# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=821 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 822 --- ## [Elastic-Agent enrollment problem](https://discuss.elastic.co/t/elastic-agent-enrollment-problem/246426)
**Author:** [@bernhard.fluehmann](https://discuss.elastic.co/u/bernhard.fluehmann)\ **Replies:** 8\ **Last updated:** [August 31, 2020, 6:17pm UTC](https://discuss.elastic.co/t/elastic-agent-enrollment-problem/246426 "2020-08-31T18:17:49Z")
I am trying to test elastic-agent and ingest-mangement, unfortunately without success so far. The agent is installed on linux machines (centos-7/8) and enrolled like described in the manuals. The agents show up in kiba… --- ## [Dangling links error](https://discuss.elastic.co/t/dangling-links-error/245601)
**Author:** [@keraghu](https://discuss.elastic.co/u/keraghu)\ **Replies:** 11\ **Last updated:** [August 31, 2020, 5:55pm UTC](https://discuss.elastic.co/t/dangling-links-error/245601 "2020-08-31T17:55:23Z")
Hi We have elastic search setup on docker swarm. The elastic search data nodes automatically restarted, but all the nodes did not up and running, then, we did manual retstart ( portainer) But now we are getting an da… --- ## [Unassigned ilm-history shard cluster in RED state](https://discuss.elastic.co/t/unassigned-ilm-history-shard-cluster-in-red-state/246970)
**Author:** [@Petr.Simik](https://discuss.elastic.co/u/Petr.Simik)\ **Replies:** 1\ **Last updated:** [August 31, 2020, 5:49pm UTC](https://discuss.elastic.co/t/unassigned-ilm-history-shard-cluster-in-red-state/246970 "2020-08-31T17:49:13Z")
dufing upgrade 7.4.2 -\> 7.9 I received an error "failed shard on node \[GnAJTEqpTeyawpDyUli4Aw\]: failed to create index, failure IllegalArgumentException\[unknown setting \[index.hidden\] please check that any required plug… --- ## [Custom ECS to Index Template](https://discuss.elastic.co/t/custom-ecs-to-index-template/245638)
**Author:** [@jakobdoering](https://discuss.elastic.co/u/jakobdoering)\ **Replies:** 7\ **Last updated:** [August 31, 2020, 4:05pm UTC](https://discuss.elastic.co/t/custom-ecs-to-index-template/245638 "2020-08-31T16:05:54Z")
Hi, we extended ECS for a specific use case where logstash is used to read some CSV, filter the data to match the custom ECS Extension and then send the data to elasticsearch. I am now wondering how to transfer my ECS e… --- ## [Index lifecycle policy is not working](https://discuss.elastic.co/t/index-lifecycle-policy-is-not-working/246792)
**Author:** [@olg32](https://discuss.elastic.co/u/olg32)\ **Replies:** 2\ **Last updated:** [August 31, 2020, 4:02pm UTC](https://discuss.elastic.co/t/index-lifecycle-policy-is-not-working/246792 "2020-08-31T16:02:06Z")
I've created a simple lifecycle policy where index records older than 10 days are deleted. Using Kibana I set the policy as follows: However, my index keeps growing by the day as I get daily index records that are o… --- ## [Field 'app.response.abc' not found; typically this occurs with arrays which are not mapped as single value](https://discuss.elastic.co/t/field-app-response-abc-not-found-typically-this-occurs-with-arrays-which-are-not-mapped-as-single-value/246968)
**Author:** [@Ayush\_Goyal](https://discuss.elastic.co/u/Ayush_Goyal)\ **Replies:** 0\ **Last updated:** [August 31, 2020, 2:14pm UTC](https://discuss.elastic.co/t/field-app-response-abc-not-found-typically-this-occurs-with-arrays-which-are-not-mapped-as-single-value/246968 "2020-08-31T14:14:15Z")
I an trying to read elastic index from hadoop but getting below error Caused by: org.elasticsearch.hadoop.EsHadoopIllegalStateException: Field 'app.response.abc' not found; typically this occurs with arrays which are n… --- ## [Elasticsearch Winlogbeats cause "caught exception while handling client http traffic"](https://discuss.elastic.co/t/elasticsearch-winlogbeats-cause-caught-exception-while-handling-client-http-traffic/246686)
**Author:** [@BenB196](https://discuss.elastic.co/u/BenB196)\ **Replies:** 2\ **Last updated:** [August 31, 2020, 1:37pm UTC](https://discuss.elastic.co/t/elasticsearch-winlogbeats-cause-caught-exception-while-handling-client-http-traffic/246686 "2020-08-31T13:37:30Z")
Hi All, I was wondering if anyone has any help for what I'm seeing. I have about 150 winlogbeats pointing to a 3 node ES cluster. Over the course of about an hour, I get about 20,000 logs of: caught exception while han… --- ## [Reduce number of results according to max result per field](https://discuss.elastic.co/t/reduce-number-of-results-according-to-max-result-per-field/246946)
**Author:** [@emr](https://discuss.elastic.co/u/emr)\ **Replies:** 0\ **Last updated:** [August 31, 2020, 12:14pm UTC](https://discuss.elastic.co/t/reduce-number-of-results-according-to-max-result-per-field/246946 "2020-08-31T12:14:45Z")
We have an index that has over 100 million data. it has a structure like this: { // ... "first\_name": "John", "last\_name": "Doe", "company": "X Company", // ... } We want to return results let's say 3 items per co… --- ## [Best way to delete large number of documents](https://discuss.elastic.co/t/best-way-to-delete-large-number-of-documents/246402)
**Author:** [@landport](https://discuss.elastic.co/u/landport)\ **Replies:** 3\ **Last updated:** [August 31, 2020, 11:40am UTC](https://discuss.elastic.co/t/best-way-to-delete-large-number-of-documents/246402 "2020-08-31T11:40:40Z")
About 10 months ago we investigated adding Elasticsearch logging to a range of consumer electronics products to track which features were being used. I used a simplistic approach with a single index and wrote to it via t… --- ## [Elastic search fail to start](https://discuss.elastic.co/t/elastic-search-fail-to-start/246876)
**Author:** [@steve2020](https://discuss.elastic.co/u/steve2020)\ **Replies:** 23\ **Last updated:** [August 31, 2020, 11:04am UTC](https://discuss.elastic.co/t/elastic-search-fail-to-start/246876 "2020-08-31T11:04:04Z")
Hi everyone, I have this issue with elasticsearch after installing successfully on fresh ubuntu 20.04 server, sudo /bin/systemctl daemon-reload sudo /bin/systemctl enable elasticsearch.service sudo systemctl start ela… --- ## [Elastic Stack memory pressure increase over time](https://discuss.elastic.co/t/elastic-stack-memory-pressure-increase-over-time/246936)
**Author:** [@sfenman](https://discuss.elastic.co/u/sfenman)\ **Replies:** 2\ **Last updated:** [August 31, 2020, 10:52am UTC](https://discuss.elastic.co/t/elastic-stack-memory-pressure-increase-over-time/246936 "2020-08-31T10:52:04Z")
Hello, Last month I have upgraded my elastic stack from 8GB Ram to 16GB since I had high memory pressure. It all worked out until last week when memory and CPU started to increase day after day without any change or inc… --- ## [Can't get a two-node cluster to work](https://discuss.elastic.co/t/cant-get-a-two-node-cluster-to-work/246140)
**Author:** [@Arp](https://discuss.elastic.co/u/Arp)\ **Replies:** 8\ **Last updated:** [August 31, 2020, 8:58am UTC](https://discuss.elastic.co/t/cant-get-a-two-node-cluster-to-work/246140 "2020-08-31T08:58:37Z")
Hi, So, I installed oss-7.9 on two VMs with RH8. All I want is a cluster with two nodes, of which one acts as a replica. I have the same config on both VMs, though of course with different IPs and node names, differen… --- ## [Multi Document Search in the Same Index](https://discuss.elastic.co/t/multi-document-search-in-the-same-index/246888)
**Author:** [@ShashikanthKomandoor](https://discuss.elastic.co/u/ShashikanthKomandoor)\ **Replies:** 2\ **Last updated:** [August 31, 2020, 8:48am UTC](https://discuss.elastic.co/t/multi-document-search-in-the-same-index/246888 "2020-08-31T08:48:33Z")
Hi Team, I am pushing the /var/log/maillog to ELK Stack version 6.X I was able to use the postfix grok filters available in github and create the indices, documents, fields and so and also I am able to see in Kibana to… --- ## [Ingest rename processor ignore empty](https://discuss.elastic.co/t/ingest-rename-processor-ignore-empty/246755)
**Author:** [@bernhard.fluehmann](https://discuss.elastic.co/u/bernhard.fluehmann)\ **Replies:** 1\ **Last updated:** [August 31, 2020, 8:17am UTC](https://discuss.elastic.co/t/ingest-rename-processor-ignore-empty/246755 "2020-08-31T08:17:38Z")
The ingest rename processor has an option ignore\_missing which does not rename a field if the field is missing. In some cases it would be helpful if the field would not be renamed if empty. E.g. with a new option ignore… --- ## [Does ElasticSearch support GRPC or will support in near future?](https://discuss.elastic.co/t/does-elasticsearch-support-grpc-or-will-support-in-near-future/246916)
**Author:** [@isuhendro](https://discuss.elastic.co/u/isuhendro)\ **Replies:** 1\ **Last updated:** [August 31, 2020, 7:40am UTC](https://discuss.elastic.co/t/does-elasticsearch-support-grpc-or-will-support-in-near-future/246916 "2020-08-31T07:40:17Z")
https://medium.com/@EmperorRXF/evaluating-performance-of-rest-vs-grpc-1b8bdf0b22da#:~:text=gRPC%20is%20roughly%207%20times,of%20HTTP%2F2%20by%20gRPC. The article above mentioned: gRPC is roughly 7 times faster than REST… --- ## [Не ищет слова меньше 4 символов](https://discuss.elastic.co/t/topic/246909)
**Author:** [@gvozdb](https://discuss.elastic.co/u/gvozdb)\ **Replies:** 0\ **Last updated:** [August 31, 2020, 6:14am UTC](https://discuss.elastic.co/t/topic/246909 "2020-08-31T06:14:23Z")
Привет! Почему-то Elasticsearch отказывается производить поиск по словам менее 4 символов. То есть, ищет от 4 символов включительно, 3 символа уже не ищет. Должен найти вот такой документ: \[pagetitle\] =\> Лувр в первый … --- ## [GPU accelerated Machine learning](https://discuss.elastic.co/t/gpu-accelerated-machine-learning/246716)
**Author:** [@nsrushi](https://discuss.elastic.co/u/nsrushi)\ **Replies:** 2\ **Last updated:** [August 31, 2020, 5:58am UTC](https://discuss.elastic.co/t/gpu-accelerated-machine-learning/246716 "2020-08-31T05:58:14Z")
hi would like to know if GPU accelerated machine learning is supported on Xpack along with SIEM (threat hunting platform) ? --- ## [Job for elasticsearch.service failed because the control process exited with error code](https://discuss.elastic.co/t/job-for-elasticsearch-service-failed-because-the-control-process-exited-with-error-code/246853)
**Author:** [@hamzakarim](https://discuss.elastic.co/u/hamzakarim)\ **Replies:** 2\ **Last updated:** [August 31, 2020, 5:03am UTC](https://discuss.elastic.co/t/job-for-elasticsearch-service-failed-because-the-control-process-exited-with-error-code/246853 "2020-08-31T05:03:52Z")
I have newly installed the Elasticsearch-7.4.2-x86\_64.rpm with rmp from the link But when i start the service it gives the below error . sudo systemctl start elasticsearch.service Job for elasticsearch.service faile… --- ## [Is it mutitenecy supported by ELK?](https://discuss.elastic.co/t/is-it-mutitenecy-supported-by-elk/246611)
**Author:** [@japarka2](https://discuss.elastic.co/u/japarka2)\ **Replies:** 4\ **Last updated:** [August 31, 2020, 4:56am UTC](https://discuss.elastic.co/t/is-it-mutitenecy-supported-by-elk/246611 "2020-08-31T04:56:14Z")
He Tam, We need to monitor multiple accounts servers from centralize location. what data collection method is used by Beat ? weather pull by ElasticSearch or push by Beat to Elastic ? if any failure in network in betw… --- ## [How to index large text string data?](https://discuss.elastic.co/t/how-to-index-large-text-string-data/246848)
**Author:** [@sandeep\_rana](https://discuss.elastic.co/u/sandeep_rana)\ **Replies:** 3\ **Last updated:** [August 31, 2020, 4:47am UTC](https://discuss.elastic.co/t/how-to-index-large-text-string-data/246848 "2020-08-31T04:47:58Z")
Why max\_bytes\_length\_exceeded\_exception while insert a doc with some large text field data.. ? --- ## [Blacklisting index pattern](https://discuss.elastic.co/t/blacklisting-index-pattern/246565)
**Author:** [@Kaustav\_Das](https://discuss.elastic.co/u/Kaustav_Das)\ **Replies:** 1\ **Last updated:** [August 31, 2020, 4:44am UTC](https://discuss.elastic.co/t/blacklisting-index-pattern/246565 "2020-08-31T04:44:19Z")
We have few indices which starts with predetermined prefix. If we want other indices which are created by es, kibana, monitoring tools like (monitoring-kibana, ml-state etc) to go to specefic tenant nodes tagged with adm… --- ## [ILM Hot to Warm: node does not match index setting](https://discuss.elastic.co/t/ilm-hot-to-warm-node-does-not-match-index-setting/246903)
**Author:** [@Camilo\_Diaz](https://discuss.elastic.co/u/Camilo_Diaz)\ **Replies:** 0\ **Last updated:** [August 31, 2020, 4:21am UTC](https://discuss.elastic.co/t/ilm-hot-to-warm-node-does-not-match-index-setting/246903 "2020-08-31T04:21:44Z")
Running Elasticsearch 7.7.17. I have an issue moving the indexes to the warm node. The indexes are on a healthy status (5 shards, 0 replicas) are in the right warm phase but I don't know why they don't move: GET /netw… --- ## [How to aggregate multiple Host from diffrent account in Elastic stack to support mutitenecey](https://discuss.elastic.co/t/how-to-aggregate-multiple-host-from-diffrent-account-in-elastic-stack-to-support-mutitenecey/246898)
**Author:** [@japarka2](https://discuss.elastic.co/u/japarka2)\ **Replies:** 1\ **Last updated:** [August 31, 2020, 4:13am UTC](https://discuss.elastic.co/t/how-to-aggregate-multiple-host-from-diffrent-account-in-elastic-stack-to-support-mutitenecey/246898 "2020-08-31T04:13:35Z")
How to aggregate multiple Host from different account in Elastic stack to support mutitenecey! We have thousand of thousand system(linux and Windows) from multiple account for monitoring using Beat. How we can aggregat… --- ## [Error with pyspark connect es](https://discuss.elastic.co/t/error-with-pyspark-connect-es/246560)
**Author:** [@sophieag](https://discuss.elastic.co/u/sophieag)\ **Replies:** 0\ **Last updated:** [August 27, 2020, 6:55am UTC](https://discuss.elastic.co/t/error-with-pyspark-connect-es/246560 "2020-08-27T06:55:08Z")
I use the below code to write spark dataframe data to es. df.write.format("org.elasticsearch.spark.sql").option("es.nodes","172.17.37.88,172.17.37.89,172.17.37.90").option("es.resource", "pyspark\_es/data").option("es.ma… --- ## [Elasticsearch stop working properly](https://discuss.elastic.co/t/elasticsearch-stop-working-properly/246729)
**Author:** [@esther4](https://discuss.elastic.co/u/esther4)\ **Replies:** 1\ **Last updated:** [August 31, 2020, 3:51am UTC](https://discuss.elastic.co/t/elasticsearch-stop-working-properly/246729 "2020-08-31T03:51:25Z")
One of the Elasticsearch logs shown the following warning messages after start the ES service \[2020-07-06T08:58:21,968\]Failed to update node information for ClusterInfoUpdateJob within 15s timeout \[2020-07-06T08:58:21,9… --- ## [Can not run elastic after add keystore](https://discuss.elastic.co/t/can-not-run-elastic-after-add-keystore/244347)
**Author:** [@AayushPatel](https://discuss.elastic.co/u/AayushPatel)\ **Replies:** 6\ **Last updated:** [August 31, 2020, 3:46am UTC](https://discuss.elastic.co/t/can-not-run-elastic-after-add-keystore/244347 "2020-08-31T03:46:47Z")
Hi Recently trying to use elasticsearch keystore when I trying to restart elastic service when a new key added like "mypassword" to created elasticsearch.keystore, got a weird error Aug 10 10:08:04 debian elasticsearc… --- ## [Audit log file does not appear in the node](https://discuss.elastic.co/t/audit-log-file-does-not-appear-in-the-node/246684)
**Author:** [@kasscharal](https://discuss.elastic.co/u/kasscharal)\ **Replies:** 1\ **Last updated:** [August 31, 2020, 3:43am UTC](https://discuss.elastic.co/t/audit-log-file-does-not-appear-in-the-node/246684 "2020-08-31T03:43:11Z")
In my Elasticsearch cluster (version 7.6.2 - installed using the elasticsearch.k8s.elastic.co/v1 resource) I have set xpack.security.audit.enabled to true under my nodeSets: GET /\_xpack/usage ... "audit" : { "… --- ## [Eorror "entity content is too long \[\] for the configured buffer limit \[104857600\]"](https://discuss.elastic.co/t/eorror-entity-content-is-too-long-for-the-configured-buffer-limit-104857600/246715)
**Author:** [@xodn0812](https://discuss.elastic.co/u/xodn0812)\ **Replies:** 1\ **Last updated:** [August 31, 2020, 3:41am UTC](https://discuss.elastic.co/t/eorror-entity-content-is-too-long-for-the-configured-buffer-limit-104857600/246715 "2020-08-31T03:41:45Z")
When searching for large data, a log of entity content is too long \[\] for the configured buffer limit \[104857600\] occurs. I looked up and said that I can put http.max\_content\_length, but it doesn't work. I saw some art… --- ## [Feature request / query templates reusable](https://discuss.elastic.co/t/feature-request-query-templates-reusable/246771)
**Author:** [@joropito](https://discuss.elastic.co/u/joropito)\ **Replies:** 1\ **Last updated:** [August 31, 2020, 3:37am UTC](https://discuss.elastic.co/t/feature-request-query-templates-reusable/246771 "2020-08-31T03:37:38Z")
Hi all! Please I would like to see query teamplates to be reusable on any query like this { "template\_search": { "params": { ....... these params will be used by defaults, child params supercedes this ones ..... … --- ## [Getting 504 on using aggs](https://discuss.elastic.co/t/getting-504-on-using-aggs/246807)
**Author:** [@rishav\_agarwal](https://discuss.elastic.co/u/rishav_agarwal)\ **Replies:** 1\ **Last updated:** [August 31, 2020, 3:36am UTC](https://discuss.elastic.co/t/getting-504-on-using-aggs/246807 "2020-08-31T03:36:54Z")
Hi, I am a new ES user, I type the following query, I get back results: POST /test\_index/\_search { "query": { "bool": { "filter": \[ { "term": { "id": "123456" } … [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=820) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=822)