# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=829 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 830 --- ## [Wildcard datatype lowercase](https://discuss.elastic.co/t/wildcard-datatype-lowercase/245726)
**Author:** [@covolution](https://discuss.elastic.co/u/covolution)\ **Replies:** 1\ **Last updated:** [August 20, 2020, 9:00am UTC](https://discuss.elastic.co/t/wildcard-datatype-lowercase/245726 "2020-08-20T09:00:45Z")
I am looking at the Wildcard datatype introduced in 7.9. I would like to normalize it first by lowercasing and removing whitespace. I can't work out the syntax. "normalizer" and "analyzer" don't seem to be supported. --- ## [How to escape special characters in regexp](https://discuss.elastic.co/t/how-to-escape-special-characters-in-regexp/245727)
**Author:** [@Krishna\_Sai\_Nag\_G](https://discuss.elastic.co/u/Krishna_Sai_Nag_G)\ **Replies:** 0\ **Last updated:** [August 20, 2020, 8:17am UTC](https://discuss.elastic.co/t/how-to-escape-special-characters-in-regexp/245727 "2020-08-20T08:17:03Z")
How to escape special characters in regular expression query GET my\_index/\_search { "\_source": \["file.filename"\], "query": { "regexp": { "content": "KRISHNA\\-\\1H3\[a-zA-Z0-9\]\*" } }, "highlight": { "fields": { "… --- ## [Enterprise Certs](https://discuss.elastic.co/t/enterprise-certs/245723)
**Author:** [@nitin7](https://discuss.elastic.co/u/nitin7)\ **Replies:** 0\ **Last updated:** [August 20, 2020, 8:00am UTC](https://discuss.elastic.co/t/enterprise-certs/245723 "2020-08-20T08:00:55Z")
Hi, I am setting up TLS on the transport layer. If I use the certs generated from the elastic search cert util then node trust the certificate and all works but when I am trying to use enterprise certs I get the error … --- ## [Inner\_hits with elasticsearch-hadoop](https://discuss.elastic.co/t/inner-hits-with-elasticsearch-hadoop/245580)
**Author:** [@HadoopMarc](https://discuss.elastic.co/u/HadoopMarc)\ **Replies:** 1\ **Last updated:** [August 20, 2020, 7:44am UTC](https://discuss.elastic.co/t/inner-hits-with-elasticsearch-hadoop/245580 "2020-08-20T07:44:48Z")
Trying here to use a nested query with inner\_hits in combination with elasticsearch-hadoop. I use es-6.8.1 via python using: df = spark.read.format("org.elasticsearch.spark.sql") I specify the "es.read.metadata": "tru… --- ## [How to settings threadpool on elastic cloud?](https://discuss.elastic.co/t/how-to-settings-threadpool-on-elastic-cloud/245544)
**Author:** [@chautm](https://discuss.elastic.co/u/chautm)\ **Replies:** 5\ **Last updated:** [August 20, 2020, 5:11am UTC](https://discuss.elastic.co/t/how-to-settings-threadpool-on-elastic-cloud/245544 "2020-08-20T05:11:55Z")
My project using elastic cloud but reject error: EsThreadPoolExecutor\[name = instance-0000000003/write, queue capacity = 200 On breaking change description "Thread pool settings are now node-level settings. As such, it… --- ## [Cant connect second Elastic node](https://discuss.elastic.co/t/cant-connect-second-elastic-node/245648)
**Author:** [@mmax](https://discuss.elastic.co/u/mmax)\ **Replies:** 0\ **Last updated:** [August 19, 2020, 4:10pm UTC](https://discuss.elastic.co/t/cant-connect-second-elastic-node/245648 "2020-08-19T16:10:25Z")
Hi, I'm mounting a ELK cluster elastic-node1 elastic-node2 kibana-node1 (logstash will created after) I have one node elastic who's connected to kibana, i set up xpack.security / transport ssl, with elasticnode-1 i… --- ## [Delete old logs](https://discuss.elastic.co/t/delete-old-logs/245268)
**Author:** [@headtea](https://discuss.elastic.co/u/headtea)\ **Replies:** 13\ **Last updated:** [August 20, 2020, 7:30am UTC](https://discuss.elastic.co/t/delete-old-logs/245268 "2020-08-20T07:30:50Z")
Is it possible to have logs older than 3 month deleted? Or set a size limit? Is it possible to do so from Kibana? Thanks ahead! --- ## [Combine two nested text fields using script](https://discuss.elastic.co/t/combine-two-nested-text-fields-using-script/245718)
**Author:** [@AntonyUkken](https://discuss.elastic.co/u/AntonyUkken)\ **Replies:** 0\ **Last updated:** [August 20, 2020, 7:21am UTC](https://discuss.elastic.co/t/combine-two-nested-text-fields-using-script/245718 "2020-08-20T07:21:40Z")
I need to combine two text nested fields to a new field using scripts. POST script/\_update\_by\_query { "script": { "source": """ ctx.\_source.example = ctx.\_source.field1 + '\_' + ctx.\_source.field2 """, … --- ## [Regular expressions](https://discuss.elastic.co/t/regular-expressions/245716)
**Author:** [@Krishna\_Sai\_Nag\_G](https://discuss.elastic.co/u/Krishna_Sai_Nag_G)\ **Replies:** 0\ **Last updated:** [August 20, 2020, 7:08am UTC](https://discuss.elastic.co/t/regular-expressions/245716 "2020-08-20T07:08:14Z")
I have a word like this in my text, "KRISHNA-1H3" How to searh this word using regular expressions in kibana? and how to use regular expression for special characters? I am using this query: GET my\_index/\_search { … --- ## [Failed to authenticate user elastic](https://discuss.elastic.co/t/failed-to-authenticate-user-elastic/245604)
**Author:** [@Divyabharathi](https://discuss.elastic.co/u/Divyabharathi)\ **Replies:** 3\ **Last updated:** [August 20, 2020, 5:10am UTC](https://discuss.elastic.co/t/failed-to-authenticate-user-elastic/245604 "2020-08-20T05:10:11Z")
I have 3 instances of elasticsearch 7.6 (2-master+data & 1- data). Cluster name is same in all three instances. I have enabled the security using xpack.security.enabled=true and xpack.security.transport.ssl.enabled=true … --- ## [Negative free swap space size](https://discuss.elastic.co/t/negative-free-swap-space-size/242626)
**Author:** [@teebu](https://discuss.elastic.co/u/teebu)\ **Replies:** 3\ **Last updated:** [August 20, 2020, 3:45am UTC](https://discuss.elastic.co/t/negative-free-swap-space-size/242626 "2020-08-20T03:45:22Z")
I installed ES 7.8.0 to my local kubernetes cluster using the helm chart into my docker-for-windows and WSL2. I'm seeing this error message in my logs constantly. {"type": "server", "timestamp": "2020-07-26T03:23:47,931… --- ## [Search.totalhits breaking change in ES 7: Java rest client 6.7](https://discuss.elastic.co/t/search-totalhits-breaking-change-in-es-7-java-rest-client-6-7/245690)
**Author:** [@Musfiqur\_Siddique](https://discuss.elastic.co/u/Musfiqur_Siddique)\ **Replies:** 0\ **Last updated:** [August 20, 2020, 1:30am UTC](https://discuss.elastic.co/t/search-totalhits-breaking-change-in-es-7-java-rest-client-6-7/245690 "2020-08-20T01:30:22Z")
Before ES 7, search.totalhits was a number. In ES 7, it is an object with a value and relation. The behavior can be retained by setting track\_total\_hits=true and rest\_total\_hits\_as\_int=true in search request. But how to… --- ## [How to view the history of tasks/activities in elasticsearch by all superusers](https://discuss.elastic.co/t/how-to-view-the-history-of-tasks-activities-in-elasticsearch-by-all-superusers/245658)
**Author:** [@ELK\_User\_Arun](https://discuss.elastic.co/u/ELK_User_Arun)\ **Replies:** 1\ **Last updated:** [August 19, 2020, 11:02pm UTC](https://discuss.elastic.co/t/how-to-view-the-history-of-tasks-activities-in-elasticsearch-by-all-superusers/245658 "2020-08-19T23:02:14Z")
Hi All, I would like to know if there is a possibility of viewing the recent changes (history) made to the ELK stack. Because I witnessed that the stack is missing quite a huge number of shards this morning but the requ… --- ## [How to enable memory lock](https://discuss.elastic.co/t/how-to-enable-memory-lock/245674)
**Author:** [@AshokBachchan](https://discuss.elastic.co/u/AshokBachchan)\ **Replies:** 1\ **Last updated:** [August 19, 2020, 11:00pm UTC](https://discuss.elastic.co/t/how-to-enable-memory-lock/245674 "2020-08-19T23:00:14Z")
Hi All, We are unable to lock the memory for elasticsearch, our OS is CentOS Linux 7 (Core) ES cluster is not giving proper performance. what is the recommendation on this???. Please suggest us. GET \_nodes?filter\_pa… --- ## [Reindexing packetbeats](https://discuss.elastic.co/t/reindexing-packetbeats/245511)
**Author:** [@Zead](https://discuss.elastic.co/u/Zead)\ **Replies:** 5\ **Last updated:** [August 19, 2020, 10:58pm UTC](https://discuss.elastic.co/t/reindexing-packetbeats/245511 "2020-08-19T22:58:43Z")
Ok i have been following this tutorial and i have almost completed it to predict. but when i am trying to reindex the packetbeat i am only reindexing the previous data not actually live. so how can i capture the pa… --- ## [Rest API version compatibility](https://discuss.elastic.co/t/rest-api-version-compatibility/245679)
**Author:** [@Musfiqur\_Siddique](https://discuss.elastic.co/u/Musfiqur_Siddique)\ **Replies:** 0\ **Last updated:** [August 19, 2020, 9:18pm UTC](https://discuss.elastic.co/t/rest-api-version-compatibility/245679 "2020-08-19T21:18:07Z")
Will we see this feature while upgrading to ES 8? I am asking this because we were in the process of creating a version independent rest adapter for upgrades. If this feature becomes available, we no longer need it. --- ## [Apply Filter on a field of array values](https://discuss.elastic.co/t/apply-filter-on-a-field-of-array-values/245660)
**Author:** [@aniaks](https://discuss.elastic.co/u/aniaks)\ **Replies:** 0\ **Last updated:** [August 19, 2020, 5:53pm UTC](https://discuss.elastic.co/t/apply-filter-on-a-field-of-array-values/245660 "2020-08-19T17:53:15Z")
How do we filter values for the field containing the values as arrays. Applying query and aggregation level filter still returns all the values in the doc and not the values only in the filters. is there a way to do this… --- ## [Elastic field include exclude performance](https://discuss.elastic.co/t/elastic-field-include-exclude-performance/245255)
**Author:** [@aniaks](https://discuss.elastic.co/u/aniaks)\ **Replies:** 2\ **Last updated:** [August 19, 2020, 5:51pm UTC](https://discuss.elastic.co/t/elastic-field-include-exclude-performance/245255 "2020-08-19T17:51:29Z")
Is performance bad when applying include or exclude on a field? currently we apply top filter and then apply include or exclude on a field , in this situation is it going to affect the performance? --- ## [Bug?: nested object mapping won't include both include\_in\_parent and include\_in\_root](https://discuss.elastic.co/t/bug-nested-object-mapping-wont-include-both-include-in-parent-and-include-in-root/245650)
**Author:** [@Luke\_Nezda](https://discuss.elastic.co/u/Luke_Nezda)\ **Replies:** 0\ **Last updated:** [August 19, 2020, 4:17pm UTC](https://discuss.elastic.co/t/bug-nested-object-mapping-wont-include-both-include-in-parent-and-include-in-root/245650 "2020-08-19T16:17:16Z")
When I specify a nested object mapping with both include\_in\_parent and include\_in\_root it only uses include\_in\_parent. This feels like a bug. (Elasticsearch version 7.8.0) Please advise. - Luke Test case PUT bar { … --- ## [How to dynamically pass range query variables](https://discuss.elastic.co/t/how-to-dynamically-pass-range-query-variables/245647)
**Author:** [@kelk](https://discuss.elastic.co/u/kelk)\ **Replies:** 0\ **Last updated:** [August 19, 2020, 4:08pm UTC](https://discuss.elastic.co/t/how-to-dynamically-pass-range-query-variables/245647 "2020-08-19T16:08:53Z")
hi We need to pass dynamic values into the filter range query within watcher, using a "painless" script. something like below "filter": \[ { "range": { "@timestamp": { "lte": "now-{{dynamicValueLte}… --- ## [Strange balancing in 3 node cluster](https://discuss.elastic.co/t/strange-balancing-in-3-node-cluster/245608)
**Author:** [@robertitox](https://discuss.elastic.co/u/robertitox)\ **Replies:** 4\ **Last updated:** [August 19, 2020, 2:57pm UTC](https://discuss.elastic.co/t/strange-balancing-in-3-node-cluster/245608 "2020-08-19T14:57:30Z")
Hi people, I have a 3 node cluster: Node 1 node.master: true node.voting\_only: false node.data: true Node 2 node master: true node.voting\_only: false node.data: true Node 3 node.master: true node.voting\_only:… --- ## [Unable to restore snapshot from URL repository with basic authentication](https://discuss.elastic.co/t/unable-to-restore-snapshot-from-url-repository-with-basic-authentication/245628)
**Author:** [@Aswin\_Kumar](https://discuss.elastic.co/u/Aswin_Kumar)\ **Replies:** 0\ **Last updated:** [August 19, 2020, 2:51pm UTC](https://discuss.elastic.co/t/unable-to-restore-snapshot-from-url-repository-with-basic-authentication/245628 "2020-08-19T14:51:04Z")
Problem: I'm trying to create snapshot on ES instance ES1, and restore to another instance ES2. It fails to restore when the remote URL requires basic authentication. ES version: 6.5.4 Success and failure cases: Succes… --- ## [Password reset of elastic user](https://discuss.elastic.co/t/password-reset-of-elastic-user/245096)
**Author:** [@bhargav\_bharat](https://discuss.elastic.co/u/bhargav_bharat)\ **Replies:** 3\ **Last updated:** [August 19, 2020, 2:17pm UTC](https://discuss.elastic.co/t/password-reset-of-elastic-user/245096 "2020-08-19T14:17:42Z")
I lost my "elastic" user password and now I am unable to change. Error I am getting when I run below mention command. root@siem:/usr/share/elasticsearch/bin# ./elasticsearch-setup-passwords interactive Failed to auth… --- ## [How to re-analyze data that has already been ingested?](https://discuss.elastic.co/t/how-to-re-analyze-data-that-has-already-been-ingested/245612)
**Author:** [@Stephan\_Stachurski](https://discuss.elastic.co/u/Stephan_Stachurski)\ **Replies:** 1\ **Last updated:** [August 19, 2020, 1:44pm UTC](https://discuss.elastic.co/t/how-to-re-analyze-data-that-has-already-been-ingested/245612 "2020-08-19T13:44:02Z")
I was trying to figure out how to extract a field from a set of log messages, and most of the answers online suggest that you should handle this upstream, by using dissect on filebeat or something like that. What do I d… --- ## [Reason for version downgrade not supported](https://discuss.elastic.co/t/reason-for-version-downgrade-not-supported/245200)
**Author:** [@shivani\_aggarwal](https://discuss.elastic.co/u/shivani_aggarwal)\ **Replies:** 7\ **Last updated:** [August 19, 2020, 1:04pm UTC](https://discuss.elastic.co/t/reason-for-version-downgrade-not-supported/245200 "2020-08-19T13:04:47Z")
Hi, Elastic documentation states that version downgrade is not supported. https://www.elastic.co/guide/en/elasticsearch/reference/7.8/setup-upgrade.html - In-place downgrades to earlier versions are not supported. To … --- ## [(Ingest Pipeline) Grok on an Array using Foreach -\> Pipeline processors](https://discuss.elastic.co/t/ingest-pipeline-grok-on-an-array-using-foreach-pipeline-processors/245436)
**Author:** [@BkQc](https://discuss.elastic.co/u/BkQc)\ **Replies:** 1\ **Last updated:** [August 19, 2020, 1:00pm UTC](https://discuss.elastic.co/t/ingest-pipeline-grok-on-an-array-using-foreach-pipeline-processors/245436 "2020-08-19T13:00:21Z")
Hello, I have a document structure that looks like the example at the end and the pipeline is just after. I tried building a pipeline that would then use a foreach processor to call a pipeline in which I used a grok pr… --- ## [Unknown Host Exception While running elasticsearch using docker-compose on Mac](https://discuss.elastic.co/t/unknown-host-exception-while-running-elasticsearch-using-docker-compose-on-mac/245596)
**Author:** [@sab20](https://discuss.elastic.co/u/sab20)\ **Replies:** 0\ **Last updated:** [August 19, 2020, 12:19pm UTC](https://discuss.elastic.co/t/unknown-host-exception-while-running-elasticsearch-using-docker-compose-on-mac/245596 "2020-08-19T12:19:28Z")
Hello all, I am pretty new to elasticsearch & docker. I am trying to deploy my application using docker-compose. It seemed to be working fine on Windows. Suddenly, I am facing following issue on Mac Os. My search-label… --- ## [Understanding of recommended ES Cluster Architecture](https://discuss.elastic.co/t/understanding-of-recommended-es-cluster-architecture/243243)
**Author:** [@neldreth](https://discuss.elastic.co/u/neldreth)\ **Replies:** 5\ **Last updated:** [July 31, 2020, 5:47pm UTC](https://discuss.elastic.co/t/understanding-of-recommended-es-cluster-architecture/243243 "2020-07-31T17:47:21Z")
I am currently working on designing a ELK Domain via AWS ES Service, and I trying to decided how many dedicated master, data, ingest, etc. nodes I require. I am ingesting data from AWS Cloudtrail via Lambda, bringing in… --- ## [Multiple filters with Ruby DSL](https://discuss.elastic.co/t/multiple-filters-with-ruby-dsl/245417)
**Author:** [@ozgurozan](https://discuss.elastic.co/u/ozgurozan)\ **Replies:** 1\ **Last updated:** [August 19, 2020, 12:24pm UTC](https://discuss.elastic.co/t/multiple-filters-with-ruby-dsl/245417 "2020-08-19T12:24:44Z")
Hi I'm trying to implement multiple filters inside one query with Ruby DSL API, but couldn't figure out how to do it from the documentation. Since "filtered" queries are removed since ES 2.0 I have to use the "boolean" … --- ## [Query connected and seperated words (ie: everybody - every body)](https://discuss.elastic.co/t/query-connected-and-seperated-words-ie-everybody-every-body/245403)
**Author:** [@ziv](https://discuss.elastic.co/u/ziv)\ **Replies:** 5\ **Last updated:** [August 19, 2020, 11:32am UTC](https://discuss.elastic.co/t/query-connected-and-seperated-words-ie-everybody-every-body/245403 "2020-08-19T11:32:04Z")
I have a document with the following description: "we have a lot of skin care products". and when I'm trying to query with the word "skincare" I get score 0. is there a tokenizer for this case? to treat words like ski… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=828) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=830)