# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=836 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 837 --- ## [Calculate disk usage](https://discuss.elastic.co/t/calculate-disk-usage/244571)
**Author:** [@headtea](https://discuss.elastic.co/u/headtea)\ **Replies:** 11\ **Last updated:** [August 13, 2020, 11:11am UTC](https://discuss.elastic.co/t/calculate-disk-usage/244571 "2020-08-13T11:11:40Z")
I've deployed a test cluster that feeds from about 5 servers. I was asked to spec out the disk requirement once 50 servers would feed it logs with ILM setup (ILM should delete logs older than 3 month or 1 year - haven't… --- ## [Exact phrase search](https://discuss.elastic.co/t/exact-phrase-search/244765)
**Author:** [@AmitaS](https://discuss.elastic.co/u/AmitaS)\ **Replies:** 2\ **Last updated:** [August 13, 2020, 11:10am UTC](https://discuss.elastic.co/t/exact-phrase-search/244765 "2020-08-13T11:10:26Z")
HI, I am new to elastic search.i wanted to know how to query for exact search. Example if am searching for "charlie" and i have "charlie chaplin" ,"charlie walter","charlie","charlie123" i am expecting result only "… --- ## [Index lifecycle error: illegal\_argument\_exception: index.lifecycle.rollover\_alias \[filebeat\] does not point to index \[filebeat-7.8.1-2020.08.12-000001\]](https://discuss.elastic.co/t/index-lifecycle-error-illegal-argument-exception-index-lifecycle-rollover-alias-filebeat-does-not-point-to-index-filebeat-7-8-1-2020-08-12-000001/244864)
**Author:** [@oicfar](https://discuss.elastic.co/u/oicfar)\ **Replies:** 0\ **Last updated:** [August 13, 2020, 11:00am UTC](https://discuss.elastic.co/t/index-lifecycle-error-illegal-argument-exception-index-lifecycle-rollover-alias-filebeat-does-not-point-to-index-filebeat-7-8-1-2020-08-12-000001/244864 "2020-08-13T11:00:07Z")
Hi, currently I have this error: Index lifecycle error illegal\_argument\_exception: index.lifecycle.rollover\_alias \[filebeat\] does not point to index \[filebeat-7.8.1-2020.08.12-000001\] ILM infos $ curl -X GET "localh… --- ## [How to create a multi field mapping for a geo\_shape / text field?](https://discuss.elastic.co/t/how-to-create-a-multi-field-mapping-for-a-geo-shape-text-field/244559)
**Author:** [@zachsa](https://discuss.elastic.co/u/zachsa)\ **Replies:** 4\ **Last updated:** [August 13, 2020, 10:39am UTC](https://discuss.elastic.co/t/how-to-create-a-multi-field-mapping-for-a-geo-shape-text-field/244559 "2020-08-13T10:39:24Z")
I saw this thread - https://discuss.elastic.co/t/cant-create-geo-shape-multi-field/19034. It looks like it's not possible to create a multi field that includes the type 'geo\_shape' and 'keyword'? In my particular case I… --- ## [Elasticsearch cluster architecture](https://discuss.elastic.co/t/elasticsearch-cluster-architecture/244057)
**Author:** [@parthmaniar](https://discuss.elastic.co/u/parthmaniar)\ **Replies:** 15\ **Last updated:** [August 13, 2020, 9:18am UTC](https://discuss.elastic.co/t/elasticsearch-cluster-architecture/244057 "2020-08-13T09:18:15Z")
I am planning to deploy a cluster with 2 nodes. Following is the proposed architecture, I would like a community review. Purpose: Non-enterprise. Final year project that will be collecting data from internet sensors (… --- ## [Non master node not able to join a master node](https://discuss.elastic.co/t/non-master-node-not-able-to-join-a-master-node/244825)
**Author:** [@dishant.chawla.338](https://discuss.elastic.co/u/dishant.chawla.338)\ **Replies:** 2\ **Last updated:** [August 13, 2020, 8:58am UTC](https://discuss.elastic.co/t/non-master-node-not-able-to-join-a-master-node/244825 "2020-08-13T08:58:36Z")
I'm initializing a cluster with 2 node setup more nodes will be joining the cluster in near future.Both nodes are on different machine. One node will be a master node with the below configuration: transport.host: local… --- ## [Question of NormalFlush](https://discuss.elastic.co/t/question-of-normalflush/244823)
**Author:** [@Charele](https://discuss.elastic.co/u/Charele)\ **Replies:** 0\ **Last updated:** [August 13, 2020, 8:18am UTC](https://discuss.elastic.co/t/question-of-normalflush/244823 "2020-08-13T08:18:35Z")
I have a question,here, who can resolve my question?Thanks! --- ## [Problem for using regexp in DSL](https://discuss.elastic.co/t/problem-for-using-regexp-in-dsl/244809)
**Author:** [@Mrzhuang007](https://discuss.elastic.co/u/Mrzhuang007)\ **Replies:** 1\ **Last updated:** [August 13, 2020, 8:07am UTC](https://discuss.elastic.co/t/problem-for-using-regexp-in-dsl/244809 "2020-08-13T08:07:22Z")
ES version: 6.8.6 use something like this GET \_search { "query": { "regexp": { "message": ".\*error.\*" } } } I can get some result, for example { "\_index" : "filebeat-6.8.6-2020.08.13", … --- ## [Mapper\_parsing\_exception](https://discuss.elastic.co/t/mapper-parsing-exception/244695)
**Author:** [@venugrd](https://discuss.elastic.co/u/venugrd)\ **Replies:** 6\ **Last updated:** [August 13, 2020, 7:38am UTC](https://discuss.elastic.co/t/mapper-parsing-exception/244695 "2020-08-13T07:38:02Z")
Hi I am facing mapper parsing exception, when i store data in elastic index. please help me to fix this issue Error: Log: 2020-08-11 20:50:31,423 ERROR SQL elastic insert error: ('7 document(s) failed to index.', \[{'i… --- ## [Access nested aggregations in watcher's condition](https://discuss.elastic.co/t/access-nested-aggregations-in-watchers-condition/244555)
**Author:** [@Alexandros888](https://discuss.elastic.co/u/Alexandros888)\ **Replies:** 13\ **Last updated:** [August 13, 2020, 7:35am UTC](https://discuss.elastic.co/t/access-nested-aggregations-in-watchers-condition/244555 "2020-08-13T07:35:48Z")
Hello, I have the following watcher alert that calculates the ratio of orders/searches for each of my customers and returns it with an email. { "trigger": { "schedule": { "cron": "0 0/2 \* 1/1 \* ? \*" } … --- ## [How to contact support to upgrade license?](https://discuss.elastic.co/t/how-to-contact-support-to-upgrade-license/244808)
**Author:** [@syafeera](https://discuss.elastic.co/u/syafeera)\ **Replies:** 1\ **Last updated:** [August 13, 2020, 7:02am UTC](https://discuss.elastic.co/t/how-to-contact-support-to-upgrade-license/244808 "2020-08-13T07:02:56Z")
Hi, I want to upgrade my basic license to enterprise..Whereis the place to contact for the license? and If i upgrade to other licenses, is there any effect or issues in my elastic search configuration for my basic licen… --- ## [Node addition failed](https://discuss.elastic.co/t/node-addition-failed/244523)
**Author:** [@faraz](https://discuss.elastic.co/u/faraz)\ **Replies:** 33\ **Last updated:** [August 13, 2020, 3:03am UTC](https://discuss.elastic.co/t/node-addition-failed/244523 "2020-08-13T03:03:33Z")
Hi Team, I am new in elasticsearch and trying to add new node on cluster getting this error. Please Help. \[WARN \]\[o.e.c.c.ClusterFormationFailureHelper\] \[Elastic-2\] master not discovered yet, this node has not previous… --- ## [Elastic 2 Cluster Setup upgrade](https://discuss.elastic.co/t/elastic-2-cluster-setup-upgrade/244737)
**Author:** [@adwaitjoshi](https://discuss.elastic.co/u/adwaitjoshi)\ **Replies:** 4\ **Last updated:** [August 13, 2020, 2:44am UTC](https://discuss.elastic.co/t/elastic-2-cluster-setup-upgrade/244737 "2020-08-13T02:44:19Z")
I have 2 elastic machines M1 and M2 They both are master eligible and replicas of each other. I need to rebuild M1. But when I do that and reinstall everything on this box. M1 doesn't join back M2. I am assuming that M… --- ## [Is it safe to write into a green index in a red cluster?](https://discuss.elastic.co/t/is-it-safe-to-write-into-a-green-index-in-a-red-cluster/244743)
**Author:** [@wenhoujx](https://discuss.elastic.co/u/wenhoujx)\ **Replies:** 1\ **Last updated:** [August 12, 2020, 10:10pm UTC](https://discuss.elastic.co/t/is-it-safe-to-write-into-a-green-index-in-a-red-cluster/244743 "2020-08-12T22:10:54Z")
hello, IIUC, i can write documents to a green index even if the cluster is red and trying to allocating shards. but is it safe to do it? anything i should watch out for? Thanks --- ## [Pulling elasticsearch-oss images](https://discuss.elastic.co/t/pulling-elasticsearch-oss-images/244758)
**Author:** [@nugusbayevkk](https://discuss.elastic.co/u/nugusbayevkk)\ **Replies:** 2\ **Last updated:** [August 12, 2020, 10:10pm UTC](https://discuss.elastic.co/t/pulling-elasticsearch-oss-images/244758 "2020-08-12T22:10:06Z")
Hello, Starting today pulling images requires authentication. docker pull docker.elastic.co/elasticsearch/elasticsearch:7.8.1 Error response from daemon: Get https://docker.elastic.co/v2/elasticsearch/elasticsearch/man… --- ## [Nginx in front of ES / SSL cert issue - ELK watcher webhook to enable / disable watcher fails](https://discuss.elastic.co/t/nginx-in-front-of-es-ssl-cert-issue-elk-watcher-webhook-to-enable-disable-watcher-fails/244640)
**Author:** [@adam.klein](https://discuss.elastic.co/u/adam.klein)\ **Replies:** 2\ **Last updated:** [August 12, 2020, 8:48pm UTC](https://discuss.elastic.co/t/nginx-in-front-of-es-ssl-cert-issue-elk-watcher-webhook-to-enable-disable-watcher-fails/244640 "2020-08-12T20:48:06Z")
Running Elastic 7.8.0 locally, three elastic, two kibana, two logstash. One nginx load-balancer in front of the two kibana nodes and another nginx load-balancer in front of the three elastic nodes. Setting up a custom … --- ## [Bulk operation failing to index first document without attachment field](https://discuss.elastic.co/t/bulk-operation-failing-to-index-first-document-without-attachment-field/244777)
**Author:** [@russinholi](https://discuss.elastic.co/u/russinholi)\ **Replies:** 3\ **Last updated:** [August 12, 2020, 8:01pm UTC](https://discuss.elastic.co/t/bulk-operation-failing-to-index-first-document-without-attachment-field/244777 "2020-08-12T20:01:11Z")
Hi all I'm using Elasticsearch 7.8 and I'm having an weird situation while using bulk operation to index some documents, that might have or not attachment the them, like if run the following command: curl -X POST "local… --- ## [Save PySpark DataFRame to ElasticSEarch index](https://discuss.elastic.co/t/save-pyspark-dataframe-to-elasticsearch-index/244581)
**Author:** [@larryrodrigues](https://discuss.elastic.co/u/larryrodrigues)\ **Replies:** 1\ **Last updated:** [August 12, 2020, 5:08pm UTC](https://discuss.elastic.co/t/save-pyspark-dataframe-to-elasticsearch-index/244581 "2020-08-12T17:08:15Z")
Using Spark 2.6 and elasticsearch 6.8 I am trying to save a PySpark DataFrame to elasticsearch index using the external library: df\_to\_save.write.format('org.elasticsearch.spark.sql').option('es.resource', '%s/%s' % ('… --- ## [Creating certs for kibana connecting to elastic](https://discuss.elastic.co/t/creating-certs-for-kibana-connecting-to-elastic/244236)
**Author:** [@AirJordan](https://discuss.elastic.co/u/AirJordan)\ **Replies:** 2\ **Last updated:** [August 12, 2020, 4:13pm UTC](https://discuss.elastic.co/t/creating-certs-for-kibana-connecting-to-elastic/244236 "2020-08-12T16:13:23Z")
So I am doing a demo of Elastic SIEM. Everything is working fine using http. Only a one server setup. Basic minimum, testing using PoC Domain. I do for the future want to know how to create certs using our domain using A… --- ## [Problems using ingest-geoip in elasticsearch](https://discuss.elastic.co/t/problems-using-ingest-geoip-in-elasticsearch/244744)
**Author:** [@mtudisco](https://discuss.elastic.co/u/mtudisco)\ **Replies:** 0\ **Last updated:** [August 12, 2020, 2:58pm UTC](https://discuss.elastic.co/t/problems-using-ingest-geoip-in-elasticsearch/244744 "2020-08-12T14:58:04Z")
Hi, I'm using elasticsearch 7.4 and have some data indexed with ip in a field. Now i want to use a pipeline to reindex that data and generate geoip information with the ingest-geoip. I created an ingest and if i use it … --- ## [Need Architecture Support](https://discuss.elastic.co/t/need-architecture-support/244457)
**Author:** [@Rohit\_Kumbhar](https://discuss.elastic.co/u/Rohit_Kumbhar)\ **Replies:** 2\ **Last updated:** [August 12, 2020, 2:21pm UTC](https://discuss.elastic.co/t/need-architecture-support/244457 "2020-08-12T14:21:24Z")
Hello, I want help to setup Server for ELK stack Client will send Logs on UDP port on logstash average EPS will be 2000 eps. I want help regarding How many Elastic and Logstash server will be needed, and what should b… --- ## [Number\_format\_exception in check-rollover-ready step](https://discuss.elastic.co/t/number-format-exception-in-check-rollover-ready-step/244609)
**Author:** [@patrykga](https://discuss.elastic.co/u/patrykga)\ **Replies:** 1\ **Last updated:** [August 12, 2020, 2:08pm UTC](https://discuss.elastic.co/t/number-format-exception-in-check-rollover-ready-step/244609 "2020-08-12T14:08:38Z")
Hi I have problem with my ilm policy? Can someone help me where I should looking for any issue with this?: "indices" : { "logstash-2020-08-11" : { "index" : "logstash-2020-08-11", "managed" : true, … --- ## [Elasticsearch 6.8 returns date as long not string](https://discuss.elastic.co/t/elasticsearch-6-8-returns-date-as-long-not-string/244193)
**Author:** [@larryrodrigues](https://discuss.elastic.co/u/larryrodrigues)\ **Replies:** 2\ **Last updated:** [August 12, 2020, 2:05pm UTC](https://discuss.elastic.co/t/elasticsearch-6-8-returns-date-as-long-not-string/244193 "2020-08-12T14:05:42Z")
FYI. The data is being indexed to elasticsearch from Spark dataframe. Putting date data directly in Kibana, and querying, return date as String. Elasticsearch 6.8/Kibana date field query always returns long value, not … --- ## [Can some one help please: sum of the field by filtering in transforms not working](https://discuss.elastic.co/t/can-some-one-help-please-sum-of-the-field-by-filtering-in-transforms-not-working/244301)
**Author:** [@anjilinga](https://discuss.elastic.co/u/anjilinga)\ **Replies:** 0\ **Last updated:** [August 9, 2020, 11:16am UTC](https://discuss.elastic.co/t/can-some-one-help-please-sum-of-the-field-by-filtering-in-transforms-not-working/244301 "2020-08-09T11:16:47Z")
Hi, I am trying to create transform with the scenario, grouping by every 15 mins and aggregation should be like as below. Getting the count of the records for each filter. but not able to perform Sum or max on the fil… --- ## [Slow date\_histogram after upgrading to 7.8.0](https://discuss.elastic.co/t/slow-date-histogram-after-upgrading-to-7-8-0/244404)
**Author:** [@Chan\_Terence](https://discuss.elastic.co/u/Chan_Terence)\ **Replies:** 1\ **Last updated:** [August 12, 2020, 1:33pm UTC](https://discuss.elastic.co/t/slow-date-histogram-after-upgrading-to-7-8-0/244404 "2020-08-12T13:33:51Z")
Hi there, We noticed a serious performance degradation of date\_histogram aggregations on our cluster after upgrading to 7.8.0. We have two indexes with 1.2billion documents and use only date\_histogram, but this query n… --- ## [ElasticSearch on Kubernetes, one master nod not discovered when xpack.security.transport.ssl.enabled=true](https://discuss.elastic.co/t/elasticsearch-on-kubernetes-one-master-nod-not-discovered-when-xpack-security-transport-ssl-enabled-true/244717)
**Author:** [@Uvais\_Ibrahim](https://discuss.elastic.co/u/Uvais_Ibrahim)\ **Replies:** 0\ **Last updated:** [August 12, 2020, 1:05pm UTC](https://discuss.elastic.co/t/elasticsearch-on-kubernetes-one-master-nod-not-discovered-when-xpack-security-transport-ssl-enabled-true/244717 "2020-08-12T13:05:36Z")
I have deployed an elasticsearch in Kubernetes with 3 masters and 3 data nodes. All the pods are running. NAME READY STATUS RESTARTS AGE elasticsearch-master-v1-0 1/1 Running 0 … --- ## [Using elastic search for user journey tracking](https://discuss.elastic.co/t/using-elastic-search-for-user-journey-tracking/244703)
**Author:** [@Dheeraj\_Joshi](https://discuss.elastic.co/u/Dheeraj_Joshi)\ **Replies:** 2\ **Last updated:** [August 12, 2020, 12:35pm UTC](https://discuss.elastic.co/t/using-elastic-search-for-user-journey-tracking/244703 "2020-08-12T12:35:20Z")
An external system generated many phases of customer journey. Phases like Anonymous, Registered, Subscriber etc. These are sent as events from a third party system who provides user management capabilities. Events would… --- ## [Index Epoch to date time in elasticserarch](https://discuss.elastic.co/t/index-epoch-to-date-time-in-elasticserarch/244709)
**Author:** [@sana1](https://discuss.elastic.co/u/sana1)\ **Replies:** 0\ **Last updated:** [August 12, 2020, 12:05pm UTC](https://discuss.elastic.co/t/index-epoch-to-date-time-in-elasticserarch/244709 "2020-08-12T12:05:18Z")
I have a filed in my index with epoch time value as "1,596,041,843.199" when ever I try to re-index is using date mapping it gives me error "ailed to parse field \[field\_name\] of type \[date\] in document with id 'xxxxxxxx… --- ## [Collect first document from each bucket](https://discuss.elastic.co/t/collect-first-document-from-each-bucket/244152)
**Author:** [@stwrt](https://discuss.elastic.co/u/stwrt)\ **Replies:** 2\ **Last updated:** [August 12, 2020, 11:14am UTC](https://discuss.elastic.co/t/collect-first-document-from-each-bucket/244152 "2020-08-12T11:14:59Z")
Hi, I need some help with a query: I have a "students" index, and each student has a "classroomId" and a "grade" fields. I need to get the best student in each class. I'm using "aggs", but what I get is the list of a… --- ## [ElasticSearch nodes create a lot of logs](https://discuss.elastic.co/t/elasticsearch-nodes-create-a-lot-of-logs/244514)
**Author:** [@raulgs](https://discuss.elastic.co/u/raulgs)\ **Replies:** 6\ **Last updated:** [August 12, 2020, 10:10am UTC](https://discuss.elastic.co/t/elasticsearch-nodes-create-a-lot-of-logs/244514 "2020-08-12T10:10:43Z")
Hi guys, I have seen that the elasticsearch nodes are creating a very huge amount of logs in my ECK cluster. Is there a way to reduce the amount of logs? Right now I am seeing the index being flooded by entries like t… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=835) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=837)