# Elasticsearch

**URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=837

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 838

---

## [Identifying what terms were matched in a match query](https://discuss.elastic.co/t/identifying-what-terms-were-matched-in-a-match-query/244202)

<div class="topic-metadata">

**Author:** [@Daymon\_Schroeder](https://discuss.elastic.co/u/Daymon_Schroeder)\
**Replies:** 1\
**Last updated:** [August 12, 2020, 9:58am UTC](https://discuss.elastic.co/t/identifying-what-terms-were-matched-in-a-match-query/244202 "2020-08-12T09:58:13Z")

</div>

Consider the following example query where we match a percentage of terms GET /\_search { "query": { "bool": { "should": \[ { "match" : { "body": {…

---

## [Search latest events and unique by field](https://discuss.elastic.co/t/search-latest-events-and-unique-by-field/244199)

<div class="topic-metadata">

**Author:** [@dikkini](https://discuss.elastic.co/u/dikkini)\
**Replies:** 1\
**Last updated:** [August 12, 2020, 9:56am UTC](https://discuss.elastic.co/t/search-latest-events-and-unique-by-field/244199 "2020-08-12T09:56:44Z")

</div>

Hello. I got the following data in my indice: {"username": "michael", "is\_vac": true, "created\_date": 1596647898006} {"username": "kate", "is\_vac": true, "created\_date": 1596647898007} {"username": "michael", "is\_vac":…

---

## [Using Exact Prefix/MatchPhrase Prefix Queries with Ngram Filter](https://discuss.elastic.co/t/using-exact-prefix-matchphrase-prefix-queries-with-ngram-filter/244207)

<div class="topic-metadata">

**Author:** [@k3np4ch1](https://discuss.elastic.co/u/k3np4ch1)\
**Replies:** 1\
**Last updated:** [August 12, 2020, 9:55am UTC](https://discuss.elastic.co/t/using-exact-prefix-matchphrase-prefix-queries-with-ngram-filter/244207 "2020-08-12T09:55:55Z")

</div>

Hi, My goal is to search query text having length one or two character long. This is my setting for the index. "settings" : { "index" : { "number\_of\_shards" : "5", "provided\_name" : "my\_user", …

---

## [How to grant permission in ESClientYamlSuiteTestCase integTest?](https://discuss.elastic.co/t/how-to-grant-permission-in-esclientyamlsuitetestcase-integtest/241975)

<div class="topic-metadata">

**Author:** [@nooneuse](https://discuss.elastic.co/u/nooneuse)\
**Replies:** 2\
**Last updated:** [August 12, 2020, 9:51am UTC](https://discuss.elastic.co/t/how-to-grant-permission-in-esclientyamlsuitetestcase-integtest/241975 "2020-08-12T09:51:17Z")

</div>

Hello, I wrote a plugin which provide support for Datasketches aggregation, I think it is easy to use and I want to contribute it. I added it to the plugins folder with code, unit tests and all license for dependencies…

---

## [How to merge Array while reindexing data?](https://discuss.elastic.co/t/how-to-merge-array-while-reindexing-data/244388)

<div class="topic-metadata">

**Author:** [@darshan\_ambre](https://discuss.elastic.co/u/darshan_ambre)\
**Replies:** 1\
**Last updated:** [August 12, 2020, 9:47am UTC](https://discuss.elastic.co/t/how-to-merge-array-while-reindexing-data/244388 "2020-08-12T09:47:07Z")

</div>

I have an index in which i have duplication document information which i wish to transform and to create one document with array of information. I've the following data in the index: \</\> { "took" : 0, …

---

## [How to iterate over Geopoints in painless?](https://discuss.elastic.co/t/how-to-iterate-over-geopoints-in-painless/244648)

<div class="topic-metadata">

**Author:** [@ClubberLang](https://discuss.elastic.co/u/ClubberLang)\
**Replies:** 5\
**Last updated:** [August 12, 2020, 9:46am UTC](https://discuss.elastic.co/t/how-to-iterate-over-geopoints-in-painless/244648 "2020-08-12T09:46:28Z")

</div>

Hi, I have a painless script, it iterate over a set of geopoints and compute the shortest distance. But it seems that there is an error: "script\_fields": { "distance": { "script": { "source": "double d = Double.MA…

---

## [ElasticSearch 7.8 date and time format issue: unable to store date in MMM-dd-yyyy HH:mm:ss format . Was woking in 6.7.1](https://discuss.elastic.co/t/elasticsearch-7-8-date-and-time-format-issue-unable-to-store-date-in-mmm-dd-yyyy-hhss-format-was-woking-in-6-7-1/244450)

<div class="topic-metadata">

**Author:** [@naresh\_sharma](https://discuss.elastic.co/u/naresh_sharma)\
**Replies:** 3\
**Last updated:** [August 12, 2020, 9:41am UTC](https://discuss.elastic.co/t/elasticsearch-7-8-date-and-time-format-issue-unable-to-store-date-in-mmm-dd-yyyy-hhss-format-was-woking-in-6-7-1/244450 "2020-08-12T09:41:51Z")

</div>

\[2020-08-10T14:30:58,866\]\[WARN \]\[logstash.outputs.elasticsearch\]\[main\] Could not index event to Elasticsearch. {:status=\>400, :action=\>\["index", {:\_id=\>nil, :\_index=\>"metrics", :routing=\>nil, :\_type=\>"\_doc"}, #LogStash::…

---

## [Aggregation using something similar to First when data is grouped](https://discuss.elastic.co/t/aggregation-using-something-similar-to-first-when-data-is-grouped/244587)

<div class="topic-metadata">

**Author:** [@Raster](https://discuss.elastic.co/u/Raster)\
**Replies:** 1\
**Last updated:** [August 12, 2020, 9:29am UTC](https://discuss.elastic.co/t/aggregation-using-something-similar-to-first-when-data-is-grouped/244587 "2020-08-12T09:29:45Z")

</div>

Lets say I have data like this. Every unique "key" has a unique "long key" - totally 1 to 1. Because key is numeric will prefer using it for agrregating (using) using terms-\> field. Field "somedata" is subject to aggre…

---

## [Heap usage is More.. Need to understand more details where the heap is being used and how to optimize it](https://discuss.elastic.co/t/heap-usage-is-more-need-to-understand-more-details-where-the-heap-is-being-used-and-how-to-optimize-it/244588)

<div class="topic-metadata">

**Author:** [@srikhark](https://discuss.elastic.co/u/srikhark)\
**Replies:** 1\
**Last updated:** [August 12, 2020, 9:28am UTC](https://discuss.elastic.co/t/heap-usage-is-more-need-to-understand-more-details-where-the-heap-is-being-used-and-how-to-optimize-it/244588 "2020-08-12T09:28:32Z")

</div>

Hi , Below are my ES cluster node Stats.. ElasticSearch version - 5.6. It is occupying more space in "old" gen space. Why heap usage is more here ? what all are occupying more heap here. And how can i optimize here? T…

---

## [Can aggregations values be used in script score calculations?](https://discuss.elastic.co/t/can-aggregations-values-be-used-in-script-score-calculations/244590)

<div class="topic-metadata">

**Author:** [@iajpl](https://discuss.elastic.co/u/iajpl)\
**Replies:** 1\
**Last updated:** [August 12, 2020, 9:26am UTC](https://discuss.elastic.co/t/can-aggregations-values-be-used-in-script-score-calculations/244590 "2020-08-12T09:26:18Z")

</div>

Each one of my documents within my index contains values associated with sales data and I calculate a score for each document based on those values. Currently, the values are bucketed globally, meaning that before indexi…

---

## [Remove 2 nodes from a 4 nodes cluster](https://discuss.elastic.co/t/remove-2-nodes-from-a-4-nodes-cluster/244690)

<div class="topic-metadata">

**Author:** [@claud81](https://discuss.elastic.co/u/claud81)\
**Replies:** 0\
**Last updated:** [August 12, 2020, 9:24am UTC](https://discuss.elastic.co/t/remove-2-nodes-from-a-4-nodes-cluster/244690 "2020-08-12T09:24:48Z")

</div>

Hi everyone, I would like to reduce the number of my 4 Ubuntu master-eligible nodes cluster (version 6.8) to a 3 master-eligible nodes cluster. In order to do this I have to temporarily remove 2 nodes from the cluster …

---

## [Ingest nodes persistent queue](https://discuss.elastic.co/t/ingest-nodes-persistent-queue/244591)

<div class="topic-metadata">

**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\
**Replies:** 1\
**Last updated:** [August 12, 2020, 9:20am UTC](https://discuss.elastic.co/t/ingest-nodes-persistent-queue/244591 "2020-08-12T09:20:41Z")

</div>

Hello, Imho it would be an awesome feature if ingest nodes could have a persistent queue. Is this something worthy of a feature request? Or technically undoable? Grtz Willem

---

## [Nested terms](https://discuss.elastic.co/t/nested-terms/244593)

<div class="topic-metadata">

**Author:** [@krathore](https://discuss.elastic.co/u/krathore)\
**Replies:** 1\
**Last updated:** [August 12, 2020, 9:20am UTC](https://discuss.elastic.co/t/nested-terms/244593 "2020-08-12T09:20:19Z")

</div>

Can some one pls help me to write a query , i cannot get result back body: { query: { bool: { must: \[ { …

---

## [Using KV processors when field names have space](https://discuss.elastic.co/t/using-kv-processors-when-field-names-have-space/244631)

<div class="topic-metadata">

**Author:** [@BkQc](https://discuss.elastic.co/u/BkQc)\
**Replies:** 1\
**Last updated:** [August 12, 2020, 9:02am UTC](https://discuss.elastic.co/t/using-kv-processors-when-field-names-have-space/244631 "2020-08-12T09:02:09Z")

</div>

Hello, I'm trying to parse a log in which elements are separated by ; and keys/values by =. My problem is that some keys have spaces in their name. Though KV will process it correctly, having spaces in name causes lot…

---

## [Index size Reduced in Elasticsearch even When Number of Documents Increased](https://discuss.elastic.co/t/index-size-reduced-in-elasticsearch-even-when-number-of-documents-increased/244664)

<div class="topic-metadata">

**Author:** [@pulkit007](https://discuss.elastic.co/u/pulkit007)\
**Replies:** 1\
**Last updated:** [August 12, 2020, 8:55am UTC](https://discuss.elastic.co/t/index-size-reduced-in-elasticsearch-even-when-number-of-documents-increased/244664 "2020-08-12T08:55:48Z")

</div>

Hi There, I am storing incremental data (Everyday 0.7 - 1 GB of data gets added) in Elasticsearch. The interesting observation I found is that : The index size in the elasticsearch decreased with time while the number …

---

## [Are there any benefits of running elasticsearch in linux and not windows?](https://discuss.elastic.co/t/are-there-any-benefits-of-running-elasticsearch-in-linux-and-not-windows/244675)

<div class="topic-metadata">

**Author:** [@defalt](https://discuss.elastic.co/u/defalt)\
**Replies:** 1\
**Last updated:** [August 12, 2020, 8:46am UTC](https://discuss.elastic.co/t/are-there-any-benefits-of-running-elasticsearch-in-linux-and-not-windows/244675 "2020-08-12T08:46:36Z")

</div>

I was wondering if there are any significant performance differences between Linux, Windows and Docker. Thanks for your answers.

---

## [Cannot get desired query results with filter](https://discuss.elastic.co/t/cannot-get-desired-query-results-with-filter/244680)

<div class="topic-metadata">

**Author:** [@vinodkrishnanr](https://discuss.elastic.co/u/vinodkrishnanr)\
**Replies:** 1\
**Last updated:** [August 12, 2020, 8:46am UTC](https://discuss.elastic.co/t/cannot-get-desired-query-results-with-filter/244680 "2020-08-12T08:46:35Z")

</div>

Hi Im trying to understand why the below query does not produce the results. { "query": { "bool": { "filter": { "terms": { "classifica…

---

## [Alias with multiple filters](https://discuss.elastic.co/t/alias-with-multiple-filters/243095)

<div class="topic-metadata">

**Author:** [@Rom1](https://discuss.elastic.co/u/Rom1)\
**Replies:** 4\
**Last updated:** [August 12, 2020, 8:45am UTC](https://discuss.elastic.co/t/alias-with-multiple-filters/243095 "2020-08-12T08:45:29Z")

</div>

Hi guys, In order to filter data to be displayed in a drop down list of the control visualization in Kibana, I decided to create an alias on my index by filtering some data but I'm facing like an issue. Here is the pa…

---

## [Restored data to fresh cluster incorrectly and receiving "master not discovered or elected yet"](https://discuss.elastic.co/t/restored-data-to-fresh-cluster-incorrectly-and-receiving-master-not-discovered-or-elected-yet/244617)

<div class="topic-metadata">

**Author:** [@ronenf](https://discuss.elastic.co/u/ronenf)\
**Replies:** 6\
**Last updated:** [August 12, 2020, 8:28am UTC](https://discuss.elastic.co/t/restored-data-to-fresh-cluster-incorrectly-and-receiving-master-not-discovered-or-elected-yet/244617 "2020-08-12T08:28:36Z")

</div>

Hi I had a 3 nodes cluster running on on Kubernetes. There were space issues with the volumes so I was forced to provision new volumes. Before I read this article I decided to make a copy of the data directory, I create…

---

## [Watcher alert only on state transition (error / ok state)](https://discuss.elastic.co/t/watcher-alert-only-on-state-transition-error-ok-state/243076)

<div class="topic-metadata">

**Author:** [@trigger-unhappy](https://discuss.elastic.co/u/trigger-unhappy)\
**Replies:** 3\
**Last updated:** [August 12, 2020, 8:27am UTC](https://discuss.elastic.co/t/watcher-alert-only-on-state-transition-error-ok-state/243076 "2020-08-12T08:27:15Z")

</div>

I've read this nice post on how you could possibly set up Watcher to trigger an action only when a watch change state (similar to how cloudwatch does it with events). I'd love to set something like that up to avoid spamm…

---

## [Adding new data node to 3 node elasticsearch cluster](https://discuss.elastic.co/t/adding-new-data-node-to-3-node-elasticsearch-cluster/244547)

<div class="topic-metadata">

**Author:** [@pdkgamage](https://discuss.elastic.co/u/pdkgamage)\
**Replies:** 1\
**Last updated:** [August 12, 2020, 8:16am UTC](https://discuss.elastic.co/t/adding-new-data-node-to-3-node-elasticsearch-cluster/244547 "2020-08-12T08:16:11Z")

</div>

Hi, There is 3 node elasticsearch cluster. one is running as master node and other two running as data node. All these nodes are having 900GB hard disk. So i wanted to add new data node which having 350GB hard disk. Pl…

---

## [Using doc\_count to calculate percentage after aggregation](https://discuss.elastic.co/t/using-doc-count-to-calculate-percentage-after-aggregation/243611)

<div class="topic-metadata">

**Author:** [@surjray](https://discuss.elastic.co/u/surjray)\
**Replies:** 3\
**Last updated:** [August 12, 2020, 8:14am UTC](https://discuss.elastic.co/t/using-doc-count-to-calculate-percentage-after-aggregation/243611 "2020-08-12T08:14:57Z")

</div>

Dear all, I am currently attempting to use the doc\_count field (result of aggregation operation: aggregations.aggregation\_name.buckets -\> doc\_count for each bucket) to calculate some percentages, namely pass and fail fo…

---

## [\[Elasticsearch Docker\] \[Errno 111\] Connection refused when connecting with python script](https://discuss.elastic.co/t/elasticsearch-docker-errno-111-connection-refused-when-connecting-with-python-script/243678)

<div class="topic-metadata">

**Author:** [@Stimmot](https://discuss.elastic.co/u/Stimmot)\
**Replies:** 5\
**Last updated:** [August 12, 2020, 8:13am UTC](https://discuss.elastic.co/t/elasticsearch-docker-errno-111-connection-refused-when-connecting-with-python-script/243678 "2020-08-12T08:13:51Z")

</div>

Hey, I got an issue with a dockerized elasticsearch cluster that I would like to connect with a simple python indexing script. After executing docker-compose up it brings up the cluster, kibana as well, but when it tri…

---

## [3 node cluster failure](https://discuss.elastic.co/t/3-node-cluster-failure/244533)

<div class="topic-metadata">

**Author:** [@iccMe](https://discuss.elastic.co/u/iccMe)\
**Replies:** 5\
**Last updated:** [August 12, 2020, 7:54am UTC](https://discuss.elastic.co/t/3-node-cluster-failure/244533 "2020-08-12T07:54:48Z")

</div>

Hi, I am new to elasticsearch. I have created a 3 node elasticsearch cluster. All master and data set to true. All 3 nodes are running: Centos 8, ES version 7.8.1 Java - openjdk 11.0.8 2020-07-14 LTS. Firewall - in …

---

## [Connection error when using a domain in python client to connect the elasticsearch](https://discuss.elastic.co/t/connection-error-when-using-a-domain-in-python-client-to-connect-the-elasticsearch/244650)

<div class="topic-metadata">

**Author:** [@Tristan\_D](https://discuss.elastic.co/u/Tristan_D)\
**Replies:** 1\
**Last updated:** [August 12, 2020, 7:08am UTC](https://discuss.elastic.co/t/connection-error-when-using-a-domain-in-python-client-to-connect-the-elasticsearch/244650 "2020-08-12T07:08:30Z")

</div>

I can't connect to the es with the direct ip:9200, so I use a domain. The domain is mapping to es\_ip:9200. It's fine when I use curl command to test the connection. curl ai-xiaov-async.vivo.com.cn/\_cat/indices But in …

---

## [Multiply scores between 'distance\_feature' and 'dismax'?](https://discuss.elastic.co/t/multiply-scores-between-distance-feature-and-dismax/244638)

<div class="topic-metadata">

**Author:** [@ClubberLang](https://discuss.elastic.co/u/ClubberLang)\
**Replies:** 0\
**Last updated:** [August 11, 2020, 10:03pm UTC](https://discuss.elastic.co/t/multiply-scores-between-distance-feature-and-dismax/244638 "2020-08-11T22:03:49Z")

</div>

Hi, Imagine I have 3 queries: "distance\_feature": { ... time... } "distance\_feature": { ... location... } "dis\_max" : { ... } Currently, to combine it I do this: "query" : { "bool" : { "must" : \[ "distance\_fe…

---

## [Getting Error "all shards failed" when I go for re-indexing](https://discuss.elastic.co/t/getting-error-all-shards-failed-when-i-go-for-re-indexing/244577)

<div class="topic-metadata">

**Author:** [@Sarwar\_Kori](https://discuss.elastic.co/u/Sarwar_Kori)\
**Replies:** 7\
**Last updated:** [August 12, 2020, 6:46am UTC](https://discuss.elastic.co/t/getting-error-all-shards-failed-when-i-go-for-re-indexing/244577 "2020-08-12T06:46:01Z")

</div>

{ "error" : { "root\_cause" : , "type" : "search\_phase\_execution\_exception", "reason" : "all shards failed", "phase" : "query", "grouped" : true, "failed\_shards" : }, "status" : 503 }

---

## [Is there an option to return the query string in the result?](https://discuss.elastic.co/t/is-there-an-option-to-return-the-query-string-in-the-result/244611)

<div class="topic-metadata">

**Author:** [@linkerc](https://discuss.elastic.co/u/linkerc)\
**Replies:** 2\
**Last updated:** [August 12, 2020, 5:30am UTC](https://discuss.elastic.co/t/is-there-an-option-to-return-the-query-string-in-the-result/244611 "2020-08-12T05:30:20Z")

</div>

Like the topic suggested. Is there an option to return back what my query is for the result? What I am looking for is to embed an ID to the request so we can easily identify the source of requester. So the task detail…

---

## [ElasticSearch automatically skips decimals in floating numbers](https://discuss.elastic.co/t/elasticsearch-automatically-skips-decimals-in-floating-numbers/244578)

<div class="topic-metadata">

**Author:** [@AGP1](https://discuss.elastic.co/u/AGP1)\
**Replies:** 3\
**Last updated:** [August 12, 2020, 1:18am UTC](https://discuss.elastic.co/t/elasticsearch-automatically-skips-decimals-in-floating-numbers/244578 "2020-08-12T01:18:15Z")

</div>

I have a panel configured to retrieve a floating number from Elasticsearh, I am interested in the decimals of that number, but apparently the panel omits the numbers after the comma and leaves them at 0 as if it were a w…

---

## [Curl command to connect to elastic cloud](https://discuss.elastic.co/t/curl-command-to-connect-to-elastic-cloud/244641)

<div class="topic-metadata">

**Author:** [@Venkatesh\_Guruprasad](https://discuss.elastic.co/u/Venkatesh_Guruprasad)\
**Replies:** 1\
**Last updated:** [August 11, 2020, 10:40pm UTC](https://discuss.elastic.co/t/curl-command-to-connect-to-elastic-cloud/244641 "2020-08-11T22:40:55Z")

</div>

I want to use curl or other mechanisms to connect to elastic cloud clusters. What is the best way to achieve them?

[Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=836)

[Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=838)
