# Elasticsearch

**URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=839

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 840

---

## [Failed to authenticate user \[elastic\]](https://discuss.elastic.co/t/failed-to-authenticate-user-elastic/244285)

<div class="topic-metadata">

**Author:** [@anandd4](https://discuss.elastic.co/u/anandd4)\
**Replies:** 3\
**Last updated:** [August 11, 2020, 2:18am UTC](https://discuss.elastic.co/t/failed-to-authenticate-user-elastic/244285 "2020-08-11T02:18:28Z")

</div>

Running elasticsearch 7.5.2 & noticed that elastic service is continuously generating following info messages indicating elastic authentication failure in logs all the time. Everything works fine on the cluster but the i…

---

## [Why I can't use Elasticsearch for as primary database? not the same way](https://discuss.elastic.co/t/why-i-cant-use-elasticsearch-for-as-primary-database-not-the-same-way/244476)

<div class="topic-metadata">

**Author:** [@chawki](https://discuss.elastic.co/u/chawki)\
**Replies:** 0\
**Last updated:** [August 11, 2020, 1:41am UTC](https://discuss.elastic.co/t/why-i-cant-use-elasticsearch-for-as-primary-database-not-the-same-way/244476 "2020-08-11T01:41:10Z")

</div>

This is a common question but in different use case. My application is a buy and sells platform does not launch yet. It uses MongoDB on the server(local) as the primary database to store Ads and I have integrated elasti…

---

## [Low Watermak warning](https://discuss.elastic.co/t/low-watermak-warning/244334)

<div class="topic-metadata">

**Author:** [@ecarmona](https://discuss.elastic.co/u/ecarmona)\
**Replies:** 8\
**Last updated:** [August 10, 2020, 11:17pm UTC](https://discuss.elastic.co/t/low-watermak-warning/244334 "2020-08-10T23:17:41Z")

</div>

Dear All, I hope this message finds you all well. I am working in a mechanism that get the Cluster health every now and then to know if elastic is up and running (Green or Yellow) and then trigger an alert in the case …

---

## [Set processor for a specific Index](https://discuss.elastic.co/t/set-processor-for-a-specific-index/243960)

<div class="topic-metadata">

**Author:** [@Sajal\_Chakraborty](https://discuss.elastic.co/u/Sajal_Chakraborty)\
**Replies:** 2\
**Last updated:** [August 10, 2020, 10:51pm UTC](https://discuss.elastic.co/t/set-processor-for-a-specific-index/243960 "2020-08-10T22:51:12Z")

</div>

I am trying to use the below code to create a Set Processor for Index default-\*, but somehow it's not working PUT /\_ingest/pipeline/addaht { "description" : "sets queue wise AHT constants", "processors": \[ { "set":…

---

## [Mapping issue](https://discuss.elastic.co/t/mapping-issue/244421)

<div class="topic-metadata">

**Author:** [@gbasic](https://discuss.elastic.co/u/gbasic)\
**Replies:** 1\
**Last updated:** [August 10, 2020, 10:04pm UTC](https://discuss.elastic.co/t/mapping-issue/244421 "2020-08-10T22:04:14Z")

</div>

Hi I am a beginner in Elasticsearch so pardon my silly questions. I am trying to feed a json file through Logstash to Elasticsearch so I can later create visualizations in Kibana. However after I create the index and set…

---

## [Elasticsearch and AWS authenticating using IP instead of IAM user](https://discuss.elastic.co/t/elasticsearch-and-aws-authenticating-using-ip-instead-of-iam-user/244408)

<div class="topic-metadata">

**Author:** [@clevallyAstute](https://discuss.elastic.co/u/clevallyAstute)\
**Replies:** 2\
**Last updated:** [August 10, 2020, 9:56pm UTC](https://discuss.elastic.co/t/elasticsearch-and-aws-authenticating-using-ip-instead-of-iam-user/244408 "2020-08-10T21:56:24Z")

</div>

I have an AWS Elasticsearch environment and I believe I’m having trouble authenticating to the Elasticsearch server via IP. We’d like not to use any IAM user policy for this piece of software if possible, and only use an…

---

## [Cross Cluster with 9300 Port](https://discuss.elastic.co/t/cross-cluster-with-9300-port/243818)

<div class="topic-metadata">

**Author:** [@3c3m](https://discuss.elastic.co/u/3c3m)\
**Replies:** 3\
**Last updated:** [August 10, 2020, 9:17pm UTC](https://discuss.elastic.co/t/cross-cluster-with-9300-port/243818 "2020-08-10T21:17:25Z")

</div>

Hi, In a scenario, I have 3 different clusters. Do each cluster added to Remote Clusters have to see each other on port 9300? Thanks, Ecem

---

## [Elasticsearch scan of all IDs slows down dramatically (exponentially?)](https://discuss.elastic.co/t/elasticsearch-scan-of-all-ids-slows-down-dramatically-exponentially/242076)

<div class="topic-metadata">

**Author:** [@Timothy\_Wall](https://discuss.elastic.co/u/Timothy_Wall)\
**Replies:** 3\
**Last updated:** [August 10, 2020, 7:59pm UTC](https://discuss.elastic.co/t/elasticsearch-scan-of-all-ids-slows-down-dramatically-exponentially/242076 "2020-08-10T19:59:32Z")

</div>

I'm trying to dump all IDs from an index. The dump starts with an ETA of under ten minutes, but then progressively slows down, ultimately taking over an hour to finish. Configuration: single node, two shards, no replic…

---

## [Using missing\_bucket with a composite aggregation with a date\_histogram source doesn't seem to create missing buckets](https://discuss.elastic.co/t/using-missing-bucket-with-a-composite-aggregation-with-a-date-histogram-source-doesnt-seem-to-create-missing-buckets/243635)

<div class="topic-metadata">

**Author:** [@acommend](https://discuss.elastic.co/u/acommend)\
**Replies:** 1\
**Last updated:** [August 10, 2020, 6:21pm UTC](https://discuss.elastic.co/t/using-missing-bucket-with-a-composite-aggregation-with-a-date-histogram-source-doesnt-seem-to-create-missing-buckets/243635 "2020-08-10T18:21:24Z")

</div>

Using missing\_bucket with a composite aggregation with a date\_histogram source doesn't seem to create missing buckets. In the example below, 2 documents are created with a date field that are 45 minutes apart. Using a …

---

## [How do I avoid split brain in dual zone on 7.5?](https://discuss.elastic.co/t/how-do-i-avoid-split-brain-in-dual-zone-on-7-5/244297)

<div class="topic-metadata">

**Author:** [@Mill](https://discuss.elastic.co/u/Mill)\
**Replies:** 6\
**Last updated:** [August 10, 2020, 4:01pm UTC](https://discuss.elastic.co/t/how-do-i-avoid-split-brain-in-dual-zone-on-7-5/244297 "2020-08-10T16:01:51Z")

</div>

I have five servers in zone A and zone B each. So I can configure 3 master nodes in zone A and 2 master nodes in zone B a cluster. Or I can use a cluster of 3 master nodes in zone A and zone B, and set up a tribe node…

---

## [Transforms - are cumulative sums a possibility?](https://discuss.elastic.co/t/transforms-are-cumulative-sums-a-possibility/244426)

<div class="topic-metadata">

**Author:** [@Mark\_Duncan](https://discuss.elastic.co/u/Mark_Duncan)\
**Replies:** 1\
**Last updated:** [August 10, 2020, 3:30pm UTC](https://discuss.elastic.co/t/transforms-are-cumulative-sums-a-possibility/244426 "2020-08-10T15:30:07Z")

</div>

I would like to sum a metric over time using Transforms, i.e. a cumulative sum. Is this at all possible? Whilst you can plot a cumulative sum graph using the basic graphs in Kibana, it's cumulative over the date range s…

---

## [Kibana Role Mapping](https://discuss.elastic.co/t/kibana-role-mapping/244374)

<div class="topic-metadata">

**Author:** [@Kevin\_f](https://discuss.elastic.co/u/Kevin_f)\
**Replies:** 3\
**Last updated:** [August 10, 2020, 3:27pm UTC](https://discuss.elastic.co/t/kibana-role-mapping/244374 "2020-08-10T15:27:21Z")

</div>

Hello All, I am trying to map a kibana role with active directory users. The ad users assigned to the role can see the index but cannot see any data within the index itself. I have mirrored a working role with the exac…

---

## [WARN in Logs: "cannot compute used memory / swap"](https://discuss.elastic.co/t/warn-in-logs-cannot-compute-used-memory-swap/244417)

<div class="topic-metadata">

**Author:** [@mfloryan](https://discuss.elastic.co/u/mfloryan)\
**Replies:** 1\
**Last updated:** [August 10, 2020, 3:19pm UTC](https://discuss.elastic.co/t/warn-in-logs-cannot-compute-used-memory-swap/244417 "2020-08-10T15:19:59Z")

</div>

Elasticsearch 7.8.1 installed on Debian 10 (buster) running on an OpenVZ host. It's a fresh install and the server has 8GB of memory. The logs are getting filled with the following two entires: cannot compute used mem…

---

## [Apply Fuzzy Search and Searching-with-without-spaces](https://discuss.elastic.co/t/apply-fuzzy-search-and-searching-with-without-spaces/242964)

<div class="topic-metadata">

**Author:** [@vinodthebest](https://discuss.elastic.co/u/vinodthebest)\
**Replies:** 2\
**Last updated:** [August 10, 2020, 3:19pm UTC](https://discuss.elastic.co/t/apply-fuzzy-search-and-searching-with-without-spaces/242964 "2020-08-10T15:19:46Z")

</div>

I am using Elasticsearch 7.4 and Spring boot 2.3.1 (Spring JPA Elasticsearch) would like to get the same results if the words have space or without space and would like to perform fuzzy search also for the same property. …

---

## [Precedence of wildcard field boosts, for simple query string query](https://discuss.elastic.co/t/precedence-of-wildcard-field-boosts-for-simple-query-string-query/243592)

<div class="topic-metadata">

**Author:** [@SamyAteia](https://discuss.elastic.co/u/SamyAteia)\
**Replies:** 1\
**Last updated:** [August 10, 2020, 1:16pm UTC](https://discuss.elastic.co/t/precedence-of-wildcard-field-boosts-for-simple-query-string-query/243592 "2020-08-10T13:16:34Z")

</div>

Hi, we are using the simple query string query and want to set different boost depending on the field names. We have a lot of fields that end with e postfix such as "\_txt" and want the boost some fields such as "title\_d…

---

## [Basic authentication on ES helm chart](https://discuss.elastic.co/t/basic-authentication-on-es-helm-chart/244337)

<div class="topic-metadata">

**Author:** [@Harsh2](https://discuss.elastic.co/u/Harsh2)\
**Replies:** 8\
**Last updated:** [August 10, 2020, 1:10pm UTC](https://discuss.elastic.co/t/basic-authentication-on-es-helm-chart/244337 "2020-08-10T13:10:25Z")

</div>

i want setup basic authentication on helm cluster. helm ES chart using :https://github.com/elastic/helm-charts/tree/master/elasticsearch i am confuse about using setting parameters in elasticsearch.yaml right now i hav…

---

## [Cant see html format in my watcher's mail](https://discuss.elastic.co/t/cant-see-html-format-in-my-watchers-mail/244406)

<div class="topic-metadata">

**Author:** [@Alexandros888](https://discuss.elastic.co/u/Alexandros888)\
**Replies:** 0\
**Last updated:** [August 10, 2020, 1:06pm UTC](https://discuss.elastic.co/t/cant-see-html-format-in-my-watchers-mail/244406 "2020-08-10T13:06:08Z")

</div>

Hello, I have created an advanced watcher alert that works and has the following email section: "actions": { "send\_email": { "email": { "profile": "standard", "to": \[ "alexandros.ana…

---

## [Return documents that match a minimal number of words in the same sentence](https://discuss.elastic.co/t/return-documents-that-match-a-minimal-number-of-words-in-the-same-sentence/243848)

<div class="topic-metadata">

**Author:** [@flm](https://discuss.elastic.co/u/flm)\
**Replies:** 2\
**Last updated:** [August 10, 2020, 11:08am UTC](https://discuss.elastic.co/t/return-documents-that-match-a-minimal-number-of-words-in-the-same-sentence/243848 "2020-08-10T11:08:16Z")

</div>

I need to return documents that match at least N words in the same sentence. I split my documents per sentence and index each one as a separate value like so: PUT /test\_index/\_doc/id1 { "texts": \[ "Your first…

---

## [ES master nodes CPU usage decrease over time and became red nodes](https://discuss.elastic.co/t/es-master-nodes-cpu-usage-decrease-over-time-and-became-red-nodes/244366)

<div class="topic-metadata">

**Author:** [@Zeroc0pter](https://discuss.elastic.co/u/Zeroc0pter)\
**Replies:** 2\
**Last updated:** [August 10, 2020, 9:28am UTC](https://discuss.elastic.co/t/es-master-nodes-cpu-usage-decrease-over-time-and-became-red-nodes/244366 "2020-08-10T09:28:34Z")

</div>

Hi People, We have issues with our ElasticSearch cluster. Somehow, the CPU usage of the master nodes decreases over time (couple of days) and then crashes the cluster's state. A screenshot of the CPU usage of Master 1: …

---

## [Errors in kibana messages](https://discuss.elastic.co/t/errors-in-kibana-messages/244312)

<div class="topic-metadata">

**Author:** [@Shivam123](https://discuss.elastic.co/u/Shivam123)\
**Replies:** 3\
**Last updated:** [August 10, 2020, 9:09am UTC](https://discuss.elastic.co/t/errors-in-kibana-messages/244312 "2020-08-10T09:09:49Z")

</div>

Hi am getting below message in kibana. Please suggest message: �����\\�0

---

## [elasticsearch.exceptions.RequestError: TransportError(400, 'illegal\_argument\_exception', 'Rejecting mapping update to \[sg\_index\_checker\_progress\] as the final mapping would have more than 1 type: \[\_doc, sg\_index\_checker\_progress\]')](https://discuss.elastic.co/t/elasticsearch-exceptions-requesterror-transporterror-400-illegal-argument-exception-rejecting-mapping-update-to-sg-index-checker-progress-as-the-final-mapping-would-have-more-than-1-type-doc-sg-index-checker-progress/244364)

<div class="topic-metadata">

**Author:** [@samandhare](https://discuss.elastic.co/u/samandhare)\
**Replies:** 1\
**Last updated:** [August 10, 2020, 8:51am UTC](https://discuss.elastic.co/t/elasticsearch-exceptions-requesterror-transporterror-400-illegal-argument-exception-rejecting-mapping-update-to-sg-index-checker-progress-as-the-final-mapping-would-have-more-than-1-type-doc-sg-index-checker-progress/244364 "2020-08-10T08:51:26Z")

</div>

Hi All, I am getting this error on elastic search. Could you please help me here.! Thanks in advance Loading articles from Springer API(Eddie) into sg\_index\_checker Processing dates 2020-01-01 00:00:00 - 2020-08-11 0…

---

## [Rally stalls when I try to benchmark Elasticsearch cluster](https://discuss.elastic.co/t/rally-stalls-when-i-try-to-benchmark-elasticsearch-cluster/243262)

<div class="topic-metadata">

**Author:** [@Akshay\_Raj1](https://discuss.elastic.co/u/Akshay_Raj1)\
**Replies:** 3\
**Last updated:** [August 10, 2020, 8:32am UTC](https://discuss.elastic.co/t/rally-stalls-when-i-try-to-benchmark-elasticsearch-cluster/243262 "2020-08-10T08:32:38Z")

</div>

Here are the details: \[rally1@rally ~\]$ python3 --version Python 3.6.8 \[rally1@rally ~\]$ java -version openjdk version "14.0.2" 2020-07-14 OpenJDK Runtime Environment (build 14.0.2+12-46) OpenJDK 64-Bit Server VM (build…

---

## [Indexer failures - ES rejected execution exception](https://discuss.elastic.co/t/indexer-failures-es-rejected-execution-exception/242805)

<div class="topic-metadata">

**Author:** [@Tafsir\_Alam](https://discuss.elastic.co/u/Tafsir_Alam)\
**Replies:** 9\
**Last updated:** [August 10, 2020, 8:25am UTC](https://discuss.elastic.co/t/indexer-failures-es-rejected-execution-exception/242805 "2020-08-10T08:25:21Z")

</div>

Hi, I am continuously getting Indexer failures errors on my Graylog web-UI console. This is the error: {"type":"es\_rejected\_execution\_exception","reason":"rejected execution of processing of \[1574940\]\[indices:data/writ…

---

## [Searching ES regex with space/colon/hypen etc](https://discuss.elastic.co/t/searching-es-regex-with-space-colon-hypen-etc/243478)

<div class="topic-metadata">

**Author:** [@Shachar0n](https://discuss.elastic.co/u/Shachar0n)\
**Replies:** 2\
**Last updated:** [August 10, 2020, 7:38am UTC](https://discuss.elastic.co/t/searching-es-regex-with-space-colon-hypen-etc/243478 "2020-08-10T07:38:43Z")

</div>

Hi, I am trying to find the way to search in our ES cluster for a substring contained within a doc field's string (where this substring may contain space, for example, as well as may contains a colon, hyphen, etc.). I …

---

## [Wild card query to match the multiple field values](https://discuss.elastic.co/t/wild-card-query-to-match-the-multiple-field-values/244351)

<div class="topic-metadata">

**Author:** [@mruthyu](https://discuss.elastic.co/u/mruthyu)\
**Replies:** 0\
**Last updated:** [August 10, 2020, 6:48am UTC](https://discuss.elastic.co/t/wild-card-query-to-match-the-multiple-field-values/244351 "2020-08-10T06:48:02Z")

</div>

How to frame the wildcard query which can search for the match in all searchable fields. I have already checked the following. https://www.elastic.co/guide/en/elasticsearch/reference/current/query-dsl-wildcard-query.ht…

---

## [Elasticsearch use case implementation help](https://discuss.elastic.co/t/elasticsearch-use-case-implementation-help/244300)

<div class="topic-metadata">

**Author:** [@ocmvin](https://discuss.elastic.co/u/ocmvin)\
**Replies:** 6\
**Last updated:** [August 10, 2020, 5:18am UTC](https://discuss.elastic.co/t/elasticsearch-use-case-implementation-help/244300 "2020-08-10T05:18:32Z")

</div>

I was wondering about elastic search use case where as per current implementation we have to search best wholeseller for a shopkeeper where Currently we are executing individual 3 queries agains relational DB (postgre…

---

## [Upgrading 1.x to 7.x](https://discuss.elastic.co/t/upgrading-1-x-to-7-x/244284)

<div class="topic-metadata">

**Author:** [@Tulasinadh\_V](https://discuss.elastic.co/u/Tulasinadh_V)\
**Replies:** 8\
**Last updated:** [August 10, 2020, 5:18am UTC](https://discuss.elastic.co/t/upgrading-1-x-to-7-x/244284 "2020-08-10T05:18:11Z")

</div>

Hi Team, My current organization using the Elastic Search 1.x and there was a plan to upgrade it to the latest stable version(7.x). Please suggest the better way to handle this without any downtime Thanks in advance

---

## [How to retrieve the last page of my documents even if it is more than 10,000th document?](https://discuss.elastic.co/t/how-to-retrieve-the-last-page-of-my-documents-even-if-it-is-more-than-10-000th-document/244331)

<div class="topic-metadata">

**Author:** [@Noctis17](https://discuss.elastic.co/u/Noctis17)\
**Replies:** 1\
**Last updated:** [August 10, 2020, 4:38am UTC](https://discuss.elastic.co/t/how-to-retrieve-the-last-page-of-my-documents-even-if-it-is-more-than-10-000th-document/244331 "2020-08-10T04:38:57Z")

</div>

Hello and good day! As the title says, we're expecting that we're able to get the last page of our search. But unfortunately, we're encountering an error message: Things beforehand: We're aware the with the relations…

---

## [How to manage phisycal logs file after moving to ELK 5:12 if we want to delete text files](https://discuss.elastic.co/t/how-to-manage-phisycal-logs-file-after-moving-to-elk-5-12-if-we-want-to-delete-text-files/243555)

<div class="topic-metadata">

**Author:** [@Puneeth\_S\_B\_Gowda1](https://discuss.elastic.co/u/Puneeth_S_B_Gowda1)\
**Replies:** 2\
**Last updated:** [August 10, 2020, 4:18am UTC](https://discuss.elastic.co/t/how-to-manage-phisycal-logs-file-after-moving-to-elk-5-12-if-we-want-to-delete-text-files/243555 "2020-08-10T04:18:29Z")

</div>

how to manage physical logs file after moving to ELK if we want to delete text files after moving to ELK how do we do?

---

## [ES Snapshot Delete](https://discuss.elastic.co/t/es-snapshot-delete/243902)

<div class="topic-metadata">

**Author:** [@bhuvaneshdct](https://discuss.elastic.co/u/bhuvaneshdct)\
**Replies:** 5\
**Last updated:** [August 10, 2020, 3:37am UTC](https://discuss.elastic.co/t/es-snapshot-delete/243902 "2020-08-10T03:37:23Z")

</div>

Elasticsearch backups are always incremental. Let's say I have a daily backup job. After one week I have 7 snapshots. On the 8th day if Im going to delete the day1's snapshot, then the rest of the snapshots will become …

[Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=838)

[Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=840)
