# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=840 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 841 --- ## [Looking for recommendations on elasticsearch set up for logging](https://discuss.elastic.co/t/looking-for-recommendations-on-elasticsearch-set-up-for-logging/243947)
**Author:** [@sbk-elk](https://discuss.elastic.co/u/sbk-elk)\ **Replies:** 9\ **Last updated:** [August 10, 2020, 2:38am UTC](https://discuss.elastic.co/t/looking-for-recommendations-on-elasticsearch-set-up-for-logging/243947 "2020-08-10T02:38:58Z")
Hi, I am looking for recommendations on spanning my cluster on cloud across multi region. Any sample ideas? The problem statement is as below and i don't see much info on a set up like this: -- Need to connect my apps… --- ## [Search query for Address Search](https://discuss.elastic.co/t/search-query-for-address-search/243912)
**Author:** [@allAbout\_Gaming](https://discuss.elastic.co/u/allAbout_Gaming)\ **Replies:** 1\ **Last updated:** [August 9, 2020, 11:14pm UTC](https://discuss.elastic.co/t/search-query-for-address-search/243912 "2020-08-09T23:14:47Z")
Hi All , Need help to frame a search query that will be able to search address. We have fields like House Name , Street Name, City, Country. We have concatenated all fields into a single field. But I am not able to fram… --- ## [A kind of transposition - is it possible](https://discuss.elastic.co/t/a-kind-of-transposition-is-it-possible/243921)
**Author:** [@Raster](https://discuss.elastic.co/u/Raster)\ **Replies:** 1\ **Last updated:** [August 9, 2020, 11:14pm UTC](https://discuss.elastic.co/t/a-kind-of-transposition-is-it-possible/243921 "2020-08-09T23:14:02Z")
Hi, Let's say I have data in a table with columnames of key, col1, col2, col3. Note name of first column is key in this example- could be anything. Can I have this data converted into a table having these columns - key,… --- ## [Cisco ESA-WSA parser](https://discuss.elastic.co/t/cisco-esa-wsa-parser/243917)
**Author:** [@stressedsalmon](https://discuss.elastic.co/u/stressedsalmon)\ **Replies:** 1\ **Last updated:** [August 9, 2020, 11:13pm UTC](https://discuss.elastic.co/t/cisco-esa-wsa-parser/243917 "2020-08-09T23:13:28Z")
Hello, Does the current default Cisco parser have capability of parsing Cisco Web security appliance and Email security appliance? I am trying to log these machines and it seems like the default Cisco parser inst worki… --- ## [Usage of coordinating node for threadpool or http request limits](https://discuss.elastic.co/t/usage-of-coordinating-node-for-threadpool-or-http-request-limits/243964)
**Author:** [@anon17386273](https://discuss.elastic.co/u/anon17386273)\ **Replies:** 1\ **Last updated:** [August 9, 2020, 11:05pm UTC](https://discuss.elastic.co/t/usage-of-coordinating-node-for-threadpool-or-http-request-limits/243964 "2020-08-09T23:05:54Z")
I read through elasticsearch and understood that there is no way to limit the connections by users I came across the topic on threadpool size configuration per nodes. https://www.elastic.co/guide/en/elasticsearch/refer… --- ## [Grant access to Stack Monitoring tab](https://discuss.elastic.co/t/grant-access-to-stack-monitoring-tab/244185)
**Author:** [@Thomas74](https://discuss.elastic.co/u/Thomas74)\ **Replies:** 1\ **Last updated:** [August 9, 2020, 10:54pm UTC](https://discuss.elastic.co/t/grant-access-to-stack-monitoring-tab/244185 "2020-08-09T22:54:10Z")
Hi, I would like to grant access to Stack monitoring for --- ## [How to upload a file into ElastiSearch](https://discuss.elastic.co/t/how-to-upload-a-file-into-elastisearch/243491)
**Author:** [@noor\_basha](https://discuss.elastic.co/u/noor_basha)\ **Replies:** 11\ **Last updated:** [August 9, 2020, 9:35pm UTC](https://discuss.elastic.co/t/how-to-upload-a-file-into-elastisearch/243491 "2020-08-09T21:35:39Z")
Hi I am new to ELK, I need to upload different types of files into ELASTIC SEARCH, is it possible to do that. if it is anyone can please help me how to do with sample code. As of now, I am doing with reading the file an… --- ## [\[ERROR\]\[o.e.x.m.c.n.NodeStatsCollector\] collector \[node\_stats\] timed out when collecting data](https://discuss.elastic.co/t/error-o-e-x-m-c-n-nodestatscollector-collector-node-stats-timed-out-when-collecting-data/244194)
**Author:** [@Burga](https://discuss.elastic.co/u/Burga)\ **Replies:** 6\ **Last updated:** [August 9, 2020, 5:32pm UTC](https://discuss.elastic.co/t/error-o-e-x-m-c-n-nodestatscollector-collector-node-stats-timed-out-when-collecting-data/244194 "2020-08-09T17:32:49Z")
Hi Guys , we just have an issue with part of the logs haven't been indexed , in almost all elastic nodes logs I see error : \[ERROR\]\[o.e.x.m.c.n.NodeStatsCollector\] collector \[node\_stats\] timed out when collecting … --- ## [Transform indices show green but Regular indices shows yellow status](https://discuss.elastic.co/t/transform-indices-show-green-but-regular-indices-shows-yellow-status/243233)
**Author:** [@sanjaysubramanian](https://discuss.elastic.co/u/sanjaysubramanian)\ **Replies:** 4\ **Last updated:** [August 9, 2020, 5:21pm UTC](https://discuss.elastic.co/t/transform-indices-show-green-but-regular-indices-shows-yellow-status/243233 "2020-08-09T17:21:55Z")
Hi all ES and K version = 7.7.0 I am using a one node development machine that has ES and Kibana running. All my indices display a status YELLOW (understandable because I have one node). However ALL my transform indic… --- ## [Ingest pipelines with Serial Difference aggregation](https://discuss.elastic.co/t/ingest-pipelines-with-serial-difference-aggregation/241511)
**Author:** [@dg1](https://discuss.elastic.co/u/dg1)\ **Replies:** 5\ **Last updated:** [August 9, 2020, 12:21pm UTC](https://discuss.elastic.co/t/ingest-pipelines-with-serial-difference-aggregation/241511 "2020-08-09T12:21:13Z")
I'm storing quality metrics in elastic. One of those metrics is code coverage (extracted from sonar). I want to calculate the difference in average code coverage for a project between weeks. So this week the average code… --- ## [Manual heap dump in elasticsearch not working](https://discuss.elastic.co/t/manual-heap-dump-in-elasticsearch-not-working/244299)
**Author:** [@Prashanth\_123](https://discuss.elastic.co/u/Prashanth_123)\ **Replies:** 0\ **Last updated:** [August 9, 2020, 10:12am UTC](https://discuss.elastic.co/t/manual-heap-dump-in-elasticsearch-not-working/244299 "2020-08-09T10:12:09Z")
Over last few days noticed more GC in my es server and was trying to take a look at heap .. My ES is running on EC2 , with Amazon linux AMI OS. When i tried to take heap dump with "jmap -dump:format=b,file=/var/lib/e… --- ## [How to update a record in ES if storing of field data in \_id will be removed in future?](https://discuss.elastic.co/t/how-to-update-a-record-in-es-if-storing-of-field-data-in-id-will-be-removed-in-future/244265)
**Author:** [@aryaman](https://discuss.elastic.co/u/aryaman)\ **Replies:** 0\ **Last updated:** [August 8, 2020, 8:01pm UTC](https://discuss.elastic.co/t/how-to-update-a-record-in-es-if-storing-of-field-data-in-id-will-be-removed-in-future/244265 "2020-08-08T20:01:21Z")
Hi, I use python Elasticsearch client for sending new documents to Elasticsearch and updating already existing records as well. My client request looks like this: es.index(index='index\_name',ignore=400,id=dict\['Logica… --- ## [Indexing a threaded conversation](https://discuss.elastic.co/t/indexing-a-threaded-conversation/244257)
**Author:** [@dansei](https://discuss.elastic.co/u/dansei)\ **Replies:** 0\ **Last updated:** [August 8, 2020, 4:26pm UTC](https://discuss.elastic.co/t/indexing-a-threaded-conversation/244257 "2020-08-08T16:26:05Z")
I would like to use Elasticsearch to index and search a threaded conversation, like a blog's comments where there are top-level comments and replies to those comments. I have tried making a single document like this, wi… --- ## [Unable to allocate replica shard after node restart](https://discuss.elastic.co/t/unable-to-allocate-replica-shard-after-node-restart/243738)
**Author:** [@Chimu](https://discuss.elastic.co/u/Chimu)\ **Replies:** 8\ **Last updated:** [August 8, 2020, 12:22pm UTC](https://discuss.elastic.co/t/unable-to-allocate-replica-shard-after-node-restart/243738 "2020-08-08T12:22:43Z")
I have an Elasticsearch (v5.6.10) cluster with 3 nodes. Node A : Master Node B : Master + Data Node C : Master + Data There are 6 shards per data node with replication set as 1. All 6 primary nodes are in Node B and a… --- ## [ELK target cluster and redactions](https://discuss.elastic.co/t/elk-target-cluster-and-redactions/244189)
**Author:** [@griffer98](https://discuss.elastic.co/u/griffer98)\ **Replies:** 1\ **Last updated:** [August 8, 2020, 5:25am UTC](https://discuss.elastic.co/t/elk-target-cluster-and-redactions/244189 "2020-08-08T05:25:54Z")
I am planning on having multiple clusters and some files that go through the stack will need ip redactions and so on. What I want to do is have some way for logstash to determine, based on certain requirements, which clu… --- ## [Total hits for search involving searchafter](https://discuss.elastic.co/t/total-hits-for-search-involving-searchafter/244223)
**Author:** [@jaekim06450](https://discuss.elastic.co/u/jaekim06450)\ **Replies:** 0\ **Last updated:** [August 7, 2020, 8:36pm UTC](https://discuss.elastic.co/t/total-hits-for-search-involving-searchafter/244223 "2020-08-07T20:36:37Z")
Hello, I am currently using Search After component of Search API for Java. The question I have involves the total hits that are tracked as part of each query. Let's say there's an index that contains 100 records for a … --- ## [Doc.length starts counting approximately starting from 41 tokens](https://discuss.elastic.co/t/doc-length-starts-counting-approximately-starting-from-41-tokens/244215)
**Author:** [@Alex\_D](https://discuss.elastic.co/u/Alex_D)\ **Replies:** 0\ **Last updated:** [August 7, 2020, 7:37pm UTC](https://discuss.elastic.co/t/doc-length-starts-counting-approximately-starting-from-41-tokens/244215 "2020-08-07T19:37:08Z")
Hi all ! I founded that doc.length variable starts counting approximately starting from 41 tokens in a document. Could anyone prompt, is it expected behavior ? I am trying to use scripted similarity and it's important… --- ## [Default found\_snapshot cycles every 5m unsuccessfully (set to 30m)](https://discuss.elastic.co/t/default-found-snapshot-cycles-every-5m-unsuccessfully-set-to-30m/244104)
**Author:** [@Erica\_Case](https://discuss.elastic.co/u/Erica_Case)\ **Replies:** 0\ **Last updated:** [August 6, 2020, 11:22pm UTC](https://discuss.elastic.co/t/default-found-snapshot-cycles-every-5m-unsuccessfully-set-to-30m/244104 "2020-08-06T23:22:32Z")
Without any configuration changes, the elastic cloudwatch snapshot runs every 5 minutes (event though the frequency is set to 30m). Despite this frequent running, monitoring says the cluster is "healthy with warnings" … --- ## [Cluster state update taking more than 10 seconds warnings](https://discuss.elastic.co/t/cluster-state-update-taking-more-than-10-seconds-warnings/243768)
**Author:** [@luiz.ooliveira](https://discuss.elastic.co/u/luiz.ooliveira)\ **Replies:** 7\ **Last updated:** [August 7, 2020, 2:47pm UTC](https://discuss.elastic.co/t/cluster-state-update-taking-more-than-10-seconds-warnings/243768 "2020-08-07T14:47:59Z")
Hi, I'm getting the following warning every time I update a cluster setting: took \[10.6s\], which is over \[10s\], to compute cluster state update for \[update-settings\] Is there any way to identify where it is taking mor… --- ## [How to ssh into eleasticsearch vm host ? This is for self managed ES on Azure](https://discuss.elastic.co/t/how-to-ssh-into-eleasticsearch-vm-host-this-is-for-self-managed-es-on-azure/244110)
**Author:** [@jpatel](https://discuss.elastic.co/u/jpatel)\ **Replies:** 3\ **Last updated:** [August 7, 2020, 2:44pm UTC](https://discuss.elastic.co/t/how-to-ssh-into-eleasticsearch-vm-host-this-is-for-self-managed-es-on-azure/244110 "2020-08-07T14:44:37Z")
I can ssh into kibana vm host using the IP address using putty ssh. I have tried to do same for elastic node vm and it does not work. I tried to ssh into elastic node from kibana host and it does not work for me. Plea… --- ## [Multi shard vs Multi index (Assuming same data)](https://discuss.elastic.co/t/multi-shard-vs-multi-index-assuming-same-data/244103)
**Author:** [@TheWorkingDeveloper](https://discuss.elastic.co/u/TheWorkingDeveloper)\ **Replies:** 1\ **Last updated:** [August 7, 2020, 2:31pm UTC](https://discuss.elastic.co/t/multi-shard-vs-multi-index-assuming-same-data/244103 "2020-08-07T14:31:22Z")
I'm currently working on a project where I have quite a bit of freedom in the structure and size of data. Now, I'm wondering if there's performance difference between the following two scenarios: Assuming a two node set… --- ## [High CPU on Elasticsearch for single node](https://discuss.elastic.co/t/high-cpu-on-elasticsearch-for-single-node/244126)
**Author:** [@karthik8890](https://discuss.elastic.co/u/karthik8890)\ **Replies:** 1\ **Last updated:** [August 7, 2020, 2:08pm UTC](https://discuss.elastic.co/t/high-cpu-on-elasticsearch-for-single-node/244126 "2020-08-07T14:08:24Z")
Elasticsearch version : 6.8.9 JDK : 8 RAM : 8GB JVM arguments: -Xms4g -Xmx4g and the remaining are default configurations provided by package. CPU utilization is going more than 90% and also high response time taki… --- ## [\[HADOOP\] Add custom mapping configuration key](https://discuss.elastic.co/t/hadoop-add-custom-mapping-configuration-key/244179)
**Author:** [@jpgilaberte](https://discuss.elastic.co/u/jpgilaberte)\ **Replies:** 0\ **Last updated:** [August 7, 2020, 1:05pm UTC](https://discuss.elastic.co/t/hadoop-add-custom-mapping-configuration-key/244179 "2020-08-07T13:05:41Z")
Hi, maybe it makes sense to allow customizing the mapping in the creation of an index? For example, when a table is created from SparkSql and the index does not exist, there could be a configuration option that allows c… --- ## [Suspected bug: cannot disable a field using dynamic templates](https://discuss.elastic.co/t/suspected-bug-cannot-disable-a-field-using-dynamic-templates/244170)
**Author:** [@drs](https://discuss.elastic.co/u/drs)\ **Replies:** 0\ **Last updated:** [August 7, 2020, 12:05pm UTC](https://discuss.elastic.co/t/suspected-bug-cannot-disable-a-field-using-dynamic-templates/244170 "2020-08-07T12:05:29Z")
I am trying to use a dynamic template to disable analysis on a field by setting enabled: false in its mapping. This is the mapping I'm using: { "mappings": { "dynamic": true, "dynamic\_templates": \[ { … --- ## [Clean scroll context after \`\_update\_by\_query\`](https://discuss.elastic.co/t/clean-scroll-context-after-update-by-query/244164)
**Author:** [@Toma\_Popov](https://discuss.elastic.co/u/Toma_Popov)\ **Replies:** 0\ **Last updated:** [August 7, 2020, 11:36am UTC](https://discuss.elastic.co/t/clean-scroll-context-after-update-by-query/244164 "2020-08-07T11:36:27Z")
Hello, I have a question regarding scroll context-s created by the Update by query API. Currently we create a lot of scroll context, when we update events in our system. The scrolls are kept for just one minute, but du… --- ## [Nginx as a reverse proxy for kibana gives 401 for /31997/bundles resources](https://discuss.elastic.co/t/nginx-as-a-reverse-proxy-for-kibana-gives-401-for-31997-bundles-resources/244151)
**Author:** [@Muhammad\_Umair\_Baig](https://discuss.elastic.co/u/Muhammad_Umair_Baig)\ **Replies:** 0\ **Last updated:** [August 7, 2020, 10:11am UTC](https://discuss.elastic.co/t/nginx-as-a-reverse-proxy-for-kibana-gives-401-for-31997-bundles-resources/244151 "2020-08-07T10:11:54Z")
I am using 7.8.0 version of kibana and elasticsearch. on the front i have configured nginx 1.19 as a reverse proxy. i have put following configurations on nginx.conf but when i hit https://DNS:4443 (Nginx url) it ends u… --- ## [Elastic API query \_grokparsefailure tags](https://discuss.elastic.co/t/elastic-api-query-grokparsefailure-tags/243584)
**Author:** [@alces](https://discuss.elastic.co/u/alces)\ **Replies:** 8\ **Last updated:** [August 7, 2020, 9:21am UTC](https://discuss.elastic.co/t/elastic-api-query-grokparsefailure-tags/243584 "2020-08-07T09:21:12Z")
Hello, I'm currently trying to get all logs of an index which have a "\_grokparsefailure" tag assigned to it. Next step would be deleting these logs, but I'm not sure if this is going to work anyways: curl -X GET "http:… --- ## [Multi-fields with IP and Keyword Possible?](https://discuss.elastic.co/t/multi-fields-with-ip-and-keyword-possible/244038)
**Author:** [@michaelpietzsch](https://discuss.elastic.co/u/michaelpietzsch)\ **Replies:** 2\ **Last updated:** [August 7, 2020, 9:18am UTC](https://discuss.elastic.co/t/multi-fields-with-ip-and-keyword-possible/244038 "2020-08-07T09:18:40Z")
Hi Gals and Guys, i was wondering. With multi-fields it is possible to add multiple data types for one field while ingesting everything in to the database. Currently I have a specific field with the datatype IP, I also… --- ## [Large dataset leads to TaskCancelledException: cancelled](https://discuss.elastic.co/t/large-dataset-leads-to-taskcancelledexception-cancelled/243720)
**Author:** [@sherzinger](https://discuss.elastic.co/u/sherzinger)\ **Replies:** 3\ **Last updated:** [August 7, 2020, 7:02am UTC](https://discuss.elastic.co/t/large-dataset-leads-to-taskcancelledexception-cancelled/243720 "2020-08-07T07:02:11Z")
Hi, When watching a dashboard or browsing Discovery of a large datas et (several 100GB) sometimes Elastic will just give up with the error message below. The cluster consists of 10 nodes with a total of 88 cores and 75… --- ## [Generate 'rollup\_index' name based on index being rolled-up](https://discuss.elastic.co/t/generate-rollup-index-name-based-on-index-being-rolled-up/244124)
**Author:** [@SpicyNotNumb](https://discuss.elastic.co/u/SpicyNotNumb)\ **Replies:** 0\ **Last updated:** [August 7, 2020, 6:39am UTC](https://discuss.elastic.co/t/generate-rollup-index-name-based-on-index-being-rolled-up/244124 "2020-08-07T06:39:35Z")
I have a bunch of indices, those are time-series data. GET \_cat/indices/jti-log\* green open jti-logical-usage-q3-raw hppahZg0Qj6dLFWTl4ouIw green open jti-logical-usage-q4-raw 6r5Y-bUFSqOIAl-Q-JSC5g green open jti-logic… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=839) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=841)