# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=841 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 842 --- ## [Elasticsearch Performance Issue](https://discuss.elastic.co/t/elasticsearch-performance-issue/243979)
**Author:** [@Muthukumaran\_Muruges](https://discuss.elastic.co/u/Muthukumaran_Muruges)\ **Replies:** 6\ **Last updated:** [August 7, 2020, 5:15am UTC](https://discuss.elastic.co/t/elasticsearch-performance-issue/243979 "2020-08-07T05:15:12Z")
Hi All, We have got a single node cluster of Elasticsearch running 7.5.0. Disk: 250GB Memory: 64GB CPU: 8CPU Index: 1 Shards : 1 Volume: 2 million Mapping: Dynamic Index Structure : PK, {Inner Obj… --- ## [Master up but cluster down](https://discuss.elastic.co/t/master-up-but-cluster-down/244078)
**Author:** [@Musfiqur\_Siddique](https://discuss.elastic.co/u/Musfiqur_Siddique)\ **Replies:** 9\ **Last updated:** [August 7, 2020, 2:15am UTC](https://discuss.elastic.co/t/master-up-but-cluster-down/244078 "2020-08-07T02:15:57Z")
Is it possible that master node is up but ES cluster is down? --- ## [Elastic 7.5.1 S3 plugin version](https://discuss.elastic.co/t/elastic-7-5-1-s3-plugin-version/244075)
**Author:** [@msf127](https://discuss.elastic.co/u/msf127)\ **Replies:** 1\ **Last updated:** [August 6, 2020, 10:19pm UTC](https://discuss.elastic.co/t/elastic-7-5-1-s3-plugin-version/244075 "2020-08-06T22:19:17Z")
This may seem like a silly question, but if I am running ES 7.5.1, do I want the repository-S3 7.5.1 or 7.5.2 plugin? Do the plugin versions align with the ES version, or should I use the most recent plugin within the E… --- ## [AD User and AD Group in Single Role Mapping](https://discuss.elastic.co/t/ad-user-and-ad-group-in-single-role-mapping/244088)
**Author:** [@Tony\_Chirillo](https://discuss.elastic.co/u/Tony_Chirillo)\ **Replies:** 5\ **Last updated:** [August 6, 2020, 9:32pm UTC](https://discuss.elastic.co/t/ad-user-and-ad-group-in-single-role-mapping/244088 "2020-08-06T21:32:42Z")
Is it possible to have a role mapping that targets an AD group as well as a single AD user? I am trying the following code from DEV Tools, but can't get it work. I have only been able to get a list of groups to work and… --- ## [How to Visualize Metrics Data in a Kibana Canvas Element with using ESSQL Functions](https://discuss.elastic.co/t/how-to-visualize-metrics-data-in-a-kibana-canvas-element-with-using-essql-functions/244067)
**Author:** [@Bu721](https://discuss.elastic.co/u/Bu721)\ **Replies:** 1\ **Last updated:** [August 6, 2020, 8:16pm UTC](https://discuss.elastic.co/t/how-to-visualize-metrics-data-in-a-kibana-canvas-element-with-using-essql-functions/244067 "2020-08-06T20:16:40Z")
HI! I am currently working on a metrics visualization in a Kibana Canvas Element. My goal is to calculate the current throughput of the processing process of items in an array and render the returned value into a Canva… --- ## [Custom new aggregator](https://discuss.elastic.co/t/custom-new-aggregator/244091)
**Author:** [@Raster](https://discuss.elastic.co/u/Raster)\ **Replies:** 0\ **Last updated:** [August 6, 2020, 7:53pm UTC](https://discuss.elastic.co/t/custom-new-aggregator/244091 "2020-08-06T19:53:32Z")
Hi, What are the steps to add a custom aggregator into the elastic server? Scenario: need slightly different behaviour for some aggregation metrics. R --- ## [Unable to make follower index as regular index in elasticsearch CCR setup](https://discuss.elastic.co/t/unable-to-make-follower-index-as-regular-index-in-elasticsearch-ccr-setup/244083)
**Author:** [@lnitin](https://discuss.elastic.co/u/lnitin)\ **Replies:** 0\ **Last updated:** [August 6, 2020, 6:42pm UTC](https://discuss.elastic.co/t/unable-to-make-follower-index-as-regular-index-in-elasticsearch-ccr-setup/244083 "2020-08-06T18:42:21Z")
Hi I'm unable to stop replication with pause or unfollow on the follower index it gives me error. i tried doing POST /testing-copy/\_ccr/pause\_follow and then POST /testing-copy/\_ccr/unfollow "cannot convert the follo… --- ## [Task record not created when wait\_for\_completion=false and server under load](https://discuss.elastic.co/t/task-record-not-created-when-wait-for-completion-false-and-server-under-load/244080)
**Author:** [@redec](https://discuss.elastic.co/u/redec)\ **Replies:** 0\ **Last updated:** [August 6, 2020, 6:10pm UTC](https://discuss.elastic.co/t/task-record-not-created-when-wait-for-completion-false-and-server-under-load/244080 "2020-08-06T18:10:31Z")
Hi all. I'm experiencing a problem where I'm issuing update\_by\_query/delete\_by\_query requests, specifying wait\_for\_completion=false....and I get back a task id as I should, but when I attempt to GET that task I get reso… --- ## [Winlogbeat Index not rolling over - alias not pointing to index](https://discuss.elastic.co/t/winlogbeat-index-not-rolling-over-alias-not-pointing-to-index/244072)
**Author:** [@kernelpanic](https://discuss.elastic.co/u/kernelpanic)\ **Replies:** 0\ **Last updated:** [August 6, 2020, 5:26pm UTC](https://discuss.elastic.co/t/winlogbeat-index-not-rolling-over-alias-not-pointing-to-index/244072 "2020-08-06T17:26:44Z")
Hello, I've create an ILM policy that should roll over the index when it gets to 50 GB. I then created an index template: PUT /\_template/winlogbeat-default { "index\_patterns" : \["winlogbeat-\*"\], "order" : 2, … --- ## [Intersection of two lists stored as string](https://discuss.elastic.co/t/intersection-of-two-lists-stored-as-string/244064)
**Author:** [@Sultanow](https://discuss.elastic.co/u/Sultanow)\ **Replies:** 0\ **Last updated:** [August 6, 2020, 4:27pm UTC](https://discuss.elastic.co/t/intersection-of-two-lists-stored-as-string/244064 "2020-08-06T16:27:28Z")
We have an index called "queues" that stores snapshots of queue states as follows: Each document contains (along some other fields) the following fields: timestamp: type=date, and it is searchable, aggregatable it… --- ## [Error while delete ml anomaly job](https://discuss.elastic.co/t/error-while-delete-ml-anomaly-job/243888)
**Author:** [@liorg2](https://discuss.elastic.co/u/liorg2)\ **Replies:** 13\ **Last updated:** [August 6, 2020, 4:29pm UTC](https://discuss.elastic.co/t/error-while-delete-ml-anomaly-job/243888 "2020-08-06T16:29:52Z")
I'm trying to delete an ML job. I used Kibana to do so, and Kibana shows "deleting" status for this job. DELETE \_ml/anomaly\_detectors/jobid?force=true gives: "reason" : { "type" : "node\_disconnected\_exception", "r… --- ## [Query with a large set of ids (67000+ terms)](https://discuss.elastic.co/t/query-with-a-large-set-of-ids-67000-terms/244065)
**Author:** [@Vesli](https://discuss.elastic.co/u/Vesli)\ **Replies:** 0\ **Last updated:** [August 6, 2020, 4:28pm UTC](https://discuss.elastic.co/t/query-with-a-large-set-of-ids-67000-terms/244065 "2020-08-06T16:28:32Z")
Hello, I have a query for document that I want to filter by excluding a large set of ids (67000 terms) that I'm current doing as following: query := map\[string\]interface{}{ "query": map\[string\]interface{}{ "b… --- ## [Image (.TIF) is supported by Ingest Attachment plugin? (OCR for images)](https://discuss.elastic.co/t/image-tif-is-supported-by-ingest-attachment-plugin-ocr-for-images/243780)
**Author:** [@christiancj](https://discuss.elastic.co/u/christiancj)\ **Replies:** 4\ **Last updated:** [August 6, 2020, 3:33pm UTC](https://discuss.elastic.co/t/image-tif-is-supported-by-ingest-attachment-plugin-ocr-for-images/243780 "2020-08-06T15:33:57Z")
I've ES 7.3.1 with Ingest Attachment plugin, I can extract text for PDF, txt, docx, xlsx, however I'm dealing as well with .TIF documents, does the plugin support image to extract text (OCR) ?. I was reading few web si… --- ## [Reindexing indicies results in issues in 7.8.1](https://discuss.elastic.co/t/reindexing-indicies-results-in-issues-in-7-8-1/244051)
**Author:** [@undelete](https://discuss.elastic.co/u/undelete)\ **Replies:** 0\ **Last updated:** [August 6, 2020, 3:01pm UTC](https://discuss.elastic.co/t/reindexing-indicies-results-in-issues-in-7-8-1/244051 "2020-08-06T15:01:03Z")
I'm reindexing a few indicies and I get the message #! Deprecation: index \[my\_index\] matches multiple legacy templates \[filebeat-7.8.1, fv2-test\], composable templates will only match a single template. I've built my in… --- ## [LDAP integration with elk](https://discuss.elastic.co/t/ldap-integration-with-elk/244049)
**Author:** [@suresh123](https://discuss.elastic.co/u/suresh123)\ **Replies:** 0\ **Last updated:** [August 6, 2020, 2:50pm UTC](https://discuss.elastic.co/t/ldap-integration-with-elk/244049 "2020-08-06T14:50:43Z")
Hi Experts, I am trying to integrate LDAP with ELK stack. I have modified below script in elasticsearch.yml xpack.security.enabled: true xpack: security: authc: realms: ldap: ldap1: … --- ## [Cluster not forming multi-master eligible. Each forming 1 node cluster with itself as master](https://discuss.elastic.co/t/cluster-not-forming-multi-master-eligible-each-forming-1-node-cluster-with-itself-as-master/243926)
**Author:** [@randomuser10](https://discuss.elastic.co/u/randomuser10)\ **Replies:** 2\ **Last updated:** [August 6, 2020, 2:45pm UTC](https://discuss.elastic.co/t/cluster-not-forming-multi-master-eligible-each-forming-1-node-cluster-with-itself-as-master/243926 "2020-08-06T14:45:07Z")
I have three nodes setup running oss-7.8.1 on CentOS 7 with SELinux Disabled I'm just trying to do a very basic initial setup as this is my first time playing with it. I have been reading different walkthroughs as well … --- ## [Transform data with false time range](https://discuss.elastic.co/t/transform-data-with-false-time-range/244015)
**Author:** [@marcospi](https://discuss.elastic.co/u/marcospi)\ **Replies:** 1\ **Last updated:** [August 6, 2020, 2:22pm UTC](https://discuss.elastic.co/t/transform-data-with-false-time-range/244015 "2020-08-06T14:22:20Z")
Hey there, I want to use the transform method to transform my original data in a more compact version. In my orignal data I have at aech document the fields "unique user Id" and the exact date. Now I want to transform … --- ## [Low level Java rest client very slow](https://discuss.elastic.co/t/low-level-java-rest-client-very-slow/244035)
**Author:** [@aldm](https://discuss.elastic.co/u/aldm)\ **Replies:** 0\ **Last updated:** [August 6, 2020, 2:02pm UTC](https://discuss.elastic.co/t/low-level-java-rest-client-very-slow/244035 "2020-08-06T14:02:27Z")
Hi. We're using Elasticsearch very extensively in our Scala (Akka based) system. We currently moved to Java low level rest client and we're experiencing some issues, namely requests take much more time executed with cli… --- ## [What is the bottleneck of elasticsearch? What gives the greatest performance boosts?](https://discuss.elastic.co/t/what-is-the-bottleneck-of-elasticsearch-what-gives-the-greatest-performance-boosts/243880)
**Author:** [@defalt](https://discuss.elastic.co/u/defalt)\ **Replies:** 5\ **Last updated:** [August 6, 2020, 1:37pm UTC](https://discuss.elastic.co/t/what-is-the-bottleneck-of-elasticsearch-what-gives-the-greatest-performance-boosts/243880 "2020-08-06T13:37:33Z")
Hi, its a general question: What limits elasticsearch the most? Lets say we have a normal node with: i5, 4 Cores 32GB, DDR4 Ram 2TB SSD What will give me the greates performance boost when I change these components? … --- ## [Elasticsearch nodes continually disconneting/reconnecting. Resulting in very high number of unassigned shards](https://discuss.elastic.co/t/elasticsearch-nodes-continually-disconneting-reconnecting-resulting-in-very-high-number-of-unassigned-shards/243784)
**Author:** [@anda](https://discuss.elastic.co/u/anda)\ **Replies:** 17\ **Last updated:** [August 6, 2020, 12:59pm UTC](https://discuss.elastic.co/t/elasticsearch-nodes-continually-disconneting-reconnecting-resulting-in-very-high-number-of-unassigned-shards/243784 "2020-08-06T12:59:43Z")
I'm running an es cluster (7.4) with 3 master, 3 data, and 1 coord node. After running smoothly for months, nodes began to continually disconnect/reconnect from the cluster. From observing, it seems like 1 particular ma… --- ## [Further optimization to ES queries / performance](https://discuss.elastic.co/t/further-optimization-to-es-queries-performance/244020)
**Author:** [@jyridevelopingsw](https://discuss.elastic.co/u/jyridevelopingsw)\ **Replies:** 0\ **Last updated:** [August 6, 2020, 12:25pm UTC](https://discuss.elastic.co/t/further-optimization-to-es-queries-performance/244020 "2020-08-06T12:25:12Z")
We have been very pleased with ES performance, but wondering is there a way to increase search performance even further? When running performance tests against ES cluster, the cluster is not the bottleneck and has enough… --- ## [How to use value from elasticsearch index as parameter in ES SQL functions, like DATE\_DIFF()](https://discuss.elastic.co/t/how-to-use-value-from-elasticsearch-index-as-parameter-in-es-sql-functions-like-date-diff/242365)
**Author:** [@burakka](https://discuss.elastic.co/u/burakka)\ **Replies:** 1\ **Last updated:** [July 27, 2020, 7:59am UTC](https://discuss.elastic.co/t/how-to-use-value-from-elasticsearch-index-as-parameter-in-es-sql-functions-like-date-diff/242365 "2020-07-27T07:59:26Z")
Hello guys! I want to use Elastic SQL with functions in Kibana Canvas. Therefore I tried to use the function DATE\_DIFF(), with values from an existing Elasticsearch index as parameter in the sql function. I looked at t… --- ## [Add custom fields, attributes to certificates](https://discuss.elastic.co/t/add-custom-fields-attributes-to-certificates/244004)
**Author:** [@Kosodrom](https://discuss.elastic.co/u/Kosodrom)\ **Replies:** 0\ **Last updated:** [August 6, 2020, 10:33am UTC](https://discuss.elastic.co/t/add-custom-fields-attributes-to-certificates/244004 "2020-08-06T10:33:00Z")
Hi, is it possible to add custom fields to certificates during the creation using elasticsearch certutil https://www.elastic.co/guide/en/elasticsearch/reference/7.8/certutil.html? My Use case: I want to create new clie… --- ## [Aggregate on string prefix extract value from suffix](https://discuss.elastic.co/t/aggregate-on-string-prefix-extract-value-from-suffix/243984)
**Author:** [@Yonatan\_Omer](https://discuss.elastic.co/u/Yonatan_Omer)\ **Replies:** 0\ **Last updated:** [August 6, 2020, 9:01am UTC](https://discuss.elastic.co/t/aggregate-on-string-prefix-extract-value-from-suffix/243984 "2020-08-06T09:01:17Z")
In our case we have unknown number of metric types. In order to avoid nested types due to the known problem Locene flattening the objects, and avoid mapping explosion, I'm considering using (prefixed) flat strings and d… --- ## [Pipeline aggregation in Composite Aggregation](https://discuss.elastic.co/t/pipeline-aggregation-in-composite-aggregation/243125)
**Author:** [@shreedhan](https://discuss.elastic.co/u/shreedhan)\ **Replies:** 4\ **Last updated:** [August 6, 2020, 9:12am UTC](https://discuss.elastic.co/t/pipeline-aggregation-in-composite-aggregation/243125 "2020-08-06T09:12:42Z")
I'm trying to get Pipeline Aggregation for Composite Aggregation similar to this post. I'm getting similar error in version 6.8. Looks like it was a bug in version 6.2. I'm wondering if this has been fixed in version 6.8… --- ## [Elastic performance on node 32GB RAM vs 64GB RAM](https://discuss.elastic.co/t/elastic-performance-on-node-32gb-ram-vs-64gb-ram/243986)
**Author:** [@Petr.Simik](https://discuss.elastic.co/u/Petr.Simik)\ **Replies:** 0\ **Last updated:** [August 6, 2020, 9:04am UTC](https://discuss.elastic.co/t/elastic-performance-on-node-32gb-ram-vs-64gb-ram/243986 "2020-08-06T09:04:38Z")
We have cluster in private cloud with node configuration (8vCPU, 64GB RAM, 1TB disk SSD/VSAN) in 13 data nodes + 3 master nodes. Due to better utilization of our cloud resources, our IT team asked me to reconfigure node… --- ## [Is it possible to implement this kind of friend search?](https://discuss.elastic.co/t/is-it-possible-to-implement-this-kind-of-friend-search/243985)
**Author:** [@demonatic](https://discuss.elastic.co/u/demonatic)\ **Replies:** 0\ **Last updated:** [August 6, 2020, 9:01am UTC](https://discuss.elastic.co/t/is-it-possible-to-implement-this-kind-of-friend-search/243985 "2020-08-06T09:01:40Z")
The basic idea is simple, we have some external kv pairs imply friend id and corresponding intimacy value that can pass to elasticsearch. We want to query first and get some match documents with corresponding text releva… --- ## [TransportClient Async calls not invoking all action listeners under heavy load in cross-cluster setup](https://discuss.elastic.co/t/transportclient-async-calls-not-invoking-all-action-listeners-under-heavy-load-in-cross-cluster-setup/243983)
**Author:** [@Roman\_Margolis](https://discuss.elastic.co/u/Roman_Margolis)\ **Replies:** 0\ **Last updated:** [August 6, 2020, 8:59am UTC](https://discuss.elastic.co/t/transportclient-async-calls-not-invoking-all-action-listeners-under-heavy-load-in-cross-cluster-setup/243983 "2020-08-06T08:59:28Z")
Hi, I managed to reproduce a scenario where using Transport Client 6.2.4 to send about 100 heavy search requests (heavy aggregation searches that hit many shards on the targeted cluster) with action listeners (every s… --- ## [How to split a field value into separated fields in elasticsearch](https://discuss.elastic.co/t/how-to-split-a-field-value-into-separated-fields-in-elasticsearch/240938)
**Author:** [@Hung\_M\_Le](https://discuss.elastic.co/u/Hung_M_Le)\ **Replies:** 6\ **Last updated:** [August 6, 2020, 8:51am UTC](https://discuss.elastic.co/t/how-to-split-a-field-value-into-separated-fields-in-elasticsearch/240938 "2020-08-06T08:51:22Z")
Hi I have the following issue that I hope to get some help to resolve background: . I ingest a log file using filebeat . I defined inside elasticsearch grok and kv statements to split incoming data into separated fi… --- ## [Tuning search to speed up shingle analyzer response time from 150ms to 30 ms](https://discuss.elastic.co/t/tuning-search-to-speed-up-shingle-analyzer-response-time-from-150ms-to-30-ms/243975)
**Author:** [@vivekatwal](https://discuss.elastic.co/u/vivekatwal)\ **Replies:** 0\ **Last updated:** [August 6, 2020, 8:03am UTC](https://discuss.elastic.co/t/tuning-search-to-speed-up-shingle-analyzer-response-time-from-150ms-to-30-ms/243975 "2020-08-06T08:03:41Z")
Hi, I am using shingle as search analyzer RAM: 16GB DDR4 SSD: 256 GB Heap size: 4gb Index size is: 700mb Total documents in index : 4 million A simple match query is made GET index/\_search { "query":{ "matc… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=840) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=842)