# Elasticsearch

**URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=844

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 845

---

## [Help reindexing to change date format](https://discuss.elastic.co/t/help-reindexing-to-change-date-format/243356)

<div class="topic-metadata">

**Author:** [@gius78](https://discuss.elastic.co/u/gius78)\
**Replies:** 3\
**Last updated:** [August 4, 2020, 2:01pm UTC](https://discuss.elastic.co/t/help-reindexing-to-change-date-format/243356 "2020-08-04T14:01:04Z")

</div>

Hi all, I have to change the timestamp format of documents in my index. Currently I have a "yyyymmddhhmmssZ" format. I have to change it to something that grafana can understand. So I think Epoch\_millis or ISO. can y…

---

## [CCS set-up](https://discuss.elastic.co/t/ccs-set-up/243711)

<div class="topic-metadata">

**Author:** [@Tuckson](https://discuss.elastic.co/u/Tuckson)\
**Replies:** 0\
**Last updated:** [August 4, 2020, 1:05pm UTC](https://discuss.elastic.co/t/ccs-set-up/243711 "2020-08-04T13:05:34Z")

</div>

Hi, On 2 locations I setup an elasticsearch cluster. Both run ok individually. Both also have a coordinating node. These nodes I want to connect to eachother to be able to do cross cluster search. So in the yml files …

---

## [What's the preferred way to update part of a nested document](https://discuss.elastic.co/t/whats-the-preferred-way-to-update-part-of-a-nested-document/243705)

<div class="topic-metadata">

**Author:** [@viebel](https://discuss.elastic.co/u/viebel)\
**Replies:** 0\
**Last updated:** [August 4, 2020, 12:36pm UTC](https://discuss.elastic.co/t/whats-the-preferred-way-to-update-part-of-a-nested-document/243705 "2020-08-04T12:36:26Z")

</div>

My document has a nested structure like this: PUT /customer/\_doc/1 { "name": "hello", "body": { "module": "aa", "config": "bb" } } Now, I'd like to update body field to be: { "module": "cc", "arg…

---

## [Need help in jq parser with my aggregrations](https://discuss.elastic.co/t/need-help-in-jq-parser-with-my-aggregrations/243701)

<div class="topic-metadata">

**Author:** [@Blason](https://discuss.elastic.co/u/Blason)\
**Replies:** 0\
**Last updated:** [August 4, 2020, 12:03pm UTC](https://discuss.elastic.co/t/need-help-in-jq-parser-with-my-aggregrations/243701 "2020-08-04T12:03:12Z")

</div>

Hi Guys, I am trying to figure out the Json data parsing out using jq from elastic 7.8. However I am confused and data is not being parsed correctly. Can someone pls help me with? "took": 1, "timed\_out": false, …

---

## [How to Get Bucket Key in Terms Aggregation to use in Sub Aggregations](https://discuss.elastic.co/t/how-to-get-bucket-key-in-terms-aggregation-to-use-in-sub-aggregations/243699)

<div class="topic-metadata">

**Author:** [@benjieperez28](https://discuss.elastic.co/u/benjieperez28)\
**Replies:** 0\
**Last updated:** [August 4, 2020, 11:41am UTC](https://discuss.elastic.co/t/how-to-get-bucket-key-in-terms-aggregation-to-use-in-sub-aggregations/243699 "2020-08-04T11:41:19Z")

</div>

Here I have an aggregation to determine each article count per publication, now my question is I have to make a sub aggregation base on per publication (bucket.key), is it possible to get the bucket key after the term a…

---

## [Upgrading my application from ES 5.3 to 7.7](https://discuss.elastic.co/t/upgrading-my-application-from-es-5-3-to-7-7/243527)

<div class="topic-metadata">

**Author:** [@taichi](https://discuss.elastic.co/u/taichi)\
**Replies:** 5\
**Last updated:** [August 4, 2020, 11:22am UTC](https://discuss.elastic.co/t/upgrading-my-application-from-es-5-3-to-7-7/243527 "2020-08-04T11:22:50Z")

</div>

I'm going to ES of my application (it's large) from version 5.3 to 7.7 I have to fix my application codes, finding difference between the two versions. Elastic documentation has many Breaking changes pages, correspondi…

---

## [Elastic stack hardware requirements](https://discuss.elastic.co/t/elastic-stack-hardware-requirements/243521)

<div class="topic-metadata">

**Author:** [@Gomeisa](https://discuss.elastic.co/u/Gomeisa)\
**Replies:** 3\
**Last updated:** [August 4, 2020, 11:16am UTC](https://discuss.elastic.co/t/elastic-stack-hardware-requirements/243521 "2020-08-04T11:16:04Z")

</div>

Hi I want to set up a cluster and I have these scenarios: I'm using ES, Kibana, filebeat(for logs) \[basic license\], a custom project instead of logstash Index heavy data, Not very frequent querying Monthly index with …

---

## [Error While Installing Elastic search plugins](https://discuss.elastic.co/t/error-while-installing-elastic-search-plugins/243170)

<div class="topic-metadata">

**Author:** [@WaseemSiddiqui](https://discuss.elastic.co/u/WaseemSiddiqui)\
**Replies:** 4\
**Last updated:** [August 4, 2020, 10:28am UTC](https://discuss.elastic.co/t/error-while-installing-elastic-search-plugins/243170 "2020-08-04T10:28:23Z")

</div>

Installing the ICU analysis 7.3.1. for Elastic Search 7.3.1 unfortunately I am getting a java error .C:\\Program Files\\Elastic\\Elasticsearch\\7.3.1\\bin\>elasticsearch-plugin.bat instal l path\\analysis-icu-7.3.1.zip -\> …

---

## [Incremental search on geo\_point](https://discuss.elastic.co/t/incremental-search-on-geo-point/243649)

<div class="topic-metadata">

**Author:** [@ocmvin](https://discuss.elastic.co/u/ocmvin)\
**Replies:** 3\
**Last updated:** [August 4, 2020, 9:59am UTC](https://discuss.elastic.co/t/incremental-search-on-geo-point/243649 "2020-08-04T09:59:40Z")

</div>

Wish to search a closest person from input geo\_point location . Quick steps to explain the requirement. Steps : 1: Add documents with person name and their lat /long details Expected result Request body shall contain g…

---

## [Changing mapping fields structure flow](https://discuss.elastic.co/t/changing-mapping-fields-structure-flow/243576)

<div class="topic-metadata">

**Author:** [@gitterhh](https://discuss.elastic.co/u/gitterhh)\
**Replies:** 1\
**Last updated:** [August 4, 2020, 9:50am UTC](https://discuss.elastic.co/t/changing-mapping-fields-structure-flow/243576 "2020-08-04T09:50:57Z")

</div>

I have an index with the mappings { "mappings": { "properties": { "title": { "type": "text" }, "location": { "type": "keyword" } } } } In lo…

---

## [Filter results by the length of the nested objects returned, similar to min\_child](https://discuss.elastic.co/t/filter-results-by-the-length-of-the-nested-objects-returned-similar-to-min-child/243582)

<div class="topic-metadata">

**Author:** [@Dustin\_Silk](https://discuss.elastic.co/u/Dustin_Silk)\
**Replies:** 1\
**Last updated:** [August 4, 2020, 9:48am UTC](https://discuss.elastic.co/t/filter-results-by-the-length-of-the-nested-objects-returned-similar-to-min-child/243582 "2020-08-04T09:48:55Z")

</div>

I'm trying to filter my results based on the number of nested objects found for a document. I've tried using scores but I cant get scores to work with filters, and I've tried a script but can't get that working either. …

---

## [Is it necessary to upgrade?](https://discuss.elastic.co/t/is-it-necessary-to-upgrade/243668)

<div class="topic-metadata">

**Author:** [@Benjamin\_Gathmann](https://discuss.elastic.co/u/Benjamin_Gathmann)\
**Replies:** 3\
**Last updated:** [August 4, 2020, 8:53am UTC](https://discuss.elastic.co/t/is-it-necessary-to-upgrade/243668 "2020-08-04T08:53:31Z")

</div>

We are running Elasticsearch v2.4 and are still happy with it. Are there any reasons to upgrade besides new features and performance improvements? E.g. are there any security issues with the 2.x branch? I could not fin…

---

## [How to group unique statistics records with overlapping fields (account and fingerprint)?](https://discuss.elastic.co/t/how-to-group-unique-statistics-records-with-overlapping-fields-account-and-fingerprint/243667)

<div class="topic-metadata">

**Author:** [@ange007](https://discuss.elastic.co/u/ange007)\
**Replies:** 0\
**Last updated:** [August 4, 2020, 8:01am UTC](https://discuss.elastic.co/t/how-to-group-unique-statistics-records-with-overlapping-fields-account-and-fingerprint/243667 "2020-08-04T08:01:45Z")

</div>

Hi. There is an index with fields: account\_id fingerprint etc. Each record may or may not have an account\_id , the same is with fingerprint . It is necessary to group them by account\_id along the way adding to th…

---

## [How To search on all the Ids in a Index in TermLookUp Mechanism](https://discuss.elastic.co/t/how-to-search-on-all-the-ids-in-a-index-in-termlookup-mechanism/243658)

<div class="topic-metadata">

**Author:** [@kashifa](https://discuss.elastic.co/u/kashifa)\
**Replies:** 0\
**Last updated:** [August 4, 2020, 7:23am UTC](https://discuss.elastic.co/t/how-to-search-on-all-the-ids-in-a-index-in-termlookup-mechanism/243658 "2020-08-04T07:23:14Z")

</div>

I have two indices namely "School" and "Student" and I have to join these two indices based on some criteria and populate the results. Let me state the example scenario here. School Data Example: { "resourceT…

---

## [Docker registry layer metadata correct?](https://discuss.elastic.co/t/docker-registry-layer-metadata-correct/243655)

<div class="topic-metadata">

**Author:** [@Just-Ross](https://discuss.elastic.co/u/Just-Ross)\
**Replies:** 0\
**Last updated:** [August 4, 2020, 6:45am UTC](https://discuss.elastic.co/t/docker-registry-layer-metadata-correct/243655 "2020-08-04T06:45:56Z")

</div>

Can someone offer advice here please - when querying docker.elastic.co for image layers (any 2+ schema) the results are totally different to a 3rd party registry for the identical image (e.g. AWS ECR): Authenticate to …

---

## [Elasticsearch-service on windows 10 not starting (es.path.conf not set)](https://discuss.elastic.co/t/elasticsearch-service-on-windows-10-not-starting-es-path-conf-not-set/243172)

<div class="topic-metadata">

**Author:** [@feva](https://discuss.elastic.co/u/feva)\
**Replies:** 1\
**Last updated:** [August 4, 2020, 6:33am UTC](https://discuss.elastic.co/t/elasticsearch-service-on-windows-10-not-starting-es-path-conf-not-set/243172 "2020-08-04T06:33:24Z")

</div>

I have some troubles installing elasticsearch as a service. I am working on Windows 10 with elasticsearch-7.8.0 The log files say Failed to start service 2020-07-30 08:50:17 Commons Daemon procrun stderr initialized …

---

## [How to Filter nested aggregations (busket results)](https://discuss.elastic.co/t/how-to-filter-nested-aggregations-busket-results/243190)

<div class="topic-metadata">

**Author:** [@aakhiezer](https://discuss.elastic.co/u/aakhiezer)\
**Replies:** 2\
**Last updated:** [August 4, 2020, 6:23am UTC](https://discuss.elastic.co/t/how-to-filter-nested-aggregations-busket-results/243190 "2020-08-04T06:23:22Z")

</div>

Hi all, I'm trying to filter an aggregations. I created aggregation for nested fields(pipe of id|value) of Badge field. It works good and return me buskets with pipe and doc\_count. But I want to filter them to return m…

---

## [Warning regarding jvm option UseConcMarkSweepGC was deprecated](https://discuss.elastic.co/t/warning-regarding-jvm-option-useconcmarksweepgc-was-deprecated/241398)

<div class="topic-metadata">

**Author:** [@pratiksha](https://discuss.elastic.co/u/pratiksha)\
**Replies:** 5\
**Last updated:** [August 4, 2020, 6:10am UTC](https://discuss.elastic.co/t/warning-regarding-jvm-option-useconcmarksweepgc-was-deprecated/241398 "2020-08-04T06:10:21Z")

</div>

Hi, We are currently on elasticsearch version 7.0.1 and about to upgrade to 7.8. In our elastic search logs, we observe a warning "OpenJDK 64-Bit Server VM warning: Option UseConcMarkSweepGC was deprecated in version …

---

## [Repair index after too many open files error](https://discuss.elastic.co/t/repair-index-after-too-many-open-files-error/243542)

<div class="topic-metadata">

**Author:** [@hunsw](https://discuss.elastic.co/u/hunsw)\
**Replies:** 1\
**Last updated:** [August 4, 2020, 5:41am UTC](https://discuss.elastic.co/t/repair-index-after-too-many-open-files-error/243542 "2020-08-04T05:41:30Z")

</div>

We had 'too many open files' error on several nodes and even though we fixed the problem, one shard fell into a sort of a limbo. # Relevant \_cluster/allocation/explain output: node01.example.com = {"in\_sync":true,"alloc…

---

## [I deleted the elasticsearch folder in /etc/elasticsearch/ , not sure how to restore back?](https://discuss.elastic.co/t/i-deleted-the-elasticsearch-folder-in-etc-elasticsearch-not-sure-how-to-restore-back/243585)

<div class="topic-metadata">

**Author:** [@Athiq\_Ahmed](https://discuss.elastic.co/u/Athiq_Ahmed)\
**Replies:** 3\
**Last updated:** [August 4, 2020, 5:33am UTC](https://discuss.elastic.co/t/i-deleted-the-elasticsearch-folder-in-etc-elasticsearch-not-sure-how-to-restore-back/243585 "2020-08-04T05:33:21Z")

</div>

I have built the Flask application(Python) which is linked to Elasticsearch(port:9200), Now I need to deploy this application within AWS EC2, however while performing I deleted the Elasticsearch folder within /etc and no…

---

## [Does Elasticsearch automatically compress indexes?](https://discuss.elastic.co/t/does-elasticsearch-automatically-compress-indexes/243354)

<div class="topic-metadata">

**Author:** [@d.silwon](https://discuss.elastic.co/u/d.silwon)\
**Replies:** 5\
**Last updated:** [August 4, 2020, 5:27am UTC](https://discuss.elastic.co/t/does-elasticsearch-automatically-compress-indexes/243354 "2020-08-04T05:27:23Z")

</div>

Dears, We have ELK in version 7.7.1. Everyday we send to ELK logs is size about 30GB. I'm worried about FS space. My question is does Elasticsearch automatically compress indexes? or Should it be forced with the corr…

---

## [Kibana Stack Monitoring Elasticsearch JVM Heap is not changing](https://discuss.elastic.co/t/kibana-stack-monitoring-elasticsearch-jvm-heap-is-not-changing/243494)

<div class="topic-metadata">

**Author:** [@evacch](https://discuss.elastic.co/u/evacch)\
**Replies:** 3\
**Last updated:** [August 4, 2020, 4:04am UTC](https://discuss.elastic.co/t/kibana-stack-monitoring-elasticsearch-jvm-heap-is-not-changing/243494 "2020-08-04T04:04:21Z")

</div>

I have changed the jvm.options of my Elasticsearch yml file to min 3GB and max 3GB as shown below to retrieve the heap status. However, the JVM heap in Elasticsearch in Kibana Stack Monitoring is not updated and it's …

---

## [Sample Dashboard isnt working](https://discuss.elastic.co/t/sample-dashboard-isnt-working/243642)

<div class="topic-metadata">

**Author:** [@samoffice](https://discuss.elastic.co/u/samoffice)\
**Replies:** 1\
**Last updated:** [August 4, 2020, 3:19am UTC](https://discuss.elastic.co/t/sample-dashboard-isnt-working/243642 "2020-08-04T03:19:58Z")

</div>

Trying to create a build a sample dashboard based on this sample given: https://www.elastic.co/guide/en/kibana/current/tutorial-build-dashboard.html Facing following errors: Trying to set mappings as below: PUT /shak…

---

## [Invalid NEST response built from a unsuccessful (401) low level call on HEAD: /](https://discuss.elastic.co/t/invalid-nest-response-built-from-a-unsuccessful-401-low-level-call-on-head/243537)

<div class="topic-metadata">

**Author:** [@buka\_bidzina](https://discuss.elastic.co/u/buka_bidzina)\
**Replies:** 1\
**Last updated:** [August 3, 2020, 11:37pm UTC](https://discuss.elastic.co/t/invalid-nest-response-built-from-a-unsuccessful-401-low-level-call-on-head/243537 "2020-08-03T23:37:01Z")

</div>

Invalid NEST response built from a unsuccessful (401) low level call on HEAD: / Audit trail of this API call: \[1\] BadResponse: Node: http://es.test.dev/ Exception: PipelineException Took: 00:00:00.1126819 OriginalExce…

---

## [Connect to ElasticSearch through a wrapper](https://discuss.elastic.co/t/connect-to-elasticsearch-through-a-wrapper/242876)

<div class="topic-metadata">

**Author:** [@itsbalur](https://discuss.elastic.co/u/itsbalur)\
**Replies:** 1\
**Last updated:** [August 3, 2020, 11:33pm UTC](https://discuss.elastic.co/t/connect-to-elasticsearch-through-a-wrapper/242876 "2020-08-03T23:33:38Z")

</div>

We use NEST API version 7.4 to connect to ES cluster with four nodes running v 7.4 The connection settings are as follows var nodeUrls = "url1~url2~url3~url4".Split('~').Select(u =\> new Uri(u)); var nodes = nod…

---

## [RestHighLevelClient re-connect on connection reset](https://discuss.elastic.co/t/resthighlevelclient-re-connect-on-connection-reset/243203)

<div class="topic-metadata">

**Author:** [@gitterhh](https://discuss.elastic.co/u/gitterhh)\
**Replies:** 0\
**Last updated:** [July 30, 2020, 10:32am UTC](https://discuss.elastic.co/t/resthighlevelclient-re-connect-on-connection-reset/243203 "2020-07-30T10:32:03Z")

</div>

I am using Spring + RestHighLevelClient to send data to Elasticsearch restHighLevelClient.search(searchRequest, RequestOptions.DEFAULT) But when the system has been idle for a while, the following exception is thrown j…

---

## [DEFAULT\_MAX\_CONN\_TOTAL value in RestClientBuilder](https://discuss.elastic.co/t/default-max-conn-total-value-in-restclientbuilder/243219)

<div class="topic-metadata">

**Author:** [@Shubham\_Mittal](https://discuss.elastic.co/u/Shubham_Mittal)\
**Replies:** 0\
**Last updated:** [July 30, 2020, 12:48pm UTC](https://discuss.elastic.co/t/default-max-conn-total-value-in-restclientbuilder/243219 "2020-07-30T12:48:44Z")

</div>

Hi , Please suggest if DEFAULT\_MAX\_CONN\_TOTAL value ie. 30 should be increased while initializing the client , if there is a use case for more than 100 like upto 500 elasticsearch concurrent requests using 1 client with…

---

## [Need help with Index Lifecycle Policy](https://discuss.elastic.co/t/need-help-with-index-lifecycle-policy/243391)

<div class="topic-metadata">

**Author:** [@uklipse](https://discuss.elastic.co/u/uklipse)\
**Replies:** 0\
**Last updated:** [July 31, 2020, 7:24pm UTC](https://discuss.elastic.co/t/need-help-with-index-lifecycle-policy/243391 "2020-07-31T19:24:55Z")

</div>

I'm trying to create a Index Lifecycle Policy but it's not rolling over. I've got the policy created to rollover at a certain size and it's linked to my index. I setup the index name of dns-7.6.2-000001 and gave it an al…

---

## [Kibana server is not ready yet](https://discuss.elastic.co/t/kibana-server-is-not-ready-yet/243515)

<div class="topic-metadata">

**Author:** [@headtea](https://discuss.elastic.co/u/headtea)\
**Replies:** 1\
**Last updated:** [August 3, 2020, 10:13pm UTC](https://discuss.elastic.co/t/kibana-server-is-not-ready-yet/243515 "2020-08-03T22:13:04Z")

</div>

As an attempt to secure communications from beats to elasticsearch, I've followed this "Securing ES with HTTP" part of the guide and as part 4 says, I've followed the readme for kibana by adding these lines to kibana.yml …

---

## [How to set total limit field to be other than 1000 by default](https://discuss.elastic.co/t/how-to-set-total-limit-field-to-be-other-than-1000-by-default/243564)

<div class="topic-metadata">

**Author:** [@Abdul\_Hameed](https://discuss.elastic.co/u/Abdul_Hameed)\
**Replies:** 3\
**Last updated:** [August 3, 2020, 9:30pm UTC](https://discuss.elastic.co/t/how-to-set-total-limit-field-to-be-other-than-1000-by-default/243564 "2020-08-03T21:30:18Z")

</div>

Hi, I would like to increase the limit of total fields for my indices. I know that we can change it in Kibana by sending an API call as such: PUT logstash-\*/\_settings { "index.mapping.total\_fields.limit": 5000 } Bu…

[Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=843)

[Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=845)
