# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=846 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 847 --- ## [Data/write/bulk running time way too long. How do you cancel?](https://discuss.elastic.co/t/data-write-bulk-running-time-way-too-long-how-do-you-cancel/243484)
**Author:** [@Dandy](https://discuss.elastic.co/u/Dandy)\ **Replies:** 3\ **Last updated:** [August 3, 2020, 7:21am UTC](https://discuss.elastic.co/t/data-write-bulk-running-time-way-too-long-how-do-you-cancel/243484 "2020-08-03T07:21:45Z")
I have a bunch of odd tasks that are taking up a ton of load on my nodes with no way to cancel them. They definitely seem stuck. All indices are still open, so it's not an issue with the index becoming unavailable. Shard… --- ## [Time taken to execute query fluctuates](https://discuss.elastic.co/t/time-taken-to-execute-query-fluctuates/243359)
**Author:** [@techie\_2020](https://discuss.elastic.co/u/techie_2020)\ **Replies:** 1\ **Last updated:** [August 3, 2020, 7:08am UTC](https://discuss.elastic.co/t/time-taken-to-execute-query-fluctuates/243359 "2020-08-03T07:08:30Z")
I have this query GET \_search { "query": { "bool": { "must" : \[{"match" : {"track\_id" : 4}}\] } } } However the time take fluctuates between… --- ## [All shards failed](https://discuss.elastic.co/t/all-shards-failed/242935)
**Author:** [@Alvaro\_Sanz](https://discuss.elastic.co/u/Alvaro_Sanz)\ **Replies:** 8\ **Last updated:** [August 3, 2020, 6:49am UTC](https://discuss.elastic.co/t/all-shards-failed/242935 "2020-08-03T06:49:13Z")
Hello, I am running elastic Stack (beats -\> logstash -\> elasticsearch -\> kibana). It is a single server (no cluster) that is collecting data from 10 or so servers (auditbeat and filebeat). Today, it stopped working. I … --- ## [3 node cluster behind F5 VIP, how to configure?](https://discuss.elastic.co/t/3-node-cluster-behind-f5-vip-how-to-configure/243296)
**Author:** [@wardallen](https://discuss.elastic.co/u/wardallen)\ **Replies:** 4\ **Last updated:** [August 3, 2020, 4:03am UTC](https://discuss.elastic.co/t/3-node-cluster-behind-f5-vip-how-to-configure/243296 "2020-08-03T04:03:15Z")
I have a 3 node cluster, and I'm wondering how to configure the network settings in the nodes now that an F5 VIP has entered the picture. The hosts: node1 - 10.1.1.1 node2 - 10.1.1.2 node3 - 10.1.1.3 The F5 VIP is s… --- ## [How to configuring system settings on elasticsearch cloud](https://discuss.elastic.co/t/how-to-configuring-system-settings-on-elasticsearch-cloud/243336)
**Author:** [@chautm](https://discuss.elastic.co/u/chautm)\ **Replies:** 2\ **Last updated:** [August 3, 2020, 2:39am UTC](https://discuss.elastic.co/t/how-to-configuring-system-settings-on-elasticsearch-cloud/243336 "2020-08-03T02:39:04Z")
Hi everybody, I'm try to config system settings on elastic cloud, as bootstrap.memory\_lock by PUT /\_cluster/settings but failed. Anyone know how to configure it? Thanks. --- ## [Update by query on nested mapping](https://discuss.elastic.co/t/update-by-query-on-nested-mapping/243290)
**Author:** [@e-rossi](https://discuss.elastic.co/u/e-rossi)\ **Replies:** 3\ **Last updated:** [August 2, 2020, 9:44pm UTC](https://discuss.elastic.co/t/update-by-query-on-nested-mapping/243290 "2020-08-02T21:44:50Z")
So, I've successfully created a field and added a value for it in existing documents using the put mapping and update by query APIs with the following NEW\_FIELD = { 'properties': { 'deleted': { … --- ## [Failed to connect to backoff, data path already locked by another beat](https://discuss.elastic.co/t/failed-to-connect-to-backoff-data-path-already-locked-by-another-beat/243480)
**Author:** [@Anthony\_Allen](https://discuss.elastic.co/u/Anthony_Allen)\ **Replies:** 0\ **Last updated:** [August 2, 2020, 8:33pm UTC](https://discuss.elastic.co/t/failed-to-connect-to-backoff-data-path-already-locked-by-another-beat/243480 "2020-08-02T20:33:45Z")
Elasticsearch and filebeats, auditbeats, packetbeats, metricbeats and Logstash are running on the following: Ubuntu 18.04 2 core , 64 bit, 4GB RAM All the aformentioned beats and Logstash have been systemctl stopped (… --- ## [Cardinality aggregation always returning one extra count](https://discuss.elastic.co/t/cardinality-aggregation-always-returning-one-extra-count/243462)
**Author:** [@Hardik\_Jain](https://discuss.elastic.co/u/Hardik_Jain)\ **Replies:** 0\ **Last updated:** [August 2, 2020, 2:49pm UTC](https://discuss.elastic.co/t/cardinality-aggregation-always-returning-one-extra-count/243462 "2020-08-02T14:49:15Z")
I am new to elasticsearch and wanted to query the number of clients at fixed\_interval of 1 hour and hence used the cardinality aggregation along with date\_histogram aggregation. The problem is, the cardinality aggregatio… --- ## [Client node is frequently getting out from cluster](https://discuss.elastic.co/t/client-node-is-frequently-getting-out-from-cluster/243415)
**Author:** [@muthug](https://discuss.elastic.co/u/muthug)\ **Replies:** 13\ **Last updated:** [August 2, 2020, 9:24am UTC](https://discuss.elastic.co/t/client-node-is-frequently-getting-out-from-cluster/243415 "2020-08-02T09:24:20Z")
Hi All, Greetings !! I am new to ELK. and below is my setup. Total 9 nodes (6 data node + 2 client node + 1 Management Node) Every 12 - 20 mins my both client node are getting out from cluster and its getting joined … --- ## [Best specs for a single cluster?](https://discuss.elastic.co/t/best-specs-for-a-single-cluster/243389)
**Author:** [@elk6](https://discuss.elastic.co/u/elk6)\ **Replies:** 5\ **Last updated:** [August 2, 2020, 7:07am UTC](https://discuss.elastic.co/t/best-specs-for-a-single-cluster/243389 "2020-08-02T07:07:08Z")
Bossman wants to deploy a cluster of logstash, elasticsearch and kibana on one machine. He says high availability doesn't matter much since we have a different platform to monitor servers and this would be used to store … --- ## [Snapshot Deletion Takes a very long time](https://discuss.elastic.co/t/snapshot-deletion-takes-a-very-long-time/242222)
**Author:** [@proton](https://discuss.elastic.co/u/proton)\ **Replies:** 10\ **Last updated:** [August 2, 2020, 6:35am UTC](https://discuss.elastic.co/t/snapshot-deletion-takes-a-very-long-time/242222 "2020-08-02T06:35:05Z")
Hello, We have snapshots for ES 7.5.2 cluster in Google Cloud Storage(GCS). We have a lot of snapshots going almost a year back and now we are trying to delete the snapshots and keep only last 90 days of data. In the pr… --- ## [I want to achieve conditional query in elastic search as described](https://discuss.elastic.co/t/i-want-to-achieve-conditional-query-in-elastic-search-as-described/243431)
**Author:** [@Saumya\_Mishra](https://discuss.elastic.co/u/Saumya_Mishra)\ **Replies:** 1\ **Last updated:** [August 1, 2020, 10:03pm UTC](https://discuss.elastic.co/t/i-want-to-achieve-conditional-query-in-elastic-search-as-described/243431 "2020-08-01T22:03:19Z")
/\* I want to achieve this kind of conditional query in ElasticSearch using PHP client library, I want to execute the match clause(In ElasticSearch) only if the the value is set or if there is some value \*/ $sql="select … --- ## [From where should i start elastic search, I am beginner for Elastic search?](https://discuss.elastic.co/t/from-where-should-i-start-elastic-search-i-am-beginner-for-elastic-search/243426)
**Author:** [@prabhunath](https://discuss.elastic.co/u/prabhunath)\ **Replies:** 1\ **Last updated:** [August 1, 2020, 6:34pm UTC](https://discuss.elastic.co/t/from-where-should-i-start-elastic-search-i-am-beginner-for-elastic-search/243426 "2020-08-01T18:34:05Z")
From where should I start the elastic search, I am a beginner for Elastic search? Please, anyone, suggest to me. --- ## [Realtime search based on 2 indexes](https://discuss.elastic.co/t/realtime-search-based-on-2-indexes/240402)
**Author:** [@mexekanez](https://discuss.elastic.co/u/mexekanez)\ **Replies:** 3\ **Last updated:** [August 1, 2020, 11:57am UTC](https://discuss.elastic.co/t/realtime-search-based-on-2-indexes/240402 "2020-08-01T11:57:47Z")
Hello to all! I need some kind of advice, so in general, I have 2 indexes: The first index its aliases ex: my\_name -\> Barak Trump (an amount in first interactions about 50 000 can be much more) Seconds Index it's … --- ## [Elasticsearch change log level](https://discuss.elastic.co/t/elasticsearch-change-log-level/243293)
**Author:** [@RAM\_NATHAN](https://discuss.elastic.co/u/RAM_NATHAN)\ **Replies:** 4\ **Last updated:** [July 31, 2020, 7:38am UTC](https://discuss.elastic.co/t/elasticsearch-change-log-level/243293 "2020-07-31T07:38:14Z")
Hi There are lot of configurations in log4j properties. I'm using logstash to insert records to elasticsearch and I need to log those. what is the effect of changing below config? logger.action.name = org.elasticsearc… --- ## [Elasticsearch nodes are leaving the cluster continuously](https://discuss.elastic.co/t/elasticsearch-nodes-are-leaving-the-cluster-continuously/242853)
**Author:** [@darshan](https://discuss.elastic.co/u/darshan)\ **Replies:** 20\ **Last updated:** [August 1, 2020, 6:29am UTC](https://discuss.elastic.co/t/elasticsearch-nodes-are-leaving-the-cluster-continuously/242853 "2020-08-01T06:29:29Z")
Hi, The nodes in the cluster are leaving continuously and rejoins after few seconds. when I checked for error it says "master not discovered yet: have discovered" error. I don't have any clue what is happening. please c… --- ## [Where elasticsearch stores policy? and how it picks up?](https://discuss.elastic.co/t/where-elasticsearch-stores-policy-and-how-it-picks-up/242622)
**Author:** [@abb](https://discuss.elastic.co/u/abb)\ **Replies:** 17\ **Last updated:** [August 1, 2020, 5:03am UTC](https://discuss.elastic.co/t/where-elasticsearch-stores-policy-and-how-it-picks-up/242622 "2020-08-01T05:03:03Z")
I am using Opendistro for ES 1.9.0 , logstash and kibana. I have created few index templates and policies. Now as per this I placed all my templates. It didn't got picked up.. And also where do I need to copy all my… --- ## [Discovery and TSVB, doesn't recognize index patterns change](https://discuss.elastic.co/t/discovery-and-tsvb-doesnt-recognize-index-patterns-change/243365)
**Author:** [@Incauto](https://discuss.elastic.co/u/Incauto)\ **Replies:** 6\ **Last updated:** [August 1, 2020, 12:01am UTC](https://discuss.elastic.co/t/discovery-and-tsvb-doesnt-recognize-index-patterns-change/243365 "2020-08-01T00:01:45Z")
I have 4 index patterns with data from diferents sources, in the index pattern section of Kibana I can see the different fields of the indexes, but in discovery and TSVB the fields remain the same when I change the index… --- ## [Computing percentages in transforms](https://discuss.elastic.co/t/computing-percentages-in-transforms/242916)
**Author:** [@cecchet](https://discuss.elastic.co/u/cecchet)\ **Replies:** 5\ **Last updated:** [July 31, 2020, 9:43pm UTC](https://discuss.elastic.co/t/computing-percentages-in-transforms/242916 "2020-07-31T21:43:49Z")
I have a transform that calculates hourly stats of users on each floor of each building: { "id": "building-floor", "source": { "index": \[ "anindex" \], "query": { "match\_all": {} } }, … --- ## [Logstash -\> Elasticsearch index template](https://discuss.elastic.co/t/logstash-elasticsearch-index-template/243339)
**Author:** [@egray](https://discuss.elastic.co/u/egray)\ **Replies:** 9\ **Last updated:** [July 31, 2020, 8:52pm UTC](https://discuss.elastic.co/t/logstash-elasticsearch-index-template/243339 "2020-07-31T20:52:23Z")
I am running Logstash and a three-node Elasticsearch cluster in docker containers. In the Elasticsearch output plugin of Logstash, I'm attempting to use a custom index template with the following lines in logstash.conf: … --- ## [Bootstrap.password not working](https://discuss.elastic.co/t/bootstrap-password-not-working/243374)
**Author:** [@MorgenComm](https://discuss.elastic.co/u/MorgenComm)\ **Replies:** 1\ **Last updated:** [July 31, 2020, 7:39pm UTC](https://discuss.elastic.co/t/bootstrap-password-not-working/243374 "2020-07-31T19:39:03Z")
Hi, I'm trying to setup a new cluster with the official Ansible playbook, which I have done in previous versions 7.7 okay. However I'm trying to create another test cluster on 7.8.1 with security enabled, and the basic … --- ## [One index template for multiple indices](https://discuss.elastic.co/t/one-index-template-for-multiple-indices/242814)
**Author:** [@randoran](https://discuss.elastic.co/u/randoran)\ **Replies:** 2\ **Last updated:** [July 31, 2020, 4:20pm UTC](https://discuss.elastic.co/t/one-index-template-for-multiple-indices/242814 "2020-07-31T16:20:50Z")
Is it possible to use one index template for multiple indices? I have an index pattern of cw-\* so that it matches any index that starts with cw- But I have an ILM policy attached to this template. It has an alias but fro… --- ## [Dynamic Template Not Working - float vs long - Metricbeat Windows Perfmon Counters](https://discuss.elastic.co/t/dynamic-template-not-working-float-vs-long-metricbeat-windows-perfmon-counters/243105)
**Author:** [@mazoutte](https://discuss.elastic.co/u/mazoutte)\ **Replies:** 1\ **Last updated:** [July 31, 2020, 1:28pm UTC](https://discuss.elastic.co/t/dynamic-template-not-working-float-vs-long-metricbeat-windows-perfmon-counters/243105 "2020-07-31T13:28:48Z")
Hello, I'm using ELK + Kafka. Version : 7.6.2 I'm monitoring Windows machines with Metricbeat and the perfmon module to get some counters. Here are some counters pulled (a lot of NTDS counters actually, just an exam… --- ## [Elasticsearch node disk space?](https://discuss.elastic.co/t/elasticsearch-node-disk-space/242174)
**Author:** [@Divit\_Sharma](https://discuss.elastic.co/u/Divit_Sharma)\ **Replies:** 7\ **Last updated:** [July 31, 2020, 12:24pm UTC](https://discuss.elastic.co/t/elasticsearch-node-disk-space/242174 "2020-07-31T12:24:27Z")
How much disk space should be given to : Dedicated Client Node Dedicated Kibana Node Will 10gb suffice? Currently the setup is, 3 Master node, 15 gb ram, 100Gb hard disk 4 Data node, 62 gb ram, 1tb hard disk 2 cli… --- ## [Run elasticsearch code source without docker](https://discuss.elastic.co/t/run-elasticsearch-code-source-without-docker/243060)
**Author:** [@TheHunter1](https://discuss.elastic.co/u/TheHunter1)\ **Replies:** 4\ **Last updated:** [July 31, 2020, 10:03am UTC](https://discuss.elastic.co/t/run-elasticsearch-code-source-without-docker/243060 "2020-07-31T10:03:30Z")
Hello everybody, I am trying to run elasticsearch code source, and when I try to run the command ./gradlew assemble I am getting this exception: ======================================= Elasticsearch Build Hamster says… --- ## [Reading just once in Elastic (Multi-instance)](https://discuss.elastic.co/t/reading-just-once-in-elastic-multi-instance/243317)
**Author:** [@Ullas7](https://discuss.elastic.co/u/Ullas7)\ **Replies:** 1\ **Last updated:** [July 31, 2020, 9:15am UTC](https://discuss.elastic.co/t/reading-just-once-in-elastic-multi-instance/243317 "2020-07-31T09:15:22Z")
Is it possible to read only once in elastic? Assume I have 4 microservices which reads by timestamp, assuming four microservice has same query and timestamp as a query param. What I am trying to achieve is if any micros… --- ## [Filebeat doesn't sent the logs to elastic cloud (circuit\_breaking\_exception)](https://discuss.elastic.co/t/filebeat-doesnt-sent-the-logs-to-elastic-cloud-circuit-breaking-exception/243204)
**Author:** [@David\_Oceans](https://discuss.elastic.co/u/David_Oceans)\ **Replies:** 9\ **Last updated:** [July 31, 2020, 8:50am UTC](https://discuss.elastic.co/t/filebeat-doesnt-sent-the-logs-to-elastic-cloud-circuit-breaking-exception/243204 "2020-07-31T08:50:10Z")
Hi! I don't know why I get this error (agents filebeat in kubernetes cluster), if we increased the size of the cluster so that it had more performance and changed the indexes so that instead of 1 shard and 1 replica th… --- ## [Repository-gcs plugin 5.2.2 and Google Global HTTP batch endpoint](https://discuss.elastic.co/t/repository-gcs-plugin-5-2-2-and-google-global-http-batch-endpoint/243229)
**Author:** [@MMH](https://discuss.elastic.co/u/MMH)\ **Replies:** 1\ **Last updated:** [July 31, 2020, 8:01am UTC](https://discuss.elastic.co/t/repository-gcs-plugin-5-2-2-and-google-global-http-batch-endpoint/243229 "2020-07-31T08:01:56Z")
Hi, Google is deprecating Global HTTP batch endpoint on Aug 12th: https://www.google.com/url?q=https://developers.googleblog.com/2018/03/discontinuing-support-for-json-rpc-and.html On the ES 5.2 cluster, the repository… --- ## [The allocation of machines for different in ELK](https://discuss.elastic.co/t/the-allocation-of-machines-for-different-in-elk/243238)
**Author:** [@iammanmale](https://discuss.elastic.co/u/iammanmale)\ **Replies:** 2\ **Last updated:** [July 31, 2020, 7:41am UTC](https://discuss.elastic.co/t/the-allocation-of-machines-for-different-in-elk/243238 "2020-07-31T07:41:45Z")
I have 5 machines to form a elasticsearch cluster. How should I use them in order to maximise the performance? Should I install elasticsearch and logstash on each machine and install kibana on one of them? or should I i… --- ## [Way to add proxy host settings for repository-gcs plugin in ES 7.5.2?](https://discuss.elastic.co/t/way-to-add-proxy-host-settings-for-repository-gcs-plugin-in-es-7-5-2/243309)
**Author:** [@nishant.saini](https://discuss.elastic.co/u/nishant.saini)\ **Replies:** 0\ **Last updated:** [July 31, 2020, 6:31am UTC](https://discuss.elastic.co/t/way-to-add-proxy-host-settings-for-repository-gcs-plugin-in-es-7-5-2/243309 "2020-07-31T06:31:16Z")
Is there a way to provide proxy.host and proxy.port for repository-gcs plugin. The same can be easily done for repository-s3 by setting the following in elasticsearch.yml: s3.client.default.protocol: http s3.client.defa… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=845) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=847)