# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=847 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 848 --- ## [Autocomplete that matches phrase prefix](https://discuss.elastic.co/t/autocomplete-that-matches-phrase-prefix/243318)
**Author:** [@emanu](https://discuss.elastic.co/u/emanu)\ **Replies:** 0\ **Last updated:** [July 31, 2020, 7:03am UTC](https://discuss.elastic.co/t/autocomplete-that-matches-phrase-prefix/243318 "2020-07-31T07:03:20Z")
Hello, I'm trying to achive an autocomplete that will match an exact phrase prefix. But I don't care where this phrase will be a.k.a in the start of the sentence, in the middle or the end. For exapmle: "Brown f" -\> "… --- ## [Seperate filebeats for different groups of servers](https://discuss.elastic.co/t/seperate-filebeats-for-different-groups-of-servers/242908)
**Author:** [@vape](https://discuss.elastic.co/u/vape)\ **Replies:** 4\ **Last updated:** [July 31, 2020, 6:25am UTC](https://discuss.elastic.co/t/seperate-filebeats-for-different-groups-of-servers/242908 "2020-07-31T06:25:17Z")
Hello, I am very new to ELK, please help me to clarify something here. So I have installed an instace of ELK all in one server for testing. I could ship the log to logstash from my servers using filebeat. I also enable … --- ## [Elasticsearch Delete Index Performance](https://discuss.elastic.co/t/elasticsearch-delete-index-performance/243301)
**Author:** [@es\_is\_hard](https://discuss.elastic.co/u/es_is_hard)\ **Replies:** 4\ **Last updated:** [July 31, 2020, 6:03am UTC](https://discuss.elastic.co/t/elasticsearch-delete-index-performance/243301 "2020-07-31T06:03:20Z")
Hello! I'm looking into the performance of the delete index API and had a few questions: How fast is deleting an Elasticsearch index? Any estimates on how long it would take to delete an index with 100s of GB of data? … --- ## [Elasticsearch service gets killed](https://discuss.elastic.co/t/elasticsearch-service-gets-killed/243039)
**Author:** [@Abdul\_Hameed](https://discuss.elastic.co/u/Abdul_Hameed)\ **Replies:** 7\ **Last updated:** [July 31, 2020, 5:14am UTC](https://discuss.elastic.co/t/elasticsearch-service-gets-killed/243039 "2020-07-31T05:14:07Z")
Hi, I have a setup of ELK on one server. Elasticsearch service and kibana run fine until I start the logstash service. When I start logstash, elasticsearch gets killed instantly and I see this error: elasticsearch sys… --- ## [Security index goes yellow when 1 of 3 masters go down](https://discuss.elastic.co/t/security-index-goes-yellow-when-1-of-3-masters-go-down/243036)
**Author:** [@sudeera](https://discuss.elastic.co/u/sudeera)\ **Replies:** 7\ **Last updated:** [July 31, 2020, 5:07am UTC](https://discuss.elastic.co/t/security-index-goes-yellow-when-1-of-3-masters-go-down/243036 "2020-07-31T05:07:21Z")
Hi Support, We have 6 node elasticsearch cluster. Node 1 is master and Node 2 and 6 are master eligible. Node 3, 4, 5, 6 are data nodes. Node 1,2,3,4,5 have same rack\_id and Node6 has a different rack\_id. When we have… --- ## [After reindex, new index has same documents but data size is much less](https://discuss.elastic.co/t/after-reindex-new-index-has-same-documents-but-data-size-is-much-less/243068)
**Author:** [@mikewillis](https://discuss.elastic.co/u/mikewillis)\ **Replies:** 3\ **Last updated:** [July 31, 2020, 4:45am UTC](https://discuss.elastic.co/t/after-reindex-new-index-has-same-documents-but-data-size-is-much-less/243068 "2020-07-31T04:45:26Z")
As part of preparation for moving from Elasticsearch 6 to 7, I've reindexed an index which the Kibana Upgade Assistant flagged as "Index has more than one mapping type". The reindex completed without apparent error, the… --- ## [Need to understand difference between alias and rollover\_alias while creating index template for ILM implementation to multiple environments](https://discuss.elastic.co/t/need-to-understand-difference-between-alias-and-rollover-alias-while-creating-index-template-for-ilm-implementation-to-multiple-environments/242599)
**Author:** [@adeel109](https://discuss.elastic.co/u/adeel109)\ **Replies:** 0\ **Last updated:** [July 25, 2020, 11:19am UTC](https://discuss.elastic.co/t/need-to-understand-difference-between-alias-and-rollover-alias-while-creating-index-template-for-ilm-implementation-to-multiple-environments/242599 "2020-07-25T11:19:40Z")
I have one ILM policy named haproxy-ilm for all haprox logs. There are 4 different indices to which logs from each environment are written, i.e., dev, prestaging, staging, and production. Below is the configuration of l… --- ## [Geo shape self-intersection](https://discuss.elastic.co/t/geo-shape-self-intersection/242584)
**Author:** [@DenisDeis](https://discuss.elastic.co/u/DenisDeis)\ **Replies:** 4\ **Last updated:** [July 31, 2020, 3:56am UTC](https://discuss.elastic.co/t/geo-shape-self-intersection/242584 "2020-07-31T03:56:13Z")
I have the following feature: { "type": "Feature", "properties": { }, "geometry": { "type": "Polygon", "coordinates": \[\[ \[77.500, 13.500\], \[77.600, 13.500\], \[77.600, 13.400\], \[77.590, 13.400\], \[77.590, 13.390\], \[77.600,… --- ## [Elasticsearch master(8.0.0) nodes can't form into a cluster](https://discuss.elastic.co/t/elasticsearch-master-8-0-0-nodes-cant-form-into-a-cluster/243153)
**Author:** [@vsop\_479](https://discuss.elastic.co/u/vsop_479)\ **Replies:** 2\ **Last updated:** [July 31, 2020, 3:02am UTC](https://discuss.elastic.co/t/elasticsearch-master-8-0-0-nodes-cant-form-into-a-cluster/243153 "2020-07-31T03:02:20Z")
I configured three nodes with elasticsearch master branch（8.0.0）,but they can't form into a cluster. It seems they don't attempt to connection each other. Here is my configuration: node1: cluster.name: es-cluster node… --- ## [Trying to create too many scroll contexts for .security index](https://discuss.elastic.co/t/trying-to-create-too-many-scroll-contexts-for-security-index/243188)
**Author:** [@munkyu](https://discuss.elastic.co/u/munkyu)\ **Replies:** 0\ **Last updated:** [July 30, 2020, 8:59am UTC](https://discuss.elastic.co/t/trying-to-create-too-many-scroll-contexts-for-security-index/243188 "2020-07-30T08:59:19Z")
Hello, I'm using elastic stack 7.6.2 My Kibana failed to log in with superuser which was done until yesterday. I checked kibana and elasticsearch verbose log. Here's the log messages in kibana {"type":"log","@times… --- ## [How to assign back bulk numbers of Unassigned shards back into cluster](https://discuss.elastic.co/t/how-to-assign-back-bulk-numbers-of-unassigned-shards-back-into-cluster/243093)
**Author:** [@suddhasil.sarkar](https://discuss.elastic.co/u/suddhasil.sarkar)\ **Replies:** 4\ **Last updated:** [July 30, 2020, 11:35pm UTC](https://discuss.elastic.co/t/how-to-assign-back-bulk-numbers-of-unassigned-shards-back-into-cluster/243093 "2020-07-30T23:35:57Z")
Hi All, any help is much appreciated. due to unexpected shutdown of my master nodes in elastic cluster I see more than 400 unassigned shards at this point, and wanted to check if there is any way I can assign them back a… --- ## [Why Can't Histogram Interval Be Decimal](https://discuss.elastic.co/t/why-cant-histogram-interval-be-decimal/243146)
**Author:** [@Ethan777100](https://discuss.elastic.co/u/Ethan777100)\ **Replies:** 0\ **Last updated:** [July 30, 2020, 3:04am UTC](https://discuss.elastic.co/t/why-cant-histogram-interval-be-decimal/243146 "2020-07-30T03:04:25Z")
Continuing the discussion from Histogram interval: I disagree with the constraint that the interval must be a decimal. I have a use case whose data is time duration which nominally falls between 0-5seconds. i also wann… --- ## [Possible snapshot bug v7.8.0](https://discuss.elastic.co/t/possible-snapshot-bug-v7-8-0/243280)
**Author:** [@Siqi\_Deng](https://discuss.elastic.co/u/Siqi_Deng)\ **Replies:** 0\ **Last updated:** [July 30, 2020, 8:01pm UTC](https://discuss.elastic.co/t/possible-snapshot-bug-v7-8-0/243280 "2020-07-30T20:01:36Z")
Hi, I try to create a snapshot of five indices via the Kibana dev\_tools like below PUT \_snapshot/shrink-cori-syslog/shrink-cori-syslog\_2020-04-24\_2020-04-29 { "indices": "shrink-cori-syslog-000101,shrink-cori-syslog-… --- ## [Elasticsearch Master Node JVM reaching 99%](https://discuss.elastic.co/t/elasticsearch-master-node-jvm-reaching-99/241907)
**Author:** [@rsmith013](https://discuss.elastic.co/u/rsmith013)\ **Replies:** 7\ **Last updated:** [July 30, 2020, 6:48pm UTC](https://discuss.elastic.co/t/elasticsearch-master-node-jvm-reaching-99/241907 "2020-07-30T18:48:28Z")
I am running a 3 Master 8 Data node cluster. Elasticsearch Version 7.8.0 The cluster bumps along happily for several days with the regular sawtooth JVM pattern then suddenly ramps up and then hits 99%. This leads to… --- ## [Loop through results and update another index](https://discuss.elastic.co/t/loop-through-results-and-update-another-index/243260)
**Author:** [@msf127](https://discuss.elastic.co/u/msf127)\ **Replies:** 1\ **Last updated:** [July 30, 2020, 6:31pm UTC](https://discuss.elastic.co/t/loop-through-results-and-update-another-index/243260 "2020-07-30T18:31:15Z")
Is it possible to loop through the results of a query and update (add a scripted field in) another index based on data within the result set? Another way to think about this is updating an index with a lookup value from… --- ## [Stemmer for keyword-fields before index](https://discuss.elastic.co/t/stemmer-for-keyword-fields-before-index/243231)
**Author:** [@Arol](https://discuss.elastic.co/u/Arol)\ **Replies:** 4\ **Last updated:** [July 30, 2020, 5:28pm UTC](https://discuss.elastic.co/t/stemmer-for-keyword-fields-before-index/243231 "2020-07-30T17:28:48Z")
Salut. I have field "Title". I use this field for aggregations, including building in the Kibana Tags Cloud, so the field is declared as a keyword. In this field, I write the title text, where each word is an array ele… --- ## [High\_min & low\_max functions - feature request?](https://discuss.elastic.co/t/high-min-low-max-functions-feature-request/242567)
**Author:** [@cosruss](https://discuss.elastic.co/u/cosruss)\ **Replies:** 1\ **Last updated:** [July 30, 2020, 4:58pm UTC](https://discuss.elastic.co/t/high-min-low-max-functions-feature-request/242567 "2020-07-30T16:58:23Z")
The current detector functions for min and max only look for anomalies in unusually low mins and unusually high maxes. It would be useful to have high\_min and low\_max detector functions. This allows detection on how high… --- ## [Can you answer these ELK questions?](https://discuss.elastic.co/t/can-you-answer-these-elk-questions/243047)
**Author:** [@myrsecurity](https://discuss.elastic.co/u/myrsecurity)\ **Replies:** 5\ **Last updated:** [July 30, 2020, 3:38pm UTC](https://discuss.elastic.co/t/can-you-answer-these-elk-questions/243047 "2020-07-30T15:38:40Z")
Given the following use case: Filebeat and Metricbeat installed on 10 centos. Each centos location represents a different customer (tenant): Topology and authentication Can we authenticate each feed and make sure tha… --- ## [Potential bug in painless execute API since 7.5](https://discuss.elastic.co/t/potential-bug-in-painless-execute-api-since-7-5/242760)
**Author:** [@Denne](https://discuss.elastic.co/u/Denne)\ **Replies:** 1\ **Last updated:** [July 30, 2020, 3:33pm UTC](https://discuss.elastic.co/t/potential-bug-in-painless-execute-api-since-7-5/242760 "2020-07-30T15:33:12Z")
I'm getting a strange error when using the painless execute API with cosineSimilarity. This only happens with version 7.5+. With version 7.4 this is not happening for me. Here a minimal working example that uses the exa… --- ## [Query takes to much time in elastic compare to sphinx](https://discuss.elastic.co/t/query-takes-to-much-time-in-elastic-compare-to-sphinx/243032)
**Author:** [@KrishK](https://discuss.elastic.co/u/KrishK)\ **Replies:** 4\ **Last updated:** [July 30, 2020, 1:06pm UTC](https://discuss.elastic.co/t/query-takes-to-much-time-in-elastic-compare-to-sphinx/243032 "2020-07-30T13:06:38Z")
Hi Support, We moved Sphinx to ElasticSearch. Elastic and Sphinx server configuration is the same. OS: Ubuntu 18.04 RAM: 60GB(50% occupied Elastic) Disc : 2TB Processor: 4 Core Elastic Configuration: ELK - 7.7.X W… --- ## [Unable to join to my new cluster](https://discuss.elastic.co/t/unable-to-join-to-my-new-cluster/240321)
**Author:** [@hgpit](https://discuss.elastic.co/u/hgpit)\ **Replies:** 1\ **Last updated:** [July 30, 2020, 1:03pm UTC](https://discuss.elastic.co/t/unable-to-join-to-my-new-cluster/240321 "2020-07-30T13:03:39Z")
Hello, We are very inexperienced with ES, so we imagine we are just overlooking something simple. We have built two machines, running ES (OSS) 7.8. Hostname: g000057.domain.com, IP: 10.40.1.62, Node name: g000057 Hos… --- ## [Error in visualisation \[esaggs\] \> Internal Server Error ELK 7.8](https://discuss.elastic.co/t/error-in-visualisation-esaggs-internal-server-error-elk-7-8/243217)
**Author:** [@Feriel\_Mufti](https://discuss.elastic.co/u/Feriel_Mufti)\ **Replies:** 1\ **Last updated:** [July 30, 2020, 12:59pm UTC](https://discuss.elastic.co/t/error-in-visualisation-esaggs-internal-server-error-elk-7-8/243217 "2020-07-30T12:59:30Z")
Hello , i am using Elasricsearch and kibana 7.8 , while trying to vizualise filebeat pie chart using aggregation it shows this errror : Error in visualisation \[esaggs\] \> Internal Server Error , what is the problem and … --- ## [Unable to connect to slack from elastic notification alerting](https://discuss.elastic.co/t/unable-to-connect-to-slack-from-elastic-notification-alerting/242539)
**Author:** [@A\_Mightiev](https://discuss.elastic.co/u/A_Mightiev)\ **Replies:** 2\ **Last updated:** [July 30, 2020, 12:14pm UTC](https://discuss.elastic.co/t/unable-to-connect-to-slack-from-elastic-notification-alerting/242539 "2020-07-30T12:14:39Z")
I have an issue connecting to slack from elasticsearch action notifications. to access https from the node, I need to use a proxy i.e. if I do a \[\]# curl -v https://hooks.slack.com -x http://proxy.domain.com:5050 \* … --- ## [Iterate\_on in Logstash no working properly](https://discuss.elastic.co/t/iterate-on-in-logstash-no-working-properly/243091)
**Author:** [@tasipasin](https://discuss.elastic.co/u/tasipasin)\ **Replies:** 2\ **Last updated:** [July 30, 2020, 12:04pm UTC](https://discuss.elastic.co/t/iterate-on-in-logstash-no-working-properly/243091 "2020-07-30T12:04:17Z")
I don't know if I'm using this wrongly or if it's a problem with the filter, but, I have the following structure: { ..., "eventDataSplit" =\> { "1" =\> { "valueKey" : "1.1.1" }, "2" =\> { "valueKey" : "2.1.1" }, "… --- ## [Boost 5.x -\> 7.x migartion performance for Gbs of data (C# Nest)](https://discuss.elastic.co/t/boost-5-x-7-x-migartion-performance-for-gbs-of-data-c-nest/243212)
**Author:** [@yBother](https://discuss.elastic.co/u/yBother)\ **Replies:** 0\ **Last updated:** [July 30, 2020, 11:55am UTC](https://discuss.elastic.co/t/boost-5-x-7-x-migartion-performance-for-gbs-of-data-c-nest/243212 "2020-07-30T11:55:51Z")
I need to migrate existing ES data from version 5.2.2 to 7.6.0. I do that by reindexing index per index to V6 and then bulk inserting index per index to a new created index and then delete the source index. I cannot us… --- ## [How to add time of ingestion to the document?](https://discuss.elastic.co/t/how-to-add-time-of-ingestion-to-the-document/243042)
**Author:** [@vasek](https://discuss.elastic.co/u/vasek)\ **Replies:** 2\ **Last updated:** [July 30, 2020, 10:02am UTC](https://discuss.elastic.co/t/how-to-add-time-of-ingestion-to-the-document/243042 "2020-07-30T10:02:30Z")
Hi Elasticians, I've created pipeline pipeline\_add\_ingest\_timestamp. I would like to achieve add time of ingesting by elasticsearch to the document using this pipeline. What am I doing wrong? The field is not populate t… --- ## [Elasticsearch Gradle build failed: PKIX path building failed](https://discuss.elastic.co/t/elasticsearch-gradle-build-failed-pkix-path-building-failed/243195)
**Author:** [@Crab2died](https://discuss.elastic.co/u/Crab2died)\ **Replies:** 0\ **Last updated:** [July 30, 2020, 9:55am UTC](https://discuss.elastic.co/t/elasticsearch-gradle-build-failed-pkix-path-building-failed/243195 "2020-07-30T09:55:14Z")
P1: git clone GitHub - elastic/elasticsearch: Free and Open, Distributed, RESTful Search Engine elasticsearch P2: import https://jcenter.bintray.com certification to JAVA\_HOME/lib/security/cacerts I'm sure the certi… --- ## [Watcher - formatting the description field in jira action](https://discuss.elastic.co/t/watcher-formatting-the-description-field-in-jira-action/240009)
**Author:** [@norgro2601](https://discuss.elastic.co/u/norgro2601)\ **Replies:** 3\ **Last updated:** [July 30, 2020, 9:52am UTC](https://discuss.elastic.co/t/watcher-formatting-the-description-field-in-jira-action/240009 "2020-07-30T09:52:30Z")
Hi, I try to format the description field in jira out of a watcher with different styles, bold text and so on. I've found no documentation, if this is possible and if it is, what I could use. Does anybody know if it is… --- ## [In-between Query for IP data type](https://discuss.elastic.co/t/in-between-query-for-ip-data-type/242882)
**Author:** [@shankarlogs](https://discuss.elastic.co/u/shankarlogs)\ **Replies:** 12\ **Last updated:** [July 30, 2020, 9:19am UTC](https://discuss.elastic.co/t/in-between-query-for-ip-data-type/242882 "2020-07-30T09:19:14Z")
I need to understand how to create in-between query for IP datatype. I need a specific example for IPv6 addresses --- ## [Change default for "index\_options"](https://discuss.elastic.co/t/change-default-for-index-options/243191)
**Author:** [@YvorL](https://discuss.elastic.co/u/YvorL)\ **Replies:** 0\ **Last updated:** [July 30, 2020, 9:21am UTC](https://discuss.elastic.co/t/change-default-for-index-options/243191 "2020-07-30T09:21:49Z")
Hi, I'm trying to get rid of anything unnecessary in my cluster and want to change the default for "index\_options", from positions to docs. At least generally on an index level. I don't have any query that'd benefit fro… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=846) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=848)