# Elasticsearch

**URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=857

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 858

---

## [Insufficient History for prediction](https://discuss.elastic.co/t/insufficient-history-for-prediction/241711)

<div class="topic-metadata">

**Author:** [@Shubhangi](https://discuss.elastic.co/u/Shubhangi)\
**Replies:** 3\
**Last updated:** [July 18, 2020, 5:53pm UTC](https://discuss.elastic.co/t/insufficient-history-for-prediction/241711 "2020-07-18T17:53:29Z")

</div>

Hi, I'm using Elastic ML 7.8. I've a monthly index with 350k+ documents count/events per month or 118.3mb worth of data per month. I've data from March to July present (4 months+ data). So, in total, that is 1400k even…

---

## [Fetch command in elasticsearch queries, limit query results](https://discuss.elastic.co/t/fetch-command-in-elasticsearch-queries-limit-query-results/241179)

<div class="topic-metadata">

**Author:** [@liron\_gofberg](https://discuss.elastic.co/u/liron_gofberg)\
**Replies:** 22\
**Last updated:** [July 18, 2020, 4:43pm UTC](https://discuss.elastic.co/t/fetch-command-in-elasticsearch-queries-limit-query-results/241179 "2020-07-18T16:43:41Z")

</div>

I am using python as elastic client and I want to fetch only 1 document I have noticed that the search speed for fetching one document is exactly the same as fetching a lots of documents. In oracle sql there is a fetc…

---

## [Cluster Redundancy with VMware vSphere HA](https://discuss.elastic.co/t/cluster-redundancy-with-vmware-vsphere-ha/241685)

<div class="topic-metadata">

**Author:** [@ka2](https://discuss.elastic.co/u/ka2)\
**Replies:** 3\
**Last updated:** [July 18, 2020, 2:45pm UTC](https://discuss.elastic.co/t/cluster-redundancy-with-vmware-vsphere-ha/241685 "2020-07-18T14:45:17Z")

</div>

I would like to use vSphere HA (or FT) to make my Elasticsearch cluster redundant, but I am wondering why I can't find a similar case study. Does anyone have any information that can help me with this question? The Ela…

---

## [Index rollover is not happening](https://discuss.elastic.co/t/index-rollover-is-not-happening/240645)

<div class="topic-metadata">

**Author:** [@bivaswap](https://discuss.elastic.co/u/bivaswap)\
**Replies:** 2\
**Last updated:** [July 18, 2020, 2:18am UTC](https://discuss.elastic.co/t/index-rollover-is-not-happening/240645 "2020-07-18T02:18:00Z")

</div>

I have 4 node cluster (3 master eligible+data, 1 coordinating node) Logstash output output { elasticsearch { hosts =\> \["es-node-01.xyz.local:9200", "es-node-02.xyz.local:9200", "es-node-03.xyz.local:9200"\] il…

---

## [Memory error when using scan In python to retrieve millions of documents](https://discuss.elastic.co/t/memory-error-when-using-scan-in-python-to-retrieve-millions-of-documents/241615)

<div class="topic-metadata">

**Author:** [@liron\_gofberg](https://discuss.elastic.co/u/liron_gofberg)\
**Replies:** 2\
**Last updated:** [July 17, 2020, 6:42pm UTC](https://discuss.elastic.co/t/memory-error-when-using-scan-in-python-to-retrieve-millions-of-documents/241615 "2020-07-17T18:42:32Z")

</div>

I’m using scan in python to retrieve my data It is working when I ask for thousands of documents but when I ask for millions of records I get an error after a while and that error relate to the memory What could be hap…

---

## [Slowly term queries](https://discuss.elastic.co/t/slowly-term-queries/241591)

<div class="topic-metadata">

**Author:** [@liron\_gofberg](https://discuss.elastic.co/u/liron_gofberg)\
**Replies:** 2\
**Last updated:** [July 17, 2020, 10:14pm UTC](https://discuss.elastic.co/t/slowly-term-queries/241591 "2020-07-17T22:14:50Z")

</div>

Hi, I’m using scan function in Python to retrieve more than 10000 results There are only filter queries I search only for terms There is no aggregation, only simple term queries I executed two queries with the same …

---

## [Slow queries](https://discuss.elastic.co/t/slow-queries/241723)

<div class="topic-metadata">

**Author:** [@liron\_gofberg](https://discuss.elastic.co/u/liron_gofberg)\
**Replies:** 1\
**Last updated:** [July 17, 2020, 9:43pm UTC](https://discuss.elastic.co/t/slow-queries/241723 "2020-07-17T21:43:22Z")

</div>

I execute a simple term filter query and I limit my results with size but part of the queries have bad performance(search time in minutes) while other perform well(search time is very fast) with the same limit of result…

---

## [Boolean similarity module with fuzzy search scoring](https://discuss.elastic.co/t/boolean-similarity-module-with-fuzzy-search-scoring/241705)

<div class="topic-metadata">

**Author:** [@mckennajp](https://discuss.elastic.co/u/mckennajp)\
**Replies:** 0\
**Last updated:** [July 17, 2020, 5:59pm UTC](https://discuss.elastic.co/t/boolean-similarity-module-with-fuzzy-search-scoring/241705 "2020-07-17T17:59:23Z")

</div>

I've updated the default similarity module for my index to be boolean. The score should only be based on whether the query terms match or not. Boolean similarity gives terms a score equal to their query boost Howeve…

---

## [Data too large, data for \[\<transport\_request\>\]](https://discuss.elastic.co/t/data-too-large-data-for-transport-request/241702)

<div class="topic-metadata">

**Author:** [@Dawood](https://discuss.elastic.co/u/Dawood)\
**Replies:** 0\
**Last updated:** [July 17, 2020, 5:48pm UTC](https://discuss.elastic.co/t/data-too-large-data-for-transport-request/241702 "2020-07-17T17:48:37Z")

</div>

i got the following in elasticsearch container logs: log:\[parent\] Data too large, data for \[\<transport\_request\>\] would be \[1020455062/973.1mb\], which is larger than the limit of \[1011774259/964.9mb\], real usage: \[102045…

---

## [Query\_string & min\_score?](https://discuss.elastic.co/t/query-string-min-score/241693)

<div class="topic-metadata">

**Author:** [@ClubberLang](https://discuss.elastic.co/u/ClubberLang)\
**Replies:** 0\
**Last updated:** [July 17, 2020, 4:18pm UTC](https://discuss.elastic.co/t/query-string-min-score/241693 "2020-07-17T16:18:26Z")

</div>

Hi, I have a basic query, and I wish to exclude all the results when the score is \< 0.5. It seems that min\_score does not work with! Noticed that I have a random\_score, if I use min\_score in "functions" it will be app…

---

## [Voting exclusion api wrong HTTP method](https://discuss.elastic.co/t/voting-exclusion-api-wrong-http-method/241638)

<div class="topic-metadata">

**Author:** [@tmporary](https://discuss.elastic.co/u/tmporary)\
**Replies:** 1\
**Last updated:** [July 17, 2020, 3:26pm UTC](https://discuss.elastic.co/t/voting-exclusion-api-wrong-http-method/241638 "2020-07-17T15:26:36Z")

</div>

Im using this dcumentation as a reference: https://www.elastic.co/guide/en/elasticsearch/reference/current/voting-config-exclusions.html POST https://MY\_DOMAIN/\_cluster/voting\_config\_exclusions?node\_ids=firstId,secondI…

---

## [Use ssl/tls between Filebeat and Logstash problems](https://discuss.elastic.co/t/use-ssl-tls-between-filebeat-and-logstash-problems/241632)

<div class="topic-metadata">

**Author:** [@d.silwon](https://discuss.elastic.co/u/d.silwon)\
**Replies:** 1\
**Last updated:** [July 17, 2020, 2:57pm UTC](https://discuss.elastic.co/t/use-ssl-tls-between-filebeat-and-logstash-problems/241632 "2020-07-17T14:57:02Z")

</div>

Dears, When I created the certs for Filebeat: /usr/share/elasticsearch/bin/elasticsearch-certutil cert --pem --ca-cert /etc/elasticsearch/certs/ca.crt --ca-key /etc/elasticsearch/certs/ca.key --in /tmp/filebeats.yml --…

---

## [Elasticsearch as producer/consumer solution](https://discuss.elastic.co/t/elasticsearch-as-producer-consumer-solution/241645)

<div class="topic-metadata">

**Author:** [@invenisso](https://discuss.elastic.co/u/invenisso)\
**Replies:** 3\
**Last updated:** [July 17, 2020, 2:53pm UTC](https://discuss.elastic.co/t/elasticsearch-as-producer-consumer-solution/241645 "2020-07-17T14:53:18Z")

</div>

Hello Community! Is it possible to use Elasticserach in a producer / consumer scenario? The producer writes documents to Elasticserach. The consumer reads documents from Eleasticserach and processes them. The order o…

---

## [Random\_score , how to moderate its impact?](https://discuss.elastic.co/t/random-score-how-to-moderate-its-impact/241555)

<div class="topic-metadata">

**Author:** [@ClubberLang](https://discuss.elastic.co/u/ClubberLang)\
**Replies:** 0\
**Last updated:** [July 16, 2020, 10:02pm UTC](https://discuss.elastic.co/t/random-score-how-to-moderate-its-impact/241555 "2020-07-16T22:02:27Z")

</div>

Hi, I use the following query, in this one I have 2 functions: distance\_feature : compute a score based on distance random\_score : compute a value between 0 and 1 The final score = distance\_feature \* random\_score Th…

---

## [Elasticsearch Ingest Pipeline + index for language identification and text analysis](https://discuss.elastic.co/t/elasticsearch-ingest-pipeline-index-for-language-identification-and-text-analysis/241646)

<div class="topic-metadata">

**Author:** [@yolo](https://discuss.elastic.co/u/yolo)\
**Replies:** 0\
**Last updated:** [July 17, 2020, 1:17pm UTC](https://discuss.elastic.co/t/elasticsearch-ingest-pipeline-index-for-language-identification-and-text-analysis/241646 "2020-07-17T13:17:55Z")

</div>

Hi, i am using elasticsearch ingest pipeline for language identification. Furthermore, i would like to apply to each language-field a language analyzer. To my knowledge there is no ingest pipeline for langauge analyzers…

---

## [How to parse haproxy logs using logstash and filebeat](https://discuss.elastic.co/t/how-to-parse-haproxy-logs-using-logstash-and-filebeat/241487)

<div class="topic-metadata">

**Author:** [@Kay\_Khan](https://discuss.elastic.co/u/Kay_Khan)\
**Replies:** 1\
**Last updated:** [July 17, 2020, 12:23pm UTC](https://discuss.elastic.co/t/how-to-parse-haproxy-logs-using-logstash-and-filebeat/241487 "2020-07-17T12:23:47Z")

</div>

I have setup logstash and filebeat on my ECK stack so in kibana/elasticsearch i can view logs from kubernetes. I followed this article to set this up https://medium.com/@raphaeldelio/deploy-logstash-and-filebeat-on-kuber…

---

## [How to generate certs for Filebeats with elasticsearch-certutil?](https://discuss.elastic.co/t/how-to-generate-certs-for-filebeats-with-elasticsearch-certutil/241618)

<div class="topic-metadata">

**Author:** [@d.silwon](https://discuss.elastic.co/u/d.silwon)\
**Replies:** 2\
**Last updated:** [July 17, 2020, 10:48am UTC](https://discuss.elastic.co/t/how-to-generate-certs-for-filebeats-with-elasticsearch-certutil/241618 "2020-07-17T10:48:42Z")

</div>

Dears, I would like to generate the certs for filebeats service and when I try to do this: /usr/share/elasticsearch/bin/elasticsearch-certutil cert --ca /etc/elasticsearch/certs/ca.crt I've got error message: Enter p…

---

## [We use id to update or delete without routing. I can't find this document. Is there a way to broadcast this operation without routing to all shards?](https://discuss.elastic.co/t/we-use-id-to-update-or-delete-without-routing-i-cant-find-this-document-is-there-a-way-to-broadcast-this-operation-without-routing-to-all-shards/241599)

<div class="topic-metadata">

**Author:** [@Liyes](https://discuss.elastic.co/u/Liyes)\
**Replies:** 11\
**Last updated:** [July 17, 2020, 10:09am UTC](https://discuss.elastic.co/t/we-use-id-to-update-or-delete-without-routing-i-cant-find-this-document-is-there-a-way-to-broadcast-this-operation-without-routing-to-all-shards/241599 "2020-07-17T10:09:08Z")

</div>

Our index has 3 primary shards. Previously, id was used for routing by default. Now we need to change to use another field as routing, and create a docuemnt based on this routing, but when we do update or delete operati…

---

## [Best Cluster Concept, Timeseries Data and more](https://discuss.elastic.co/t/best-cluster-concept-timeseries-data-and-more/241482)

<div class="topic-metadata">

**Author:** [@defalt](https://discuss.elastic.co/u/defalt)\
**Replies:** 4\
**Last updated:** [July 17, 2020, 10:07am UTC](https://discuss.elastic.co/t/best-cluster-concept-timeseries-data-and-more/241482 "2020-07-17T10:07:04Z")

</div>

Hi, I am currently developing some cluster concept and once again asking for your opinions and insight. We will need different clusters for different customers. I have some questions regarding my concepts and I hope you…

---

## [Ingest Pipeline - Check if a field exists](https://discuss.elastic.co/t/ingest-pipeline-check-if-a-field-exists/238040)

<div class="topic-metadata">

**Author:** [@sean\_wills](https://discuss.elastic.co/u/sean_wills)\
**Replies:** 1\
**Last updated:** [July 17, 2020, 9:07am UTC](https://discuss.elastic.co/t/ingest-pipeline-check-if-a-field-exists/238040 "2020-07-17T09:07:48Z")

</div>

Hello, I'm trying to do something that seems like it should be relatively simple, but I haven't been able to track down the correct syntax the documentation. I have a basic ingest pipeline which I want to use to referen…

---

## [Run a subquery for each of the filtered documents](https://discuss.elastic.co/t/run-a-subquery-for-each-of-the-filtered-documents/237925)

<div class="topic-metadata">

**Author:** [@kamboh](https://discuss.elastic.co/u/kamboh)\
**Replies:** 1\
**Last updated:** [July 17, 2020, 8:50am UTC](https://discuss.elastic.co/t/run-a-subquery-for-each-of-the-filtered-documents/237925 "2020-07-17T08:50:50Z")

</div>

I have an index named employees with the following structure: { id: integer, name: text, age: integer, cityId: integer, resumeText: text \<--------- parsed resume text } I want to search employees with certain…

---

## [Problem with JSON file import into ElasticSearch](https://discuss.elastic.co/t/problem-with-json-file-import-into-elasticsearch/240871)

<div class="topic-metadata">

**Author:** [@siva4](https://discuss.elastic.co/u/siva4)\
**Replies:** 9\
**Last updated:** [July 17, 2020, 6:35am UTC](https://discuss.elastic.co/t/problem-with-json-file-import-into-elasticsearch/240871 "2020-07-17T06:35:59Z")

</div>

Exported data from Mongo and generated JSON file. Sample JSON File data (1 record): { "\_id": { "$oid": "5d84438f4514cb1f8a" }, "slug": "test-home-technology", "title": "test home technology", "subtitle": …

---

## [Space requirement for logstash and elasticsearch](https://discuss.elastic.co/t/space-requirement-for-logstash-and-elasticsearch/241587)

<div class="topic-metadata">

**Author:** [@falconpurple](https://discuss.elastic.co/u/falconpurple)\
**Replies:** 0\
**Last updated:** [July 17, 2020, 6:33am UTC](https://discuss.elastic.co/t/space-requirement-for-logstash-and-elasticsearch/241587 "2020-07-17T06:33:05Z")

</div>

Hi, I have to ELK stack . The filebeat collects log and then passes to kafka for buffering and then to logstash for analysis and filtering .The data is passes then to elasticsearch and displaying dashboards on kibana. …

---

## [Highlight does not work properly with ScriptScore, version 7.8](https://discuss.elastic.co/t/highlight-does-not-work-properly-with-scriptscore-version-7-8/241584)

<div class="topic-metadata">

**Author:** [@gurjit\_buck](https://discuss.elastic.co/u/gurjit_buck)\
**Replies:** 0\
**Last updated:** [July 17, 2020, 6:22am UTC](https://discuss.elastic.co/t/highlight-does-not-work-properly-with-scriptscore-version-7-8/241584 "2020-07-17T06:22:06Z")

</div>

Elasticsearch version (7.8): OS version (Windows 10): Along with ScriptScore function, Highlight function does not work properly. If we search two words only first word gets higlighted or last word doesn't display hig…

---

## [Would there be an impact / difference of Big and Small Indices?](https://discuss.elastic.co/t/would-there-be-an-impact-difference-of-big-and-small-indices/241560)

<div class="topic-metadata">

**Author:** [@Noctis17](https://discuss.elastic.co/u/Noctis17)\
**Replies:** 8\
**Last updated:** [July 17, 2020, 6:05am UTC](https://discuss.elastic.co/t/would-there-be-an-impact-difference-of-big-and-small-indices/241560 "2020-07-17T06:05:55Z")

</div>

Hello and good day! Just like what the title says, I humbly request for you guys' expertise and a healthy, bountiful discussion regarding this.... My team has 2 indices called "web" and "socialmedia", both of them got …

---

## [Monitoring execution failed on cluster in ElasticSearch SaaS service](https://discuss.elastic.co/t/monitoring-execution-failed-on-cluster-in-elasticsearch-saas-service/241568)

<div class="topic-metadata">

**Author:** [@jeromeb](https://discuss.elastic.co/u/jeromeb)\
**Replies:** 2\
**Last updated:** [July 17, 2020, 5:58am UTC](https://discuss.elastic.co/t/monitoring-execution-failed-on-cluster-in-elasticsearch-saas-service/241568 "2020-07-17T05:58:55Z")

</div>

Hi I have a cluster on ElasticSearch Service (the managed service solution) in version 7.7. It has 2 data nodes (AWS.DATA.HIGHIO.I3 8GB) + a Master (AWS.MASTER.R4). Am trying to enable Monitoring on it but I am facing …

---

## [Still getting 'max open shards' error after re-indexing and decreasing shards to 850](https://discuss.elastic.co/t/still-getting-max-open-shards-error-after-re-indexing-and-decreasing-shards-to-850/241369)

<div class="topic-metadata">

**Author:** [@anda](https://discuss.elastic.co/u/anda)\
**Replies:** 9\
**Last updated:** [July 17, 2020, 5:42am UTC](https://discuss.elastic.co/t/still-getting-max-open-shards-error-after-re-indexing-and-decreasing-shards-to-850/241369 "2020-07-17T05:42:49Z")

</div>

Hello, I'm running ELK 7.4 and have been getting this error in Logstash logs for basically every event that's being processed: \[2020-07-15T15:24:06,789\]\[WARN \]\[logstash.outputs.elasticsearch\]\[enm\] Could not index event…

---

## [Mapping Value is not changing after updating](https://discuss.elastic.co/t/mapping-value-is-not-changing-after-updating/241437)

<div class="topic-metadata">

**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\
**Replies:** 2\
**Last updated:** [July 17, 2020, 5:35am UTC](https://discuss.elastic.co/t/mapping-value-is-not-changing-after-updating/241437 "2020-07-17T05:35:39Z")

</div>

"mappings": { "properties": { "client.ip":{"type": "ip"}, "host.ip":{"type": "ip"}, "server.ip":{"type": "ip"}, "source.ip":{"type": "ip"}, "destination.ip":{"type": "ip"}, "geoip": { "dynamic": true, "properti…

---

## [CircuitBreakingException Data too large](https://discuss.elastic.co/t/circuitbreakingexception-data-too-large/237953)

<div class="topic-metadata">

**Author:** [@Barak](https://discuss.elastic.co/u/Barak)\
**Replies:** 3\
**Last updated:** [July 17, 2020, 3:33am UTC](https://discuss.elastic.co/t/circuitbreakingexception-data-too-large/237953 "2020-07-17T03:33:55Z")

</div>

Hi, I have an ES stack running on AWS spot instances, so shard reallocation happens quite frequently. Occasionally I receive the following error message and then the shard remains unassigned without further allocation …

---

## [Do you need to keep the small version always in elk and kibana](https://discuss.elastic.co/t/do-you-need-to-keep-the-small-version-always-in-elk-and-kibana/241571)

<div class="topic-metadata">

**Author:** [@111351](https://discuss.elastic.co/u/111351)\
**Replies:** 1\
**Last updated:** [July 17, 2020, 3:28am UTC](https://discuss.elastic.co/t/do-you-need-to-keep-the-small-version-always-in-elk-and-kibana/241571 "2020-07-17T03:28:36Z")

</div>

Do you need to keep the small version always in elk and kibana if I use logstash5.6.16 and elasticsearch5.4 will there be a problem thanks for you

[Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=856)

[Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=858)
