# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=859 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 860 --- ## [Suggestion on summarizing running total value](https://discuss.elastic.co/t/suggestion-on-summarizing-running-total-value/241339)
**Author:** [@Jehutywong](https://discuss.elastic.co/u/Jehutywong)\ **Replies:** 6\ **Last updated:** [July 16, 2020, 7:54am UTC](https://discuss.elastic.co/t/suggestion-on-summarizing-running-total-value/241339 "2020-07-16T07:54:54Z")
ES version 7.6 I am finding difficult to do summarize or transforms on running total values like network traffic metrics. For example i want to get the max bucket on inbound bytes/s. But prior to that, looks like i hav… --- ## [Unable to access ElasticSearch -Standalone Setup using version 6.8.10](https://discuss.elastic.co/t/unable-to-access-elasticsearch-standalone-setup-using-version-6-8-10/239150)
**Author:** [@viuha8](https://discuss.elastic.co/u/viuha8)\ **Replies:** 3\ **Last updated:** [July 16, 2020, 6:47am UTC](https://discuss.elastic.co/t/unable-to-access-elasticsearch-standalone-setup-using-version-6-8-10/239150 "2020-07-16T06:47:22Z")
Hello All, Iam trying to set up a Standalone ElasticSearch instance but not a Cluster One. For that , i have the following in the yml file: bootstrap.memory\_lock: false cluster.name: elasticsearch discovery.zen.min… --- ## [Mounting a nfs drive for snapshot](https://discuss.elastic.co/t/mounting-a-nfs-drive-for-snapshot/241218)
**Author:** [@lusynda](https://discuss.elastic.co/u/lusynda)\ **Replies:** 6\ **Last updated:** [July 16, 2020, 6:30am UTC](https://discuss.elastic.co/t/mounting-a-nfs-drive-for-snapshot/241218 "2020-07-16T06:30:17Z")
Hi all i have a case that i really dont know how to solve. I have a nfs share server that i mount an external drive in, and then i share that specific drive for my elastic cluster to takke snapshot in. The problems is … --- ## [CircuitBreakingException: \[parent\] Data too large, data error](https://discuss.elastic.co/t/circuitbreakingexception-parent-data-too-large-data-error/238690)
**Author:** [@Zeroc0pter](https://discuss.elastic.co/u/Zeroc0pter)\ **Replies:** 2\ **Last updated:** [July 16, 2020, 6:27am UTC](https://discuss.elastic.co/t/circuitbreakingexception-parent-data-too-large-data-error/238690 "2020-07-16T06:27:47Z")
Hi People, I'm facing an issue that keeps crashing our cluster. Luckily it is our acceptance cluster, but still a problem because people use the cluster to log their errors. We use Elasticsearch 6.8 The error that we r… --- ## [Index structure question](https://discuss.elastic.co/t/index-structure-question/241001)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 2\ **Last updated:** [July 16, 2020, 6:24am UTC](https://discuss.elastic.co/t/index-structure-question/241001 "2020-07-16T06:24:58Z")
Can I have a index with different field name for each document? for example document1 { name: empid: location: pay: } Document2 { fullname: address: city: zip } will it cause any problem in long run? the… --- ## [High OS Cpu usage on 7.7.1](https://discuss.elastic.co/t/high-os-cpu-usage-on-7-7-1/238301)
**Author:** [@chakragod](https://discuss.elastic.co/u/chakragod)\ **Replies:** 5\ **Last updated:** [July 16, 2020, 6:20am UTC](https://discuss.elastic.co/t/high-os-cpu-usage-on-7-7-1/238301 "2020-07-16T06:20:50Z")
Hello, We recently upgraded our ELK stack from v 7.4.0 to 7.7.1 and now we noticed that the OS CPU is 100% on our hot data nodes which do the indexing. The OS CPU is almost always at 100%, the process CPU is close to 45… --- ## [Guidance on increasing cluster.max\_shards\_per\_node](https://discuss.elastic.co/t/guidance-on-increasing-cluster-max-shards-per-node/240978)
**Author:** [@mrudrego](https://discuss.elastic.co/u/mrudrego)\ **Replies:** 8\ **Last updated:** [July 16, 2020, 6:10am UTC](https://discuss.elastic.co/t/guidance-on-increasing-cluster-max-shards-per-node/240978 "2020-07-16T06:10:12Z")
Hi, We use Elasticsearch(7.x) to store application/system logs and our indices are time based where new index is created everyday. We have a requirment where different indices are created for every log types and also fo… --- ## [Getting a bunch of startup errors when trying to run ES 6.3.2 on my mac](https://discuss.elastic.co/t/getting-a-bunch-of-startup-errors-when-trying-to-run-es-6-3-2-on-my-mac/203831)
**Author:** [@Nicholas\_Hillier](https://discuss.elastic.co/u/Nicholas_Hillier)\ **Replies:** 5\ **Last updated:** [July 16, 2020, 5:10am UTC](https://discuss.elastic.co/t/getting-a-bunch-of-startup-errors-when-trying-to-run-es-6-3-2-on-my-mac/203831 "2020-07-16T05:10:10Z")
I was running, without issue, Elastic Search 7.4.0 which comes bundled with a JDK. However, after downloading and attempting to run 6.3.2, I receive 12 errors with the following message: Message: access denied ("java.l… --- ## [Setting up ElasticSearch Cluster on Windows](https://discuss.elastic.co/t/setting-up-elasticsearch-cluster-on-windows/241266)
**Author:** [@Terizian](https://discuss.elastic.co/u/Terizian)\ **Replies:** 7\ **Last updated:** [July 16, 2020, 3:47am UTC](https://discuss.elastic.co/t/setting-up-elasticsearch-cluster-on-windows/241266 "2020-07-16T03:47:22Z")
I'm trying to set up an ES cluster on three Windows hosts. Those hosts are currently offline, and I cannot extract screenshots. All three nodes have the following elasticsearch.yml: bootstrap.memory\_lock: false cluster… --- ## [Elastic Search Basic Authentication overriding the JWT headers issue while trying to access elastic db](https://discuss.elastic.co/t/elastic-search-basic-authentication-overriding-the-jwt-headers-issue-while-trying-to-access-elastic-db/241381)
**Author:** [@Sai\_Teja\_Singamsetty](https://discuss.elastic.co/u/Sai_Teja_Singamsetty)\ **Replies:** 0\ **Last updated:** [July 16, 2020, 3:43am UTC](https://discuss.elastic.co/t/elastic-search-basic-authentication-overriding-the-jwt-headers-issue-while-trying-to-access-elastic-db/241381 "2020-07-16T03:43:07Z")
I have a Gateway service for checking authentication and authorizations, then a microservice connecting to an elastic database. For a request I am making, I have to pass JWT token in headers to get authenticated at Gatew… --- ## [Master and Ingest node in one? Is my Hot-Warm-Cold concept any good?](https://discuss.elastic.co/t/master-and-ingest-node-in-one-is-my-hot-warm-cold-concept-any-good/241243)
**Author:** [@defalt](https://discuss.elastic.co/u/defalt)\ **Replies:** 3\ **Last updated:** [July 16, 2020, 2:01am UTC](https://discuss.elastic.co/t/master-and-ingest-node-in-one-is-my-hot-warm-cold-concept-any-good/241243 "2020-07-16T02:01:42Z")
Hi, for a customer I have set up the following cluster concept: Is it any good or do you think something should be different? In which node should I ingest the data and which one should run kibana? EDIT: Is this a… --- ## [SUGGESTION: Allow CRON based rollover expressions](https://discuss.elastic.co/t/suggestion-allow-cron-based-rollover-expressions/241256)
**Author:** [@Colbert\_Philippe](https://discuss.elastic.co/u/Colbert_Philippe)\ **Replies:** 1\ **Last updated:** [July 16, 2020, 1:58am UTC](https://discuss.elastic.co/t/suggestion-allow-cron-based-rollover-expressions/241256 "2020-07-16T01:58:58Z")
The current rollover feature supports only rollover by age (some length of time) or by file size (size of index exceeds some number or number of entries exceeds some number). In real business applications, rollover are… --- ## [How to insert timestamps in applications that use Elastic in their logging architecture?](https://discuss.elastic.co/t/how-to-insert-timestamps-in-applications-that-use-elastic-in-their-logging-architecture/239689)
**Author:** [@TejaV](https://discuss.elastic.co/u/TejaV)\ **Replies:** 7\ **Last updated:** [July 16, 2020, 1:32am UTC](https://discuss.elastic.co/t/how-to-insert-timestamps-in-applications-that-use-elastic-in-their-logging-architecture/239689 "2020-07-16T01:32:30Z")
Hi, I want to understand the proper or the right way to insert timestamps in log messages. Is it good policy to rely on docker or k8s to take care of my log timestamps or is it a good practise to design applications/ins… --- ## [Fail to exclude Post by Term localhost:9200/abc-post-1/post/\_search/?mode=exclude:Sales&q=post\_type:%22jobs%22&size=1000&from=1 #59457](https://discuss.elastic.co/t/fail-to-exclude-post-by-term-localhost-9200-abc-post-1-post-search-mode-exclude-sales-q-post-type-22jobs-22-size-1000-from-1-59457/241374)
**Author:** [@iexpertini](https://discuss.elastic.co/u/iexpertini)\ **Replies:** 0\ **Last updated:** [July 16, 2020, 12:18am UTC](https://discuss.elastic.co/t/fail-to-exclude-post-by-term-localhost-9200-abc-post-1-post-search-mode-exclude-sales-q-post-type-22jobs-22-size-1000-from-1-59457/241374 "2020-07-16T00:18:40Z")
Hi Guys, Need help to filter the ElasticSearch Result. I don't want to display the post that comes from certain post author. We try to filter it by localhost:9200/abc-post-1/post/\_search/?mode=exclude:authorname&q=pos… --- ## [Timeout at scroll](https://discuss.elastic.co/t/timeout-at-scroll/241373)
**Author:** [@kinlee](https://discuss.elastic.co/u/kinlee)\ **Replies:** 0\ **Last updated:** [July 16, 2020, 12:12am UTC](https://discuss.elastic.co/t/timeout-at-scroll/241373 "2020-07-16T00:12:48Z")
I am trying to benchmark on a 3 node cluster using rally. A node is of 7G RAM and 2core. Everything works perfectly until the "running scroll" kicks in. Once the scroll job starts i get error GET https://40.77.60.174:9… --- ## [Client trying to route document to non-existent node?](https://discuss.elastic.co/t/client-trying-to-route-document-to-non-existent-node/240874)
**Author:** [@Dandy](https://discuss.elastic.co/u/Dandy)\ **Replies:** 6\ **Last updated:** [July 15, 2020, 11:58pm UTC](https://discuss.elastic.co/t/client-trying-to-route-document-to-non-existent-node/240874 "2020-07-15T23:58:48Z")
I'm in a bare-metal Kubernetes environment, and I see that documents sent from a fluent instance are being routed from my ingestor client to a non-existent data node: 2020-07-13 00:08:18 +0000 \[warn\]: #0 \[elasticsearch\]… --- ## [How to debug relevance in DSL queries](https://discuss.elastic.co/t/how-to-debug-relevance-in-dsl-queries/241357)
**Author:** [@ClubberLang](https://discuss.elastic.co/u/ClubberLang)\ **Replies:** 1\ **Last updated:** [July 15, 2020, 8:09pm UTC](https://discuss.elastic.co/t/how-to-debug-relevance-in-dsl-queries/241357 "2020-07-15T20:09:33Z")
Hi, I'm working on my first set of queries, but I wish to 'debug' and see: which part of my query match what is the computed score for anything involved in the computation of the final score. For the first, it seems … --- ## [How to read JSON files and insert in Elastic Stack](https://discuss.elastic.co/t/how-to-read-json-files-and-insert-in-elastic-stack/241229)
**Author:** [@Mike0211](https://discuss.elastic.co/u/Mike0211)\ **Replies:** 2\ **Last updated:** [July 15, 2020, 7:48pm UTC](https://discuss.elastic.co/t/how-to-read-json-files-and-insert-in-elastic-stack/241229 "2020-07-15T19:48:48Z")
I am new to Elastic. I have 10 independent docker containers each writing custom JSON files in a single directory. Each docker container writes file in a different format. Each file is a single line JSON along with times… --- ## [Snapshot only for data-nodes](https://discuss.elastic.co/t/snapshot-only-for-data-nodes/241345)
**Author:** [@NmPOuNgLfKWK2c4dDS](https://discuss.elastic.co/u/NmPOuNgLfKWK2c4dDS)\ **Replies:** 2\ **Last updated:** [July 15, 2020, 6:17pm UTC](https://discuss.elastic.co/t/snapshot-only-for-data-nodes/241345 "2020-07-15T18:17:45Z")
Hi \*. My first post here, this time I was unable to simply find answer on the net. I have ES 7.8.0 cluster, two "proper" nodes and one voting-only master-eligible. Last one is as simple as it can be - just a docker imag… --- ## [Near duplicate document detection](https://discuss.elastic.co/t/near-duplicate-document-detection/241334)
**Author:** [@tallison](https://discuss.elastic.co/u/tallison)\ **Replies:** 1\ **Last updated:** [July 15, 2020, 5:35pm UTC](https://discuss.elastic.co/t/near-duplicate-document-detection/241334 "2020-07-15T17:35:03Z")
I have an index w ~12 million files. We have a serious duplication issue and near duplication issue. The exact duplicate problem is trivial because we store a digest. The near duplicate issue is more profound, and I'v… --- ## [ERROR: Failed to verify bootstrap password when setting built in user's password](https://discuss.elastic.co/t/error-failed-to-verify-bootstrap-password-when-setting-built-in-users-password/241341)
**Author:** [@bhavya](https://discuss.elastic.co/u/bhavya)\ **Replies:** 0\ **Last updated:** [July 15, 2020, 5:21pm UTC](https://discuss.elastic.co/t/error-failed-to-verify-bootstrap-password-when-setting-built-in-users-password/241341 "2020-07-15T17:21:45Z")
I have imported and started Elasticsearch Source Code into an IntelliJ IDEA project. I want to create the password for the built-in users To enable security, I passed -Dtests.es.xpack.security.enabled=true as a parame… --- ## [Get newest value per distinct field](https://discuss.elastic.co/t/get-newest-value-per-distinct-field/241157)
**Author:** [@gudmundur](https://discuss.elastic.co/u/gudmundur)\ **Replies:** 2\ **Last updated:** [July 15, 2020, 5:15pm UTC](https://discuss.elastic.co/t/get-newest-value-per-distinct-field/241157 "2020-07-15T17:15:02Z")
Greetings I want to do a query which returns the newest 1 value per distinct combination of specific underlying fields (maybe also after a certain timestamp) In the sql world I can do a query like this: select Element… --- ## [Indexes size and time duration recommended values](https://discuss.elastic.co/t/indexes-size-and-time-duration-recommended-values/241335)
**Author:** [@robertitox](https://discuss.elastic.co/u/robertitox)\ **Replies:** 1\ **Last updated:** [July 15, 2020, 4:54pm UTC](https://discuss.elastic.co/t/indexes-size-and-time-duration-recommended-values/241335 "2020-07-15T16:54:56Z")
Hi people, I have ELK 7.8.0 running OK and configured by default. I have several data coming to my ELK server: mainly Cisco ASA and Netflow into filebeat-\* indexes: And this is the default lifecycle policy: Do y… --- ## [How to update dynamic mapping on existing index](https://discuss.elastic.co/t/how-to-update-dynamic-mapping-on-existing-index/241327)
**Author:** [@ilang](https://discuss.elastic.co/u/ilang)\ **Replies:** 0\ **Last updated:** [July 15, 2020, 3:42pm UTC](https://discuss.elastic.co/t/how-to-update-dynamic-mapping-on-existing-index/241327 "2020-07-15T15:42:34Z")
Hi guys, I am trying to update the dynamic mapping to "strict" on an existing index. To do so I tried to run the following query: PUT /dev-jira-fetcher/\_mappings { "dynamic": "strict" } I also tried this one: PUT… --- ## [How can I have an review of my index content on a specific field?](https://discuss.elastic.co/t/how-can-i-have-an-review-of-my-index-content-on-a-specific-field/241297)
**Author:** [@vic22](https://discuss.elastic.co/u/vic22)\ **Replies:** 4\ **Last updated:** [July 15, 2020, 3:10pm UTC](https://discuss.elastic.co/t/how-can-i-have-an-review-of-my-index-content-on-a-specific-field/241297 "2020-07-15T15:10:24Z")
Hello everyone ! I hope that you have a great day! I would like to ask you a particular question. It sounds easy, but, in contrario, it is quite complex... In my Elasticsearch index, I would like to know for a specifi… --- ## [ILM uses the default policy](https://discuss.elastic.co/t/ilm-uses-the-default-policy/241319)
**Author:** [@Abdelhalim](https://discuss.elastic.co/u/Abdelhalim)\ **Replies:** 0\ **Last updated:** [July 15, 2020, 3:02pm UTC](https://discuss.elastic.co/t/ilm-uses-the-default-policy/241319 "2020-07-15T15:02:00Z")
Hello everyone, I need your help please, I created a new ILM policy but packetbeat is still using the default policy here is my configuration Creation of the new policy: PUT \_ilm/policy/hot-warm-cold-delete-60days-p… --- ## [How to get current time as unix timestamp for script use](https://discuss.elastic.co/t/how-to-get-current-time-as-unix-timestamp-for-script-use/240723)
**Author:** [@Quentin\_L\_eilde](https://discuss.elastic.co/u/Quentin_L_eilde)\ **Replies:** 2\ **Last updated:** [July 15, 2020, 2:31pm UTC](https://discuss.elastic.co/t/how-to-get-current-time-as-unix-timestamp-for-script-use/240723 "2020-07-15T14:31:52Z")
Hello, I have three fields: date\_start (type: date) date\_end (type: date) permanent (type: bool) I would like to return all documents with theses conditions: date\_start \<= now AND date\_end \>= now OR date\_start \<= … --- ## [AWS Elasticsearch snapshot stuck in state IN\_PROGRESS](https://discuss.elastic.co/t/aws-elasticsearch-snapshot-stuck-in-state-in-progress/241289)
**Author:** [@dorinand](https://discuss.elastic.co/u/dorinand)\ **Replies:** 2\ **Last updated:** [July 15, 2020, 2:16pm UTC](https://discuss.elastic.co/t/aws-elasticsearch-snapshot-stuck-in-state-in-progress/241289 "2020-07-15T14:16:24Z")
I am using ElasticService from AWS. I am receiving Snapshot failure status in Overall health. I can see, there is one snapshot that is stuctk for almost 2 days. id … --- ## [Not able to start Elasticsearch, no matter what I do](https://discuss.elastic.co/t/not-able-to-start-elasticsearch-no-matter-what-i-do/240847)
**Author:** [@prajwalgmpp](https://discuss.elastic.co/u/prajwalgmpp)\ **Replies:** 7\ **Last updated:** [July 15, 2020, 2:15pm UTC](https://discuss.elastic.co/t/not-able-to-start-elasticsearch-no-matter-what-i-do/240847 "2020-07-15T14:15:42Z")
Running Ubuntu 20.04 on Oracle VM. Deployed two Ubuntu instances on AWS. I will list out all the steps I did. Please let me know where I have gone wrong. Copied the pem file to home directory cp ~/Downloads/TetraSear… --- ## [How to restore elasticsearch s3 snapshot on a different cluster](https://discuss.elastic.co/t/how-to-restore-elasticsearch-s3-snapshot-on-a-different-cluster/241153)
**Author:** [@Kay\_Khan](https://discuss.elastic.co/u/Kay_Khan)\ **Replies:** 3\ **Last updated:** [July 15, 2020, 1:58pm UTC](https://discuss.elastic.co/t/how-to-restore-elasticsearch-s3-snapshot-on-a-different-cluster/241153 "2020-07-15T13:58:51Z")
I have an Elastic Cloud on Kubernetes (ECK) setup and i have also setup snapshots which are stored on s3. I want to restore these snapshots on s3 to a local version of ECK i have running on minikube. So how do i restore… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=858) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=860)