# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=860 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 861 --- ## [List of string must match all provided values](https://discuss.elastic.co/t/list-of-string-must-match-all-provided-values/240351)
**Author:** [@Nicolas\_Rey](https://discuss.elastic.co/u/Nicolas_Rey)\ **Replies:** 13\ **Last updated:** [July 15, 2020, 1:07pm UTC](https://discuss.elastic.co/t/list-of-string-must-match-all-provided-values/240351 "2020-07-15T13:07:30Z")
Hi, I'm new to Elastic Search, and I simply would like to make a query that filter all entries that have exactly all the supplied values (not an OR but an AND). Here is an example of my document \[ { "Areas" : … --- ## [Sum nested values and filter / sort by them](https://discuss.elastic.co/t/sum-nested-values-and-filter-sort-by-them/241284)
**Author:** [@stefnats](https://discuss.elastic.co/u/stefnats)\ **Replies:** 5\ **Last updated:** [July 15, 2020, 12:54pm UTC](https://discuss.elastic.co/t/sum-nested-values-and-filter-sort-by-them/241284 "2020-07-15T12:54:26Z")
Hi, as in this thread, my problem is pretty similar: I have a product index with a nested sales\_per\_day array. It looks something like this: PUT /products { "mappings": { "properties": { "sales\_per\_day… --- ## [Elasticsearch term aggregations : use case for a single field](https://discuss.elastic.co/t/elasticsearch-term-aggregations-use-case-for-a-single-field/240672)
**Author:** [@vic22](https://discuss.elastic.co/u/vic22)\ **Replies:** 2\ **Last updated:** [July 15, 2020, 12:40pm UTC](https://discuss.elastic.co/t/elasticsearch-term-aggregations-use-case-for-a-single-field/240672 "2020-07-15T12:40:02Z")
Hello everyone, I try to understand term aggregations in Elasticsearch, and I don't know how to fix an particular use case : let me explain ! I try to catch all the element and their "key" values of a single field with… --- ## [Slurm Forwarding Error (anonymous user)](https://discuss.elastic.co/t/slurm-forwarding-error-anonymous-user/241292)
**Author:** [@Kerg09](https://discuss.elastic.co/u/Kerg09)\ **Replies:** 0\ **Last updated:** [July 15, 2020, 12:28pm UTC](https://discuss.elastic.co/t/slurm-forwarding-error-anonymous-user/241292 "2020-07-15T12:28:48Z")
Hello all. I am trying to set up a log forwarder from SLURM to elasticsearch using this guide https://slurm.schedmd.com/elasticsearch.html I have already run into a few snags. My Elasticsearch is encrypted using the xp… --- ## [Question regarding dedicated master nodes](https://discuss.elastic.co/t/question-regarding-dedicated-master-nodes/241267)
**Author:** [@Zerobot](https://discuss.elastic.co/u/Zerobot)\ **Replies:** 1\ **Last updated:** [July 15, 2020, 10:41am UTC](https://discuss.elastic.co/t/question-regarding-dedicated-master-nodes/241267 "2020-07-15T10:41:53Z")
Hello! What will happen to elasticsearch cluster if 2 out of 3 dedicated master nodes will go down? Let's say we have replication factor 2 and basically 2/3 of our cluster went down - we still have the data because it … --- ## [Discover query with geolocation](https://discuss.elastic.co/t/discover-query-with-geolocation/241199)
**Author:** [@ClubberLang](https://discuss.elastic.co/u/ClubberLang)\ **Replies:** 2\ **Last updated:** [July 15, 2020, 10:25am UTC](https://discuss.elastic.co/t/discover-query-with-geolocation/241199 "2020-07-15T10:25:12Z")
Hi, FYI, I'm just a newbie with ES, but so... let's start :slight\_smile: I currently have a "discovery query", imagine that I have "stores" and each store has "products". Noticed that each store is geolocalized. So, t… --- ## [Clarifying the difference between Active shards and in-sync copies](https://discuss.elastic.co/t/clarifying-the-difference-between-active-shards-and-in-sync-copies/238716)
**Author:** [@paulcarey](https://discuss.elastic.co/u/paulcarey)\ **Replies:** 2\ **Last updated:** [July 15, 2020, 9:06am UTC](https://discuss.elastic.co/t/clarifying-the-difference-between-active-shards-and-in-sync-copies/238716 "2020-07-15T09:06:18Z")
Hi The replication docs state a single in-sync copy is sufficient to serve read requests and then, when describing the read model, the same doc states that the basic flow Select\[s\] an active copy of each relevant … --- ## [How to import attribute from another analyzer plugin](https://discuss.elastic.co/t/how-to-import-attribute-from-another-analyzer-plugin/241013)
**Author:** [@JBo\_Shim](https://discuss.elastic.co/u/JBo_Shim)\ **Replies:** 1\ **Last updated:** [July 15, 2020, 8:16am UTC](https://discuss.elastic.co/t/how-to-import-attribute-from-another-analyzer-plugin/241013 "2020-07-15T08:16:03Z")
Hi, I'm attempting to create custom token filter in elasticsearch (7.8.0, lucene 8.5.1). I managed to make my own plugin with filter, installed on my ES cluster. In this filter, I'm trying to use attribute from anothe… --- ## [Error in elk](https://discuss.elastic.co/t/error-in-elk/240956)
**Author:** [@Deepika\_Rawat](https://discuss.elastic.co/u/Deepika_Rawat)\ **Replies:** 11\ **Last updated:** [July 15, 2020, 6:34am UTC](https://discuss.elastic.co/t/error-in-elk/240956 "2020-07-15T06:34:45Z")
I tried to import using kv filter my logs started importing like this.. indent preformatted text by 4 spaces "authserver" =\> "a\_India RADIUS", "proto" =\> "6", "devname" =\> "FW\_1", "10:56:12\\tdate" =\> "2020-06-22\\tl… --- ## [Data Organization](https://discuss.elastic.co/t/data-organization/241178)
**Author:** [@liron\_gofberg](https://discuss.elastic.co/u/liron_gofberg)\ **Replies:** 3\ **Last updated:** [July 15, 2020, 6:29am UTC](https://discuss.elastic.co/t/data-organization/241178 "2020-07-15T06:29:57Z")
Hi, I have 150 thousands fathers and each father has 20 millions children there is only one type of document. document describes child and its father. I routed the documents by father id but I am not sure if it's a g… --- ## [Replacing missing aggregation value](https://discuss.elastic.co/t/replacing-missing-aggregation-value/241223)
**Author:** [@111366](https://discuss.elastic.co/u/111366)\ **Replies:** 0\ **Last updated:** [July 15, 2020, 5:12am UTC](https://discuss.elastic.co/t/replacing-missing-aggregation-value/241223 "2020-07-15T05:12:22Z")
Hello, I am an engineer preparing to migrate from splunk to elasticsearch. I wanted to aggregate the highest value of count every minute, and I wanted to replace the empty part with zero. However, it didn't work out as… --- ## [Elasticsearch index/result aggregation with multiple datasources](https://discuss.elastic.co/t/elasticsearch-index-result-aggregation-with-multiple-datasources/237649)
**Author:** [@tbege](https://discuss.elastic.co/u/tbege)\ **Replies:** 13\ **Last updated:** [July 15, 2020, 4:16am UTC](https://discuss.elastic.co/t/elasticsearch-index-result-aggregation-with-multiple-datasources/237649 "2020-07-15T04:16:38Z")
Hello, I am currently researching the functionalities and features of the Elastic stack, more precisely Elasticsearch and Logstash and would need some advice regarding a scenario that I would need to implement. I have s… --- ## [Elasticsearch restart issue](https://discuss.elastic.co/t/elasticsearch-restart-issue/241197)
**Author:** [@Splunk](https://discuss.elastic.co/u/Splunk)\ **Replies:** 3\ **Last updated:** [July 15, 2020, 3:58am UTC](https://discuss.elastic.co/t/elasticsearch-restart-issue/241197 "2020-07-15T03:58:15Z")
Hi Guys, I changed network host to 0.0.0.0 from localhost and I restarted the machine that's all its gone below is the message, any suggestion thanks. ubuntu@ip-1XX-XX-X-X:~/ELK$ sudo /etc/init.d/elasticsearch status ●… --- ## [Elastic Search Failure over EC2 AWS](https://discuss.elastic.co/t/elastic-search-failure-over-ec2-aws/241130)
**Author:** [@BabarKhan](https://discuss.elastic.co/u/BabarKhan)\ **Replies:** 2\ **Last updated:** [July 15, 2020, 2:53am UTC](https://discuss.elastic.co/t/elastic-search-failure-over-ec2-aws/241130 "2020-07-15T02:53:49Z")
I was trying to install Magento over Amazon EC2 instance and it requires ElasticSearch as prerequisite. I followed available methods to install it through Archive and the other method. But none of them worked for me. Wh… --- ## [Date parsing error in Elasticsearch 7.1](https://discuss.elastic.co/t/date-parsing-error-in-elasticsearch-7-1/240607)
**Author:** [@sharadha\_s](https://discuss.elastic.co/u/sharadha_s)\ **Replies:** 10\ **Last updated:** [July 15, 2020, 1:02am UTC](https://discuss.elastic.co/t/date-parsing-error-in-elasticsearch-7-1/240607 "2020-07-15T01:02:12Z")
We are using the AWS Elasticsearch 7.1 and we see some date formats are not being supported. It used to work in 5.5 and its a issue with only 7.1. Mapping : "dynamic": "strict", "dynamic\_templates… --- ## [Performance of painless scripts: inline vs stored](https://discuss.elastic.co/t/performance-of-painless-scripts-inline-vs-stored/241212)
**Author:** [@Dennis\_Andersen](https://discuss.elastic.co/u/Dennis_Andersen)\ **Replies:** 1\ **Last updated:** [July 15, 2020, 12:53am UTC](https://discuss.elastic.co/t/performance-of-painless-scripts-inline-vs-stored/241212 "2020-07-15T00:53:08Z")
Is it more efficient to create stored painless scripts than put them inline? Specifically I am interested in this for aggregations. Thanks, Dennis --- ## [Delete Replica after N days ILM](https://discuss.elastic.co/t/delete-replica-after-n-days-ilm/241208)
**Author:** [@contregm](https://discuss.elastic.co/u/contregm)\ **Replies:** 2\ **Last updated:** [July 15, 2020, 12:28am UTC](https://discuss.elastic.co/t/delete-replica-after-n-days-ilm/241208 "2020-07-15T00:28:11Z")
Looking at the documentation it seems to say that if you only have hot nodes you can't set a lifecycle policy to remove replicas after a certain time period. You would have to migrate to a warm/cold node to be able to do… --- ## [Rest client for Elastic 6.2.x and 7.2.x](https://discuss.elastic.co/t/rest-client-for-elastic-6-2-x-and-7-2-x/241183)
**Author:** [@ashu.vedi](https://discuss.elastic.co/u/ashu.vedi)\ **Replies:** 0\ **Last updated:** [July 14, 2020, 7:04pm UTC](https://discuss.elastic.co/t/rest-client-for-elastic-6-2-x-and-7-2-x/241183 "2020-07-14T19:04:24Z")
Hi , We have a sbt project which need to query both elasticsearch 6.2 cluster using sksamuel/elastic4s as well as Elasticsearch 7.2.0 using the bight level rest client for elasticsearch. I am getting errors as there is a… --- ## [JVM Heap Size settings defined are not the same as I can see now](https://discuss.elastic.co/t/jvm-heap-size-settings-defined-are-not-the-same-as-i-can-see-now/241160)
**Author:** [@jelocabral](https://discuss.elastic.co/u/jelocabral)\ **Replies:** 0\ **Last updated:** [July 14, 2020, 3:52pm UTC](https://discuss.elastic.co/t/jvm-heap-size-settings-defined-are-not-the-same-as-i-can-see-now/241160 "2020-07-14T15:52:37Z")
Dear people, I have an ELK 7.8.0 server with 60GB RAM. It is a Debian 10 server and the ELK packages were installed by apt (DEB packages). I've setup the JVM heap size in: /etc/elasticsearch/jvm.options: -Xms30g -Xmx… --- ## [Accessing file system from within Elasticsearch custom realm?](https://discuss.elastic.co/t/accessing-file-system-from-within-elasticsearch-custom-realm/241193)
**Author:** [@TimothyMDean](https://discuss.elastic.co/u/TimothyMDean)\ **Replies:** 0\ **Last updated:** [July 14, 2020, 8:39pm UTC](https://discuss.elastic.co/t/accessing-file-system-from-within-elasticsearch-custom-realm/241193 "2020-07-14T20:39:44Z")
I am working on a custom authentication realm for Elasticsearch. In its current form I would like it to be able to read a secret key from a locally-readable Java keystone in JCEKS format. I have set up my ES plugin with … --- ## [Searching multiple values in multiple fields](https://discuss.elastic.co/t/searching-multiple-values-in-multiple-fields/241177)
**Author:** [@brsntus](https://discuss.elastic.co/u/brsntus)\ **Replies:** 2\ **Last updated:** [July 14, 2020, 7:15pm UTC](https://discuss.elastic.co/t/searching-multiple-values-in-multiple-fields/241177 "2020-07-14T19:15:30Z")
Hi folks. I have an index with documents that have a product\_id (long) and product\_subtype (text). I'm trying to search for documents using multiple product\_ids and product\_subtypes. The data that I have is this: \[ … --- ## [Can I match network ranges in painless?](https://discuss.elastic.co/t/can-i-match-network-ranges-in-painless/241182)
**Author:** [@tterranigma](https://discuss.elastic.co/u/tterranigma)\ **Replies:** 0\ **Last updated:** [July 14, 2020, 7:01pm UTC](https://discuss.elastic.co/t/can-i-match-network-ranges-in-painless/241182 "2020-07-14T19:01:49Z")
I would like to port some packetbeat processors over to ingest node. One of the processors I would like to port is the network processor that matches a subnet range. Is there a way to port this over to ingest node? I cou… --- ## [Geospatial query with aggregations does not return any results ES7.6](https://discuss.elastic.co/t/geospatial-query-with-aggregations-does-not-return-any-results-es7-6/240762)
**Author:** [@vmanohar1](https://discuss.elastic.co/u/vmanohar1)\ **Replies:** 4\ **Last updated:** [July 14, 2020, 6:27pm UTC](https://discuss.elastic.co/t/geospatial-query-with-aggregations-does-not-return-any-results-es7-6/240762 "2020-07-14T18:27:49Z")
1) MY template for indices of type myindex-YYYY-MM-DD is - PUT \_template/myindex\_template { "index\_patterns" : \["myindex-\*"\], "aliases" : { "myindex\_alias" : {} }, "settings": { "number\_of\_repl… --- ## [Search for a negative value](https://discuss.elastic.co/t/search-for-a-negative-value/241159)
**Author:** [@Katia](https://discuss.elastic.co/u/Katia)\ **Replies:** 1\ **Last updated:** [July 14, 2020, 4:18pm UTC](https://discuss.elastic.co/t/search-for-a-negative-value/241159 "2020-07-14T16:18:39Z")
I have indexed fields containing character codes such as 3 1 1 and 3 1 -1. But when I search 3 1 -1 it seems that the "-" is not supported! could you please help me? GET /\_search { "query": { "match\_phra… --- ## [Active directory Authentication Problem](https://discuss.elastic.co/t/active-directory-authentication-problem/240838)
**Author:** [@Mahmoud\_Shash](https://discuss.elastic.co/u/Mahmoud_Shash)\ **Replies:** 4\ **Last updated:** [July 14, 2020, 4:16pm UTC](https://discuss.elastic.co/t/active-directory-authentication-problem/240838 "2020-07-14T16:16:34Z")
Hello Gents, I'm a newbie in the elastic World, actually, I'm counting on you to solve my problem. I've elastic search cluster and I need to do the Active directory integration I followed the https://www.elastic.co/gu… --- ## [How to install Elasticsearch windows service on server with different versions of Java?](https://discuss.elastic.co/t/how-to-install-elasticsearch-windows-service-on-server-with-different-versions-of-java/240854)
**Author:** [@Gosforth](https://discuss.elastic.co/u/Gosforth)\ **Replies:** 1\ **Last updated:** [July 14, 2020, 3:05pm UTC](https://discuss.elastic.co/t/how-to-install-elasticsearch-windows-service-on-server-with-different-versions-of-java/240854 "2020-07-14T15:05:25Z")
I have at least two versions of Java on server so JAVA\_HOME points to version 8 not 11. To start manually start ES I just modified elasticsearch-env.bat: if "%JAVA\_HOME%" == "" ( set JAVA="%ES\_HOME%\\jdk\\bin\\java.exe"… --- ## [Wrong result in Bool Query](https://discuss.elastic.co/t/wrong-result-in-bool-query/241136)
**Author:** [@buka\_bidzina](https://discuss.elastic.co/u/buka_bidzina)\ **Replies:** 11\ **Last updated:** [July 14, 2020, 2:19pm UTC](https://discuss.elastic.co/t/wrong-result-in-bool-query/241136 "2020-07-14T14:19:02Z")
Mapping PUT index PUT /index/\_mapping { "properties": { "categories": { "type": "nested", "properties": { "id": { "type": "integer" } } }, "deleted": { "… --- ## [Rejected execution](https://discuss.elastic.co/t/rejected-execution/240984)
**Author:** [@alexus](https://discuss.elastic.co/u/alexus)\ **Replies:** 8\ **Last updated:** [July 14, 2020, 2:05pm UTC](https://discuss.elastic.co/t/rejected-execution/240984 "2020-07-14T14:05:58Z")
Hello World! I'm using Elasticsearch 6.8.10 and trying to run a query, yet running into following issue: { "shard" : 3, "node" : "koEOgkkDBhOVfKHA7QXBjj", "reason" : { "reason" : "rejected execution of o… --- ## [Target node question](https://discuss.elastic.co/t/target-node-question/241105)
**Author:** [@Tuckson](https://discuss.elastic.co/u/Tuckson)\ **Replies:** 2\ **Last updated:** [July 14, 2020, 1:55pm UTC](https://discuss.elastic.co/t/target-node-question/241105 "2020-07-14T13:55:06Z")
Hi, Just a question. The amount of data my old (6.7 / 6.8) platform needs to process explodes. So I'm busy tuning that until my new (7.x) platform is ready. Now I have a bunch of indexes of which 2 or 3 are large and … --- ## [Adding script\_fields to transform index using painless scripts](https://discuss.elastic.co/t/adding-script-fields-to-transform-index-using-painless-scripts/240601)
**Author:** [@InfiniteDreamer](https://discuss.elastic.co/u/InfiniteDreamer)\ **Replies:** 2\ **Last updated:** [July 14, 2020, 1:02pm UTC](https://discuss.elastic.co/t/adding-script-fields-to-transform-index-using-painless-scripts/240601 "2020-07-14T13:02:50Z")
we have fields like hour of day, week of month,quarter of year.. derived from @timestamp field using scripted field in kibana. We want to create a transform index to summarize our operational data, we want to store thos… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=859) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=861)