# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=866 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 867 --- ## [Elasticsearch groovy script query Not working properly](https://discuss.elastic.co/t/elasticsearch-groovy-script-query-not-working-properly/240540)
**Author:** [@Abhishek\_Kumar5](https://discuss.elastic.co/u/Abhishek_Kumar5)\ **Replies:** 0\ **Last updated:** [July 9, 2020, 2:19pm UTC](https://discuss.elastic.co/t/elasticsearch-groovy-script-query-not-working-properly/240540 "2020-07-09T14:19:58Z")
Hi Everybody, I have a issue. Want your review on it to fix. Mapping { "supply": {"properties": { "rotation\_list": { "type": "nested", "properties": { "project\_end\_date": { "type": "nested",… --- ## [Upgrade to 7.8.0 failed](https://discuss.elastic.co/t/upgrade-to-7-8-0-failed/240331)
**Author:** [@ggrocott](https://discuss.elastic.co/u/ggrocott)\ **Replies:** 8\ **Last updated:** [July 9, 2020, 2:24pm UTC](https://discuss.elastic.co/t/upgrade-to-7-8-0-failed/240331 "2020-07-09T14:24:33Z")
I have just upgraded from 6.8 to 7.8. When I restarted the service, it fails: ● elasticsearch.service - Elasticsearch Loaded: loaded (/usr/lib/systemd/system/elasticsearch.service; enabled; vendor preset: disabled) Ac… --- ## [Multi-String search not working as expeced](https://discuss.elastic.co/t/multi-string-search-not-working-as-expeced/240457)
**Author:** [@ksarkar](https://discuss.elastic.co/u/ksarkar)\ **Replies:** 3\ **Last updated:** [July 9, 2020, 2:23pm UTC](https://discuss.elastic.co/t/multi-string-search-not-working-as-expeced/240457 "2020-07-09T14:23:22Z")
While executing following query, GET /rm\_inventory\_details\*/\_search { "query": { "query\_string": { "default\_field": "usage", "query": "(XYZ)" } } } Getting result. again GET /rm\_inven… --- ## [Sorting, Paginating the aggregated data](https://discuss.elastic.co/t/sorting-paginating-the-aggregated-data/240456)
**Author:** [@ankitagarwal9156](https://discuss.elastic.co/u/ankitagarwal9156)\ **Replies:** 11\ **Last updated:** [July 9, 2020, 2:16pm UTC](https://discuss.elastic.co/t/sorting-paginating-the-aggregated-data/240456 "2020-07-09T14:16:52Z")
I need to aggregate the data on the basis of two fields (composite aggregation), sort all the data and then perform pagination. Is is possible using elastic search? If Yes, Can you please share an example. --- ## [Elasticsearch doesn't start node validation exception](https://discuss.elastic.co/t/elasticsearch-doesnt-start-node-validation-exception/240530)
**Author:** [@n4gu4l](https://discuss.elastic.co/u/n4gu4l)\ **Replies:** 0\ **Last updated:** [July 9, 2020, 1:11pm UTC](https://discuss.elastic.co/t/elasticsearch-doesnt-start-node-validation-exception/240530 "2020-07-09T13:11:09Z")
Hi there, After experiencing some disk usage issues i freed some disk space deleting an old index from Kibana WEBUI interface. I wanted to share the path to another partition with more disk space and proceeded to restar… --- ## [Node pool upgrade](https://discuss.elastic.co/t/node-pool-upgrade/240526)
**Author:** [@amanjain](https://discuss.elastic.co/u/amanjain)\ **Replies:** 0\ **Last updated:** [July 9, 2020, 12:42pm UTC](https://discuss.elastic.co/t/node-pool-upgrade/240526 "2020-07-09T12:42:13Z")
Hi Elastic team, I have deployed Elasticsearch 6.x in GKE and I want to perform node pool upgrade. I have checked this doc https://www.elastic.co/guide/en/elasticsearch/reference/current/rolling-upgrades.html I will cr… --- ## [Could not initialize GeoHashGridAggregationBuilder for elastic search 7.8.0](https://discuss.elastic.co/t/could-not-initialize-geohashgridaggregationbuilder-for-elastic-search-7-8-0/240102)
**Author:** [@ayse](https://discuss.elastic.co/u/ayse)\ **Replies:** 6\ **Last updated:** [July 9, 2020, 12:12pm UTC](https://discuss.elastic.co/t/could-not-initialize-geohashgridaggregationbuilder-for-elastic-search-7-8-0/240102 "2020-07-09T12:12:18Z")
Hello, I upgraded Elastic search version to 7.8.0. When I call ElasticSearchAPI I faced with "Caused By: java.lang.NoClassDefFoundError: Could not initialize class org.elasticsearch.search.aggregations.bucket.geogrid.Ge… --- ## [Aggregation based on terms field is not working](https://discuss.elastic.co/t/aggregation-based-on-terms-field-is-not-working/240423)
**Author:** [@rajthilakr](https://discuss.elastic.co/u/rajthilakr)\ **Replies:** 2\ **Last updated:** [July 9, 2020, 11:59am UTC](https://discuss.elastic.co/t/aggregation-based-on-terms-field-is-not-working/240423 "2020-07-09T11:59:21Z")
Aggregation based on terms field is not working. I loaded the data with different (\_id), with the same data. I Am trying to find a duplicate of records based on one of the index fields. using the below simple terms quer… --- ## [Index reapears 1sec after deleting it](https://discuss.elastic.co/t/index-reapears-1sec-after-deleting-it/240522)
**Author:** [@defalt](https://discuss.elastic.co/u/defalt)\ **Replies:** 2\ **Last updated:** [July 9, 2020, 11:58am UTC](https://discuss.elastic.co/t/index-reapears-1sec-after-deleting-it/240522 "2020-07-09T11:58:15Z")
Hi, I try to delete 2 indices on my cluster. DELETE http://elastic:PASSWORD@IP:9200/index I get back acknowledged true. It gets delteted for 1 second and after that it reapears What it looks like when I look at the s… --- ## [Aggregation by the first character of field](https://discuss.elastic.co/t/aggregation-by-the-first-character-of-field/240307)
**Author:** [@d.silwon](https://discuss.elastic.co/u/d.silwon)\ **Replies:** 5\ **Last updated:** [July 9, 2020, 11:48am UTC](https://discuss.elastic.co/t/aggregation-by-the-first-character-of-field/240307 "2020-07-09T11:48:49Z")
Dears, Is there any way to do doc aggregation on the first character instead of whole field? My query in case of whole field: GET /log-2020.07.07/\_search?size=0 { "aggs": { "TEXT1": { "terms": { "f… --- ## [Need to setup rollover on indexes in elasticsearch](https://discuss.elastic.co/t/need-to-setup-rollover-on-indexes-in-elasticsearch/240516)
**Author:** [@manjeetsingh](https://discuss.elastic.co/u/manjeetsingh)\ **Replies:** 0\ **Last updated:** [July 9, 2020, 11:10am UTC](https://discuss.elastic.co/t/need-to-setup-rollover-on-indexes-in-elasticsearch/240516 "2020-07-09T11:10:39Z")
Hi, I am looking for help in rollover indexes using ILM policy on existing indexes. I have created one policy with below parameters { "rollup-policy" : { "version" : 1, "modified\_date" : "2020-07-09T10:48:54.921Z", … --- ## [Check if restore operation is still running](https://discuss.elastic.co/t/check-if-restore-operation-is-still-running/239764)
**Author:** [@JacFal](https://discuss.elastic.co/u/JacFal)\ **Replies:** 13\ **Last updated:** [July 9, 2020, 11:40am UTC](https://discuss.elastic.co/t/check-if-restore-operation-is-still-running/239764 "2020-07-09T11:40:05Z")
Hello, Is there any way to monitor restore if wait\_for\_completion flag is set to false? For now I use the GET \_recovery API. I have few conditions for each shard in indices to check if restore operation is still runnin… --- ## [Getting error in MAC OS](https://discuss.elastic.co/t/getting-error-in-mac-os/240500)
**Author:** [@inandi](https://discuss.elastic.co/u/inandi)\ **Replies:** 1\ **Last updated:** [July 9, 2020, 11:22am UTC](https://discuss.elastic.co/t/getting-error-in-mac-os/240500 "2020-07-09T11:22:30Z")
getting this error while starting elasticsearch in macOS Catalina via brew \[2020-07-09T14:38:59,510\]\[INFO \]\[o.e.n.Node \] \[node-testgobinda\] initialized \[2020-07-09T14:38:59,512\]\[INFO \]\[o.e.n.Node … --- ## [Unable to use variable in curl bash script](https://discuss.elastic.co/t/unable-to-use-variable-in-curl-bash-script/240003)
**Author:** [@Jose\_H](https://discuss.elastic.co/u/Jose_H)\ **Replies:** 2\ **Last updated:** [July 9, 2020, 11:03am UTC](https://discuss.elastic.co/t/unable-to-use-variable-in-curl-bash-script/240003 "2020-07-09T11:03:30Z")
Hi guys. I've been trying to use a variable called "Time Period Variable" in my bash script, but im unable to make it work: #!/bin/bash ES EVENT Threshold number=10 Time Period Variable es\_period=now-1d Elasticsearc… --- ## [Using tokenizer on rank\_feature fields](https://discuss.elastic.co/t/using-tokenizer-on-rank-feature-fields/240417)
**Author:** [@lukegil](https://discuss.elastic.co/u/lukegil)\ **Replies:** 1\ **Last updated:** [July 9, 2020, 10:45am UTC](https://discuss.elastic.co/t/using-tokenizer-on-rank-feature-fields/240417 "2020-07-09T10:45:57Z")
Hi! I was wondering if it's possible to apply tokenizer/analyzers to rank\_feature fields. When attempting to create a sample index on ES 7.6.2 it doesn't appear to work, but I don't see anything explicit in the docs. In… --- ## [Merge two datasets](https://discuss.elastic.co/t/merge-two-datasets/240506)
**Author:** [@lugano](https://discuss.elastic.co/u/lugano)\ **Replies:** 0\ **Last updated:** [July 9, 2020, 9:59am UTC](https://discuss.elastic.co/t/merge-two-datasets/240506 "2020-07-09T09:59:53Z")
I have two datasets which I want to merge into one. I am using Elastic stack v7.7 . I want to use composite key with Painless script processor. To get a unique document I need 4 fields. 3 of the fields they match exactly… --- ## [Cant update the mapping](https://discuss.elastic.co/t/cant-update-the-mapping/238031)
**Author:** [@Alexandros888](https://discuss.elastic.co/u/Alexandros888)\ **Replies:** 0\ **Last updated:** [June 22, 2020, 7:56am UTC](https://discuss.elastic.co/t/cant-update-the-mapping/238031 "2020-06-22T07:56:41Z")
Hello, I cant map correctly the following field: http.request.body.original Currently part of my mapping looks like that for my apm indices: "http" : { "dynamic" : "false", "properties" : { … --- ## [Quering nullable timstamp field](https://discuss.elastic.co/t/quering-nullable-timstamp-field/240478)
**Author:** [@recordable542](https://discuss.elastic.co/u/recordable542)\ **Replies:** 1\ **Last updated:** [July 9, 2020, 8:55am UTC](https://discuss.elastic.co/t/quering-nullable-timstamp-field/240478 "2020-07-09T08:55:28Z")
I have user index like below name: text frozen\_until: timestamp I want to query all users which... (frozen\_until == null || frozen\_until \< today) below is the query I'm struggling with: { "query": { "bool": { … --- ## [Link index lifecycle policies to the snapshot policy](https://discuss.elastic.co/t/link-index-lifecycle-policies-to-the-snapshot-policy/240440)
**Author:** [@lusynda](https://discuss.elastic.co/u/lusynda)\ **Replies:** 1\ **Last updated:** [July 9, 2020, 8:26am UTC](https://discuss.elastic.co/t/link-index-lifecycle-policies-to-the-snapshot-policy/240440 "2020-07-09T08:26:04Z")
Hi all. I currently need to backup old indices are like 3 month older that the current time and only that, then after that i will delete those indices. I don't really know how to since the way i name the indices makes … --- ## [Limitations for AWS hosted ES Instances](https://discuss.elastic.co/t/limitations-for-aws-hosted-es-instances/240303)
**Author:** [@Flora\_Dev](https://discuss.elastic.co/u/Flora_Dev)\ **Replies:** 3\ **Last updated:** [July 9, 2020, 7:58am UTC](https://discuss.elastic.co/t/limitations-for-aws-hosted-es-instances/240303 "2020-07-09T07:58:48Z")
Hello Experts, We have m5.xlarge.elasticsearch instance hosted for product search and index purpose (retail products, images, product descriptions ect.,) In AWS cloudwatch perspective I want to set alarm for Index Rate … --- ## [Elastic down when I ask for more than 6 days](https://discuss.elastic.co/t/elastic-down-when-i-ask-for-more-than-6-days/240336)
**Author:** [@ISR\_FY](https://discuss.elastic.co/u/ISR_FY)\ **Replies:** 4\ **Last updated:** [July 9, 2020, 7:53am UTC](https://discuss.elastic.co/t/elastic-down-when-i-ask-for-more-than-6-days/240336 "2020-07-09T07:53:47Z")
Morning team. Actually, I have a problem with my ElasticStack. I have crashes on my main elastic search when i ask in grafana dashboards for more than 6 days. The memory and CPU is high but Ive increased the CPU and me… --- ## [Can I block document names in Elasticsearch?](https://discuss.elastic.co/t/can-i-block-document-names-in-elasticsearch/240455)
**Author:** [@Callonski](https://discuss.elastic.co/u/Callonski)\ **Replies:** 1\ **Last updated:** [July 9, 2020, 7:51am UTC](https://discuss.elastic.co/t/can-i-block-document-names-in-elasticsearch/240455 "2020-07-09T07:51:25Z")
My problem is ingesting data that does not come in order into elasticsearch. The data is customer profiles, and if a customer updates their profile and then deletes it. I will receive two messages. One Update and one Del… --- ## [Help Searching the data from my index](https://discuss.elastic.co/t/help-searching-the-data-from-my-index/240286)
**Author:** [@snowfall\_2010](https://discuss.elastic.co/u/snowfall_2010)\ **Replies:** 3\ **Last updated:** [July 9, 2020, 6:14am UTC](https://discuss.elastic.co/t/help-searching-the-data-from-my-index/240286 "2020-07-09T06:14:18Z")
my index save data structure is the pic below: index info: "1":{ "aliases":{}, "mappings":{ "properties":{ "DeviceId":{ "type":"text", "fields":{ … --- ## [Semantically equivalent search leads to different results](https://discuss.elastic.co/t/semantically-equivalent-search-leads-to-different-results/240297)
**Author:** [@puschelfoo](https://discuss.elastic.co/u/puschelfoo)\ **Replies:** 4\ **Last updated:** [July 9, 2020, 5:13am UTC](https://discuss.elastic.co/t/semantically-equivalent-search-leads-to-different-results/240297 "2020-07-09T05:13:06Z")
Query \[1\] (exactly one result) and \[2\] (many results) differ in their results (quantity), although they are semantically equivalent according to the documentation (see "operator" parameter explanation for in Documentati… --- ## [Post Upgrading ElasticSearch to 6.8.10 its not receiving data from Logstash(5.6.16)](https://discuss.elastic.co/t/post-upgrading-elasticsearch-to-6-8-10-its-not-receiving-data-from-logstash-5-6-16/240445)
**Author:** [@vsudhaka](https://discuss.elastic.co/u/vsudhaka)\ **Replies:** 2\ **Last updated:** [July 9, 2020, 4:53am UTC](https://discuss.elastic.co/t/post-upgrading-elasticsearch-to-6-8-10-its-not-receiving-data-from-logstash-5-6-16/240445 "2020-07-09T04:53:05Z")
Hello, I am new in using ELK stack. I recently Upgraded Logstash from 5.6.13 -\> 5.6.16 ,ElasticSearch Nodes from 5.6.16 -\> 6.8.10 and Kibana from 5.6.16 -\> 6.8.10. I did not Upgrade Logstash and FileBeats to version 6… --- ## [Bug in elasticsearch search\_after rest api?](https://discuss.elastic.co/t/bug-in-elasticsearch-search-after-rest-api/240215)
**Author:** [@corbosman](https://discuss.elastic.co/u/corbosman)\ **Replies:** 5\ **Last updated:** [July 9, 2020, 3:14am UTC](https://discuss.elastic.co/t/bug-in-elasticsearch-search-after-rest-api/240215 "2020-07-09T03:14:04Z")
Hi all, im running into what I'm thinking might be a bug. I'm using the REST search api to return log entries stored in our elasticsearch cluster. This could run into the tens of thousands, so I'm using search\_after to r… --- ## [Questions about default sorting！！！](https://discuss.elastic.co/t/questions-about-default-sorting/240362)
**Author:** [@111365](https://discuss.elastic.co/u/111365)\ **Replies:** 2\ **Last updated:** [July 9, 2020, 1:50am UTC](https://discuss.elastic.co/t/questions-about-default-sorting/240362 "2020-07-09T01:50:56Z")
When I use elasticsearch's search function, matchall always returns documents in a fixed order, without relevance ranking. So what is the sort order without using sort? --- ## [Help parsing a date field](https://discuss.elastic.co/t/help-parsing-a-date-field/240253)
**Author:** [@ajhstn](https://discuss.elastic.co/u/ajhstn)\ **Replies:** 3\ **Last updated:** [July 9, 2020, 1:24am UTC](https://discuss.elastic.co/t/help-parsing-a-date-field/240253 "2020-07-09T01:24:34Z")
Hello, my source data has the following dates, which i am struggling to create the correct field mapping. "notBefore": "Jun 9 00:31:02 2020 GMT", "notAfter": "Jun 9 00:31:02 2025 GMT" i have tried various combination… --- ## [Is there a way to bring back in clause without using OR in query string](https://discuss.elastic.co/t/is-there-a-way-to-bring-back-in-clause-without-using-or-in-query-string/240374)
**Author:** [@dcengl](https://discuss.elastic.co/u/dcengl)\ **Replies:** 1\ **Last updated:** [July 9, 2020, 12:48am UTC](https://discuss.elastic.co/t/is-there-a-way-to-bring-back-in-clause-without-using-or-in-query-string/240374 "2020-07-09T00:48:14Z")
Is there a way to bring back the "in" query without using OR in ES 7. For example: q=my-field:(value1 value2 value3) instead of q=my-field:(value1 OR value2 OR value3) --- ## [Conditionally merge values from 2 fields into 1 new field](https://discuss.elastic.co/t/conditionally-merge-values-from-2-fields-into-1-new-field/240436)
**Author:** [@ericl](https://discuss.elastic.co/u/ericl)\ **Replies:** 1\ **Last updated:** [July 9, 2020, 12:44am UTC](https://discuss.elastic.co/t/conditionally-merge-values-from-2-fields-into-1-new-field/240436 "2020-07-09T00:44:53Z")
I'm looking for a recommended way to copy value either from field1 or field2, whichever is not empty and field2 take precedence over field1, into a third field name field3 I was trying to do that with scripted fields, I… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=865) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=867)