# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=867 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 868 --- ## [Filter with multiple string queries with wildcard](https://discuss.elastic.co/t/filter-with-multiple-string-queries-with-wildcard/240432)
**Author:** [@okemu](https://discuss.elastic.co/u/okemu)\ **Replies:** 0\ **Last updated:** [July 8, 2020, 9:41pm UTC](https://discuss.elastic.co/t/filter-with-multiple-string-queries-with-wildcard/240432 "2020-07-08T21:41:32Z")
Hello, I'm new to Elasticsearch and would greatly appreciate help on this In the query below I only want the first document to be returned, but instead both documents are returned. How can I write a query to allow wildc… --- ## [Query multiple indexes](https://discuss.elastic.co/t/query-multiple-indexes/240396)
**Author:** [@sai\_16](https://discuss.elastic.co/u/sai_16)\ **Replies:** 1\ **Last updated:** [July 8, 2020, 9:42pm UTC](https://discuss.elastic.co/t/query-multiple-indexes/240396 "2020-07-08T21:42:38Z")
I need to perform this,how is it possible? I have index1 - with cpu,mem,hostname details. index-2 with location details. Now i need to fetch cpu,mem information of hostnames starting with host\* and location is bgl.How… --- ## [Matching combined words in elasticsearch?](https://discuss.elastic.co/t/matching-combined-words-in-elasticsearch/240284)
**Author:** [@jnatten](https://discuss.elastic.co/u/jnatten)\ **Replies:** 0\ **Last updated:** [July 8, 2020, 7:32am UTC](https://discuss.elastic.co/t/matching-combined-words-in-elasticsearch/240284 "2020-07-08T07:32:54Z")
Hi, We're using Elasticsearch for providing content search for users on our website, and I have a question regarding combined/compound words. In our language (Norwegian) "combined words" are a very regular occurrence, … --- ## [Need to fetch Avg CPU values for a particular set of hosts](https://discuss.elastic.co/t/need-to-fetch-avg-cpu-values-for-a-particular-set-of-hosts/240323)
**Author:** [@sai\_16](https://discuss.elastic.co/u/sai_16)\ **Replies:** 0\ **Last updated:** [July 8, 2020, 10:29am UTC](https://discuss.elastic.co/t/need-to-fetch-avg-cpu-values-for-a-particular-set-of-hosts/240323 "2020-07-08T10:29:35Z")
I want to fetch all the records of avg cpu and memory usage for a particular set of hosts,with one hour of granularity. I'm using below query { "size": 0, "\_source" : \["@timestamp","beat.name","system.memory.used.pct",… --- ## [RSS Feeds ingestion](https://discuss.elastic.co/t/rss-feeds-ingestion/240332)
**Author:** [@anu\_gaur](https://discuss.elastic.co/u/anu_gaur)\ **Replies:** 0\ **Last updated:** [July 8, 2020, 11:16am UTC](https://discuss.elastic.co/t/rss-feeds-ingestion/240332 "2020-07-08T11:16:26Z")
Hi, I have elasticsearch on elastic cloud deployment. I want to ingest RSS feeds into the elasticsearch on elastic cloud. Could you please guide for the same. --- ## [Received response for a request that has timed out Issue & \[o.e.c.c.C.CoordinatorPublication\] \[Master Node Name\] after \[30s\] publication of cluster state version \[number\] is still waiting for {Data Node Name}](https://discuss.elastic.co/t/received-response-for-a-request-that-has-timed-out-issue-o-e-c-c-c-coordinatorpublication-master-node-name-after-30s-publication-of-cluster-state-version-number-is-still-waiting-for-data-node-name/240353)
**Author:** [@ankitag79](https://discuss.elastic.co/u/ankitag79)\ **Replies:** 0\ **Last updated:** [July 8, 2020, 1:31pm UTC](https://discuss.elastic.co/t/received-response-for-a-request-that-has-timed-out-issue-o-e-c-c-c-coordinatorpublication-master-node-name-after-30s-publication-of-cluster-state-version-number-is-still-waiting-for-data-node-name/240353 "2020-07-08T13:31:46Z")
Hi, Obviously, this error indicates cluster overload but this has become more frequent after adding more data nodes to cluster and separating out master only nodes. Also the throughput of the cluster has reduced. There… --- ## [Fetching all the buckets using Composite Search](https://discuss.elastic.co/t/fetching-all-the-buckets-using-composite-search/240381)
**Author:** [@ankitagarwal9156](https://discuss.elastic.co/u/ankitagarwal9156)\ **Replies:** 0\ **Last updated:** [July 8, 2020, 3:30pm UTC](https://discuss.elastic.co/t/fetching-all-the-buckets-using-composite-search/240381 "2020-07-08T15:30:09Z")
Is there any way to fetch all the buckets (without pagination) using composite aggregation? Right now by default 10 buckets are returned. --- ## [How to fetch the count of the documents from the sql query translate](https://discuss.elastic.co/t/how-to-fetch-the-count-of-the-documents-from-the-sql-query-translate/240394)
**Author:** [@Jayasri\_Cimba](https://discuss.elastic.co/u/Jayasri_Cimba)\ **Replies:** 0\ **Last updated:** [July 8, 2020, 4:06pm UTC](https://discuss.elastic.co/t/how-to-fetch-the-count-of-the-documents-from-the-sql-query-translate/240394 "2020-07-08T16:06:46Z")
I translate this elastic query sql POST \_sql?translate { "query": "SELECT HISTOGRAM(\\"@timestamp\\", INTERVAL 1 MONTH) AS month, count(DISTINCT(ID)) as id\_count, report\_period FROM \\"indexname-\*\\" WHERE \\"@t… --- ## [Specifying match\_phrases to search for dynamically](https://discuss.elastic.co/t/specifying-match-phrases-to-search-for-dynamically/238537)
**Author:** [@chari](https://discuss.elastic.co/u/chari)\ **Replies:** 1\ **Last updated:** [July 8, 2020, 8:21pm UTC](https://discuss.elastic.co/t/specifying-match-phrases-to-search-for-dynamically/238537 "2020-07-08T20:21:25Z")
I have a list of bigrams that I would like to search for. How can I specify each of them dynamically ? "query" : { "bool" : { "must": \[ … --- ## [Curator "regular expression matching with timestrings"](https://discuss.elastic.co/t/curator-regular-expression-matching-with-timestrings/240401)
**Author:** [@rsk0](https://discuss.elastic.co/u/rsk0)\ **Replies:** 2\ **Last updated:** [July 8, 2020, 8:05pm UTC](https://discuss.elastic.co/t/curator-regular-expression-matching-with-timestrings/240401 "2020-07-08T20:05:15Z")
Curator docs say What this means is that a simple timestring to match year and month, %Y.%m will result in a regular expression like this: ^.\*\\d{4}\\.\\d{2}.\*$ . This pattern will match any 4 digits, followed by a period… --- ## [Simple query string, default operator and, doesn't work with nested objects](https://discuss.elastic.co/t/simple-query-string-default-operator-and-doesnt-work-with-nested-objects/240426)
**Author:** [@pilo](https://discuss.elastic.co/u/pilo)\ **Replies:** 1\ **Last updated:** [July 8, 2020, 7:48pm UTC](https://discuss.elastic.co/t/simple-query-string-default-operator-and-doesnt-work-with-nested-objects/240426 "2020-07-08T19:48:36Z")
Hello everyone, as mentioned in the title, seem like simple\_query\_string with default operator and doesn't work with nested data type. For example, i have a mapping like bellow: PUT test1 { "mappings": { "propert… --- ## [Using G1GC in ES 7.7.0](https://discuss.elastic.co/t/using-g1gc-in-es-7-7-0/239547)
**Author:** [@praveenmak](https://discuss.elastic.co/u/praveenmak)\ **Replies:** 2\ **Last updated:** [July 8, 2020, 6:52pm UTC](https://discuss.elastic.co/t/using-g1gc-in-es-7-7-0/239547 "2020-07-08T18:52:02Z")
Hello Guys, I am using ES 7.7.0 JDK is bin/java --version openjdk 14 2020-03-17 OpenJDK Runtime Environment AdoptOpenJDK (build 14+36) OpenJDK 64-Bit Server VM AdoptOpenJDK (build 14+36, mixed mode, sharing) -Xm… --- ## [Nodes frequently removed from cluster version 7.3.2](https://discuss.elastic.co/t/nodes-frequently-removed-from-cluster-version-7-3-2/237334)
**Author:** [@jleezer](https://discuss.elastic.co/u/jleezer)\ **Replies:** 2\ **Last updated:** [July 8, 2020, 6:06pm UTC](https://discuss.elastic.co/t/nodes-frequently-removed-from-cluster-version-7-3-2/237334 "2020-07-08T18:06:40Z")
This issue has been plaguing us for quite sometime and various attempts at solving it haven't produced anything. Any help is greatly appreciated. We're seeing issues where the data nodes drop from the cluster. Sometimes … --- ## [Getting Error in ingest pipeline](https://discuss.elastic.co/t/getting-error-in-ingest-pipeline/240042)
**Author:** [@anjilinga](https://discuss.elastic.co/u/anjilinga)\ **Replies:** 1\ **Last updated:** [July 8, 2020, 5:20pm UTC](https://discuss.elastic.co/t/getting-error-in-ingest-pipeline/240042 "2020-07-08T17:20:52Z")
Hi, We are using filebeat and ingest pipeline to load the csv data file. if the last value is null in any line, getting error while mapping the field headers in ingest pipeline for those lines. Sample ingest pipeline: … --- ## [Problem removing nested object using UpdateByQuery](https://discuss.elastic.co/t/problem-removing-nested-object-using-updatebyquery/240409)
**Author:** [@maynestream](https://discuss.elastic.co/u/maynestream)\ **Replies:** 0\ **Last updated:** [July 8, 2020, 5:15pm UTC](https://discuss.elastic.co/t/problem-removing-nested-object-using-updatebyquery/240409 "2020-07-08T17:15:25Z")
Hi all, Apologies if there are similar answers, I have extensively searched, but this does appear to be quite a niche problem. As the title suggests, I have a scenario where I am using UpdateByQuery (java API) using gr… --- ## [Find documents that might have unindexed fields](https://discuss.elastic.co/t/find-documents-that-might-have-unindexed-fields/239709)
**Author:** [@ddreier](https://discuss.elastic.co/u/ddreier)\ **Replies:** 3\ **Last updated:** [July 8, 2020, 4:14pm UTC](https://discuss.elastic.co/t/find-documents-that-might-have-unindexed-fields/239709 "2020-07-08T16:14:03Z")
We recently disabled dynamic field mapping on one of our logging index templates after a field explosion basically took down our cluster. Most documents (log lines) coming into the indices should only have fields that a… --- ## [Multiple ILM Policies on same index: Which one applies?](https://discuss.elastic.co/t/multiple-ilm-policies-on-same-index-which-one-applies/240269)
**Author:** [@Keff](https://discuss.elastic.co/u/Keff)\ **Replies:** 1\ **Last updated:** [July 8, 2020, 3:15pm UTC](https://discuss.elastic.co/t/multiple-ilm-policies-on-same-index-which-one-applies/240269 "2020-07-08T15:15:04Z")
If I define multiple ILM Policies on patterns that match the same index, which one applies? Does the one with the lower "min\_age" apply or the one which was created first? Or anything else? Example: If I now create the… --- ## [Transform error handling](https://discuss.elastic.co/t/transform-error-handling/240348)
**Author:** [@liorg2](https://discuss.elastic.co/u/liorg2)\ **Replies:** 3\ **Last updated:** [July 8, 2020, 2:30pm UTC](https://discuss.elastic.co/t/transform-error-handling/240348 "2020-07-08T14:30:43Z")
hi there, is there a way to configure a transform to ignore errors? it seems that if it fails, it will changed the state the failed state, and stop the processing. example: imagine I define a transform for data-. da… --- ## [Aggregation pagination and sort by document field](https://discuss.elastic.co/t/aggregation-pagination-and-sort-by-document-field/240211)
**Author:** [@nerd2000](https://discuss.elastic.co/u/nerd2000)\ **Replies:** 9\ **Last updated:** [July 8, 2020, 2:05pm UTC](https://discuss.elastic.co/t/aggregation-pagination-and-sort-by-document-field/240211 "2020-07-08T14:05:15Z")
Hi, I would like to know how to sort an aggregation result by a field in the document. My indice configuration { "id": { "type": "long" }, "film\_id": { "type": "long" }, "film\_group\_id": { "type"… --- ## [Issue with open files](https://discuss.elastic.co/t/issue-with-open-files/239300)
**Author:** [@WiseOwl](https://discuss.elastic.co/u/WiseOwl)\ **Replies:** 3\ **Last updated:** [July 8, 2020, 1:58pm UTC](https://discuss.elastic.co/t/issue-with-open-files/239300 "2020-07-08T13:58:40Z")
Hi All, I have an issue with a cluster setup. The setup has 3 nodes, all communicating via stunnel ( as per https://www.elastic.co/guide/en/cloud/current/ec-tunneling-ssl.html ). However, the link is flaky from time to… --- ## [Write one query instead of four queries](https://discuss.elastic.co/t/write-one-query-instead-of-four-queries/240342)
**Author:** [@d.silwon](https://discuss.elastic.co/u/d.silwon)\ **Replies:** 0\ **Last updated:** [July 8, 2020, 12:26pm UTC](https://discuss.elastic.co/t/write-one-query-instead-of-four-queries/240342 "2020-07-08T12:26:22Z")
Dears, I have a problem with write my proper query. I try to write one query which will do the same what other four queries which should: count docs which have codes 1?? or 2?? in ci.rc and count docs which have code… --- ## [SlowLogs entries in both SlowLogs and Default Logs](https://discuss.elastic.co/t/slowlogs-entries-in-both-slowlogs-and-default-logs/239453)
**Author:** [@ankit2.agarwal](https://discuss.elastic.co/u/ankit2.agarwal)\ **Replies:** 1\ **Last updated:** [July 8, 2020, 12:11pm UTC](https://discuss.elastic.co/t/slowlogs-entries-in-both-slowlogs-and-default-logs/239453 "2020-07-08T12:11:54Z")
Hi, I am facing issue that my default log is full of slowlog entries. All though I have slowlogs for search and indexing getting generated separately. I have enabled slowlog in log4j.properties. I have daily indexes so … --- ## [Elasticsearch High CPU on GC and strange behaviors](https://discuss.elastic.co/t/elasticsearch-high-cpu-on-gc-and-strange-behaviors/240339)
**Author:** [@zaynkorai](https://discuss.elastic.co/u/zaynkorai)\ **Replies:** 0\ **Last updated:** [July 8, 2020, 12:04pm UTC](https://discuss.elastic.co/t/elasticsearch-high-cpu-on-gc-and-strange-behaviors/240339 "2020-07-08T12:04:21Z")
Hello we have a elasticsearch(5.6) cluster and due to development overhead we can not upgrade our code for newer version of elasticsearch near soon. So there are some issues we are facing with it. Numbers one is high CP… --- ## [How to drop Document on FailureAction](https://discuss.elastic.co/t/how-to-drop-document-on-failureaction/240327)
**Author:** [@Bhaskar3184](https://discuss.elastic.co/u/Bhaskar3184)\ **Replies:** 0\ **Last updated:** [July 8, 2020, 11:06am UTC](https://discuss.elastic.co/t/how-to-drop-document-on-failureaction/240327 "2020-07-08T11:06:20Z")
Hi, I am new to ELK, and trying to send the JSON data to elasticsearch, if the JSON format is given wrongly the Es is adding a document with "-". Can you please help me in avoiding the wrong input JSON. My script: i… --- ## [Aggregation terms and @timestamp](https://discuss.elastic.co/t/aggregation-terms-and-timestamp/240319)
**Author:** [@d.silwon](https://discuss.elastic.co/u/d.silwon)\ **Replies:** 4\ **Last updated:** [July 8, 2020, 10:41am UTC](https://discuss.elastic.co/t/aggregation-terms-and-timestamp/240319 "2020-07-08T10:41:35Z")
Dears, Second my problem. Is there any way/method to filter doc by timestamp inside aggregation? or Is there any way/method to filter aggregated doc by timestamp? My aggregation looks like: GET /log-2020.07.07/\_sea… --- ## [After installing the security feature(Open distro) in elasticsearch, while starting server getting following error](https://discuss.elastic.co/t/after-installing-the-security-feature-open-distro-in-elasticsearch-while-starting-server-getting-following-error/240305)
**Author:** [@Rahul\_Chougule](https://discuss.elastic.co/u/Rahul_Chougule)\ **Replies:** 3\ **Last updated:** [July 8, 2020, 9:51am UTC](https://discuss.elastic.co/t/after-installing-the-security-feature-open-distro-in-elasticsearch-while-starting-server-getting-following-error/240305 "2020-07-08T09:51:34Z")
\[ERROR\]\[c.a.o.s.s.h.n.OpenDistroSecuritySSLNettyHttpServerTransport\] \[smoketestnode\] Exception during establishing a SSL connection: io.netty.handler.ssl.NotSslRecordException: not an SSL/TLS record: Please help..!! --- ## [How to use QueryBuilders for Multi-value field](https://discuss.elastic.co/t/how-to-use-querybuilders-for-multi-value-field/240325)
**Author:** [@PeterZhao](https://discuss.elastic.co/u/PeterZhao)\ **Replies:** 0\ **Last updated:** [July 8, 2020, 10:46am UTC](https://discuss.elastic.co/t/how-to-use-querybuilders-for-multi-value-field/240325 "2020-07-08T10:46:29Z")
I am a new comer. I have a multi-value field with definition like 'docBuilder.field(FreeTextField, List )'. How could I use QueryBuilders to search matching any of the list items? --- ## [Most stable version of ELK](https://discuss.elastic.co/t/most-stable-version-of-elk/240294)
**Author:** [@Feriel\_Mufti](https://discuss.elastic.co/u/Feriel_Mufti)\ **Replies:** 2\ **Last updated:** [July 8, 2020, 10:06am UTC](https://discuss.elastic.co/t/most-stable-version-of-elk/240294 "2020-07-08T10:06:53Z")
Hello , please i am new to ELK , and i want to know what is the latest stable version of ELK to use and what does it offer for free as advantages ( ps: i have used ELK 6.8.x and it seems an old version and it didn't offe… --- ## [Elasticsearch GC allocation failure errors in GC.log](https://discuss.elastic.co/t/elasticsearch-gc-allocation-failure-errors-in-gc-log/240186)
**Author:** [@sammi](https://discuss.elastic.co/u/sammi)\ **Replies:** 0\ **Last updated:** [July 7, 2020, 3:40pm UTC](https://discuss.elastic.co/t/elasticsearch-gc-allocation-failure-errors-in-gc-log/240186 "2020-07-07T15:40:34Z")
Hi, I have allocated 32GB for elasticsearch heap memory and keep seeing below error in gc.log. \*\*\[2020-07-07T14:44:44.064+0000\]\[1\]\[gc,start \] GC(87) Pause Young (Allocation Failure)\*\* \*\*\[2020-07-07T14:44:44.064+0000… --- ## [Transform behavior with deleted documents](https://discuss.elastic.co/t/transform-behavior-with-deleted-documents/240172)
**Author:** [@nemhods](https://discuss.elastic.co/u/nemhods)\ **Replies:** 4\ **Last updated:** [July 8, 2020, 9:15am UTC](https://discuss.elastic.co/t/transform-behavior-with-deleted-documents/240172 "2020-07-08T09:15:10Z")
Consider a source index that contains user authentications. I want to create a transform that contains, for each user, the oldest and newest login. It would look like this: Group by user Aggregate max(@timestamp) and m… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=866) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=868)