# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=869 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 870 --- ## [Fail to elect a master following a failover due to GC](https://discuss.elastic.co/t/fail-to-elect-a-master-following-a-failover-due-to-gc/240181)
**Author:** [@Alex\_Davidovich](https://discuss.elastic.co/u/Alex_Davidovich)\ **Replies:** 1\ **Last updated:** [July 7, 2020, 3:05pm UTC](https://discuss.elastic.co/t/fail-to-elect-a-master-following-a-failover-due-to-gc/240181 "2020-07-07T15:05:27Z")
We are using elastic 7.2.1 We have a 3 nodes cluster with all nodes being master eligible. Our configuration is: transport.connect\_timeout: 1s cluster.publish.timeout: 15s cluster.fault\_detection.leader\_check.timeout:… --- ## [Shard reallocation and disk space](https://discuss.elastic.co/t/shard-reallocation-and-disk-space/240174)
**Author:** [@kernelpanic](https://discuss.elastic.co/u/kernelpanic)\ **Replies:** 4\ **Last updated:** [July 7, 2020, 2:25pm UTC](https://discuss.elastic.co/t/shard-reallocation-and-disk-space/240174 "2020-07-07T14:25:19Z")
Hello, I'm using ElasticStack 7.6.1 on CentOS 8. I recently upgraded the kernels on all three of our nodes so I then rebooted them all; after they were rebooted the cluster decided to reallocate some shards but for some… --- ## [Memory Utilization in ELK](https://discuss.elastic.co/t/memory-utilization-in-elk/240169)
**Author:** [@rohitarorait82](https://discuss.elastic.co/u/rohitarorait82)\ **Replies:** 1\ **Last updated:** [July 7, 2020, 2:09pm UTC](https://discuss.elastic.co/t/memory-utilization-in-elk/240169 "2020-07-07T14:09:36Z")
Hi All, Memory utilization on my all the data\_nodes is reaching around 70-80 percent. Can someone suggest, how to reduce it. As we are afraid that after adding all the instances it might reach even 100%. Thanks for you… --- ## [BulkProcessor.awaitClose() is returning false and documents are getting indexed](https://discuss.elastic.co/t/bulkprocessor-awaitclose-is-returning-false-and-documents-are-getting-indexed/240176)
**Author:** [@Sanyukta\_Sinha](https://discuss.elastic.co/u/Sanyukta_Sinha)\ **Replies:** 0\ **Last updated:** [July 7, 2020, 2:00pm UTC](https://discuss.elastic.co/t/bulkprocessor-awaitclose-is-returning-false-and-documents-are-getting-indexed/240176 "2020-07-07T14:00:48Z")
I am using bulkProcessor to index multiple UpdateRequests. The awaitClose() is returning false and hence the logs of the listener are not printing. The documents are still getting indexed but in the absence of the BulkRe… --- ## [IP2Proxy - Pipeline](https://discuss.elastic.co/t/ip2proxy-pipeline/239901)
**Author:** [@pablo1816](https://discuss.elastic.co/u/pablo1816)\ **Replies:** 2\ **Last updated:** [July 7, 2020, 1:56pm UTC](https://discuss.elastic.co/t/ip2proxy-pipeline/239901 "2020-07-07T13:56:16Z")
I am using Elasticsearch and Kibana, entering data with filebeats direct to Elastic parsing the information with apache2 pipeline and they work perfectly but for the analysis that I should do I would like to change or ad… --- ## [Divide Should query into two parts and combine them with and logic](https://discuss.elastic.co/t/divide-should-query-into-two-parts-and-combine-them-with-and-logic/240120)
**Author:** [@buka\_bidzina](https://discuss.elastic.co/u/buka_bidzina)\ **Replies:** 12\ **Last updated:** [July 7, 2020, 1:03pm UTC](https://discuss.elastic.co/t/divide-should-query-into-two-parts-and-combine-them-with-and-logic/240120 "2020-07-07T13:03:44Z")
GET INDEX/\_search { "query": { "bool": { "must": \[ { "nested": { "path": "categories", "query": { "terms": { "categories.id": \[ … --- ## [Query range problem](https://discuss.elastic.co/t/query-range-problem/240150)
**Author:** [@d.silwon](https://discuss.elastic.co/u/d.silwon)\ **Replies:** 2\ **Last updated:** [July 7, 2020, 12:51pm UTC](https://discuss.elastic.co/t/query-range-problem/240150 "2020-07-07T12:51:39Z")
Dears, How to modify such query to add additional condition to first range "0nn"? I need to find only such documents which meet such conditions: ci.a": { "gte": 0,"lte": 99} and ci.b like "(??1?) or (??3?) or (??5?) o… --- ## [URL ingest processor](https://discuss.elastic.co/t/url-ingest-processor/239616)
**Author:** [@bernhard.fluehmann](https://discuss.elastic.co/u/bernhard.fluehmann)\ **Replies:** 2\ **Last updated:** [July 7, 2020, 12:25pm UTC](https://discuss.elastic.co/t/url-ingest-processor/239616 "2020-07-07T12:25:06Z")
It would be helpful to have an ingest pipeline processor which parses a url to the corresponding ecs fields. It can be done with GROK, but would be much more convenient and error save to have it as an official processor. … --- ## [How to make elastic search ignore delimiter](https://discuss.elastic.co/t/how-to-make-elastic-search-ignore-delimiter/240037)
**Author:** [@ermagherd](https://discuss.elastic.co/u/ermagherd)\ **Replies:** 1\ **Last updated:** [July 7, 2020, 12:19pm UTC](https://discuss.elastic.co/t/how-to-make-elastic-search-ignore-delimiter/240037 "2020-07-07T12:19:33Z")
Hi all, ES Noob posting his first question here. I've ingested some text documents into ES using FS Crawler. When I try to run a match query in elastic search for a piece of text like "aaa-bbb", I notice that elastic se… --- ## [Unable to connect to Elasticsearch server 6.2.2 from spring application](https://discuss.elastic.co/t/unable-to-connect-to-elasticsearch-server-6-2-2-from-spring-application/240055)
**Author:** [@alexc1](https://discuss.elastic.co/u/alexc1)\ **Replies:** 1\ **Last updated:** [July 7, 2020, 12:07pm UTC](https://discuss.elastic.co/t/unable-to-connect-to-elasticsearch-server-6-2-2-from-spring-application/240055 "2020-07-07T12:07:12Z")
Hello everyone, I am struggling to connect my webapp based on Spring Framework 4.3.13 (not a springboot app) to an Elasticsearch server 6.2.2. I've googling al lot but with no result unfortunally. Here the code I'm ex… --- ## [Elastic search errors after OutOfMemoryError](https://discuss.elastic.co/t/elastic-search-errors-after-outofmemoryerror/240142)
**Author:** [@cm-vdp](https://discuss.elastic.co/u/cm-vdp)\ **Replies:** 3\ **Last updated:** [July 7, 2020, 11:48am UTC](https://discuss.elastic.co/t/elastic-search-errors-after-outofmemoryerror/240142 "2020-07-07T11:48:17Z")
I restarted the elasticsearch service after I saw OutOfMemoryError - errors. But in the logging I see these errors: \[2020-07-07T09:43:52,654\]\[ERROR\]\[o.e.x.m.c.i.IndexStatsCollector\] \[mPGPZUq\] collector \[index-stats\] fa… --- ## [Performance tuning for aggregators](https://discuss.elastic.co/t/performance-tuning-for-aggregators/240050)
**Author:** [@pratikgcet](https://discuss.elastic.co/u/pratikgcet)\ **Replies:** 0\ **Last updated:** [July 6, 2020, 6:21pm UTC](https://discuss.elastic.co/t/performance-tuning-for-aggregators/240050 "2020-07-06T18:21:37Z")
Hello, I have a below query which is doing mulitple aggregations and then returning the data. I am doing a filter on date greater than 7am this morning. The elasticsearch has got millions of rows and I expected the belo… --- ## [The difference between using script in pipeline and using normal script to update document](https://discuss.elastic.co/t/the-difference-between-using-script-in-pipeline-and-using-normal-script-to-update-document/239951)
**Author:** [@FFFro](https://discuss.elastic.co/u/FFFro)\ **Replies:** 2\ **Last updated:** [July 7, 2020, 9:30am UTC](https://discuss.elastic.co/t/the-difference-between-using-script-in-pipeline-and-using-normal-script-to-update-document/239951 "2020-07-07T09:30:46Z")
Now I'd like to update documents with parent-child relationships. When I use script to update, prompt me "field"\[\_ routing\] is a metadata field and cannot be added inside a document. Use the index API request parameters.… --- ## [Elasticsearch simple scripted similarity performance issues](https://discuss.elastic.co/t/elasticsearch-simple-scripted-similarity-performance-issues/240134)
**Author:** [@kamils468](https://discuss.elastic.co/u/kamils468)\ **Replies:** 0\ **Last updated:** [July 7, 2020, 9:30am UTC](https://discuss.elastic.co/t/elasticsearch-simple-scripted-similarity-performance-issues/240134 "2020-07-07T09:30:39Z")
I have created simple similarity which all it does is returning doc.freq . { "similarity": { "custom\_similarity\_score": { "type": "scripted", "script": { "source": "return doc.freq;" } … --- ## [Huge delay in logs to ES from Kafka/Logstash](https://discuss.elastic.co/t/huge-delay-in-logs-to-es-from-kafka-logstash/239948)
**Author:** [@biswajit\_list](https://discuss.elastic.co/u/biswajit_list)\ **Replies:** 4\ **Last updated:** [July 7, 2020, 9:26am UTC](https://discuss.elastic.co/t/huge-delay-in-logs-to-es-from-kafka-logstash/239948 "2020-07-07T09:26:12Z")
New for ELK Have 2 Kafka , 2 Logstash , 3 master ES and 2 Data nodes my logstash config is input { kafka { bootstrap\_servers =\> "kafka01:9092, kafka02:9092" topics =\> \["filebeat"\] codec =\> json heartbeat\_interval… --- ## [Cross field search with different analyzers](https://discuss.elastic.co/t/cross-field-search-with-different-analyzers/239765)
**Author:** [@rathcke](https://discuss.elastic.co/u/rathcke)\ **Replies:** 1\ **Last updated:** [July 7, 2020, 9:04am UTC](https://discuss.elastic.co/t/cross-field-search-with-different-analyzers/239765 "2020-07-07T09:04:12Z")
I have the following (simplified) mapping: { "settings": { "index": { "number\_of\_shards": "2", "number\_of\_replicas": "1" }, "analysis": { "analyzer": { "rebuilt\_whitespace… --- ## [Nodes don't connect until keyboard interrupt is sent](https://discuss.elastic.co/t/nodes-dont-connect-until-keyboard-interrupt-is-sent/240125)
**Author:** [@defalt](https://discuss.elastic.co/u/defalt)\ **Replies:** 0\ **Last updated:** [July 7, 2020, 9:02am UTC](https://discuss.elastic.co/t/nodes-dont-connect-until-keyboard-interrupt-is-sent/240125 "2020-07-07T09:02:21Z")
Hi, I have a cluster of 3 nodes. I had the problem that I turned off one node and when I turned in back on it didn't connect until I sent a keyboard interrupt (CTRL+C) in the terminal on a second node. After that they s… --- ## [How to return highlight as an html instead of string?](https://discuss.elastic.co/t/how-to-return-highlight-as-an-html-instead-of-string/239892)
**Author:** [@NikolaP93](https://discuss.elastic.co/u/NikolaP93)\ **Replies:** 1\ **Last updated:** [July 7, 2020, 8:32am UTC](https://discuss.elastic.co/t/how-to-return-highlight-as-an-html-instead-of-string/239892 "2020-07-07T08:32:14Z")
So I have a problem , I created a custom highlight like so: customHighlight={() =\> ({ highlight: { pre\_tags: \['\'\], … --- ## [Elastic Node - Failed to execute watch](https://discuss.elastic.co/t/elastic-node-failed-to-execute-watch/239520)
**Author:** [@Kevin\_f](https://discuss.elastic.co/u/Kevin_f)\ **Replies:** 4\ **Last updated:** [July 7, 2020, 7:58am UTC](https://discuss.elastic.co/t/elastic-node-failed-to-execute-watch/239520 "2020-07-07T07:58:16Z")
Hello, I am hoping that someone in the ElasticSearch Forum would kindly help me with an issue I am facing. I am seeing this in my elasticsearch log: Had a read through and doing some research, can't seem to get the r… --- ## [Snapshot failure missing file](https://discuss.elastic.co/t/snapshot-failure-missing-file/240097)
**Author:** [@michaelv](https://discuss.elastic.co/u/michaelv)\ **Replies:** 2\ **Last updated:** [July 7, 2020, 7:57am UTC](https://discuss.elastic.co/t/snapshot-failure-missing-file/240097 "2020-07-07T07:57:32Z")
Hi All, This is running ELK 7.7.8 on Ubuntu 18.04.4 LTS I had created a NFS mount on my 3 old node cluster and new 3 node cluster I did manage to make a snapshot from old and restore to new cluster. However, I decide… --- ## [Elasticsearch v2.2 Java version](https://discuss.elastic.co/t/elasticsearch-v2-2-java-version/239990)
**Author:** [@rschirin](https://discuss.elastic.co/u/rschirin)\ **Replies:** 5\ **Last updated:** [July 7, 2020, 7:51am UTC](https://discuss.elastic.co/t/elasticsearch-v2-2-java-version/239990 "2020-07-07T07:51:22Z")
Hi everybody, I know that Elasticsearch v.2.2 is out of support, it is dead and so on but I was using for a small project. I have a plan to create it from scratch with a new version while for the moment I would like to … --- ## [Does elastic search allow aggregations within a document? Or is there another way to do same](https://discuss.elastic.co/t/does-elastic-search-allow-aggregations-within-a-document-or-is-there-another-way-to-do-same/239637)
**Author:** [@charvi23](https://discuss.elastic.co/u/charvi23)\ **Replies:** 6\ **Last updated:** [July 7, 2020, 7:46am UTC](https://discuss.elastic.co/t/does-elastic-search-allow-aggregations-within-a-document-or-is-there-another-way-to-do-same/239637 "2020-07-07T07:46:58Z")
I am new to elastic search, I have a elastic search index example as follows: Category is my index and insight is field having array of elements. "category": { "insight": { \[ { "topic":"xyz", "id":"10" } , { "… --- ## [How to migrate from multi node cluster to singe node cluster](https://discuss.elastic.co/t/how-to-migrate-from-multi-node-cluster-to-singe-node-cluster/240104)
**Author:** [@klokkie](https://discuss.elastic.co/u/klokkie)\ **Replies:** 4\ **Last updated:** [July 7, 2020, 7:43am UTC](https://discuss.elastic.co/t/how-to-migrate-from-multi-node-cluster-to-singe-node-cluster/240104 "2020-07-07T07:43:16Z")
Hi Is there some sort of work instruction how to migrate from a 5 node cluster (all data nodes) with 3 eligable masters to a single node cluster? Regards, Tim --- ## [I am curious when sending data from logstash to elasticsearch](https://discuss.elastic.co/t/i-am-curious-when-sending-data-from-logstash-to-elasticsearch/240073)
**Author:** [@111349](https://discuss.elastic.co/u/111349)\ **Replies:** 7\ **Last updated:** [July 7, 2020, 7:40am UTC](https://discuss.elastic.co/t/i-am-curious-when-sending-data-from-logstash-to-elasticsearch/240073 "2020-07-07T07:40:07Z")
I pass custom logs to elastocsearch using logstash For example, the string "A+B=AB" contains the field name in "fields1". If I search for "A+B=AB" literally, other fields containing A,B,AB are partially searched. This … --- ## [DHCP audit using ELK stack](https://discuss.elastic.co/t/dhcp-audit-using-elk-stack/239962)
**Author:** [@zkhanfur](https://discuss.elastic.co/u/zkhanfur)\ **Replies:** 3\ **Last updated:** [July 7, 2020, 7:35am UTC](https://discuss.elastic.co/t/dhcp-audit-using-elk-stack/239962 "2020-07-07T07:35:37Z")
We were interested in monitoring DHCP leases in our environment using ELK stack. As we do currently not have Beats, we are forced to use Windows logs and either forward these or copy these. We found a very good blog desc… --- ## [Searching on " for inches](https://discuss.elastic.co/t/searching-on-for-inches/240100)
**Author:** [@DaveG](https://discuss.elastic.co/u/DaveG)\ **Replies:** 0\ **Last updated:** [July 7, 2020, 6:49am UTC](https://discuss.elastic.co/t/searching-on-for-inches/240100 "2020-07-07T06:49:24Z")
Hi All, I wish to be able to search on: 10 " 10 inches etc where " is a synonym for inches. I saw post : Synonym analyzer issue in elastic search but no reply. I do not know what a good strategy for this is given … --- ## [Searching text with reserved characters with fuzzy](https://discuss.elastic.co/t/searching-text-with-reserved-characters-with-fuzzy/240099)
**Author:** [@DaveG](https://discuss.elastic.co/u/DaveG)\ **Replies:** 0\ **Last updated:** [July 7, 2020, 6:39am UTC](https://discuss.elastic.co/t/searching-text-with-reserved-characters-with-fuzzy/240099 "2020-07-07T06:39:34Z")
Hi All, I have queries where I want to allow searching on part numbers/help ticket numbers and the like with reserved characters in them. For example: SR-1234 SR/1234 The fields are analyzed with the standard analyz… --- ## [Node failed to join](https://discuss.elastic.co/t/node-failed-to-join/239515)
**Author:** [@aakashR](https://discuss.elastic.co/u/aakashR)\ **Replies:** 1\ **Last updated:** [July 7, 2020, 5:59am UTC](https://discuss.elastic.co/t/node-failed-to-join/239515 "2020-07-07T05:59:26Z")
Hi I am relatively new to elasticsearch. I installed elasticsearch oss 7.7.0 a couple of days ago on two Ubuntu 18.04.3. I want to form a test cluster with 2 nodes - one master and ingest and the other only data. I conf… --- ## [Unable to install Elastic Search on Windows](https://discuss.elastic.co/t/unable-to-install-elastic-search-on-windows/240091)
**Author:** [@Ram\_Vashista](https://discuss.elastic.co/u/Ram_Vashista)\ **Replies:** 1\ **Last updated:** [July 7, 2020, 5:42am UTC](https://discuss.elastic.co/t/unable-to-install-elastic-search-on-windows/240091 "2020-07-07T05:42:05Z")
Hi there, I am in the need to create elastic search server to save my UiPath robots logs. I followed below installation guide from UiPath https://docs.uipath.com/orchestrator/v2018.2/docs/prerequisites-for-installation#… --- ## [Network traffic between Elastic Cloud and my infrastructure](https://discuss.elastic.co/t/network-traffic-between-elastic-cloud-and-my-infrastructure/236319)
**Author:** [@bg\_aad](https://discuss.elastic.co/u/bg_aad)\ **Replies:** 1\ **Last updated:** [July 7, 2020, 1:30am UTC](https://discuss.elastic.co/t/network-traffic-between-elastic-cloud-and-my-infrastructure/236319 "2020-07-07T01:30:32Z")
Good morning, I would like to know if the network traffic generate sending logs between my infrastructure in GCP and Elastic Cloud it will be internal (VPC Peering) or external (Internet). In my case, this will mean a… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=868) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=870)