# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=876 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 877 --- ## [Watcher sometimes input-search hits.total return 0](https://discuss.elastic.co/t/watcher-sometimes-input-search-hits-total-return-0/236677)
**Author:** [@fenggao11](https://discuss.elastic.co/u/fenggao11)\ **Replies:** 1\ **Last updated:** [June 30, 2020, 8:10am UTC](https://discuss.elastic.co/t/watcher-sometimes-input-search-hits-total-return-0/236677 "2020-06-30T08:10:01Z")
my watcher json { "trigger": { "schedule": { "interval": "30m" } }, "input": { "search": { "request": { "search\_type": "query\_t… --- ## [Watcher only fires with single character matching](https://discuss.elastic.co/t/watcher-only-fires-with-single-character-matching/236660)
**Author:** [@medal](https://discuss.elastic.co/u/medal)\ **Replies:** 1\ **Last updated:** [June 30, 2020, 8:08am UTC](https://discuss.elastic.co/t/watcher-only-fires-with-single-character-matching/236660 "2020-06-30T08:08:55Z")
Hello, I am currently creating a watcher, which should trigger everytime a specific action (Azure NSG change) is detected within the logs. My watcher is never fired if I try to use the value provided by Azure to detect… --- ## [Two different email IDs with two different BODY in a single watcher code](https://discuss.elastic.co/t/two-different-email-ids-with-two-different-body-in-a-single-watcher-code/236286)
**Author:** [@sai\_krishna\_bsk](https://discuss.elastic.co/u/sai_krishna_bsk)\ **Replies:** 1\ **Last updated:** [June 30, 2020, 8:05am UTC](https://discuss.elastic.co/t/two-different-email-ids-with-two-different-body-in-a-single-watcher-code/236286 "2020-06-30T08:05:32Z")
Hi All, I want to send alert to two different email ids with two different text as a BODY from a single watcher code. so basically email id one will receive full customer details and email id two will get only limited i… --- ## [I have issues with "ctx.payload.hits.total": null](https://discuss.elastic.co/t/i-have-issues-with-ctx-payload-hits-total-null/236118)
**Author:** [@gelvismo](https://discuss.elastic.co/u/gelvismo)\ **Replies:** 1\ **Last updated:** [June 30, 2020, 8:02am UTC](https://discuss.elastic.co/t/i-have-issues-with-ctx-payload-hits-total-null/236118 "2020-06-30T08:02:04Z")
"My Watcher results is the next, i dont know what does it mean." "condition": { "type": "compare", "status": "success", "met": false, "compare": { "resolved\_values": { "ctx.payload.hits.total": null } } }, "ac… --- ## [Watcher basics Looping into the bucket and processing its values](https://discuss.elastic.co/t/watcher-basics-looping-into-the-bucket-and-processing-its-values/235849)
**Author:** [@Rolf\_Nufable](https://discuss.elastic.co/u/Rolf_Nufable)\ **Replies:** 1\ **Last updated:** [June 30, 2020, 7:56am UTC](https://discuss.elastic.co/t/watcher-basics-looping-into-the-bucket-and-processing-its-values/235849 "2020-06-30T07:56:46Z")
Hi All, I'm fairly new to watchers (just started to learn about it yesterday, and I'm quite in a problem here wherein I want to know if the value of the doc\_count is greater than 10 ( for example ) and would hopefully a… --- ## [Query about cluster metadata file - global.sts](https://discuss.elastic.co/t/query-about-cluster-metadata-file-global-sts/239128)
**Author:** [@chaitra\_hegde](https://discuss.elastic.co/u/chaitra_hegde)\ **Replies:** 3\ **Last updated:** [June 30, 2020, 7:36am UTC](https://discuss.elastic.co/t/query-about-cluster-metadata-file-global-sts/239128 "2020-06-30T07:36:04Z")
Hi, I have an Elasticsearch cluster with version 6.6.1. I have 14 data nodes, 3 master nodes, 3 client nodes. When I check in the above elasticsearch nodes under data/nodes/0/\_state folder I can see different version o… --- ## [Create users in kibana basic license](https://discuss.elastic.co/t/create-users-in-kibana-basic-license/239240)
**Author:** [@igarci](https://discuss.elastic.co/u/igarci)\ **Replies:** 0\ **Last updated:** [June 30, 2020, 7:32am UTC](https://discuss.elastic.co/t/create-users-in-kibana-basic-license/239240 "2020-06-30T07:32:45Z")
Hi everyone I would like to create different users in kibana 7.1. With different permissions in the basic license, I have read the documentation to do it, but could not understand how to do it step by step, there is a l… --- ## [Cannot set up script\_score for dense\_vector using Java REST API](https://discuss.elastic.co/t/cannot-set-up-script-score-for-dense-vector-using-java-rest-api/238849)
**Author:** [@ivanqwam](https://discuss.elastic.co/u/ivanqwam)\ **Replies:** 2\ **Last updated:** [June 29, 2020, 4:34pm UTC](https://discuss.elastic.co/t/cannot-set-up-script-score-for-dense-vector-using-java-rest-api/238849 "2020-06-29T16:34:25Z")
I want to search similar sentences using dense vectors calculated by BERT. I am following this great paper in french or english I indexed sentences with each having a dense\_vector calculated by BERT. I ran this query … --- ## [ILM alias does not point to index](https://discuss.elastic.co/t/ilm-alias-does-not-point-to-index/238567)
**Author:** [@craigothy](https://discuss.elastic.co/u/craigothy)\ **Replies:** 1\ **Last updated:** [June 30, 2020, 12:55am UTC](https://discuss.elastic.co/t/ilm-alias-does-not-point-to-index/238567 "2020-06-30T00:55:35Z")
Can someone explain why I am getting the following error regarding the default builtin ILM policy. I've seen this for different beats (winlogbeat,packetbeat,filebeat). They all go into an "error" state. I've basically ju… --- ## [How to implement handlers to render my own data with Search UI](https://discuss.elastic.co/t/how-to-implement-handlers-to-render-my-own-data-with-search-ui/239204)
**Author:** [@spadel](https://discuss.elastic.co/u/spadel)\ **Replies:** 0\ **Last updated:** [June 30, 2020, 12:14am UTC](https://discuss.elastic.co/t/how-to-implement-handlers-to-render-my-own-data-with-search-ui/239204 "2020-06-30T00:14:15Z")
I worked through the Elastic Search UI on github and finally found what I need, to render my own data: It seems like I can implement a handler, that takes the search query, so that I can send it to my API and render m… --- ## [Update 2 million record with a correct format of country prefix in phone number field](https://discuss.elastic.co/t/update-2-million-record-with-a-correct-format-of-country-prefix-in-phone-number-field/239152)
**Author:** [@meena](https://discuss.elastic.co/u/meena)\ **Replies:** 2\ **Last updated:** [June 29, 2020, 9:19pm UTC](https://discuss.elastic.co/t/update-2-million-record-with-a-correct-format-of-country-prefix-in-phone-number-field/239152 "2020-06-29T21:19:12Z")
Hi, Am not an Expert on elastic search but would like to update around 2 million records in my database with a country prefix to be added to the phone number field in correct format. My phone number field lies under ne… --- ## [How can I do a “match\_phrase” that ranks solely on “does the phrase exists”?](https://discuss.elastic.co/t/how-can-i-do-a-match-phrase-that-ranks-solely-on-does-the-phrase-exists/238976)
**Author:** [@chrislentz](https://discuss.elastic.co/u/chrislentz)\ **Replies:** 1\ **Last updated:** [June 29, 2020, 8:57pm UTC](https://discuss.elastic.co/t/how-can-i-do-a-match-phrase-that-ranks-solely-on-does-the-phrase-exists/238976 "2020-06-29T20:57:35Z")
Is there a way to make “match\_phrase” only look for a match, but not take other things into account, like the match in relation to other terms in the text field? i.e. If I search "star wars", "Star Wars: Revelations" re… --- ## [Transform kills the whole cluster](https://discuss.elastic.co/t/transform-kills-the-whole-cluster/237294)
**Author:** [@liorg2](https://discuss.elastic.co/u/liorg2)\ **Replies:** 3\ **Last updated:** [June 29, 2020, 8:25pm UTC](https://discuss.elastic.co/t/transform-kills-the-whole-cluster/237294 "2020-06-29T20:25:12Z")
Hi I'm using elastic cloud (cloud.elastic.co) I'm not sure if that's the correct category, but I want to run a transform for the past 6 month, and it's killing the cpu. the whole cluster becomes unresponsive (queries, k… --- ## [Error client.addTransportAddress(new TransportAddress(InetAddress.getByName("localhost"), 9300));](https://discuss.elastic.co/t/error-client-addtransportaddress-new-transportaddress-inetaddress-getbyname-localhost-9300/239098)
**Author:** [@Najib\_Ghlissi](https://discuss.elastic.co/u/Najib_Ghlissi)\ **Replies:** 1\ **Last updated:** [June 29, 2020, 7:52pm UTC](https://discuss.elastic.co/t/error-client-addtransportaddress-new-transportaddress-inetaddress-getbyname-localhost-9300/239098 "2020-06-29T19:52:24Z")
hi All developers i have i error in my projetct Exception in thread "main" NoNodeAvailableException\[None of the configured nodes are available: \[{#transport#-1}{zSavWRA4QBGzdYdox-h2Aw}{localhost}{127.0.0.1:9300}\]\] att … --- ## [Transforms cannot group by boolean](https://discuss.elastic.co/t/transforms-cannot-group-by-boolean/238752)
**Author:** [@Xavier\_Marti\_Bofill](https://discuss.elastic.co/u/Xavier_Marti_Bofill)\ **Replies:** 1\ **Last updated:** [June 29, 2020, 7:46pm UTC](https://discuss.elastic.co/t/transforms-cannot-group-by-boolean/238752 "2020-06-29T19:46:28Z")
When I try to add a boolean field into the group\_by list of a transform, preview returns me an error: "type" : "illegal\_argument\_exception", "reason" : "Value of type \[class java.lang.Boolean\] is not supported" Am I u… --- ## [Weird field names with Transforms](https://discuss.elastic.co/t/weird-field-names-with-transforms/238597)
**Author:** [@mykael](https://discuss.elastic.co/u/mykael)\ **Replies:** 3\ **Last updated:** [June 29, 2020, 7:34pm UTC](https://discuss.elastic.co/t/weird-field-names-with-transforms/238597 "2020-06-29T19:34:07Z")
I used a text field to group my data - STATE, although the input to the grouping was STATE.keyword. Then I defined a second level transfrom that took my hourly data and rolled it up to daily data, also grouping it by st… --- ## [Ask for advice on elastic search client](https://discuss.elastic.co/t/ask-for-advice-on-elastic-search-client/239178)
**Author:** [@kendraschwartz](https://discuss.elastic.co/u/kendraschwartz)\ **Replies:** 0\ **Last updated:** [June 29, 2020, 7:33pm UTC](https://discuss.elastic.co/t/ask-for-advice-on-elastic-search-client/239178 "2020-06-29T19:33:19Z")
Hello, I want to be able to pass in "server\_hostname" to the elastic search python client. Because I would like to give an IP address and still have the SSL work. Do you have any suggestions? --- ## [Continuous Transform Timestamp isn't a timestamp](https://discuss.elastic.co/t/continuous-transform-timestamp-isnt-a-timestamp/238594)
**Author:** [@mykael](https://discuss.elastic.co/u/mykael)\ **Replies:** 3\ **Last updated:** [June 29, 2020, 7:10pm UTC](https://discuss.elastic.co/t/continuous-transform-timestamp-isnt-a-timestamp/238594 "2020-06-29T19:10:00Z")
Set up a continuous transform, grouping by a time historgram driven from the @timestamp field. The transform contains an @timestamp value, but it's classified as a number rather than as a date (according to Kibana when … --- ## [Segments with 60-70% deleted docs (5G) never remove deleted docs](https://discuss.elastic.co/t/segments-with-60-70-deleted-docs-5g-never-remove-deleted-docs/238342)
**Author:** [@zenloop](https://discuss.elastic.co/u/zenloop)\ **Replies:** 2\ **Last updated:** [June 29, 2020, 6:39pm UTC](https://discuss.elastic.co/t/segments-with-60-70-deleted-docs-5g-never-remove-deleted-docs/238342 "2020-06-29T18:39:36Z")
Will a 5g segment ever be selected for merging? We have 5g segments with up to 60-70% deleted docs. We have been monitoring and the segments never appear to be selected for merge. --- ## [Different fields in different documents](https://discuss.elastic.co/t/different-fields-in-different-documents/238139)
**Author:** [@Anton91](https://discuss.elastic.co/u/Anton91)\ **Replies:** 3\ **Last updated:** [June 23, 2020, 7:05pm UTC](https://discuss.elastic.co/t/different-fields-in-different-documents/238139 "2020-06-23T19:05:37Z")
Hey, I have the following question and I want to visualize two fields with each other that are not connected to each other. Both are stored in different documents but in the same index. For example I have document A:… --- ## [I have deleted Elastic searcg logs files and now logs are not coming up](https://discuss.elastic.co/t/i-have-deleted-elastic-searcg-logs-files-and-now-logs-are-not-coming-up/239148)
**Author:** [@Ali\_Nouman](https://discuss.elastic.co/u/Ali_Nouman)\ **Replies:** 1\ **Last updated:** [June 29, 2020, 4:46pm UTC](https://discuss.elastic.co/t/i-have-deleted-elastic-searcg-logs-files-and-now-logs-are-not-coming-up/239148 "2020-06-29T16:46:20Z")
Hi Guys, Using ubutnu 16.04,elastic search 6 and inside the /var/log/elasticsearch, I have run sudo rm \* to clean all the old log files. it's not writing new logs file anymore. It will be great if somebody can give me i… --- ## [Elasticsearch has deleted all my visualizations and indexes](https://discuss.elastic.co/t/elasticsearch-has-deleted-all-my-visualizations-and-indexes/239157)
**Author:** [@Anton91](https://discuss.elastic.co/u/Anton91)\ **Replies:** 1\ **Last updated:** [June 29, 2020, 4:41pm UTC](https://discuss.elastic.co/t/elasticsearch-has-deleted-all-my-visualizations-and-indexes/239157 "2020-06-29T16:41:36Z")
Hello, today I wanted to continue working on my visualizations and already at the registration I was shown That I cannot select a Space. Then I restarted my machine and thought nothing else. Afterwards I could log in ag… --- ## [Requirements](https://discuss.elastic.co/t/requirements/235550)
**Author:** [@\_mslo](https://discuss.elastic.co/u/_mslo)\ **Replies:** 3\ **Last updated:** [June 29, 2020, 4:20pm UTC](https://discuss.elastic.co/t/requirements/235550 "2020-06-29T16:20:20Z")
Hi All, I often see questions regarding hardware requirements and I can't find the official Elastic requirements. For instance I cant calculate budget after tests on production. I need to know how many resources I need… --- ## [Using a custom ingest pipeline with a module](https://discuss.elastic.co/t/using-a-custom-ingest-pipeline-with-a-module/239143)
**Author:** [@jamiejackson](https://discuss.elastic.co/u/jamiejackson)\ **Replies:** 0\ **Last updated:** [June 29, 2020, 3:30pm UTC](https://discuss.elastic.co/t/using-a-custom-ingest-pipeline-with-a-module/239143 "2020-06-29T15:30:45Z")
Picking back up on a topic that I shelved a while back: https://discuss.elastic.co/t/apache-httpd-logs-with-comma-delimited-x-forwarded-for-ips/181917 @jsoriano had been helping me and suggested that I try the following… --- ## [\[HELP\]\[ERROR\]\[FILEBEAT\] “cannot retrieve the elasticsearch license from the /\_license endpoint”](https://discuss.elastic.co/t/help-error-filebeat-cannot-retrieve-the-elasticsearch-license-from-the-license-endpoint/239123)
**Author:** [@Vikas\_Rathore](https://discuss.elastic.co/u/Vikas_Rathore)\ **Replies:** 3\ **Last updated:** [June 29, 2020, 3:30pm UTC](https://discuss.elastic.co/t/help-error-filebeat-cannot-retrieve-the-elasticsearch-license-from-the-license-endpoint/239123 "2020-06-29T15:30:05Z")
I had below filebeat-kubernetes.yaml for my ELK where I was using filebeat v 6.6.2 and AWS Elasticsearch version 6.4. Everything was working fine. --- apiVersion: v1 kind: ConfigMap metadata: name: filebeat-config n… --- ## [How to get client compatibility right with different major elasticsearch versions?](https://discuss.elastic.co/t/how-to-get-client-compatibility-right-with-different-major-elasticsearch-versions/239113)
**Author:** [@CoaxVex](https://discuss.elastic.co/u/CoaxVex)\ **Replies:** 1\ **Last updated:** [June 29, 2020, 3:03pm UTC](https://discuss.elastic.co/t/how-to-get-client-compatibility-right-with-different-major-elasticsearch-versions/239113 "2020-06-29T15:03:25Z")
Client libraries are meant to be used against the same major version of the server they are using, but how do you deal with upgrades to a new major version? You can usually load both the old and the new version of the s… --- ## [Will the elasticsearch client work in a ARM64 platform like coral devboard?](https://discuss.elastic.co/t/will-the-elasticsearch-client-work-in-a-arm64-platform-like-coral-devboard/239134)
**Author:** [@Rosho](https://discuss.elastic.co/u/Rosho)\ **Replies:** 0\ **Last updated:** [June 29, 2020, 3:00pm UTC](https://discuss.elastic.co/t/will-the-elasticsearch-client-work-in-a-arm64-platform-like-coral-devboard/239134 "2020-06-29T15:00:26Z")
Hi I am using the Coral devboard (a ARM64 platform). My project consists of taking a photo and doing inference (AI, image classification) with the devboard. Then I want to send the results directly to Elasticsearch. C… --- ## [How to create intentionally slow query?](https://discuss.elastic.co/t/how-to-create-intentionally-slow-query/239132)
**Author:** [@trex](https://discuss.elastic.co/u/trex)\ **Replies:** 0\ **Last updated:** [June 29, 2020, 2:56pm UTC](https://discuss.elastic.co/t/how-to-create-intentionally-slow-query/239132 "2020-06-29T14:56:25Z")
I want to test things with a slow query. How can I create a slow query? I thought it can be done via script GET \_search { "script\_fields": { "AvgTicketPrice": { "script": "sleep(3000);" } } } But it … --- ## [Does aggregations runs in parallel?](https://discuss.elastic.co/t/does-aggregations-runs-in-parallel/237189)
**Author:** [@jessepeixoto](https://discuss.elastic.co/u/jessepeixoto)\ **Replies:** 3\ **Last updated:** [June 29, 2020, 2:48pm UTC](https://discuss.elastic.co/t/does-aggregations-runs-in-parallel/237189 "2020-06-29T14:48:21Z")
Hi everyone, I have one query \_search with four separated nested terms aggregation and filters in the aggregations, this query is retrieving data in about 2 seconds when a specific term is searched. I splitted the four… --- ## [Watcher issues using ranger query for @timestamp with slow processing speed](https://discuss.elastic.co/t/watcher-issues-using-ranger-query-for-timestamp-with-slow-processing-speed/238425)
**Author:** [@Jasonespo](https://discuss.elastic.co/u/Jasonespo)\ **Replies:** 1\ **Last updated:** [June 29, 2020, 2:06pm UTC](https://discuss.elastic.co/t/watcher-issues-using-ranger-query-for-timestamp-with-slow-processing-speed/238425 "2020-06-29T14:06:25Z")
Hi guys, So I was wondering today if there would be a better way to do use watchers. We use the below to search the past 2minutes worth of data for anything that matches our query. "filter": \[ { … [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=875) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=877)