# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=885 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 886 --- ## [Ingest pipeline should work based on conditions](https://discuss.elastic.co/t/ingest-pipeline-should-work-based-on-conditions/237806)
**Author:** [@Mohan\_vel](https://discuss.elastic.co/u/Mohan_vel)\ **Replies:** 1\ **Last updated:** [June 20, 2020, 7:05am UTC](https://discuss.elastic.co/t/ingest-pipeline-should-work-based-on-conditions/237806 "2020-06-20T07:05:45Z")
Hi i have created a ingest pipeline using grok processor below is my processor Ingest pipeline with grok PUT \_ingest/pipeline/dissectpipeline { "description" : "split message content", … --- ## [Exception in thread “” java.lang.NoSuchFieldError: FAIL\_ON\_SYMBOL\_HASH\_OVERFLOW Elasticsearch 7.7](https://discuss.elastic.co/t/exception-in-thread-java-lang-nosuchfielderror-fail-on-symbol-hash-overflow-elasticsearch-7-7/237897)
**Author:** [@Sepideh\_Naghdi](https://discuss.elastic.co/u/Sepideh_Naghdi)\ **Replies:** 0\ **Last updated:** [June 20, 2020, 6:22am UTC](https://discuss.elastic.co/t/exception-in-thread-java-lang-nosuchfielderror-fail-on-symbol-hash-overflow-elasticsearch-7-7/237897 "2020-06-20T06:22:15Z")
0 I wrote java code which connect to ElasticSearch node and save documents in index. I got below error: Exception in thread "Thread-21" java.lang.NoSuchFieldError: FAIL\_ON\_SYMBOL\_HASH\_OVERFLOW I know this error is rela… --- ## [Index name error](https://discuss.elastic.co/t/index-name-error/237759)
**Author:** [@examin](https://discuss.elastic.co/u/examin)\ **Replies:** 1\ **Last updated:** [June 20, 2020, 5:17am UTC](https://discuss.elastic.co/t/index-name-error/237759 "2020-06-20T05:17:59Z")
my indexName have '-' and it is returning error Please help curl -XPOST "http://3.7.226.52:9200/\_xpack/sql" -H 'Content-Type: application/json' -d' { "query":"SELECT \* from cc-portm" }' "type": "parsing\_exception", … --- ## [Elastic Search Aggregation with bool query](https://discuss.elastic.co/t/elastic-search-aggregation-with-bool-query/237768)
**Author:** [@Vaibhav\_Sharma](https://discuss.elastic.co/u/Vaibhav_Sharma)\ **Replies:** 1\ **Last updated:** [June 20, 2020, 5:10am UTC](https://discuss.elastic.co/t/elastic-search-aggregation-with-bool-query/237768 "2020-06-20T05:10:34Z")
This is my elastic bool query. this works fine : { "query": { "bool": { "filter": \[ { "terms": { "parent\_uuid.\_raw": \[ … --- ## [Elasticsearch Hot-Warn-Cold on a single node!](https://discuss.elastic.co/t/elasticsearch-hot-warn-cold-on-a-single-node/237650)
**Author:** [@Julius](https://discuss.elastic.co/u/Julius)\ **Replies:** 4\ **Last updated:** [June 20, 2020, 3:30am UTC](https://discuss.elastic.co/t/elasticsearch-hot-warn-cold-on-a-single-node/237650 "2020-06-20T03:30:09Z")
is there a way to archive old data on elasticsearch and automatically move it to cheaper storage while keeping access to this data from the kibana interface ? Our architecture has a single node that run, logstash, elast… --- ## [Search for index field value in text possible?](https://discuss.elastic.co/t/search-for-index-field-value-in-text-possible/237824)
**Author:** [@Tom\_Burke](https://discuss.elastic.co/u/Tom_Burke)\ **Replies:** 1\ **Last updated:** [June 20, 2020, 1:17am UTC](https://discuss.elastic.co/t/search-for-index-field-value-in-text-possible/237824 "2020-06-20T01:17:52Z")
The problem: I have a long list of short strings (1-5 words, mostly) which I want to fuzzy check if they are in a text. The shorts strings are in an index, while the text is part of the query. Is this possible? I manag… --- ## [Reindexing with date format conversion applied on dynamic fields matching regex](https://discuss.elastic.co/t/reindexing-with-date-format-conversion-applied-on-dynamic-fields-matching-regex/237793)
**Author:** [@Andrei\_Gog](https://discuss.elastic.co/u/Andrei_Gog)\ **Replies:** 1\ **Last updated:** [June 19, 2020, 11:53pm UTC](https://discuss.elastic.co/t/reindexing-with-date-format-conversion-applied-on-dynamic-fields-matching-regex/237793 "2020-06-19T23:53:46Z")
Hello Guys. I have an index A that has fields dt\_0 to dt\_n (n\<=100) that unfortunately are stored as dynamic mappings and represent the Long value of a date. The index B has the same mappings as A but it also has the ri… --- ## [Adding elasticsearch-keystore with docker/kubernetes](https://discuss.elastic.co/t/adding-elasticsearch-keystore-with-docker-kubernetes/237884)
**Author:** [@elk\_follower](https://discuss.elastic.co/u/elk_follower)\ **Replies:** 0\ **Last updated:** [June 19, 2020, 10:37pm UTC](https://discuss.elastic.co/t/adding-elasticsearch-keystore-with-docker-kubernetes/237884 "2020-06-19T22:37:53Z")
Hi, I'm following below documents to make a test ELK cluster integrate with key cloak and I'm at the step to add client secret in the elasticsearch keystore. https://www.elastic.co/guide/en/elastic-stack-get-started/cu… --- ## [Elasticsearch 7.3.2 shows status as failed - main ERROR Unable to locate appender "rolling\_old" for logger config "root"](https://discuss.elastic.co/t/elasticsearch-7-3-2-shows-status-as-failed-main-error-unable-to-locate-appender-rolling-old-for-logger-config-root/237886)
**Author:** [@sayef](https://discuss.elastic.co/u/sayef)\ **Replies:** 0\ **Last updated:** [June 19, 2020, 11:00pm UTC](https://discuss.elastic.co/t/elasticsearch-7-3-2-shows-status-as-failed-main-error-unable-to-locate-appender-rolling-old-for-logger-config-root/237886 "2020-06-19T23:00:27Z")
I am new to Elasticsearch and getting this error Getting the following error when I do a sudo systemctl status elasticsearch.service. ● elasticsearch.service - Elasticsearch Loaded: loaded (/usr/lib/systemd/system/ela… --- ## [Real time and sync](https://discuss.elastic.co/t/real-time-and-sync/237859)
**Author:** [@asl](https://discuss.elastic.co/u/asl)\ **Replies:** 0\ **Last updated:** [June 19, 2020, 7:54pm UTC](https://discuss.elastic.co/t/real-time-and-sync/237859 "2020-06-19T19:54:01Z")
Hi everyone, I’m trying to achieve real-time operations without affecting performance too much. More in deep, I need to sync data from a main relational database to ES. I thought about using a message broker (or by usin… --- ## [Cannot add a new node in a cluster already composed of 1 node](https://discuss.elastic.co/t/cannot-add-a-new-node-in-a-cluster-already-composed-of-1-node/237841)
**Author:** [@Julius](https://discuss.elastic.co/u/Julius)\ **Replies:** 4\ **Last updated:** [June 19, 2020, 8:48pm UTC](https://discuss.elastic.co/t/cannot-add-a-new-node-in-a-cluster-already-composed-of-1-node/237841 "2020-06-19T20:48:27Z")
here is the configuration of node 1 with IP: 192.168.1.1 : cluster.name: Syslog node.name: ColdServer node.master: false node.data: true path.data: /var/log/ELK/data network.host: 0.0.0.0 http.port: 9200 transport.tcp.p… --- ## [Field transformation in elasticsearch](https://discuss.elastic.co/t/field-transformation-in-elasticsearch/237865)
**Author:** [@Gauti](https://discuss.elastic.co/u/Gauti)\ **Replies:** 0\ **Last updated:** [June 19, 2020, 8:11pm UTC](https://discuss.elastic.co/t/field-transformation-in-elasticsearch/237865 "2020-06-19T20:11:33Z")
Hi All, We are ingesting documents into elasticsearch using logstash, i have a field called "business elapsed time" the value of this field is "1 hours 15 minutes" , its getting ingested into elasticsearch as string is… --- ## [How can we use the logstash values by trim some content to show in visualizations or new scripted parameters](https://discuss.elastic.co/t/how-can-we-use-the-logstash-values-by-trim-some-content-to-show-in-visualizations-or-new-scripted-parameters/237857)
**Author:** [@sajjithreddy](https://discuss.elastic.co/u/sajjithreddy)\ **Replies:** 0\ **Last updated:** [June 19, 2020, 7:43pm UTC](https://discuss.elastic.co/t/how-can-we-use-the-logstash-values-by-trim-some-content-to-show-in-visualizations-or-new-scripted-parameters/237857 "2020-06-19T19:43:48Z")
Hello, I have a event called "size" and the value be like "125433 Bytes" in log stash. I have few questions here. Can we trim the value as 125433 and use in Visualization ? If so how can we do? Can we convert the valu… --- ## [Elastic Search nested data type query](https://discuss.elastic.co/t/elastic-search-nested-data-type-query/237773)
**Author:** [@surajdalvi](https://discuss.elastic.co/u/surajdalvi)\ **Replies:** 1\ **Last updated:** [June 19, 2020, 5:07pm UTC](https://discuss.elastic.co/t/elastic-search-nested-data-type-query/237773 "2020-06-19T17:07:12Z")
Hi, I have created the index in elastic search with the following mapping: PUT test { "mappings": { "documents": { "properties": { "title": { "type": "text", "fields": { "raw": { "type"… --- ## [Query from multiple fields with boolean operators](https://discuss.elastic.co/t/query-from-multiple-fields-with-boolean-operators/237690)
**Author:** [@namali](https://discuss.elastic.co/u/namali)\ **Replies:** 2\ **Last updated:** [June 19, 2020, 4:42pm UTC](https://discuss.elastic.co/t/query-from-multiple-fields-with-boolean-operators/237690 "2020-06-19T16:42:25Z")
wanted to query two fields (a and b) in 'and' /'or' operators to check ((a \> 90 and b \>=70 ) or (a\>80 and b\>98))with another field. Please guide me to write combine multiple query clauses using boolean operators """ up… --- ## [Elasticsearch null values aggregation](https://discuss.elastic.co/t/elasticsearch-null-values-aggregation/237828)
**Author:** [@hiba](https://discuss.elastic.co/u/hiba)\ **Replies:** 1\ **Last updated:** [June 19, 2020, 3:57pm UTC](https://discuss.elastic.co/t/elasticsearch-null-values-aggregation/237828 "2020-06-19T15:57:11Z")
Hi , is null values considered a correct value for AVG aggregation in elasticsearch ? example a=5 b=15 c=0 avg =(5+15+0)/3 or avg=(5+15)/2 any help pease! --- ## [Can't get text on a START\_OBJECT at 1:159\]\]](https://discuss.elastic.co/t/cant-get-text-on-a-start-object-at-1-159/236543)
**Author:** [@Keener](https://discuss.elastic.co/u/Keener)\ **Replies:** 2\ **Last updated:** [June 19, 2020, 1:51pm UTC](https://discuss.elastic.co/t/cant-get-text-on-a-start-object-at-1-159/236543 "2020-06-19T13:51:57Z")
HI, I am a first time user of this forum, I hope this is the place to post this question/issue. I have a customer that upgraded to ES 6.8.9 and now gets the following messages, what does this mean? Preformatted text'El… --- ## [Getting connectivity issue in filebeat with elasticsearch](https://discuss.elastic.co/t/getting-connectivity-issue-in-filebeat-with-elasticsearch/237811)
**Author:** [@Avinash\_sanapala](https://discuss.elastic.co/u/Avinash_sanapala)\ **Replies:** 0\ **Last updated:** [June 19, 2020, 1:32pm UTC](https://discuss.elastic.co/t/getting-connectivity-issue-in-filebeat-with-elasticsearch/237811 "2020-06-19T13:32:11Z")
getting the below error while connecting to elastic search from filebeat failed to check for policy name 'filebeat': (status=403) {"error":{"root\_cause":\[{"type":"security\_exception","reason":"action \[cluster:admin/ilm/… --- ## [How to update documents without using the ingest pipeline](https://discuss.elastic.co/t/how-to-update-documents-without-using-the-ingest-pipeline/237766)
**Author:** [@mabr3](https://discuss.elastic.co/u/mabr3)\ **Replies:** 1\ **Last updated:** [June 19, 2020, 12:53pm UTC](https://discuss.elastic.co/t/how-to-update-documents-without-using-the-ingest-pipeline/237766 "2020-06-19T12:53:17Z")
Hi! Pretty much what the title says: I have an index which uses an ingest pipeline to add some fields and do some changes, but when updating the documents (e.g. for testing or to correct something) I don't want that pip… --- ## [Does installing azure plugin cause any data loss?](https://discuss.elastic.co/t/does-installing-azure-plugin-cause-any-data-loss/237799)
**Author:** [@gokulnath112](https://discuss.elastic.co/u/gokulnath112)\ **Replies:** 1\ **Last updated:** [June 19, 2020, 12:42pm UTC](https://discuss.elastic.co/t/does-installing-azure-plugin-cause-any-data-loss/237799 "2020-06-19T12:42:19Z")
Greetings..! Hope everyone is safe and good. I have a 3 node cluster in production.It holds almost 24Lakhs of records. I want to install azure plugin to take backup in azure container. As it is in production, i'm afraid… --- ## [Docker image in kubernetes](https://discuss.elastic.co/t/docker-image-in-kubernetes/237805)
**Author:** [@rwxr\_xr\_x](https://discuss.elastic.co/u/rwxr_xr_x)\ **Replies:** 0\ **Last updated:** [June 19, 2020, 12:33pm UTC](https://discuss.elastic.co/t/docker-image-in-kubernetes/237805 "2020-06-19T12:33:26Z")
Hello, I see many posts about this error, they all seem to mention external storage, but I don't use any external volumnes. The error I get is: Underlying file changed by an external force I use docker.elastic.co/ela… --- ## [Elasticsearch running in a docker container: How identify it as target for log events?](https://discuss.elastic.co/t/elasticsearch-running-in-a-docker-container-how-identify-it-as-target-for-log-events/237791)
**Author:** [@smm](https://discuss.elastic.co/u/smm)\ **Replies:** 1\ **Last updated:** [June 19, 2020, 12:22pm UTC](https://discuss.elastic.co/t/elasticsearch-running-in-a-docker-container-how-identify-it-as-target-for-log-events/237791 "2020-06-19T12:22:21Z")
Dear community, I am askig myself this: I have as test a docker-compose.yml up & running with 5 nodes - 3 es node, 1 kibana, 1 logstash. Each and everyone in its container. So far so good. Now I wanted to send from a vm… --- ## [How do I get to see elasticsearch own logs in a dockerized elasticsearch?](https://discuss.elastic.co/t/how-do-i-get-to-see-elasticsearch-own-logs-in-a-dockerized-elasticsearch/236839)
**Author:** [@smm](https://discuss.elastic.co/u/smm)\ **Replies:** 6\ **Last updated:** [June 19, 2020, 10:45am UTC](https://discuss.elastic.co/t/how-do-i-get-to-see-elasticsearch-own-logs-in-a-dockerized-elasticsearch/236839 "2020-06-19T10:45:11Z")
Dear community, i dockerized elasticsearch like this: esnode1: image: docker.elastic.co/elasticsearch/elasticsearch:7.7.1 container\_name: esnode1 environment: - node.name=esnode1 - cluster.name=es-on-docker - disc… --- ## [Dynamic templates - Any way of accessing a field full path instead of its name?](https://discuss.elastic.co/t/dynamic-templates-any-way-of-accessing-a-field-full-path-instead-of-its-name/237774)
**Author:** [@ng.software.dev](https://discuss.elastic.co/u/ng.software.dev)\ **Replies:** 0\ **Last updated:** [June 19, 2020, 9:29am UTC](https://discuss.elastic.co/t/dynamic-templates-any-way-of-accessing-a-field-full-path-instead-of-its-name/237774 "2020-06-19T09:29:32Z")
Hi, I am developping a search engine in which I rely quite heavily on dynamic templates, as the underlying data model is dynamic. So I'm using path\_match with regular expressions. Here's a sample example to get an idea… --- ## [502 bad gateway read ECONNRESET issue with custom plugin](https://discuss.elastic.co/t/502-bad-gateway-read-econnreset-issue-with-custom-plugin/237769)
**Author:** [@Dahea\_Moon](https://discuss.elastic.co/u/Dahea_Moon)\ **Replies:** 0\ **Last updated:** [June 19, 2020, 9:15am UTC](https://discuss.elastic.co/t/502-bad-gateway-read-econnreset-issue-with-custom-plugin/237769 "2020-06-19T09:15:42Z")
hi, I have issues with my custom search plugin. I have made search plugin to change scoring. It was okay till I have installed my plugin and start ES. But when I searched query, ES just shut down without any returning … --- ## [Max\_bucket exception from elasticsearch](https://discuss.elastic.co/t/max-bucket-exception-from-elasticsearch/237732)
**Author:** [@Voula\_Mikr](https://discuss.elastic.co/u/Voula_Mikr)\ **Replies:** 3\ **Last updated:** [June 19, 2020, 8:20am UTC](https://discuss.elastic.co/t/max-bucket-exception-from-elasticsearch/237732 "2020-06-19T08:20:00Z")
Hi, I have made a control visualization (option list) with 4 options-fields (let's say A, B, C & D). The "size" field of each option is 10000 and search.max\_buckets setting is 10000 too. In ElasticSearch, for field A … --- ## [Synonym in Query\_string not working as expected](https://discuss.elastic.co/t/synonym-in-query-string-not-working-as-expected/236269)
**Author:** [@Lalit\_Kumar](https://discuss.elastic.co/u/Lalit_Kumar)\ **Replies:** 1\ **Last updated:** [June 19, 2020, 8:12am UTC](https://discuss.elastic.co/t/synonym-in-query-string-not-working-as-expected/236269 "2020-06-19T08:12:10Z")
Hey, Thank you in advance, any help would be greatly appreciated. I am not clear why this happening. when i execute the given(below) query its return 200. but the synonym created for the query is not correct. so result… --- ## [How to efficiently return most recent documents using index pattern by date](https://discuss.elastic.co/t/how-to-efficiently-return-most-recent-documents-using-index-pattern-by-date/237712)
**Author:** [@fletcherd](https://discuss.elastic.co/u/fletcherd)\ **Replies:** 1\ **Last updated:** [June 19, 2020, 4:28am UTC](https://discuss.elastic.co/t/how-to-efficiently-return-most-recent-documents-using-index-pattern-by-date/237712 "2020-06-19T04:28:20Z")
I am having trouble doing what I feel like should be really simple. I want to return the most recent 500 documents that match a query, using the JSON query language. I tried just sorting on the date and then setting a … --- ## [Mappings of different types in one index](https://discuss.elastic.co/t/mappings-of-different-types-in-one-index/237717)
**Author:** [@lec\_ssmi](https://discuss.elastic.co/u/lec_ssmi)\ **Replies:** 4\ **Last updated:** [June 19, 2020, 4:26am UTC](https://discuss.elastic.co/t/mappings-of-different-types-in-one-index/237717 "2020-06-19T04:26:35Z")
Excuse me, if there are two types in the same index, these two types have their own mapping. These two mappings use some fields with the same name, but the field types are different. Will there be conflict? --- ## [Customize ESJsonLayout](https://discuss.elastic.co/t/customize-esjsonlayout/237724)
**Author:** [@casparxu](https://discuss.elastic.co/u/casparxu)\ **Replies:** 0\ **Last updated:** [June 19, 2020, 3:47am UTC](https://discuss.elastic.co/t/customize-esjsonlayout/237724 "2020-06-19T03:47:12Z")
Hi experts, I'm trying to add some field to es json log output to meet some my owner log collector. Any idea how can I do this? Or I can only user patternLayout by manually making it looks like json? Thanks [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=884) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=886)