# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=897 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 898 --- ## [Ingest only nodes](https://discuss.elastic.co/t/ingest-only-nodes/235854)
**Author:** [@barracuda-charles](https://discuss.elastic.co/u/barracuda-charles)\ **Replies:** 3\ **Last updated:** [June 6, 2020, 4:28pm UTC](https://discuss.elastic.co/t/ingest-only-nodes/235854 "2020-06-06T16:28:47Z")
I have an ingest-heavy workload (many more writes than reads). I am curious about the need / benefits of having ingest-only nodes vs having the ingest done on the data nodes. I don't think I actually have a specific ing… --- ## [Discrepancy b/w /\_cat/nodes and Kibana dashboard showing node's performance](https://discuss.elastic.co/t/discrepancy-b-w-cat-nodes-and-kibana-dashboard-showing-nodes-performance/236039)
**Author:** [@slmingol](https://discuss.elastic.co/u/slmingol)\ **Replies:** 0\ **Last updated:** [June 6, 2020, 1:15pm UTC](https://discuss.elastic.co/t/discrepancy-b-w-cat-nodes-and-kibana-dashboard-showing-nodes-performance/236039 "2020-06-06T13:15:42Z")
I'm investigating a performance problem we've been noticing with one of our datanodes. Specifically es-data-01a.lab1. The /\_cat/nodes API shows indexing.index\_count hovering around 20, but the dashboard in Kibana shows a… --- ## [Regexp not searching as expected](https://discuss.elastic.co/t/regexp-not-searching-as-expected/235155)
**Author:** [@Alenoosh\_Baghoomian](https://discuss.elastic.co/u/Alenoosh_Baghoomian)\ **Replies:** 6\ **Last updated:** [June 6, 2020, 11:41am UTC](https://discuss.elastic.co/t/regexp-not-searching-as-expected/235155 "2020-06-06T11:41:38Z")
Hello I'm using 'search' api of elasticsearch (7.4.1) and the following is the query I pass to this api : \`\["size" =\> 10000, "query" =\> \[ "bool" =\> \[ "must" =\> \[ \[ "regexp" =\> \[ "name" =\> \[ "valu… --- ## [Plain Highlighter "order":"none" is not working](https://discuss.elastic.co/t/plain-highlighter-order-none-is-not-working/236030)
**Author:** [@mayanknc](https://discuss.elastic.co/u/mayanknc)\ **Replies:** 0\ **Last updated:** [June 6, 2020, 10:47am UTC](https://discuss.elastic.co/t/plain-highlighter-order-none-is-not-working/236030 "2020-06-06T10:47:52Z")
Hi, I have created below test\_plain\_highlighter index. I want highlighted fragments should appear in order as they appear in the field using Plain Highlighter. I have tried below option, Set "order":"none" in highlig… --- ## [How to make few token as phrase](https://discuss.elastic.co/t/how-to-make-few-token-as-phrase/235977)
**Author:** [@aradhanacha](https://discuss.elastic.co/u/aradhanacha)\ **Replies:** 0\ **Last updated:** [June 5, 2020, 3:48pm UTC](https://discuss.elastic.co/t/how-to-make-few-token-as-phrase/235977 "2020-06-05T15:48:45Z")
I want to search part of query to be considered as phrase .For e.g. I want to search "Can you show me documents for Hospitality and Airline Industry" Here I want Airline Industry to be considered as phrase.I dont find an… --- ## [Why \_msearch request isn't cancellable(=false)?](https://discuss.elastic.co/t/why-msearch-request-isnt-cancellable-false/235893)
**Author:** [@rahul\_yadav1](https://discuss.elastic.co/u/rahul_yadav1)\ **Replies:** 7\ **Last updated:** [June 6, 2020, 8:18am UTC](https://discuss.elastic.co/t/why-msearch-request-isnt-cancellable-false/235893 "2020-06-06T08:18:27Z")
In ES-7.4.2, search request is cancellable(=true) but \_msearch request isn't. What's the idea behind it ?? --- ## [Date format is in string](https://discuss.elastic.co/t/date-format-is-in-string/235288)
**Author:** [@Sridhar](https://discuss.elastic.co/u/Sridhar)\ **Replies:** 1\ **Last updated:** [June 3, 2020, 5:54am UTC](https://discuss.elastic.co/t/date-format-is-in-string/235288 "2020-06-03T05:54:49Z")
Hi all, Below is the powershell script I try to push the data to Elasticsearch. I'm able to do that. but the @timestamp field is loaded as string. Please help me.. what exactly I'm missing.. I'm not using logstash.. ev… --- ## [Ingest Node Timezone Offset](https://discuss.elastic.co/t/ingest-node-timezone-offset/236006)
**Author:** [@crux](https://discuss.elastic.co/u/crux)\ **Replies:** 0\ **Last updated:** [June 5, 2020, 8:15pm UTC](https://discuss.elastic.co/t/ingest-node-timezone-offset/236006 "2020-06-05T20:15:34Z")
I've found an inconsistency between Logstash date matching syntax and Ingest node date matching syntax. I have a time field that looks like this: 2020-06-03 15:37:14.465 -04:00 While most of the Logstash Date Plugin s… --- ## [Define cluster / index privileges for Management sub-features](https://discuss.elastic.co/t/define-cluster-index-privileges-for-management-sub-features/236002)
**Author:** [@mcardozo](https://discuss.elastic.co/u/mcardozo)\ **Replies:** 0\ **Last updated:** [June 5, 2020, 7:43pm UTC](https://discuss.elastic.co/t/define-cluster-index-privileges-for-management-sub-features/236002 "2020-06-05T19:43:50Z")
I'm experimenting with ES 7.6 and securing the stack. I've spent a fair amount of time in the documents and have become familiar with the built-in users & roles. I've also tried creating my own roles and users to match… --- ## [Elasticsearch snapshot query](https://discuss.elastic.co/t/elasticsearch-snapshot-query/235820)
**Author:** [@Dev\_Chakraborty](https://discuss.elastic.co/u/Dev_Chakraborty)\ **Replies:** 12\ **Last updated:** [June 5, 2020, 7:39pm UTC](https://discuss.elastic.co/t/elasticsearch-snapshot-query/235820 "2020-06-05T19:39:26Z")
Hi Team, I was running the below command to get all the snapshots which was taken by me: curl -username:password -X GET "ES Server IP:9200/\_snapshot/reponame?v&s=id&pretty" -k { "error" : { "root\_cause" : \[ … --- ## [Count values are not concatenated as one single value .How to get one entries out of multiple values](https://discuss.elastic.co/t/count-values-are-not-concatenated-as-one-single-value-how-to-get-one-entries-out-of-multiple-values/235999)
**Author:** [@hema\_vathi](https://discuss.elastic.co/u/hema_vathi)\ **Replies:** 0\ **Last updated:** [June 5, 2020, 7:22pm UTC](https://discuss.elastic.co/t/count-values-are-not-concatenated-as-one-single-value-how-to-get-one-entries-out-of-multiple-values/235999 "2020-06-05T19:22:14Z")
I am trying to get the time duration of my process and its count . But it showing up as different entries in data table for same value. Say for example i should get data like this duration count 0.34 … --- ## [Backp up native users along with passwords and roles](https://discuss.elastic.co/t/backp-up-native-users-along-with-passwords-and-roles/235995)
**Author:** [@Sirius](https://discuss.elastic.co/u/Sirius)\ **Replies:** 0\ **Last updated:** [June 5, 2020, 5:57pm UTC](https://discuss.elastic.co/t/backp-up-native-users-along-with-passwords-and-roles/235995 "2020-06-05T17:57:35Z")
Hello, Is there a way to export a backup of my users with passwords and roles ? I'm running ES 7.6.2. If I do create snapshots for indices security... I'll be covering that users, roles, passwords part ? i.e. PUT /\_… --- ## [ILM in 7.7.0 not applying - 0 linked indices](https://discuss.elastic.co/t/ilm-in-7-7-0-not-applying-0-linked-indices/235201)
**Author:** [@taa](https://discuss.elastic.co/u/taa)\ **Replies:** 2\ **Last updated:** [June 5, 2020, 5:11pm UTC](https://discuss.elastic.co/t/ilm-in-7-7-0-not-applying-0-linked-indices/235201 "2020-06-05T17:11:05Z")
I have a 7.7.0 cluster which reports 0 linked indices for every ILM policy and no ILM is being performed on any index. I have a similarly configured 7.5.0 cluster in which ILM is working as expected. Is there something… --- ## [Unable to launch Kibana after upgrade to 7.7.0](https://discuss.elastic.co/t/unable-to-launch-kibana-after-upgrade-to-7-7-0/234654)
**Author:** [@skyluke.1987](https://discuss.elastic.co/u/skyluke.1987)\ **Replies:** 1\ **Last updated:** [June 5, 2020, 3:55pm UTC](https://discuss.elastic.co/t/unable-to-launch-kibana-after-upgrade-to-7-7-0/234654 "2020-06-05T15:55:26Z")
Hi all, yesterday I tried to upgrade my ELKS from 7.1 to 7.7. After the upgrade I am able to run the services and when I check its working and running. Just that I am not able to browse the site. But there are following… --- ## [Why elasticsearch's query time per shard take little while the total query time is long](https://discuss.elastic.co/t/why-elasticsearchs-query-time-per-shard-take-little-while-the-total-query-time-is-long/235910)
**Author:** [@Matt-JN](https://discuss.elastic.co/u/Matt-JN)\ **Replies:** 6\ **Last updated:** [June 5, 2020, 3:17pm UTC](https://discuss.elastic.co/t/why-elasticsearchs-query-time-per-shard-take-little-while-the-total-query-time-is-long/235910 "2020-06-05T15:17:22Z")
Elasticserach cluster has 5 nodes with 16 cores and 64 gb memory each，boot heap size is 24GB. elasticsearch version 5.6.16. the index size is 150G(exclude replica), 300 million documents，5 primary shard, 2 replica. ind… --- ## [Difference of count between count of field value](https://discuss.elastic.co/t/difference-of-count-between-count-of-field-value/235968)
**Author:** [@Guillaume\_RENARD](https://discuss.elastic.co/u/Guillaume_RENARD)\ **Replies:** 0\ **Last updated:** [June 5, 2020, 2:41pm UTC](https://discuss.elastic.co/t/difference-of-count-between-count-of-field-value/235968 "2020-06-05T14:41:01Z")
Hi, I have some URLs ending by end.gif and some other by start.gif. What I would like to get is the useragent for the one with the most start without end but I can't achieve that. Below a screenshot I would like a t… --- ## [Can we set count in decimal value in curator actions](https://discuss.elastic.co/t/can-we-set-count-in-decimal-value-in-curator-actions/235959)
**Author:** [@Dragon9](https://discuss.elastic.co/u/Dragon9)\ **Replies:** 0\ **Last updated:** [June 5, 2020, 1:37pm UTC](https://discuss.elastic.co/t/can-we-set-count-in-decimal-value-in-curator-actions/235959 "2020-06-05T13:37:50Z")
like in my action file i want this -filtertype: age timestring: '%Y.%m.%d' source: name direction: older unit: days unit\_count: 4.5 --- ## [Method threw 'java.lang.NoClassDefFoundError' exception. Cannot evaluate org.elasticsearch.search.builder.SearchSourceBuilder.toString()](https://discuss.elastic.co/t/method-threw-java-lang-noclassdeffounderror-exception-cannot-evaluate-org-elasticsearch-search-builder-searchsourcebuilder-tostring/235956)
**Author:** [@ManojKumar\_Julakanti](https://discuss.elastic.co/u/ManojKumar_Julakanti)\ **Replies:** 1\ **Last updated:** [June 5, 2020, 1:32pm UTC](https://discuss.elastic.co/t/method-threw-java-lang-noclassdeffounderror-exception-cannot-evaluate-org-elasticsearch-search-builder-searchsourcebuilder-tostring/235956 "2020-06-05T13:32:08Z")
I couldn't instantiate SearchSourceBuilder my elastic-search version is 7.6.0 I am using rest high level client --- ## [Doubts about hardware requirements for elasticsearch](https://discuss.elastic.co/t/doubts-about-hardware-requirements-for-elasticsearch/235545)
**Author:** [@eayala](https://discuss.elastic.co/u/eayala)\ **Replies:** 10\ **Last updated:** [June 5, 2020, 1:18pm UTC](https://discuss.elastic.co/t/doubts-about-hardware-requirements-for-elasticsearch/235545 "2020-06-05T13:18:40Z")
I'm trying to setup elasticsearch cluster. I will get maximum of 4GB of data every day. So what will be hardware required to set up ElasticSearch 7.6.2 and kibana 7.6.2 What is ideal configuration for server- side RAM/… --- ## [Is this forcemerge behaviour normal?](https://discuss.elastic.co/t/is-this-forcemerge-behaviour-normal/235896)
**Author:** [@slabajos](https://discuss.elastic.co/u/slabajos)\ **Replies:** 5\ **Last updated:** [June 5, 2020, 1:14pm UTC](https://discuss.elastic.co/t/is-this-forcemerge-behaviour-normal/235896 "2020-06-05T13:14:58Z")
Hello, just wanted to ask a quick question regarding forcemerge. We have a hot-warm architecture for logs and every night we move yesterday indices to our "warm" node. We only have 1 master (hot), 1 data (warm) and one … --- ## [Issues ingesting log files with fresh installation](https://discuss.elastic.co/t/issues-ingesting-log-files-with-fresh-installation/233564)
**Author:** [@ozonshak](https://discuss.elastic.co/u/ozonshak)\ **Replies:** 4\ **Last updated:** [June 5, 2020, 12:33pm UTC](https://discuss.elastic.co/t/issues-ingesting-log-files-with-fresh-installation/233564 "2020-06-05T12:33:59Z")
Hello. I'm hoping someone can please help me with an indexing issue that i'm having. I'm working with a fresh setup of ElasticSearch and Kibana. I have everything setup, Kibana loads, I can log in with security, and t… --- ## [Total Fields limit to 1000 in queries](https://discuss.elastic.co/t/total-fields-limit-to-1000-in-queries/235938)
**Author:** [@agiorgi](https://discuss.elastic.co/u/agiorgi)\ **Replies:** 0\ **Last updated:** [June 5, 2020, 10:57am UTC](https://discuss.elastic.co/t/total-fields-limit-to-1000-in-queries/235938 "2020-06-05T10:57:09Z")
Hello guys, I was wondering why the number of fields in indexes is by default capped at 1000. Same applies for the query maximum number of fields that can be targeted, which is also capped at 1024. I mean, this is fin… --- ## [Kilograms to grams convert processor](https://discuss.elastic.co/t/kilograms-to-grams-convert-processor/235937)
**Author:** [@gitterhh](https://discuss.elastic.co/u/gitterhh)\ **Replies:** 2\ **Last updated:** [June 5, 2020, 12:15pm UTC](https://discuss.elastic.co/t/kilograms-to-grams-convert-processor/235937 "2020-06-05T12:15:56Z")
There is a standard processor for bytes https://www.elastic.co/guide/en/elasticsearch/reference/current/bytes-processor.html Is there similar processor for grams? Or which processor can be used to achieve same functiona… --- ## [Inters Section Query in elastic search](https://discuss.elastic.co/t/inters-section-query-in-elastic-search/235777)
**Author:** [@abba5](https://discuss.elastic.co/u/abba5)\ **Replies:** 2\ **Last updated:** [June 5, 2020, 11:37am UTC](https://discuss.elastic.co/t/inters-section-query-in-elastic-search/235777 "2020-06-05T11:37:41Z")
I am working on a project where I need to search for a person's name and it's college. Indexing: "attributes": { "type": "nested", "properties": { "name": { "type": "keyword" }, "value": { "type": "text",… --- ## [Is there an msearch performance gain if all queries are targeting the same field?](https://discuss.elastic.co/t/is-there-an-msearch-performance-gain-if-all-queries-are-targeting-the-same-field/235296)
**Author:** [@ndtreviv](https://discuss.elastic.co/u/ndtreviv)\ **Replies:** 1\ **Last updated:** [June 5, 2020, 11:08am UTC](https://discuss.elastic.co/t/is-there-an-msearch-performance-gain-if-all-queries-are-targeting-the-same-field/235296 "2020-06-05T11:08:56Z")
I'm trying to query elastic with lots and lots of queries. I'm batching the queries into set-sized msearches according to our query queue settings. At the moment it's organised so that each msearch only contains queries… --- ## [Invalid\_index\_name\_exception when version up to 7.x](https://discuss.elastic.co/t/invalid-index-name-exception-when-version-up-to-7-x/235919)
**Author:** [@carlostevez](https://discuss.elastic.co/u/carlostevez)\ **Replies:** 0\ **Last updated:** [June 5, 2020, 8:55am UTC](https://discuss.elastic.co/t/invalid-index-name-exception-when-version-up-to-7-x/235919 "2020-06-05T08:55:06Z")
I've upgrade ELK 6.x to 7.X But I got error I haven't got when I use 6.x. I used with below index name pattern when 6.x If I modify the index name , it suffer to change whole system. Q1. Is it added index naming rule… --- ## [Elasticsearch cluster chain cert null excpetion](https://discuss.elastic.co/t/elasticsearch-cluster-chain-cert-null-excpetion/235740)
**Author:** [@tmporary](https://discuss.elastic.co/u/tmporary)\ **Replies:** 2\ **Last updated:** [June 5, 2020, 8:04am UTC](https://discuss.elastic.co/t/elasticsearch-cluster-chain-cert-null-excpetion/235740 "2020-06-05T08:04:07Z")
Hi, I'm trying to setup a ssl for elasticsearch (both for encryption of communication and client authentication). Currently I'm trying to run cluster configuration with one node on my local machine with below setup: clu… --- ## [Disabled syscall filter but still issue](https://discuss.elastic.co/t/disabled-syscall-filter-but-still-issue/234894)
**Author:** [@elk2](https://discuss.elastic.co/u/elk2)\ **Replies:** 5\ **Last updated:** [June 5, 2020, 7:57am UTC](https://discuss.elastic.co/t/disabled-syscall-filter-but-still-issue/234894 "2020-06-05T07:57:48Z")
I have a cluster with 10 nodes with elasticsearch 2.4 version. I disabled in elasticsearch.yml syscall filter with this configuration: \[...\] bootstrap.system\_call\_filter: false \[...\] Unfortunately, elasticsearch sti… --- ## [Getting 'missing auth credentials' after setting SSL in Elasticsearch](https://discuss.elastic.co/t/getting-missing-auth-credentials-after-setting-ssl-in-elasticsearch/235906)
**Author:** [@tmporary](https://discuss.elastic.co/u/tmporary)\ **Replies:** 0\ **Last updated:** [June 5, 2020, 7:54am UTC](https://discuss.elastic.co/t/getting-missing-auth-credentials-after-setting-ssl-in-elasticsearch/235906 "2020-06-05T07:54:18Z")
Hi, Recently I set up ssl for HTTP and TCP in elasticsearch but I'm constantly getting below error when trying to call elastic API curl -k --cert MY\_CERT.pem:Password 'https://localhost:9200/\_xpack/security/\_authentica… --- ## [Watcher: Conditional action for failed login event](https://discuss.elastic.co/t/watcher-conditional-action-for-failed-login-event/234652)
**Author:** [@Tirtharaj\_Karbotkar](https://discuss.elastic.co/u/Tirtharaj_Karbotkar)\ **Replies:** 3\ **Last updated:** [June 5, 2020, 7:37am UTC](https://discuss.elastic.co/t/watcher-conditional-action-for-failed-login-event/234652 "2020-06-05T07:37:04Z")
Hi, I have one watcher which is checking for user login events after every 1 minute. Now i have issues in filtering the results in following manner, I want to get only the failed login events (exclude successful login… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=896) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=898)