# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=898 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 899 --- ## [Transforms: date epoch\_millis parsing errors](https://discuss.elastic.co/t/transforms-date-epoch-millis-parsing-errors/235731)
**Author:** [@Carlos\_Moya](https://discuss.elastic.co/u/Carlos_Moya)\ **Replies:** 2\ **Last updated:** [June 5, 2020, 7:09am UTC](https://discuss.elastic.co/t/transforms-date-epoch-millis-parsing-errors/235731 "2020-06-05T07:09:54Z")
Hello, We have a 7.6.2 elasticsearch cluster. A transform is failing with the next parsing errors: 261\]: index \[t\_transform\_testing\], type \[\_doc\], id \[QWFGhHsjq4vzL5KDKy\_E9J2TAAAAAAAA\], message \[MapperParsingExcep… --- ## [ELK Security : What is the best choice for realm?](https://discuss.elastic.co/t/elk-security-what-is-the-best-choice-for-realm/235897)
**Author:** [@elisavet](https://discuss.elastic.co/u/elisavet)\ **Replies:** 0\ **Last updated:** [June 5, 2020, 7:01am UTC](https://discuss.elastic.co/t/elk-security-what-is-the-best-choice-for-realm/235897 "2020-06-05T07:01:52Z")
Hello! My goal is to enable security in ELK and create user/passwords for login. Among the ELK realms, I am between native, file and pki (I am using the basic licence), but I do not know what are the pros and cons of e… --- ## [Append update to a document](https://discuss.elastic.co/t/append-update-to-a-document/235834)
**Author:** [@Susmit07](https://discuss.elastic.co/u/Susmit07)\ **Replies:** 1\ **Last updated:** [June 5, 2020, 5:38am UTC](https://discuss.elastic.co/t/append-update-to-a-document/235834 "2020-06-05T05:38:27Z")
Hello team, I have a document and also have a unique id field, first time it inserts 10 data based on the docId, secondTime it has again 15 data with same docId again so docId is the primaryKey (in the context of RDBMS)… --- ## [How to filter nested object in Elasticsearch 7.5?](https://discuss.elastic.co/t/how-to-filter-nested-object-in-elasticsearch-7-5/234121)
**Author:** [@tanobi92](https://discuss.elastic.co/u/tanobi92)\ **Replies:** 1\ **Last updated:** [June 5, 2020, 4:05am UTC](https://discuss.elastic.co/t/how-to-filter-nested-object-in-elasticsearch-7-5/234121 "2020-06-05T04:05:04Z")
I have a mapping: { "ntol-2020-05" : { "mappings" : { { "properties": { "\_createdAt": { "type": "date" }, "\_logType": { "type": "text", … --- ## [Empty .kibana index cannot be relocated after node exlusion has been set](https://discuss.elastic.co/t/empty-kibana-index-cannot-be-relocated-after-node-exlusion-has-been-set/234877)
**Author:** [@howardhuang](https://discuss.elastic.co/u/howardhuang)\ **Replies:** 1\ **Last updated:** [June 5, 2020, 3:11am UTC](https://discuss.elastic.co/t/empty-kibana-index-cannot-be-relocated-after-node-exlusion-has-been-set/234877 "2020-06-05T03:11:16Z")
Dear support, We have met a shard relocation issue after setting node exclusion. In our case, original cluster is 6.8.2, we try to add the same amount of new 7.5.1 nodes and exclude the 6.8.2 nodes to upgrade cluster. H… --- ## [How to keep original date data from json as source to ES](https://discuss.elastic.co/t/how-to-keep-original-date-data-from-json-as-source-to-es/235436)
**Author:** [@Sirius](https://discuss.elastic.co/u/Sirius)\ **Replies:** 2\ **Last updated:** [June 5, 2020, 2:41am UTC](https://discuss.elastic.co/t/how-to-keep-original-date-data-from-json-as-source-to-es/235436 "2020-06-05T02:41:19Z")
Hello, I'm shipping json data logs with filebeat to ELK 7.6 version. For some reason date data are substracted by hours when is ingested in ES,, how can I keep original source dates in ES without be modified ? FIlebeat… --- ## [Is it possible to directly upgrade (rolling) Elasticsearch 6.3.0 to 7.7.0?](https://discuss.elastic.co/t/is-it-possible-to-directly-upgrade-rolling-elasticsearch-6-3-0-to-7-7-0/235785)
**Author:** [@elasticheart](https://discuss.elastic.co/u/elasticheart)\ **Replies:** 2\ **Last updated:** [June 5, 2020, 12:59am UTC](https://discuss.elastic.co/t/is-it-possible-to-directly-upgrade-rolling-elasticsearch-6-3-0-to-7-7-0/235785 "2020-06-05T00:59:14Z")
Hi, I would like to if it is possible to upgrade my existing Elasticsearch v6.3.0 to v7.7.0, without introducing an intermediate version? Below is the rolling upgrade link. https://www.elastic.co/guide/en/elasticsearch… --- ## [Why mapping isn't woking with python Elasticsearch?](https://discuss.elastic.co/t/why-mapping-isnt-woking-with-python-elasticsearch/235600)
**Author:** [@New\_user](https://discuss.elastic.co/u/New_user)\ **Replies:** 0\ **Last updated:** [June 3, 2020, 4:15pm UTC](https://discuss.elastic.co/t/why-mapping-isnt-woking-with-python-elasticsearch/235600 "2020-06-03T16:15:39Z")
I need to map lat, long to geo-point. I stream data every 10 seconds from a website. I get only first occurrence of the "position" from json and only I take lat, long and timestamp. I did mapping and when I run my code t… --- ## [Get the Source Data from Completion Suggest response](https://discuss.elastic.co/t/get-the-source-data-from-completion-suggest-response/235869)
**Author:** [@tedks](https://discuss.elastic.co/u/tedks)\ **Replies:** 0\ **Last updated:** [June 5, 2020, 12:16am UTC](https://discuss.elastic.co/t/get-the-source-data-from-completion-suggest-response/235869 "2020-06-05T00:16:31Z")
I am trying to use the Completion suggester for an Auto complete App. I am developing the client in Java and using "org.elasticsearch.client:elasticsearch-rest-high-level-client:7.1.0." library. is there any way to extr… --- ## [A question about dynamic templates](https://discuss.elastic.co/t/a-question-about-dynamic-templates/234544)
**Author:** [@tomeri](https://discuss.elastic.co/u/tomeri)\ **Replies:** 7\ **Last updated:** [June 4, 2020, 11:57pm UTC](https://discuss.elastic.co/t/a-question-about-dynamic-templates/234544 "2020-06-04T23:57:59Z")
Hi, I am trying to find a way to only index fields that pass some naming validation using regex, so i did this: { "dynamic\_templates": \[ { "message\_field": { "path\_match": "message", "mappin… --- ## [How to combine completion, suggestion and match phrase across multiple text fields?](https://discuss.elastic.co/t/how-to-combine-completion-suggestion-and-match-phrase-across-multiple-text-fields/235859)
**Author:** [@rpm1984](https://discuss.elastic.co/u/rpm1984)\ **Replies:** 0\ **Last updated:** [June 4, 2020, 10:58pm UTC](https://discuss.elastic.co/t/how-to-combine-completion-suggestion-and-match-phrase-across-multiple-text-fields/235859 "2020-06-04T22:58:27Z")
Hi there, as the title suggests (no pun intended!), i'm trying to combine a few things in a single Elasticsearch query. Here's a google screenshot to show what i'm trying to do: So when we start typing "can", it list… --- ## [How can I specify a GeoTile Extent in a query filter](https://discuss.elastic.co/t/how-can-i-specify-a-geotile-extent-in-a-query-filter/235852)
**Author:** [@mmu](https://discuss.elastic.co/u/mmu)\ **Replies:** 0\ **Last updated:** [June 4, 2020, 9:49pm UTC](https://discuss.elastic.co/t/how-can-i-specify-a-geotile-extent-in-a-query-filter/235852 "2020-06-04T21:49:24Z")
ES supports Geographical bounding boxes in query filters and GeoTiles (z/x/y) in aggregations. Is there a way to use a GeoTile in query filters instead of a bounding box to query all points/documents that are within the … --- ## [Delete by query for nested docs for ES version 7.x](https://discuss.elastic.co/t/delete-by-query-for-nested-docs-for-es-version-7-x/232134)
**Author:** [@sg.esearch](https://discuss.elastic.co/u/sg.esearch)\ **Replies:** 10\ **Last updated:** [June 4, 2020, 7:09pm UTC](https://discuss.elastic.co/t/delete-by-query-for-nested-docs-for-es-version-7-x/232134 "2020-06-04T19:09:57Z")
Delete-by-query is in general a bit performance intensive in ES. Would you suggest to use it for nested docs too? Also, is there some different syntax to delete-by-query when the field being queried is present only in … --- ## [Build error](https://discuss.elastic.co/t/build-error/235646)
**Author:** [@Elena\_Z](https://discuss.elastic.co/u/Elena_Z)\ **Replies:** 1\ **Last updated:** [June 4, 2020, 6:23pm UTC](https://discuss.elastic.co/t/build-error/235646 "2020-06-04T18:23:27Z")
Hey all, I am trying to build from current github source on CentOS 7.7 / openjdk 11.0.7 / docker 19.03.11 and getting the following error during "./gradlew assembly": Task :x-pack:plugin:monitoring:compileJava FAILE… --- ## [Cpu usage is -1](https://discuss.elastic.co/t/cpu-usage-is-1/235824)
**Author:** [@Julio\_Edel\_Salas\_Dia](https://discuss.elastic.co/u/Julio_Edel_Salas_Dia)\ **Replies:** 0\ **Last updated:** [June 4, 2020, 5:31pm UTC](https://discuss.elastic.co/t/cpu-usage-is-1/235824 "2020-06-04T17:31:43Z")
When consulting the use of a CP in elasticsearch 7.7.1 I get a value of -1, using the query curl -X GET "localhost:9200/\_cat/nodes?v&pretty". What can be? ip heap.percent ram.percent cpu load\_1m load\_5m load\_1… --- ## [When I have a multi-match query, what index analyzer gets applied to the query by default?](https://discuss.elastic.co/t/when-i-have-a-multi-match-query-what-index-analyzer-gets-applied-to-the-query-by-default/235811)
**Author:** [@aorona](https://discuss.elastic.co/u/aorona)\ **Replies:** 1\ **Last updated:** [June 4, 2020, 4:35pm UTC](https://discuss.elastic.co/t/when-i-have-a-multi-match-query-what-index-analyzer-gets-applied-to-the-query-by-default/235811 "2020-06-04T16:35:51Z")
I am using a multi-match query on multi-fields as follows: INDEX: "mappings": { "my\_doc": { "properties": { "content": { "type": "text", "fields": { "ngram": { … --- ## [ClusterBlockException SERVICE\_UNAVAILABLE](https://discuss.elastic.co/t/clusterblockexception-service-unavailable/235610)
**Author:** [@Tiago\_Krebs](https://discuss.elastic.co/u/Tiago_Krebs)\ **Replies:** 1\ **Last updated:** [June 4, 2020, 4:28pm UTC](https://discuss.elastic.co/t/clusterblockexception-service-unavailable/235610 "2020-06-04T16:28:36Z")
After some coordinators node left from Elastic cluster and return we start to see this erros on the logs: org.elasticsearch.cluster.block.ClusterBlockException: blocked by: \[SERVICE\_UNAVAILABLE/1/state not recovered / i… --- ## [Updating geo.location in add\_host\_metadata with beats while running](https://discuss.elastic.co/t/updating-geo-location-in-add-host-metadata-with-beats-while-running/235800)
**Author:** [@Ad3t0](https://discuss.elastic.co/u/Ad3t0)\ **Replies:** 0\ **Last updated:** [June 4, 2020, 3:47pm UTC](https://discuss.elastic.co/t/updating-geo-location-in-add-host-metadata-with-beats-while-running/235800 "2020-06-04T15:47:18Z")
Is it possible to update the geo.location metadata while a beat is running? I have it configured in my metricbeat.yml and after metricbeat runs it sends the metadata however if it were to change while running how can I s… --- ## [Use ecs with vpn server](https://discuss.elastic.co/t/use-ecs-with-vpn-server/235656)
**Author:** [@orsa](https://discuss.elastic.co/u/orsa)\ **Replies:** 4\ **Last updated:** [June 4, 2020, 3:33pm UTC](https://discuss.elastic.co/t/use-ecs-with-vpn-server/235656 "2020-06-04T15:33:59Z")
Hi, I parse Mikrotik log vpn server and and encountered difficulties in applying the ecs for some fields. Exsample: vpn session time - the total time of VPN session vpn session rx bits or packets vpn session tx bits… --- ## [Data too large, data for \[\\] - CircuitBreakingException](https://discuss.elastic.co/t/data-too-large-data-for-transport-request-circuitbreakingexception/235792)
**Author:** [@Sarath\_Pullabhotla](https://discuss.elastic.co/u/Sarath_Pullabhotla)\ **Replies:** 0\ **Last updated:** [June 4, 2020, 3:04pm UTC](https://discuss.elastic.co/t/data-too-large-data-for-transport-request-circuitbreakingexception/235792 "2020-06-04T15:04:25Z")
Hello Team, I am trying to push data from a spark dataframe to Elastic using saveToES bulk api and I am ending up with the below issue. I am using ES - 7.5.2 version. message \[failed to perform indices:data/write/bulk… --- ## [Creating a mapping when nested object has too many unique random keys](https://discuss.elastic.co/t/creating-a-mapping-when-nested-object-has-too-many-unique-random-keys/235239)
**Author:** [@jb789](https://discuss.elastic.co/u/jb789)\ **Replies:** 4\ **Last updated:** [June 4, 2020, 3:01pm UTC](https://discuss.elastic.co/t/creating-a-mapping-when-nested-object-has-too-many-unique-random-keys/235239 "2020-06-04T15:01:17Z")
Wondering how to create a mapping for the below document when the nested object key has too many unique / unknown keys in just one document. Document Link When run as dynamic mapping, I receive the following error { … --- ## [Read and index multiple CSV files](https://discuss.elastic.co/t/read-and-index-multiple-csv-files/235615)
**Author:** [@manideep](https://discuss.elastic.co/u/manideep)\ **Replies:** 1\ **Last updated:** [June 4, 2020, 2:18pm UTC](https://discuss.elastic.co/t/read-and-index-multiple-csv-files/235615 "2020-06-04T14:18:50Z")
Hi Community, I am working on a task to read multiple CSV files from path and index them in Elasticsearch. all csv files are independent of each other. I am using python. I appreciate if there are any alternate methods… --- ## [Dynamic Facets in Elasticsearch](https://discuss.elastic.co/t/dynamic-facets-in-elasticsearch/234382)
**Author:** [@manideep](https://discuss.elastic.co/u/manideep)\ **Replies:** 6\ **Last updated:** [June 4, 2020, 2:16pm UTC](https://discuss.elastic.co/t/dynamic-facets-in-elasticsearch/234382 "2020-06-04T14:16:09Z")
Hello All, how to achieve dynamic faceting functionality in elastic search? Is there a way my facets(not values inside the facets) change as per the search query? I don't want to perform aggregation on any specific fi… --- ## [How to transform input before indexing document into elastic search](https://discuss.elastic.co/t/how-to-transform-input-before-indexing-document-into-elastic-search/235769)
**Author:** [@Ajinkya\_Pathrudkar](https://discuss.elastic.co/u/Ajinkya_Pathrudkar)\ **Replies:** 1\ **Last updated:** [June 4, 2020, 2:13pm UTC](https://discuss.elastic.co/t/how-to-transform-input-before-indexing-document-into-elastic-search/235769 "2020-06-04T14:13:02Z")
Hi All, I have requirement, where I want to store the value into property after removing special characters from request. I tried using mapping-transform but its giving mapper\_parsing\_exception. Is there any way where… --- ## [Filtering using terms for function\_score in elasticsearch?](https://discuss.elastic.co/t/filtering-using-terms-for-function-score-in-elasticsearch/235051)
**Author:** [@abhijith\_chandran](https://discuss.elastic.co/u/abhijith_chandran)\ **Replies:** 1\ **Last updated:** [June 4, 2020, 2:05pm UTC](https://discuss.elastic.co/t/filtering-using-terms-for-function-score-in-elasticsearch/235051 "2020-06-04T14:05:40Z")
I am trying to filter out results of a cosine similarity using terms . This is the query I am using? { "size": 15, "query": { "function\_score": { "query": { "bool": { … --- ## [Is elastic contains two different memory?](https://discuss.elastic.co/t/is-elastic-contains-two-different-memory/235670)
**Author:** [@gokulnath112](https://discuss.elastic.co/u/gokulnath112)\ **Replies:** 2\ **Last updated:** [June 4, 2020, 1:39pm UTC](https://discuss.elastic.co/t/is-elastic-contains-two-different-memory/235670 "2020-06-04T13:39:43Z")
Hi everyone..! Greetings...! I studied that elasticsearch is using inverted indices to perform search much faster. My doubt is that is elasticsearch contains two different memories? one for inverted indices and another … --- ## [How to solve java.lang.NoSuchFieldError: LUCENE\_7\_7\_2](https://discuss.elastic.co/t/how-to-solve-java-lang-nosuchfielderror-lucene-7-7-2/235533)
**Author:** [@apar](https://discuss.elastic.co/u/apar)\ **Replies:** 2\ **Last updated:** [June 4, 2020, 1:38pm UTC](https://discuss.elastic.co/t/how-to-solve-java-lang-nosuchfielderror-lucene-7-7-2/235533 "2020-06-04T13:38:24Z")
Hi, I'm using the elasticsearch 7.6.2 and I'm trying to create an index and update the mappings in a second step. The index gets successfully created, however the mapping update fails with the following error: nested ex… --- ## [Elasticsearch date-histogram aggregations default buckets](https://discuss.elastic.co/t/elasticsearch-date-histogram-aggregations-default-buckets/235757)
**Author:** [@GuyMoses](https://discuss.elastic.co/u/GuyMoses)\ **Replies:** 0\ **Last updated:** [June 4, 2020, 12:49pm UTC](https://discuss.elastic.co/t/elasticsearch-date-histogram-aggregations-default-buckets/235757 "2020-06-04T12:49:32Z")
I am using elastic search's date\_histogram to retrieve data my query looks as follows: POST { "size": 0, "aggs": { "2": { "date\_histogram": { "field": "@timestamp", "interval": "1h" … --- ## [X- pack for elasticsearch and Kibana](https://discuss.elastic.co/t/x-pack-for-elasticsearch-and-kibana/235754)
**Author:** [@Parthey\_Khanderia](https://discuss.elastic.co/u/Parthey_Khanderia)\ **Replies:** 0\ **Last updated:** [June 4, 2020, 12:41pm UTC](https://discuss.elastic.co/t/x-pack-for-elasticsearch-and-kibana/235754 "2020-06-04T12:41:43Z")
I am trying to use ansible to deploy an ELK stack on a centos vm using docker-compose. The first part I am doing is copying the config files to the VM and then mounting it to the docker-compose from that directory. Every… --- ## [Query to determine percentage](https://discuss.elastic.co/t/query-to-determine-percentage/235752)
**Author:** [@leandroribeiro](https://discuss.elastic.co/u/leandroribeiro)\ **Replies:** 0\ **Last updated:** [June 4, 2020, 12:37pm UTC](https://discuss.elastic.co/t/query-to-determine-percentage/235752 "2020-06-04T12:37:36Z")
Hi all, I have a query that returns an aggregation for a certain term: { "\_source": \["id", "status","message"\], "query": { "bool": { "must": \[ {"exists": { "field": "status" }… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=897) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=899)