# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=913 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 914 --- ## [Combine multiple document into one document with limited Fields ( merging of documents )](https://discuss.elastic.co/t/combine-multiple-document-into-one-document-with-limited-fields-merging-of-documents/231758)
**Author:** [@ramakrushna.sahu](https://discuss.elastic.co/u/ramakrushna.sahu)\ **Replies:** 8\ **Last updated:** [May 22, 2020, 3:33am UTC](https://discuss.elastic.co/t/combine-multiple-document-into-one-document-with-limited-fields-merging-of-documents/231758 "2020-05-22T03:33:34Z")
Combine multiple documents into one document I have a few documents, for example, 3 documents Document - 1 { ... test: "a" ... } Document - 2 { ... test: "b" ... } Document - 3 { ... test: "c" ... } =… --- ## [Significance of two phases - "query then fetch" with default number of shards as 1](https://discuss.elastic.co/t/significance-of-two-phases-query-then-fetch-with-default-number-of-shards-as-1/233789)
**Author:** [@nages](https://discuss.elastic.co/u/nages)\ **Replies:** 3\ **Last updated:** [May 22, 2020, 2:59am UTC](https://discuss.elastic.co/t/significance-of-two-phases-query-then-fetch-with-default-number-of-shards-as-1/233789 "2020-05-22T02:59:52Z")
Is there any significance for search to be executed in two phases - "query then fetch" when the default number of shards as 1 ( starting from 7.x ) ? leaving the cases of considering replicas --- ## [Setting index false increases the index storage size](https://discuss.elastic.co/t/setting-index-false-increases-the-index-storage-size/232324)
**Author:** [@thinkshard](https://discuss.elastic.co/u/thinkshard)\ **Replies:** 10\ **Last updated:** [May 22, 2020, 3:05am UTC](https://discuss.elastic.co/t/setting-index-false-increases-the-index-storage-size/232324 "2020-05-22T03:05:49Z")
Hi, In an effort to reduce document storage size, I added the index false property to several fields in my index mapping template for fields of type text, keyword and numerical types. To measure how much storage space … --- ## [Is it possible to extract data from SolarWinds in order to setup a ELK project?](https://discuss.elastic.co/t/is-it-possible-to-extract-data-from-solarwinds-in-order-to-setup-a-elk-project/233609)
**Author:** [@Gurkeerat\_Sondhi](https://discuss.elastic.co/u/Gurkeerat_Sondhi)\ **Replies:** 5\ **Last updated:** [May 22, 2020, 12:43am UTC](https://discuss.elastic.co/t/is-it-possible-to-extract-data-from-solarwinds-in-order-to-setup-a-elk-project/233609 "2020-05-22T00:43:25Z")
I have a Solarwinds setup done. I want to extract data from Solarwinds and then push it to Elastic-Search so that I can make a dashboard for it in Kibana. How should I go about it? Should I look into calling the REST Ap… --- ## [Elasticsearch - Plain-text search](https://discuss.elastic.co/t/elasticsearch-plain-text-search/233275)
**Author:** [@Julien1](https://discuss.elastic.co/u/Julien1)\ **Replies:** 8\ **Last updated:** [May 22, 2020, 12:40am UTC](https://discuss.elastic.co/t/elasticsearch-plain-text-search/233275 "2020-05-22T00:40:17Z")
Hello, I'm working on an index on which I want to do plain-text search in several strings : for example, for 2 documents Doc 1 : strings "This is an example" and "another example" Doc 2 : strings "This is an test" an… --- ## [What nodes should we give while connecting to ES cluster from java client](https://discuss.elastic.co/t/what-nodes-should-we-give-while-connecting-to-es-cluster-from-java-client/233826)
**Author:** [@pinakinab](https://discuss.elastic.co/u/pinakinab)\ **Replies:** 0\ **Last updated:** [May 22, 2020, 12:02am UTC](https://discuss.elastic.co/t/what-nodes-should-we-give-while-connecting-to-es-cluster-from-java-client/233826 "2020-05-22T00:02:38Z")
We are using elasticsearch with following topology: Dedicated master nodes: 3 Dedicated data nodes: 6 ES JAVA clients: 6 While connecting to ES cluster from a java client program, we provide comma separated data host… --- ## [Newb crypto source question](https://discuss.elastic.co/t/newb-crypto-source-question/233822)
**Author:** [@KPeirce](https://discuss.elastic.co/u/KPeirce)\ **Replies:** 0\ **Last updated:** [May 21, 2020, 11:07pm UTC](https://discuss.elastic.co/t/newb-crypto-source-question/233822 "2020-05-21T23:07:41Z")
I have looked at the code and searched for netty in the hopes of finding a bind for the TLS stack. I suspect that Elastic is leveraging the Java crypto library. Is that correct? Does Elastic leverage an existing TLS sta… --- ## [Additional data to be processed and displayed in ELK](https://discuss.elastic.co/t/additional-data-to-be-processed-and-displayed-in-elk/233812)
**Author:** [@ManuelF](https://discuss.elastic.co/u/ManuelF)\ **Replies:** 0\ **Last updated:** [May 21, 2020, 8:59pm UTC](https://discuss.elastic.co/t/additional-data-to-be-processed-and-displayed-in-elk/233812 "2020-05-21T20:59:57Z")
Running ELK 6.8.8 on premises Hi, I was not sure if this topic would fit better in Logstash or Kibana, so I decided ELK, which is above both. Please forgive me if this should go to a different section. I am looking f… --- ## [Curator Configuration](https://discuss.elastic.co/t/curator-configuration/233778)
**Author:** [@Dev\_Chakraborty](https://discuss.elastic.co/u/Dev_Chakraborty)\ **Replies:** 3\ **Last updated:** [May 21, 2020, 8:08pm UTC](https://discuss.elastic.co/t/curator-configuration/233778 "2020-05-21T20:08:18Z")
Hello, I have a query regarding curator setup, I have successfully setup my curator, I could see for master\_only, it says \[In some situations, primarily with automated deployments, it makes sense to install Curator on e… --- ## [Kibana 7.7.0 Basic version: management tab missing Security panel when started from docker](https://discuss.elastic.co/t/kibana-7-7-0-basic-version-management-tab-missing-security-panel-when-started-from-docker/233412)
**Author:** [@jimisdrpc](https://discuss.elastic.co/u/jimisdrpc)\ **Replies:** 26\ **Last updated:** [May 21, 2020, 6:38pm UTC](https://discuss.elastic.co/t/kibana-7-7-0-basic-version-management-tab-missing-security-panel-when-started-from-docker/233412 "2020-05-21T18:38:02Z")
I can't find Security under Kibana 7.7 when I pull it from docker instead of downloading and installing manually Kibana. I posted same question in (https://stackoverflow.com/questions/61900546/kibana-7-7-0-basic-version-… --- ## [Getting Elstack to work with Filebeat?](https://discuss.elastic.co/t/getting-elstack-to-work-with-filebeat/231572)
**Author:** [@Forcep](https://discuss.elastic.co/u/Forcep)\ **Replies:** 1\ **Last updated:** [May 21, 2020, 6:25pm UTC](https://discuss.elastic.co/t/getting-elstack-to-work-with-filebeat/231572 "2020-05-21T18:25:07Z")
Hi, I hade problems to get my existing Elastic enviroment running so downloaded and tried a fresh version. I do however still got problem. After starting Elastic and Kibana I can brows Kibana. I then run the Filebeat … --- ## [Elastic 7.7.0 too many requests with one request!](https://discuss.elastic.co/t/elastic-7-7-0-too-many-requests-with-one-request/233417)
**Author:** [@staticdev](https://discuss.elastic.co/u/staticdev)\ **Replies:** 3\ **Last updated:** [May 21, 2020, 6:02pm UTC](https://discuss.elastic.co/t/elastic-7-7-0-too-many-requests-with-one-request/233417 "2020-05-21T18:02:01Z")
I am developing an application using elasticsearch 7.7.0 image from docker (docker.elastic.co/elasticsearch/elasticsearch:7.7.0) with single node. Configs: - cluster.name=log - bootstrap.memory\_lock=true - "ES\_JAV… --- ## [Elastic search pagination on top hits](https://discuss.elastic.co/t/elastic-search-pagination-on-top-hits/233777)
**Author:** [@hariskhalique](https://discuss.elastic.co/u/hariskhalique)\ **Replies:** 0\ **Last updated:** [May 21, 2020, 4:55pm UTC](https://discuss.elastic.co/t/elastic-search-pagination-on-top-hits/233777 "2020-05-21T16:55:46Z")
Hi, I am looking for a way to paginate my results under "products" aggregation following is my query. { "size": 0, "aggs": { "sub\_category": { "terms": { "size": 1… --- ## [Search against Index with customized routing is slow](https://discuss.elastic.co/t/search-against-index-with-customized-routing-is-slow/233358)
**Author:** [@jeffzhao](https://discuss.elastic.co/u/jeffzhao)\ **Replies:** 6\ **Last updated:** [May 21, 2020, 4:17pm UTC](https://discuss.elastic.co/t/search-against-index-with-customized-routing-is-slow/233358 "2020-05-21T16:17:07Z")
I'm trying to verify whether customized routing can improve search performance. I created two indices: the old one was indexed without routing, the new one was indexed with customized routing. Then I ran the same search… --- ## [Unable to negotiate with kerberos keytab file](https://discuss.elastic.co/t/unable-to-negotiate-with-kerberos-keytab-file/233633)
**Author:** [@lnitin12](https://discuss.elastic.co/u/lnitin12)\ **Replies:** 4\ **Last updated:** [May 21, 2020, 4:02pm UTC](https://discuss.elastic.co/t/unable-to-negotiate-with-kerberos-keytab-file/233633 "2020-05-21T16:02:02Z")
I'm unable to negotiate a user with kerberos keytab to URL i'm testing is curl --negotiate -u : https://localhost:9200/\_security/\_authenticate --verbose Although keytab user has superuser access it still shows Unauthor… --- ## [Elastic aggregation for timeline of a searched field based on timestamp](https://discuss.elastic.co/t/elastic-aggregation-for-timeline-of-a-searched-field-based-on-timestamp/231369)
**Author:** [@Pankesh\_Kumar](https://discuss.elastic.co/u/Pankesh_Kumar)\ **Replies:** 1\ **Last updated:** [May 21, 2020, 3:48pm UTC](https://discuss.elastic.co/t/elastic-aggregation-for-timeline-of-a-searched-field-based-on-timestamp/231369 "2020-05-21T15:48:20Z")
We are using elastic version: 6.8 I need help with a sample query that can solve below use case. Sample data: We have books index, that can travel in which zone a book was and when. {'zone': 'z1', book: 'book1', time… --- ## [Wildcard search does not work](https://discuss.elastic.co/t/wildcard-search-does-not-work/233016)
**Author:** [@debasisc](https://discuss.elastic.co/u/debasisc)\ **Replies:** 3\ **Last updated:** [May 21, 2020, 3:21pm UTC](https://discuss.elastic.co/t/wildcard-search-does-not-work/233016 "2020-05-21T15:21:50Z")
V7.3.2 in Windows The following command works. Note "name" is text field. GET /myindex/\_search { "query": { "match" : { "name": { "query" : "ABCD" } } … --- ## [Google-like search engine query in node.js](https://discuss.elastic.co/t/google-like-search-engine-query-in-node-js/233764)
**Author:** [@la711](https://discuss.elastic.co/u/la711)\ **Replies:** 0\ **Last updated:** [May 21, 2020, 3:21pm UTC](https://discuss.elastic.co/t/google-like-search-engine-query-in-node-js/233764 "2020-05-21T15:21:20Z")
I am trying to build a search engine like search tool, similar to Google using the node.js client of elasticsearch. Here is an example document: { title: "Audits of Alberta Energy Regulator Expose a Broken Agency", … --- ## [Elasticsearch stats aggregation corrupt float number precision](https://discuss.elastic.co/t/elasticsearch-stats-aggregation-corrupt-float-number-precision/232926)
**Author:** [@JavaDeveloper](https://discuss.elastic.co/u/JavaDeveloper)\ **Replies:** 3\ **Last updated:** [May 21, 2020, 3:18pm UTC](https://discuss.elastic.co/t/elasticsearch-stats-aggregation-corrupt-float-number-precision/232926 "2020-05-21T15:18:32Z")
Hi everyone. I'm using stats aggregation (max, min, avg) over some documents with float number fields. These float numbers are saved with two decimal point in documents (for example 69.43). But the stats aggregation ou… --- ## [Werid err: org..CircuitBreakingException: \[script\] Too many dynamic script compilations](https://discuss.elastic.co/t/werid-err-org-circuitbreakingexception-script-too-many-dynamic-script-compilations/233153)
**Author:** [@stanats](https://discuss.elastic.co/u/stanats)\ **Replies:** 3\ **Last updated:** [May 21, 2020, 3:16pm UTC](https://discuss.elastic.co/t/werid-err-org-circuitbreakingexception-script-too-many-dynamic-script-compilations/233153 "2020-05-21T15:16:52Z")
we are getting weird error : org.elasticsearch.common.breaker.CircuitBreakingException: \[script\] Too many dynamic script compilations within, max: \[75/5m\]; please use indexed, or scripts with parameters instead; this lim… --- ## [How to sum values per percentile?](https://discuss.elastic.co/t/how-to-sum-values-per-percentile/233527)
**Author:** [@Vince1](https://discuss.elastic.co/u/Vince1)\ **Replies:** 1\ **Last updated:** [May 21, 2020, 3:14pm UTC](https://discuss.elastic.co/t/how-to-sum-values-per-percentile/233527 "2020-05-21T15:14:43Z")
I have a cluster with millions of documents. Each document represents a music transaction. I want to calculate percentiles with the field price AND to sum prices by percentiles. My document looks like "\_source" : { … --- ## [Filtering indices with index.lifecycle.name removing from list](https://discuss.elastic.co/t/filtering-indices-with-index-lifecycle-name-removing-from-list/233730)
**Author:** [@Adriann](https://discuss.elastic.co/u/Adriann)\ **Replies:** 1\ **Last updated:** [May 21, 2020, 3:12pm UTC](https://discuss.elastic.co/t/filtering-indices-with-index-lifecycle-name-removing-from-list/233730 "2020-05-21T15:12:27Z")
Hello, While I was testing the curator I encounter the below problem. Curator Config Preformatted textclient: hosts: - 127.0.0.1 port: 9200 http\_auth: "elastic:elastic" url\_prefix… --- ## [Elasticsearch log level settings](https://discuss.elastic.co/t/elasticsearch-log-level-settings/233734)
**Author:** [@RAM\_NATHAN](https://discuss.elastic.co/u/RAM_NATHAN)\ **Replies:** 0\ **Last updated:** [May 21, 2020, 12:10pm UTC](https://discuss.elastic.co/t/elasticsearch-log-level-settings/233734 "2020-05-21T12:10:10Z")
Hi There are lot of configurations in log4j properties. I'm using logstash to insert records to elasticsearch and I need to log those. Where should I enable log in elasticsearch? what is logging hierarchy in this case? … --- ## [How to filter elastic search document based on overflowing hour range?](https://discuss.elastic.co/t/how-to-filter-elastic-search-document-based-on-overflowing-hour-range/233751)
**Author:** [@f3l1xss](https://discuss.elastic.co/u/f3l1xss)\ **Replies:** 0\ **Last updated:** [May 21, 2020, 2:07pm UTC](https://discuss.elastic.co/t/how-to-filter-elastic-search-document-based-on-overflowing-hour-range/233751 "2020-05-21T14:07:43Z")
I have a restaurant index which has a nested field that contains dayOfWeek, opening\_hour and closing\_hour hour\_range(HH:mm:ss). "hours": { "type": "nested" , "properties": { … --- ## [Sync local Elasticsearch index with remote Elasticsearch continuously](https://discuss.elastic.co/t/sync-local-elasticsearch-index-with-remote-elasticsearch-continuously/233708)
**Author:** [@Abolurah](https://discuss.elastic.co/u/Abolurah)\ **Replies:** 6\ **Last updated:** [May 21, 2020, 2:01pm UTC](https://discuss.elastic.co/t/sync-local-elasticsearch-index-with-remote-elasticsearch-continuously/233708 "2020-05-21T14:01:52Z")
Hi All, I have local Elasticsearch that collects a lot of data into the index lets call it eventIndex. My goal is to move this data from "localEventIndex" to the remote Elasticsearch "remoteEventIndex" index. I made s… --- ## [Daily shard reallocation](https://discuss.elastic.co/t/daily-shard-reallocation/233360)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 12\ **Last updated:** [May 21, 2020, 1:56pm UTC](https://discuss.elastic.co/t/daily-shard-reallocation/233360 "2020-05-21T13:56:43Z")
in my cluster even when I don't make any changes (zero new index introduce or deleted) daily I have 20-30 shard gets reallocating. why is that? only process going on in cluster is regular ingestion of data. using vers… --- ## [7.7 ILM Best Compression](https://discuss.elastic.co/t/7-7-ilm-best-compression/233279)
**Author:** [@probson](https://discuss.elastic.co/u/probson)\ **Replies:** 4\ **Last updated:** [May 21, 2020, 1:55pm UTC](https://discuss.elastic.co/t/7-7-ilm-best-compression/233279 "2020-05-21T13:55:00Z")
From the release notes of 7.7 there is Adding best\_compression #49974 I have upgraded to 7.7 and cannot find best compression under ILM and cannot find anything in the guides. Has thise been implemented yet? Thanks … --- ## [APM Agent Tomcat](https://discuss.elastic.co/t/apm-agent-tomcat/233747)
**Author:** [@mhr](https://discuss.elastic.co/u/mhr)\ **Replies:** 0\ **Last updated:** [May 21, 2020, 1:53pm UTC](https://discuss.elastic.co/t/apm-agent-tomcat/233747 "2020-05-21T13:53:58Z")
HI, I have install APM agent for Tomcat. Below is the setenv config. I am not getting any error in catalina.out file. Tomcat version: 8.0.39, java version:1.8.0\_20. I am not able to find my server in APM service. expo… --- ## [Email Watcher : How to Read "To :" List from Database](https://discuss.elastic.co/t/email-watcher-how-to-read-to-list-from-database/233585)
**Author:** [@RaTheDev](https://discuss.elastic.co/u/RaTheDev)\ **Replies:** 0\ **Last updated:** [May 20, 2020, 5:54pm UTC](https://discuss.elastic.co/t/email-watcher-how-to-read-to-list-from-database/233585 "2020-05-20T17:54:00Z")
I had configured the Email watcher and successfully send individual reports to different Email distribution lists. But now we have the Distribution Groups defined in our database where my client can control the lists, So… --- ## [SIEM ML Jobs Stuck | No Node Found to Open Job](https://discuss.elastic.co/t/siem-ml-jobs-stuck-no-node-found-to-open-job/233731)
**Author:** [@hpicass0](https://discuss.elastic.co/u/hpicass0)\ **Replies:** 1\ **Last updated:** [May 21, 2020, 12:30pm UTC](https://discuss.elastic.co/t/siem-ml-jobs-stuck-no-node-found-to-open-job/233731 "2020-05-21T12:30:05Z")
Hello Everyone, I hope you are safe and well I'm running a POC in Elastic Cloud, and I have an issue with ML jobs I have some jobs stuck as you see below. That's under SIEM \> Detections \> ML Job Settings They have be… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=912) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=914)