# Elasticsearch

**URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=918

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 919

---

## [How exactly does max\_query\_terms works in a MLT query](https://discuss.elastic.co/t/how-exactly-does-max-query-terms-works-in-a-mlt-query/233098)

<div class="topic-metadata">

**Author:** [@lok63](https://discuss.elastic.co/u/lok63)\
**Replies:** 1\
**Last updated:** [May 18, 2020, 4:54pm UTC](https://discuss.elastic.co/t/how-exactly-does-max-query-terms-works-in-a-mlt-query/233098 "2020-05-18T16:54:59Z")

</div>

As the official documentation states, max\_query\_terms is the MAX number of query terms that will be selected. I would like to know how this works. For example if I set max\_query\_terms = 6, then using the explain paramet…

---

## [Change url param name from 'q' to 'k'?](https://discuss.elastic.co/t/change-url-param-name-from-q-to-k/233149)

<div class="topic-metadata">

**Author:** [@bwknow](https://discuss.elastic.co/u/bwknow)\
**Replies:** 1\
**Last updated:** [May 18, 2020, 4:36pm UTC](https://discuss.elastic.co/t/change-url-param-name-from-q-to-k/233149 "2020-05-18T16:36:12Z")

</div>

I need to change q var name to k in the url request string. Is this possible? ie. ?q=xyz =\> ?k=xyz

---

## [Rollover: from Hot to Warm nodes - limit per 'max\_concurrent\_file\_chunks' and/or 'max\_bytes\_per\_sec'?](https://discuss.elastic.co/t/rollover-from-hot-to-warm-nodes-limit-per-max-concurrent-file-chunks-and-or-max-bytes-per-sec/232998)

<div class="topic-metadata">

**Author:** [@Rysiu](https://discuss.elastic.co/u/Rysiu)\
**Replies:** 5\
**Last updated:** [May 18, 2020, 4:18pm UTC](https://discuss.elastic.co/t/rollover-from-hot-to-warm-nodes-limit-per-max-concurrent-file-chunks-and-or-max-bytes-per-sec/232998 "2020-05-18T16:18:25Z")

</div>

I have hot phase indexes on certain elasticsearch nodes. Is it possible to set the index rollover data transmission rate on data flow: hot nodes =\> warm nodes? I mean, 'max\_concurrent\_file\_chunks' and/or 'max\_bytes\_per…

---

## [Analyzer for treating "." differently in different fields](https://discuss.elastic.co/t/analyzer-for-treating-differently-in-different-fields/229530)

<div class="topic-metadata">

**Author:** [@telebh](https://discuss.elastic.co/u/telebh)\
**Replies:** 4\
**Last updated:** [May 18, 2020, 3:45pm UTC](https://discuss.elastic.co/t/analyzer-for-treating-differently-in-different-fields/229530 "2020-05-18T15:45:03Z")

</div>

Hi There, We have an analyzer that leaves "." as is in the case of numeric fields (i.e. 1.4.5), but some other fields (i.e. Abstract) applying this analyzer makes us losing matching documents if Abstract contains words …

---

## [Apply security on a running cluster](https://discuss.elastic.co/t/apply-security-on-a-running-cluster/232568)

<div class="topic-metadata">

**Author:** [@Guillaume\_RENARD](https://discuss.elastic.co/u/Guillaume_RENARD)\
**Replies:** 4\
**Last updated:** [May 18, 2020, 2:56pm UTC](https://discuss.elastic.co/t/apply-security-on-a-running-cluster/232568 "2020-05-18T14:56:26Z")

</div>

Hello, I've an ELK stack 7.6.2 with logstash, an elasticsearch cluster with 3 nodes and kibana. I would like to add security but the only doc I can find always start 'from scratch' I would like to have an example on an …

---

## [Elasticsearch heap management and GC question](https://discuss.elastic.co/t/elasticsearch-heap-management-and-gc-question/233089)

<div class="topic-metadata">

**Author:** [@renzokuken](https://discuss.elastic.co/u/renzokuken)\
**Replies:** 5\
**Last updated:** [May 18, 2020, 2:24pm UTC](https://discuss.elastic.co/t/elasticsearch-heap-management-and-gc-question/233089 "2020-05-18T14:24:00Z")

</div>

Background: We have 32 ES instances running in a bare metal server, all with the same dataset replicated, and namespaced from each other (think containers). Recently we've been noticing a gradual increase in CPU load in …

---

## [Concurrency update](https://discuss.elastic.co/t/concurrency-update/233114)

<div class="topic-metadata">

**Author:** [@bobflip](https://discuss.elastic.co/u/bobflip)\
**Replies:** 1\
**Last updated:** [May 18, 2020, 2:09pm UTC](https://discuss.elastic.co/t/concurrency-update/233114 "2020-05-18T14:09:02Z")

</div>

Hi, Can you please advise if OPTIMISTIC CONCURRENCY CONTROL is needed in case, when two users update different fields in the same document concurrently? Rgds, Bob

---

## [Date Time Issue with Index](https://discuss.elastic.co/t/date-time-issue-with-index/231391)

<div class="topic-metadata">

**Author:** [@adwaitjoshi](https://discuss.elastic.co/u/adwaitjoshi)\
**Replies:** 5\
**Last updated:** [May 18, 2020, 2:01pm UTC](https://discuss.elastic.co/t/date-time-issue-with-index/231391 "2020-05-18T14:01:24Z")

</div>

when I apply a date filter, I get this error, my data is correct (when checked from individual index) Request to Elasticsearch failed: {"error":{"root\_cause":\[{"type":"parse\_exception","reason":"failed to parse date fie…

---

## [Fetching Records As Result And Haldling](https://discuss.elastic.co/t/fetching-records-as-result-and-haldling/232948)

<div class="topic-metadata">

**Author:** [@Rahul\_layall](https://discuss.elastic.co/u/Rahul_layall)\
**Replies:** 5\
**Last updated:** [May 18, 2020, 1:59pm UTC](https://discuss.elastic.co/t/fetching-records-as-result-and-haldling/232948 "2020-05-18T13:59:33Z")

</div>

GET /index\_name/\_search { "query" : { "match" : { "name": "Kumar" } } } Sir If i run this query then it will give value: \<=10,000(if this much or more than that records are there) hits: 10 To manage hi…

---

## [Best way to update and insert array](https://discuss.elastic.co/t/best-way-to-update-and-insert-array/233109)

<div class="topic-metadata">

**Author:** [@walter.franssen](https://discuss.elastic.co/u/walter.franssen)\
**Replies:** 0\
**Last updated:** [May 18, 2020, 1:02pm UTC](https://discuss.elastic.co/t/best-way-to-update-and-insert-array/233109 "2020-05-18T13:02:07Z")

</div>

Hello, I wonder wat is the best way to update a document. I want to add a value to an array and also set some meta data in one request. I have first an update statement like this: test/\_update/AaCnJ3IBeJO1gLa1SX7H { …

---

## [Elastic query count mismatching](https://discuss.elastic.co/t/elastic-query-count-mismatching/232855)

<div class="topic-metadata">

**Author:** [@rthangaraj5](https://discuss.elastic.co/u/rthangaraj5)\
**Replies:** 5\
**Last updated:** [May 18, 2020, 12:29pm UTC](https://discuss.elastic.co/t/elastic-query-count-mismatching/232855 "2020-05-18T12:29:46Z")

</div>

Hi , we have contacts index .while querying thru java we are getting Total Hits based on the No of Hits. But we want to get the counts based on contacts count inside Hits. Here we have 4 contacts .but we are getting the…

---

## [Best way to handle multiple fields with same text](https://discuss.elastic.co/t/best-way-to-handle-multiple-fields-with-same-text/233064)

<div class="topic-metadata">

**Author:** [@dbakti7](https://discuss.elastic.co/u/dbakti7)\
**Replies:** 1\
**Last updated:** [May 18, 2020, 11:04am UTC](https://discuss.elastic.co/t/best-way-to-handle-multiple-fields-with-same-text/233064 "2020-05-18T11:04:50Z")

</div>

Hi, all! We are currently trying to support search on multiple languages, but we are not indexing in all of these language fields (hence we are not using multifields). We perform language detection to figure out which …

---

## [Adding storage to ES instance hosted by elastic.co](https://discuss.elastic.co/t/adding-storage-to-es-instance-hosted-by-elastic-co/233078)

<div class="topic-metadata">

**Author:** [@idanP](https://discuss.elastic.co/u/idanP)\
**Replies:** 1\
**Last updated:** [May 18, 2020, 10:44am UTC](https://discuss.elastic.co/t/adding-storage-to-es-instance-hosted-by-elastic-co/233078 "2020-05-18T10:44:51Z")

</div>

Hi all, I created ES instance using elastic.co, I chose the HighMem instance in amazon, but it seems it has only 8gb of storage. Is it possible to add only storage without over scaling the machine? (because its stupid …

---

## [Can't get young or surviror max memory with stats/jvm](https://discuss.elastic.co/t/cant-get-young-or-surviror-max-memory-with-stats-jvm/233083)

<div class="topic-metadata">

**Author:** [@ignacio.rivas](https://discuss.elastic.co/u/ignacio.rivas)\
**Replies:** 0\
**Last updated:** [May 18, 2020, 10:31am UTC](https://discuss.elastic.co/t/cant-get-young-or-surviror-max-memory-with-stats-jvm/233083 "2020-05-18T10:31:22Z")

</div>

Hello, I had a problem monitoring my cluster with Datadog. The metrics jvm.mem.pools.young.max and jvm.mem.pools.survivor.max return a zero. The metrics for the pool old and the used mem work. I did check the stats usi…

---

## [Not enough space in ES instance](https://discuss.elastic.co/t/not-enough-space-in-es-instance/233055)

<div class="topic-metadata">

**Author:** [@idanP](https://discuss.elastic.co/u/idanP)\
**Replies:** 1\
**Last updated:** [May 18, 2020, 8:21am UTC](https://discuss.elastic.co/t/not-enough-space-in-es-instance/233055 "2020-05-18T08:21:06Z")

</div>

Hi all, I created ES instance using elastic.io, I chose the HighMem instance in amazon, but it seems it has only 8gb of storage. Is it possible to add only storage without over scaling the machine? (because its stupid …

---

## [ILM - Index node location](https://discuss.elastic.co/t/ilm-index-node-location/232982)

<div class="topic-metadata">

**Author:** [@vdelcampo](https://discuss.elastic.co/u/vdelcampo)\
**Replies:** 2\
**Last updated:** [May 18, 2020, 8:44am UTC](https://discuss.elastic.co/t/ilm-index-node-location/232982 "2020-05-18T08:44:30Z")

</div>

Hi. I´ve implemented a ILM policy to move all my indexes older than 1 day to warm nodes. How can i check which indexes are in warm nodes? I´ve checked the ilm policy with GET my\_index-\*/\_ilm/explain and the results show…

---

## [Sort based on timestamp from log](https://discuss.elastic.co/t/sort-based-on-timestamp-from-log/233065)

<div class="topic-metadata">

**Author:** [@Darshan\_Kamat](https://discuss.elastic.co/u/Darshan_Kamat)\
**Replies:** 0\
**Last updated:** [May 18, 2020, 8:32am UTC](https://discuss.elastic.co/t/sort-based-on-timestamp-from-log/233065 "2020-05-18T08:32:48Z")

</div>

I have setup Filebeat-\>ES\<-Kibana I am not using and do not wish to use Logstash. My log is as below \> 2020 May 15 02:21:03:573 GMT -0400 DEBUG but @timestamp has May 15, 2020 @ 06:21:04.343 I want t…

---

## [Sort results based on the number of highlights?](https://discuss.elastic.co/t/sort-results-based-on-the-number-of-highlights/233061)

<div class="topic-metadata">

**Author:** [@shAkur](https://discuss.elastic.co/u/shAkur)\
**Replies:** 0\
**Last updated:** [May 18, 2020, 8:21am UTC](https://discuss.elastic.co/t/sort-results-based-on-the-number-of-highlights/233061 "2020-05-18T08:21:07Z")

</div>

Is there a way to sort the search results based on the number of highlighted words per document? I'm using the highlight feature on a multi\_match search and I want to have the results with the most matching highlights o…

---

## [Context Suggester is very slow for large context set](https://discuss.elastic.co/t/context-suggester-is-very-slow-for-large-context-set/233048)

<div class="topic-metadata">

**Author:** [@raychow](https://discuss.elastic.co/u/raychow)\
**Replies:** 0\
**Last updated:** [May 18, 2020, 7:24am UTC](https://discuss.elastic.co/t/context-suggester-is-very-slow-for-large-context-set/233048 "2020-05-18T07:24:08Z")

</div>

Hi, I'm considering to use context suggester to auto complete user input, and the context is used as permission scope: PUT localhost:9200/multi\_conditions\_2?pretty Content-Type: application/json { "mappings": { …

---

## [Singel Node Opens Too Many Connections](https://discuss.elastic.co/t/singel-node-opens-too-many-connections/233040)

<div class="topic-metadata">

**Author:** [@chen-wu](https://discuss.elastic.co/u/chen-wu)\
**Replies:** 4\
**Last updated:** [May 18, 2020, 7:15am UTC](https://discuss.elastic.co/t/singel-node-opens-too-many-connections/233040 "2020-05-18T07:15:21Z")

</div>

Hello. We have an instance running in single node running on Windows. I saw that it opens a lot of connections to itself. Like: TCP 127.0.0.1:9200 127.0.0.1:52540 ESTABLISHED 21936 TCP 127.0.0…

---

## [Multi index "\_search" endpoint , how many indices can we search at a time is there any limit?](https://discuss.elastic.co/t/multi-index-search-endpoint-how-many-indices-can-we-search-at-a-time-is-there-any-limit/233035)

<div class="topic-metadata">

**Author:** [@panditb](https://discuss.elastic.co/u/panditb)\
**Replies:** 4\
**Last updated:** [May 18, 2020, 6:49am UTC](https://discuss.elastic.co/t/multi-index-search-endpoint-how-many-indices-can-we-search-at-a-time-is-there-any-limit/233035 "2020-05-18T06:49:06Z")

</div>

Hello Team, I am using multi index \_search api, which is like below, i want to know what is the limit or how many indices we can search multiple GET : http://localhost:9200/20200515,20200514,20200517/\_search As we k…

---

## [Elastic account vs personal account](https://discuss.elastic.co/t/elastic-account-vs-personal-account/232847)

<div class="topic-metadata">

**Author:** [@ErwinEnableU](https://discuss.elastic.co/u/ErwinEnableU)\
**Replies:** 4\
**Last updated:** [May 18, 2020, 6:42am UTC](https://discuss.elastic.co/t/elastic-account-vs-personal-account/232847 "2020-05-18T06:42:19Z")

</div>

On the cloud (cloud.elastic.co) we have logged in using the elastic account. Now it doesn't seem to work anymore. We can only log in using a personal account based upon an email address. Can anyone explain this, please?

---

## [Creating and loading index after Elasticsearch docker container bootstrap](https://discuss.elastic.co/t/creating-and-loading-index-after-elasticsearch-docker-container-bootstrap/231848)

<div class="topic-metadata">

**Author:** [@shekharshan](https://discuss.elastic.co/u/shekharshan)\
**Replies:** 1\
**Last updated:** [May 18, 2020, 2:40am UTC](https://discuss.elastic.co/t/creating-and-loading-index-after-elasticsearch-docker-container-bootstrap/231848 "2020-05-18T02:40:16Z")

</div>

I am doing some development for which I am using Elasticsearch 6.7 in a docker container. Every time my container starts up I have to use 'curl' commands to create the index and then index the data stored in my json file…

---

## [How to parse sub-aggregation JSON fragment of the search response?](https://discuss.elastic.co/t/how-to-parse-sub-aggregation-json-fragment-of-the-search-response/233013)

<div class="topic-metadata">

**Author:** [@mmu](https://discuss.elastic.co/u/mmu)\
**Replies:** 0\
**Last updated:** [May 17, 2020, 8:54pm UTC](https://discuss.elastic.co/t/how-to-parse-sub-aggregation-json-fragment-of-the-search-response/233013 "2020-05-17T20:54:47Z")

</div>

I have a custom parser that fails early (i.e. aborts parsing immediatey) if some elements of the response contents do not meet expected values. Failing early means that some of the responses elements are evaluated/checke…

---

## [Unable to configure elasticsearch security](https://discuss.elastic.co/t/unable-to-configure-elasticsearch-security/228752)

<div class="topic-metadata">

**Author:** [@Blason](https://discuss.elastic.co/u/Blason)\
**Replies:** 1\
**Last updated:** [May 17, 2020, 7:03pm UTC](https://discuss.elastic.co/t/unable-to-configure-elasticsearch-security/228752 "2020-05-17T19:03:28Z")

</div>

Hi Folks, I am trying to build security between elasticsearch and kibana to make SIEM detection work. However been struggling for so long. I followed lot of tutorials and generated p12 file. Here is my config file #act…

---

## [General Guidance on Updating ELK with minimum Fuss](https://discuss.elastic.co/t/general-guidance-on-updating-elk-with-minimum-fuss/232828)

<div class="topic-metadata">

**Author:** [@cawoodm](https://discuss.elastic.co/u/cawoodm)\
**Replies:** 5\
**Last updated:** [May 17, 2020, 7:02pm UTC](https://discuss.elastic.co/t/general-guidance-on-updating-elk-with-minimum-fuss/232828 "2020-05-17T19:02:43Z")

</div>

I might be missing something but ELK updates (even minor versions like 7.6.2 to 7.7) can be a real pain with much downtime. Is there a guide which explains how to upgrade? We generally download the latest version, copy d…

---

## [Deleted the indexes but the data is still there](https://discuss.elastic.co/t/deleted-the-indexes-but-the-data-is-still-there/232343)

<div class="topic-metadata">

**Author:** [@GGUERRA](https://discuss.elastic.co/u/GGUERRA)\
**Replies:** 5\
**Last updated:** [May 17, 2020, 4:21pm UTC](https://discuss.elastic.co/t/deleted-the-indexes-but-the-data-is-still-there/232343 "2020-05-17T16:21:29Z")

</div>

Hello everyone, I have the following question. Through Kibana, in the management section, specifically in Index Management, I deleted indexes. However, in the monitoring section, the indexes keep appearing and the disk s…

---

## [Date Dynamic Mapping](https://discuss.elastic.co/t/date-dynamic-mapping/232981)

<div class="topic-metadata">

**Author:** [@AsfK](https://discuss.elastic.co/u/AsfK)\
**Replies:** 3\
**Last updated:** [May 17, 2020, 3:28pm UTC](https://discuss.elastic.co/t/date-dynamic-mapping/232981 "2020-05-17T15:28:25Z")

</div>

Hello! I using ES High rest api to upload json as document, no template is provide. I want to make an index pattern by date, therefore I added a 'time' field contains time in various formats but it recognized as string…

---

## [Elastic cluster recommendation for large data set](https://discuss.elastic.co/t/elastic-cluster-recommendation-for-large-data-set/232987)

<div class="topic-metadata">

**Author:** [@Virajsl](https://discuss.elastic.co/u/Virajsl)\
**Replies:** 2\
**Last updated:** [May 17, 2020, 3:05pm UTC](https://discuss.elastic.co/t/elastic-cluster-recommendation-for-large-data-set/232987 "2020-05-17T15:05:05Z")

</div>

I'm planing to use elasticsearch for my reporting purposes. I'm very new to elasticsearch therefore looking for some advises in below areas. Scenario For reporting purposes i'm using ES. My data set roughly estimated …

---

## [Elasticsearch change state](https://discuss.elastic.co/t/elasticsearch-change-state/232937)

<div class="topic-metadata">

**Author:** [@khzied](https://discuss.elastic.co/u/khzied)\
**Replies:** 9\
**Last updated:** [May 17, 2020, 2:14pm UTC](https://discuss.elastic.co/t/elasticsearch-change-state/232937 "2020-05-17T14:14:37Z")

</div>

Hello, I'm running Elasticsearch 5.6 and when my Cluster became yellow I have these logs In master: \[2020-05-15T14:50:57,908\]\[DEBUG\]\[o.e.a.a.c.n.s.TransportNodesStatsAction\] \[node-elasticsearch\_master\_02\] failed to ex…

[Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=917)

[Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=919)
