# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=920 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 921 --- ## [Antivirus Exclustions & Performance considerations](https://discuss.elastic.co/t/antivirus-exclustions-performance-considerations/232845)
**Author:** [@vladtepes](https://discuss.elastic.co/u/vladtepes)\ **Replies:** 1\ **Last updated:** [May 15, 2020, 3:00pm UTC](https://discuss.elastic.co/t/antivirus-exclustions-performance-considerations/232845 "2020-05-15T15:00:52Z")
Hi, I would like to know what is the guidance on antivirus for Elasticsearch? Which paths should be excluded and with what justification? I am writing about the 7.6.2 version on Windows. --- ## [Node loop crashing](https://discuss.elastic.co/t/node-loop-crashing/232178)
**Author:** [@jsu](https://discuss.elastic.co/u/jsu)\ **Replies:** 18\ **Last updated:** [May 15, 2020, 2:51pm UTC](https://discuss.elastic.co/t/node-loop-crashing/232178 "2020-05-15T14:51:55Z")
Hey there, So, I currently have a cluster running for timeseries with security enabled. It has 5 nodes: 1 dedicated master-eligible node, let's call it node1 2 master-elligible, data and ingest nodes, tagged hot, le… --- ## [Get document from doc\_count](https://discuss.elastic.co/t/get-document-from-doc-count/232829)
**Author:** [@Unpolygon](https://discuss.elastic.co/u/Unpolygon)\ **Replies:** 2\ **Last updated:** [May 15, 2020, 2:22pm UTC](https://discuss.elastic.co/t/get-document-from-doc-count/232829 "2020-05-15T14:22:27Z")
Is there a way to get document after composite aggregation? Assume after I aggregated and I get doc\_count = 5. I want to know these 5 documents in doc\_count because I have to analyze these documents. --- ## [Watcher notifications on Slack in Docker env](https://discuss.elastic.co/t/watcher-notifications-on-slack-in-docker-env/232840)
**Author:** [@maadhav](https://discuss.elastic.co/u/maadhav)\ **Replies:** 0\ **Last updated:** [May 15, 2020, 2:18pm UTC](https://discuss.elastic.co/t/watcher-notifications-on-slack-in-docker-env/232840 "2020-05-15T14:18:50Z")
Hi Team I am using Docker concept for ELK setup using v7.6.2. I want to configure slack notifications for watcher. Following is my docker-compose.yml file: version: '3.1' services: es01: image: docker.elastic.co/… --- ## [Would rolling restart cause continuous bulk data lost?](https://discuss.elastic.co/t/would-rolling-restart-cause-continuous-bulk-data-lost/232739)
**Author:** [@hackerwin7](https://discuss.elastic.co/u/hackerwin7)\ **Replies:** 8\ **Last updated:** [May 15, 2020, 2:09pm UTC](https://discuss.elastic.co/t/would-rolling-restart-cause-continuous-bulk-data-lost/232739 "2020-05-15T14:09:20Z")
Hi, According to this if default settings is only 1 primary shard is active, when rolling restart, the indexing write primary shard is down. primary have latest data, replicas haven't sync these latest data, when rolli… --- ## [How to use SLM to do snapshots ignoring hot and warm indices](https://discuss.elastic.co/t/how-to-use-slm-to-do-snapshots-ignoring-hot-and-warm-indices/232834)
**Author:** [@Robert\_Vilvert](https://discuss.elastic.co/u/Robert_Vilvert)\ **Replies:** 0\ **Last updated:** [May 15, 2020, 1:46pm UTC](https://discuss.elastic.co/t/how-to-use-slm-to-do-snapshots-ignoring-hot-and-warm-indices/232834 "2020-05-15T13:46:32Z")
Hi! I would like to know if it's possible to ignore my hot and warm indices on SLM. Could be something like ignoring some days too. Hot retention is already 7 days and warm 30 days, Can I make a policy like following pat… --- ## [Filter Machine learning job](https://discuss.elastic.co/t/filter-machine-learning-job/232765)
**Author:** [@ElasticLiver](https://discuss.elastic.co/u/ElasticLiver)\ **Replies:** 1\ **Last updated:** [May 15, 2020, 1:24pm UTC](https://discuss.elastic.co/t/filter-machine-learning-job/232765 "2020-05-15T13:24:55Z")
Hi, at the beggining of a job creation, one has to select an index, I have an index with metrics of various groups of machines, like the index "CPU" will have cpu metrics of multiples groups, I was wandering if I could … --- ## [Elasticsearch cluster crash due to circuit breakdown issue](https://discuss.elastic.co/t/elasticsearch-cluster-crash-due-to-circuit-breakdown-issue/232824)
**Author:** [@Khajan\_Singh\_Bisht](https://discuss.elastic.co/u/Khajan_Singh_Bisht)\ **Replies:** 0\ **Last updated:** [May 15, 2020, 1:01pm UTC](https://discuss.elastic.co/t/elasticsearch-cluster-crash-due-to-circuit-breakdown-issue/232824 "2020-05-15T13:01:02Z")
Hi, Currently elasticsearch cluster is getting crashed and showing error related to circuit breakdown. While hitting kibana url I am getting below screen. While further debugging I found logs regarding circuit break… --- ## [Elasticsearch-keystore and docker](https://discuss.elastic.co/t/elasticsearch-keystore-and-docker/232820)
**Author:** [@maadhav](https://discuss.elastic.co/u/maadhav)\ **Replies:** 0\ **Last updated:** [May 15, 2020, 12:36pm UTC](https://discuss.elastic.co/t/elasticsearch-keystore-and-docker/232820 "2020-05-15T12:36:48Z")
Hi everyone How can we configure elastisearch-keystore in docker environment. We are using docker based architecture and all elasticsearch settings are passed as environment keys(not using elasticsearch.yml). I am tryi… --- ## [Filter for documents that only have one of possible values](https://discuss.elastic.co/t/filter-for-documents-that-only-have-one-of-possible-values/229949)
**Author:** [@gyterpena](https://discuss.elastic.co/u/gyterpena)\ **Replies:** 4\ **Last updated:** [May 15, 2020, 11:41am UTC](https://discuss.elastic.co/t/filter-for-documents-that-only-have-one-of-possible-values/229949 "2020-05-15T11:41:12Z")
I have documents/web logs that have source IP and http method(GET,POST,PUT...) I need to query list of source IPs that only did POST in specified time window. Any ideas? --- ## [Curator does not backup all index on Azure](https://discuss.elastic.co/t/curator-does-not-backup-all-index-on-azure/232773)
**Author:** [@RdrgPorto](https://discuss.elastic.co/u/RdrgPorto)\ **Replies:** 0\ **Last updated:** [May 15, 2020, 9:07am UTC](https://discuss.elastic.co/t/curator-does-not-backup-all-index-on-azure/232773 "2020-05-15T09:07:51Z")
Hi, everyone I use Curator tool in order to backup all my index on Azure. However, it only backup 46 index. On Kibana: PUT \_snapshot/azure { "type": "azure", "settings": { "container": "container-name-azure", … --- ## [Access to max\_score result property in elasticsearch result in script sorting](https://discuss.elastic.co/t/access-to-max-score-result-property-in-elasticsearch-result-in-script-sorting/232806)
**Author:** [@111338](https://discuss.elastic.co/u/111338)\ **Replies:** 0\ **Last updated:** [May 15, 2020, 11:35am UTC](https://discuss.elastic.co/t/access-to-max-score-result-property-in-elasticsearch-result-in-script-sorting/232806 "2020-05-15T11:35:05Z")
I have es query for search, like this { "track\_scores": true, "query": { "bool": { "must": \[ \, \, \] } and I got result l… --- ## [Retrieving sorted documents from large index](https://discuss.elastic.co/t/retrieving-sorted-documents-from-large-index/228499)
**Author:** [@itsash](https://discuss.elastic.co/u/itsash)\ **Replies:** 0\ **Last updated:** [April 17, 2020, 11:18am UTC](https://discuss.elastic.co/t/retrieving-sorted-documents-from-large-index/228499 "2020-04-17T11:18:37Z")
(topic withdrawn by author, will be automatically deleted in 24 hours unless flagged) --- ## [Convert timestamp formats in array of objects in a Nested Field](https://discuss.elastic.co/t/convert-timestamp-formats-in-array-of-objects-in-a-nested-field/232802)
**Author:** [@ckough](https://discuss.elastic.co/u/ckough)\ **Replies:** 0\ **Last updated:** [May 15, 2020, 11:16am UTC](https://discuss.elastic.co/t/convert-timestamp-formats-in-array-of-objects-in-a-nested-field/232802 "2020-05-15T11:16:57Z")
Hi There, I have an index that looks like so: { "\_index": "ec2\_logs-index-2020.05.11", "\_type": "\_doc", "\_id": "V3LAAnIBk2krYRHTuxCC", "\_version": 1, "\_score": null, "\_source": { "owner": "104115521938"… --- ## [Cannot save to ElasticSearch via NLog](https://discuss.elastic.co/t/cannot-save-to-elasticsearch-via-nlog/232790)
**Author:** [@persepherone](https://discuss.elastic.co/u/persepherone)\ **Replies:** 2\ **Last updated:** [May 15, 2020, 10:47am UTC](https://discuss.elastic.co/t/cannot-save-to-elasticsearch-via-nlog/232790 "2020-05-15T10:47:59Z")
I have a password protected ElasticSearch instance. When i try to use NLog.Targets.ElasticSearch in my .net core 3.1 application to directly save logs to Elastic search. I am getting error. my Log .config file is as fol… --- ## [Duplicate keyword problem](https://discuss.elastic.co/t/duplicate-keyword-problem/232796)
**Author:** [@bigshark](https://discuss.elastic.co/u/bigshark)\ **Replies:** 0\ **Last updated:** [May 15, 2020, 10:47am UTC](https://discuss.elastic.co/t/duplicate-keyword-problem/232796 "2020-05-15T10:47:37Z")
Hi everyone, I have a trouble with Elastic search. Let's say I have about 1 millions articles. Within them, there are about 100k articles talk about Corona virus. The thing is when lecturers and students search for "cor… --- ## [Copy single field from one index to another existing index](https://discuss.elastic.co/t/copy-single-field-from-one-index-to-another-existing-index/232794)
**Author:** [@thekozak](https://discuss.elastic.co/u/thekozak)\ **Replies:** 0\ **Last updated:** [May 15, 2020, 10:39am UTC](https://discuss.elastic.co/t/copy-single-field-from-one-index-to-another-existing-index/232794 "2020-05-15T10:39:48Z")
Is it possible to take a field from one index and copy it to another existing index without loosing fields it already contains? For example I have an index abc having fields field\_a, field\_b, field\_c and index def havin… --- ## [Blue/Green Deployment to 7.7](https://discuss.elastic.co/t/blue-green-deployment-to-7-7/232780)
**Author:** [@spike83](https://discuss.elastic.co/u/spike83)\ **Replies:** 4\ **Last updated:** [May 15, 2020, 10:25am UTC](https://discuss.elastic.co/t/blue-green-deployment-to-7-7/232780 "2020-05-15T10:25:56Z")
Hi, I'm running a 3 node cluster running 1 shard 2 replica for most indexes. Is it possible to carry out a Blue/Green deployment type upgrade to Elasticsearch whereby I shutdown a node and bring up a brand new node on 7… --- ## [.keyword field not filled?](https://discuss.elastic.co/t/keyword-field-not-filled/232778)
**Author:** [@Tuckson](https://discuss.elastic.co/u/Tuckson)\ **Replies:** 0\ **Last updated:** [May 15, 2020, 9:19am UTC](https://discuss.elastic.co/t/keyword-field-not-filled/232778 "2020-05-15T09:19:23Z")
Hi folks, Running elk 6.7 here. I have these indexes. 2 from different applications. These applications use the same logstash cluster and this goes to the same elastic coördinating node. Now I have these 2 indexes, le… --- ## [Elasticsearch6.2.1 remove field](https://discuss.elastic.co/t/elasticsearch6-2-1-remove-field/232558)
**Author:** [@jerry-chen-315](https://discuss.elastic.co/u/jerry-chen-315)\ **Replies:** 3\ **Last updated:** [May 15, 2020, 9:36am UTC](https://discuss.elastic.co/t/elasticsearch6-2-1-remove-field/232558 "2020-05-15T09:36:43Z")
Is there any method remove field from some docs when don't know doc id or don't specified doc id? Like higher version provide delete\_by\_query API. --- ## [Behavior of a failed snapshot restoration](https://discuss.elastic.co/t/behavior-of-a-failed-snapshot-restoration/232775)
**Author:** [@J3rem1e](https://discuss.elastic.co/u/J3rem1e)\ **Replies:** 0\ **Last updated:** [May 15, 2020, 9:10am UTC](https://discuss.elastic.co/t/behavior-of-a-failed-snapshot-restoration/232775 "2020-05-15T09:10:36Z")
Hello, I have two ES clusters X & Y. One of this cluster (Y) is "read only", and I periodically synchronize this cluster by restoring a snapshot made in the first cluster (X). The restoration is done through a HTTP rem… --- ## [Problem when reindex a 8G index](https://discuss.elastic.co/t/problem-when-reindex-a-8g-index/232592)
**Author:** [@lizhu](https://discuss.elastic.co/u/lizhu)\ **Replies:** 3\ **Last updated:** [May 14, 2020, 5:16pm UTC](https://discuss.elastic.co/t/problem-when-reindex-a-8g-index/232592 "2020-05-14T17:16:09Z")
I have a 8G 、336408 docs index which have 5 pri and 1 rep, and want to reindex it. my command is POST \:9200/\_reindex?scroll=120m&timeout=120m&requests\_per\_second=10 { "source": { "index": "pcom", "si… --- ## [Transforms API not admitting triple quotes](https://discuss.elastic.co/t/transforms-api-not-admitting-triple-quotes/232681)
**Author:** [@Xavier\_Marti\_Bofill](https://discuss.elastic.co/u/Xavier_Marti_Bofill)\ **Replies:** 4\ **Last updated:** [May 15, 2020, 8:11am UTC](https://discuss.elastic.co/t/transforms-api-not-admitting-triple-quotes/232681 "2020-05-15T08:11:51Z")
We are trying to create a transform using painless scripts for aggregations, such as explained here. In Kibana's dev tools, we use Transforms Preview and it works wonderfully. However, whenever we want to post the tran… --- ## [Timestamp in ElasticSearch and Kibana](https://discuss.elastic.co/t/timestamp-in-elasticsearch-and-kibana/232233)
**Author:** [@Mateusz\_Koper](https://discuss.elastic.co/u/Mateusz_Koper)\ **Replies:** 7\ **Last updated:** [May 15, 2020, 7:15am UTC](https://discuss.elastic.co/t/timestamp-in-elasticsearch-and-kibana/232233 "2020-05-15T07:15:04Z")
Hello. We have an issue within our organization, with the timestamp in Kibana. Our Orchestrator is connected to ElasticSearch and the whole view of our Robot’s run we have in Kibana. The problem is that log messages f… --- ## [Max 20 Million Documents?](https://discuss.elastic.co/t/max-20-million-documents/232698)
**Author:** [@cawoodm](https://discuss.elastic.co/u/cawoodm)\ **Replies:** 2\ **Last updated:** [May 15, 2020, 7:08am UTC](https://discuss.elastic.co/t/max-20-million-documents/232698 "2020-05-15T07:08:41Z")
I have indexed around 30-40 million documents to my ElasticSearch with the Bulk API and providing no \_id field. I noticed that the count of docs according to /\_cat/indices is fixed at 20'000'000 even after a refresh. It… --- ## [How to run multiple elasticsearch nodes in same server with rpm package?](https://discuss.elastic.co/t/how-to-run-multiple-elasticsearch-nodes-in-same-server-with-rpm-package/232652)
**Author:** [@rohitarora275](https://discuss.elastic.co/u/rohitarora275)\ **Replies:** 3\ **Last updated:** [May 15, 2020, 6:16am UTC](https://discuss.elastic.co/t/how-to-run-multiple-elasticsearch-nodes-in-same-server-with-rpm-package/232652 "2020-05-15T06:16:54Z")
Hi All, We are trying to run multiple Elasticsearch nodes like (master node, coordinating node and data node) on the same server , we have installed rpm package and updated the configuration in /etc/elasticsearch/elasti… --- ## [Compare fields' value in es query dsl](https://discuss.elastic.co/t/compare-fields-value-in-es-query-dsl/232758)
**Author:** [@Leslie\_xxx](https://discuss.elastic.co/u/Leslie_xxx)\ **Replies:** 1\ **Last updated:** [May 15, 2020, 6:10am UTC](https://discuss.elastic.co/t/compare-fields-value-in-es-query-dsl/232758 "2020-05-15T06:10:42Z")
ES： v7.6 About es query dsl. When I use script, it doesn't work: script: { "source": "doc\[a.aa\].value == doc\[b.bb.bbb\]" } It's the wrong way, so what should I do? Thanks? --- ## [Elasticsearch ODBC - multiple hosts setup](https://discuss.elastic.co/t/elasticsearch-odbc-multiple-hosts-setup/232011)
**Author:** [@saif3r](https://discuss.elastic.co/u/saif3r)\ **Replies:** 2\ **Last updated:** [May 15, 2020, 6:10am UTC](https://discuss.elastic.co/t/elasticsearch-odbc-multiple-hosts-setup/232011 "2020-05-15T06:10:10Z")
Hello, I'm about to configure my connection to Elasticsearch using ODBC. One of the fields to fill is related to host address. My cluster currently consists of 3 hosts. Is there a way to setup all of them in the hosts l… --- ## [How to setup cluster with 2 Nodes with same index with different data](https://discuss.elastic.co/t/how-to-setup-cluster-with-2-nodes-with-same-index-with-different-data/232752)
**Author:** [@Abhijit\_Desai](https://discuss.elastic.co/u/Abhijit_Desai)\ **Replies:** 5\ **Last updated:** [May 15, 2020, 5:51am UTC](https://discuss.elastic.co/t/how-to-setup-cluster-with-2-nodes-with-same-index-with-different-data/232752 "2020-05-15T05:51:40Z")
I have 2 nodes - same index but have different data date wise as. What is the configuration of the nodes so that I can get both data from cluster url Where Node 1 - contains 2018 year data node 2 - contains 2019 year d… --- ## [Elasticsearch log duplicates into Console and RollingFile](https://discuss.elastic.co/t/elasticsearch-log-duplicates-into-console-and-rollingfile/232614)
**Author:** [@dbakti7](https://discuss.elastic.co/u/dbakti7)\ **Replies:** 4\ **Last updated:** [May 15, 2020, 5:43am UTC](https://discuss.elastic.co/t/elasticsearch-log-duplicates-into-console-and-rollingfile/232614 "2020-05-15T05:43:04Z")
Hi, all! We have some issues whereby log size grows without limit for console logs. From logging config, seems like ES defines 2 rootLogger (console and file) and respectively 2 settings for appenders for each of them. … [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=919) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=921)