# Elasticsearch

**URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=922

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 923

---

## [Elasticsearch service is crashing while indexing](https://discuss.elastic.co/t/elasticsearch-service-is-crashing-while-indexing/232472)

<div class="topic-metadata">

**Author:** [@Lisahtwy](https://discuss.elastic.co/u/Lisahtwy)\
**Replies:** 5\
**Last updated:** [May 14, 2020, 10:23am UTC](https://discuss.elastic.co/t/elasticsearch-service-is-crashing-while-indexing/232472 "2020-05-14T10:23:15Z")

</div>

Hi, I am running Elasticsearch on CentOS, and to indexing the 5GB files automatically using fsCrawler commands in a python script.When I am running that script, elastic search is crashing. below is the status using sys…

---

## [Can't list snapshot in S3 repository](https://discuss.elastic.co/t/cant-list-snapshot-in-s3-repository/232583)

<div class="topic-metadata">

**Author:** [@Antoine-Leveque](https://discuss.elastic.co/u/Antoine-Leveque)\
**Replies:** 0\
**Last updated:** [May 14, 2020, 8:38am UTC](https://discuss.elastic.co/t/cant-list-snapshot-in-s3-repository/232583 "2020-05-14T08:38:59Z")

</div>

Hello ! I'm facing some issues with snapshot on an S3 compatible storage behind an nginx proxy. I don't have any error when registering the repository and i can take a snapshot : Success log on elasticsearch cluster N…

---

## [How to use aggregation when range query size is greater than 10000](https://discuss.elastic.co/t/how-to-use-aggregation-when-range-query-size-is-greater-than-10000/232579)

<div class="topic-metadata">

**Author:** [@JavaDeveloper](https://discuss.elastic.co/u/JavaDeveloper)\
**Replies:** 0\
**Last updated:** [May 14, 2020, 8:21am UTC](https://discuss.elastic.co/t/how-to-use-aggregation-when-range-query-size-is-greater-than-10000/232579 "2020-05-14T08:21:53Z")

</div>

Hi everyone. I want to create a date range query on my documents. It is possible that my user request a full day query (00:00:00 to 23:59:59) and often the result size is nearly 40000 (greater than 10000). I want to …

---

## [Field boost vs query text boost](https://discuss.elastic.co/t/field-boost-vs-query-text-boost/232305)

<div class="topic-metadata">

**Author:** [@Lalit\_Kumar](https://discuss.elastic.co/u/Lalit_Kumar)\
**Replies:** 1\
**Last updated:** [May 14, 2020, 8:20am UTC](https://discuss.elastic.co/t/field-boost-vs-query-text-boost/232305 "2020-05-14T08:20:43Z")

</div>

In elaticsearch7.x either of these queries are not working please correct me where i'm wrong. i want a search which is boosted with field and specific word in a query. query = ("winter foxˆ2" OR "summer ice") query = …

---

## [Failed to process cluster event (put-mapping) within 30s at UTC 00:00:00](https://discuss.elastic.co/t/failed-to-process-cluster-event-put-mapping-within-30s-at-utc-0000/231919)

<div class="topic-metadata">

**Author:** [@vissu](https://discuss.elastic.co/u/vissu)\
**Replies:** 4\
**Last updated:** [May 14, 2020, 7:57am UTC](https://discuss.elastic.co/t/failed-to-process-cluster-event-put-mapping-within-30s-at-utc-0000/231919 "2020-05-14T07:57:16Z")

</div>

Hi Team, every day during UTC 00:00:00 we start receiving this error( failed to process cluster event (put-mapping) within 30s ). will the mappings be put all the data nodes ?? i mean will this API hit all the data node…

---

## [Did I hit bug related to scroll and too many scroll contexts](https://discuss.elastic.co/t/did-i-hit-bug-related-to-scroll-and-too-many-scroll-contexts/230954)

<div class="topic-metadata">

**Author:** [@crs](https://discuss.elastic.co/u/crs)\
**Replies:** 1\
**Last updated:** [May 14, 2020, 7:47am UTC](https://discuss.elastic.co/t/did-i-hit-bug-related-to-scroll-and-too-many-scroll-contexts/230954 "2020-05-14T07:47:23Z")

</div>

Hi, I've probably hit bug related to scrolling feature. I'm running ES 7.6.2 and have one process iterating over all entries from one of indices. It uses scroll feature and was working fine till yesterday. Now when I'm …

---

## [Elasticsearch non loop back address data migration](https://discuss.elastic.co/t/elasticsearch-non-loop-back-address-data-migration/232536)

<div class="topic-metadata">

**Author:** [@RAM\_NATHAN](https://discuss.elastic.co/u/RAM_NATHAN)\
**Replies:** 7\
**Last updated:** [May 14, 2020, 6:08am UTC](https://discuss.elastic.co/t/elasticsearch-non-loop-back-address-data-migration/232536 "2020-05-14T06:08:17Z")

</div>

Hi I'm using localhost so far and if I'm planning to create a cluster later and if I enable network.host and cluster settings, will I lose my data as ES points to localhost:9200 so far?? Regards Ram

---

## [Collapse on nested inner hits](https://discuss.elastic.co/t/collapse-on-nested-inner-hits/232553)

<div class="topic-metadata">

**Author:** [@mekanix](https://discuss.elastic.co/u/mekanix)\
**Replies:** 0\
**Last updated:** [May 14, 2020, 6:02am UTC](https://discuss.elastic.co/t/collapse-on-nested-inner-hits/232553 "2020-05-14T06:02:33Z")

</div>

Can you do collapse on inner\_hits like this: { "query": { "bool": { "filter": \[ { "nested": { "path": "foo", "query": { "match\_all": {} }, …

---

## [What is the best way to create subquery with elasticsearch](https://discuss.elastic.co/t/what-is-the-best-way-to-create-subquery-with-elasticsearch/231623)

<div class="topic-metadata">

**Author:** [@scofield](https://discuss.elastic.co/u/scofield)\
**Replies:** 4\
**Last updated:** [May 14, 2020, 5:50am UTC](https://discuss.elastic.co/t/what-is-the-best-way-to-create-subquery-with-elasticsearch/231623 "2020-05-14T05:50:46Z")

</div>

I have an alert that is trigged every time the last record added has the field rabbitmq.queue.name == 'service\_test\_error' and the field rabbitmq.queue.messages.total.count != '0' The sql query below works for my search…

---

## [Shard sizing charts](https://discuss.elastic.co/t/shard-sizing-charts/229680)

<div class="topic-metadata">

**Author:** [@Phandora](https://discuss.elastic.co/u/Phandora)\
**Replies:** 3\
**Last updated:** [May 14, 2020, 5:27am UTC](https://discuss.elastic.co/t/shard-sizing-charts/229680 "2020-05-14T05:27:59Z")

</div>

Hello! Recently we have started to benchmark our Elasticsearch cluster using Rally. We have designed a custom workload to be able to find the desired shard size for us. We are really interested in generating a chart li…

---

## [Increasing primary shards number](https://discuss.elastic.co/t/increasing-primary-shards-number/232539)

<div class="topic-metadata">

**Author:** [@hilo21](https://discuss.elastic.co/u/hilo21)\
**Replies:** 2\
**Last updated:** [May 14, 2020, 4:58am UTC](https://discuss.elastic.co/t/increasing-primary-shards-number/232539 "2020-05-14T04:58:17Z")

</div>

Hello, I have a three nodes cluster: one dedicated master no data, and two others are data nodes one for HOT and the second one for Warm data. In my use case having replicas isn't necessary so I have one shard per index…

---

## [Search NOT working for json ingestion](https://discuss.elastic.co/t/search-not-working-for-json-ingestion/232537)

<div class="topic-metadata">

**Author:** [@richylyq](https://discuss.elastic.co/u/richylyq)\
**Replies:** 0\
**Last updated:** [May 14, 2020, 3:09am UTC](https://discuss.elastic.co/t/search-not-working-for-json-ingestion/232537 "2020-05-14T03:09:48Z")

</div>

Hi all, I have just written a script for json ingestion into elasticsearch and i have indexed my json document, but when i tried to search for certain terms, it returns this error msg which I do not know how to resolve.…

---

## [How to diagnose when indexing performance suddenly droped](https://discuss.elastic.co/t/how-to-diagnose-when-indexing-performance-suddenly-droped/232436)

<div class="topic-metadata">

**Author:** [@111336](https://discuss.elastic.co/u/111336)\
**Replies:** 2\
**Last updated:** [May 14, 2020, 2:27am UTC](https://discuss.elastic.co/t/how-to-diagnose-when-indexing-performance-suddenly-droped/232436 "2020-05-14T02:27:14Z")

</div>

Hi. I'm running a es cluster which has 50 data nodes, 20 for a logging index, 20 for a data index, 10 for other indices, and 4 coordinators and 3 master nodes. One day the indexing performance of the logging index was s…

---

## [What happens when calling reindex in the context of reindex from remote](https://discuss.elastic.co/t/what-happens-when-calling-reindex-in-the-context-of-reindex-from-remote/232528)

<div class="topic-metadata">

**Author:** [@vfiset](https://discuss.elastic.co/u/vfiset)\
**Replies:** 3\
**Last updated:** [May 14, 2020, 1:52am UTC](https://discuss.elastic.co/t/what-happens-when-calling-reindex-in-the-context-of-reindex-from-remote/232528 "2020-05-14T01:52:03Z")

</div>

In the context of reindex from remote I don’t quite get what exactly happens when the call to \_reindex? is made. Does it simply replicate the document from the source cluster to destination cluster or shards/replicas …

---

## [Reindex.remote.whitelist wildcard details](https://discuss.elastic.co/t/reindex-remote-whitelist-wildcard-details/232530)

<div class="topic-metadata">

**Author:** [@vfiset](https://discuss.elastic.co/u/vfiset)\
**Replies:** 1\
**Last updated:** [May 14, 2020, 1:47am UTC](https://discuss.elastic.co/t/reindex-remote-whitelist-wildcard-details/232530 "2020-05-14T01:47:17Z")

</div>

I don't understand quite well how does the reindex.remote.whitelist works when it comes to wildcards. Is there a way to whitelist \*:\* ? (my cluster is living on a private network) Is something like 10.\*:\* is valid ? S…

---

## [How to migrate old index from Old Server to New Server](https://discuss.elastic.co/t/how-to-migrate-old-index-from-old-server-to-new-server/232460)

<div class="topic-metadata">

**Author:** [@dattack13](https://discuss.elastic.co/u/dattack13)\
**Replies:** 5\
**Last updated:** [May 14, 2020, 1:24am UTC](https://discuss.elastic.co/t/how-to-migrate-old-index-from-old-server-to-new-server/232460 "2020-05-14T01:24:03Z")

</div>

Hi, I have one index in old elasticsearch server in 6.2.0 version (windows server) and now I am trying to move it to new server (Linux) on 7.6.2 version of elasticsearch. I tried below command to migrate my index from o…

---

## [How to build the elasitic docker images in my local to do some testing , and if there are some steps or docs](https://discuss.elastic.co/t/how-to-build-the-elasitic-docker-images-in-my-local-to-do-some-testing-and-if-there-are-some-steps-or-docs/232372)

<div class="topic-metadata">

**Author:** [@xauthulei](https://discuss.elastic.co/u/xauthulei)\
**Replies:** 7\
**Last updated:** [May 14, 2020, 1:23am UTC](https://discuss.elastic.co/t/how-to-build-the-elasitic-docker-images-in-my-local-to-do-some-testing-and-if-there-are-some-steps-or-docs/232372 "2020-05-14T01:23:55Z")

</div>

I am confuse to the docker images build, I want have try in my local and with private ID

---

## [How to check/wait until all outstanding bulk (index) operations are complete?](https://discuss.elastic.co/t/how-to-check-wait-until-all-outstanding-bulk-index-operations-are-complete/232490)

<div class="topic-metadata">

**Author:** [@redec](https://discuss.elastic.co/u/redec)\
**Replies:** 10\
**Last updated:** [May 13, 2020, 11:50pm UTC](https://discuss.elastic.co/t/how-to-check-wait-until-all-outstanding-bulk-index-operations-are-complete/232490 "2020-05-13T23:50:21Z")

</div>

Is there some way to wait for all outstanding indexing operations to complete, across the entire index? the refresh=wait\_for parameter will only wait for the documents which are modified in this query, and only on the s…

---

## [What is the best practice to install elasticsearch?](https://discuss.elastic.co/t/what-is-the-best-practice-to-install-elasticsearch/232421)

<div class="topic-metadata">

**Author:** [@Mahebub\_Sayyed](https://discuss.elastic.co/u/Mahebub_Sayyed)\
**Replies:** 1\
**Last updated:** [May 13, 2020, 11:41pm UTC](https://discuss.elastic.co/t/what-is-the-best-practice-to-install-elasticsearch/232421 "2020-05-13T23:41:14Z")

</div>

What is the best practice to install Elasticsearch is either docker based or plain VM? Are there any benefits in installing Elasticsearch on docker (container based)?

---

## [Setting passwords in elasticsearch cluster](https://discuss.elastic.co/t/setting-passwords-in-elasticsearch-cluster/232477)

<div class="topic-metadata">

**Author:** [@kawalec](https://discuss.elastic.co/u/kawalec)\
**Replies:** 1\
**Last updated:** [May 13, 2020, 11:03pm UTC](https://discuss.elastic.co/t/setting-passwords-in-elasticsearch-cluster/232477 "2020-05-13T23:03:06Z")

</div>

I have a working cluster "cluster\_name" : "elk", "status" : "green", "timed\_out" : false, "number\_of\_nodes" : 3, "number\_of\_data\_nodes" : 3, "active\_primary\_shards" : 3, "active\_shards" : 6, "relocating\_shards" :…

---

## [Unable to index data coming from filebeat to elasticsearch](https://discuss.elastic.co/t/unable-to-index-data-coming-from-filebeat-to-elasticsearch/232474)

<div class="topic-metadata">

**Author:** [@Kv\_Karthik](https://discuss.elastic.co/u/Kv_Karthik)\
**Replies:** 1\
**Last updated:** [May 13, 2020, 11:02pm UTC](https://discuss.elastic.co/t/unable-to-index-data-coming-from-filebeat-to-elasticsearch/232474 "2020-05-13T23:02:26Z")

</div>

Hi, The problem i am facing is as follows, I developed a config file for the logstash and indexed the event to elastic and everything was working as expected, but when I added file beat as the input, I am unable to ind…

---

## [Rollup - Rollover and destination index date math/patterns](https://discuss.elastic.co/t/rollup-rollover-and-destination-index-date-math-patterns/232136)

<div class="topic-metadata">

**Author:** [@Rysiu](https://discuss.elastic.co/u/Rysiu)\
**Replies:** 4\
**Last updated:** [May 13, 2020, 10:13pm UTC](https://discuss.elastic.co/t/rollup-rollover-and-destination-index-date-math-patterns/232136 "2020-05-13T22:13:41Z")

</div>

I'm trying to use the Rollover in the Rollup. According to the information: Implementation: "id": "index-data.\*", "index\_pattern": "index-data.\*", "rollup\_index": "rollup.index-data-%{+YYYY.MM}", But it does…

---

## [Accessing nested objects in a filter script](https://discuss.elastic.co/t/accessing-nested-objects-in-a-filter-script/232511)

<div class="topic-metadata">

**Author:** [@johnc1](https://discuss.elastic.co/u/johnc1)\
**Replies:** 0\
**Last updated:** [May 13, 2020, 8:34pm UTC](https://discuss.elastic.co/t/accessing-nested-objects-in-a-filter-script/232511 "2020-05-13T20:34:59Z")

</div>

Is there a way to access nested objects in a filter script? I found several relevant questions on this forum, but all are without answers. I got a mapping: "properties": { "locations": { "type": "neste…

---

## [Unable to create client connect; SSL certificate verify failed](https://discuss.elastic.co/t/unable-to-create-client-connect-ssl-certificate-verify-failed/229352)

<div class="topic-metadata">

**Author:** [@Mehak\_Bhargava](https://discuss.elastic.co/u/Mehak_Bhargava)\
**Replies:** 41\
**Last updated:** [May 13, 2020, 8:17pm UTC](https://discuss.elastic.co/t/unable-to-create-client-connect-ssl-certificate-verify-failed/229352 "2020-05-13T20:17:44Z")

</div>

I have read posts reading this issue but not sure if its a python- curator version issue here or certificate. I want no ssl\_validate but still curator throws an error while verifying the certificate. Below is the error a…

---

## [Multi match returns 1 of 2 available matches](https://discuss.elastic.co/t/multi-match-returns-1-of-2-available-matches/232510)

<div class="topic-metadata">

**Author:** [@ghost1face](https://discuss.elastic.co/u/ghost1face)\
**Replies:** 0\
**Last updated:** [May 13, 2020, 8:30pm UTC](https://discuss.elastic.co/t/multi-match-returns-1-of-2-available-matches/232510 "2020-05-13T20:30:40Z")

</div>

Hello, I've been using elastic and have recently run into a puzzling issue. I've got two records with the same first and last name and when I use a phrase prefix query for last name, only 1 returns: { "query": { …

---

## [Nested Field vs Multiple Indices](https://discuss.elastic.co/t/nested-field-vs-multiple-indices/232500)

<div class="topic-metadata">

**Author:** [@Krishna\_Boppana](https://discuss.elastic.co/u/Krishna_Boppana)\
**Replies:** 2\
**Last updated:** [May 13, 2020, 7:40pm UTC](https://discuss.elastic.co/t/nested-field-vs-multiple-indices/232500 "2020-05-13T19:40:51Z")

</div>

Hello - I am new to elastic search. I am trying to figure out the pros and cons of using nested values for a field vs using multiple indexes. A simple use case is a person has multiple addresses. There are two types of …

---

## [How to retrieve index template version number using High Level REST API](https://discuss.elastic.co/t/how-to-retrieve-index-template-version-number-using-high-level-rest-api/226473)

<div class="topic-metadata">

**Author:** [@Cat](https://discuss.elastic.co/u/Cat)\
**Replies:** 4\
**Last updated:** [May 13, 2020, 5:33pm UTC](https://discuss.elastic.co/t/how-to-retrieve-index-template-version-number-using-high-level-rest-api/226473 "2020-05-13T17:33:47Z")

</div>

I am new to elasticsearch. I am looking for example how to retrieve index template version using HLRest API. I saw some posts indicating that this is not possible?

---

## [Annotated Text Plugin: full-text queries for annotated\_text](https://discuss.elastic.co/t/annotated-text-plugin-full-text-queries-for-annotated-text/232308)

<div class="topic-metadata">

**Author:** [@JohnathanBostrom](https://discuss.elastic.co/u/JohnathanBostrom)\
**Replies:** 6\
**Last updated:** [May 13, 2020, 4:59pm UTC](https://discuss.elastic.co/t/annotated-text-plugin-full-text-queries-for-annotated-text/232308 "2020-05-13T16:59:25Z")

</div>

I would like to use a full-text query on annotated text. A similar question was asked last year, but didn't receive any responses. Just as that poster, I want to be able to do the following: if I have the annotated te…

---

## [How to partially use x-pack feature (OSS version) - Use role/user feature but not Authentication](https://discuss.elastic.co/t/how-to-partially-use-x-pack-feature-oss-version-use-role-user-feature-but-not-authentication/232486)

<div class="topic-metadata">

**Author:** [@harshilfadia](https://discuss.elastic.co/u/harshilfadia)\
**Replies:** 0\
**Last updated:** [May 13, 2020, 4:57pm UTC](https://discuss.elastic.co/t/how-to-partially-use-x-pack-feature-oss-version-use-role-user-feature-but-not-authentication/232486 "2020-05-13T16:57:50Z")

</div>

I am doing some POC on ES and Kibana 7.6.4. Please advise on below need on how to implement this. Requirement: How can I use x-pack OSS feature partially? Details: Feature I want to use: Roles & User management for …

---

## [Search API not returning all the results](https://discuss.elastic.co/t/search-api-not-returning-all-the-results/232483)

<div class="topic-metadata">

**Author:** [@labuka](https://discuss.elastic.co/u/labuka)\
**Replies:** 0\
**Last updated:** [May 13, 2020, 4:45pm UTC](https://discuss.elastic.co/t/search-api-not-returning-all-the-results/232483 "2020-05-13T16:45:12Z")

</div>

I have three indexes, all three of them share a particular key-value pair. When I do a blanket search with the api "http://localhost:9200/\_search" using the request body {"query":{ "query\_string": { "query":"city\*" …

[Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=921)

[Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=923)
