# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=940 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 941 --- ## [Is Daily-Index better than Monthly-Index](https://discuss.elastic.co/t/is-daily-index-better-than-monthly-index/229863)
**Author:** [@jeffzhao](https://discuss.elastic.co/u/jeffzhao)\ **Replies:** 5\ **Last updated:** [April 28, 2020, 1:49pm UTC](https://discuss.elastic.co/t/is-daily-index-better-than-monthly-index/229863 "2020-04-28T13:49:57Z")
Hi, My Elasticsearch index is time-based: one index per month at this scale: number of Documents: 100M Size: 125 GB The index was created with 12 shards + 2 replicas. Since the date range for most of my user's searc… --- ## [Elasticsearch 7.5 upgrade](https://discuss.elastic.co/t/elasticsearch-7-5-upgrade/230165)
**Author:** [@uk300](https://discuss.elastic.co/u/uk300)\ **Replies:** 1\ **Last updated:** [April 28, 2020, 1:43pm UTC](https://discuss.elastic.co/t/elasticsearch-7-5-upgrade/230165 "2020-04-28T13:43:37Z")
Hi, I am trying to upgrade our application to use elasticsearch 7.5.1 from 6.x. Our application updates a date field using painless script by calling updateByQuery on the RestHighLevelClient. In elasticsearch the field… --- ## [Help with improving composite aggregation search speed](https://discuss.elastic.co/t/help-with-improving-composite-aggregation-search-speed/230177)
**Author:** [@Toma\_Popov](https://discuss.elastic.co/u/Toma_Popov)\ **Replies:** 0\ **Last updated:** [April 28, 2020, 1:10pm UTC](https://discuss.elastic.co/t/help-with-improving-composite-aggregation-search-speed/230177 "2020-04-28T13:10:04Z")
Hello, Currently we are tying to aggregate quite a bit of data for one of our dashboards. For this purpose we use composite aggregations to fetch and aggregated the data. This is an index, containing data for the last… --- ## [How not to use test:framework](https://discuss.elastic.co/t/how-not-to-use-test-framework/230171)
**Author:** [@xjtushilei](https://discuss.elastic.co/u/xjtushilei)\ **Replies:** 0\ **Last updated:** [April 28, 2020, 12:42pm UTC](https://discuss.elastic.co/t/how-not-to-use-test-framework/230171 "2020-04-28T12:42:21Z")
I am writing a plug-in, and ported to the ES code repository. It is located in the plugins directory. In this way, I can easily quote ES code without referring to the jar package. I wrote this plugin using junit4 and mo… --- ## [How to get the selected fields from a search that are not under the \_source?](https://discuss.elastic.co/t/how-to-get-the-selected-fields-from-a-search-that-are-not-under-the-source/230170)
**Author:** [@sudosu](https://discuss.elastic.co/u/sudosu)\ **Replies:** 0\ **Last updated:** [April 28, 2020, 12:41pm UTC](https://discuss.elastic.co/t/how-to-get-the-selected-fields-from-a-search-that-are-not-under-the-source/230170 "2020-04-28T12:41:51Z")
Hi, I am trying to get only the fields selected from a search. I know that we can use include / exclude to select parts of \_source: But how about the fields that are not under the \_source? For example how to filter o… --- ## [Discover Can't Find Any Index Patterns](https://discuss.elastic.co/t/discover-cant-find-any-index-patterns/230157)
**Author:** [@Doug\_Murphy](https://discuss.elastic.co/u/Doug_Murphy)\ **Replies:** 0\ **Last updated:** [April 28, 2020, 12:04pm UTC](https://discuss.elastic.co/t/discover-cant-find-any-index-patterns/230157 "2020-04-28T12:04:59Z")
I have documents in an index, and a matching index pattern that was loaded from a saved object, but Discover says there are no index patterns. I can see the index patterns in the Management tab, and I can see the index … --- ## [Ingesting kafka events including headers to elastic](https://discuss.elastic.co/t/ingesting-kafka-events-including-headers-to-elastic/230155)
**Author:** [@Ujval](https://discuss.elastic.co/u/Ujval)\ **Replies:** 0\ **Last updated:** [April 28, 2020, 11:58am UTC](https://discuss.elastic.co/t/ingesting-kafka-events-including-headers-to-elastic/230155 "2020-04-28T11:58:15Z")
We need to ingest logs from kafka topic to elastic. Event published on kafka includes event header as well. Header contains useful information which we need to ingest into elastic. How to approach this? --- ## [FSCrawler: Error while crawling - Invalid UTF-8 start byte 0xb5](https://discuss.elastic.co/t/fscrawler-error-while-crawling-invalid-utf-8-start-byte-0xb5/230096)
**Author:** [@Yamini\_Shashank](https://discuss.elastic.co/u/Yamini_Shashank)\ **Replies:** 5\ **Last updated:** [April 28, 2020, 11:56am UTC](https://discuss.elastic.co/t/fscrawler-error-while-crawling-invalid-utf-8-start-byte-0xb5/230096 "2020-04-28T11:56:50Z")
Hi @dadoonet, I'v installed "fscrawler-es7-2.7-SNAPSHOT" . I'v created a PDF from MS Word with simple text. Here is a snapshot: Now i'v placed it in a folder structure such as: My configuration in yaml: --- nam… --- ## [For search query ,giving logs without searching the content using nesed query](https://discuss.elastic.co/t/for-search-query-giving-logs-without-searching-the-content-using-nesed-query/230150)
**Author:** [@vinay123](https://discuss.elastic.co/u/vinay123)\ **Replies:** 0\ **Last updated:** [April 28, 2020, 11:30am UTC](https://discuss.elastic.co/t/for-search-query-giving-logs-without-searching-the-content-using-nesed-query/230150 "2020-04-28T11:30:16Z")
Hello All, I have nested Json which is 1000 lines, i am writing a nested match query to find matching content , but i am getting logs as : \` {searchType=QUERY\_THEN\_FETCH, indices=\[jsonfile\], indicesOptions… --- ## [Comparison of Splunk vs Elastic Stack](https://discuss.elastic.co/t/comparison-of-splunk-vs-elastic-stack/230146)
**Author:** [@kelk](https://discuss.elastic.co/u/kelk)\ **Replies:** 0\ **Last updated:** [April 28, 2020, 11:15am UTC](https://discuss.elastic.co/t/comparison-of-splunk-vs-elastic-stack/230146 "2020-04-28T11:15:40Z")
We were looking into a prospective migration of Splunk to Elastic Stack for cost and efficiency. Though the Splunk platform is much matured and long running, I was looking for an equivalency document to provide to Compan… --- ## [V2.3.2 have only SNAPSHOT version](https://discuss.elastic.co/t/v2-3-2-have-only-snapshot-version/230113)
**Author:** [@yixingzhong](https://discuss.elastic.co/u/yixingzhong)\ **Replies:** 2\ **Last updated:** [April 28, 2020, 10:41am UTC](https://discuss.elastic.co/t/v2-3-2-have-only-snapshot-version/230113 "2020-04-28T10:41:33Z")
hi, i want to modify elasticsearch of v2.3.2 source code, but i cant find release version. can you help me? thanks!!! --- ## [Nest query no longer working in v7](https://discuss.elastic.co/t/nest-query-no-longer-working-in-v7/230135)
**Author:** [@adiksl](https://discuss.elastic.co/u/adiksl)\ **Replies:** 0\ **Last updated:** [April 28, 2020, 10:19am UTC](https://discuss.elastic.co/t/nest-query-no-longer-working-in-v7/230135 "2020-04-28T10:19:01Z")
I have upgraded my Elasticsearch v7 and installed the new Nest Nuget packages in dev studio but once I changed my code so it worked with Nest v7 the queries no longer return any hits. string url = "http://lo… --- ## ["Unknown key for a START\_ARRAY in in json](https://discuss.elastic.co/t/unknown-key-for-a-start-array-in-in-json/230091)
**Author:** [@vinay123](https://discuss.elastic.co/u/vinay123)\ **Replies:** 7\ **Last updated:** [April 28, 2020, 10:12am UTC](https://discuss.elastic.co/t/unknown-key-for-a-start-array-in-in-json/230091 "2020-04-28T10:12:55Z")
Hello Team , i have a large json file which has nested kind of, the start of json file has array. when i a writing a search query i am getting error as Unknown key for a START\_ARRAY parsing issue. any suggestions to… --- ## [Elasticsearch stopped and can't start again](https://discuss.elastic.co/t/elasticsearch-stopped-and-cant-start-again/230121)
**Author:** [@Goran](https://discuss.elastic.co/u/Goran)\ **Replies:** 1\ **Last updated:** [April 28, 2020, 10:01am UTC](https://discuss.elastic.co/t/elasticsearch-stopped-and-cant-start-again/230121 "2020-04-28T10:01:27Z")
Here is log: Apr 28 08:07:19 scw-fcc8a8 elasticsearch\[3388\]: 2020-04-28 08:07:18,907 main ERROR Null object returned for RollingFile in Appenders. Apr 28 08:07:19 scw-fcc8a8 elasticsearch\[3388\]: 2020-04-28 08:07:18,907 … --- ## [Unable to start elasticsearch from systemctl in centos 7.7](https://discuss.elastic.co/t/unable-to-start-elasticsearch-from-systemctl-in-centos-7-7/230025)
**Author:** [@Gauti](https://discuss.elastic.co/u/Gauti)\ **Replies:** 1\ **Last updated:** [April 28, 2020, 9:31am UTC](https://discuss.elastic.co/t/unable-to-start-elasticsearch-from-systemctl-in-centos-7-7/230025 "2020-04-28T09:31:13Z")
Hi All, I have done a fresh installation of elasticsearch 7.6.2, installation went through successfully. Only problem is i'm not able to start the elasticsearch service through systemctl But i'm able to start the servi… --- ## [The total indexation hits](https://discuss.elastic.co/t/the-total-indexation-hits/230102)
**Author:** [@Yassine\_Nifa](https://discuss.elastic.co/u/Yassine_Nifa)\ **Replies:** 1\ **Last updated:** [April 28, 2020, 9:21am UTC](https://discuss.elastic.co/t/the-total-indexation-hits/230102 "2020-04-28T09:21:46Z")
Hello, I want to know what is the max number of doc that can we store in the elasticsearch database Thank you --- ## [Change elastic user password using kibana](https://discuss.elastic.co/t/change-elastic-user-password-using-kibana/230117)
**Author:** [@Dragon9](https://discuss.elastic.co/u/Dragon9)\ **Replies:** 0\ **Last updated:** [April 28, 2020, 9:16am UTC](https://discuss.elastic.co/t/change-elastic-user-password-using-kibana/230117 "2020-04-28T09:16:45Z")
i set bootstrap passoword using enviroment variable. application work fine .but when i change password of elastic user using kibana error comes Kibana status is Red my elasticsearch yaml snippet containers: -… --- ## [Scripted Metric not considering the data from all shards . showing in different blocks](https://discuss.elastic.co/t/scripted-metric-not-considering-the-data-from-all-shards-showing-in-different-blocks/228896)
**Author:** [@anjilinga](https://discuss.elastic.co/u/anjilinga)\ **Replies:** 1\ **Last updated:** [April 28, 2020, 9:09am UTC](https://discuss.elastic.co/t/scripted-metric-not-considering-the-data-from-all-shards-showing-in-different-blocks/228896 "2020-04-28T09:09:41Z")
Hi All, I have used the below query to get the scripted metric data. but the data is displaying in different shards. Is it possible to get the data in single Array insted of multiple arrays. Query: GET act\*/\_search { … --- ## [Difference between Store and Fielddata](https://discuss.elastic.co/t/difference-between-store-and-fielddata/230114)
**Author:** [@divyangshah97](https://discuss.elastic.co/u/divyangshah97)\ **Replies:** 0\ **Last updated:** [April 28, 2020, 9:05am UTC](https://discuss.elastic.co/t/difference-between-store-and-fielddata/230114 "2020-04-28T09:05:58Z")
Hi , My question relates to the difference between store : true and fielddata :true . As per my knowledge , store : true stores the values of a particular field . Fielddata true caches values for a particular field . Do… --- ## [ElasticSearch 7 APT repository - hash sum mismatch](https://discuss.elastic.co/t/elasticsearch-7-apt-repository-hash-sum-mismatch/226365)
**Author:** [@JYG\_NAOS](https://discuss.elastic.co/u/JYG_NAOS)\ **Replies:** 7\ **Last updated:** [April 28, 2020, 8:56am UTC](https://discuss.elastic.co/t/elasticsearch-7-apt-repository-hash-sum-mismatch/226365 "2020-04-28T08:56:34Z")
Hello, Since 31th March 2020, install from https://artifacts.elastic.co/packages/7.x/apt stable/main amd64 elasticsearch amd64 7.6.2 doesn't work because of hash sum mismatch. Problem is for multiple DEB packets. I te… --- ## [Index and query performance](https://discuss.elastic.co/t/index-and-query-performance/230104)
**Author:** [@Thomas\_Ardal](https://discuss.elastic.co/u/Thomas_Ardal)\ **Replies:** 0\ **Last updated:** [April 28, 2020, 8:22am UTC](https://discuss.elastic.co/t/index-and-query-performance/230104 "2020-04-28T08:22:23Z")
I know there's a high level of "it depends" when it comes to splitting up data into indexes and shards. I still want to share some thoughts to try and find the best separation for my data. I currently have a single node… --- ## [Date parsing issue - ElasticSearch 7.6](https://discuss.elastic.co/t/date-parsing-issue-elasticsearch-7-6/229989)
**Author:** [@IanCap](https://discuss.elastic.co/u/IanCap)\ **Replies:** 1\ **Last updated:** [April 28, 2020, 8:22am UTC](https://discuss.elastic.co/t/date-parsing-issue-elasticsearch-7-6/229989 "2020-04-28T08:22:13Z")
Hi everyone, I recently migrated from ElasticSearch 6.8 to 7.6 and i have an issue with the date format I'm pushing documents to ElasticSearch with the following format : yyyy-MM-dd'T'HH:mm:ssZ I red the following li… --- ## [Feed data into the newly created index](https://discuss.elastic.co/t/feed-data-into-the-newly-created-index/229822)
**Author:** [@iammanmale](https://discuss.elastic.co/u/iammanmale)\ **Replies:** 7\ **Last updated:** [April 28, 2020, 7:53am UTC](https://discuss.elastic.co/t/feed-data-into-the-newly-created-index/229822 "2020-04-28T07:53:20Z")
I am new to ELK. I have created a new index myself. But the data is still feeding into the old index. How do i switch it to new index? --- ## [Extending storage of elasticsearch](https://discuss.elastic.co/t/extending-storage-of-elasticsearch/229307)
**Author:** [@RAM\_NATHAN](https://discuss.elastic.co/u/RAM_NATHAN)\ **Replies:** 1\ **Last updated:** [April 28, 2020, 7:52am UTC](https://discuss.elastic.co/t/extending-storage-of-elasticsearch/229307 "2020-04-28T07:52:11Z")
Hi Assume I have a storage size of 100 GB and it got filled up almost. Then I wish to extend the storage with external hard drive. Can I visualize both existing and external storage data in Kibana, means can I ask Kiban… --- ## [Setup Elasticsearch cluster on Multi-Cloud(AWS and GCP)](https://discuss.elastic.co/t/setup-elasticsearch-cluster-on-multi-cloud-aws-and-gcp/230065)
**Author:** [@Taewoo](https://discuss.elastic.co/u/Taewoo)\ **Replies:** 3\ **Last updated:** [April 28, 2020, 7:46am UTC](https://discuss.elastic.co/t/setup-elasticsearch-cluster-on-multi-cloud-aws-and-gcp/230065 "2020-04-28T07:46:44Z")
Hello? I'm newbie to Elasticsearch. I'm planning to manage Multi-Cloud logs using Elasticsearch. Some of nodes are in AWS and other nodes are in GCP. (Let's assume each public cloud's instances are in same vpc) I came… --- ## [Description for each field in Elasticsearch Index](https://discuss.elastic.co/t/description-for-each-field-in-elasticsearch-index/229659)
**Author:** [@dspatil90](https://discuss.elastic.co/u/dspatil90)\ **Replies:** 3\ **Last updated:** [April 28, 2020, 7:09am UTC](https://discuss.elastic.co/t/description-for-each-field-in-elasticsearch-index/229659 "2020-04-28T07:09:13Z")
Hello All, I am new to Elasticsearch. I wanted to create a description sub-field for each field in the index. For ex. {'properties': { 'location': { 'type': … --- ## [Creating index ~ mapping rdbms to index](https://discuss.elastic.co/t/creating-index-mapping-rdbms-to-index/230082)
**Author:** [@rajiv\_d](https://discuss.elastic.co/u/rajiv_d)\ **Replies:** 0\ **Last updated:** [April 28, 2020, 6:02am UTC](https://discuss.elastic.co/t/creating-index-mapping-rdbms-to-index/230082 "2020-04-28T06:02:26Z")
We have an existing sql data from where we kind of planning to get only aggregated entity which is bounded by key constraints which is mapped to index . Now my query , is it good to have one sql table or entity per inde… --- ## [Sync data to elastic cloud](https://discuss.elastic.co/t/sync-data-to-elastic-cloud/230078)
**Author:** [@Neha\_Nakrani912](https://discuss.elastic.co/u/Neha_Nakrani912)\ **Replies:** 0\ **Last updated:** [April 28, 2020, 5:37am UTC](https://discuss.elastic.co/t/sync-data-to-elastic-cloud/230078 "2020-04-28T05:37:33Z")
My data structure have a child-parent relationship and it’s bit complex nested structure of data so that can be nested objects to syncing raise Problem Let's say we have a parent-child relationship of has many and one t… --- ## [Elasticsearch Unknown Field, logEvents](https://discuss.elastic.co/t/elasticsearch-unknown-field-logevents/230076)
**Author:** [@ckough](https://discuss.elastic.co/u/ckough)\ **Replies:** 0\ **Last updated:** [April 28, 2020, 5:23am UTC](https://discuss.elastic.co/t/elasticsearch-unknown-field-logevents/230076 "2020-04-28T05:23:02Z")
Hi there, I'm using ELK 7.6. I am ingesting logs from S3 buckets via SQS. These S3 logs are piped using Firehose from Cloudwatch logs. I have encountered Unknown Field, logEvents, in my indices. What it contains ins… --- ## [ECS network.direction field](https://discuss.elastic.co/t/ecs-network-direction-field/229662)
**Author:** [@Saurabh\_Singh1](https://discuss.elastic.co/u/Saurabh_Singh1)\ **Replies:** 1\ **Last updated:** [April 28, 2020, 5:17am UTC](https://discuss.elastic.co/t/ecs-network-direction-field/229662 "2020-04-28T05:17:04Z")
Hi All, Can anybody help me in understanding the meaning of network.direction field in ECS ? I went through Network Fields | Elastic Common Schema (ECS) Reference \[8.11\] | Elastic Please help me with an example to un… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=939) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=941)