# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=942 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 943 --- ## [Lifecycle indices with update functionality](https://discuss.elastic.co/t/lifecycle-indices-with-update-functionality/229937)
**Author:** [@thomasixo](https://discuss.elastic.co/u/thomasixo)\ **Replies:** 0\ **Last updated:** [April 27, 2020, 10:00am UTC](https://discuss.elastic.co/t/lifecycle-indices-with-update-functionality/229937 "2020-04-27T10:00:03Z")
Hello, i have an elasticsearch cluster with 3 nodes and need help / ideas for the correct index / alias / data structure. My application have different tenants, each tenant use it's own index to store their transaction… --- ## [Configuration for cluster.initial\_master\_nodes](https://discuss.elastic.co/t/configuration-for-cluster-initial-master-nodes/229754)
**Author:** [@Dev\_Chakraborty](https://discuss.elastic.co/u/Dev_Chakraborty)\ **Replies:** 10\ **Last updated:** [April 25, 2020, 3:22pm UTC](https://discuss.elastic.co/t/configuration-for-cluster-initial-master-nodes/229754 "2020-04-25T15:22:32Z")
Hello Folks, I have three nodes, 2 dedicated for Elasticsearch and one is ES+Kibana. Below is my elasticsearch.yml file,can you suggest on cluster.initial\_master\_nodes, how it should be mentioned if I want only two node… --- ## [Connect to load balancer from high level rest client](https://discuss.elastic.co/t/connect-to-load-balancer-from-high-level-rest-client/229935)
**Author:** [@AshishUser](https://discuss.elastic.co/u/AshishUser)\ **Replies:** 0\ **Last updated:** [April 27, 2020, 9:43am UTC](https://discuss.elastic.co/t/connect-to-load-balancer-from-high-level-rest-client/229935 "2020-04-27T09:43:59Z")
Hi I am trying to connect to elastic search LB URL using high level rest client but getting following error: Caused by: java.net.UnknownHostException: I was able to communicate to individual nodes do we need to do som… --- ## [Cluster update failure message (Data size issue?)](https://discuss.elastic.co/t/cluster-update-failure-message-data-size-issue/229588)
**Author:** [@Alexandros888](https://discuss.elastic.co/u/Alexandros888)\ **Replies:** 14\ **Last updated:** [April 27, 2020, 9:32am UTC](https://discuss.elastic.co/t/cluster-update-failure-message-data-size-issue/229588 "2020-04-27T09:32:33Z")
Hello, I have a 3 nodes cluster and yesterday was time for updating them. During the end of the 1st node update procedure when my cluster was at the following state: I received that message when i tried to start k… --- ## [Optional fields in custom index template](https://discuss.elastic.co/t/optional-fields-in-custom-index-template/229869)
**Author:** [@ElasticLiver](https://discuss.elastic.co/u/ElasticLiver)\ **Replies:** 1\ **Last updated:** [April 27, 2020, 2:10am UTC](https://discuss.elastic.co/t/optional-fields-in-custom-index-template/229869 "2020-04-27T02:10:55Z")
Hi, Im consuming events from logstash to elastic, I have created an index template for it, Every document will have ONE of this three fields, so if a document has "uptime\_seconds" the other fields will be empty, So I was… --- ## [Getting exception while starting the elastic search node](https://discuss.elastic.co/t/getting-exception-while-starting-the-elastic-search-node/229263)
**Author:** [@DENMODSupport](https://discuss.elastic.co/u/DENMODSupport)\ **Replies:** 5\ **Last updated:** [April 27, 2020, 7:58am UTC](https://discuss.elastic.co/t/getting-exception-while-starting-the-elastic-search-node/229263 "2020-04-27T07:58:36Z")
We are getting below exception while starting one of the elastic search nodes. \[2020-04-20T15:22:16,743\]\[ERROR\]\[o.e.g.GatewayMetaState \] \[elk-denmod-web-2\] failed to read local state, exiting... \*\*java.lang.IllegalSta… --- ## [How to access configurations pushed to opendistro security index](https://discuss.elastic.co/t/how-to-access-configurations-pushed-to-opendistro-security-index/229909)
**Author:** [@pinakinab](https://discuss.elastic.co/u/pinakinab)\ **Replies:** 1\ **Last updated:** [April 27, 2020, 6:59am UTC](https://discuss.elastic.co/t/how-to-access-configurations-pushed-to-opendistro-security-index/229909 "2020-04-27T06:59:57Z")
We are doing to POC to check if we can use opendistro securoty plugin to enable LDAP authentication in OSS version of Elasticsearch. During the process we have pushed our LDAP config to .opendistro\_security index. Howeve… --- ## [Running gradlew with two plugins](https://discuss.elastic.co/t/running-gradlew-with-two-plugins/229915)
**Author:** [@Amos\_Gutman](https://discuss.elastic.co/u/Amos_Gutman)\ **Replies:** 0\ **Last updated:** [April 27, 2020, 6:59am UTC](https://discuss.elastic.co/t/running-gradlew-with-two-plugins/229915 "2020-04-27T06:59:53Z")
HI, I want to run elastic debugging with two of my plugins. I can attach the IDE to the JAVA process with --debug-jvm. But, when running a gradle with a :plugins:\:run I cant pass two plugins to make it to… --- ## [Nested Aggregation in a Transforms Script and collect value](https://discuss.elastic.co/t/nested-aggregation-in-a-transforms-script-and-collect-value/229888)
**Author:** [@aviman](https://discuss.elastic.co/u/aviman)\ **Replies:** 0\ **Last updated:** [April 27, 2020, 3:37am UTC](https://discuss.elastic.co/t/nested-aggregation-in-a-transforms-script-and-collect-value/229888 "2020-04-27T03:37:58Z")
What is the syntax for loop through all the buckets inside the map statement Below is my aggregation code: "aggs": { "account\_agg" : { "terms": { "field": "client"}, "aggs" … --- ## [Watcher Question](https://discuss.elastic.co/t/watcher-question/229168)
**Author:** [@namar321](https://discuss.elastic.co/u/namar321)\ **Replies:** 1\ **Last updated:** [April 27, 2020, 3:21am UTC](https://discuss.elastic.co/t/watcher-question/229168 "2020-04-27T03:21:25Z")
We would like to set up a watcher to continuously compare the latest sum of values by location and alert if the latest set of values are more than two standard deviations above historical data. The following is not worki… --- ## [Security with ldap](https://discuss.elastic.co/t/security-with-ldap/228779)
**Author:** [@rwr](https://discuss.elastic.co/u/rwr)\ **Replies:** 2\ **Last updated:** [April 27, 2020, 2:10am UTC](https://discuss.elastic.co/t/security-with-ldap/228779 "2020-04-27T02:10:40Z")
can LDAP used for Elasticsearch in Free license ? thanks --- ## [Delete assign replica shards](https://discuss.elastic.co/t/delete-assign-replica-shards/229741)
**Author:** [@Ekta](https://discuss.elastic.co/u/Ekta)\ **Replies:** 7\ **Last updated:** [April 27, 2020, 1:35am UTC](https://discuss.elastic.co/t/delete-assign-replica-shards/229741 "2020-04-27T01:35:26Z")
How can I delete replica shards without harming the primary shards? I have to delete the only replica shards I am using elasticsearch version-7.6.2 Please, help me here? Thanks in advance --- ## [Search Machine Learning result and use watcher send message to telegram](https://discuss.elastic.co/t/search-machine-learning-result-and-use-watcher-send-message-to-telegram/229198)
**Author:** [@hanase](https://discuss.elastic.co/u/hanase)\ **Replies:** 1\ **Last updated:** [April 27, 2020, 1:33am UTC](https://discuss.elastic.co/t/search-machine-learning-result-and-use-watcher-send-message-to-telegram/229198 "2020-04-27T01:33:59Z")
Hi elastic community, I want to send alert message to telegram, when ML got anomalies, like 2 times higher or lower. now I create ML job and run it frequency. Then I use watcher search ML job, and send message to tel… --- ## [Kibana show elasticsearch no monitoring data , but exists index in elasticsearch and getting below error in master node](https://discuss.elastic.co/t/kibana-show-elasticsearch-no-monitoring-data-but-exists-index-in-elasticsearch-and-getting-below-error-in-master-node/229621)
**Author:** [@Asad.Anwar](https://discuss.elastic.co/u/Asad.Anwar)\ **Replies:** 0\ **Last updated:** [April 24, 2020, 10:32am UTC](https://discuss.elastic.co/t/kibana-show-elasticsearch-no-monitoring-data-but-exists-index-in-elasticsearch-and-getting-below-error-in-master-node/229621 "2020-04-24T10:32:08Z")
\[abc-Master\] exporter \[my\_remote\] failed to open exporting bulk org.elasticsearch.client.ResponseException: method \[GET\], host \[https://abc.com:9200\], URI \[/\_xpack/watcher/watch/pTjzeglAR76UMJm73OyPWw\_elasticsearch\_clus… --- ## [Converting epoch date to human date](https://discuss.elastic.co/t/converting-epoch-date-to-human-date/229749)
**Author:** [@josete242](https://discuss.elastic.co/u/josete242)\ **Replies:** 0\ **Last updated:** [April 25, 2020, 9:54am UTC](https://discuss.elastic.co/t/converting-epoch-date-to-human-date/229749 "2020-04-25T09:54:57Z")
Hi. I'm new to ELK and I'm still starting to get to know the entire stack. I am working with an index that has a field (events.startTime) is type number. i think it's epoch in milliseconds How can I convert that timest… --- ## [Cleanup after windows .msi installation](https://discuss.elastic.co/t/cleanup-after-windows-msi-installation/229791)
**Author:** [@glushkov](https://discuss.elastic.co/u/glushkov)\ **Replies:** 1\ **Last updated:** [April 26, 2020, 11:51pm UTC](https://discuss.elastic.co/t/cleanup-after-windows-msi-installation/229791 "2020-04-26T23:51:15Z")
Dear experts, I had installed ES 7.6.0 via the .msi package. I have removed it using "Add/remove programs". Now I am left with all setting left in C:\\ProgramData\\Elastic\\Elasticsearch and two dynamic environmental varia… --- ## [Max ES Query](https://discuss.elastic.co/t/max-es-query/229785)
**Author:** [@Stefano\_Bossi](https://discuss.elastic.co/u/Stefano_Bossi)\ **Replies:** 2\ **Last updated:** [April 26, 2020, 10:22pm UTC](https://discuss.elastic.co/t/max-es-query/229785 "2020-04-26T22:22:45Z")
Dear Forum, I need some help to design a query I have some difficulties. I need the maximum value of two fields (i.e. numerical ones). I have figured out by myself the max of one value with this query: { "si… --- ## [ES 7.4 GC keeps reclaiming less memory on each pass](https://discuss.elastic.co/t/es-7-4-gc-keeps-reclaiming-less-memory-on-each-pass/229547)
**Author:** [@tyler-3](https://discuss.elastic.co/u/tyler-3)\ **Replies:** 8\ **Last updated:** [April 26, 2020, 10:07pm UTC](https://discuss.elastic.co/t/es-7-4-gc-keeps-reclaiming-less-memory-on-each-pass/229547 "2020-04-26T22:07:14Z")
Hello, I recently upgraded 7.4 and I'm having a problem where the sawtooth pattern's reclaimed heap keeps shrinking (EG: Initially GC goes from 75% to 20%... but the node goes to 30%... then 40% with each additional recl… --- ## [How to get matched values from array without getting all the values in it, using a dynamic template without type nested?](https://discuss.elastic.co/t/how-to-get-matched-values-from-array-without-getting-all-the-values-in-it-using-a-dynamic-template-without-type-nested/229823)
**Author:** [@rkarthikraj](https://discuss.elastic.co/u/rkarthikraj)\ **Replies:** 4\ **Last updated:** [April 26, 2020, 4:41pm UTC](https://discuss.elastic.co/t/how-to-get-matched-values-from-array-without-getting-all-the-values-in-it-using-a-dynamic-template-without-type-nested/229823 "2020-04-26T16:41:10Z")
I tried to search inside array of object using match query but I got all the values inside the array, because the array is not of type nested. I am using dynamic template to create index. Is there any way to search si… --- ## [How to compare the cost of Search Request](https://discuss.elastic.co/t/how-to-compare-the-cost-of-search-request/228881)
**Author:** [@jeffzhao](https://discuss.elastic.co/u/jeffzhao)\ **Replies:** 2\ **Last updated:** [April 26, 2020, 4:19pm UTC](https://discuss.elastic.co/t/how-to-compare-the-cost-of-search-request/228881 "2020-04-26T16:19:57Z")
Hi, I want to optimize index settings, for example, customized \_routing parameter, to see if it can improve search performance. The problem is Elasticsearch always cache the query result, so when I run the search for th… --- ## [Create a watcher on a different watcher output/execution status](https://discuss.elastic.co/t/create-a-watcher-on-a-different-watcher-output-execution-status/229855)
**Author:** [@sai\_krishna\_bsk](https://discuss.elastic.co/u/sai_krishna_bsk)\ **Replies:** 0\ **Last updated:** [April 26, 2020, 3:59pm UTC](https://discuss.elastic.co/t/create-a-watcher-on-a-different-watcher-output-execution-status/229855 "2020-04-26T15:59:51Z")
Hi Team/ Alexander Reelsen, I want to create a watcher based on some other watcher execution status. My requirement is, whenever I send an alert (Based on some condition) to slack with "RED" color, the moment that part… --- ## [Searchable S3 Snapshots - availability?](https://discuss.elastic.co/t/searchable-s3-snapshots-availability/229527)
**Author:** [@cks](https://discuss.elastic.co/u/cks)\ **Replies:** 3\ **Last updated:** [April 26, 2020, 12:08pm UTC](https://discuss.elastic.co/t/searchable-s3-snapshots-availability/229527 "2020-04-26T12:08:59Z")
Earlier today during Elasticon East Q&A, there was discussion on object storage for storing snapshots such as in S3. Going forward there was plan to make it searchable on S3 based snapshots (new "Frozen" data tier). Is t… --- ## [Sort Based on text Position from multiple fields](https://discuss.elastic.co/t/sort-based-on-text-position-from-multiple-fields/229830)
**Author:** [@psramkumar](https://discuss.elastic.co/u/psramkumar)\ **Replies:** 0\ **Last updated:** [April 26, 2020, 9:29am UTC](https://discuss.elastic.co/t/sort-based-on-text-position-from-multiple-fields/229830 "2020-04-26T09:29:34Z")
{ "size": 100, "\_source": { "includes": \[ "id", "name", "type", "acc\_names" \] }, "query": { "match\_phrase\_prefix": { "na… --- ## [Nested query and exists query](https://discuss.elastic.co/t/nested-query-and-exists-query/229827)
**Author:** [@HaijieChen](https://discuss.elastic.co/u/HaijieChen)\ **Replies:** 0\ **Last updated:** [April 26, 2020, 9:13am UTC](https://discuss.elastic.co/t/nested-query-and-exists-query/229827 "2020-04-26T09:13:16Z")
i think first image is same as second image code , but fist can hit the target ,the second not. --- ## [Swarm of shard search requests cause Elasticsearch transport worker blocked on ClosableThreadLocal](https://discuss.elastic.co/t/swarm-of-shard-search-requests-cause-elasticsearch-transport-worker-blocked-on-closablethreadlocal/229803)
**Author:** [@hackerwin7](https://discuss.elastic.co/u/hackerwin7)\ **Replies:** 1\ **Last updated:** [April 26, 2020, 6:47am UTC](https://discuss.elastic.co/t/swarm-of-shard-search-requests-cause-elasticsearch-transport-worker-blocked-on-closablethreadlocal/229803 "2020-04-26T06:47:11Z")
Hi, version: 7.5.1 shard size: 10 we do a load test of search for a Elasticsearch cluster. we found the thread dumps indicates that many threads of transport\_worker blocked on InboundHandler.messageReceived() -\> Inbou… --- ## [Manually delete old logs/indices in ELK 7.3.0](https://discuss.elastic.co/t/manually-delete-old-logs-indices-in-elk-7-3-0/227981)
**Author:** [@mohamed.samir](https://discuss.elastic.co/u/mohamed.samir)\ **Replies:** 5\ **Last updated:** [April 26, 2020, 6:46am UTC](https://discuss.elastic.co/t/manually-delete-old-logs-indices-in-elk-7-3-0/227981 "2020-04-26T06:46:12Z")
please, how to delete old logs/indices or in ELK 7.3 before i used to use curl -GET http://localhost:9200/\_cat/indices to see old indices and delete it manually using curl -XDELETE http://localhost:9200/logstash-2020… --- ## [Query to Determine All Unique IDs that are distance X away from a particular ID?](https://discuss.elastic.co/t/query-to-determine-all-unique-ids-that-are-distance-x-away-from-a-particular-id/229813)
**Author:** [@brolo](https://discuss.elastic.co/u/brolo)\ **Replies:** 0\ **Last updated:** [April 26, 2020, 6:28am UTC](https://discuss.elastic.co/t/query-to-determine-all-unique-ids-that-are-distance-x-away-from-a-particular-id/229813 "2020-04-26T06:28:36Z")
I have data in this format generated from a random walk (to simulate people walking around). It is set up in this manner { location : { lat: someLat, lon: someLong }, id: uniqueId, date:date }. I am trying to write a que… --- ## [Issue about index lifecycle management](https://discuss.elastic.co/t/issue-about-index-lifecycle-management/228981)
**Author:** [@iammanmale](https://discuss.elastic.co/u/iammanmale)\ **Replies:** 3\ **Last updated:** [April 26, 2020, 5:08am UTC](https://discuss.elastic.co/t/issue-about-index-lifecycle-management/228981 "2020-04-26T05:08:06Z")
I am very new to ELK. I have setup kibana, elasticsearch, logstash and filebeat. Data can be received successfully and shown in kibana but I have problem with index lifecycle management. There is always error like this: … --- ## [Getting Validation Failed: 1: mapping type is missing when making a text field aggregatable](https://discuss.elastic.co/t/getting-validation-failed-1-mapping-type-is-missing-when-making-a-text-field-aggregatable/229725)
**Author:** [@karanmig12](https://discuss.elastic.co/u/karanmig12)\ **Replies:** 6\ **Last updated:** [April 25, 2020, 7:55pm UTC](https://discuss.elastic.co/t/getting-validation-failed-1-mapping-type-is-missing-when-making-a-text-field-aggregatable/229725 "2020-04-25T19:55:57Z")
I am new to Elasticsearch and using 6.7 I am trying to make a text field aggregatabe in an existing index. type": "action\_request\_validation\_exception", "reason": "Validation Failed: 1: mapping type is missing;" PUT… --- ## [DSL Query for text in quotes](https://discuss.elastic.co/t/dsl-query-for-text-in-quotes/229556)
**Author:** [@VSP](https://discuss.elastic.co/u/VSP)\ **Replies:** 5\ **Last updated:** [April 25, 2020, 5:53pm UTC](https://discuss.elastic.co/t/dsl-query-for-text-in-quotes/229556 "2020-04-25T17:53:32Z")
Hello, I have a sample message as below in log with several other messages too: {"kind":"user\_test","sts":"2020-04-23 10:26:29","uc":,"rc":"ok","errc":0} I am trying to write a query to find all the messages with a co… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=941) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=943)