# Elasticsearch

**URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=953

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 954

---

## [Elastic master node high cpu](https://discuss.elastic.co/t/elastic-master-node-high-cpu/228347)

<div class="topic-metadata">

**Author:** [@kyle\_che](https://discuss.elastic.co/u/kyle_che)\
**Replies:** 10\
**Last updated:** [April 17, 2020, 3:16am UTC](https://discuss.elastic.co/t/elastic-master-node-high-cpu/228347 "2020-04-17T03:16:44Z")

</div>

I have a cluster with 3 master nodes, 6 coordinating nodes, and 18 data nodes. the elected master node is at 95% cpu usage. I'm looking through the logs and all i see is what it has always been doing, deleting a lot of…

---

## [Calculate success count in Visualization using JSON Input](https://discuss.elastic.co/t/calculate-success-count-in-visualization-using-json-input/227752)

<div class="topic-metadata">

**Author:** [@rohitarora275](https://discuss.elastic.co/u/rohitarora275)\
**Replies:** 5\
**Last updated:** [April 16, 2020, 10:59pm UTC](https://discuss.elastic.co/t/calculate-success-count-in-visualization-using-json-input/227752 "2020-04-16T22:59:58Z")

</div>

Hi All, I am new to ELK stack, I want to implement a logic to find the count of daily success transactions on the basis of a field status(if status = "S" it is success). I have implemented this logic by creating an scr…

---

## [Transform email body response to a more readable form](https://discuss.elastic.co/t/transform-email-body-response-to-a-more-readable-form/227889)

<div class="topic-metadata">

**Author:** [@Alexandros888](https://discuss.elastic.co/u/Alexandros888)\
**Replies:** 5\
**Last updated:** [April 16, 2020, 10:22pm UTC](https://discuss.elastic.co/t/transform-email-body-response-to-a-more-readable-form/227889 "2020-04-16T22:22:18Z")

</div>

Hello, I have created the following watcher alert: { "trigger": { "schedule": { "hourly": { "minute": \[ 1, 3, 11, 16, …

---

## [Failing to run on Intellij in debug mode](https://discuss.elastic.co/t/failing-to-run-on-intellij-in-debug-mode/227805)

<div class="topic-metadata">

**Author:** [@amitkg](https://discuss.elastic.co/u/amitkg)\
**Replies:** 5\
**Last updated:** [April 16, 2020, 7:01pm UTC](https://discuss.elastic.co/t/failing-to-run-on-intellij-in-debug-mode/227805 "2020-04-16T19:01:09Z")

</div>

Hi, I followed the instruction, provided CONTRIBUTING.md and TESTING.asciidoc, to setup Elasticsearch on Intellij (macOS 10.15.4) . I was able to run it normal mode but I am unable to run it in debug mode. This worked:…

---

## [Query Plugin Performance issue](https://discuss.elastic.co/t/query-plugin-performance-issue/228391)

<div class="topic-metadata">

**Author:** [@adrik](https://discuss.elastic.co/u/adrik)\
**Replies:** 0\
**Last updated:** [April 16, 2020, 6:26pm UTC](https://discuss.elastic.co/t/query-plugin-performance-issue/228391 "2020-04-16T18:26:26Z")

</div>

Background: Every token consist of payload representing our own custom position value. Use of Custom Plugin: During processing of Term, we use the term's payload as the position. During the processing of nextDoc, we …

---

## [Garbage Collection not happening, leads to circuit breakers tripping (ES 7.5)](https://discuss.elastic.co/t/garbage-collection-not-happening-leads-to-circuit-breakers-tripping-es-7-5/228383)

<div class="topic-metadata">

**Author:** [@Jonathan\_Mendenhall](https://discuss.elastic.co/u/Jonathan_Mendenhall)\
**Replies:** 0\
**Last updated:** [April 16, 2020, 5:34pm UTC](https://discuss.elastic.co/t/garbage-collection-not-happening-leads-to-circuit-breakers-tripping-es-7-5/228383 "2020-04-16T17:34:19Z")

</div>

What we are seeing is out ES 7.5 data nodes tripping "PERMANENT" circuit breakers after running a few fairly simple queries, that the exact same index on ES 6.4 is able to handle without issue. I've included a bunch of …

---

## [Help interpreting explain results, IDF behavior (newbie)](https://discuss.elastic.co/t/help-interpreting-explain-results-idf-behavior-newbie/228217)

<div class="topic-metadata">

**Author:** [@redec](https://discuss.elastic.co/u/redec)\
**Replies:** 2\
**Last updated:** [April 16, 2020, 5:11pm UTC](https://discuss.elastic.co/t/help-interpreting-explain-results-idf-behavior-newbie/228217 "2020-04-16T17:11:22Z")

</div>

I have 2 documents which match my filter, and both have an identical value in the field being queried, but yet they yield vastly different scores. Here is the returned result: { "took" : 3, "timed\_out" : false, "…

---

## [Vulnerabilities associated with jackson-databind 2.8.11.3](https://discuss.elastic.co/t/vulnerabilities-associated-with-jackson-databind-2-8-11-3/228376)

<div class="topic-metadata">

**Author:** [@Sunil\_Chadha](https://discuss.elastic.co/u/Sunil_Chadha)\
**Replies:** 0\
**Last updated:** [April 16, 2020, 5:04pm UTC](https://discuss.elastic.co/t/vulnerabilities-associated-with-jackson-databind-2-8-11-3/228376 "2020-04-16T17:04:20Z")

</div>

Hi, In the Elasticsearch 6.8.4 jackson-databind version 2.8.11.3 used. This version of Jackson-databind has many high vulnerabilities associated. CVE-2019-16943 CVE-2018-19360 CVE-2019-14893 CVE-2018-14719 CVE-201…

---

## [Elastic Search 5.6 - Getting HTTP/1.1 504 Gateway Timeout](https://discuss.elastic.co/t/elastic-search-5-6-getting-http-1-1-504-gateway-timeout/228371)

<div class="topic-metadata">

**Author:** [@kc404](https://discuss.elastic.co/u/kc404)\
**Replies:** 0\
**Last updated:** [April 16, 2020, 4:36pm UTC](https://discuss.elastic.co/t/elastic-search-5-6-getting-http-1-1-504-gateway-timeout/228371 "2020-04-16T16:36:06Z")

</div>

We are using ES 5.6. Our application (Java,Play) keeps on receiving requests on application-akka.actor.default-dispatcher and response for those will be collected by ForkJoinPool.commonPool-worker threads from elastic. A…

---

## [Charm Elasticsearch Security and P12 certificates with password](https://discuss.elastic.co/t/charm-elasticsearch-security-and-p12-certificates-with-password/228363)

<div class="topic-metadata">

**Author:** [@jgato](https://discuss.elastic.co/u/jgato)\
**Replies:** 0\
**Last updated:** [April 16, 2020, 4:04pm UTC](https://discuss.elastic.co/t/charm-elasticsearch-security-and-p12-certificates-with-password/228363 "2020-04-16T16:04:29Z")

</div>

I have almost everything up and running to enable security, certificates, user and password. But the p12 certificate is protected with a password. How do I configure that in the Charm values?

---

## [How to store and search for same values in a field](https://discuss.elastic.co/t/how-to-store-and-search-for-same-values-in-a-field/228357)

<div class="topic-metadata">

**Author:** [@kent120103](https://discuss.elastic.co/u/kent120103)\
**Replies:** 0\
**Last updated:** [April 16, 2020, 3:38pm UTC](https://discuss.elastic.co/t/how-to-store-and-search-for-same-values-in-a-field/228357 "2020-04-16T15:38:22Z")

</div>

Dear Elastic community, My index contains following documents: {. "\_index": "sametokensearch", "\_type": "\_doc", "\_id": "1", "found": true, "\_source": { "dob": \["202", "020", "20-", "0-0", "-03", "03-", …

---

## [Transform date field (timeStamp) "failed to parse field"](https://discuss.elastic.co/t/transform-date-field-timestamp-failed-to-parse-field/228192)

<div class="topic-metadata">

**Author:** [@Cain310](https://discuss.elastic.co/u/Cain310)\
**Replies:** 2\
**Last updated:** [April 16, 2020, 3:26pm UTC](https://discuss.elastic.co/t/transform-date-field-timestamp-failed-to-parse-field/228192 "2020-04-16T15:26:32Z")

</div>

Hi I am having trouble with transforming a timeStamp date field for ml. I am getting this error in the logs failed to parse field \[doc.timeStamp.min\] of type \[date\] in document with id 'xxx'. Preview of field's value:…

---

## [Inconsistent Error messages when throwing an exception in a painless script](https://discuss.elastic.co/t/inconsistent-error-messages-when-throwing-an-exception-in-a-painless-script/228350)

<div class="topic-metadata">

**Author:** [@justinjones](https://discuss.elastic.co/u/justinjones)\
**Replies:** 0\
**Last updated:** [April 16, 2020, 2:57pm UTC](https://discuss.elastic.co/t/inconsistent-error-messages-when-throwing-an-exception-in-a-painless-script/228350 "2020-04-16T14:57:57Z")

</div>

Overview: Amazon Elasticsearch Service Version: 6.7 Number of Nodes: 3 When throwing an exception from a painless script we are getting inconsistent error messages back. In some cases we get an extra "exception: " p…

---

## [Word Frequency for search term](https://discuss.elastic.co/t/word-frequency-for-search-term/228332)

<div class="topic-metadata">

**Author:** [@sanjaye218](https://discuss.elastic.co/u/sanjaye218)\
**Replies:** 0\
**Last updated:** [April 16, 2020, 1:44pm UTC](https://discuss.elastic.co/t/word-frequency-for-search-term/228332 "2020-04-16T13:44:26Z")

</div>

Hi, I am trying to find word frequency suing query string. But in case search term is more than single word and field is of type text, then its returning incorrect results. Like if my data is "This is word tied off" an…

---

## [Cloud NAT egress cost to elastic cloud](https://discuss.elastic.co/t/cloud-nat-egress-cost-to-elastic-cloud/228327)

<div class="topic-metadata">

**Author:** [@Edgar\_Peixoto](https://discuss.elastic.co/u/Edgar_Peixoto)\
**Replies:** 0\
**Last updated:** [April 16, 2020, 1:27pm UTC](https://discuss.elastic.co/t/cloud-nat-egress-cost-to-elastic-cloud/228327 "2020-04-16T13:27:35Z")

</div>

I have a Elastic Cloud as a service and a google private GKE cluster in the same region with filebeat and metric beat sending metrics to my EC installation. They are using Cloud NAT. I noticed a great cost using Cloud N…

---

## [String Manipulation in Scripts](https://discuss.elastic.co/t/string-manipulation-in-scripts/228321)

<div class="topic-metadata">

**Author:** [@dawiro](https://discuss.elastic.co/u/dawiro)\
**Replies:** 0\
**Last updated:** [April 16, 2020, 1:10pm UTC](https://discuss.elastic.co/t/string-manipulation-in-scripts/228321 "2020-04-16T13:10:55Z")

</div>

Hi, If I have a string looking something like: aaa-bbb-ccc-dddd How can I use painless scripts to extract ccc into a new field? Thx D

---

## [Can't fetch data using REST / POSTMAN](https://discuss.elastic.co/t/cant-fetch-data-using-rest-postman/228318)

<div class="topic-metadata">

**Author:** [@ahmadalibaloch](https://discuss.elastic.co/u/ahmadalibaloch)\
**Replies:** 0\
**Last updated:** [April 16, 2020, 1:00pm UTC](https://discuss.elastic.co/t/cant-fetch-data-using-rest-postman/228318 "2020-04-16T13:00:33Z")

</div>

I did a simple deployment and using the JS client pushed some records for an index 'hear2learn'. That was successful. I can also fetch records using JS client. but when I do a request using POSTMAN or browser passing my …

---

## [Are elk 6 rpms supported on centos8/python3?](https://discuss.elastic.co/t/are-elk-6-rpms-supported-on-centos8-python3/228315)

<div class="topic-metadata">

**Author:** [@akshatsharma](https://discuss.elastic.co/u/akshatsharma)\
**Replies:** 1\
**Last updated:** [April 16, 2020, 12:36pm UTC](https://discuss.elastic.co/t/are-elk-6-rpms-supported-on-centos8-python3/228315 "2020-04-16T12:36:17Z")

</div>

Hi, We are using elk 6.6.1 rpms along with elasticsearch-curator-5.6.0. I just wanted to check if all these RPMs are supported on centos8/python3.x. Best Regards, Akshat Sharma

---

## [Elasticsearch does not work with network.host 0.0.0.0](https://discuss.elastic.co/t/elasticsearch-does-not-work-with-network-host-0-0-0-0/228162)

<div class="topic-metadata">

**Author:** [@wiktort](https://discuss.elastic.co/u/wiktort)\
**Replies:** 5\
**Last updated:** [April 16, 2020, 12:27pm UTC](https://discuss.elastic.co/t/elasticsearch-does-not-work-with-network-host-0-0-0-0/228162 "2020-04-16T12:27:18Z")

</div>

I have been trying to set up a test version of a website on a different server. The website uses React, Strapi, Postgres, Nginx and Elasticsearch. All of them are working, but the website is stuck on a loader. I do no…

---

## [Elastic search + workplace search implementation on linux server](https://discuss.elastic.co/t/elastic-search-workplace-search-implementation-on-linux-server/228308)

<div class="topic-metadata">

**Author:** [@anchal\_kalra](https://discuss.elastic.co/u/anchal_kalra)\
**Replies:** 0\
**Last updated:** [April 16, 2020, 11:37am UTC](https://discuss.elastic.co/t/elastic-search-workplace-search-implementation-on-linux-server/228308 "2020-04-16T11:37:18Z")

</div>

We are trying to implement elastic workplace search on a linux server referring the link: https://www.elastic.co/downloads/enterprise-search The Red Hat linux server is a restricted one and we can't directly download a…

---

## [An example of more simple pre-indexed shapes filtering and more complex ones not filtering](https://discuss.elastic.co/t/an-example-of-more-simple-pre-indexed-shapes-filtering-and-more-complex-ones-not-filtering/228183)

<div class="topic-metadata">

**Author:** [@corrigancd](https://discuss.elastic.co/u/corrigancd)\
**Replies:** 5\
**Last updated:** [April 16, 2020, 11:22am UTC](https://discuss.elastic.co/t/an-example-of-more-simple-pre-indexed-shapes-filtering-and-more-complex-ones-not-filtering/228183 "2020-04-16T11:22:54Z")

</div>

Hello, Using Elasticsearch and Kibana v7.5.2, I have encountered something unexpected while using pre-indexed shape filtering. I have it documented in a google doc - The doc is split into 2 sections and the information…

---

## [Question about prequery of DFS\_Query\_then\_Fetch](https://discuss.elastic.co/t/question-about-prequery-of-dfs-query-then-fetch/228287)

<div class="topic-metadata">

**Author:** [@Hyunsoo\_Shim](https://discuss.elastic.co/u/Hyunsoo_Shim)\
**Replies:** 3\
**Last updated:** [April 16, 2020, 10:38am UTC](https://discuss.elastic.co/t/question-about-prequery-of-dfs-query-then-fetch/228287 "2020-04-16T10:38:08Z")

</div>

Hello, I have a simple question about "prequery" step of "DFS\_Query\_then\_Fetch" search type. When we create an index of only 1 primary shard and make 4 replicas, is "prequery" excuted for all 5 shards(primary and repl…

---

## [Multi dynamic templates - issue](https://discuss.elastic.co/t/multi-dynamic-templates-issue/228296)

<div class="topic-metadata">

**Author:** [@adude946](https://discuss.elastic.co/u/adude946)\
**Replies:** 0\
**Last updated:** [April 16, 2020, 10:19am UTC](https://discuss.elastic.co/t/multi-dynamic-templates-issue/228296 "2020-04-16T10:19:55Z")

</div>

I'm testing implementing multiple dynamic templates on 3 different fields but each time mapping is not getting created correctly. Only the first array object template is picked up. Any help would be great on what is wron…

---

## [Using sort with elastic request is not returning score in the response](https://discuss.elastic.co/t/using-sort-with-elastic-request-is-not-returning-score-in-the-response/227890)

<div class="topic-metadata">

**Author:** [@guruprasadkk](https://discuss.elastic.co/u/guruprasadkk)\
**Replies:** 4\
**Last updated:** [April 16, 2020, 10:17am UTC](https://discuss.elastic.co/t/using-sort-with-elastic-request-is-not-returning-score-in-the-response/227890 "2020-04-16T10:17:03Z")

</div>

I am using elasticsearch-rest-high-level-client 7.6.2 version to interact with elastic server from my java application. Now I am planning to use sorting capability in elastic. When I added the sort in the elastic reques…

---

## [Helm-chart and ExtraVolumes](https://discuss.elastic.co/t/helm-chart-and-extravolumes/227907)

<div class="topic-metadata">

**Author:** [@jgato](https://discuss.elastic.co/u/jgato)\
**Replies:** 2\
**Last updated:** [April 16, 2020, 9:56am UTC](https://discuss.elastic.co/t/helm-chart-and-extravolumes/227907 "2020-04-16T09:56:49Z")

</div>

Hi there, I am deploying a cluster using your helm-chart package and everything goes ok. Now I would like to make something more advanced, like creating a backup repo, and export this directory as a volume. Trying some…

---

## [ES responding very slow after Rolling Restart](https://discuss.elastic.co/t/es-responding-very-slow-after-rolling-restart/228290)

<div class="topic-metadata">

**Author:** [@Vipul\_Sharma](https://discuss.elastic.co/u/Vipul_Sharma)\
**Replies:** 0\
**Last updated:** [April 16, 2020, 9:48am UTC](https://discuss.elastic.co/t/es-responding-very-slow-after-rolling-restart/228290 "2020-04-16T09:48:18Z")

</div>

I have just restart my elasticsearch cluster only data-nodes increase the number of Core after the restart ES is responding very slow The query is taking almost around 3K ms while it uses to take 300ms at max Did we mi…

---

## [Metrics for replica sync - ES 7.0.1](https://discuss.elastic.co/t/metrics-for-replica-sync-es-7-0-1/227866)

<div class="topic-metadata">

**Author:** [@dinesh\_gnanasamy](https://discuss.elastic.co/u/dinesh_gnanasamy)\
**Replies:** 3\
**Last updated:** [April 16, 2020, 9:25am UTC](https://discuss.elastic.co/t/metrics-for-replica-sync-es-7-0-1/227866 "2020-04-16T09:25:50Z")

</div>

Are there any specific metrics which indicate if the replica shards are out of sync wrt primary shards. I checked something which appears relatively closer from \_cat/shards API seq\_no.global\_checkpoint , sqg , global…

---

## [Unable to start Elasticsearch in Windows10](https://discuss.elastic.co/t/unable-to-start-elasticsearch-in-windows10/227789)

<div class="topic-metadata">

**Author:** [@srivatsans](https://discuss.elastic.co/u/srivatsans)\
**Replies:** 14\
**Last updated:** [April 16, 2020, 8:56am UTC](https://discuss.elastic.co/t/unable-to-start-elasticsearch-in-windows10/227789 "2020-04-16T08:56:40Z")

</div>

I have downloaded 7.6.2 and 7.5.0 .zip versions of ES and unzipped them. When I run '.\\bin\\elasticsearch.bat', it throws error 'The system cannot open the device or file specified'. I have set the JAVA\_HOME to the JRE pa…

---

## [Does es have the Incremental change function like mysql‘s binlog](https://discuss.elastic.co/t/does-es-have-the-incremental-change-function-like-mysql-s-binlog/228259)

<div class="topic-metadata">

**Author:** [@q6413260](https://discuss.elastic.co/u/q6413260)\
**Replies:** 1\
**Last updated:** [April 16, 2020, 7:52am UTC](https://discuss.elastic.co/t/does-es-have-the-incremental-change-function-like-mysql-s-binlog/228259 "2020-04-16T07:52:42Z")

</div>

I want to subscribe es’s Incremental change(some write events like mysql binlog) to trigger some business check event. How can I achieve this goal？Thank you

---

## [What do "total\_stopped\_time/total\_throttled\_time/total\_auto\_throttle“ mean in index merge stats api?](https://discuss.elastic.co/t/what-do-total-stopped-time-total-throttled-time-total-auto-throttle-mean-in-index-merge-stats-api/228258)

<div class="topic-metadata">

**Author:** [@LoadingZhang](https://discuss.elastic.co/u/LoadingZhang)\
**Replies:** 0\
**Last updated:** [April 16, 2020, 6:39am UTC](https://discuss.elastic.co/t/what-do-total-stopped-time-total-throttled-time-total-auto-throttle-mean-in-index-merge-stats-api/228258 "2020-04-16T06:39:37Z")

</div>

I found these metric are slightly large { "current": 30, "current\_docs": 564106582, "current\_size": "385.7gb", "current\_size\_in\_bytes": 414198867561, "total": 33588, "total\_time": "2.9d", "total\_time\_in\_m…

[Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=952)

[Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=954)
