# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=963 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 964 --- ## [.monitoring-es-6, .monitoring-kibana-6 are unassigned](https://discuss.elastic.co/t/monitoring-es-6-monitoring-kibana-6-are-unassigned/226974)
**Author:** [@pami](https://discuss.elastic.co/u/pami)\ **Replies:** 0\ **Last updated:** [April 7, 2020, 6:11pm UTC](https://discuss.elastic.co/t/monitoring-es-6-monitoring-kibana-6-are-unassigned/226974 "2020-04-07T18:11:37Z")
Hi, My cluster is in red state due to following indicies are unassigned. .monitoring-es-6, I tried to remove the indicies but still not working. Not sure what to do ? \[root@cs-els01 elasticsearch\]# curl -X GET localh… --- ## [Sorting by \_score on an aggregation](https://discuss.elastic.co/t/sorting-by-score-on-an-aggregation/224728)
**Author:** [@Tim\_Estes](https://discuss.elastic.co/u/Tim_Estes)\ **Replies:** 3\ **Last updated:** [April 7, 2020, 6:05pm UTC](https://discuss.elastic.co/t/sorting-by-score-on-an-aggregation/224728 "2020-04-07T18:05:57Z")
Hello, I have the following schema for an index, with some example documents. My use-case is that I'm indexing a book and I am indexing by page. I'm trying to make a query against the contents of each page and return the… --- ## [Monitor/Log search queries in elasticsearch/kibana](https://discuss.elastic.co/t/monitor-log-search-queries-in-elasticsearch-kibana/226970)
**Author:** [@OMW](https://discuss.elastic.co/u/OMW)\ **Replies:** 0\ **Last updated:** [April 7, 2020, 5:57pm UTC](https://discuss.elastic.co/t/monitor-log-search-queries-in-elasticsearch-kibana/226970 "2020-04-07T17:57:47Z")
Hello, I am trying to create a pipeline for monitoring user executed queries in elasticsearch. I followed this tutorial I successfully installed logstash, packetbeat and kibana. Both applications are configured loca… --- ## [Elasticsearch Consuming Massive Memory](https://discuss.elastic.co/t/elasticsearch-consuming-massive-memory/226783)
**Author:** [@wwalker](https://discuss.elastic.co/u/wwalker)\ **Replies:** 1\ **Last updated:** [April 6, 2020, 10:58pm UTC](https://discuss.elastic.co/t/elasticsearch-consuming-massive-memory/226783 "2020-04-06T22:58:33Z")
Just curious as to what's going on here. jvm.options set to 20GB but this is what I see in Task Manager. Running Elasticsearch 7.6 on Server 2012 R2 --- ## [Using scripted nested sorting with missing fields](https://discuss.elastic.co/t/using-scripted-nested-sorting-with-missing-fields/226962)
**Author:** [@Jimmy](https://discuss.elastic.co/u/Jimmy)\ **Replies:** 0\ **Last updated:** [April 7, 2020, 5:24pm UTC](https://discuss.elastic.co/t/using-scripted-nested-sorting-with-missing-fields/226962 "2020-04-07T17:24:43Z")
Hi, I'm working with documents that looks like: { "product\_name": "abc", "prices": { "regular": 9.99, "pricing\_tables": \[ { "id": 1, "price": 8.99 }, { "id": 2, "price": 7.99 } \] } Where pr… --- ## [Summarization of text content](https://discuss.elastic.co/t/summarization-of-text-content/226958)
**Author:** [@Nathaniel\_Gonzalez](https://discuss.elastic.co/u/Nathaniel_Gonzalez)\ **Replies:** 0\ **Last updated:** [April 7, 2020, 4:42pm UTC](https://discuss.elastic.co/t/summarization-of-text-content/226958 "2020-04-07T16:42:38Z")
Hi, I'm looking for a way of extracting/returning a summarize version of the text that was ingested. Its there any plugin or functionality in elastic that can accomplished this. In a best case scenario the information w… --- ## [Why no native CSV import in bulk instead of JSON? It would make sense am I right?](https://discuss.elastic.co/t/why-no-native-csv-import-in-bulk-instead-of-json-it-would-make-sense-am-i-right/226836)
**Author:** [@emilebosch](https://discuss.elastic.co/u/emilebosch)\ **Replies:** 3\ **Last updated:** [April 7, 2020, 4:39pm UTC](https://discuss.elastic.co/t/why-no-native-csv-import-in-bulk-instead-of-json-it-would-make-sense-am-i-right/226836 "2020-04-07T16:39:24Z")
Hi all! I was wondering for some time now why doesn't Elasticsearch allow for native CSV import? I don't mean converting the CSV to JSON and then using the Bulk API, but uploading a CSV to the server and then the server … --- ## [Search UI and result ranking](https://discuss.elastic.co/t/search-ui-and-result-ranking/226953)
**Author:** [@nickdeckerdevs](https://discuss.elastic.co/u/nickdeckerdevs)\ **Replies:** 0\ **Last updated:** [April 7, 2020, 4:26pm UTC](https://discuss.elastic.co/t/search-ui-and-result-ranking/226953 "2020-04-07T16:26:13Z")
I'm trying to figure out how to use search ui (using react package) and determine if a result has been modified. Here there are "sponsored results" -- I was told this was done by result ranking (which I understand how t… --- ## [Java exception when trying to run elasticsearch-sql-cli](https://discuss.elastic.co/t/java-exception-when-trying-to-run-elasticsearch-sql-cli/226722)
**Author:** [@beerman](https://discuss.elastic.co/u/beerman)\ **Replies:** 1\ **Last updated:** [April 7, 2020, 3:23pm UTC](https://discuss.elastic.co/t/java-exception-when-trying-to-run-elasticsearch-sql-cli/226722 "2020-04-07T15:23:19Z")
Hello, I'm trying to run elasticsearch-sql-cli but just get a java exception. I've tried to run as a normal user, as root, and as the elasticsearch users, nothing works? This is on a Ubuntu 16.04 system: cd /usr/shar… --- ## [MITRE ATT&CK detection](https://discuss.elastic.co/t/mitre-att-ck-detection/226919)
**Author:** [@Mangolinux](https://discuss.elastic.co/u/Mangolinux)\ **Replies:** 0\ **Last updated:** [April 7, 2020, 2:51pm UTC](https://discuss.elastic.co/t/mitre-att-ck-detection/226919 "2020-04-07T14:51:50Z")
How do I configure Elastic to show MITRE ATT&CK technique ID's? I am using Atomic Red Team to simulate ATT&CK tactics against Windows and Linux host but I don't see the attacks in my logs. Using filebeat and winlogbeat --- ## [Disable cluster setting: xpack.monitoring.enabled](https://discuss.elastic.co/t/disable-cluster-setting-xpack-monitoring-enabled/226505)
**Author:** [@Itay\_Bittan](https://discuss.elastic.co/u/Itay_Bittan)\ **Replies:** 7\ **Last updated:** [April 7, 2020, 2:41pm UTC](https://discuss.elastic.co/t/disable-cluster-setting-xpack-monitoring-enabled/226505 "2020-04-07T14:41:53Z")
Setup: Elasticsearch 6.3.0 with 19 nodes: 12 data nodes 4 client nodes 3 master nodes We have around: Cluster size: ~820GB (~175GB of them are .monitoring indices) 1,030,000,000 documents in the cluster (900,000,00… --- ## [FSCrawler - Elastic Mapping Changes](https://discuss.elastic.co/t/fscrawler-elastic-mapping-changes/226867)
**Author:** [@Sarath\_Pullabhotla](https://discuss.elastic.co/u/Sarath_Pullabhotla)\ **Replies:** 3\ **Last updated:** [April 7, 2020, 2:19pm UTC](https://discuss.elastic.co/t/fscrawler-elastic-mapping-changes/226867 "2020-04-07T14:19:51Z")
Hi, Can anyone please guide me on the below. Q1) Is it possible for us to change the tag names in elastic search while ingesting documents using fscrawler. Example: The content that a file has is getting ingested und… --- ## [numHits must be \> 0; please use TotalHitCountCollector if you just need the total hit count](https://discuss.elastic.co/t/numhits-must-be-0-please-use-totalhitcountcollector-if-you-just-need-the-total-hit-count/226516)
**Author:** [@Casper\_Skydt](https://discuss.elastic.co/u/Casper_Skydt)\ **Replies:** 4\ **Last updated:** [April 7, 2020, 2:10pm UTC](https://discuss.elastic.co/t/numhits-must-be-0-please-use-totalhitcountcollector-if-you-just-need-the-total-hit-count/226516 "2020-04-07T14:10:24Z")
Once in a while i get the following error: numHits must be \> 0; please use TotalHitCountCollector if you just need the total hit count The query is the following, with varying 'from', but never larger than 750: { … --- ## [Watcher EmailAction using Outlook account throws SMTPAddressFailedException](https://discuss.elastic.co/t/watcher-emailaction-using-outlook-account-throws-smtpaddressfailedexception/226624)
**Author:** [@prathibha](https://discuss.elastic.co/u/prathibha)\ **Replies:** 3\ **Last updated:** [April 7, 2020, 1:43pm UTC](https://discuss.elastic.co/t/watcher-emailaction-using-outlook-account-throws-smtpaddressfailedexception/226624 "2020-04-07T13:43:54Z")
Hello Team , I am getting the following exception while configuring a watcher using outlook account. I am using 7.4 version for all components like filebeat, logstash , kibana and elastic and all these components are ru… --- ## [Elastic watcher - modify query result value before condition](https://discuss.elastic.co/t/elastic-watcher-modify-query-result-value-before-condition/226908)
**Author:** [@vdelcampo](https://discuss.elastic.co/u/vdelcampo)\ **Replies:** 0\ **Last updated:** [April 7, 2020, 1:40pm UTC](https://discuss.elastic.co/t/elastic-watcher-modify-query-result-value-before-condition/226908 "2020-04-07T13:40:04Z")
Hi. Im trying to create a watcher to compare two query results. Here is my code (it works): { "trigger": { "schedule": { "interval": "1m" } }, "input": { "chain": { "inputs": \[ { "first": … --- ## [Get the number of documents of index in snapshot?](https://discuss.elastic.co/t/get-the-number-of-documents-of-index-in-snapshot/226875)
**Author:** [@Arp](https://discuss.elastic.co/u/Arp)\ **Replies:** 3\ **Last updated:** [April 7, 2020, 12:57pm UTC](https://discuss.elastic.co/t/get-the-number-of-documents-of-index-in-snapshot/226875 "2020-04-07T12:57:27Z")
Hi, Is it possible to get the number of documents an index in a snapshot has? I know how to do this for actual indices. I can see which indices are in snapshot, but I can't figure out how to get the number of documents … --- ## [ES can't get btrfs filesystem stats](https://discuss.elastic.co/t/es-cant-get-btrfs-filesystem-stats/226858)
**Author:** [@LoadingZhang](https://discuss.elastic.co/u/LoadingZhang)\ **Replies:** 6\ **Last updated:** [April 7, 2020, 12:35pm UTC](https://discuss.elastic.co/t/es-cant-get-btrfs-filesystem-stats/226858 "2020-04-07T12:35:52Z")
if ES data store in btrfs filesystem partition, then GET \_nodes/stats/fs will return empty io\_stats field. such as : "fs" : { "timestamp" : 1586250875508, "total" : { "total\_in\_bytes" : 4000225… --- ## [What are the downfalls of using elasticsearch as a primary database](https://discuss.elastic.co/t/what-are-the-downfalls-of-using-elasticsearch-as-a-primary-database/226815)
**Author:** [@chawki](https://discuss.elastic.co/u/chawki)\ **Replies:** 1\ **Last updated:** [April 7, 2020, 11:09am UTC](https://discuss.elastic.co/t/what-are-the-downfalls-of-using-elasticsearch-as-a-primary-database/226815 "2020-04-07T11:09:48Z")
Please point out the downfalls. Thank you --- ## [Rename index](https://discuss.elastic.co/t/rename-index/226853)
**Author:** [@michielM](https://discuss.elastic.co/u/michielM)\ **Replies:** 3\ **Last updated:** [April 7, 2020, 10:37am UTC](https://discuss.elastic.co/t/rename-index/226853 "2020-04-07T10:37:44Z")
Hi all, Currently, I,m trying to change the index name in a way that every server I connect is a prefix of the index. For example: currently, I just have auditbeat-7.6.1-2020.03.27-000001 as index name, but I want to ha… --- ## [Filter Documents based on data of other documents](https://discuss.elastic.co/t/filter-documents-based-on-data-of-other-documents/226843)
**Author:** [@dgurusam](https://discuss.elastic.co/u/dgurusam)\ **Replies:** 1\ **Last updated:** [April 7, 2020, 9:14am UTC](https://discuss.elastic.co/t/filter-documents-based-on-data-of-other-documents/226843 "2020-04-07T09:14:16Z")
I have an index where documents will be of two types such as Type1 and Type2 { { "id":1, "SourceType": "Type1", "ItemNumber": "AS5888", "AgreementNumber": null } { "id":2, "SourceType": "Type2", "ItemNumbe… --- ## [Pattern in scroll\_id](https://discuss.elastic.co/t/pattern-in-scroll-id/226693)
**Author:** [@MKU](https://discuss.elastic.co/u/MKU)\ **Replies:** 3\ **Last updated:** [April 7, 2020, 9:02am UTC](https://discuss.elastic.co/t/pattern-in-scroll-id/226693 "2020-04-07T09:02:28Z")
Hi all, I would like to know if we can figure out the page number ( result set number) by using the scroll\_id that Elasticsearch provides. I use Elasticsearch-7.4. Regards, Mohan --- ## [How to apply an ILM to a rollup index](https://discuss.elastic.co/t/how-to-apply-an-ilm-to-a-rollup-index/226849)
**Author:** [@rhalliday](https://discuss.elastic.co/u/rhalliday)\ **Replies:** 2\ **Last updated:** [April 7, 2020, 8:53am UTC](https://discuss.elastic.co/t/how-to-apply-an-ilm-to-a-rollup-index/226849 "2020-04-07T08:53:42Z")
We are creating an aggregated set of data using the rollup job feature in Elasticsearch 7.5.2. Creating the rollup job works and we have an index that contains the aggregated data, but we're using a hot/warm architecture… --- ## [Increased docs.count and store.size after Elasticsearch upgrade](https://discuss.elastic.co/t/increased-docs-count-and-store-size-after-elasticsearch-upgrade/226670)
**Author:** [@SerjGAmoVeR](https://discuss.elastic.co/u/SerjGAmoVeR)\ **Replies:** 3\ **Last updated:** [April 7, 2020, 8:37am UTC](https://discuss.elastic.co/t/increased-docs-count-and-store-size-after-elasticsearch-upgrade/226670 "2020-04-07T08:37:04Z")
We have existing Elasticsearch 5.5 cluster and want to migrate to another one Elasticsearch 7+ Mapping is same for both Elasticsearch 5 and Elasticsearch 7 indices "mappings": { "properties": { "\_… --- ## [How do I created a scripted field from a message field that I already have](https://discuss.elastic.co/t/how-do-i-created-a-scripted-field-from-a-message-field-that-i-already-have/226846)
**Author:** [@bharati](https://discuss.elastic.co/u/bharati)\ **Replies:** 1\ **Last updated:** [April 7, 2020, 8:36am UTC](https://discuss.elastic.co/t/how-do-i-created-a-scripted-field-from-a-message-field-that-i-already-have/226846 "2020-04-07T08:36:06Z")
Hello, I am new to scripted fields . I have a field "message" in my logs. I am trying to create scripted fields/customized fields for the content inside the message field. Can anyone please tell me how to create custo… --- ## [Cancel restore snapshot](https://discuss.elastic.co/t/cancel-restore-snapshot/225190)
**Author:** [@ELJIE](https://discuss.elastic.co/u/ELJIE)\ **Replies:** 6\ **Last updated:** [April 7, 2020, 8:26am UTC](https://discuss.elastic.co/t/cancel-restore-snapshot/225190 "2020-04-07T08:26:28Z")
hello, i am doing automation tests on snapshot restore. I wish I could stop a restoration that is underway. When I execute the following command: GET / \_tasks / taskID I have the return indicating the id and the act… --- ## [Reasons for a separate monitor-cluster?](https://discuss.elastic.co/t/reasons-for-a-separate-monitor-cluster/226844)
**Author:** [@Mattness](https://discuss.elastic.co/u/Mattness)\ **Replies:** 3\ **Last updated:** [April 7, 2020, 8:26am UTC](https://discuss.elastic.co/t/reasons-for-a-separate-monitor-cluster/226844 "2020-04-07T08:26:16Z")
Hello, I have to decide between setting up an extra cluster for monitoring or just let the production cluster monitor itself. Aside from being able to see historical data if the monitored nodes are unavailable, are the… --- ## [Effective pagination over composite aggregation in Java](https://discuss.elastic.co/t/effective-pagination-over-composite-aggregation-in-java/226638)
**Author:** [@florinmoc](https://discuss.elastic.co/u/florinmoc)\ **Replies:** 2\ **Last updated:** [April 7, 2020, 6:22am UTC](https://discuss.elastic.co/t/effective-pagination-over-composite-aggregation-in-java/226638 "2020-04-07T06:22:41Z")
Hi, I'm trying to paginate over composite aggregation in Java. I have some working code, but it doesn't seem to be very efficient, as it re-builds the query each time. Is there a way to re-use the query and just change … --- ## [Extract Metricbeat network traffic visualization DSL query](https://discuss.elastic.co/t/extract-metricbeat-network-traffic-visualization-dsl-query/226837)
**Author:** [@Mudboyzh](https://discuss.elastic.co/u/Mudboyzh)\ **Replies:** 0\ **Last updated:** [April 7, 2020, 7:13am UTC](https://discuss.elastic.co/t/extract-metricbeat-network-traffic-visualization-dsl-query/226837 "2020-04-07T07:13:10Z")
I want to understand how does the metricbeat's network traffic visualization DSL query. I had already used the Chrome Dev Tools to get the DSL query and the Kibana saved object, but the request payload and visState seem… --- ## [How to configure and enable elastic logging](https://discuss.elastic.co/t/how-to-configure-and-enable-elastic-logging/226828)
**Author:** [@vishnuvardhan](https://discuss.elastic.co/u/vishnuvardhan)\ **Replies:** 1\ **Last updated:** [April 7, 2020, 6:42am UTC](https://discuss.elastic.co/t/how-to-configure-and-enable-elastic-logging/226828 "2020-04-07T06:42:17Z")
Hi Team, How to configure the elastic looging and how to enable the elastic logging in development environment . can you please provide the steps how to implement. Thanks in advance !! --- ## [Pipeline cannot ingest lines with the word "value" in them](https://discuss.elastic.co/t/pipeline-cannot-ingest-lines-with-the-word-value-in-them/226626)
**Author:** [@Stuart\_Stafford](https://discuss.elastic.co/u/Stuart_Stafford)\ **Replies:** 2\ **Last updated:** [April 7, 2020, 6:21am UTC](https://discuss.elastic.co/t/pipeline-cannot-ingest-lines-with-the-word-value-in-them/226626 "2020-04-07T06:21:14Z")
I am trying to create a pipeline for a gitlab log. I run a simulate on the message in Dev Tools and it works fine:- POST \_ingest/pipeline/\_simulate { "pipeline": { "processors": \[ { "gsub": { … [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=962) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=964)