# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=965 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 966 --- ## [Elasticsearch not update](https://discuss.elastic.co/t/elasticsearch-not-update/226341)
**Author:** [@111306](https://discuss.elastic.co/u/111306)\ **Replies:** 9\ **Last updated:** [April 6, 2020, 10:38am UTC](https://discuss.elastic.co/t/elasticsearch-not-update/226341 "2020-04-06T10:38:26Z")
I met a strange thing, that is, I can use \_update\_by\_query locally to successfully update, but not on the server. I considered the problem of multithreading and added a lock, but it still doesn't work. Can anyone have id… --- ## [What causes a "empty server certificate chain"](https://discuss.elastic.co/t/what-causes-a-empty-server-certificate-chain/226671)
**Author:** [@maxg1](https://discuss.elastic.co/u/maxg1)\ **Replies:** 2\ **Last updated:** [April 6, 2020, 10:21am UTC](https://discuss.elastic.co/t/what-causes-a-empty-server-certificate-chain/226671 "2020-04-06T10:21:19Z")
Hello, i want to configure one elasticsearch-node to communicate via https and i am using the following parameters: legend: (xpack.security) = xs xs.enabled: true xs.transport.ssl.enabled: true xs.transport.ssl.ver… --- ## [Failed to execute bulk item error in elasticsearch pods](https://discuss.elastic.co/t/failed-to-execute-bulk-item-error-in-elasticsearch-pods/226385)
**Author:** [@kasim123](https://discuss.elastic.co/u/kasim123)\ **Replies:** 2\ **Last updated:** [April 6, 2020, 9:30am UTC](https://discuss.elastic.co/t/failed-to-execute-bulk-item-error-in-elasticsearch-pods/226385 "2020-04-06T09:30:25Z")
Hi Team, Recently, I configured elasticsearch cluster with official helm by using default values. I have not changed any setting. I am seeing few error messages related to index. Could you guide me why I am getting b… --- ## [Regarding Cluster Sizing](https://discuss.elastic.co/t/regarding-cluster-sizing/226509)
**Author:** [@dawiro](https://discuss.elastic.co/u/dawiro)\ **Replies:** 5\ **Last updated:** [April 6, 2020, 9:25am UTC](https://discuss.elastic.co/t/regarding-cluster-sizing/226509 "2020-04-06T09:25:14Z")
Hi, If I deploy a topology that separates ingest nodes and data nodes, all things being equal, how many data nodes can be served by a single ingest node without the heap of the ingest node becoming a bottleneck? Thx D … --- ## [Flushing logs from AWS S3 bucket to ElasticSearch : Validation Failed: 1: type is missing](https://discuss.elastic.co/t/flushing-logs-from-aws-s3-bucket-to-elasticsearch-validation-failed-1-type-is-missing/226661)
**Author:** [@IanCap](https://discuss.elastic.co/u/IanCap)\ **Replies:** 0\ **Last updated:** [April 6, 2020, 9:21am UTC](https://discuss.elastic.co/t/flushing-logs-from-aws-s3-bucket-to-elasticsearch-validation-failed-1-type-is-missing/226661 "2020-04-06T09:21:28Z")
Hi everyone, I'm currently trying to collect logs files stored in a S3 Bucket on AWS and send them to a clouded ES deployment. I followed the following tutorial : https://developers.cloudflare.com/logs/analytics-integra… --- ## [Node stats - indices.search.scroll\_time\_in\_millis](https://discuss.elastic.co/t/node-stats-indices-search-scroll-time-in-millis/226660)
**Author:** [@whatgeorgemade](https://discuss.elastic.co/u/whatgeorgemade)\ **Replies:** 0\ **Last updated:** [April 6, 2020, 9:21am UTC](https://discuss.elastic.co/t/node-stats-indices-search-scroll-time-in-millis/226660 "2020-04-06T09:21:21Z")
I've been looking through some stats in a customer's cluster and have noticed a lot of time is being spent performing scroll operations, according to indices.search.scroll\_time\_in\_millis. There is a legitimate use-case … --- ## [Auto-creating indices even though configured not to](https://discuss.elastic.co/t/auto-creating-indices-even-though-configured-not-to/226027)
**Author:** [@simonauner-bookbeat](https://discuss.elastic.co/u/simonauner-bookbeat)\ **Replies:** 2\ **Last updated:** [April 6, 2020, 8:41am UTC](https://discuss.elastic.co/t/auto-creating-indices-even-though-configured-not-to/226027 "2020-04-06T08:41:05Z")
I want to have full control over what indices are created in my cluster, so I have configured PUT \_cluster/settings { "persistent": { "action.auto\_create\_index": "false" } } Still, when using NEST to s… --- ## [Problem regarding APM mapping](https://discuss.elastic.co/t/problem-regarding-apm-mapping/226646)
**Author:** [@Guillaume\_Mallet](https://discuss.elastic.co/u/Guillaume_Mallet)\ **Replies:** 0\ **Last updated:** [April 6, 2020, 8:26am UTC](https://discuss.elastic.co/t/problem-regarding-apm-mapping/226646 "2020-04-06T08:26:59Z")
Dear all, I am trying to edit the default mapping for APM in order to index labels as text (default is keyword) My issue is that the dynamic templates doesn't seems to be kept over rollout of the new indices. I am usi… --- ## [How to get array size for each document](https://discuss.elastic.co/t/how-to-get-array-size-for-each-document/226599)
**Author:** [@ntsh999](https://discuss.elastic.co/u/ntsh999)\ **Replies:** 2\ **Last updated:** [April 6, 2020, 8:01am UTC](https://discuss.elastic.co/t/how-to-get-array-size-for-each-document/226599 "2020-04-06T08:01:25Z")
I want the size of an array of objects ('breaches' here) which is present in each document to be returned along with the fields present in the document once the query is executed. How can I do this? Below is my document … --- ## [Watcher executes action only for 10 times](https://discuss.elastic.co/t/watcher-executes-action-only-for-10-times/226350)
**Author:** [@Donatas\_Racys](https://discuss.elastic.co/u/Donatas_Racys)\ **Replies:** 2\ **Last updated:** [April 6, 2020, 7:35am UTC](https://discuss.elastic.co/t/watcher-executes-action-only-for-10-times/226350 "2020-04-06T07:35:08Z")
Hi folks, we have an case - Watcher performs Pagerduty/webhook action" only 10 times per trigger interval. We use foreach iteration in action and we receive only 10 notifications in Pagerduty. This is visible in Watcher… --- ## [Handling data between multiple indices](https://discuss.elastic.co/t/handling-data-between-multiple-indices/226556)
**Author:** [@Vignesh\_Theyagarajan](https://discuss.elastic.co/u/Vignesh_Theyagarajan)\ **Replies:** 3\ **Last updated:** [April 6, 2020, 7:33am UTC](https://discuss.elastic.co/t/handling-data-between-multiple-indices/226556 "2020-04-06T07:33:15Z")
I have 2 indices. These 2 indices are kind of related to one another. For example, lets say, the 1st index contains all information pertaining to an e-book. Information like author, published date, title etc. will be in… --- ## [Retrying failed action with response code: 503 unavailable\_shards\_exception, reason - logstash primary shard is not active](https://discuss.elastic.co/t/retrying-failed-action-with-response-code-503-unavailable-shards-exception-reason-logstash-primary-shard-is-not-active/226576)
**Author:** [@vignesh.s2](https://discuss.elastic.co/u/vignesh.s2)\ **Replies:** 5\ **Last updated:** [April 6, 2020, 7:27am UTC](https://discuss.elastic.co/t/retrying-failed-action-with-response-code-503-unavailable-shards-exception-reason-logstash-primary-shard-is-not-active/226576 "2020-04-06T07:27:49Z")
After upgrading to the latest version of the ELK 7.6.2 , I tried to restart the all the services. But elasticsearch has errors Below mentioned is the errors, Apr 03 21:56:46 CLMserver logstash\[3216\]: \[2020-04-03T21:56:… --- ## [How to use filter with more like query](https://discuss.elastic.co/t/how-to-use-filter-with-more-like-query/226635)
**Author:** [@ajay\_jangid](https://discuss.elastic.co/u/ajay_jangid)\ **Replies:** 0\ **Last updated:** [April 6, 2020, 7:18am UTC](https://discuss.elastic.co/t/how-to-use-filter-with-more-like-query/226635 "2020-04-06T07:18:10Z")
I am working on some recommendation problem as mine college project so task is to recommend a activity based on search term given by user and I am able to recommend similar result based on query. But I want to add filter… --- ## [Error whilie csv download \[monitoring execution failed org.elasticsearch.xpack.monitoring.exporter.ExportException\]](https://discuss.elastic.co/t/error-whilie-csv-download-monitoring-execution-failed-org-elasticsearch-xpack-monitoring-exporter-exportexception/226622)
**Author:** [@mist](https://discuss.elastic.co/u/mist)\ **Replies:** 0\ **Last updated:** [April 6, 2020, 6:02am UTC](https://discuss.elastic.co/t/error-whilie-csv-download-monitoring-execution-failed-org-elasticsearch-xpack-monitoring-exporter-exportexception/226622 "2020-04-06T06:02:08Z")
Hello All I am using ES 7.4.0 on AWS. I tried to download csv from kibana, but the error occurred and I checked the log and found the following log. elastic\_search log : \[instance-0000000008\] monitoring execution fai… --- ## [Disabling Rollover in ILM cause to error on retry lifecycle step](https://discuss.elastic.co/t/disabling-rollover-in-ilm-cause-to-error-on-retry-lifecycle-step/226619)
**Author:** [@Arman\_Ajdani](https://discuss.elastic.co/u/Arman_Ajdani)\ **Replies:** 0\ **Last updated:** [April 6, 2020, 5:47am UTC](https://discuss.elastic.co/t/disabling-rollover-in-ilm-cause-to-error-on-retry-lifecycle-step/226619 "2020-04-06T05:47:09Z")
Currently, I have an ILM Policy set to rollover and warm phase action, but of error : illegal\_argument\_exception: index.lifecycle.rollover\_alias \[oauth\] does not point to index \[oauth-2020.02.24\] I decided to disable r… --- ## [Change Indices Name after Snapshot](https://discuss.elastic.co/t/change-indices-name-after-snapshot/226603)
**Author:** [@jamesyone](https://discuss.elastic.co/u/jamesyone)\ **Replies:** 3\ **Last updated:** [April 6, 2020, 5:39am UTC](https://discuss.elastic.co/t/change-indices-name-after-snapshot/226603 "2020-04-06T05:39:12Z")
Hi, I was able to take a manual screenshot of a index and transfer it to another domain. Is there a way to change that index name to a new index name when I restore the screenshot to the other domain? Thanks --- ## [Keyword Insensitive Match](https://discuss.elastic.co/t/keyword-insensitive-match/226549)
**Author:** [@Jose\_Salgodo](https://discuss.elastic.co/u/Jose_Salgodo)\ **Replies:** 5\ **Last updated:** [April 6, 2020, 1:57am UTC](https://discuss.elastic.co/t/keyword-insensitive-match/226549 "2020-04-06T01:57:12Z")
any way to make a keyword type case insensitive ? an example would be me using match query and the input would be "input" and the output "InPuT" --- ## [Elasticsearch mTLS connection to S3 (minio) to store snapshots](https://discuss.elastic.co/t/elasticsearch-mtls-connection-to-s3-minio-to-store-snapshots/223997)
**Author:** [@bikkina\_mahesh](https://discuss.elastic.co/u/bikkina_mahesh)\ **Replies:** 2\ **Last updated:** [April 6, 2020, 1:12am UTC](https://discuss.elastic.co/t/elasticsearch-mtls-connection-to-s3-minio-to-store-snapshots/223997 "2020-04-06T01:12:47Z")
Hi All, I want to store snapshots in s3 storage where it requires mutual auth (mTLS) ( Note : S3 is minio based) I have client.crt, client.key, root.crt at client side. I tried these steps, 1. openssl pkcs12 -export … --- ## [Join Statements](https://discuss.elastic.co/t/join-statements/226550)
**Author:** [@Vijayakumar\_Kannan](https://discuss.elastic.co/u/Vijayakumar_Kannan)\ **Replies:** 1\ **Last updated:** [April 5, 2020, 8:05pm UTC](https://discuss.elastic.co/t/join-statements/226550 "2020-04-05T20:05:58Z")
i have a log file . in which first line shows client login activity second line show file transfer activity. Common for both lines are pid. How to join based on pid field? --- ## [Newly created index template does not apply on old indices?](https://discuss.elastic.co/t/newly-created-index-template-does-not-apply-on-old-indices/226583)
**Author:** [@ghost\_recon](https://discuss.elastic.co/u/ghost_recon)\ **Replies:** 2\ **Last updated:** [April 5, 2020, 7:01pm UTC](https://discuss.elastic.co/t/newly-created-index-template-does-not-apply-on-old-indices/226583 "2020-04-05T19:01:29Z")
I newly created an index templates that has the following index-pattern log-\*, And i already have an old index under the name log-server which has a timestamp field that contains a different format than the default form… --- ## [Unable to add my JSON file to elasticsearch get error "Can't merge a non object mapping"](https://discuss.elastic.co/t/unable-to-add-my-json-file-to-elasticsearch-get-error-cant-merge-a-non-object-mapping/226562)
**Author:** [@zebulyon](https://discuss.elastic.co/u/zebulyon)\ **Replies:** 3\ **Last updated:** [April 5, 2020, 6:33pm UTC](https://discuss.elastic.co/t/unable-to-add-my-json-file-to-elasticsearch-get-error-cant-merge-a-non-object-mapping/226562 "2020-04-05T18:33:53Z")
Hello, I'm currently running the ELK-stack through the official docker containers version 7.6.0. I have some json files generated by using tshark to convert pcap files to JSON. As per this guide: Now I'm trying to a… --- ## [Restore snapshot](https://discuss.elastic.co/t/restore-snapshot/224188)
**Author:** [@debasisc](https://discuss.elastic.co/u/debasisc)\ **Replies:** 8\ **Last updated:** [April 5, 2020, 11:55am UTC](https://discuss.elastic.co/t/restore-snapshot/224188 "2020-04-05T11:55:51Z")
I see this command in help site https://www.elastic.co/guide/en/elasticsearch/reference/current/snapshots-restore-snapshot.html POST /\_snapshot/my\_backup/snapshot\_1/\_restore But I am missing the prerequisite steps. H… --- ## [2 index same data](https://discuss.elastic.co/t/2-index-same-data/226551)
**Author:** [@legolas\_bilbao](https://discuss.elastic.co/u/legolas_bilbao)\ **Replies:** 7\ **Last updated:** [April 5, 2020, 10:51am UTC](https://discuss.elastic.co/t/2-index-same-data/226551 "2020-04-05T10:51:07Z")
Hi everybody , I've two index defined in the same logstash and the origin of the data are two different tables of a database. When i read the data with logstash and paint them into kibana, the data is mixed , why does … --- ## [Export exact log message from elastic searc](https://discuss.elastic.co/t/export-exact-log-message-from-elastic-searc/226559)
**Author:** [@Baharul](https://discuss.elastic.co/u/Baharul)\ **Replies:** 0\ **Last updated:** [April 5, 2020, 9:39am UTC](https://discuss.elastic.co/t/export-exact-log-message-from-elastic-searc/226559 "2020-04-05T09:39:23Z")
Hi , As a part of docker application we are sending all logs (server logs , application logs) to ELK . For analyzing product behavior we need to extract some logs in exact format that server generate like below screen a… --- ## [Exporting and importing Elastic data](https://discuss.elastic.co/t/exporting-and-importing-elastic-data/224470)
**Author:** [@Daniel\_Lupisella](https://discuss.elastic.co/u/Daniel_Lupisella)\ **Replies:** 2\ **Last updated:** [April 5, 2020, 6:25am UTC](https://discuss.elastic.co/t/exporting-and-importing-elastic-data/224470 "2020-04-05T06:25:24Z")
Hello all, I recently was using Elastic to do some testing. I exported the data from my running instance of Elastic using the Save, Share, Generate CSV method. I started up a new instance to continue working at home (… --- ## [Logging Cluster Architecture](https://discuss.elastic.co/t/logging-cluster-architecture/225715)
**Author:** [@LaurentB1](https://discuss.elastic.co/u/LaurentB1)\ **Replies:** 2\ **Last updated:** [April 5, 2020, 3:26am UTC](https://discuss.elastic.co/t/logging-cluster-architecture/225715 "2020-04-05T03:26:19Z")
Dear all, I want to setup a logging cluster with ES. The ingestion should be 2000 Event per Seconds, meaning 160GB per day (hypothesis: 1 log is 1kb). The retention time is 365 days and the hot retention time is 15 days… --- ## [Completed my search ui app, node/react -- how do I deploy to website](https://discuss.elastic.co/t/completed-my-search-ui-app-node-react-how-do-i-deploy-to-website/226536)
**Author:** [@nickdeckerdevs](https://discuss.elastic.co/u/nickdeckerdevs)\ **Replies:** 1\ **Last updated:** [April 4, 2020, 8:00pm UTC](https://discuss.elastic.co/t/completed-my-search-ui-app-node-react-how-do-i-deploy-to-website/226536 "2020-04-04T20:00:00Z")
Hey all, I'm a little confused on this and I've been trying to find some resources on this but I just think I'm not searching for the right words as I am not sure what I'm really trying to do. I'm trying to take my reac… --- ## [Suppress deprecation notice using 6.8](https://discuss.elastic.co/t/suppress-deprecation-notice-using-6-8/226494)
**Author:** [@nages](https://discuss.elastic.co/u/nages)\ **Replies:** 5\ **Last updated:** [April 4, 2020, 12:14pm UTC](https://discuss.elastic.co/t/suppress-deprecation-notice-using-6-8/226494 "2020-04-04T12:14:07Z")
I created a brand new index, the following deprecation notice is displayed. How to suppress it . Version : 6.8.8 #! Deprecation: the default number of shards will change from \[5\] to \[1\] in 7.0.0; if you wish to contin… --- ## [Elasticsearch sql is not working for some index](https://discuss.elastic.co/t/elasticsearch-sql-is-not-working-for-some-index/226223)
**Author:** [@sunitha.eswaraiah](https://discuss.elastic.co/u/sunitha.eswaraiah)\ **Replies:** 2\ **Last updated:** [April 4, 2020, 11:25am UTC](https://discuss.elastic.co/t/elasticsearch-sql-is-not-working-for-some-index/226223 "2020-04-04T11:25:02Z")
Hi, I'm unable to apply sql query on one index and i get this error, { "error": { "root\_cause": \[ { "type": "unsupported\_operation\_exception", "reason": null } \], "type": "unsu… --- ## [Lucene logging in ElasticSearch logs](https://discuss.elastic.co/t/lucene-logging-in-elasticsearch-logs/226497)
**Author:** [@dextermorgan](https://discuss.elastic.co/u/dextermorgan)\ **Replies:** 2\ **Last updated:** [April 4, 2020, 11:15am UTC](https://discuss.elastic.co/t/lucene-logging-in-elasticsearch-logs/226497 "2020-04-04T11:15:06Z")
I am on Elasticsearch 7.6.1 and to debug some issues, want to enable lucene logging in ES logs. Can anyone help with how can enable that? [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=964) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=966)