# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=967 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 968 --- ## [Track alert state change](https://discuss.elastic.co/t/track-alert-state-change/226411)
**Author:** [@Haris\_Brackovic](https://discuss.elastic.co/u/Haris_Brackovic)\ **Replies:** 0\ **Last updated:** [April 3, 2020, 2:09pm UTC](https://discuss.elastic.co/t/track-alert-state-change/226411 "2020-04-03T14:09:45Z")
Hi, I am using Elasticsearch v 7.1. I have several alerts set in Kibana and I need to track when the alert state changes from triggerd back to OK. I need to send the notification when things go back to normal. Example: … --- ## [Not able to restore snap shot from 5.6.3 to 7.4.2 elastic search](https://discuss.elastic.co/t/not-able-to-restore-snap-shot-from-5-6-3-to-7-4-2-elastic-search/225679)
**Author:** [@abhishek1](https://discuss.elastic.co/u/abhishek1)\ **Replies:** 7\ **Last updated:** [April 3, 2020, 2:05pm UTC](https://discuss.elastic.co/t/not-able-to-restore-snap-shot-from-5-6-3-to-7-4-2-elastic-search/225679 "2020-04-03T14:05:45Z")
Hello , Actually i have installed 5.6.3 elasticsearch and created some indexes not i want to install new version of elastic search 7.4.2 so in that case i followed below steps 1.Take backup by creating snap shot for 5.… --- ## [Couln't start Elasticsearch. Exiting.No Error.How to troubleshooting!](https://discuss.elastic.co/t/coulnt-start-elasticsearch-exiting-no-error-how-to-troubleshooting/226300)
**Author:** [@echotj](https://discuss.elastic.co/u/echotj)\ **Replies:** 1\ **Last updated:** [April 3, 2020, 2:05pm UTC](https://discuss.elastic.co/t/coulnt-start-elasticsearch-exiting-no-error-how-to-troubleshooting/226300 "2020-04-03T14:05:36Z")
Hello,I have a trouble of this "Couln't start Elasticsearch. Exiting" and No Error report.And search the logs.canot find any error.How to solve this problem. And the elk's version is 6.8, and the elasticsearch.yml ： netw… --- ## [Field Collapsing not working](https://discuss.elastic.co/t/field-collapsing-not-working/226342)
**Author:** [@jseow](https://discuss.elastic.co/u/jseow)\ **Replies:** 1\ **Last updated:** [April 3, 2020, 2:02pm UTC](https://discuss.elastic.co/t/field-collapsing-not-working/226342 "2020-04-03T14:02:19Z")
Hi, I'm having some issues with field-collapsing. I tried the following to no avail. The query: { "size": 1, "from": 1, "query": { "match": { "model": "Sonic"} }, "sort": \[ { "model": "desc" } \], "collapse"… --- ## [Throttle\_period if request change](https://discuss.elastic.co/t/throttle-period-if-request-change/226363)
**Author:** [@Downer](https://discuss.elastic.co/u/Downer)\ **Replies:** 1\ **Last updated:** [April 3, 2020, 2:00pm UTC](https://discuss.elastic.co/t/throttle-period-if-request-change/226363 "2020-04-03T14:00:02Z")
Hello ! I'm actually trying to monitor some url and return its status if error. I am ok with that and I added a throttle\_period = 10m to prevent spam (my interval is 1m) but if a new url fall in this period I will get t… --- ## [Graduated prices on documents](https://discuss.elastic.co/t/graduated-prices-on-documents/226378)
**Author:** [@Max\_van\_der\_Sluis](https://discuss.elastic.co/u/Max_van_der_Sluis)\ **Replies:** 4\ **Last updated:** [April 3, 2020, 1:59pm UTC](https://discuss.elastic.co/t/graduated-prices-on-documents/226378 "2020-04-03T13:59:33Z")
I'm having issues implementing graduated prices in Elasticsearch. This is the mapping I use (I can change it, as long as it all stays in the same index): PUT /sw\_shop1\_product/\_mapping { "properties": { … --- ## [Seeing "unknown\_ca" error for elastichsearch pod](https://discuss.elastic.co/t/seeing-unknown-ca-error-for-elastichsearch-pod/226383)
**Author:** [@kasim123](https://discuss.elastic.co/u/kasim123)\ **Replies:** 0\ **Last updated:** [April 3, 2020, 10:10am UTC](https://discuss.elastic.co/t/seeing-unknown-ca-error-for-elastichsearch-pod/226383 "2020-04-03T10:10:04Z")
Hi Team, I configured elasticsearch cluster using official helm chart and enabled x-pack security feature by creating PKC#12 certificates. Elasticsearch pod status shows running state when I check in kubernetes cluster… --- ## [Open index on restore snapshot action](https://discuss.elastic.co/t/open-index-on-restore-snapshot-action/226384)
**Author:** [@Wallie](https://discuss.elastic.co/u/Wallie)\ **Replies:** 1\ **Last updated:** [April 3, 2020, 1:52pm UTC](https://discuss.elastic.co/t/open-index-on-restore-snapshot-action/226384 "2020-04-03T13:52:58Z")
Am trying to move our ELK stack to a different machine to verify backup/restore procedure. A snapshot has been created on machine A, after creating a Repository. Moved full repository directory to machine B, added the r… --- ## [Unable to create elasticsearch index from logstash.conf file](https://discuss.elastic.co/t/unable-to-create-elasticsearch-index-from-logstash-conf-file/225693)
**Author:** [@sachinarora](https://discuss.elastic.co/u/sachinarora)\ **Replies:** 6\ **Last updated:** [April 3, 2020, 1:37pm UTC](https://discuss.elastic.co/t/unable-to-create-elasticsearch-index-from-logstash-conf-file/225693 "2020-04-03T13:37:30Z")
I am trying to create index of elasticsearch using logstash.conf file but I am not able to create index. There is not any error in logs of elasticsearch and logstash. After starting the logstash whenever I do url/\_cat/in… --- ## [Max Shards allowed per Index](https://discuss.elastic.co/t/max-shards-allowed-per-index/224881)
**Author:** [@sreekanth](https://discuss.elastic.co/u/sreekanth)\ **Replies:** 3\ **Last updated:** [April 3, 2020, 1:34pm UTC](https://discuss.elastic.co/t/max-shards-allowed-per-index/224881 "2020-04-03T13:34:03Z")
We are planning to have 1 index which will host ~150TB of data. Ideally it is suggested to have 1 shard per 50GB. So i may end up in 3000 Shards!!! does ES really works with 3000 shards on 1 index? We don't have problem… --- ## [Put Elasticsearch behind Apache](https://discuss.elastic.co/t/put-elasticsearch-behind-apache/226233)
**Author:** [@Bergy27](https://discuss.elastic.co/u/Bergy27)\ **Replies:** 5\ **Last updated:** [April 3, 2020, 1:33pm UTC](https://discuss.elastic.co/t/put-elasticsearch-behind-apache/226233 "2020-04-03T13:33:04Z")
Hi guys, Maybe my question is dumb but I have an issue. I work on a remote server and I started Elasticsearch on default port (9200). The problem is that this port is closed from the outside. We can't access Elasticsear… --- ## [Ingest Node or Uploading data to website](https://discuss.elastic.co/t/ingest-node-or-uploading-data-to-website/225492)
**Author:** [@KaustubhB](https://discuss.elastic.co/u/KaustubhB)\ **Replies:** 5\ **Last updated:** [April 3, 2020, 1:30pm UTC](https://discuss.elastic.co/t/ingest-node-or-uploading-data-to-website/225492 "2020-04-03T13:30:03Z")
What I am doing currently is, fetching logs from one elastic search index. Now I want these logs to be accessible to other users through a good user interface. For that, I was thinking of two options- Create a small we… --- ## [Get some information in Message Watcher](https://discuss.elastic.co/t/get-some-information-in-message-watcher/225370)
**Author:** [@Downer](https://discuss.elastic.co/u/Downer)\ **Replies:** 6\ **Last updated:** [April 3, 2020, 1:29pm UTC](https://discuss.elastic.co/t/get-some-information-in-message-watcher/225370 "2020-04-03T13:29:25Z")
Hello ! I'm new in the world of elastic. I would like to know if it is possible with watcher to get some variables and use it in "Message" (example: slack). I would like to create a watcher that send me a message on sla… --- ## [Set-up Elastic Search and Kibana](https://discuss.elastic.co/t/set-up-elastic-search-and-kibana/226402)
**Author:** [@fmquasi](https://discuss.elastic.co/u/fmquasi)\ **Replies:** 1\ **Last updated:** [April 3, 2020, 12:53pm UTC](https://discuss.elastic.co/t/set-up-elastic-search-and-kibana/226402 "2020-04-03T12:53:17Z")
im new to elastic search and was wondering if someone can assist me on setting up information for Elastic search and Kibana - this is to be used for Log management and SIEM start-up --- ## [Optimize elasticsearch segment merge](https://discuss.elastic.co/t/optimize-elasticsearch-segment-merge/226327)
**Author:** [@quweiyu](https://discuss.elastic.co/u/quweiyu)\ **Replies:** 4\ **Last updated:** [April 3, 2020, 11:54am UTC](https://discuss.elastic.co/t/optimize-elasticsearch-segment-merge/226327 "2020-04-03T11:54:44Z")
All, We are running an elasticsearch load (48K documents / mins with elasticsearch 6.5) for 24 hours. There are 32 active main shards for each 8 hours (no replica shard). Here is what we see, Load runs well at the beg… --- ## [Elastic delete query](https://discuss.elastic.co/t/elastic-delete-query/226366)
**Author:** [@niraj\_pandey](https://discuss.elastic.co/u/niraj_pandey)\ **Replies:** 2\ **Last updated:** [April 3, 2020, 11:17am UTC](https://discuss.elastic.co/t/elastic-delete-query/226366 "2020-04-03T11:17:43Z")
Hi , I need to delete some data based on time from a index. Using below qury I am able to get all the data. curl -XGET 'http://abc6:9200/data\*/\_search?pretty' -H 'Content-Type: application/json' -d' { "query":{ "bool":… --- ## [Enrich processor: enrich multiple documents into one array](https://discuss.elastic.co/t/enrich-processor-enrich-multiple-documents-into-one-array/225567)
**Author:** [@nitzan.karni](https://discuss.elastic.co/u/nitzan.karni)\ **Replies:** 1\ **Last updated:** [April 3, 2020, 11:04am UTC](https://discuss.elastic.co/t/enrich-processor-enrich-multiple-documents-into-one-array/225567 "2020-04-03T11:04:27Z")
I have two indices. index1 and index2. Let say each document in index1 owes fields \[ "host.name", "ip"\] And each document in index2 owes fields \[ "host.name", "software"\] index2 can contain multiple documents fo… --- ## [Nodes randomly, temporarily, leaving 7.3.2 cluster](https://discuss.elastic.co/t/nodes-randomly-temporarily-leaving-7-3-2-cluster/224925)
**Author:** [@lag13](https://discuss.elastic.co/u/lag13)\ **Replies:** 16\ **Last updated:** [April 3, 2020, 9:49am UTC](https://discuss.elastic.co/t/nodes-randomly-temporarily-leaving-7-3-2-cluster/224925 "2020-04-03T09:49:55Z")
I'm really stumped here so I'm hoping that someone can point me in the right direction. Thanks! Over the past couple weeks I've noticed that nodes will occasionally leave our cluster and then rejoin a short time later a… --- ## [Add Field on the fly to the returned result](https://discuss.elastic.co/t/add-field-on-the-fly-to-the-returned-result/226361)
**Author:** [@keshara](https://discuss.elastic.co/u/keshara)\ **Replies:** 0\ **Last updated:** [April 3, 2020, 7:57am UTC](https://discuss.elastic.co/t/add-field-on-the-fly-to-the-returned-result/226361 "2020-04-03T07:57:58Z")
Hi, Think about a elasticsearch query result where i get two matched documents in two buckets as below. bucket1 =\> { "product": "abc", "price: "$100" } bucket2 =\> { "product": "xyz", "price": "$50" } now my require… --- ## [Question about "FileNotFoundException(no segments\* file found)" while allocating replica shard](https://discuss.elastic.co/t/question-about-filenotfoundexception-no-segments-file-found-while-allocating-replica-shard/226296)
**Author:** [@Hyunsoo\_Shim](https://discuss.elastic.co/u/Hyunsoo_Shim)\ **Replies:** 1\ **Last updated:** [April 3, 2020, 7:49am UTC](https://discuss.elastic.co/t/question-about-filenotfoundexception-no-segments-file-found-while-allocating-replica-shard/226296 "2020-04-03T07:49:55Z")
Hello, we have got an issue when we have replica allocation after making primary shard. \[System ENV\] ES version : 6.5.2 Cluster has total 6 nodes (one node per one instance) \[Scenario\] At first, we created an index … --- ## [How to give more importance to recent dates within a certain range?](https://discuss.elastic.co/t/how-to-give-more-importance-to-recent-dates-within-a-certain-range/226347)
**Author:** [@abhijith\_chandran](https://discuss.elastic.co/u/abhijith_chandran)\ **Replies:** 1\ **Last updated:** [April 3, 2020, 7:29am UTC](https://discuss.elastic.co/t/how-to-give-more-importance-to-recent-dates-within-a-certain-range/226347 "2020-04-03T07:29:25Z")
Hi, I wanted to know whether it is possible to sort queries by most relevant within a specified range. For example, lets take three scores that have been returned by a query. Doc 1 = 85.1 - Date = 2 March 2020 Doc 2 … --- ## [How are matched\_queries ordered?](https://discuss.elastic.co/t/how-are-matched-queries-ordered/225581)
**Author:** [@abhijith\_chandran](https://discuss.elastic.co/u/abhijith_chandran)\ **Replies:** 2\ **Last updated:** [April 3, 2020, 6:56am UTC](https://discuss.elastic.co/t/how-are-matched-queries-ordered/225581 "2020-04-03T06:56:33Z")
Hi, I wanted to know in what order are the matched\_queries returned when we specify \_name? Is it in order of relevance? --- ## [ES errors - illegal\_argument\_exception](https://discuss.elastic.co/t/es-errors-illegal-argument-exception/226260)
**Author:** [@Juan\_Bertolotti](https://discuss.elastic.co/u/Juan_Bertolotti)\ **Replies:** 2\ **Last updated:** [April 3, 2020, 6:46am UTC](https://discuss.elastic.co/t/es-errors-illegal-argument-exception/226260 "2020-04-03T06:46:07Z")
Im getting the following error {"error":{"root\_cause":\[{"type":"illegal\_argument\_exception","reason":"No endpoint or operation is available at \[search\_shards\]"}\],"type":"illegal\_argument\_exception","reason":"No endpoint… --- ## [How to inspect write queue](https://discuss.elastic.co/t/how-to-inspect-write-queue/225986)
**Author:** [@hunsw](https://discuss.elastic.co/u/hunsw)\ **Replies:** 1\ **Last updated:** [April 3, 2020, 6:45am UTC](https://discuss.elastic.co/t/how-to-inspect-write-queue/225986 "2020-04-03T06:45:16Z")
I'm on 6.8... my write queues are filling up and I don't really know, how to inspect their contents. I have even stopped Logstashes, but something is constantly writing. Does recovery use the write queues? It's not cons… --- ## [Setup-Passwords for 3 nodes cluster](https://discuss.elastic.co/t/setup-passwords-for-3-nodes-cluster/226338)
**Author:** [@rufus001](https://discuss.elastic.co/u/rufus001)\ **Replies:** 2\ **Last updated:** [April 3, 2020, 6:34am UTC](https://discuss.elastic.co/t/setup-passwords-for-3-nodes-cluster/226338 "2020-04-03T06:34:46Z")
I can able to set password for elastic super user in single node cluster using x-pack security authentication with basic license (https://www.elastic.co/guide/en/elasticsearch/reference/6.2/setup-passwords.html). With th… --- ## [Index selection optimisation when \_index filter is used](https://discuss.elastic.co/t/index-selection-optimisation-when-index-filter-is-used/226324)
**Author:** [@vangap](https://discuss.elastic.co/u/vangap)\ **Replies:** 1\ **Last updated:** [April 3, 2020, 6:08am UTC](https://discuss.elastic.co/t/index-selection-optimisation-when-index-filter-is-used/226324 "2020-04-03T06:08:13Z")
If we take a query like below, where the index selection in request path has a wider scope, but we are only interested in results from a subset of the indices. GET 123-logs-\*/\_search?size=1 { "profile": true, "q… --- ## [Is it possible to seperate authentication from authorization in elasticsearch?](https://discuss.elastic.co/t/is-it-possible-to-seperate-authentication-from-authorization-in-elasticsearch/226270)
**Author:** [@Amine\_Maalfi](https://discuss.elastic.co/u/Amine_Maalfi)\ **Replies:** 1\ **Last updated:** [April 3, 2020, 5:57am UTC](https://discuss.elastic.co/t/is-it-possible-to-seperate-authentication-from-authorization-in-elasticsearch/226270 "2020-04-03T05:57:52Z")
Hello, my company want to use a custom java authentication filter but still interested in role based access of Elasticsearch is it possible or they should both be customized? Thanks in advance. --- ## [Snapshot has been deleted but can’t reduce disk usage](https://discuss.elastic.co/t/snapshot-has-been-deleted-but-can-t-reduce-disk-usage/226322)
**Author:** [@maddog](https://discuss.elastic.co/u/maddog)\ **Replies:** 0\ **Last updated:** [April 3, 2020, 5:14am UTC](https://discuss.elastic.co/t/snapshot-has-been-deleted-but-can-t-reduce-disk-usage/226322 "2020-04-03T05:14:23Z")
Hi All. I create daily indices and snapshots are created for indices 90 days and retain the snapshots for 7 more days. I create the NFS Fileshare Path for stored data index of the snapshot (3TB). but I have met a ques… --- ## [How to you search for a filebeat tag?](https://discuss.elastic.co/t/how-to-you-search-for-a-filebeat-tag/226321)
**Author:** [@meatwad](https://discuss.elastic.co/u/meatwad)\ **Replies:** 1\ **Last updated:** [April 3, 2020, 5:13am UTC](https://discuss.elastic.co/t/how-to-you-search-for-a-filebeat-tag/226321 "2020-04-03T05:13:02Z")
Hi, I'm trying to search for logs originating from nodes that have a specific tag defined in their filebeat configuration. Is there a way to do that in Elasticsearch? Thanks! --- ## [How to manage AppSearch's indexes lifecycle?](https://discuss.elastic.co/t/how-to-manage-appsearchs-indexes-lifecycle/225576)
**Author:** [@gpribi](https://discuss.elastic.co/u/gpribi)\ **Replies:** 2\ **Last updated:** [April 2, 2020, 10:59pm UTC](https://discuss.elastic.co/t/how-to-manage-appsearchs-indexes-lifecycle/225576 "2020-04-02T22:59:16Z")
Hello! I'm currently developing an autocomplete feature for my mobile marketplace using AppSearch, based on my products dataset, stored in my main database. I currently have about 100K documents loaded on my products in… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=966) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=968)