# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=969 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 970 --- ## [GeoTile Aggregation](https://discuss.elastic.co/t/geotile-aggregation/225552)
**Author:** [@Nishant\_Gauttam](https://discuss.elastic.co/u/Nishant_Gauttam)\ **Replies:** 9\ **Last updated:** [April 2, 2020, 5:33am UTC](https://discuss.elastic.co/t/geotile-aggregation/225552 "2020-04-02T05:33:27Z")
I am working on geo data. where I need to show the heatmaps based on aggregation. The data ponts are quite high in volume in any area so looking for some clustering techniques on server side. I came across geotile grid… --- ## [Search query exception "org.elasticsearch.index.query.QueryShardException: failed to create query"](https://discuss.elastic.co/t/search-query-exception-org-elasticsearch-index-query-queryshardexception-failed-to-create-query/225820)
**Author:** [@Suchita\_Gangurde](https://discuss.elastic.co/u/Suchita_Gangurde)\ **Replies:** 7\ **Last updated:** [April 2, 2020, 4:55am UTC](https://discuss.elastic.co/t/search-query-exception-org-elasticsearch-index-query-queryshardexception-failed-to-create-query/225820 "2020-04-02T04:55:32Z")
Hello, I am using elasticsearch version 7.3.1, on my local setup search query execution works fine. But the same query using docker image for es version 7.3.1 on kubernetes recently I am facing following exception: "m… --- ## [Search on Long is faster than keyword](https://discuss.elastic.co/t/search-on-long-is-faster-than-keyword/226145)
**Author:** [@kiranprakash154](https://discuss.elastic.co/u/kiranprakash154)\ **Replies:** 0\ **Last updated:** [April 2, 2020, 12:26am UTC](https://discuss.elastic.co/t/search-on-long-is-faster-than-keyword/226145 "2020-04-02T00:26:45Z")
Hi, I came across this article from ES on indexing fields as keywords would result in faster in search performance than having them as numerics I went ahead and benchmarked this and found out that this was not the case… --- ## [Data in old index has grok working, but new data in old index doesnt](https://discuss.elastic.co/t/data-in-old-index-has-grok-working-but-new-data-in-old-index-doesnt/226135)
**Author:** [@Mehak\_Bhargava](https://discuss.elastic.co/u/Mehak_Bhargava)\ **Replies:** 1\ **Last updated:** [April 1, 2020, 11:59pm UTC](https://discuss.elastic.co/t/data-in-old-index-has-grok-working-but-new-data-in-old-index-doesnt/226135 "2020-04-01T23:59:39Z")
I created an index 2 days ago, and that has some data in it. The groks were being applied on it and fields created. But now I ran my logstash, filebeat, kibana again with same index named and new data does not have grok … --- ## [Forcemerge on daily or on monthly](https://discuss.elastic.co/t/forcemerge-on-daily-or-on-monthly/226059)
**Author:** [@Norman\_Khine](https://discuss.elastic.co/u/Norman_Khine)\ **Replies:** 2\ **Last updated:** [April 1, 2020, 11:45pm UTC](https://discuss.elastic.co/t/forcemerge-on-daily-or-on-monthly/226059 "2020-04-01T23:45:49Z")
Hello, We are implementing an Index Lifecycle Policy each month to reindex our daily indexes into a monthly index using the \_reindex api From https://www.elastic.co/blog/managing-time-based-indices-efficiently has good… --- ## [Check if items need updating](https://discuss.elastic.co/t/check-if-items-need-updating/226114)
**Author:** [@permagne](https://discuss.elastic.co/u/permagne)\ **Replies:** 1\ **Last updated:** [April 1, 2020, 10:39pm UTC](https://discuss.elastic.co/t/check-if-items-need-updating/226114 "2020-04-01T22:39:12Z")
Hi, Currently working on a scheduled batch import. The items that are being saved may or may not contain updated values. My question is if I should first get the documents by IDs and check if the items need updating, … --- ## [I need to create a custom application that interfaces with Elasticsearch similar to how Rally does](https://discuss.elastic.co/t/i-need-to-create-a-custom-application-that-interfaces-with-elasticsearch-similar-to-how-rally-does/225904)
**Author:** [@davidmarsh](https://discuss.elastic.co/u/davidmarsh)\ **Replies:** 2\ **Last updated:** [April 1, 2020, 5:22pm UTC](https://discuss.elastic.co/t/i-need-to-create-a-custom-application-that-interfaces-with-elasticsearch-similar-to-how-rally-does/225904 "2020-04-01T17:22:15Z")
I've been studying Rally to try to see an example of how an application might interface with Elasticsearch. The problem is that so far I haven't discovered where Rally communicates with Elasticsearch. Of particular inter… --- ## [Should I connect to master or data nodes to index new documents?](https://discuss.elastic.co/t/should-i-connect-to-master-or-data-nodes-to-index-new-documents/226124)
**Author:** [@alecrooney](https://discuss.elastic.co/u/alecrooney)\ **Replies:** 1\ **Last updated:** [April 1, 2020, 9:06pm UTC](https://discuss.elastic.co/t/should-i-connect-to-master-or-data-nodes-to-index-new-documents/226124 "2020-04-01T21:06:41Z")
Seems like you can connect to any node and index and query data. If I have a cluster with 3 master nodes and 3+ data nodes, should I connect to the data nodes or master nodes to index or query documents? Should I round… --- ## [Word\_delimiter\_graph + preserve\_original = token position matters for "match" query](https://discuss.elastic.co/t/word-delimiter-graph-preserve-original-token-position-matters-for-match-query/225944)
**Author:** [@jetnet](https://discuss.elastic.co/u/jetnet)\ **Replies:** 1\ **Last updated:** [April 1, 2020, 7:29pm UTC](https://discuss.elastic.co/t/word-delimiter-graph-preserve-original-token-position-matters-for-match-query/225944 "2020-04-01T19:29:19Z")
following issue: DELETE test PUT test { "settings": { "number\_of\_shards": "1", "number\_of\_replicas": "0", "analysis": { "filter": { "word\_delimiter\_filter": { "type": "word\_delimit… --- ## [How to warm up shard request cache?](https://discuss.elastic.co/t/how-to-warm-up-shard-request-cache/226109)
**Author:** [@hhsuey](https://discuss.elastic.co/u/hhsuey)\ **Replies:** 0\ **Last updated:** [April 1, 2020, 6:00pm UTC](https://discuss.elastic.co/t/how-to-warm-up-shard-request-cache/226109 "2020-04-01T18:00:39Z")
We have an elasticsearch cluster with 1 small index and high read to write volumes. It has 1 primary and several replicas to handle the read loads. We turned on shard request cache for searches (with size\>0 hits). As exp… --- ## [Search character ( wild card )](https://discuss.elastic.co/t/search-character-wild-card/226091)
**Author:** [@hariskhalique](https://discuss.elastic.co/u/hariskhalique)\ **Replies:** 7\ **Last updated:** [April 1, 2020, 5:34pm UTC](https://discuss.elastic.co/t/search-character-wild-card/226091 "2020-04-01T17:34:56Z")
How we use wild card to search in elasticsearch. I try with following queries "query": { "wildcard": { "item\_name": { "value": "\*Iko\*", "boost": 1.0, "rewrite": "constant\_score" } } a… --- ## [\*Really\* Delete All Scrolls?](https://discuss.elastic.co/t/really-delete-all-scrolls/226097)
**Author:** [@vp\_tech](https://discuss.elastic.co/u/vp_tech)\ **Replies:** 0\ **Last updated:** [April 1, 2020, 5:18pm UTC](https://discuss.elastic.co/t/really-delete-all-scrolls/226097 "2020-04-01T17:18:08Z")
I'm familiar with DELETE /\_search/scroll/\_all But when I use it only a small handful of scrolls are actually closed (10-40) when I currently have 100s open. Is there a way to really clear all the open search contexts… --- ## [Using FROM option with delete by query](https://discuss.elastic.co/t/using-from-option-with-delete-by-query/225925)
**Author:** [@ninze](https://discuss.elastic.co/u/ninze)\ **Replies:** 3\ **Last updated:** [April 1, 2020, 5:13pm UTC](https://discuss.elastic.co/t/using-from-option-with-delete-by-query/225925 "2020-04-01T17:13:06Z")
Hi, I want to keep a max of 1000 latest documents (notifications) for each user. In case the search finds much more than that, I am trying to use "delete by query" to delete excess documents for the user. The docs for … --- ## [ILM Policy and Filebeat versions](https://discuss.elastic.co/t/ilm-policy-and-filebeat-versions/226095)
**Author:** [@t3fsx](https://discuss.elastic.co/u/t3fsx)\ **Replies:** 0\ **Last updated:** [April 1, 2020, 5:07pm UTC](https://discuss.elastic.co/t/ilm-policy-and-filebeat-versions/226095 "2020-04-01T17:07:08Z")
My setup is fairly simple. I use Filebeat, with all the default options to send to Elastic Cloud. My cluster is sized with 200GB. I see that each update of Filebeat is creating it's own ILM policy, and there's also an u… --- ## [SSL cert configuration for proxy and encryption for Elastic cluster nodes](https://discuss.elastic.co/t/ssl-cert-configuration-for-proxy-and-encryption-for-elastic-cluster-nodes/226093)
**Author:** [@chitraj8](https://discuss.elastic.co/u/chitraj8)\ **Replies:** 0\ **Last updated:** [April 1, 2020, 4:54pm UTC](https://discuss.elastic.co/t/ssl-cert-configuration-for-proxy-and-encryption-for-elastic-cluster-nodes/226093 "2020-04-01T16:54:27Z")
We have below setup for Elasticsearch consisting of stack components in front of haproxy server. cname and cert for below exists: data-eng.stats.com and urls below for elastic stack redirection from proxy data-eng.st… --- ## [Aggregate return all data](https://discuss.elastic.co/t/aggregate-return-all-data/226053)
**Author:** [@hariskhalique](https://discuss.elastic.co/u/hariskhalique)\ **Replies:** 9\ **Last updated:** [April 1, 2020, 4:37pm UTC](https://discuss.elastic.co/t/aggregate-return-all-data/226053 "2020-04-01T16:37:27Z")
Hi, Following is my query GET product\_detail\_info/\_search { "query": { "multi\_match": { "query": "a", "fields": \["item\_name", "description","cat\_name","item\_details"\] } }, "aggs": { "search\_result": { "terms"… --- ## [Set multiple base\_dn values in elasticsearch.yml](https://discuss.elastic.co/t/set-multiple-base-dn-values-in-elasticsearch-yml/226090)
**Author:** [@Yuriy](https://discuss.elastic.co/u/Yuriy)\ **Replies:** 0\ **Last updated:** [April 1, 2020, 4:35pm UTC](https://discuss.elastic.co/t/set-multiple-base-dn-values-in-elasticsearch-yml/226090 "2020-04-01T16:35:59Z")
In my Active Directory users are contained in two different organisation units: OU=users,OU=unit-01,DC=example,DC=com OU=users,OU=unit-02,DC=example,DC=com How can I set both base\_dn values with condition "OR" to opti… --- ## [Way to filtering search result by user/dept role?](https://discuss.elastic.co/t/way-to-filtering-search-result-by-user-dept-role/225842)
**Author:** [@111307](https://discuss.elastic.co/u/111307)\ **Replies:** 1\ **Last updated:** [April 1, 2020, 3:47pm UTC](https://discuss.elastic.co/t/way-to-filtering-search-result-by-user-dept-role/225842 "2020-04-01T15:47:18Z")
Hi Experts, I'm configuring intranet search page. One of the requirements of this project is that users can get the search result only in their department's data. I have "user id" & "dept id" fields but dont know how t… --- ## [Support of AWS (S3, EC2, ELB, Billing, etc.) in Apache Open source elasticsearch](https://discuss.elastic.co/t/support-of-aws-s3-ec2-elb-billing-etc-in-apache-open-source-elasticsearch/225843)
**Author:** [@Stephy\_Jacob](https://discuss.elastic.co/u/Stephy_Jacob)\ **Replies:** 1\ **Last updated:** [April 1, 2020, 3:37pm UTC](https://discuss.elastic.co/t/support-of-aws-s3-ec2-elb-billing-etc-in-apache-open-source-elasticsearch/225843 "2020-04-01T15:37:37Z")
Hi Team, Could you please explain more on AWS (S3, EC2, ELB, Billing, etc.) as a data source not supported in Open source license version of elasticsearch mentioned in this page. https://www.elastic.co/subscriptions W… --- ## [Log4j regex filter to avoid audit logs](https://discuss.elastic.co/t/log4j-regex-filter-to-avoid-audit-logs/226016)
**Author:** [@Javier\_Parrondo](https://discuss.elastic.co/u/Javier_Parrondo)\ **Replies:** 2\ **Last updated:** [April 1, 2020, 3:32pm UTC](https://discuss.elastic.co/t/log4j-regex-filter-to-avoid-audit-logs/226016 "2020-04-01T15:32:08Z")
Hello, I would like to avoid messages like the followings inside my {cluster\_name}\_audit.log: {"@timestamp":"2020-04-01T10:11:54,869", "xxxxxxxxxxxxxxxxxxx"user.name":"kibana", "user.realm":"reserved", "user.roles":\["k… --- ## [ES 7.1 repository type \[azure\] does not exist](https://discuss.elastic.co/t/es-7-1-repository-type-azure-does-not-exist/225468)
**Author:** [@jperezvt](https://discuss.elastic.co/u/jperezvt)\ **Replies:** 5\ **Last updated:** [April 1, 2020, 3:09pm UTC](https://discuss.elastic.co/t/es-7-1-repository-type-azure-does-not-exist/225468 "2020-04-01T15:09:23Z")
I'm running ES 7.1 in Azure govcloud, its working fine and now wish to setting snapshots. Here is what I've done Install plugin PLUGIN\_BIN=/usr/share/elasticsearch/bin/elasticsearch-plugin echo "y" | $PLUGIN\_BIN instal… --- ## [Is it a bad practice to stop ELK daily](https://discuss.elastic.co/t/is-it-a-bad-practice-to-stop-elk-daily/222458)
**Author:** [@nahiko2000](https://discuss.elastic.co/u/nahiko2000)\ **Replies:** 7\ **Last updated:** [April 1, 2020, 2:49pm UTC](https://discuss.elastic.co/t/is-it-a-bad-practice-to-stop-elk-daily/222458 "2020-04-01T14:49:44Z")
Hi! I guess it is a bad practice to stop Elastic/Logstash/Kibana in the evening and start it in the morning, but it is not going to be used (we use it for logs, some logs would be ingested, but they can be ingested in t… --- ## [Updating existing documents with a new field](https://discuss.elastic.co/t/updating-existing-documents-with-a-new-field/225701)
**Author:** [@kernelpanic](https://discuss.elastic.co/u/kernelpanic)\ **Replies:** 2\ **Last updated:** [April 1, 2020, 2:35pm UTC](https://discuss.elastic.co/t/updating-existing-documents-with-a-new-field/225701 "2020-04-01T14:35:15Z")
Hello all, we're ingesting Windows event logs via Logstash and to get specific field data from an application log I've got the following filter in Logstash: if \[log\_name\] == "CISAccess" { grok { match =\> { "mes… --- ## [Retrieve the last value of each "should" in a bool query](https://discuss.elastic.co/t/retrieve-the-last-value-of-each-should-in-a-bool-query/225634)
**Author:** [@LeopoldBriand](https://discuss.elastic.co/u/LeopoldBriand)\ **Replies:** 1\ **Last updated:** [April 1, 2020, 2:02pm UTC](https://discuss.elastic.co/t/retrieve-the-last-value-of-each-should-in-a-bool-query/225634 "2020-04-01T14:02:08Z")
Hi, I'm new to using Elastisearch and I'm completely stuck on a query. I've actually written this query that returns different values for all the ingredients. { "query": { "bool": { "must": … --- ## [Mount Shared Drive](https://discuss.elastic.co/t/mount-shared-drive/226035)
**Author:** [@cpb14pk](https://discuss.elastic.co/u/cpb14pk)\ **Replies:** 1\ **Last updated:** [April 1, 2020, 1:09pm UTC](https://discuss.elastic.co/t/mount-shared-drive/226035 "2020-04-01T13:09:58Z")
Hi, I am trying to mount a shared drive across three elasticsearch nodes with the aim of snapshotting an elasticsearch repository. I have three different nodes across three different centos servers, e.g. 10.212.145.10, … --- ## [Help with bundling search results](https://discuss.elastic.co/t/help-with-bundling-search-results/226041)
**Author:** [@MartinKip](https://discuss.elastic.co/u/MartinKip)\ **Replies:** 0\ **Last updated:** [April 1, 2020, 12:11pm UTC](https://discuss.elastic.co/t/help-with-bundling-search-results/226041 "2020-04-01T12:11:01Z")
Hello, I am having trouble finding out if and how the following use case can be done with ElasticSearch. I have an elastic cluster index with Real Estate properties. Some of these properties are the same property, but … --- ## [Why Filebeat is treating the the whole content of the file as a single message?](https://discuss.elastic.co/t/why-filebeat-is-treating-the-the-whole-content-of-the-file-as-a-single-message/225919)
**Author:** [@muntazirabbas](https://discuss.elastic.co/u/muntazirabbas)\ **Replies:** 0\ **Last updated:** [March 31, 2020, 4:53pm UTC](https://discuss.elastic.co/t/why-filebeat-is-treating-the-the-whole-content-of-the-file-as-a-single-message/225919 "2020-03-31T16:53:18Z")
Hi, I am trying to send some custome logs to elasticsearch but it seems filebeat is treating the content of the file as a single message while the file has many log entries. The file name syntax is as follows: F:\\inetp… --- ## [Index Lifecycle Management with document ids / routing](https://discuss.elastic.co/t/index-lifecycle-management-with-document-ids-routing/223968)
**Author:** [@Jorge\_Betancourt](https://discuss.elastic.co/u/Jorge_Betancourt)\ **Replies:** 2\ **Last updated:** [April 1, 2020, 9:48am UTC](https://discuss.elastic.co/t/index-lifecycle-management-with-document-ids-routing/223968 "2020-04-01T09:48:39Z")
Currently, we have a logging pipeline based on ELK (plus Filebeat). For quite some time we've been doing sharding based on a fixed number of shards, usually aiming to have ~40GB per shard. We're currently looking into au… --- ## [Error when Registering new Snapshot Repository](https://discuss.elastic.co/t/error-when-registering-new-snapshot-repository/225828)
**Author:** [@cpb14pk](https://discuss.elastic.co/u/cpb14pk)\ **Replies:** 5\ **Last updated:** [April 1, 2020, 9:35am UTC](https://discuss.elastic.co/t/error-when-registering-new-snapshot-repository/225828 "2020-04-01T09:35:21Z")
Hi, I am trying to snapshot an elasticsearch repository. I have three different nodes across three different servers, e.g. 10.212.145.10, 10.212.145.20, 10.212.145.30. I have added the path.repo field in my elasticsear… --- ## [Ingest attachment in nested type](https://discuss.elastic.co/t/ingest-attachment-in-nested-type/226014)
**Author:** [@mattiacareddu](https://discuss.elastic.co/u/mattiacareddu)\ **Replies:** 1\ **Last updated:** [April 1, 2020, 9:35am UTC](https://discuss.elastic.co/t/ingest-attachment-in-nested-type/226014 "2020-04-01T09:35:40Z")
Hi, I'm trying to index multiple documents in nested type using ingest attachment plugin. Simply I create my pipeline as follow: { "description": "Extract attachment information", "processors": \[ { … [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=968) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=970)