# Elasticsearch

**URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=975

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 976

---

## [How to connect from python to an elasticsearch cluster?](https://discuss.elastic.co/t/how-to-connect-from-python-to-an-elasticsearch-cluster/225251)

<div class="topic-metadata">

**Author:** [@GGUERRA](https://discuss.elastic.co/u/GGUERRA)\
**Replies:** 0\
**Last updated:** [March 26, 2020, 5:24pm UTC](https://discuss.elastic.co/t/how-to-connect-from-python-to-an-elasticsearch-cluster/225251 "2020-03-26T17:24:54Z")

</div>

Hi everyone! I have an elasticsearch cluster, one virtual machine per node and everything works fine. I want to connect to the cluster using python, I understand that there is a library and I have been reading it, but a…

---

## [Performance consideration for search cluster](https://discuss.elastic.co/t/performance-consideration-for-search-cluster/225240)

<div class="topic-metadata">

**Author:** [@Norman\_Khine](https://discuss.elastic.co/u/Norman_Khine)\
**Replies:** 1\
**Last updated:** [March 26, 2020, 4:52pm UTC](https://discuss.elastic.co/t/performance-consideration-for-search-cluster/225240 "2020-03-26T16:52:39Z")

</div>

Hello, We have a large catalogue of about 120,000,000 documents and we want to release these for general public consumption from different devices. What kind of things would I need to consider when designing the cluste…

---

## [Restoring snapshot failed during cleanup](https://discuss.elastic.co/t/restoring-snapshot-failed-during-cleanup/225244)

<div class="topic-metadata">

**Author:** [@acetin](https://discuss.elastic.co/u/acetin)\
**Replies:** 0\
**Last updated:** [March 26, 2020, 4:51pm UTC](https://discuss.elastic.co/t/restoring-snapshot-failed-during-cleanup/225244 "2020-03-26T16:51:16Z")

</div>

Hi, Trying to restore the snapshot of an index stored in S3. When I check the status of the snapshot I see this: curl -X GET "localhost:9200/\_snapshot/website/2020-2-24\_0-0-2/\_status?pretty" { "snapshots…

---

## [Getting the error - Request cannot be executed; I/O reactor status: STOPPED](https://discuss.elastic.co/t/getting-the-error-request-cannot-be-executed-i-o-reactor-status-stopped/223702)

<div class="topic-metadata">

**Author:** [@akshaymaniyar](https://discuss.elastic.co/u/akshaymaniyar)\
**Replies:** 5\
**Last updated:** [March 26, 2020, 4:38pm UTC](https://discuss.elastic.co/t/getting-the-error-request-cannot-be-executed-i-o-reactor-status-stopped/223702 "2020-03-26T16:38:44Z")

</div>

We are getting the below error when we are trying to do a getById call using high level rest client. We are using elasticsearch version 7.5.0. java.lang.RuntimeException: Request cannot be executed; I/O reactor status: …

---

## [Accounting Circuit Breaker](https://discuss.elastic.co/t/accounting-circuit-breaker/225238)

<div class="topic-metadata">

**Author:** [@anx-dan](https://discuss.elastic.co/u/anx-dan)\
**Replies:** 0\
**Last updated:** [March 26, 2020, 4:32pm UTC](https://discuss.elastic.co/t/accounting-circuit-breaker/225238 "2020-03-26T16:32:43Z")

</div>

I would like to understand the behaviour of the "Accounting Circuit Breaker" more. Unfortunately I could not find any good information on it so far. The documentation https://www.elastic.co/guide/en/elasticsearch/refe…

---

## [Cloudtrail logs have too many fields](https://discuss.elastic.co/t/cloudtrail-logs-have-too-many-fields/225236)

<div class="topic-metadata">

**Author:** [@mathur7vidit](https://discuss.elastic.co/u/mathur7vidit)\
**Replies:** 0\
**Last updated:** [March 26, 2020, 4:10pm UTC](https://discuss.elastic.co/t/cloudtrail-logs-have-too-many-fields/225236 "2020-03-26T16:10:11Z")

</div>

Team, we are using functionbeat for ingesting cloudtrail logs to ES. Previously we were using Logstash to parse cloudtrail data. Now in both the case, we observed that overall field count is too high.. its almost touch…

---

## [Is it possiable to add one more filed to existing index in elastic search,using java API](https://discuss.elastic.co/t/is-it-possiable-to-add-one-more-filed-to-existing-index-in-elastic-search-using-java-api/225139)

<div class="topic-metadata">

**Author:** [@upendra5](https://discuss.elastic.co/u/upendra5)\
**Replies:** 7\
**Last updated:** [March 26, 2020, 3:21pm UTC](https://discuss.elastic.co/t/is-it-possiable-to-add-one-more-filed-to-existing-index-in-elastic-search-using-java-api/225139 "2020-03-26T15:21:00Z")

</div>

Hi Team, I trying to add one more field to existing in elastic search using JAVA API. PutMappingRequest request = new PutMappingRequest(indexName); XContentBuilder mapping = XContentFactory.jsonBuilder(); mapping.st…

---

## [Need help with searching text with special characters](https://discuss.elastic.co/t/need-help-with-searching-text-with-special-characters/223172)

<div class="topic-metadata">

**Author:** [@Lisahtwy](https://discuss.elastic.co/u/Lisahtwy)\
**Replies:** 10\
**Last updated:** [March 26, 2020, 3:02pm UTC](https://discuss.elastic.co/t/need-help-with-searching-text-with-special-characters/223172 "2020-03-26T15:02:30Z")

</div>

Hi, I have created index for my files in a server using FsCrawler and using elastcsearch\_dsl&python program to match query. It is working fine for any text / numbers. But I need to search text with special characters s…

---

## [Sort items having the same score by date](https://discuss.elastic.co/t/sort-items-having-the-same-score-by-date/225212)

<div class="topic-metadata">

**Author:** [@slim-souissi](https://discuss.elastic.co/u/slim-souissi)\
**Replies:** 0\
**Last updated:** [March 26, 2020, 2:15pm UTC](https://discuss.elastic.co/t/sort-items-having-the-same-score-by-date/225212 "2020-03-26T14:15:33Z")

</div>

Hello , I need to sort items that matched having same score by a date field . This an example of the query "sort" : \[ "\_score", { "searchDate" : {"order" : "desc" } } \] This works perfectly . Now i want to convert t…

---

## [Unable to start elastcsearch 5.5.0 service, getting 203 error](https://discuss.elastic.co/t/unable-to-start-elastcsearch-5-5-0-service-getting-203-error/224706)

<div class="topic-metadata">

**Author:** [@bkanuroop](https://discuss.elastic.co/u/bkanuroop)\
**Replies:** 8\
**Last updated:** [March 26, 2020, 1:26pm UTC](https://discuss.elastic.co/t/unable-to-start-elastcsearch-5-5-0-service-getting-203-error/224706 "2020-03-26T13:26:52Z")

</div>

Hi, I have just installed elasticsearch 5.5.0 using RPM and I am not able to start the services, here is all the details, also I have uploaded the yml file. \[root@xxxxxx\]# systemctl status elasticsearch.service ● elas…

---

## [Sorting aggregation results with Java API](https://discuss.elastic.co/t/sorting-aggregation-results-with-java-api/224486)

<div class="topic-metadata">

**Author:** [@mrbarret](https://discuss.elastic.co/u/mrbarret)\
**Replies:** 7\
**Last updated:** [March 26, 2020, 2:43pm UTC](https://discuss.elastic.co/t/sorting-aggregation-results-with-java-api/224486 "2020-03-26T14:43:06Z")

</div>

I have below query that buckets results and sorts them in the order I want, but I am unable to translate this to the Java API. GET /my\_data\_set/\_search { "size": 0, "aggregations": { "toBeOrdered": { "term…

---

## [SAML group mapping](https://discuss.elastic.co/t/saml-group-mapping/225006)

<div class="topic-metadata">

**Author:** [@raphperrin](https://discuss.elastic.co/u/raphperrin)\
**Replies:** 7\
**Last updated:** [March 26, 2020, 1:36pm UTC](https://discuss.elastic.co/t/saml-group-mapping/225006 "2020-03-26T13:36:20Z")

</div>

Hi I am trying to map groups from my IDP. I can see in the SAML attributes that the group is provided see the json bellow \<saml2p:Response Destination="https://cc3412ce750740298512d2c9624fd110.ece.domain.com:9243/api/s…

---

## [Anomaly detection on ratio of two counts](https://discuss.elastic.co/t/anomaly-detection-on-ratio-of-two-counts/164842)

<div class="topic-metadata">

**Author:** [@nandrik](https://discuss.elastic.co/u/nandrik)\
**Replies:** 4\
**Last updated:** [March 26, 2020, 1:26pm UTC](https://discuss.elastic.co/t/anomaly-detection-on-ratio-of-two-counts/164842 "2020-03-26T13:26:57Z")

</div>

Hi, I'm indexing a log file where the majority of the lines contain actions but a small percentage (1-2%) contains error lines. I have managed to successfully plot the hourly error rate using either Timelion or the Visu…

---

## [IIS logs and hardware requirements](https://discuss.elastic.co/t/iis-logs-and-hardware-requirements/225012)

<div class="topic-metadata">

**Author:** [@devagp](https://discuss.elastic.co/u/devagp)\
**Replies:** 2\
**Last updated:** [March 26, 2020, 12:58pm UTC](https://discuss.elastic.co/t/iis-logs-and-hardware-requirements/225012 "2020-03-26T12:58:32Z")

</div>

Hello everyone, I'm new here and I would like to take some questions before using elastic. Can I collect logs from an IIS 10 website? Which tool do I use? Can I use the opensource version? If question number 1 is ok, w…

---

## [Search query doesnt working](https://discuss.elastic.co/t/search-query-doesnt-working/225191)

<div class="topic-metadata">

**Author:** [@Bahadir\_Eyuboglu](https://discuss.elastic.co/u/Bahadir_Eyuboglu)\
**Replies:** 0\
**Last updated:** [March 26, 2020, 12:23pm UTC](https://discuss.elastic.co/t/search-query-doesnt-working/225191 "2020-03-26T12:23:42Z")

</div>

I have 2 search query one is range query and other one is fuzzy query, i am sending queries trough python so my functions is look like for range query ''' resp2 = es.search(index="restaurants", doc\_type="docket",body…

---

## [Special Characters in Query String](https://discuss.elastic.co/t/special-characters-in-query-string/224971)

<div class="topic-metadata">

**Author:** [@mattiacareddu](https://discuss.elastic.co/u/mattiacareddu)\
**Replies:** 1\
**Last updated:** [March 26, 2020, 11:47am UTC](https://discuss.elastic.co/t/special-characters-in-query-string/224971 "2020-03-26T11:47:16Z")

</div>

Hi, I'm having trouble trying to search special characters using query string. I need to search an email address in format "xxx@xxx.xxx". At index time I use a custom normalizer which provide lowercase and ascii folding.…

---

## [How to use a variable with ctx\['\_source'\] without tokenising it](https://discuss.elastic.co/t/how-to-use-a-variable-with-ctx-source-without-tokenising-it/225164)

<div class="topic-metadata">

**Author:** [@uddhav](https://discuss.elastic.co/u/uddhav)\
**Replies:** 0\
**Last updated:** [March 26, 2020, 10:26am UTC](https://discuss.elastic.co/t/how-to-use-a-variable-with-ctx-source-without-tokenising-it/225164 "2020-03-26T10:26:28Z")

</div>

Following is my document structure "ListOfResourcesForTheTeam”:\[{"Resource":{"Name": "XYZ", "Phone": 31213}}, { "Resource":{"Name": "ABC", "Phone": 4365}}\] Using update\_by\_query using painless scripting I am trying to …

---

## [Xpack - User unauthorized to to curl Health checks](https://discuss.elastic.co/t/xpack-user-unauthorized-to-to-curl-health-checks/225143)

<div class="topic-metadata">

**Author:** [@Moritz\_Kiesewetter](https://discuss.elastic.co/u/Moritz_Kiesewetter)\
**Replies:** 2\
**Last updated:** [March 26, 2020, 9:21am UTC](https://discuss.elastic.co/t/xpack-user-unauthorized-to-to-curl-health-checks/225143 "2020-03-26T09:21:55Z")

</div>

Hello guys, i succesfully setup Xpack in my ELK-Cluster - now i have to get my monitoring to no throw any errors when checking /\_cluster/health?pretty So i added a user called "checkmk" with the following command: b…

---

## [Docker single container vs multiple containers](https://discuss.elastic.co/t/docker-single-container-vs-multiple-containers/225079)

<div class="topic-metadata">

**Author:** [@LenaSikirin](https://discuss.elastic.co/u/LenaSikirin)\
**Replies:** 9\
**Last updated:** [March 26, 2020, 8:49am UTC](https://discuss.elastic.co/t/docker-single-container-vs-multiple-containers/225079 "2020-03-26T08:49:14Z")

</div>

I'm going to setup ELK solution on single server with 16GB RAM and 2TB space. (I'm limited only to single server). After reading this article - i'm very confused.... Should I: run multiple docker containers on the si…

---

## [Unable to start Elastic on RHEL host](https://discuss.elastic.co/t/unable-to-start-elastic-on-rhel-host/224776)

<div class="topic-metadata">

**Author:** [@amty](https://discuss.elastic.co/u/amty)\
**Replies:** 3\
**Last updated:** [March 26, 2020, 7:21am UTC](https://discuss.elastic.co/t/unable-to-start-elastic-on-rhel-host/224776 "2020-03-26T07:21:38Z")

</div>

I installed Elastic as per this guide - https://www.elastic.co/guide/en/elasticsearch/reference/7.6/rpm.html OS info - NAME="Red Hat Enterprise Linux Server", VERSION="7.7 (Maipo)" Since my tmp direcgtory is set to NOE…

---

## [Failed to connect to localhost port 9200: Connection refused，----elasticsearch SETUP](https://discuss.elastic.co/t/failed-to-connect-to-localhost-port-9200-connection-refused-elasticsearch-setup/225092)

<div class="topic-metadata">

**Author:** [@Jennifer](https://discuss.elastic.co/u/Jennifer)\
**Replies:** 3\
**Last updated:** [March 26, 2020, 7:17am UTC](https://discuss.elastic.co/t/failed-to-connect-to-localhost-port-9200-connection-refused-elasticsearch-setup/225092 "2020-03-26T07:17:21Z")

</div>

oot@ubuntu1804:/usr/local/elasticsearch-7.6.1# /etc/init.d/elasticsearch start No passwd entry for user 'elsearch' elasticsearch is started root@ubuntu1804:/usr/local/elasticsearch-7.6.1# /usr/local/elasticsearch-7.6.…

---

## [Indexing very long word](https://discuss.elastic.co/t/indexing-very-long-word/224995)

<div class="topic-metadata">

**Author:** [@Jogi\_Michal](https://discuss.elastic.co/u/Jogi_Michal)\
**Replies:** 0\
**Last updated:** [March 25, 2020, 2:10pm UTC](https://discuss.elastic.co/t/indexing-very-long-word/224995 "2020-03-25T14:10:17Z")

</div>

Hi folks, I have a problem with the indexation of the text field... My mapping for this field looks like this: "metadata": { "type": "text" }, and some of the documents have there a very long string without whites…

---

## [Configure log4j2 in Elasticsearch (7x)](https://discuss.elastic.co/t/configure-log4j2-in-elasticsearch-7x/224777)

<div class="topic-metadata">

**Author:** [@RdrgPorto](https://discuss.elastic.co/u/RdrgPorto)\
**Replies:** 2\
**Last updated:** [March 26, 2020, 7:02am UTC](https://discuss.elastic.co/t/configure-log4j2-in-elasticsearch-7x/224777 "2020-03-26T07:02:25Z")

</div>

Hi everyone, I have just installed Elasticsearch 7.5.2 on Ubuntu 16.04 and I would like to configure Elasticsearch in order to retain only two log compressed files in /var/log/elasticsearch. I have modified log4j2.prop…

---

## [Authentication not working and mixed docs over the web](https://discuss.elastic.co/t/authentication-not-working-and-mixed-docs-over-the-web/225053)

<div class="topic-metadata">

**Author:** [@Dean\_Hiller](https://discuss.elastic.co/u/Dean_Hiller)\
**Replies:** 1\
**Last updated:** [March 26, 2020, 6:26am UTC](https://discuss.elastic.co/t/authentication-not-working-and-mixed-docs-over-the-web/225053 "2020-03-26T06:26:50Z")

</div>

This was great for getting a key but it didn't show me how to use it at all in curl ... https://www.elastic.co/guide/en/beats/metricbeat/current/beats-api-keys.html Then I find this https://www.elastic.co/guide/en/ela…

---

## [Does Rally support aliases?](https://discuss.elastic.co/t/does-rally-support-aliases/225098)

<div class="topic-metadata">

**Author:** [@vrozov](https://discuss.elastic.co/u/vrozov)\
**Replies:** 3\
**Last updated:** [March 26, 2020, 6:14am UTC](https://discuss.elastic.co/t/does-rally-support-aliases/225098 "2020-03-26T06:14:45Z")

</div>

I can't find anything in the documentation on how to work with aliases in Rally. Are they supported?

---

## [Improve restore speed from S3?](https://discuss.elastic.co/t/improve-restore-speed-from-s3/225120)

<div class="topic-metadata">

**Author:** [@CanardMoussant](https://discuss.elastic.co/u/CanardMoussant)\
**Replies:** 0\
**Last updated:** [March 26, 2020, 6:14am UTC](https://discuss.elastic.co/t/improve-restore-speed-from-s3/225120 "2020-03-26T06:14:44Z")

</div>

Hello, I have a single node cluster running on a i3.2xlarge on AWS (ES 6.8.3). I want to perform a restore from S3 (in the same region) and I am surprised that the network throughput moves between 200MB/s and 300MB/s. I…

---

## [Creating dedicated master nodes. How do we turn off coordinating responsibilities for master nodes?](https://discuss.elastic.co/t/creating-dedicated-master-nodes-how-do-we-turn-off-coordinating-responsibilities-for-master-nodes/225087)

<div class="topic-metadata">

**Author:** [@hhsuey](https://discuss.elastic.co/u/hhsuey)\
**Replies:** 3\
**Last updated:** [March 26, 2020, 5:08am UTC](https://discuss.elastic.co/t/creating-dedicated-master-nodes-how-do-we-turn-off-coordinating-responsibilities-for-master-nodes/225087 "2020-03-26T05:08:05Z")

</div>

Here it is stated that the master node should not be a coordinating node. Dedicated master-eligible nodes only have the master role, allowing them to focus on managing the cluster. While master nodes can also behave …

---

## [Extract a string from field Scripted field](https://discuss.elastic.co/t/extract-a-string-from-field-scripted-field/225108)

<div class="topic-metadata">

**Author:** [@rsuper\_6616](https://discuss.elastic.co/u/rsuper_6616)\
**Replies:** 0\
**Last updated:** [March 26, 2020, 4:27am UTC](https://discuss.elastic.co/t/extract-a-string-from-field-scripted-field/225108 "2020-03-26T04:27:50Z")

</div>

I am working on Elastic Cloud v7.6. I have a index that contain a field contains a text like this Status: 200-200 OK-OK Headers: Server=xxxxxxxxxx content-length=295 Cache-Control=private Content-Type=application/json;…

---

## [Create a custom analyze without tokenizer](https://discuss.elastic.co/t/create-a-custom-analyze-without-tokenizer/224045)

<div class="topic-metadata">

**Author:** [@David\_Han](https://discuss.elastic.co/u/David_Han)\
**Replies:** 2\
**Last updated:** [March 26, 2020, 4:03am UTC](https://discuss.elastic.co/t/create-a-custom-analyze-without-tokenizer/224045 "2020-03-26T04:03:40Z")

</div>

Is it a way to make a new analyzer without tokenizer ? As the document say that the tokenizer is necessary. But in my case , I need to analyze the field by " Shingle token filter". I want to use the two words gram by wo…

---

## [Internode communication metrics](https://discuss.elastic.co/t/internode-communication-metrics/225105)

<div class="topic-metadata">

**Author:** [@surilshah](https://discuss.elastic.co/u/surilshah)\
**Replies:** 0\
**Last updated:** [March 26, 2020, 3:42am UTC](https://discuss.elastic.co/t/internode-communication-metrics/225105 "2020-03-26T03:42:52Z")

</div>

Is there a way to get any kind of metrics on the internode communication happening? For example, when a search request comes in, how many calls are being made when doing a scatter gather? How much time is being taken in…

[Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=974)

[Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=976)
