# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=978 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 979 --- ## [Intervals search with complicated before/after requirements](https://discuss.elastic.co/t/intervals-search-with-complicated-before-after-requirements/224850)
**Author:** [@andrew-matteson](https://discuss.elastic.co/u/andrew-matteson)\ **Replies:** 0\ **Last updated:** [March 24, 2020, 1:30pm UTC](https://discuss.elastic.co/t/intervals-search-with-complicated-before-after-requirements/224850 "2020-03-24T13:30:51Z")
I'm trying to develop a query that's based on several interval searches. One of the searches needs to exclude intervals containing a particular word if it appears in the interval, within the 10 preceding words before the… --- ## [Changing Column data in elasticsearch](https://discuss.elastic.co/t/changing-column-data-in-elasticsearch/224844)
**Author:** [@Sagar\_Mandal](https://discuss.elastic.co/u/Sagar_Mandal)\ **Replies:** 0\ **Last updated:** [March 24, 2020, 1:24pm UTC](https://discuss.elastic.co/t/changing-column-data-in-elasticsearch/224844 "2020-03-24T13:24:49Z")
Hii Team, I have another task where i want to change some data which is already stored in ES, for example Phone Number 9876543210 into Phone Number 98765xxxxx I just need to change this column in the indices which… --- ## [SSL Certificates used in ELK stack](https://discuss.elastic.co/t/ssl-certificates-used-in-elk-stack/224835)
**Author:** [@vladtepes](https://discuss.elastic.co/u/vladtepes)\ **Replies:** 2\ **Last updated:** [March 24, 2020, 1:21pm UTC](https://discuss.elastic.co/t/ssl-certificates-used-in-elk-stack/224835 "2020-03-24T13:21:47Z")
Greetings! I am a rookie, getting started with ElasticSearch and have a question regarding the SSL certificates used in the ELK stack. From what I've read in the guides, an SSL certificate is needed for Kibana, but for… --- ## [Elasticsearch Cluster size](https://discuss.elastic.co/t/elasticsearch-cluster-size/224382)
**Author:** [@dadadima](https://discuss.elastic.co/u/dadadima)\ **Replies:** 1\ **Last updated:** [March 24, 2020, 1:07pm UTC](https://discuss.elastic.co/t/elasticsearch-cluster-size/224382 "2020-03-24T13:07:32Z")
I have a dataset, on which I would like to perform Anomaly Detection. The data size until now is 15-20TB and it grows 10-15GB per day. I do not need to query much the data (of course I will do some data exploration on m… --- ## [Joining more indexes and paginate the result](https://discuss.elastic.co/t/joining-more-indexes-and-paginate-the-result/224808)
**Author:** [@Matteo\_Depascale](https://discuss.elastic.co/u/Matteo_Depascale)\ **Replies:** 1\ **Last updated:** [March 24, 2020, 12:28pm UTC](https://discuss.elastic.co/t/joining-more-indexes-and-paginate-the-result/224808 "2020-03-24T12:28:27Z")
Describe the feature: I'd like to be able to join more indexes and paginate the result Elasticsearch version: 6.8.0 URL: POST ... .../\_opendistro/\_sql/ Actual query: "query": "SELECT \* FROM file f JOIN document d ON… --- ## [Set up ILM for multiple index patterns](https://discuss.elastic.co/t/set-up-ilm-for-multiple-index-patterns/224825)
**Author:** [@JensVanDeynse](https://discuss.elastic.co/u/JensVanDeynse)\ **Replies:** 0\ **Last updated:** [March 24, 2020, 12:05pm UTC](https://discuss.elastic.co/t/set-up-ilm-for-multiple-index-patterns/224825 "2020-03-24T12:05:22Z")
Hello We are trying to set up ILM for our ELK Stack(s) but are running into some issues. The current scenario is as follows: We previously had one ELK Stack for all of our environments but decided to split this up per… --- ## [Updating Datafeed didn't affect anomaly detection results](https://discuss.elastic.co/t/updating-datafeed-didnt-affect-anomaly-detection-results/224624)
**Author:** [@adam-zarniewicz-wb](https://discuss.elastic.co/u/adam-zarniewicz-wb)\ **Replies:** 4\ **Last updated:** [March 24, 2020, 11:52am UTC](https://discuss.elastic.co/t/updating-datafeed-didnt-affect-anomaly-detection-results/224624 "2020-03-24T11:52:54Z")
Hi all, I needed to update Datafeed on one of my anomaly detection jobs. I stopped the datafeed, updated it by adding appropriate term to bool query, and started the datafeed again. Problem is that anomaly detector was … --- ## [How elasticsearch deals with the result of each shard?](https://discuss.elastic.co/t/how-elasticsearch-deals-with-the-result-of-each-shard/221864)
**Author:** [@wall](https://discuss.elastic.co/u/wall)\ **Replies:** 1\ **Last updated:** [March 24, 2020, 11:51am UTC](https://discuss.elastic.co/t/how-elasticsearch-deals-with-the-result-of-each-shard/221864 "2020-03-24T11:51:06Z")
Hi Elasticians! I was thinking in how Elasticsearch deals with the results from each shard and how it can lead to imprecise results, once each shard only knows about its data (I also read we can make it work precisely) … --- ## [When Watcher HTTP action fails, it reports it fails forever without ever actually retrying](https://discuss.elastic.co/t/when-watcher-http-action-fails-it-reports-it-fails-forever-without-ever-actually-retrying/224395)
**Author:** [@runtman](https://discuss.elastic.co/u/runtman)\ **Replies:** 9\ **Last updated:** [March 24, 2020, 11:18am UTC](https://discuss.elastic.co/t/when-watcher-http-action-fails-it-reports-it-fails-forever-without-ever-actually-retrying/224395 "2020-03-24T11:18:34Z")
Hello, so I got a watcher action that posts to an API for freshdesk (Ticket system) this works 99.9% of the time, but every now and then we receive a 502 back from Freshdesk. If this happens, every consequtive alert, wi… --- ## [Trying to create watcher but getting payload is "ctx.payload.hits.total.value" : null](https://discuss.elastic.co/t/trying-to-create-watcher-but-getting-payload-is-ctx-payload-hits-total-value-null/224787)
**Author:** [@sundar\_elk](https://discuss.elastic.co/u/sundar_elk)\ **Replies:** 1\ **Last updated:** [March 24, 2020, 10:51am UTC](https://discuss.elastic.co/t/trying-to-create-watcher-but-getting-payload-is-ctx-payload-hits-total-value-null/224787 "2020-03-24T10:51:39Z")
Hi Team, I am trying to create a watcher for 1 error message but I get stuck. I have executed steps from elasticsearch document https://www.elastic.co/guide/en/elasticsearch/reference/current/watcher-getting-started.ht… --- ## [Web Portocols and Ports used by Elasticsearch](https://discuss.elastic.co/t/web-portocols-and-ports-used-by-elasticsearch/220055)
**Author:** [@somebody](https://discuss.elastic.co/u/somebody)\ **Replies:** 17\ **Last updated:** [March 24, 2020, 10:37am UTC](https://discuss.elastic.co/t/web-portocols-and-ports-used-by-elasticsearch/220055 "2020-03-24T10:37:22Z")
Hi, I need to know all the protocols ( http, tcp.. etc) Elasticsearch uses for client-server communication (indexing, querying.. etc) Inter-communication between primary and replica shards ( For leader election, recov… --- ## [Enrich policy with daily index uses only oldest index after \_execute](https://discuss.elastic.co/t/enrich-policy-with-daily-index-uses-only-oldest-index-after-execute/224804)
**Author:** [@winlamp](https://discuss.elastic.co/u/winlamp)\ **Replies:** 0\ **Last updated:** [March 24, 2020, 10:32am UTC](https://discuss.elastic.co/t/enrich-policy-with-daily-index-uses-only-oldest-index-after-execute/224804 "2020-03-24T10:32:09Z")
Hi, i try to use an enrich policy that references to a daily index e.g. index-dd.mm.yyyy. When I change the content of the index and start ingestion the index is updated. All is fine. But as soon as I update the enrich … --- ## [PutIndexTemplateRequest problem using JSON as source - mappings fail to parse](https://discuss.elastic.co/t/putindextemplaterequest-problem-using-json-as-source-mappings-fail-to-parse/224803)
**Author:** [@Chris\_Samo](https://discuss.elastic.co/u/Chris_Samo)\ **Replies:** 0\ **Last updated:** [March 24, 2020, 10:29am UTC](https://discuss.elastic.co/t/putindextemplaterequest-problem-using-json-as-source-mappings-fail-to-parse/224803 "2020-03-24T10:29:26Z")
I'm trying to use the Elasticsearch Java SDK (7.6.0) to validate some index template JSON that I know works when sent to Elasticsearch's \_template endpoint through Kibana/direct to the Elasticsearch instance. Example te… --- ## [Boolean query with two conditions on a field](https://discuss.elastic.co/t/boolean-query-with-two-conditions-on-a-field/224313)
**Author:** [@Titan](https://discuss.elastic.co/u/Titan)\ **Replies:** 13\ **Last updated:** [March 24, 2020, 10:15am UTC](https://discuss.elastic.co/t/boolean-query-with-two-conditions-on-a-field/224313 "2020-03-24T10:15:48Z")
Applying range filter on a boolean field In a search query, I am trying to get product records that are either not suppressed or if suppressed then the suppression range is either before current time or after current ti… --- ## [QRadar data into Elasticsearch](https://discuss.elastic.co/t/qradar-data-into-elasticsearch/224800)
**Author:** [@Purushoth\_Kumar](https://discuss.elastic.co/u/Purushoth_Kumar)\ **Replies:** 0\ **Last updated:** [March 24, 2020, 10:14am UTC](https://discuss.elastic.co/t/qradar-data-into-elasticsearch/224800 "2020-03-24T10:14:35Z")
Hi Team, I need some help/guidance regarding integrating QRadar with Elastic. My requirement is to get EPS data from QRadar and store them in elasticserach for monitoring. Any little help is appreciated. Thanks for y… --- ## [Access and match a subfield (nested field) in a Painless script with the reindex API](https://discuss.elastic.co/t/access-and-match-a-subfield-nested-field-in-a-painless-script-with-the-reindex-api/224711)
**Author:** [@dsv](https://discuss.elastic.co/u/dsv)\ **Replies:** 2\ **Last updated:** [March 24, 2020, 9:44am UTC](https://discuss.elastic.co/t/access-and-match-a-subfield-nested-field-in-a-painless-script-with-the-reindex-api/224711 "2020-03-24T09:44:52Z")
I have to change type (reindex) a field "source.ip" from the text mapping type to the IP type. Because some of the "source.ip" values have non IP format (like "bob\_IP"). I've tried: POST \_reindex { "source": { … --- ## [Logs are being aggregated not separate lines](https://discuss.elastic.co/t/logs-are-being-aggregated-not-separate-lines/224652)
**Author:** [@calanon](https://discuss.elastic.co/u/calanon)\ **Replies:** 0\ **Last updated:** [March 23, 2020, 10:50am UTC](https://discuss.elastic.co/t/logs-are-being-aggregated-not-separate-lines/224652 "2020-03-23T10:50:25Z")
I am not sure if this is a logstash or elasticsearch subject. I am pulling nginx\_error logs from filebeats \> logstash \> elasticsearch The thing I have noticed that it is grouping all the messages together like the foll… --- ## [Fuzzy Hostname/FQDN Semantics](https://discuss.elastic.co/t/fuzzy-hostname-fqdn-semantics/224368)
**Author:** [@nemhods](https://discuss.elastic.co/u/nemhods)\ **Replies:** 2\ **Last updated:** [March 24, 2020, 8:17am UTC](https://discuss.elastic.co/t/fuzzy-hostname-fqdn-semantics/224368 "2020-03-24T08:17:13Z")
Hello, I'm normalizing hostnames and host name fields across multiple data sources and indices for security use cases. I'm struggling to find a consistent use of the Hostname/domain fields in ECS. Consider the use cas… --- ## [Template with asterisk name](https://discuss.elastic.co/t/template-with-asterisk-name/224452)
**Author:** [@fulkon](https://discuss.elastic.co/u/fulkon)\ **Replies:** 2\ **Last updated:** [March 24, 2020, 7:53am UTC](https://discuss.elastic.co/t/template-with-asterisk-name/224452 "2020-03-24T07:53:24Z")
Got an ELK stack with template name \*. I have created new index template with normal name, but how can I delete an index template with asterisk name? Thank You --- ## [Increase in Elasticsearch search latency after increasing instance memory to 64GB](https://discuss.elastic.co/t/increase-in-elasticsearch-search-latency-after-increasing-instance-memory-to-64gb/224223)
**Author:** [@the123saurav](https://discuss.elastic.co/u/the123saurav)\ **Replies:** 2\ **Last updated:** [March 23, 2020, 11:57am UTC](https://discuss.elastic.co/t/increase-in-elasticsearch-search-latency-after-increasing-instance-memory-to-64gb/224223 "2020-03-23T11:57:18Z")
We are using ES 6.0. We do not have any analysers in our index and all fields are "keyword" OR number OR date field. Our search queries are also simple bool queries without any aggregation. We are using EC2, and our p… --- ## [Out of memory on Client Node](https://discuss.elastic.co/t/out-of-memory-on-client-node/224780)
**Author:** [@Jorge\_Nunes1](https://discuss.elastic.co/u/Jorge_Nunes1)\ **Replies:** 0\ **Last updated:** [March 24, 2020, 7:28am UTC](https://discuss.elastic.co/t/out-of-memory-on-client-node/224780 "2020-03-24T07:28:45Z")
Hey everyone! On the last month I have configured an elastic search cluster as follows: 1 Client-node =\> dedicated server (i7 with 12GB ram with Heap Size of 6GB) 4 master-nodes/data-nodes =\> 2 dedicated servers (i7 w… --- ## [No shards assigning of an index on elastic version 2.X](https://discuss.elastic.co/t/no-shards-assigning-of-an-index-on-elastic-version-2-x/224766)
**Author:** [@Vishal\_Yadav](https://discuss.elastic.co/u/Vishal_Yadav)\ **Replies:** 4\ **Last updated:** [March 24, 2020, 6:48am UTC](https://discuss.elastic.co/t/no-shards-assigning-of-an-index-on-elastic-version-2-x/224766 "2020-03-24T06:48:51Z")
We have 15 Nodes cluster where 3 master 12 data Nodes. After hitting below comand curl -XGET 'localhost:9200/\_cat/shards?h=index,shard,prirep,state,unassigned.reason,unassigned.details'| grep UNASSIGNED index1 … --- ## [Fail to load elasticsearch index](https://discuss.elastic.co/t/fail-to-load-elasticsearch-index/224764)
**Author:** [@Sandeep\_Singh2](https://discuss.elastic.co/u/Sandeep_Singh2)\ **Replies:** 0\ **Last updated:** [March 24, 2020, 5:47am UTC](https://discuss.elastic.co/t/fail-to-load-elasticsearch-index/224764 "2020-03-24T05:47:19Z")
We recently upgraded ELK stack from 6.5 to 7.5.0. Via Kibana i am unable to load older index like last 1 day or 2 days in new version of 7.5.0. Below is the ES error log while trying to load 2 days index. Kibana Console… --- ## [How to index and store pdf file in elastic search using spring boot?](https://discuss.elastic.co/t/how-to-index-and-store-pdf-file-in-elastic-search-using-spring-boot/220289)
**Author:** [@samanvi\_sweety](https://discuss.elastic.co/u/samanvi_sweety)\ **Replies:** 50\ **Last updated:** [March 24, 2020, 3:08am UTC](https://discuss.elastic.co/t/how-to-index-and-store-pdf-file-in-elastic-search-using-spring-boot/220289 "2020-03-24T03:08:20Z")
I am new to elastic search. I would like to know how to index and store the pdf files in elastic search using spring boot microservices --- ## [Elastic pipeline can get current datetime from java](https://discuss.elastic.co/t/elastic-pipeline-can-get-current-datetime-from-java/224754)
**Author:** [@Hong](https://discuss.elastic.co/u/Hong)\ **Replies:** 1\ **Last updated:** [March 24, 2020, 2:30am UTC](https://discuss.elastic.co/t/elastic-pipeline-can-get-current-datetime-from-java/224754 "2020-03-24T02:30:24Z")
Continuing the discussion from How to update a filed with current date and time in ES5.6?: --- ## [Install elasticsearch in a running docker container](https://discuss.elastic.co/t/install-elasticsearch-in-a-running-docker-container/224743)
**Author:** [@Chandrak](https://discuss.elastic.co/u/Chandrak)\ **Replies:** 2\ **Last updated:** [March 24, 2020, 1:09am UTC](https://discuss.elastic.co/t/install-elasticsearch-in-a-running-docker-container/224743 "2020-03-24T01:09:19Z")
There is a lot of documentation on installing ELK using dockers e.g. https://github.com/deviantony/docker-elk However, I want to install ELK in a running docker container. I followed the instructions here https://w… --- ## [Issues with Bulk Sending data](https://discuss.elastic.co/t/issues-with-bulk-sending-data/224694)
**Author:** [@adwaitjoshi](https://discuss.elastic.co/u/adwaitjoshi)\ **Replies:** 7\ **Last updated:** [March 23, 2020, 10:43pm UTC](https://discuss.elastic.co/t/issues-with-bulk-sending-data/224694 "2020-03-23T22:43:58Z")
I am having a weird issue. I have a index template setup and I created an index. I tried sending data from dev inside KIBANA and it worked. One document went in. But when I try to send bulk through my code using python I… --- ## [Elasticsearch on AWS](https://discuss.elastic.co/t/elasticsearch-on-aws/224738)
**Author:** [@Bruceclegg](https://discuss.elastic.co/u/Bruceclegg)\ **Replies:** 1\ **Last updated:** [March 23, 2020, 9:56pm UTC](https://discuss.elastic.co/t/elasticsearch-on-aws/224738 "2020-03-23T21:56:43Z")
I'm new to this company and to ELK. I've been tasked with limiting the logs stored in our elasticsearch 6.8.6 deployment to logs less than 40 days old. My first thought was to do this with logrotate, but I googled first… --- ## [Reindex documents following a query in order to make a snapshot](https://discuss.elastic.co/t/reindex-documents-following-a-query-in-order-to-make-a-snapshot/224307)
**Author:** [@stack](https://discuss.elastic.co/u/stack)\ **Replies:** 5\ **Last updated:** [March 23, 2020, 5:59pm UTC](https://discuss.elastic.co/t/reindex-documents-following-a-query-in-order-to-make-a-snapshot/224307 "2020-03-23T17:59:04Z")
Hello, I am currently looking at making a snapshot of my Active Directory users login events that i have been gathering using Winlogbeat. I don't want to snapshot the whole winlogbeat index, just theses specifics event… --- ## [Spark is unable to write to ES when ElasticSearch is in Red state](https://discuss.elastic.co/t/spark-is-unable-to-write-to-es-when-elasticsearch-is-in-red-state/224692)
**Author:** [@Amit\_Hora](https://discuss.elastic.co/u/Amit_Hora)\ **Replies:** 2\ **Last updated:** [March 23, 2020, 5:43pm UTC](https://discuss.elastic.co/t/spark-is-unable-to-write-to-es-when-elasticsearch-is-in-red-state/224692 "2020-03-23T17:43:12Z")
Hi, Spark is unable to write to ES when the cluster is in Red state even when the index to which the spark is reading/writing is 100% available, in Green state. The Spark job just hangs, it doesn't fail or timeout Is … [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=977) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=979)