# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=985 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 986 --- ## [Few Clarifications about elasticsearch setup](https://discuss.elastic.co/t/few-clarifications-about-elasticsearch-setup/223729)
**Author:** [@kasim123](https://discuss.elastic.co/u/kasim123)\ **Replies:** 3\ **Last updated:** [March 17, 2020, 11:05am UTC](https://discuss.elastic.co/t/few-clarifications-about-elasticsearch-setup/223729 "2020-03-17T11:05:41Z")
Hi Team, I have configured elasticsearch STS object in k8s cluster using helm chart. I have defined following options in values.yaml. I am not still clear what it means. roles: master: "true" ingest: "true" dat… --- ## [ElasticSearch use aggregation over another aggregation result](https://discuss.elastic.co/t/elasticsearch-use-aggregation-over-another-aggregation-result/223579)
**Author:** [@Linu\_Radu](https://discuss.elastic.co/u/Linu_Radu)\ **Replies:** 1\ **Last updated:** [March 17, 2020, 10:58am UTC](https://discuss.elastic.co/t/elasticsearch-use-aggregation-over-another-aggregation-result/223579 "2020-03-17T10:58:55Z")
Having an elasticsearch aggregation result, I want to collect all duplicated values and to do a count on them. The desired result should be something similar to this: { \[ {"\[root, A, A.3, A.3.1, A.3.1.1\]": 1}, --\>… --- ## [Setting up Xpack security - stuck](https://discuss.elastic.co/t/setting-up-xpack-security-stuck/222766)
**Author:** [@amills](https://discuss.elastic.co/u/amills)\ **Replies:** 1\ **Last updated:** [March 17, 2020, 10:55am UTC](https://discuss.elastic.co/t/setting-up-xpack-security-stuck/222766 "2020-03-17T10:55:29Z")
Hello everyone, I recently setup a 3 server cluster of Elasticsearch, 2 server cluster of Logstash, and 1 Kibana server. Before I attempted to turn on https and xpack everything worked like a charm. I know I am getting … --- ## [How I can fix is\_write\_index=false in my indexes](https://discuss.elastic.co/t/how-i-can-fix-is-write-index-false-in-my-indexes/223900)
**Author:** [@David\_Oceans](https://discuss.elastic.co/u/David_Oceans)\ **Replies:** 0\ **Last updated:** [March 17, 2020, 10:27am UTC](https://discuss.elastic.co/t/how-i-can-fix-is-write-index-false-in-my-indexes/223900 "2020-03-17T10:27:21Z")
Hi, I have some indexes in read-only, I want to put the latest alias in write mode. But I received this error { "error": { "root\_cause": \[ { "type": "cluster\_block\_exception", "reas… --- ## [5 new hot nodes were added, but the relocating shards were all freeze nodes, and the number of freeze nodes was close to equilibrium. ES version 6.8.3](https://discuss.elastic.co/t/5-new-hot-nodes-were-added-but-the-relocating-shards-were-all-freeze-nodes-and-the-number-of-freeze-nodes-was-close-to-equilibrium-es-version-6-8-3/223897)
**Author:** [@zcola](https://discuss.elastic.co/u/zcola)\ **Replies:** 0\ **Last updated:** [March 17, 2020, 10:16am UTC](https://discuss.elastic.co/t/5-new-hot-nodes-were-added-but-the-relocating-shards-were-all-freeze-nodes-and-the-number-of-freeze-nodes-was-close-to-equilibrium-es-version-6-8-3/223897 "2020-03-17T10:16:28Z")
5 new hot nodes were added, but the relocating shards were all freeze nodes, and the number of freeze nodes was close to equilibrium. ES version 6.8.3 awk '{print $ NF}' 2005\_shards | sort | uniq -c | grep freeze | sort… --- ## [Create new role for read index](https://discuss.elastic.co/t/create-new-role-for-read-index/223880)
**Author:** [@Leonadius](https://discuss.elastic.co/u/Leonadius)\ **Replies:** 0\ **Last updated:** [March 17, 2020, 8:34am UTC](https://discuss.elastic.co/t/create-new-role-for-read-index/223880 "2020-03-17T08:34:57Z")
Greetings, I need some guidance for creating new role to read an index within 24 hours only. I did test creating new role on kibana with dev tools POST /\_security/role/timestamp\_restrict { "indices": \[ { "n… --- ## [Limit of total fields \[1000\] in index has been exceeded particular json's](https://discuss.elastic.co/t/limit-of-total-fields-1000-in-index-has-been-exceeded-particular-jsons/222627)
**Author:** [@Bahadir\_Eyuboglu](https://discuss.elastic.co/u/Bahadir_Eyuboglu)\ **Replies:** 12\ **Last updated:** [March 17, 2020, 10:00am UTC](https://discuss.elastic.co/t/limit-of-total-fields-1000-in-index-has-been-exceeded-particular-jsons/222627 "2020-03-17T10:00:26Z")
I have huge json files, so i split the json files and index them one by one but no matter how smallest the split gets, i get limit total fields exception, Im using elastisearch on python, and i splitthe json objects thr… --- ## [Local Elasticsearch 7.6.x Cluster with security features enabled](https://discuss.elastic.co/t/local-elasticsearch-7-6-x-cluster-with-security-features-enabled/223136)
**Author:** [@stsm](https://discuss.elastic.co/u/stsm)\ **Replies:** 2\ **Last updated:** [March 17, 2020, 8:57am UTC](https://discuss.elastic.co/t/local-elasticsearch-7-6-x-cluster-with-security-features-enabled/223136 "2020-03-17T08:57:45Z")
Hello! I have some trouble with a local ES-Cluster in relation to security features. I configured a simple three-node master/data (node.master|node.data:true) cluster. The cluster is up, running and 'green'. After tha… --- ## [Recommended cipher](https://discuss.elastic.co/t/recommended-cipher/223828)
**Author:** [@kinlee](https://discuss.elastic.co/u/kinlee)\ **Replies:** 3\ **Last updated:** [March 17, 2020, 8:44am UTC](https://discuss.elastic.co/t/recommended-cipher/223828 "2020-03-17T08:44:53Z")
Hi I want to set the http and transport protocol to TLSv1.2. I want to know the recommended ciphers that I can use with TLSv1.2. for now I have enabled, "TLS\_ECDHE\_ECDSA\_WITH\_AES\_256\_GCM\_SHA384", "TLS\_ECDHE\_ECDSA\_WIT… --- ## [Add elasticsearch node multiple machine](https://discuss.elastic.co/t/add-elasticsearch-node-multiple-machine/223443)
**Author:** [@Charles\_Yuliansen](https://discuss.elastic.co/u/Charles_Yuliansen)\ **Replies:** 16\ **Last updated:** [March 17, 2020, 8:40am UTC](https://discuss.elastic.co/t/add-elasticsearch-node-multiple-machine/223443 "2020-03-17T08:40:39Z")
Hi, im currently doing some poc about add node to elasticsearch cluster with multiple machine. The master node should be x.x.x.246 and the data node that i want to add is x.x.x.99. Running the latest elasticsearch 7.6. I… --- ## [Filter out buckets in a date\_histogram aggregated query](https://discuss.elastic.co/t/filter-out-buckets-in-a-date-histogram-aggregated-query/223869)
**Author:** [@ajacob](https://discuss.elastic.co/u/ajacob)\ **Replies:** 0\ **Last updated:** [March 17, 2020, 8:02am UTC](https://discuss.elastic.co/t/filter-out-buckets-in-a-date-histogram-aggregated-query/223869 "2020-03-17T08:02:35Z")
Hello ! I have documents with a field that can store multiple dates like this: { "documentId": 481012, "creationDate": "2016-06-02T17:30:34.232Z", "activationDates": \[ "2016-06-02T17:30:34.232Z", "2016-06-03T17:… --- ## [How to install and configure ELK stack on Docker](https://discuss.elastic.co/t/how-to-install-and-configure-elk-stack-on-docker/223851)
**Author:** [@Pathshala\_Gopi](https://discuss.elastic.co/u/Pathshala_Gopi)\ **Replies:** 7\ **Last updated:** [March 17, 2020, 7:16am UTC](https://discuss.elastic.co/t/how-to-install-and-configure-elk-stack-on-docker/223851 "2020-03-17T07:16:56Z")
Hello everyone, I tried a lot to install ELK on docker container but i am not able to do this can,can anyone guide me on this?? I followed lot of blogs and tutorials but no use can anyone help me on this topic. --- ## [Help need with geo\_poligon query](https://discuss.elastic.co/t/help-need-with-geo-poligon-query/223440)
**Author:** [@vadim-shadrin](https://discuss.elastic.co/u/vadim-shadrin)\ **Replies:** 5\ **Last updated:** [March 17, 2020, 4:30am UTC](https://discuss.elastic.co/t/help-need-with-geo-poligon-query/223440 "2020-03-17T04:30:09Z")
My index mapping is { "events" : { "mappings" : { "properties" : { "accepted" : { "type" : "nested" }, "address" : { "type" : "text" }, "available\_for" : { "properties" : { "key" : { "type" : "long" }, "v… --- ## [Cluster provision and benchmark stalls using Rally](https://discuss.elastic.co/t/cluster-provision-and-benchmark-stalls-using-rally/223231)
**Author:** [@ven100](https://discuss.elastic.co/u/ven100)\ **Replies:** 20\ **Last updated:** [March 17, 2020, 4:15am UTC](https://discuss.elastic.co/t/cluster-provision-and-benchmark-stalls-using-rally/223231 "2020-03-17T04:15:29Z")
Following the cluster benchmarking as per the Rally 1.4 documentation.I have three Virtual machines Coordinator is 10.156.129.118 (vm-1) Target are 10.156.129.121 (vm-2) and 10.156.129.169 (vm-4) On Coordinator: elas… --- ## [Software Security Process](https://discuss.elastic.co/t/software-security-process/223837)
**Author:** [@mhapner](https://discuss.elastic.co/u/mhapner)\ **Replies:** 2\ **Last updated:** [March 17, 2020, 3:27am UTC](https://discuss.elastic.co/t/software-security-process/223837 "2020-03-17T03:27:11Z")
Does Elasticsearch have a document/link that describes the steps an Elasticsearch release goes through (source scanning, penetration testing, etc) to detect software vulnerabilities in its code and the code of its depend… --- ## [Index template overwritten with default setup.template.overwrite false](https://discuss.elastic.co/t/index-template-overwritten-with-default-setup-template-overwrite-false/223684)
**Author:** [@MagicNotElastic](https://discuss.elastic.co/u/MagicNotElastic)\ **Replies:** 0\ **Last updated:** [March 16, 2020, 4:34am UTC](https://discuss.elastic.co/t/index-template-overwritten-with-default-setup-template-overwrite-false/223684 "2020-03-16T04:34:08Z")
in escloud I've got some index templates with optimized configuration, yet everytime they are being overwritten, logs confirms it: \[instance-0000000011\] adding template \[winlogbeat-7.5.2-blabla\] for index patterns \[win… --- ## [Status= 78/config Transport SSL must be enabled](https://discuss.elastic.co/t/status-78-config-transport-ssl-must-be-enabled/222181)
**Author:** [@snehid](https://discuss.elastic.co/u/snehid)\ **Replies:** 5\ **Last updated:** [March 16, 2020, 9:58pm UTC](https://discuss.elastic.co/t/status-78-config-transport-ssl-must-be-enabled/222181 "2020-03-16T21:58:30Z")
Failed to start Elasticsearch daemon in CentOS8 Error exit-code Status 78/config pls help --- ## [License and nodes](https://discuss.elastic.co/t/license-and-nodes/223820)
**Author:** [@Incauto](https://discuss.elastic.co/u/Incauto)\ **Replies:** 1\ **Last updated:** [March 16, 2020, 9:08pm UTC](https://discuss.elastic.co/t/license-and-nodes/223820 "2020-03-16T21:08:44Z")
I was reading on reddit that you buy licenses for individual nodes, so that means that if I have a docker cluster of three master nodes, and I have platinium licenses for only 2 nodes, my cluster will still have his li… --- ## [A document doesn't have a value for a vector field](https://discuss.elastic.co/t/a-document-doesnt-have-a-value-for-a-vector-field/223564)
**Author:** [@dvisz-inf](https://discuss.elastic.co/u/dvisz-inf)\ **Replies:** 2\ **Last updated:** [March 16, 2020, 7:09pm UTC](https://discuss.elastic.co/t/a-document-doesnt-have-a-value-for-a-vector-field/223564 "2020-03-16T19:09:48Z")
Hi all, Not all of my documents have a value for a vector field, and I seem to get this error when trying to use dotProductSparse on such documents: A document doesn't have a value for a vector field It seems that tes… --- ## [Adding rest\_total\_hits\_as\_int to php-client search() method](https://discuss.elastic.co/t/adding-rest-total-hits-as-int-to-php-client-search-method/223793)
**Author:** [@Sundeep\_Dangol](https://discuss.elastic.co/u/Sundeep_Dangol)\ **Replies:** 1\ **Last updated:** [March 16, 2020, 6:31pm UTC](https://discuss.elastic.co/t/adding-rest-total-hits-as-int-to-php-client-search-method/223793 "2020-03-16T18:31:46Z")
Hi How do i add rest\_total\_hits\_as\_int=true to search() method in php-client? i see in documentation below, it's mentioned in msearch method, but not in search. can we add rest\_total\_hits\_as\_int to search? https://www.e… --- ## [How can I make an SLM policy, that excludes specific indices by pattern?](https://discuss.elastic.co/t/how-can-i-make-an-slm-policy-that-excludes-specific-indices-by-pattern/223799)
**Author:** [@Guerteltier](https://discuss.elastic.co/u/Guerteltier)\ **Replies:** 0\ **Last updated:** [March 16, 2020, 5:08pm UTC](https://discuss.elastic.co/t/how-can-i-make-an-slm-policy-that-excludes-specific-indices-by-pattern/223799 "2020-03-16T17:08:01Z")
\-\*beat\* doesn't work. --- ## [Load balancing with Kibana](https://discuss.elastic.co/t/load-balancing-with-kibana/223753)
**Author:** [@drautenbach](https://discuss.elastic.co/u/drautenbach)\ **Replies:** 2\ **Last updated:** [March 16, 2020, 4:57pm UTC](https://discuss.elastic.co/t/load-balancing-with-kibana/223753 "2020-03-16T16:57:00Z")
Hi, We have the following configuration: 2x Elastic Master+Data Nodes (Live data centre) 1x Elastic Voting node (DR data centre) 2x Kibana Nodes (live data centre) 2x Logstash Nodes If I turn off any of the master+… --- ## [How to append a character to a string in elasticsearch?](https://discuss.elastic.co/t/how-to-append-a-character-to-a-string-in-elasticsearch/223778)
**Author:** [@guibvieira](https://discuss.elastic.co/u/guibvieira)\ **Replies:** 4\ **Last updated:** [March 16, 2020, 4:14pm UTC](https://discuss.elastic.co/t/how-to-append-a-character-to-a-string-in-elasticsearch/223778 "2020-03-16T16:14:28Z")
I am attempting to write a transformation while using the \_reindex API. The idea is that I'm taking an existing index, I want to reindex it and append a number to the end of a few hash string parameters in the process (t… --- ## [I can't get the S3 Snapshot Repository Plugin to work with MinIO](https://discuss.elastic.co/t/i-cant-get-the-s3-snapshot-repository-plugin-to-work-with-minio/223668)
**Author:** [@Guerteltier](https://discuss.elastic.co/u/Guerteltier)\ **Replies:** 7\ **Last updated:** [March 16, 2020, 4:10pm UTC](https://discuss.elastic.co/t/i-cant-get-the-s3-snapshot-repository-plugin-to-work-with-minio/223668 "2020-03-16T16:10:01Z")
PUT \_snapshot/MinIO { "type": "s3", "settings": { "client": "minio", "bucket": "asozial-private", "base\_path": "elasticsearch", "compress": true } } It causes the following error message: { "err… --- ## [Using two enrich policies in one ingestion pipeline](https://discuss.elastic.co/t/using-two-enrich-policies-in-one-ingestion-pipeline/223767)
**Author:** [@winlamp](https://discuss.elastic.co/u/winlamp)\ **Replies:** 8\ **Last updated:** [March 16, 2020, 4:09pm UTC](https://discuss.elastic.co/t/using-two-enrich-policies-in-one-ingestion-pipeline/223767 "2020-03-16T16:09:49Z")
Hi, I'm trying to enrich one index by applying two enrich policies with two different source indices. Here is my approach: "enrich": \[ { "policy\_name": "vehicle-database-policy", "field" : "vehicle.id", "target\_f… --- ## [Raw log message in kibana](https://discuss.elastic.co/t/raw-log-message-in-kibana/223759)
**Author:** [@kumar6](https://discuss.elastic.co/u/kumar6)\ **Replies:** 4\ **Last updated:** [March 16, 2020, 3:51pm UTC](https://discuss.elastic.co/t/raw-log-message-in-kibana/223759 "2020-03-16T15:51:55Z")
Hello, We have a requirement to send the entire raw log message along with parsed data. This will allow the users to view the parsed data as well raw log. Can someone let me know if this is feasible? --- ## [New Elasticsearch 7.6.0 cluster eventually becomes unresponsive](https://discuss.elastic.co/t/new-elasticsearch-7-6-0-cluster-eventually-becomes-unresponsive/223453)
**Author:** [@vchan2002](https://discuss.elastic.co/u/vchan2002)\ **Replies:** 2\ **Last updated:** [March 16, 2020, 3:39pm UTC](https://discuss.elastic.co/t/new-elasticsearch-7-6-0-cluster-eventually-becomes-unresponsive/223453 "2020-03-16T15:39:08Z")
This is really strange.... I have several ES clusters that was originally at 6.3, then 6.8.... There's various sources of logs flowing in (Beats, logstash, etc...) They are all at various versions between version 6 and 7… --- ## [Hot-warm setup](https://discuss.elastic.co/t/hot-warm-setup/222367)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 7\ **Last updated:** [March 16, 2020, 3:32pm UTC](https://discuss.elastic.co/t/hot-warm-setup/222367 "2020-03-16T15:32:16Z")
Can I setup something like this? 3 data only node with SSD disks, hot node node.master: false node.data: true node.box\_type: hot 3 master node with slow disk, warm node node.master: true node.data: true node.box\_… --- ## [Configuration of SMTP in elastic cloud](https://discuss.elastic.co/t/configuration-of-smtp-in-elastic-cloud/223743)
**Author:** [@dbElastic](https://discuss.elastic.co/u/dbElastic)\ **Replies:** 3\ **Last updated:** [March 16, 2020, 2:44pm UTC](https://discuss.elastic.co/t/configuration-of-smtp-in-elastic-cloud/223743 "2020-03-16T14:44:49Z")
Hi , We are using this configuration in elastic cloud for smtp : xpack.notification.email.account: exchange\_account: profile: outlook email\_defaults: from: smtp: auth: true starttls.enable: true host: smtp.off… --- ## [Update document, by moving a node within the document](https://discuss.elastic.co/t/update-document-by-moving-a-node-within-the-document/223721)
**Author:** [@chaim\_turkel](https://discuss.elastic.co/u/chaim_turkel)\ **Replies:** 1\ **Last updated:** [March 16, 2020, 2:04pm UTC](https://discuss.elastic.co/t/update-document-by-moving-a-node-within-the-document/223721 "2020-03-16T14:04:02Z")
I have a multiple document, that have nested objects. I need to move the location of the nested objects within the document. How can i do this, say move users out of groups in the following example: { "resourceGroup":… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=984) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=986)