# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=987 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 988 --- ## [UpdateByQuery API Response returns wrong status](https://discuss.elastic.co/t/updatebyquery-api-response-returns-wrong-status/223611)
**Author:** [@Om\_S\_Patel](https://discuss.elastic.co/u/Om_S_Patel)\ **Replies:** 0\ **Last updated:** [March 14, 2020, 11:16am UTC](https://discuss.elastic.co/t/updatebyquery-api-response-returns-wrong-status/223611 "2020-03-14T11:16:41Z")
I am facing issue with UpdateByQuery API while trying to update a document which doesn’t exist in Elasticsearch Problem description Step 1 - We are creating one index for each day like test\_index-2020.03.11, test\_index… --- ## [ES 7.6 on AWS ECS](https://discuss.elastic.co/t/es-7-6-on-aws-ecs/223431)
**Author:** [@jf11](https://discuss.elastic.co/u/jf11)\ **Replies:** 8\ **Last updated:** [March 14, 2020, 10:49am UTC](https://discuss.elastic.co/t/es-7-6-on-aws-ecs/223431 "2020-03-14T10:49:13Z")
Hello, Trust all is well. Im trying to setup a cluster on AWS ECS via Cloudformation. I've used ELK in the past and have been used to the older style dynamic node discovery for all nodes (data & masters) and in setting… --- ## [Updating Elastic license](https://discuss.elastic.co/t/updating-elastic-license/223530)
**Author:** [@Incauto](https://discuss.elastic.co/u/Incauto)\ **Replies:** 1\ **Last updated:** [March 14, 2020, 10:22am UTC](https://discuss.elastic.co/t/updating-elastic-license/223530 "2020-03-14T10:22:31Z")
Hi, I got a licence key (alphanumeric sequence), but checking the documentation it requires a json file to update the license, I was wandering if you can update the license with this key that I got....or do I need some o… --- ## [Store.size decreased drastically after reindexing data from 5.6 ES cluster to 7.6 ES cluster](https://discuss.elastic.co/t/store-size-decreased-drastically-after-reindexing-data-from-5-6-es-cluster-to-7-6-es-cluster/223400)
**Author:** [@Bharath\_Italapur](https://discuss.elastic.co/u/Bharath_Italapur)\ **Replies:** 7\ **Last updated:** [March 14, 2020, 9:34am UTC](https://discuss.elastic.co/t/store-size-decreased-drastically-after-reindexing-data-from-5-6-es-cluster-to-7-6-es-cluster/223400 "2020-03-14T09:34:27Z")
Hi, Thank you in advance, I reindexed 5 Gb data from 5.6 ES cluster to 7.6 ES cluster. The data size decreased to 2.7 Gb, But the document count is the same. Can I know why this is happening? The only difference betwe… --- ## [N-gram Tokenizer by words](https://discuss.elastic.co/t/n-gram-tokenizer-by-words/223471)
**Author:** [@David\_Han](https://discuss.elastic.co/u/David_Han)\ **Replies:** 2\ **Last updated:** [March 14, 2020, 7:16am UTC](https://discuss.elastic.co/t/n-gram-tokenizer-by-words/223471 "2020-03-14T07:16:54Z")
In elasticsearch , the n-gram means divide the string by letter. For example , "this is a dog" will divide to \['t','th','thi','this' .....etc\]. Is there a way to do n-gram by two words. For example , "this is a dog" w… --- ## [Index Management of beats](https://discuss.elastic.co/t/index-management-of-beats/223596)
**Author:** [@vbala21712](https://discuss.elastic.co/u/vbala21712)\ **Replies:** 0\ **Last updated:** [March 14, 2020, 2:42am UTC](https://discuss.elastic.co/t/index-management-of-beats/223596 "2020-03-14T02:42:58Z")
HI All, I am new to ELK. I want to create weekly basis index for each beats. is the below mentioned is good or do I needs to change here anaything? username: "{ES\_USR}" password: "{ES\_PWD}" index: "packetbeat-%{+xxx… --- ## [Any hard limit on the number of remote clusters?](https://discuss.elastic.co/t/any-hard-limit-on-the-number-of-remote-clusters/223592)
**Author:** [@iShiBin](https://discuss.elastic.co/u/iShiBin)\ **Replies:** 0\ **Last updated:** [March 13, 2020, 11:42pm UTC](https://discuss.elastic.co/t/any-hard-limit-on-the-number-of-remote-clusters/223592 "2020-03-13T23:42:48Z")
I am wondering whether there is a hard limit of the number of remote clusters. Can I support 200+ remote clusters? Also, what is some good practice and recommendation of setup so many remote clusters? Note: I am using … --- ## [Reload search analyzers fails "Request body is required"](https://discuss.elastic.co/t/reload-search-analyzers-fails-request-body-is-required/223586)
**Author:** [@Mark\_Walters](https://discuss.elastic.co/u/Mark_Walters)\ **Replies:** 1\ **Last updated:** [March 13, 2020, 11:02pm UTC](https://discuss.elastic.co/t/reload-search-analyzers-fails-request-body-is-required/223586 "2020-03-13T23:02:20Z")
Really confused why this is happening, local windows install works fine but a fresh install on a linux box, the command through Kibana: POST /index\_name/\_reload\_search\_analyzers gives { "error" : { "root\_cause" : \[ … --- ## [Bootstrap error regarding failure to lock memory](https://discuss.elastic.co/t/bootstrap-error-regarding-failure-to-lock-memory/223572)
**Author:** [@\_finack](https://discuss.elastic.co/u/_finack)\ **Replies:** 1\ **Last updated:** [March 13, 2020, 9:28pm UTC](https://discuss.elastic.co/t/bootstrap-error-regarding-failure-to-lock-memory/223572 "2020-03-13T21:28:53Z")
I have enabled the bootstrap.memory\_lock: true setting in elasticsearch.yml; however, Elasticsearch refuses to start due to failure during bootstrap check because it cannot lock the memory. The log advised the following: … --- ## [Machine learning datafeed preview return no data](https://discuss.elastic.co/t/machine-learning-datafeed-preview-return-no-data/222742)
**Author:** [@SpicyNotNumb](https://discuss.elastic.co/u/SpicyNotNumb)\ **Replies:** 1\ **Last updated:** [March 13, 2020, 9:02pm UTC](https://discuss.elastic.co/t/machine-learning-datafeed-preview-return-no-data/222742 "2020-03-13T21:02:17Z")
elastic version elasticsearch version 7.5.0 complate configuration Here is the complete machine learning anomaly detection configuration { "job\_id": "egress\_q\_bytes\_ml", "job\_type": "anomaly\_detector", "job\_versi… --- ## [Composite Agg after Date Filter](https://discuss.elastic.co/t/composite-agg-after-date-filter/223578)
**Author:** [@adaley222](https://discuss.elastic.co/u/adaley222)\ **Replies:** 0\ **Last updated:** [March 13, 2020, 8:56pm UTC](https://discuss.elastic.co/t/composite-agg-after-date-filter/223578 "2020-03-13T20:56:41Z")
I am trying to count documents over a week, for each hour/day of the week. So essentially, I'd like the output to be 7x24 =168 doc\_counts, for a specified date range. The code below nearly gives me what I need, however,… --- ## [How can i consult the status of reception of daily data in elasticsearch?](https://discuss.elastic.co/t/how-can-i-consult-the-status-of-reception-of-daily-data-in-elasticsearch/223570)
**Author:** [@Emna1](https://discuss.elastic.co/u/Emna1)\ **Replies:** 0\ **Last updated:** [March 13, 2020, 8:10pm UTC](https://discuss.elastic.co/t/how-can-i-consult-the-status-of-reception-of-daily-data-in-elasticsearch/223570 "2020-03-13T20:10:24Z")
I have a question please, i want to know the status of every csv file in elasticsearch after it readed by logstash : I want to see in elasticsearch date of entry of each csv files with the location(path of file) and t… --- ## [Helpers.scan throws a key error on ES python package 7.1 but not on 7.0.0](https://discuss.elastic.co/t/helpers-scan-throws-a-key-error-on-es-python-package-7-1-but-not-on-7-0-0/223567)
**Author:** [@Okhtay](https://discuss.elastic.co/u/Okhtay)\ **Replies:** 0\ **Last updated:** [March 13, 2020, 7:12pm UTC](https://discuss.elastic.co/t/helpers-scan-throws-a-key-error-on-es-python-package-7-1-but-not-on-7-0-0/223567 "2020-03-13T19:12:29Z")
I have a pipeline in production that ingests some data into an elasticsearch index. Recently we upgraded from version 5.4 to 7.4. We also upgraded the python package to v. 7.1. Now, elasticsearch.helpers.scan command th… --- ## [Get distinct count on a field by grouping on another field and select all rows with a condition on that count](https://discuss.elastic.co/t/get-distinct-count-on-a-field-by-grouping-on-another-field-and-select-all-rows-with-a-condition-on-that-count/223549)
**Author:** [@elasticdata101](https://discuss.elastic.co/u/elasticdata101)\ **Replies:** 0\ **Last updated:** [March 13, 2020, 5:28pm UTC](https://discuss.elastic.co/t/get-distinct-count-on-a-field-by-grouping-on-another-field-and-select-all-rows-with-a-condition-on-that-count/223549 "2020-03-13T17:28:53Z")
Hi, I am very new to elastic search and I need to write a query in Elasticsearch which is equivalent to the following SQL query: SELECT \* FROM table WHERE field1 IN (SELECT field1 FROM table GROUP BY field1 HAVING COUNT… --- ## [7.6.0 still attempting plaintext http](https://discuss.elastic.co/t/7-6-0-still-attempting-plaintext-http/221830)
**Author:** [@stefws](https://discuss.elastic.co/u/stefws)\ **Replies:** 4\ **Last updated:** [March 13, 2020, 5:25pm UTC](https://discuss.elastic.co/t/7-6-0-still-attempting-plaintext-http/221830 "2020-03-13T17:25:42Z")
Wondering about these log events on our elected master node: \[2020-03-03T08:46:57,125\]\[WARN \]\[o.e.x.s.t.n.SecurityNetty4HttpServerTransport\] \[es-mst2\] received plaintext http traffic on an https channel, closing connect… --- ## [Drop messages to log](https://discuss.elastic.co/t/drop-messages-to-log/223378)
**Author:** [@David\_Oceans](https://discuss.elastic.co/u/David_Oceans)\ **Replies:** 1\ **Last updated:** [March 13, 2020, 4:40pm UTC](https://discuss.elastic.co/t/drop-messages-to-log/223378 "2020-03-13T16:40:10Z")
Hi! I have a lot of documents saved in each minute because of LB of Google, the messages are like that: 10.xx.xx.xx - - \[12/Mar/2020:16:08:20 +0000\] "GET / HTTP/1.1" 200 7487 "-" "GoogleHC/1.0" "-" After investigate t… --- ## [How to configure index to ignore unmapped fields](https://discuss.elastic.co/t/how-to-configure-index-to-ignore-unmapped-fields/223352)
**Author:** [@hemamalini](https://discuss.elastic.co/u/hemamalini)\ **Replies:** 1\ **Last updated:** [March 13, 2020, 4:38pm UTC](https://discuss.elastic.co/t/how-to-configure-index-to-ignore-unmapped-fields/223352 "2020-03-13T16:38:51Z")
Hi All, I am using elastic search 5.6 for Apache Metron (They support 5.6). Is there any way to configure index to ignore unmapped fields for ES template and index --- ## [Aggregate through pages](https://discuss.elastic.co/t/aggregate-through-pages/223491)
**Author:** [@babayotakun](https://discuss.elastic.co/u/babayotakun)\ **Replies:** 1\ **Last updated:** [March 13, 2020, 4:30pm UTC](https://discuss.elastic.co/t/aggregate-through-pages/223491 "2020-03-13T16:30:32Z")
We have a query which returns a large number of results, sorted alphabetically and we're using a pagination to iterate through these pages. I wonder: can we use aggregations to get the page, containing the element with … --- ## [Breaking change v6 to v7 to search date\_time\_parse\_exception 'hh:mm:ss a'](https://discuss.elastic.co/t/breaking-change-v6-to-v7-to-search-date-time-parse-exception-hhss-a/217444)
**Author:** [@akatz](https://discuss.elastic.co/u/akatz)\ **Replies:** 6\ **Last updated:** [March 13, 2020, 4:24pm UTC](https://discuss.elastic.co/t/breaking-change-v6-to-v7-to-search-date-time-parse-exception-hhss-a/217444 "2020-03-13T16:24:22Z")
I have tested that the following query works in versions of ES 6 (6.2.3, 6.8.2), but fails in versions of 7 (7.1.1, 7.3.1). The query is: { "query": { "bool": { "filter": \[ { "range": { … --- ## [Problem Using 'must\_not' to Exclude Matches](https://discuss.elastic.co/t/problem-using-must-not-to-exclude-matches/223531)
**Author:** [@stephencr](https://discuss.elastic.co/u/stephencr)\ **Replies:** 4\ **Last updated:** [March 13, 2020, 3:52pm UTC](https://discuss.elastic.co/t/problem-using-must-not-to-exclude-matches/223531 "2020-03-13T15:52:25Z")
I'm trying to add a feature to my search where I can exclude users that contain certain hashtags from the result . My code for including users that contain all of the given hashtags works, and is the same as the code be… --- ## [How can I recover passwords after running "elasticsearch-setup-passwords" in a Windows environment?](https://discuss.elastic.co/t/how-can-i-recover-passwords-after-running-elasticsearch-setup-passwords-in-a-windows-environment/223539)
**Author:** [@RJ45](https://discuss.elastic.co/u/RJ45)\ **Replies:** 0\ **Last updated:** [March 13, 2020, 3:41pm UTC](https://discuss.elastic.co/t/how-can-i-recover-passwords-after-running-elasticsearch-setup-passwords-in-a-windows-environment/223539 "2020-03-13T15:41:34Z")
How can I recover passwords after running "elasticsearch-setup-passwords" in a Windows environment? --- ## [Standard tokenizer punctuation symbols removed](https://discuss.elastic.co/t/standard-tokenizer-punctuation-symbols-removed/223426)
**Author:** [@Chris\_Gatihi](https://discuss.elastic.co/u/Chris_Gatihi)\ **Replies:** 3\ **Last updated:** [March 13, 2020, 3:38pm UTC](https://discuss.elastic.co/t/standard-tokenizer-punctuation-symbols-removed/223426 "2020-03-13T15:38:30Z")
The ES documentation here \[0\] states this about the standard tokenizer: The standard tokenizer divides text into terms on word boundaries, as defined by the Unicode Text Segmentation algorithm. It removes most punctu… --- ## [Help with aggregation performance improvement for nested aggregations](https://discuss.elastic.co/t/help-with-aggregation-performance-improvement-for-nested-aggregations/223524)
**Author:** [@frankkoornstra](https://discuss.elastic.co/u/frankkoornstra)\ **Replies:** 0\ **Last updated:** [March 13, 2020, 2:28pm UTC](https://discuss.elastic.co/t/help-with-aggregation-performance-improvement-for-nested-aggregations/223524 "2020-03-13T14:28:19Z")
I'm trying to find out what the underlying problem for some of my searches' and aggregations' performance is but I can't seem to find any documentation on what the terms in the profiling breakdown mean and what I can do … --- ## [Need HELP with mapping referring to log output](https://discuss.elastic.co/t/need-help-with-mapping-referring-to-log-output/223520)
**Author:** [@carmine.fabrizio](https://discuss.elastic.co/u/carmine.fabrizio)\ **Replies:** 0\ **Last updated:** [March 13, 2020, 1:46pm UTC](https://discuss.elastic.co/t/need-help-with-mapping-referring-to-log-output/223520 "2020-03-13T13:46:43Z")
Hi, I am trying to understand how to define some static mapping, this is the log message that I have Mar 12 17:27:16 dev-jenkins filebeat: 2020-03-12T17:27:16.768-0400#011INFO#011\[monitoring\]#011log/log.go:145#011Non-z… --- ## [Does elasticsearch learn new synonyms and misspellings?](https://discuss.elastic.co/t/does-elasticsearch-learn-new-synonyms-and-misspellings/223509)
**Author:** [@alberto56](https://discuss.elastic.co/u/alberto56)\ **Replies:** 1\ **Last updated:** [March 13, 2020, 1:20pm UTC](https://discuss.elastic.co/t/does-elasticsearch-learn-new-synonyms-and-misspellings/223509 "2020-03-13T13:20:52Z")
Hi, I am new to Elasticsearch and I'm looking for a product which will do the following: Let's say people search for "physisian" and end up with no results, then try again with "physician" and click on a result, a would… --- ## [Installation of Watcher on Windows fails](https://discuss.elastic.co/t/installation-of-watcher-on-windows-fails/223241)
**Author:** [@aviman](https://discuss.elastic.co/u/aviman)\ **Replies:** 12\ **Last updated:** [March 13, 2020, 1:12pm UTC](https://discuss.elastic.co/t/installation-of-watcher-on-windows-fails/223241 "2020-03-13T13:12:24Z")
Hi, I am trying to install Watcher on Windows. But the commands fails. Images below Please help debugging the issue. Thanks --- ## [Policy based on a term](https://discuss.elastic.co/t/policy-based-on-a-term/223495)
**Author:** [@A\_Mightiev](https://discuss.elastic.co/u/A_Mightiev)\ **Replies:** 2\ **Last updated:** [March 13, 2020, 11:41am UTC](https://discuss.elastic.co/t/policy-based-on-a-term/223495 "2020-03-13T11:41:20Z")
I am ingesting logs which has very high verbosity, in order to cope with the high number of documents I wanted to create a policy in the index lifecyle, rolling over to cold an index after certain number of documents or … --- ## [Physical or virtualised vs docker vs redundancy](https://discuss.elastic.co/t/physical-or-virtualised-vs-docker-vs-redundancy/223494)
**Author:** [@Petr.Simik](https://discuss.elastic.co/u/Petr.Simik)\ **Replies:** 0\ **Last updated:** [March 13, 2020, 11:28am UTC](https://discuss.elastic.co/t/physical-or-virtualised-vs-docker-vs-redundancy/223494 "2020-03-13T11:28:15Z")
I have 2 clusters virtualised dockerised but both have several advantages/disadvantages I am asking for advice for best architecture setup from performance/reliability perspective. I am running 2 production clusters … --- ## [Alias on rollup index](https://discuss.elastic.co/t/alias-on-rollup-index/223027)
**Author:** [@apiras](https://discuss.elastic.co/u/apiras)\ **Replies:** 2\ **Last updated:** [March 13, 2020, 11:10am UTC](https://discuss.elastic.co/t/alias-on-rollup-index/223027 "2020-03-13T11:10:40Z")
Hi all, is it possible to create alias and alias with filters on one rollup index? Thanks in advance. Regards, Andrea --- ## [Updating the existing index in elastic search](https://discuss.elastic.co/t/updating-the-existing-index-in-elastic-search/222931)
**Author:** [@Thamini\_NellaiKumar](https://discuss.elastic.co/u/Thamini_NellaiKumar)\ **Replies:** 3\ **Last updated:** [March 13, 2020, 10:36am UTC](https://discuss.elastic.co/t/updating-the-existing-index-in-elastic-search/222931 "2020-03-13T10:36:52Z")
Hi, I have created the visualisation with the static data for my dashboard..now I want to change the data...is there any way to update the existing index without having to rework from the scratch? [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=986) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=988)