# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=988 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 989 --- ## [AWS Elastic Search Vs Elastic search cloud](https://discuss.elastic.co/t/aws-elastic-search-vs-elastic-search-cloud/223458)
**Author:** [@DG13](https://discuss.elastic.co/u/DG13)\ **Replies:** 1\ **Last updated:** [March 13, 2020, 9:44am UTC](https://discuss.elastic.co/t/aws-elastic-search-vs-elastic-search-cloud/223458 "2020-03-13T09:44:53Z")
Hi , Current stack - single node ELK Env - PoC As I am planning to productionize ELK stack . I would like to hear thoughts from community people . which version works best . AWS Elastic Search Elastic Cloud Docke… --- ## [How to put mapping by JAVA API](https://discuss.elastic.co/t/how-to-put-mapping-by-java-api/223475)
**Author:** [@SomberOfShadow](https://discuss.elastic.co/u/SomberOfShadow)\ **Replies:** 1\ **Last updated:** [March 13, 2020, 9:40am UTC](https://discuss.elastic.co/t/how-to-put-mapping-by-java-api/223475 "2020-03-13T09:40:37Z")
hi， guys I met a problem that blockde me several days. I want to put mapping for a field by JAVA API but failed. Following is detailded information: My data struction is : { "mje-test-execution-id": "464b66ea6c914d… --- ## [Why elastic search is generating this files](https://discuss.elastic.co/t/why-elastic-search-is-generating-this-files/223460)
**Author:** [@rameshkr1994](https://discuss.elastic.co/u/rameshkr1994)\ **Replies:** 1\ **Last updated:** [March 13, 2020, 9:30am UTC](https://discuss.elastic.co/t/why-elastic-search-is-generating-this-files/223460 "2020-03-13T09:30:24Z")
Dear All. I don't know why this files is generating in elastic search side. i having more than 200 files generated by elastic and taking huge storage in machine. why? is below is solution? xpack.monitoring.enabled… --- ## [Get top n with date histogram](https://discuss.elastic.co/t/get-top-n-with-date-histogram/222843)
**Author:** [@ming1997](https://discuss.elastic.co/u/ming1997)\ **Replies:** 3\ **Last updated:** [March 13, 2020, 8:35am UTC](https://discuss.elastic.co/t/get-top-n-with-date-histogram/222843 "2020-03-13T08:35:53Z")
"aggs": { "2": { "date\_histogram": { "field": "@timestamp", "interval": "30s", "time\_zone": "Asia/Shanghai", "min\_doc\_count": 1 }, "aggs": { "3": { "terms": { "field": "flow.src\_addr.keyword", "order": { "\_c… --- ## [Cluster configuration advice](https://discuss.elastic.co/t/cluster-configuration-advice/221201)
**Author:** [@Amine\_Maalfi](https://discuss.elastic.co/u/Amine_Maalfi)\ **Replies:** 8\ **Last updated:** [March 13, 2020, 8:24am UTC](https://discuss.elastic.co/t/cluster-configuration-advice/221201 "2020-03-13T08:24:48Z")
Hello, I need to store logs generated by say 50 apps and the average log size a day is 5 GB with a retention period of a month, the write speed isn't important for me but the read time is, high availability isn't also t… --- ## [What is meant by Heap in relation to ES?](https://discuss.elastic.co/t/what-is-meant-by-heap-in-relation-to-es/223031)
**Author:** [@rgelb](https://discuss.elastic.co/u/rgelb)\ **Replies:** 9\ **Last updated:** [March 13, 2020, 6:37am UTC](https://discuss.elastic.co/t/what-is-meant-by-heap-in-relation-to-es/223031 "2020-03-13T06:37:07Z")
Consider the following situation: the node has 100 GB of RAM, but the ES heap size is 30 GB. Does this mean that ES will only ever use 30 GB of RAM? And the other 70 GB will go unused? If not, than what how does it use… --- ## [Any reason why having 1 shard is slower than 5 shards?](https://discuss.elastic.co/t/any-reason-why-having-1-shard-is-slower-than-5-shards/223429)
**Author:** [@NewHere](https://discuss.elastic.co/u/NewHere)\ **Replies:** 3\ **Last updated:** [March 13, 2020, 6:21am UTC](https://discuss.elastic.co/t/any-reason-why-having-1-shard-is-slower-than-5-shards/223429 "2020-03-13T06:21:39Z")
According to various online sources (e.g. https://www.elastic.co/guide/en/elasticsearch/reference/master/tune-for-search-speed.html), they all said fewer shard the faster. However, my experience was 5 shards index retur… --- ## [Configuring elasticsearch security in Cloud using helm](https://discuss.elastic.co/t/configuring-elasticsearch-security-in-cloud-using-helm/223449)
**Author:** [@sarvendras](https://discuss.elastic.co/u/sarvendras)\ **Replies:** 0\ **Last updated:** [March 13, 2020, 5:22am UTC](https://discuss.elastic.co/t/configuring-elasticsearch-security-in-cloud-using-helm/223449 "2020-03-13T05:22:03Z")
Hi All, Please suggest the configuration steps for implementing elastic-search security in Cloud using helm. Just like below steps we had done in local. Thanks Sarvendra --- ## [Field Aliases vs Copy](https://discuss.elastic.co/t/field-aliases-vs-copy/223102)
**Author:** [@NerdSec](https://discuss.elastic.co/u/NerdSec)\ **Replies:** 4\ **Last updated:** [March 13, 2020, 4:53am UTC](https://discuss.elastic.co/t/field-aliases-vs-copy/223102 "2020-03-13T04:53:47Z")
Hi Team, We are planning to use Wazuh for some of our monitoring needs. Wazuh does not support ECS. Now, I plan to make the Wazuh data ECS compliant for better monitoring! My question is, which of the following would b… --- ## [Elasticsearch cluster design for heavy ingestion](https://discuss.elastic.co/t/elasticsearch-cluster-design-for-heavy-ingestion/223446)
**Author:** [@Faiz\_Ahmed\_Mushtak\_H](https://discuss.elastic.co/u/Faiz_Ahmed_Mushtak_H)\ **Replies:** 0\ **Last updated:** [March 13, 2020, 4:33am UTC](https://discuss.elastic.co/t/elasticsearch-cluster-design-for-heavy-ingestion/223446 "2020-03-13T04:33:42Z")
We have setup a 13 node elasticsearch cluster (3 master, 10 data nodes) such that 7 of the data node have an attribute A=1 and 3 nodes have an attribute A=2 This is because we want to ingest a lot of data into the clust… --- ## [Applying filters in ElasticSearch](https://discuss.elastic.co/t/applying-filters-in-elasticsearch/223442)
**Author:** [@cravinder489](https://discuss.elastic.co/u/cravinder489)\ **Replies:** 0\ **Last updated:** [March 13, 2020, 4:04am UTC](https://discuss.elastic.co/t/applying-filters-in-elasticsearch/223442 "2020-03-13T04:04:06Z")
I have an index :idxquesanswer, in which i have a body field: "body" : { "type" : "text", "analyzer" : "synonym\_analyzer" } synonym\_analyzer is: "filter" : { "synonym\_filter" : { "type" … --- ## [Not working: Must query between array of records in nested type](https://discuss.elastic.co/t/not-working-must-query-between-array-of-records-in-nested-type/223222)
**Author:** [@deepak643](https://discuss.elastic.co/u/deepak643)\ **Replies:** 2\ **Last updated:** [March 12, 2020, 11:34pm UTC](https://discuss.elastic.co/t/not-working-must-query-between-array-of-records-in-nested-type/223222 "2020-03-12T23:34:05Z")
I have the below record: { "objectId": "ea5f9b14e0ca03990591de06a433a220", "annotations": \[ { "itemDetails": { "value": "US1", "confide… --- ## [When using 'nori' and synonym\_filter, token postagging is null](https://discuss.elastic.co/t/when-using-nori-and-synonym-filter-token-postagging-is-null/222829)
**Author:** [@innze](https://discuss.elastic.co/u/innze)\ **Replies:** 2\ **Last updated:** [March 12, 2020, 10:30pm UTC](https://discuss.elastic.co/t/when-using-nori-and-synonym-filter-token-postagging-is-null/222829 "2020-03-12T22:30:01Z")
In ES 7.6.0 I setting index below PUT test\_index { "settings" : { "index" : { "analysis" : { "filter" : { "ko\_synonyms" : { "type" : "synonym", "synon… --- ## [Client unable to trust server certificate](https://discuss.elastic.co/t/client-unable-to-trust-server-certificate/223404)
**Author:** [@brb44](https://discuss.elastic.co/u/brb44)\ **Replies:** 4\ **Last updated:** [March 12, 2020, 10:05pm UTC](https://discuss.elastic.co/t/client-unable-to-trust-server-certificate/223404 "2020-03-12T22:05:01Z")
Hi, I'm getting below error when I tried to enabling transport ssl. Caused by: sun.security.validator.ValidatorException: Extended key usage does not permit use for TLS client authentication at sun.security.val… --- ## [Elasticsearch thread pool rejected](https://discuss.elastic.co/t/elasticsearch-thread-pool-rejected/223142)
**Author:** [@Guylot](https://discuss.elastic.co/u/Guylot)\ **Replies:** 5\ **Last updated:** [March 12, 2020, 9:32pm UTC](https://discuss.elastic.co/t/elasticsearch-thread-pool-rejected/223142 "2020-03-12T21:32:38Z")
Hi, We are using Elasticsearch 5.6 (Next week we will upgrade to 7.6) for our application, we are using elasticsearch mostly for bulk indexing and much fewer for querying the data. Our cluster contains 8 nodes. 1 Data … --- ## [Aggregation match forward slash and dot in query string](https://discuss.elastic.co/t/aggregation-match-forward-slash-and-dot-in-query-string/223397)
**Author:** [@kkworker](https://discuss.elastic.co/u/kkworker)\ **Replies:** 0\ **Last updated:** [March 12, 2020, 6:59pm UTC](https://discuss.elastic.co/t/aggregation-match-forward-slash-and-dot-in-query-string/223397 "2020-03-12T18:59:40Z")
Hello everyone, I just registered on this forum and ask my first question. I use aggregation to search a field "ID". The values of such field in the documents are those like "98.4325/D3452SD2", where "." and "/" are in… --- ## [Removing duplicates when using search\_after](https://discuss.elastic.co/t/removing-duplicates-when-using-search-after/223390)
**Author:** [@ddrobert](https://discuss.elastic.co/u/ddrobert)\ **Replies:** 0\ **Last updated:** [March 12, 2020, 5:54pm UTC](https://discuss.elastic.co/t/removing-duplicates-when-using-search-after/223390 "2020-03-12T17:54:45Z")
:wave: Hi! I'm using the search API to query records across multiple indexes, so I know there will be duplicate records. I'd like to use the search\_after parameter for pagination since using from has caused problems wit… --- ## [All\[request\] Data too large, data for \[\\] would be larger than limit of \[4488796569/4.1gb\]](https://discuss.elastic.co/t/all-request-data-too-large-data-for-agg-filter-brand-would-be-larger-than-limit-of-4488796569-4-1gb/223385)
**Author:** [@Anilkumar061988](https://discuss.elastic.co/u/Anilkumar061988)\ **Replies:** 0\ **Last updated:** [March 12, 2020, 5:23pm UTC](https://discuss.elastic.co/t/all-request-data-too-large-data-for-agg-filter-brand-would-be-larger-than-limit-of-4488796569-4-1gb/223385 "2020-03-12T17:23:38Z")
When I do search All my shards are failing and I am receiving the below exception. It was working fine till yesterday and all my query's and shard's are continuously failing now //\[2020-03-12T16:30:30,410\]\[DEBUG\]\[o.e.a… --- ## [Not able to execute rally track as many process running already](https://discuss.elastic.co/t/not-able-to-execute-rally-track-as-many-process-running-already/222899)
**Author:** [@jbaskaran\_123](https://discuss.elastic.co/u/jbaskaran_123)\ **Replies:** 3\ **Last updated:** [March 12, 2020, 5:17pm UTC](https://discuss.elastic.co/t/not-able-to-execute-rally-track-as-many-process-running-already/222899 "2020-03-12T17:17:24Z")
Hi, I have a single node elasticsearch cluster in a kubernetes cluster. Also Rally installed in a separate docker container in same namespace where ES is running. I am able to run default track "geonames" and test com… --- ## [Number of nodes for primary and replicas required for resilience](https://discuss.elastic.co/t/number-of-nodes-for-primary-and-replicas-required-for-resilience/223377)
**Author:** [@jkhere](https://discuss.elastic.co/u/jkhere)\ **Replies:** 4\ **Last updated:** [March 12, 2020, 5:16pm UTC](https://discuss.elastic.co/t/number-of-nodes-for-primary-and-replicas-required-for-resilience/223377 "2020-03-12T17:16:50Z")
I am building a large elasticsearch cluster. I will have probably have around 100 to 150 primary shards. Since the dataset is very large, I am planning to limit the number of shards per node to max of 3. So for 100 prim… --- ## [Elasticsearch 3+ nodes set up on Windows Server 2016](https://discuss.elastic.co/t/elasticsearch-3-nodes-set-up-on-windows-server-2016/223380)
**Author:** [@Amphagory](https://discuss.elastic.co/u/Amphagory)\ **Replies:** 0\ **Last updated:** [March 12, 2020, 4:34pm UTC](https://discuss.elastic.co/t/elasticsearch-3-nodes-set-up-on-windows-server-2016/223380 "2020-03-12T16:34:22Z")
I'm having trouble setting up 3+ nodes Elasticsearch cluster on Windows Server 2016. I was wondering if anyone has done this in the past and wondering if you could share your solution? I trying to use docker and creatin… --- ## [SAML configuration with NameID as unspecified](https://discuss.elastic.co/t/saml-configuration-with-nameid-as-unspecified/222704)
**Author:** [@AjitR](https://discuss.elastic.co/u/AjitR)\ **Replies:** 2\ **Last updated:** [March 12, 2020, 4:02pm UTC](https://discuss.elastic.co/t/saml-configuration-with-nameid-as-unspecified/222704 "2020-03-12T16:02:35Z")
Hi All, For SAML configuration, what parameter to be used instead of persistent, attributes.principal: "nameid:persistent" In Azure it is 'unspecified' or emailaddress --- ## [Scale down production cluster](https://discuss.elastic.co/t/scale-down-production-cluster/223374)
**Author:** [@royal\_man](https://discuss.elastic.co/u/royal_man)\ **Replies:** 0\ **Last updated:** [March 12, 2020, 3:50pm UTC](https://discuss.elastic.co/t/scale-down-production-cluster/223374 "2020-03-12T15:50:36Z")
I want the opinion about scaling down elasticsearch. I have 2 shard cluster having 2 replicas (2P + 4R = 6shards) running on kubernetes. Now I want to remove replicas and corresponding nodes. I reduced kubernetes deploy… --- ## [Javascript to elasticsearch](https://discuss.elastic.co/t/javascript-to-elasticsearch/223373)
**Author:** [@Abhinav\_Gandhi](https://discuss.elastic.co/u/Abhinav_Gandhi)\ **Replies:** 0\ **Last updated:** [March 12, 2020, 3:47pm UTC](https://discuss.elastic.co/t/javascript-to-elasticsearch/223373 "2020-03-12T15:47:24Z")
I have a javascript AWS lambda which writes to my elastic search cluster. The problem i am facing is that all long values are truncated in javascript because of javascript parsing issues. When I parse this little piece … --- ## [Watcher with JSON objects](https://discuss.elastic.co/t/watcher-with-json-objects/223151)
**Author:** [@rajsolanki](https://discuss.elastic.co/u/rajsolanki)\ **Replies:** 3\ **Last updated:** [March 12, 2020, 3:45pm UTC](https://discuss.elastic.co/t/watcher-with-json-objects/223151 "2020-03-12T15:45:13Z")
I have a watcher alert i to alert on HTTP status 422 or 500. i populate request body and response body in my API upon failures and that gets ingested in my index. (basically life of entire api transaction) so watcher is… --- ## [Elasticsearch Service won't startup on reboot](https://discuss.elastic.co/t/elasticsearch-service-wont-startup-on-reboot/222502)
**Author:** [@edster](https://discuss.elastic.co/u/edster)\ **Replies:** 5\ **Last updated:** [March 12, 2020, 3:39pm UTC](https://discuss.elastic.co/t/elasticsearch-service-wont-startup-on-reboot/222502 "2020-03-12T15:39:59Z")
Hello, We are running our elastic servers on Ubuntu 16.x servers. The services have been enabled. The version of elastic 7.2. Entire path has been included in the .service file and it was installed as a tar file. The sy… --- ## [Issues while using SQL queries with curl](https://discuss.elastic.co/t/issues-while-using-sql-queries-with-curl/223118)
**Author:** [@tarund](https://discuss.elastic.co/u/tarund)\ **Replies:** 5\ **Last updated:** [March 12, 2020, 3:10pm UTC](https://discuss.elastic.co/t/issues-while-using-sql-queries-with-curl/223118 "2020-03-12T15:10:42Z")
Hi there, I am trying to export data out of Elasticsearch into csv files using SQL queries through curl. Most of the basic queries work fine, but when I try to use LIKE operator or CASE WHEN operators, I get exceptions.… --- ## [How to include given documents to my query that DONT match?](https://discuss.elastic.co/t/how-to-include-given-documents-to-my-query-that-dont-match/223327)
**Author:** [@Bart\_de\_Man](https://discuss.elastic.co/u/Bart_de_Man)\ **Replies:** 2\ **Last updated:** [March 12, 2020, 2:47pm UTC](https://discuss.elastic.co/t/how-to-include-given-documents-to-my-query-that-dont-match/223327 "2020-03-12T14:47:53Z")
How would I include documents to my result (given \_id's) when they DONT match the query? example query: { "query": { "bool": { "must": \[ { "term": { "purpose": { … --- ## [How to get \_id in search API in java high level rest client](https://discuss.elastic.co/t/how-to-get-id-in-search-api-in-java-high-level-rest-client/222164)
**Author:** [@hemamalini](https://discuss.elastic.co/u/hemamalini)\ **Replies:** 2\ **Last updated:** [March 12, 2020, 2:27pm UTC](https://discuss.elastic.co/t/how-to-get-id-in-search-api-in-java-high-level-rest-client/222164 "2020-03-12T14:27:52Z")
Hi I am using Elastic search 5.6 . As of now i cannot upgrade to higher versions. I am using Java High level rest client to fetch documents . I need to get \_id in search response. I am not getting document id in search r… --- ## [Elasticsearch Unreachable!](https://discuss.elastic.co/t/elasticsearch-unreachable/223168)
**Author:** [@Youssef\_SBAI](https://discuss.elastic.co/u/Youssef_SBAI)\ **Replies:** 6\ **Last updated:** [March 12, 2020, 2:06pm UTC](https://discuss.elastic.co/t/elasticsearch-unreachable/223168 "2020-03-12T14:06:58Z")
Hi, i am getting below error, after enable firewall on the logstash server. 2020-03-11T15:46:14,189\]\[WARN \]\[logstash.outputs.elasticsearch\] Attempted to resurrect connection to dead ES instance, but got an error. {:u… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=987) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=989)