# Elasticsearch

**URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=991

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 992

---

## [Delete old elasticsearch indexes (TLS, auth enabled for elasticsearch) using curator](https://discuss.elastic.co/t/delete-old-elasticsearch-indexes-tls-auth-enabled-for-elasticsearch-using-curator/223069)

<div class="topic-metadata">

**Author:** [@naveenspen](https://discuss.elastic.co/u/naveenspen)\
**Replies:** 0\
**Last updated:** [March 11, 2020, 8:19am UTC](https://discuss.elastic.co/t/delete-old-elasticsearch-indexes-tls-auth-enabled-for-elasticsearch-using-curator/223069 "2020-03-11T08:19:36Z")

</div>

I have daily indices (created through elasticsearch), Elasticsearch is running with basic xpack configuration (TLS certificate, authentication, and https ) I'm Trying to delete 'systemlog-' indices once in 2 days. Bel…

---

## [Elasticsearch only works on 127.0.0.1?](https://discuss.elastic.co/t/elasticsearch-only-works-on-127-0-0-1/223038)

<div class="topic-metadata">

**Author:** [@edvrfn](https://discuss.elastic.co/u/edvrfn)\
**Replies:** 2\
**Last updated:** [March 11, 2020, 8:13am UTC](https://discuss.elastic.co/t/elasticsearch-only-works-on-127-0-0-1/223038 "2020-03-11T08:13:11Z")

</div>

I get error when trying to run start elastic search from interface IP 192.168.1.10. Error i get is Job for elasticsearch.service failed because the control process exited with error code. See "systemctl status elasticse…

---

## [Parent/Child Aggregation ordering problem ES 7.6](https://discuss.elastic.co/t/parent-child-aggregation-ordering-problem-es-7-6/223066)

<div class="topic-metadata">

**Author:** [@dizzzyroma](https://discuss.elastic.co/u/dizzzyroma)\
**Replies:** 0\
**Last updated:** [March 11, 2020, 8:12am UTC](https://discuss.elastic.co/t/parent-child-aggregation-ordering-problem-es-7-6/223066 "2020-03-11T08:12:03Z")

</div>

Hi All, We try to migrate to ES 7.X from ES 5.3 and found next problem: In ES 7.6.1 Aggregation ordering path not working when we try to aggregate parent/child documents In ES 5.3 Its working fine ES 7.6.1 Example: P…

---

## [Elasticsearch OIDC connection through Proxy](https://discuss.elastic.co/t/elasticsearch-oidc-connection-through-proxy/223018)

<div class="topic-metadata">

**Author:** [@Chris\_Samo](https://discuss.elastic.co/u/Chris_Samo)\
**Replies:** 3\
**Last updated:** [March 11, 2020, 6:01am UTC](https://discuss.elastic.co/t/elasticsearch-oidc-connection-through-proxy/223018 "2020-03-11T06:01:53Z")

</div>

We use an OpenID Connect provider for Authentication & Authorisation in Elasticsearch, however have been tasked with locking down egress from our cluster (we're running in Kubernetes using Docker images). We've implemen…

---

## [Attachment Indexing search](https://discuss.elastic.co/t/attachment-indexing-search/222873)

<div class="topic-metadata">

**Author:** [@vaibhav8600](https://discuss.elastic.co/u/vaibhav8600)\
**Replies:** 0\
**Last updated:** [March 10, 2020, 7:06am UTC](https://discuss.elastic.co/t/attachment-indexing-search/222873 "2020-03-10T07:06:37Z")

</div>

i have indexed attachments using ingest-attachment processor and in search i want only mail nested Attachment but when i'm trying to search on attachment content it returns complete Document /--------------------------…

---

## [Multi-term synonyms: How can this be used in practice?](https://discuss.elastic.co/t/multi-term-synonyms-how-can-this-be-used-in-practice/219423)

<div class="topic-metadata">

**Author:** [@aj\_potc](https://discuss.elastic.co/u/aj_potc)\
**Replies:** 5\
**Last updated:** [March 11, 2020, 3:17am UTC](https://discuss.elastic.co/t/multi-term-synonyms-how-can-this-be-used-in-practice/219423 "2020-03-11T03:17:21Z")

</div>

I'm evaluating Elasticsearch 7.6 and its handling of multi-term (multi-word) synonyms, and I'm having a lot of trouble figuring out how to make practical use of it. In short: How can I take a user's query and present it…

---

## [Data migration from OSS version to Basic version](https://discuss.elastic.co/t/data-migration-from-oss-version-to-basic-version/223019)

<div class="topic-metadata">

**Author:** [@somebody](https://discuss.elastic.co/u/somebody)\
**Replies:** 4\
**Last updated:** [March 10, 2020, 11:31pm UTC](https://discuss.elastic.co/t/data-migration-from-oss-version-to-basic-version/223019 "2020-03-10T23:31:34Z")

</div>

Hi, I have a requirement to migrate data from OSS version to Basic version. Can I transfer the data from 7.2.x OSS version to 7.5.x Basic version using reindex from remote API Ref: https://www.elastic.co/guide/en/elas…

---

## [LDAP cross-forest authentication](https://discuss.elastic.co/t/ldap-cross-forest-authentication/222837)

<div class="topic-metadata">

**Author:** [@wyh\_ryan](https://discuss.elastic.co/u/wyh_ryan)\
**Replies:** 0\
**Last updated:** [March 10, 2020, 2:17am UTC](https://discuss.elastic.co/t/ldap-cross-forest-authentication/222837 "2020-03-10T02:17:13Z")

</div>

Hi, I'm trying to authenticate users via AD. I have 2 forests: A.COM and B.ORG which have a trust relationship between them. I can bind to A.COM and perform a search there while B.ORG has all the users. When a user req…

---

## [SSL wild card certificate using with nodejs and Lambda produce error "unable to verify the first certificate"](https://discuss.elastic.co/t/ssl-wild-card-certificate-using-with-nodejs-and-lambda-produce-error-unable-to-verify-the-first-certificate/222986)

<div class="topic-metadata">

**Author:** [@Sanjay1](https://discuss.elastic.co/u/Sanjay1)\
**Replies:** 0\
**Last updated:** [March 10, 2020, 5:15pm UTC](https://discuss.elastic.co/t/ssl-wild-card-certificate-using-with-nodejs-and-lambda-produce-error-unable-to-verify-the-first-certificate/222986 "2020-03-10T17:15:43Z")

</div>

We are using the wild card certificate. Hence CRT for node as well as CA is same. The elasticsearch.yml file is as follows.... cluster.name: cluster\_name node.name: i0861956fda57c7461 path.data: "/data/elasticsearch" …

---

## [Two Elasticsearch clusters in sync](https://discuss.elastic.co/t/two-elasticsearch-clusters-in-sync/222521)

<div class="topic-metadata">

**Author:** [@Bharath\_Italapur](https://discuss.elastic.co/u/Bharath_Italapur)\
**Replies:** 2\
**Last updated:** [March 10, 2020, 8:56pm UTC](https://discuss.elastic.co/t/two-elasticsearch-clusters-in-sync/222521 "2020-03-10T20:56:06Z")

</div>

Hi, Thank you in advance. Is there a way to keep two elasticsearch clusters in sync? I have a 5.6 elasticsearch cluster which is getting data inserted through spark and I have another 7.6 elasticsearch cluster that…

---

## [Elasticsearch server is not starting on Ramdisk (imdisk)](https://discuss.elastic.co/t/elasticsearch-server-is-not-starting-on-ramdisk-imdisk/222167)

<div class="topic-metadata">

**Author:** [@MadhukarA](https://discuss.elastic.co/u/MadhukarA)\
**Replies:** 6\
**Last updated:** [March 10, 2020, 8:13pm UTC](https://discuss.elastic.co/t/elasticsearch-server-is-not-starting-on-ramdisk-imdisk/222167 "2020-03-10T20:13:49Z")

</div>

I am unable to start Elasticsearch when path.data was set to a location on Ramdisk (Imdisk). It throws the following error: elasticsearch-7.6.0-windows-x86\_64\\elasticsearch-7.6.0\\bin\>.\\elasticsearch.bat OpenJDK 64-B…

---

## [Monitoring difference between full-stack and multi-stack](https://discuss.elastic.co/t/monitoring-difference-between-full-stack-and-multi-stack/222999)

<div class="topic-metadata">

**Author:** [@sentient](https://discuss.elastic.co/u/sentient)\
**Replies:** 2\
**Last updated:** [March 10, 2020, 8:09pm UTC](https://discuss.elastic.co/t/monitoring-difference-between-full-stack-and-multi-stack/222999 "2020-03-10T20:09:18Z")

</div>

From https://www.elastic.co/subscriptions Full stack monitoring is available in the basic subscription. multi stack monitoring is NOT available. But what is the difference between 'full stack' and 'multi stack'

---

## [Set esConfig](https://discuss.elastic.co/t/set-esconfig/222995)

<div class="topic-metadata">

**Author:** [@Carlos2020](https://discuss.elastic.co/u/Carlos2020)\
**Replies:** 0\
**Last updated:** [March 10, 2020, 6:01pm UTC](https://discuss.elastic.co/t/set-esconfig/222995 "2020-03-10T18:01:22Z")

</div>

What is the correct to set esConfig parameter ? // helm install elastic/elasticsearch --namespace default --set imageTag=7.6.1 --set replicas=1 --set minimumMasterNodes=1 --set resources.requests.memory=2Gi --set v…

---

## [Elasticsearch with instance store on k8](https://discuss.elastic.co/t/elasticsearch-with-instance-store-on-k8/222715)

<div class="topic-metadata">

**Author:** [@deepak\_deore](https://discuss.elastic.co/u/deepak_deore)\
**Replies:** 3\
**Last updated:** [March 10, 2020, 4:46pm UTC](https://discuss.elastic.co/t/elasticsearch-with-instance-store-on-k8/222715 "2020-03-10T16:46:01Z")

</div>

currently I have 5 dedicated k8 worker nodes for ES cluster, each node is 8cpu/ 32G memory. 5 ES pods are deployed through ECK operator on k8, all ES pods have all roles (no separate master, data etc.) eck is excellent …

---

## [Max shard size for a very large single index](https://discuss.elastic.co/t/max-shard-size-for-a-very-large-single-index/222751)

<div class="topic-metadata">

**Author:** [@jkhere](https://discuss.elastic.co/u/jkhere)\
**Replies:** 4\
**Last updated:** [March 10, 2020, 3:44pm UTC](https://discuss.elastic.co/t/max-shard-size-for-a-very-large-single-index/222751 "2020-03-10T15:44:42Z")

</div>

I am planning to develop an elasticsearch cluster to stand up a very massive index. The main usecase is to index documents and search using keywords. We estimate the size of the index to be 16TB. So if I keep single sha…

---

## [Is it possible to include the Anomaly Explorer screenshot in the watcher sent email](https://discuss.elastic.co/t/is-it-possible-to-include-the-anomaly-explorer-screenshot-in-the-watcher-sent-email/222859)

<div class="topic-metadata">

**Author:** [@pk.241011](https://discuss.elastic.co/u/pk.241011)\
**Replies:** 1\
**Last updated:** [March 10, 2020, 3:30pm UTC](https://discuss.elastic.co/t/is-it-possible-to-include-the-anomaly-explorer-screenshot-in-the-watcher-sent-email/222859 "2020-03-10T15:30:01Z")

</div>

I have been playing with Anomaly Explorer jobs and it is very exciting to receive the emails from the job when something out of ordinary is detected. I took feedback from the potential users and they all said it will be…

---

## [One field free text query on Elasticsearch supporting dates](https://discuss.elastic.co/t/one-field-free-text-query-on-elasticsearch-supporting-dates/222946)

<div class="topic-metadata">

**Author:** [@styks90](https://discuss.elastic.co/u/styks90)\
**Replies:** 0\
**Last updated:** [March 10, 2020, 1:50pm UTC](https://discuss.elastic.co/t/one-field-free-text-query-on-elasticsearch-supporting-dates/222946 "2020-03-10T13:50:22Z")

</div>

I originally asked this question on StackOverflow, but haven't found a satisfactory answer yet: Suppose I have an index with multiple fields of type text and one or more of type date (of some format, say yyyy/MM/dd …

---

## [Geodistance sort throws Elasticsearch exception \[type=parsing\_exception, reason=\[\_geo\_distance\] does not support \[ignore\_unmapped\]\] Elastic search version 6.3.0](https://discuss.elastic.co/t/geodistance-sort-throws-elasticsearch-exception-type-parsing-exception-reason-geo-distance-does-not-support-ignore-unmapped-elastic-search-version-6-3-0/222930)

<div class="topic-metadata">

**Author:** [@jsunish](https://discuss.elastic.co/u/jsunish)\
**Replies:** 3\
**Last updated:** [March 10, 2020, 2:14pm UTC](https://discuss.elastic.co/t/geodistance-sort-throws-elasticsearch-exception-type-parsing-exception-reason-geo-distance-does-not-support-ignore-unmapped-elastic-search-version-6-3-0/222930 "2020-03-10T14:14:38Z")

</div>

I am searching the index object based on the lat long (geo\_point type) for a distance of 999km and I am sorting it on the ascending order. But I am getting the exception Elasticsearch exception \[type=parsing\_exception, …

---

## [Elastic search INDEXING taking too long (days !)](https://discuss.elastic.co/t/elastic-search-indexing-taking-too-long-days/222953)

<div class="topic-metadata">

**Author:** [@MisterBass](https://discuss.elastic.co/u/MisterBass)\
**Replies:** 0\
**Last updated:** [March 10, 2020, 2:14pm UTC](https://discuss.elastic.co/t/elastic-search-indexing-taking-too-long-days/222953 "2020-03-10T14:14:08Z")

</div>

I have a es cluster with 3 nodes (2 master& data, 1 master only) 5 shards of 1.2Gb, 5 replicas.\`\` I trigered the a redindexation of my content since 5 days, arroubnd 1million documents are indexed for now and the ind…

---

## [How to index s3 files and transfer that index to my ES server](https://discuss.elastic.co/t/how-to-index-s3-files-and-transfer-that-index-to-my-es-server/220930)

<div class="topic-metadata">

**Author:** [@Lisahtwy](https://discuss.elastic.co/u/Lisahtwy)\
**Replies:** 3\
**Last updated:** [March 10, 2020, 2:12pm UTC](https://discuss.elastic.co/t/how-to-index-s3-files-and-transfer-that-index-to-my-es-server/220930 "2020-03-10T14:12:14Z")

</div>

Hi, I have been indexing files from different servers using FSCrawler and storing them in my Elastic search server. But now I have files in s3 bucket. Could anyone please guide me how to index files that are in S3 and …

---

## [Evaluating the performance of the real-time anomaly detection included in the Elastic Stack](https://discuss.elastic.co/t/evaluating-the-performance-of-the-real-time-anomaly-detection-included-in-the-elastic-stack/222941)

<div class="topic-metadata">

**Author:** [@dadadima](https://discuss.elastic.co/u/dadadima)\
**Replies:** 0\
**Last updated:** [March 10, 2020, 1:33pm UTC](https://discuss.elastic.co/t/evaluating-the-performance-of-the-real-time-anomaly-detection-included-in-the-elastic-stack/222941 "2020-03-10T13:33:09Z")

</div>

I was quite new to the Elastic Stack and I managed to play a bit with it in the past month. I am doing a Master Thesis on Anomaly Detection and I am using the Elastic Stack as part of it. I have tried to look at the re…

---

## [How to setup ILM in elastic search](https://discuss.elastic.co/t/how-to-setup-ilm-in-elastic-search/222876)

<div class="topic-metadata">

**Author:** [@rahulkothanath](https://discuss.elastic.co/u/rahulkothanath)\
**Replies:** 1\
**Last updated:** [March 10, 2020, 1:31pm UTC](https://discuss.elastic.co/t/how-to-setup-ilm-in-elastic-search/222876 "2020-03-10T13:31:43Z")

</div>

I am confused about creating an ILM policy with roll over when index size goes beyond 190gb. I have followed below steps to it. Defined ILM policy in elastic search. PUT \_ilm/policy/abcd\_foundation\_policy { "polic…

---

## [Multi token exact matching](https://discuss.elastic.co/t/multi-token-exact-matching/222783)

<div class="topic-metadata">

**Author:** [@borgmajr](https://discuss.elastic.co/u/borgmajr)\
**Replies:** 1\
**Last updated:** [March 10, 2020, 1:27pm UTC](https://discuss.elastic.co/t/multi-token-exact-matching/222783 "2020-03-10T13:27:52Z")

</div>

I am trying to search on a field that has entries with multiple tokens like this: doc1 { biz\_name: biz } doc2 { biz\_name: biz inc } doc3 { biz\_name: big biz inc } I want to search on field "biz\_name" with "biz inc" a…

---

## [Which is more efficient, to reindex the raw .ndjson or use the \_reindex api](https://discuss.elastic.co/t/which-is-more-efficient-to-reindex-the-raw-ndjson-or-use-the-reindex-api/222911)

<div class="topic-metadata">

**Author:** [@Norman\_Khine](https://discuss.elastic.co/u/Norman_Khine)\
**Replies:** 1\
**Last updated:** [March 10, 2020, 1:19pm UTC](https://discuss.elastic.co/t/which-is-more-efficient-to-reindex-the-raw-ndjson-or-use-the-reindex-api/222911 "2020-03-10T13:19:26Z")

</div>

Hello, Currently we backup our daily indexes to AWS S3 as raw .ndjosn format and I wanted an opinion whether it would be better to re-ingest these files into a monthly index or use the \_reindex API to this. So my optio…

---

## [SSO test using OpenID Connect in elasticsearch](https://discuss.elastic.co/t/sso-test-using-openid-connect-in-elasticsearch/222429)

<div class="topic-metadata">

**Author:** [@Yungyoung\_Ok](https://discuss.elastic.co/u/Yungyoung_Ok)\
**Replies:** 5\
**Last updated:** [March 10, 2020, 12:59pm UTC](https://discuss.elastic.co/t/sso-test-using-openid-connect-in-elasticsearch/222429 "2020-03-10T12:59:44Z")

</div>

I am currently conducting the sso test. User authentication has all been successful. However 403 error occurs. What settings should I add? ERROR: {"statusCode":403,"error":"Forbidden","message":"Forbidden"} ES LOG: …

---

## [Whitelist URLs in Elasticsearch managed service from Elastic](https://discuss.elastic.co/t/whitelist-urls-in-elasticsearch-managed-service-from-elastic/222917)

<div class="topic-metadata">

**Author:** [@Amphagory](https://discuss.elastic.co/u/Amphagory)\
**Replies:** 3\
**Last updated:** [March 10, 2020, 12:11pm UTC](https://discuss.elastic.co/t/whitelist-urls-in-elasticsearch-managed-service-from-elastic/222917 "2020-03-10T12:11:44Z")

</div>

I am unsure if this should question should go here, but I'm trying to find where I can whitelist URLs in my Elasticsearch managed service from Elastic? This is the following error: { "error": { "root\_cause": \[ { "t…

---

## [Hot,Warm and Cold- is only available with out x-pack version?](https://discuss.elastic.co/t/hot-warm-and-cold-is-only-available-with-out-x-pack-version/222868)

<div class="topic-metadata">

**Author:** [@Ozil](https://discuss.elastic.co/u/Ozil)\
**Replies:** 2\
**Last updated:** [March 10, 2020, 11:34am UTC](https://discuss.elastic.co/t/hot-warm-and-cold-is-only-available-with-out-x-pack-version/222868 "2020-03-10T11:34:54Z")

</div>

Hi All I would like to update my existing architecture with Hot, Warm and Cold architecture. Is Hot, Warm and Cold architecture is only possible with Elasticsearch X-pack. If no please suggest some links to create this…

---

## [Question about Spring Data Elasticsearch using Rest Client](https://discuss.elastic.co/t/question-about-spring-data-elasticsearch-using-rest-client/222886)

<div class="topic-metadata">

**Author:** [@aiden\_elastic](https://discuss.elastic.co/u/aiden_elastic)\
**Replies:** 2\
**Last updated:** [March 10, 2020, 10:01am UTC](https://discuss.elastic.co/t/question-about-spring-data-elasticsearch-using-rest-client/222886 "2020-03-10T10:01:57Z")

</div>

I am trying to connect spring data elastic search with elastic search using Rest Client. This is pom.xml \<?xml version="1.0" encoding="UTF-8"?\> \<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http…

---

## [CCR on ElasticCloud - ETA?](https://discuss.elastic.co/t/ccr-on-elasticcloud-eta/222900)

<div class="topic-metadata">

**Author:** [@permagne](https://discuss.elastic.co/u/permagne)\
**Replies:** 1\
**Last updated:** [March 10, 2020, 11:00am UTC](https://discuss.elastic.co/t/ccr-on-elasticcloud-eta/222900 "2020-03-10T11:00:09Z")

</div>

Hi, Do you have an ETA on when CCR is available for ElasticCloud? This is a possible deal breaker for us, and we need to know if we need to move away from ElasticCloud. Thanks!

---

## [When i am searching in ES index, i am getting 2 or 3 multiple records. I want those results as a single record](https://discuss.elastic.co/t/when-i-am-searching-in-es-index-i-am-getting-2-or-3-multiple-records-i-want-those-results-as-a-single-record/221363)

<div class="topic-metadata">

**Author:** [@pyerunka](https://discuss.elastic.co/u/pyerunka)\
**Replies:** 3\
**Last updated:** [March 10, 2020, 10:21am UTC](https://discuss.elastic.co/t/when-i-am-searching-in-es-index-i-am-getting-2-or-3-multiple-records-i-want-those-results-as-a-single-record/221363 "2020-03-10T10:21:37Z")

</div>

Hello, I am using jdbc input plugin to fetch data from database. I have created ES index using 6 different sql queries and in that 6 queries some columns are same. After that i have created one index pattern in endec…

[Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=990)

[Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=992)
