# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=992 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 993 --- ## [Search slowlogs from all nodes](https://discuss.elastic.co/t/search-slowlogs-from-all-nodes/222905)
**Author:** [@ansamHox](https://discuss.elastic.co/u/ansamHox)\ **Replies:** 0\ **Last updated:** [March 10, 2020, 10:07am UTC](https://discuss.elastic.co/t/search-slowlogs-from-all-nodes/222905 "2020-03-10T10:07:02Z")
Is there any way to retreive slowlog from all nodes (greping from one machine). I query for all indices (from my\_index\_2011 to my\_index\_2018) \[my\_index\_\*\], but on my machine I'm getting only logs for that machine/node\_i… --- ## [Elasticsearch DSL with (A or B) and C](https://discuss.elastic.co/t/elasticsearch-dsl-with-a-or-b-and-c/222890)
**Author:** [@Tennis](https://discuss.elastic.co/u/Tennis)\ **Replies:** 1\ **Last updated:** [March 10, 2020, 9:29am UTC](https://discuss.elastic.co/t/elasticsearch-dsl-with-a-or-b-and-c/222890 "2020-03-10T09:29:19Z")
I want to query the data with the condition: ("product":"book" OR customer":"A") AND "Tag":"T1" My DSL: body = { "query":{ "bool":{ "must":\[ {"bool":{ "should":\[ { "match"… --- ## [ILM with time based indices - eg test-logs-%{+YYYYMMdd}-000001](https://discuss.elastic.co/t/ilm-with-time-based-indices-eg-test-logs-yyyymmdd-000001/222256)
**Author:** [@radw](https://discuss.elastic.co/u/radw)\ **Replies:** 1\ **Last updated:** [March 10, 2020, 9:09am UTC](https://discuss.elastic.co/t/ilm-with-time-based-indices-eg-test-logs-yyyymmdd-000001/222256 "2020-03-10T09:09:00Z")
Hi all! I'm trying to implement ILM time-based indices in my elasticsearch cluster. Right now, I have custom indexes. My configuration is as follows: BEATS(metricbeat, filebeat) ---\> Logstash ---\> Elasticsearch. I ha… --- ## [Converting whole CSV file in one field into multiple documents for each csv row (using headers as field names)](https://discuss.elastic.co/t/converting-whole-csv-file-in-one-field-into-multiple-documents-for-each-csv-row-using-headers-as-field-names/222789)
**Author:** [@tonyskulk](https://discuss.elastic.co/u/tonyskulk)\ **Replies:** 10\ **Last updated:** [March 10, 2020, 8:31am UTC](https://discuss.elastic.co/t/converting-whole-csv-file-in-one-field-into-multiple-documents-for-each-csv-row-using-headers-as-field-names/222789 "2020-03-10T08:31:42Z")
Hi, I have an index with a field that contains a whole CSV file (headers included). I want to convert each csv row into a separate document containing all fields of the corresponding csv row (if possible the field names… --- ## [Closed index red status and ES failed to turn off translog retention](https://discuss.elastic.co/t/closed-index-red-status-and-es-failed-to-turn-off-translog-retention/222877)
**Author:** [@hackerwin7](https://discuss.elastic.co/u/hackerwin7)\ **Replies:** 0\ **Last updated:** [March 10, 2020, 7:32am UTC](https://discuss.elastic.co/t/closed-index-red-status-and-es-failed-to-turn-off-translog-retention/222877 "2020-03-10T07:32:43Z")
Hi, In Elasticsearch 7.5.1 there is a case: closed index is red and server log is: so Cluster status will be stuck in red status caused by theses unrecoverable closed red indices --- ## [Index rollover latency](https://discuss.elastic.co/t/index-rollover-latency/222866)
**Author:** [@Muhammad\_Ariful\_Isla](https://discuss.elastic.co/u/Muhammad_Ariful_Isla)\ **Replies:** 0\ **Last updated:** [March 10, 2020, 6:24am UTC](https://discuss.elastic.co/t/index-rollover-latency/222866 "2020-03-10T06:24:41Z")
I have created an ILM policy as follows, { "policy": { "phases": { "hot": { "min\_age": "0ms", "actions": { "rollover": { "max\_docs": 30 }, "set\_prior… --- ## [ES-Hadoop Hive Integration with TLS/SSL Security](https://discuss.elastic.co/t/es-hadoop-hive-integration-with-tls-ssl-security/222853)
**Author:** [@gsahu25](https://discuss.elastic.co/u/gsahu25)\ **Replies:** 1\ **Last updated:** [March 10, 2020, 6:21am UTC](https://discuss.elastic.co/t/es-hadoop-hive-integration-with-tls-ssl-security/222853 "2020-03-10T06:21:44Z")
Hi, I have set-up a cluster with 3 master, 4 DI nodes. Also I have enabled TLS/SSL with self signed CA. The .p12 files I have generated for elasticsearch nodes are IP based. Now I am trying to connect to ES cluster usi… --- ## [Fail Index if document does not match explicit mapping](https://discuss.elastic.co/t/fail-index-if-document-does-not-match-explicit-mapping/222832)
**Author:** [@m\_ebags](https://discuss.elastic.co/u/m_ebags)\ **Replies:** 1\ **Last updated:** [March 10, 2020, 6:19am UTC](https://discuss.elastic.co/t/fail-index-if-document-does-not-match-explicit-mapping/222832 "2020-03-10T06:19:57Z")
Is it possible to force a document to fail being indexed if it does not match an explicit mapping https://www.elastic.co/guide/en/elasticsearch/reference/master/mapping.html#\_explicit\_mappings --- ## [Component Startup logs missing](https://discuss.elastic.co/t/component-startup-logs-missing/222858)
**Author:** [@devops\_army](https://discuss.elastic.co/u/devops_army)\ **Replies:** 0\ **Last updated:** [March 10, 2020, 5:22am UTC](https://discuss.elastic.co/t/component-startup-logs-missing/222858 "2020-03-10T05:22:31Z")
Hi Team, I am using Elasticsearch, fluentd and kibana in my setup and i have different components (applications) deployed in my cluster . Whenever, my pod restarts or freshly deployed, the start up logs are missing when… --- ## [How to rationalize the index name(s) to query with rollover?](https://discuss.elastic.co/t/how-to-rationalize-the-index-name-s-to-query-with-rollover/222846)
**Author:** [@Newlastic](https://discuss.elastic.co/u/Newlastic)\ **Replies:** 0\ **Last updated:** [March 10, 2020, 3:49am UTC](https://discuss.elastic.co/t/how-to-rationalize-the-index-name-s-to-query-with-rollover/222846 "2020-03-10T03:49:07Z")
Hello, Suppose we have an index that rolls over approximately every day. We retain 100 days of historical indexes, the older ones in colder storage. Is there a method for targeting queries with time range restrictions… --- ## [Custom bundle does not appear in ElasticSearch deployment edit page](https://discuss.elastic.co/t/custom-bundle-does-not-appear-in-elasticsearch-deployment-edit-page/221083)
**Author:** [@Xavier\_Krantz](https://discuss.elastic.co/u/Xavier_Krantz)\ **Replies:** 6\ **Last updated:** [March 10, 2020, 2:42am UTC](https://discuss.elastic.co/t/custom-bundle-does-not-appear-in-elasticsearch-deployment-edit-page/221083 "2020-03-10T02:42:48Z")
Hi there ! I am trying to setup Kiban SSO with Google Suite SAML. I am following the official doc + using some existing posts out there: https://www.elastic.co/guide/en/cloud/current/ec-securing-clusters-SAML.html ht… --- ## [Abnormal index\_writer\_memory,its so high!](https://discuss.elastic.co/t/abnormal-index-writer-memory-its-so-high/222759)
**Author:** [@KellyK313](https://discuss.elastic.co/u/KellyK313)\ **Replies:** 2\ **Last updated:** [March 9, 2020, 11:20pm UTC](https://discuss.elastic.co/t/abnormal-index-writer-memory-its-so-high/222759 "2020-03-09T23:20:59Z")
Our ElasticSearch version is v1.6.2. 31G jvm memory in 156G machine total memory. Recently I found out our node is OOM frequently,then I found an index use "index\_writer\_memory" is so high. It really confuse me,beca… --- ## [Cross-cluster search questions](https://discuss.elastic.co/t/cross-cluster-search-questions/222379)
**Author:** [@alexpanas](https://discuss.elastic.co/u/alexpanas)\ **Replies:** 9\ **Last updated:** [March 10, 2020, 12:05am UTC](https://discuss.elastic.co/t/cross-cluster-search-questions/222379 "2020-03-10T00:05:24Z")
Hello, We are trying to replace our tribe nodes setup with cross-cluster search setup and we have multiple questions regarding the general configuration and monitoring of cross-cluster-search cluster. Unfortunately the… --- ## [Boosting results using Function\_Score result unexpected behavior](https://discuss.elastic.co/t/boosting-results-using-function-score-result-unexpected-behavior/222820)
**Author:** [@auduwage](https://discuss.elastic.co/u/auduwage)\ **Replies:** 0\ **Last updated:** [March 9, 2020, 10:51pm UTC](https://discuss.elastic.co/t/boosting-results-using-function-score-result-unexpected-behavior/222820 "2020-03-09T22:51:34Z")
We have 3 stage ranking phase in our search engine. We use BM25 with Distance Decay function and Freshness Decay function as the first phase. Then for the second stage, we use LTR plugin and do a rescoring with a window\_… --- ## [Active Directory Authentication failed after User changed password](https://discuss.elastic.co/t/active-directory-authentication-failed-after-user-changed-password/222785)
**Author:** [@TonyLuc](https://discuss.elastic.co/u/TonyLuc)\ **Replies:** 0\ **Last updated:** [March 9, 2020, 7:00pm UTC](https://discuss.elastic.co/t/active-directory-authentication-failed-after-user-changed-password/222785 "2020-03-09T19:00:08Z")
In our environment, we are using the active directory realm to authenticate users. This have been reported by several users that previously they could but after they changed their password they could not log in via Kiba… --- ## [Can not run elasticsearch as root for elasticsearch 7.6.0 in linux](https://discuss.elastic.co/t/can-not-run-elasticsearch-as-root-for-elasticsearch-7-6-0-in-linux/220913)
**Author:** [@rohithkothaneth](https://discuss.elastic.co/u/rohithkothaneth)\ **Replies:** 4\ **Last updated:** [March 9, 2020, 8:02pm UTC](https://discuss.elastic.co/t/can-not-run-elasticsearch-as-root-for-elasticsearch-7-6-0-in-linux/220913 "2020-03-09T20:02:03Z")
Hello, Could someone please help me how to fix this issue . Here I have installed Elasticsearch as a user and not as root in my Linux OS. I can execute the command line call without any issue. But I wanted to run it… --- ## [Copy another field with nanoseconds to elasticsearch/kibana @timestamp field](https://discuss.elastic.co/t/copy-another-field-with-nanoseconds-to-elasticsearch-kibana-timestamp-field/222541)
**Author:** [@savvy](https://discuss.elastic.co/u/savvy)\ **Replies:** 5\ **Last updated:** [March 9, 2020, 7:44pm UTC](https://discuss.elastic.co/t/copy-another-field-with-nanoseconds-to-elasticsearch-kibana-timestamp-field/222541 "2020-03-09T19:44:04Z")
Hello, My Elasticsearch is version 7.5 I have a\> date type - @timestamp field b\> string type - event\_timestamp field (format: 2020-03-06 20:28:33:232123456 +0000) sent in each event. What I want to achieve: 1st, I … --- ## [Index Template Field Whitelist](https://discuss.elastic.co/t/index-template-field-whitelist/222777)
**Author:** [@seth.yes](https://discuss.elastic.co/u/seth.yes)\ **Replies:** 0\ **Last updated:** [March 9, 2020, 6:12pm UTC](https://discuss.elastic.co/t/index-template-field-whitelist/222777 "2020-03-09T18:12:11Z")
Using Elasticsearch 7.4.2 Is there a concept of a field whitelist for indices/index patterns? I want to have ~150 fields whitelisted for an index, and other fields to be automatically dropped. My use-case is that an ol… --- ## [Consequences of Large Number of Fields](https://discuss.elastic.co/t/consequences-of-large-number-of-fields/222776)
**Author:** [@Josh\_D](https://discuss.elastic.co/u/Josh_D)\ **Replies:** 0\ **Last updated:** [March 9, 2020, 6:07pm UTC](https://discuss.elastic.co/t/consequences-of-large-number-of-fields/222776 "2020-03-09T18:07:05Z")
We're using elastic search mostly for logging, but we've started adding telemetry data along with some of the log entries. These additional fields have causing our field count to explode to be over a 1000. All of this ex… --- ## [Restore Snapshot from a Production Cluster in an off site cluster without Internet Access](https://discuss.elastic.co/t/restore-snapshot-from-a-production-cluster-in-an-off-site-cluster-without-internet-access/222772)
**Author:** [@fgomes](https://discuss.elastic.co/u/fgomes)\ **Replies:** 0\ **Last updated:** [March 9, 2020, 5:26pm UTC](https://discuss.elastic.co/t/restore-snapshot-from-a-production-cluster-in-an-off-site-cluster-without-internet-access/222772 "2020-03-09T17:26:19Z")
Hi there. We have currently in production a 3 node Elasticsearch Cluster, but unfortunately due to the nature of Railway Industry, at the moment there is no outbound access to the internet. I would like to retrieve the s… --- ## [Order inner\_hits by offset](https://discuss.elastic.co/t/order-inner-hits-by-offset/222770)
**Author:** [@daven](https://discuss.elastic.co/u/daven)\ **Replies:** 0\ **Last updated:** [March 9, 2020, 5:04pm UTC](https://discuss.elastic.co/t/order-inner-hits-by-offset/222770 "2020-03-09T17:04:36Z")
I have a set of documents that contain nested paragraphs and sentences, I need the order of the inner hits to be in the order they occur in the document, eg. paragraph 0 sentence 0, paragraph 0 sentence 5, paragraph 2 se… --- ## [AWS Elasticsearch Service](https://discuss.elastic.co/t/aws-elasticsearch-service/222750)
**Author:** [@jh.94](https://discuss.elastic.co/u/jh.94)\ **Replies:** 3\ **Last updated:** [March 9, 2020, 4:15pm UTC](https://discuss.elastic.co/t/aws-elasticsearch-service/222750 "2020-03-09T16:15:56Z")
Hi there, As I have just started knowing about AWS, I have a few questions regarding the Amazon Elasticsearch Service. Can i download Kibana plugins mentioned in https://www.elastic.co/guide/en/kibana/current/known-p… --- ## [SSH into elastic search, or another way to get a synonyms bundle](https://discuss.elastic.co/t/ssh-into-elastic-search-or-another-way-to-get-a-synonyms-bundle/222762)
**Author:** [@Ron\_Hay](https://discuss.elastic.co/u/Ron_Hay)\ **Replies:** 0\ **Last updated:** [March 9, 2020, 4:09pm UTC](https://discuss.elastic.co/t/ssh-into-elastic-search-or-another-way-to-get-a-synonyms-bundle/222762 "2020-03-09T16:09:49Z")
I'd like to get the file used by ES for custom plugin / bundle, that is used for synonyms. Is there a way to retrieve the information? One option, it seems, would be to ssh into the cluster (via the kibana node, maybe?… --- ## [Synonyms search in elastticsearch.net nest 7.5](https://discuss.elastic.co/t/synonyms-search-in-elastticsearch-net-nest-7-5/222522)
**Author:** [@linliliu](https://discuss.elastic.co/u/linliliu)\ **Replies:** 1\ **Last updated:** [March 9, 2020, 2:51pm UTC](https://discuss.elastic.co/t/synonyms-search-in-elastticsearch-net-nest-7-5/222522 "2020-03-09T14:51:09Z")
I am working on the synonyms search in nest 7.5. Do you have example for it? Most examples online are for old version nest. What is the replacement for .createIndex in nest 7.5? --- ## [CMDB use-case](https://discuss.elastic.co/t/cmdb-use-case/222735)
**Author:** [@robinf36](https://discuss.elastic.co/u/robinf36)\ **Replies:** 0\ **Last updated:** [March 9, 2020, 2:50pm UTC](https://discuss.elastic.co/t/cmdb-use-case/222735 "2020-03-09T14:50:08Z")
Dear Elastic community, I have a question regarding a specific use-case for which we would like to use Elastic(search). We would like to use Elastic for automating our Configuration Management Database (CMDB). Using t… --- ## [Elasticsearch-7.4.2- unable to discover master](https://discuss.elastic.co/t/elasticsearch-7-4-2-unable-to-discover-master/222730)
**Author:** [@satya06](https://discuss.elastic.co/u/satya06)\ **Replies:** 0\ **Last updated:** [March 9, 2020, 2:30pm UTC](https://discuss.elastic.co/t/elasticsearch-7-4-2-unable-to-discover-master/222730 "2020-03-09T14:30:24Z")
Hello Team, I am planning to spin up 3 nodes (node1,node2,node3) elasticsearch cluster in a single vm. I am using ip address of the machine for network host. getting the below errors in logs, master not discovered or e… --- ## [ILM: delete phase based on number of indicies?](https://discuss.elastic.co/t/ilm-delete-phase-based-on-number-of-indicies/222726)
**Author:** [@reighnman](https://discuss.elastic.co/u/reighnman)\ **Replies:** 0\ **Last updated:** [March 9, 2020, 2:15pm UTC](https://discuss.elastic.co/t/ilm-delete-phase-based-on-number-of-indicies/222726 "2020-03-09T14:15:04Z")
I thought I saw a commit in 7.6 for adding a delete phase based on "number of indicies", however I can no longer find it. Does anyone know if this is out in the channel somewhere? nm, think I found it in https://github… --- ## [Unfollowing indices when leader is gone](https://discuss.elastic.co/t/unfollowing-indices-when-leader-is-gone/221701)
**Author:** [@javierE](https://discuss.elastic.co/u/javierE)\ **Replies:** 4\ **Last updated:** [March 9, 2020, 1:10pm UTC](https://discuss.elastic.co/t/unfollowing-indices-when-leader-is-gone/221701 "2020-03-09T13:10:37Z")
Hello, I am currently testing ccr, and staging a particular scenario where my primary site is lost. I need to script a procedure to change all my followers to R/W and resume the operations on the secondary site. To a… --- ## [Elasticsearch datafeed has been retrieving no data for a while](https://discuss.elastic.co/t/elasticsearch-datafeed-has-been-retrieving-no-data-for-a-while/222634)
**Author:** [@pk.241011](https://discuss.elastic.co/u/pk.241011)\ **Replies:** 1\ **Last updated:** [March 9, 2020, 12:29pm UTC](https://discuss.elastic.co/t/elasticsearch-datafeed-has-been-retrieving-no-data-for-a-while/222634 "2020-03-09T12:29:53Z")
Hi, I have been seeing this warning "Datafeed has been retrieving no data for a while". But the Anomaly detection job is processing the records and I can see the timestamp and count of processed records changing. Why … --- ## [Data reconciliation from Filebeat, Logstash and ElasticSearch](https://discuss.elastic.co/t/data-reconciliation-from-filebeat-logstash-and-elasticsearch/222697)
**Author:** [@Lakshmi\_Narasimhan\_V](https://discuss.elastic.co/u/Lakshmi_Narasimhan_V)\ **Replies:** 0\ **Last updated:** [March 9, 2020, 11:38am UTC](https://discuss.elastic.co/t/data-reconciliation-from-filebeat-logstash-and-elasticsearch/222697 "2020-03-09T11:38:49Z")
I need to do a data reconciliation for the data read by filebeat (csv files) and the data processed by the Logstash (using csv filter plugin) and sent to Elasticsearch. Count of documents on a daily basis. Also if ther… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=991) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=993)