# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=994 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 995 --- ## [MDC logs, ELK and filebeat](https://discuss.elastic.co/t/mdc-logs-elk-and-filebeat/222413)
**Author:** [@ash2](https://discuss.elastic.co/u/ash2)\ **Replies:** 9\ **Last updated:** [March 6, 2020, 4:30pm UTC](https://discuss.elastic.co/t/mdc-logs-elk-and-filebeat/222413 "2020-03-06T16:30:08Z")
Hi, I am new to Elastic stack. I am trying to creating a log management system. And while searching I came across MDC. So, I want to know about MDC logs and how it is useful in respect of filebeat or logstash log parsin… --- ## [Curator action close fails if index.blocks.read\_only for .kibana meta index is set to true](https://discuss.elastic.co/t/curator-action-close-fails-if-index-blocks-read-only-for-kibana-meta-index-is-set-to-true/222482)
**Author:** [@danksim](https://discuss.elastic.co/u/danksim)\ **Replies:** 2\ **Last updated:** [March 6, 2020, 4:19pm UTC](https://discuss.elastic.co/t/curator-action-close-fails-if-index-blocks-read-only-for-kibana-meta-index-is-set-to-true/222482 "2020-03-06T16:19:13Z")
I want to set the visualize and dashboards features readonly for my Kibana users. So I successfully ran the following from one of the elasticsearech data nodes (a k8s pod in this case): \>\> curl -XPUT localhost:9200/.kib… --- ## [Search a substring in a field](https://discuss.elastic.co/t/search-a-substring-in-a-field/222452)
**Author:** [@McElroy](https://discuss.elastic.co/u/McElroy)\ **Replies:** 1\ **Last updated:** [March 6, 2020, 3:46pm UTC](https://discuss.elastic.co/t/search-a-substring-in-a-field/222452 "2020-03-06T15:46:05Z")
Hi, I'd like to search for a substring in the message field of my document, but I can't get it done. The substring is "Error while initializing socket". I'd like to get it via curl. I already search a lot in the docume… --- ## [Possibility to run rally tests on ECK deployed clusters](https://discuss.elastic.co/t/possibility-to-run-rally-tests-on-eck-deployed-clusters/222450)
**Author:** [@das-chick](https://discuss.elastic.co/u/das-chick)\ **Replies:** 1\ **Last updated:** [March 6, 2020, 3:44pm UTC](https://discuss.elastic.co/t/possibility-to-run-rally-tests-on-eck-deployed-clusters/222450 "2020-03-06T15:44:02Z")
Hey, is there a description or howto, how i could benchmark ES deployed via ECK based on openshift? regards --- ## [Elasticsearch Curator snapshot/restore with multiple .kibana/.kibana\_N indices](https://discuss.elastic.co/t/elasticsearch-curator-snapshot-restore-with-multiple-kibana-kibana-n-indices/222384)
**Author:** [@danksim](https://discuss.elastic.co/u/danksim)\ **Replies:** 2\ **Last updated:** [March 6, 2020, 3:14pm UTC](https://discuss.elastic.co/t/elasticsearch-curator-snapshot-restore-with-multiple-kibana-kibana-n-indices/222384 "2020-03-06T15:14:50Z")
I am running two separate instances (x and y) of ES. I am treating y as the "source of truth" for saved objects. So x will snapshot to x's s3 bucket (as a backup plan if y goes stale) but always restore from y's s3 buck… --- ## [Sort within a sort - ElasticSearch (DSL / DRF)](https://discuss.elastic.co/t/sort-within-a-sort-elasticsearch-dsl-drf/222479)
**Author:** [@Julian\_Camilleri](https://discuss.elastic.co/u/Julian_Camilleri)\ **Replies:** 0\ **Last updated:** [March 6, 2020, 3:09pm UTC](https://discuss.elastic.co/t/sort-within-a-sort-elasticsearch-dsl-drf/222479 "2020-03-06T15:09:52Z")
Context: Imagine having 10 records, 5 of which are featured. - You want to firstly bring the featured to the top of the list (not sure if it's the best way but done easily via .sort('-featured')) , then you want to sort… --- ## [Ansible-Elasticsearch custom CA certificate validation failures](https://discuss.elastic.co/t/ansible-elasticsearch-custom-ca-certificate-validation-failures/216843)
**Author:** [@bernhard.fluehmann](https://discuss.elastic.co/u/bernhard.fluehmann)\ **Replies:** 1\ **Last updated:** [March 6, 2020, 3:08pm UTC](https://discuss.elastic.co/t/ansible-elasticsearch-custom-ca-certificate-validation-failures/216843 "2020-03-06T15:08:09Z")
If Elasticsearch is installed with Ansible and a custom CA is used, the installation fails when es\_validate\_certs is true. The reason is that Ansible just copies the CA from the Ansible host to the nodes certificate dire… --- ## [Take snapshot every day of Mysql datatbase in ElasticSearch](https://discuss.elastic.co/t/take-snapshot-every-day-of-mysql-datatbase-in-elasticsearch/220609)
**Author:** [@anujeet](https://discuss.elastic.co/u/anujeet)\ **Replies:** 1\ **Last updated:** [March 6, 2020, 2:55pm UTC](https://discuss.elastic.co/t/take-snapshot-every-day-of-mysql-datatbase-in-elasticsearch/220609 "2020-03-06T14:55:56Z")
Hello. I have a Mysql application. But we want to do some analysis on the data that is being stored. In the Mysql database, the data is being overriden everyday. But we want to store everyday's dump in ElasticSearch so … --- ## [Elasticsearch Partial Snapshot](https://discuss.elastic.co/t/elasticsearch-partial-snapshot/222289)
**Author:** [@Bkelly](https://discuss.elastic.co/u/Bkelly)\ **Replies:** 2\ **Last updated:** [March 6, 2020, 2:07pm UTC](https://discuss.elastic.co/t/elasticsearch-partial-snapshot/222289 "2020-03-06T14:07:17Z")
Hi Im running into an issue with snapshotting one of my elasticsearch clusters. I have snapshot the cluster weekly , however I got a PARTIAL snapshot last time . 199/200 indices passed. one of the indices failed with… --- ## [Timestamp fails for filebeat haproxy @SSL handshake failure loglines its displayed one houre in the future in kibana](https://discuss.elastic.co/t/timestamp-fails-for-filebeat-haproxy-ssl-handshake-failure-loglines-its-displayed-one-houre-in-the-future-in-kibana/222470)
**Author:** [@seb0](https://discuss.elastic.co/u/seb0)\ **Replies:** 0\ **Last updated:** [March 6, 2020, 1:55pm UTC](https://discuss.elastic.co/t/timestamp-fails-for-filebeat-haproxy-ssl-handshake-failure-loglines-its-displayed-one-houre-in-the-future-in-kibana/222470 "2020-03-06T13:55:13Z")
Hello, i have a problem with filebeat haproxy module. All logs are parsed directly from filebeat 7.5.0 to elk 7.5.0 but the Lines with SSL handshakre failure are displayed on hour in the future. Here my json output: {… --- ## [Securing Elasticsearch communication in Docker Swarm](https://discuss.elastic.co/t/securing-elasticsearch-communication-in-docker-swarm/222469)
**Author:** [@areller](https://discuss.elastic.co/u/areller)\ **Replies:** 0\ **Last updated:** [March 6, 2020, 1:53pm UTC](https://discuss.elastic.co/t/securing-elasticsearch-communication-in-docker-swarm/222469 "2020-03-06T13:53:18Z")
I am running an Elastic stack in Docker swarm. I want to setup authentication in Kibana (username + password atleast), but to do that I need to set security in Elasticsearch first. What is the best approach to do it in… --- ## [Illegal\_argument\_exception: index.lifecycle.rollover\_alias does not point to index](https://discuss.elastic.co/t/illegal-argument-exception-index-lifecycle-rollover-alias-does-not-point-to-index/222466)
**Author:** [@bodo.te](https://discuss.elastic.co/u/bodo.te)\ **Replies:** 0\ **Last updated:** [March 6, 2020, 1:38pm UTC](https://discuss.elastic.co/t/illegal-argument-exception-index-lifecycle-rollover-alias-does-not-point-to-index/222466 "2020-03-06T13:38:05Z")
I have a new installation of elasticsearch, kibana, filebeats, metricbeat, journalbeat and heartbeat. At the time of the new installation it was Version 7.5.0 , now upgraded to V 7.6.0 and today V7.6.1. I configured th… --- ## [Blocks.write = true, won't work](https://discuss.elastic.co/t/blocks-write-true-wont-work/222464)
**Author:** [@aliservetdonmez](https://discuss.elastic.co/u/aliservetdonmez)\ **Replies:** 0\ **Last updated:** [March 6, 2020, 1:30pm UTC](https://discuss.elastic.co/t/blocks-write-true-wont-work/222464 "2020-03-06T13:30:18Z")
Hi, I am running an ES (version 6.3.1) cluster on AWS's managed-ES service, and have a script (written in Python) that is running every so often to check for index sizes, and if any index exceeds a given threshold, I wi… --- ## [How to set G1GC in docker](https://discuss.elastic.co/t/how-to-set-g1gc-in-docker/222457)
**Author:** [@roflmao](https://discuss.elastic.co/u/roflmao)\ **Replies:** 0\ **Last updated:** [March 6, 2020, 12:34pm UTC](https://discuss.elastic.co/t/how-to-set-g1gc-in-docker/222457 "2020-03-06T12:34:36Z")
Running elasticsearch 7.6.1 in docker Setting ES\_JAVA\_OPTS env: -XX:+UseG1GC -Xms16g -Xmx16g -XX:-UseConcMarkSweepGC -XX:UseCMSInitiatingOccupancyOnly -XX:InitiatingHeapOccupancyPercent=75 elasticsearch doesnt star… --- ## [Repeated cluster failures in multi-node cluster](https://discuss.elastic.co/t/repeated-cluster-failures-in-multi-node-cluster/221919)
**Author:** [@Carv](https://discuss.elastic.co/u/Carv)\ **Replies:** 19\ **Last updated:** [March 6, 2020, 12:16pm UTC](https://discuss.elastic.co/t/repeated-cluster-failures-in-multi-node-cluster/221919 "2020-03-06T12:16:44Z")
Hi All, Long time reader, very few posts over the years... I've recently implemented a new multi-node cluster of the following topology, all on Ubuntu 18.04 LTS servers running v7.5.2 ES/LS/Kibana etc.: ES-Node01 = El… --- ## [Machine Learning datafeed for egress traffic](https://discuss.elastic.co/t/machine-learning-datafeed-for-egress-traffic/222451)
**Author:** [@ezions](https://discuss.elastic.co/u/ezions)\ **Replies:** 0\ **Last updated:** [March 6, 2020, 11:59am UTC](https://discuss.elastic.co/t/machine-learning-datafeed-for-egress-traffic/222451 "2020-03-06T11:59:55Z")
Hi, I'm trying to create a datafeed for a ML job which would detect suspicious egress traffic per hosts. PUT \_xpack/ml/datafeeds/datafeed-network\_out\_deriv/ { "job\_id": "network\_out\_deriv", "indices": \[ "metric… --- ## [License of GeoLite2 database](https://discuss.elastic.co/t/license-of-geolite2-database/216411)
**Author:** [@Flavio\_Pompermaier](https://discuss.elastic.co/u/Flavio_Pompermaier)\ **Replies:** 7\ **Last updated:** [March 6, 2020, 11:54am UTC](https://discuss.elastic.co/t/license-of-geolite2-database/216411 "2020-03-06T11:54:38Z")
Hi to all, I'm using ES 7.5.0 and the IP resolution of the IP 94.102.52.57 is wrong (see dev tools example below). So I tried to update my geolite database but now it seems that it's not available for free download. Am… --- ## [Can't get text on a START\_OBJECT at 1:1111 when using the \_reindex API](https://discuss.elastic.co/t/cant-get-text-on-a-start-object-at-1-1111-when-using-the-reindex-api/222448)
**Author:** [@Norman\_Khine](https://discuss.elastic.co/u/Norman_Khine)\ **Replies:** 0\ **Last updated:** [March 6, 2020, 11:43am UTC](https://discuss.elastic.co/t/cant-get-text-on-a-start-object-at-1-1111-when-using-the-reindex-api/222448 "2020-03-06T11:43:57Z")
Hello, I am using the \_reindex API to merge daily indexes into monthly indexes but get this error: { "index": "sentry-2019.01", "type": "\_doc", "id": "NtBfKWgBAZO4MSmwwzvg", "cause": { "type": "mapper\_parsing\_exception… --- ## [Unable to run SQL query on multi fields using Elastic Search v. 7.3](https://discuss.elastic.co/t/unable-to-run-sql-query-on-multi-fields-using-elastic-search-v-7-3/222321)
**Author:** [@Prince.Tyagi](https://discuss.elastic.co/u/Prince.Tyagi)\ **Replies:** 3\ **Last updated:** [March 6, 2020, 11:43am UTC](https://discuss.elastic.co/t/unable-to-run-sql-query-on-multi-fields-using-elastic-search-v-7-3/222321 "2020-03-06T11:43:46Z")
Hi Team, I am getting below error while executing elasticsearch SQL query for translating it to elastic query on multifield: { \* "error": { \* "root\_cause": \[ \* { \* "type": "verification\_exception", \*… --- ## [Elasticsearch 7.6 Cluster Configuration](https://discuss.elastic.co/t/elasticsearch-7-6-cluster-configuration/222438)
**Author:** [@northmilo](https://discuss.elastic.co/u/northmilo)\ **Replies:** 1\ **Last updated:** [March 6, 2020, 11:35am UTC](https://discuss.elastic.co/t/elasticsearch-7-6-cluster-configuration/222438 "2020-03-06T11:35:22Z")
Hi, I am having issue with Elasticsearch 7.6 cluster configuration. Cluser status is RED. curl -XGET master1:9200/\_cat/nodes prints: 10.69.61.201 8 63 0 0.00 0.01 0.05 ilm \* master1.ela.soc.xxx curl -XGET data1:9200/\_c… --- ## [Elasticsearch failed node exception (Negative longs unsupported) since 7.5 -7.6 upgrade](https://discuss.elastic.co/t/elasticsearch-failed-node-exception-negative-longs-unsupported-since-7-5-7-6-upgrade/222305)
**Author:** [@james.garside](https://discuss.elastic.co/u/james.garside)\ **Replies:** 3\ **Last updated:** [March 6, 2020, 11:04am UTC](https://discuss.elastic.co/t/elasticsearch-failed-node-exception-negative-longs-unsupported-since-7-5-7-6-upgrade/222305 "2020-03-06T11:04:09Z")
Since upgrading from 7.5 to 7.6 we have been getting an error on two of our master nodes which is causing them to fail. It seems something is trying to insert a negative long where one is not supported causing failure. I… --- ## [Aggregations large data in real time in Elasticsearch. What solution is the best?](https://discuss.elastic.co/t/aggregations-large-data-in-real-time-in-elasticsearch-what-solution-is-the-best/222188)
**Author:** [@ndhcoder](https://discuss.elastic.co/u/ndhcoder)\ **Replies:** 10\ **Last updated:** [March 6, 2020, 10:30am UTC](https://discuss.elastic.co/t/aggregations-large-data-in-real-time-in-elasticsearch-what-solution-is-the-best/222188 "2020-03-06T10:30:21Z")
Hi all, I have a question ? With a system have about a billion logs each days, How can i get all my aggregations data like "count request error per host", "count request per days, per hours, ..", in time series in rea… --- ## [7.6.0 High CPU on a data node](https://discuss.elastic.co/t/7-6-0-high-cpu-on-a-data-node/220340)
**Author:** [@stefws](https://discuss.elastic.co/u/stefws)\ **Replies:** 22\ **Last updated:** [March 6, 2020, 10:26am UTC](https://discuss.elastic.co/t/7-6-0-high-cpu-on-a-data-node/220340 "2020-03-06T10:26:01Z")
Found the need to restart elasticsearch service on one of our 7.6.0 data nodes today as it was in high cpu load. Maybe a general bug that bid us? Top of only stack dump/issue seen in the log: \[2020-02-21T09:15:34,251\]\[… --- ## [How to collapse multiple fields value in ElasticSearch?](https://discuss.elastic.co/t/how-to-collapse-multiple-fields-value-in-elasticsearch/222427)
**Author:** [@ndhcoder](https://discuss.elastic.co/u/ndhcoder)\ **Replies:** 0\ **Last updated:** [March 6, 2020, 9:31am UTC](https://discuss.elastic.co/t/how-to-collapse-multiple-fields-value-in-elasticsearch/222427 "2020-03-06T09:31:52Z")
Hi everyone, I want to make a use case is allow user setting dynamic collapse field on their data, so I have a question: How to collapse multiple fields value in ElasticSearch ? Thanks all. --- ## [Continued support for annotated text plugin?](https://discuss.elastic.co/t/continued-support-for-annotated-text-plugin/218688)
**Author:** [@benarar](https://discuss.elastic.co/u/benarar)\ **Replies:** 1\ **Last updated:** [March 6, 2020, 9:31am UTC](https://discuss.elastic.co/t/continued-support-for-annotated-text-plugin/218688 "2020-03-06T09:31:29Z")
Hi, I am hoping to use the Mapper Annotated Text Plugin (Mapper Annotated Text Plugin | Elasticsearch Plugins and Integrations \[7.5\] | Elastic) but noticed this warning: This functionality is experimental and may be c… --- ## [I would like to inquire that there are more than one field value for the entire document](https://discuss.elastic.co/t/i-would-like-to-inquire-that-there-are-more-than-one-field-value-for-the-entire-document/222259)
**Author:** [@Sihwan](https://discuss.elastic.co/u/Sihwan)\ **Replies:** 2\ **Last updated:** [March 6, 2020, 7:53am UTC](https://discuss.elastic.co/t/i-would-like-to-inquire-that-there-are-more-than-one-field-value-for-the-entire-document/222259 "2020-03-06T07:53:51Z")
If you look at MS-SQL queries select T1.column1 AS 'A' , count(T1.column1) AS 'C' from Table1 T1 group by column1 having count(column1) \> 1 But I would like to have a lookup at the elastic Will it be possible? --- ## [Products sort with pick products from every brand and list accordingly](https://discuss.elastic.co/t/products-sort-with-pick-products-from-every-brand-and-list-accordingly/222410)
**Author:** [@tejas-ambalia](https://discuss.elastic.co/u/tejas-ambalia)\ **Replies:** 1\ **Last updated:** [March 6, 2020, 7:19am UTC](https://discuss.elastic.co/t/products-sort-with-pick-products-from-every-brand-and-list-accordingly/222410 "2020-03-06T07:19:39Z")
I do have 10 products with different brands. Brand1 contains 3 products Brand2 contains 4 products Brand3 contains 3 products Currently I am getting output as per relevance sorting (given example below) { 'id': 1, … --- ## [Configuring TLS and authentication in Local](https://discuss.elastic.co/t/configuring-tls-and-authentication-in-local/222235)
**Author:** [@sarvendras](https://discuss.elastic.co/u/sarvendras)\ **Replies:** 3\ **Last updated:** [March 6, 2020, 7:12am UTC](https://discuss.elastic.co/t/configuring-tls-and-authentication-in-local/222235 "2020-03-06T07:12:52Z")
Hi All, I am following below blog for TLS configutation on my local windows machine. After completing and following till step 3 when I am running second elasticsearch node its giving below error.While first master n… --- ## [I Cant snapshot to s3](https://discuss.elastic.co/t/i-cant-snapshot-to-s3/220336)
**Author:** [@mark.quilates](https://discuss.elastic.co/u/mark.quilates)\ **Replies:** 7\ **Last updated:** [March 6, 2020, 6:17am UTC](https://discuss.elastic.co/t/i-cant-snapshot-to-s3/220336 "2020-03-06T06:17:26Z")
Hi, I'm getting this error once i ran the curator snaphots to s3 "{"error":{"root\_cause":\[{"type":"multi\_object\_delete\_exception","reason":"One or more objects could not be deleted (Service: null; Status Code: 200; Err… --- ## [Unable to access EC2 ElasticSearch7.5.2 Server using EC2 Public IP on local machine](https://discuss.elastic.co/t/unable-to-access-ec2-elasticsearch7-5-2-server-using-ec2-public-ip-on-local-machine/221854)
**Author:** [@shaheryar.malik](https://discuss.elastic.co/u/shaheryar.malik)\ **Replies:** 18\ **Last updated:** [March 6, 2020, 3:51am UTC](https://discuss.elastic.co/t/unable-to-access-ec2-elasticsearch7-5-2-server-using-ec2-public-ip-on-local-machine/221854 "2020-03-06T03:51:43Z")
I am using Elasticsearch7.5.2 on EC2 instance and I have modified config/elasticsearch.yml as: network.host: 0.0.0.0 node.master: true node.data: true transport.host: localhost transport.tcp.port: 9300 I can access it … [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=993) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=995)