# Elasticsearch **URL:** https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=998 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 999 --- ## [Newbie: Sizing and Cluster](https://discuss.elastic.co/t/newbie-sizing-and-cluster/222003)
**Author:** [@Glenn\_Camilleri](https://discuss.elastic.co/u/Glenn_Camilleri)\ **Replies:** 2\ **Last updated:** [March 4, 2020, 8:47am UTC](https://discuss.elastic.co/t/newbie-sizing-and-cluster/222003 "2020-03-04T08:47:08Z")
Do you have any sources where I can find information regarding sizing (according to traffic: events/second) and what kind of hardware do I need ? And how to build a cluster ? Any good manuals / references where to start … --- ## [Logs are not showing in kibana - maximum shards open error](https://discuss.elastic.co/t/logs-are-not-showing-in-kibana-maximum-shards-open-error/221156)
**Author:** [@rvb\_n](https://discuss.elastic.co/u/rvb_n)\ **Replies:** 15\ **Last updated:** [March 4, 2020, 8:28am UTC](https://discuss.elastic.co/t/logs-are-not-showing-in-kibana-maximum-shards-open-error/221156 "2020-03-04T08:28:53Z")
Logs stopped suddenly from displaying in kibana. no clue.index pattern also not created. --- ## [Bad error handling of regex errors in pipelines](https://discuss.elastic.co/t/bad-error-handling-of-regex-errors-in-pipelines/222006)
**Author:** [@gborg](https://discuss.elastic.co/u/gborg)\ **Replies:** 0\ **Last updated:** [March 4, 2020, 8:19am UTC](https://discuss.elastic.co/t/bad-error-handling-of-regex-errors-in-pipelines/222006 "2020-03-04T08:19:20Z")
Hello, this is meant as feedback to elastic: All of a sudden yesterday my entire cluster (thankfully not my production cluster) started bombing out "regular expression has redundant nested repeat operator" errors, after… --- ## [Unable to increase shard allocation limit](https://discuss.elastic.co/t/unable-to-increase-shard-allocation-limit/221884)
**Author:** [@Yashwant\_Shettigar](https://discuss.elastic.co/u/Yashwant_Shettigar)\ **Replies:** 3\ **Last updated:** [March 4, 2020, 7:39am UTC](https://discuss.elastic.co/t/unable-to-increase-shard-allocation-limit/221884 "2020-03-04T07:39:20Z")
Hello, I am upgrading my ELK stack from 6.8 version to 7.5. While upgrading, I am getting following error in elasticsearch : "Validation Failed: 1: this action would add \[2\] total shards, but this cluster currently has… --- ## [Elk running on docker](https://discuss.elastic.co/t/elk-running-on-docker/221974)
**Author:** [@alxfernando](https://discuss.elastic.co/u/alxfernando)\ **Replies:** 6\ **Last updated:** [March 4, 2020, 6:43am UTC](https://discuss.elastic.co/t/elk-running-on-docker/221974 "2020-03-04T06:43:29Z")
Hi I have created a log analysis environment using elastisearch, kibana and logstash running on docker, but each tool in a container, now I need to put the 3 tools in a single docker container, I have seen the elastic d… --- ## [How to store different index on different storage device?](https://discuss.elastic.co/t/how-to-store-different-index-on-different-storage-device/221984)
**Author:** [@Muhammad\_Ariful\_Isla](https://discuss.elastic.co/u/Muhammad_Ariful_Isla)\ **Replies:** 3\ **Last updated:** [March 4, 2020, 5:49am UTC](https://discuss.elastic.co/t/how-to-store-different-index-on-different-storage-device/221984 "2020-03-04T05:49:43Z")
Hi there, How can I store different index on the different storage device? I want to storage hot indices to an SSD device and cold ones to a Spinning disk. How can I achieve this? --- ## [Elastic Search : Matching all the values from a multi-value field](https://discuss.elastic.co/t/elastic-search-matching-all-the-values-from-a-multi-value-field/221983)
**Author:** [@Vikram.Jain](https://discuss.elastic.co/u/Vikram.Jain)\ **Replies:** 0\ **Last updated:** [March 4, 2020, 5:13am UTC](https://discuss.elastic.co/t/elastic-search-matching-all-the-values-from-a-multi-value-field/221983 "2020-03-04T05:13:31Z")
I have the exact same problem as asked by @Bostjan\_Kovac " hi all! I am trying to build query that will match a document only when all the document's values in it's multi-value field are present in the given query. … --- ## [Error appeared while trying to get all documents from an index one by one](https://discuss.elastic.co/t/error-appeared-while-trying-to-get-all-documents-from-an-index-one-by-one/221964)
**Author:** [@Aayush\_Lakkad](https://discuss.elastic.co/u/Aayush_Lakkad)\ **Replies:** 0\ **Last updated:** [March 4, 2020, 2:05am UTC](https://discuss.elastic.co/t/error-appeared-while-trying-to-get-all-documents-from-an-index-one-by-one/221964 "2020-03-04T02:05:42Z")
Hey, I am new to elasticsearch and was trying a piece of code to get all the documents from an index one by one but I got an error. The code was: \> from elasticsearch import Elasticsearch \> import pandas as pd \> es … --- ## [How to search for anomalies in metrics?](https://discuss.elastic.co/t/how-to-search-for-anomalies-in-metrics/221953)
**Author:** [@jerrac](https://discuss.elastic.co/u/jerrac)\ **Replies:** 0\ **Last updated:** [March 3, 2020, 10:58pm UTC](https://discuss.elastic.co/t/how-to-search-for-anomalies-in-metrics/221953 "2020-03-03T22:58:49Z")
I want to create a small script that will query ES for data, and then send me an alert when it sees that there is "anomalous" data. For example, if the cpu load on a vm is suddenly spiking. I'd like an alert. That's eas… --- ## [Docker pull docker.elastic.co/elasticsearch/elasticsearch:7.5.2 getting "authentication required"](https://discuss.elastic.co/t/docker-pull-docker-elastic-co-elasticsearch-elasticsearch-7-5-2-getting-authentication-required/221918)
**Author:** [@achang77](https://discuss.elastic.co/u/achang77)\ **Replies:** 5\ **Last updated:** [March 3, 2020, 10:47pm UTC](https://discuss.elastic.co/t/docker-pull-docker-elastic-co-elasticsearch-elasticsearch-7-5-2-getting-authentication-required/221918 "2020-03-03T22:47:28Z")
Can anyone replicate? --- ## [Are there any proper alternatives to "Join" queries in ElasticSearch?](https://discuss.elastic.co/t/are-there-any-proper-alternatives-to-join-queries-in-elasticsearch/221952)
**Author:** [@Kun\_Liu1](https://discuss.elastic.co/u/Kun_Liu1)\ **Replies:** 0\ **Last updated:** [March 3, 2020, 10:35pm UTC](https://discuss.elastic.co/t/are-there-any-proper-alternatives-to-join-queries-in-elasticsearch/221952 "2020-03-03T22:35:10Z")
Hi everyone, We are seeking advice on a situation which may need elasticsearch "join" queries. It is basically a subscription system. Different users may subscribe the same item, so we want to save the users data agai… --- ## [Can split processor address a multi-field?](https://discuss.elastic.co/t/can-split-processor-address-a-multi-field/221601)
**Author:** [@JohanP](https://discuss.elastic.co/u/JohanP)\ **Replies:** 2\ **Last updated:** [March 3, 2020, 9:15pm UTC](https://discuss.elastic.co/t/can-split-processor-address-a-multi-field/221601 "2020-03-03T21:15:31Z")
Using the split processor as documented in my earlier topic: Now I would like to be able to specify a multi-field as the field to write to: PUT 51 { "mappings": { "properties": { "q3.read": { "type… --- ## [Geo\_point mapping problem](https://discuss.elastic.co/t/geo-point-mapping-problem/221799)
**Author:** [@Aba](https://discuss.elastic.co/u/Aba)\ **Replies:** 4\ **Last updated:** [March 3, 2020, 9:22pm UTC](https://discuss.elastic.co/t/geo-point-mapping-problem/221799 "2020-03-03T21:22:07Z")
Hi guys, I am ELK noob willing to learn. I've got a document \[...\] "\_source": { "network": { "type": "ipv4" }, "interface\_name": "LAN", "destination": { "geo": { "country\_name": "U… --- ## [Odbc SQL rest access](https://discuss.elastic.co/t/odbc-sql-rest-access/220726)
**Author:** [@rajsolanki](https://discuss.elastic.co/u/rajsolanki)\ **Replies:** 1\ **Last updated:** [March 3, 2020, 8:59pm UTC](https://discuss.elastic.co/t/odbc-sql-rest-access/220726 "2020-03-03T20:59:57Z")
hi on my ELK cluster i have LDAP (active directory) security enabled. i m trying to setup odbc from here https://www.elastic.co/guide/en/elasticsearch/reference/current/sql-odbc-setup.html and page says abotu security "I… --- ## [Different response of match and term query using synonyms](https://discuss.elastic.co/t/different-response-of-match-and-term-query-using-synonyms/221827)
**Author:** [@Syed\_Saeed\_Ul\_Hassan](https://discuss.elastic.co/u/Syed_Saeed_Ul_Hassan)\ **Replies:** 2\ **Last updated:** [March 3, 2020, 8:28pm UTC](https://discuss.elastic.co/t/different-response-of-match-and-term-query-using-synonyms/221827 "2020-03-03T20:28:14Z")
Hi all, I have recently started working with elastic search. I read about synonyms and how expansion and replacement works in synonyms but when I perform a match query, resultant response seems like synonyms worked as e… --- ## [How to connect Liferay client (using Transport Protocol) to Elastic Cluster through Nginx](https://discuss.elastic.co/t/how-to-connect-liferay-client-using-transport-protocol-to-elastic-cluster-through-nginx/221938)
**Author:** [@galew](https://discuss.elastic.co/u/galew)\ **Replies:** 0\ **Last updated:** [March 3, 2020, 7:11pm UTC](https://discuss.elastic.co/t/how-to-connect-liferay-client-using-transport-protocol-to-elastic-cluster-through-nginx/221938 "2020-03-03T19:11:09Z")
Hi! I have Elasticsearch clusters behind NGiNX. Everything has worked great until I try to connect my Elasticsearch clusters with Liferay Client. Liferay client is using Elasticsearch Native Binary Protocol to connect… --- ## [Planning a new cluster installation](https://discuss.elastic.co/t/planning-a-new-cluster-installation/221924)
**Author:** [@Burga](https://discuss.elastic.co/u/Burga)\ **Replies:** 2\ **Last updated:** [March 3, 2020, 6:39pm UTC](https://discuss.elastic.co/t/planning-a-new-cluster-installation/221924 "2020-03-03T18:39:19Z")
Hi , I'm planning a new Elasticsearch cluster installation I want to build 3 master nodes (4 cpu , 8g ) 3 data nodes (4 cpu, 16g) 2 logstash nodes(4 cpu , 8g) 2 Ingest nodes --\> (do I need it ?) Is this a correc… --- ## [Shards still started for closed indexes](https://discuss.elastic.co/t/shards-still-started-for-closed-indexes/221930)
**Author:** [@16318a22907f3cbfa04b](https://discuss.elastic.co/u/16318a22907f3cbfa04b)\ **Replies:** 2\ **Last updated:** [March 3, 2020, 6:15pm UTC](https://discuss.elastic.co/t/shards-still-started-for-closed-indexes/221930 "2020-03-03T18:15:19Z")
Elasticsearch 7.3.2 OSS. When I close some indexes (POST pattern-\*/\_close) shards still displayed as started in GET \_cat/shards. I made sure that the indexes are really closed (GET \_cat/indices/pattern-\*?h=s,i) I exp… --- ## [Clarification about recommended memory-disk ratio of 1:30](https://discuss.elastic.co/t/clarification-about-recommended-memory-disk-ratio-of-1-30/221547)
**Author:** [@dwilches](https://discuss.elastic.co/u/dwilches)\ **Replies:** 4\ **Last updated:** [March 3, 2020, 5:40pm UTC](https://discuss.elastic.co/t/clarification-about-recommended-memory-disk-ratio-of-1-30/221547 "2020-03-03T17:40:19Z")
I've seen some confusing (seemingly contradicting) official guidelines about sizing an ElasticSearch cluster, so I'd like to know if somebody can shed some light on this. These are the guidelines in question: As per … --- ## [ILM rollsover the index but it stays in hot phase](https://discuss.elastic.co/t/ilm-rollsover-the-index-but-it-stays-in-hot-phase/219378)
**Author:** [@TomaszKlosinski](https://discuss.elastic.co/u/TomaszKlosinski)\ **Replies:** 9\ **Last updated:** [March 3, 2020, 5:04pm UTC](https://discuss.elastic.co/t/ilm-rollsover-the-index-but-it-stays-in-hot-phase/219378 "2020-03-03T17:04:22Z")
I have ILM like this: PUT \_ilm/policy/logs { "policy": { "phases": { "hot": { "min\_age": "0ms", "actions": { "rollover": { "max\_size"… --- ## [Self-signed certificate expiration date and the ES cluster transport layer](https://discuss.elastic.co/t/self-signed-certificate-expiration-date-and-the-es-cluster-transport-layer/221784)
**Author:** [@Darrell\_Lowrance](https://discuss.elastic.co/u/Darrell_Lowrance)\ **Replies:** 2\ **Last updated:** [March 3, 2020, 4:38pm UTC](https://discuss.elastic.co/t/self-signed-certificate-expiration-date-and-the-es-cluster-transport-layer/221784 "2020-03-03T16:38:15Z")
Current ELK cluster version: v7.3 I'm currently using a self-signed cert generated using the elasticsearch-certutil tool. By default, the CA and Certificate expire in 3 years. I plan to use the self-signed certs in P… --- ## [Unable to increase REST API startup timeout](https://discuss.elastic.co/t/unable-to-increase-rest-api-startup-timeout/221719)
**Author:** [@sipayne](https://discuss.elastic.co/u/sipayne)\ **Replies:** 3\ **Last updated:** [March 3, 2020, 3:48pm UTC](https://discuss.elastic.co/t/unable-to-increase-rest-api-startup-timeout/221719 "2020-03-03T15:48:55Z")
Hi, I am a newcomer to Rally and having a go at running some benchmarks. My OS is Ubuntu Linux 18.04.1 64-bit. Rally version is 1.4.1. I have created a custom track and set of cars, and have a benchmark that runs nicel… --- ## [Not able to pass value from filebeat to logstash](https://discuss.elastic.co/t/not-able-to-pass-value-from-filebeat-to-logstash/221916)
**Author:** [@punit11in](https://discuss.elastic.co/u/punit11in)\ **Replies:** 0\ **Last updated:** [March 3, 2020, 3:25pm UTC](https://discuss.elastic.co/t/not-able-to-pass-value-from-filebeat-to-logstash/221916 "2020-03-03T15:25:03Z")
Hi experts, Im new to elk and need your help here. I m trying to pass a value from filebeat to logstash but been unsuccessful. This is what I have mentioned in filebeat.yml ########filebeat.yml######### output.logst… --- ## [Can i use Histogram field and Boxplot with XPack Basic license?](https://discuss.elastic.co/t/can-i-use-histogram-field-and-boxplot-with-xpack-basic-license/221905)
**Author:** [@AtyNewman](https://discuss.elastic.co/u/AtyNewman)\ **Replies:** 0\ **Last updated:** [March 3, 2020, 2:48pm UTC](https://discuss.elastic.co/t/can-i-use-histogram-field-and-boxplot-with-xpack-basic-license/221905 "2020-03-03T14:48:47Z")
I read the documentation here: Histogram Datatype BoxPlot I saw the Histogram datatype and Boxplot both connected to XPack, but in the subsciption page, i see that i can use Histogram data type with basic license: Su… --- ## [ELK architucture](https://discuss.elastic.co/t/elk-architucture/221762)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 4\ **Last updated:** [March 3, 2020, 2:18pm UTC](https://discuss.elastic.co/t/elk-architucture/221762 "2020-03-03T14:18:37Z")
I ask few time about Architecture but no input from community. well after while now asking different questions but same topic Can I setup multiple coordinating only server? will it help? this is what I was thinking. I… --- ## [Version stable](https://discuss.elastic.co/t/version-stable/221888)
**Author:** [@Oscar\_Benitez](https://discuss.elastic.co/u/Oscar_Benitez)\ **Replies:** 2\ **Last updated:** [March 3, 2020, 2:18pm UTC](https://discuss.elastic.co/t/version-stable/221888 "2020-03-03T14:18:24Z")
buenas a todos, Cual es la version mas estable de elasticsearch en un entorno de big-data ? --- ## [Compatibilidad con java](https://discuss.elastic.co/t/compatibilidad-con-java/221890)
**Author:** [@Oscar\_Benitez](https://discuss.elastic.co/u/Oscar_Benitez)\ **Replies:** 1\ **Last updated:** [March 3, 2020, 2:13pm UTC](https://discuss.elastic.co/t/compatibilidad-con-java/221890 "2020-03-03T14:13:14Z")
Buenas a todos soy nuevo en elasticsearch, y quisiera saber que version de java es compatible con elasticsearch 7 o superior ?? --- ## [GET \_nodes/\_local/stats times out when executed by metricbeat](https://discuss.elastic.co/t/get-nodes-local-stats-times-out-when-executed-by-metricbeat/221839)
**Author:** [@leprovokateur](https://discuss.elastic.co/u/leprovokateur)\ **Replies:** 0\ **Last updated:** [March 3, 2020, 9:05am UTC](https://discuss.elastic.co/t/get-nodes-local-stats-times-out-when-executed-by-metricbeat/221839 "2020-03-03T09:05:02Z")
Hi, I want to activate the selfmonitoring of my elasticsearch cluster using metricbeat. The problem is, that the request of GET \_node/\_local\_stats times out: Feb 28 11:19:25 WUM96178 metricbeat\[18611\]: 2020-02-28T11:1… --- ## [Leap Year Issue: Performance issue](https://discuss.elastic.co/t/leap-year-issue-performance-issue/221897)
**Author:** [@Nitin\_K](https://discuss.elastic.co/u/Nitin_K)\ **Replies:** 0\ **Last updated:** [March 3, 2020, 1:52pm UTC](https://discuss.elastic.co/t/leap-year-issue-performance-issue/221897 "2020-03-03T13:52:02Z")
Hi, We are using ElasticSearch 6.2 in production. We noticed a spike in search latency on the recent leap day (02/29/2020). We use lot of date\_range and date fields in our index. We noticed that our search latency almos… --- ## [Cannot join nodes to master 2](https://discuss.elastic.co/t/cannot-join-nodes-to-master-2/221793)
**Author:** [@Julio\_Edel\_Salas\_Dia](https://discuss.elastic.co/u/Julio_Edel_Salas_Dia)\ **Replies:** 2\ **Last updated:** [March 3, 2020, 1:46pm UTC](https://discuss.elastic.co/t/cannot-join-nodes-to-master-2/221793 "2020-03-03T13:46:26Z")
Hi, it is normal this error for to comunicate 2 nodes in an elasticsearch cluster? This is network traffic between two master nodes, to join each other. 10.28.11.7.9300 \> 10.28.11.8.48610: Flags \[.\], cksum 0xa1d5 (cor… [Previous page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=997) [Next page](https://discuss.elastic.co/c/elastic-stack/elasticsearch/6.md?page=999)