# Elastic Search **URL:** https://discuss.elastic.co/c/search/84.md?page=1 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 2 --- ## [Performance Issue on Elasticsearch (Plain search query)](https://discuss.elastic.co/t/performance-issue-on-elasticsearch-plain-search-query/385178)
**Author:** [@crchaulagain](https://discuss.elastic.co/u/crchaulagain)\ **Replies:** 2\ **Last updated:** [March 3, 2026, 5:35am UTC](https://discuss.elastic.co/t/performance-issue-on-elasticsearch-plain-search-query/385178 "2026-03-03T05:35:41Z")
Hey everyone, I'm using ES (9.1.7) and running into a performance issue with my Elasticsearch setup and could use some insights. Here’s the situation: I have a cluster with 4 client nodes, 8 data nodes, and 3 master no… --- ## [ES query operation’s impact on cluster CPU consumption](https://discuss.elastic.co/t/es-query-operation-s-impact-on-cluster-cpu-consumption/385280)
**Author:** [@mloine](https://discuss.elastic.co/u/mloine)\ **Replies:** 1\ **Last updated:** [February 28, 2026, 8:27am UTC](https://discuss.elastic.co/t/es-query-operation-s-impact-on-cluster-cpu-consumption/385280 "2026-02-28T08:27:23Z")
Hello, I have a practical question: Background: Query operations on ES in stress testing scenarios Question: The CPU usage of a specific node is much higher than that of other nodes. How to evenly distribute query oper… --- ## [Elasticsearch Log4j vulnerability resolution for 8.19.X version](https://discuss.elastic.co/t/elasticsearch-log4j-vulnerability-resolution-for-8-19-x-version/385022)
**Author:** [@shubhammugale](https://discuss.elastic.co/u/shubhammugale)\ **Replies:** 7\ **Last updated:** [February 20, 2026, 5:58pm UTC](https://discuss.elastic.co/t/elasticsearch-log4j-vulnerability-resolution-for-8-19-x-version/385022 "2026-02-20T17:58:31Z")
We are currently running Elasticsearch version 8.19.8 in our environment and are receiving a Log4j vulnerability alert. To address this issue, we verified and upgraded to Elasticsearch version 8.19.11, but the vulnerabi… --- ## [FsCrawler snapshot 2.10 not compatible with the Elastic search version 9.2.4 and 9.3.0 getting error](https://discuss.elastic.co/t/fscrawler-snapshot-2-10-not-compatible-with-the-elastic-search-version-9-2-4-and-9-3-0-getting-error/384944)
**Author:** [@sunilhpan](https://discuss.elastic.co/u/sunilhpan)\ **Replies:** 2\ **Last updated:** [February 20, 2026, 8:39am UTC](https://discuss.elastic.co/t/fscrawler-snapshot-2-10-not-compatible-with-the-elastic-search-version-9-2-4-and-9-3-0-getting-error/384944 "2026-02-20T08:39:20Z")
FsCrawler snapshot 2.10 not compatible with the Elastic search version 9.2.4 and 9.3.0 getting error - Getting below error need to resolve this not sure what error is it Elasticsearch 9.2.4 and 9.3.0 says to install the … --- ## [Cryptic error trying to test a PROD-ready query proxy](https://discuss.elastic.co/t/cryptic-error-trying-to-test-a-prod-ready-query-proxy/385029)
**Author:** [@DaManDOH](https://discuss.elastic.co/u/DaManDOH)\ **Replies:** 0\ **Last updated:** [February 12, 2026, 9:45pm UTC](https://discuss.elastic.co/t/cryptic-error-trying-to-test-a-prod-ready-query-proxy/385029 "2026-02-12T21:45:29Z")
Greetings again, Stretchy-lookers! I’ve run into a problem trying to derive my use case from the following tutorial: Note: I’m not looking to do any User Behavior Insights (UBI), so I’ve trimmed the example down a lo… --- ## [Elasticsearch Alert Handling fields with dots](https://discuss.elastic.co/t/elasticsearch-alert-handling-fields-with-dots/384893)
**Author:** [@Elk\_huh](https://discuss.elastic.co/u/Elk_huh)\ **Replies:** 1\ **Last updated:** [February 3, 2026, 8:05pm UTC](https://discuss.elastic.co/t/elasticsearch-alert-handling-fields-with-dots/384893 "2026-02-03T20:05:11Z")
How do I reference a field with dots/periods in it like the 2 below SNMPv2-SMI::enterprises.99999.1.2 SNMPv2-SMI::enterprises.99999.1.5 {{#context.hits}} Source IP Address: {{\_source}}{{SNMPv2-SMI::enterprises.9999… --- ## [Unclosed session error with Data extraction service](https://discuss.elastic.co/t/unclosed-session-error-with-data-extraction-service/383450)
**Author:** [@SPRINGPEACHVINH](https://discuss.elastic.co/u/SPRINGPEACHVINH)\ **Replies:** 2\ **Last updated:** [February 3, 2026, 11:17am UTC](https://discuss.elastic.co/t/unclosed-session-error-with-data-extraction-service/383450 "2026-02-03T11:17:41Z")
Hi, I’m running a AWS S3 connector (8.17.1) and extraction service (0.3.5) Docker containers. After sync job I see this warning: Unclosed client session client\_session: \ **Author:** [@Siddhant\_Gupta1](https://discuss.elastic.co/u/Siddhant_Gupta1)\ **Replies:** 2\ **Last updated:** [January 14, 2026, 1:03pm UTC](https://discuss.elastic.co/t/lots-of-documents-getting-failed-and-dropped-at-the-logstash-seen-in-logstash-logs/384512 "2026-01-14T13:03:15Z") We use logstash to send the logs to Azure EventHub and then to Azure Data Explorer(ADX). Also, we use Filebeat to send the logs to logstash first. The issue is that some of the logs are not reaching to ADX and its interm… --- ## [Getting API throttled (?) by Elastic, cannot understand why](https://discuss.elastic.co/t/getting-api-throttled-by-elastic-cannot-understand-why/382955)
**Author:** [@maxxer](https://discuss.elastic.co/u/maxxer)\ **Replies:** 5\ **Last updated:** [January 8, 2026, 11:33am UTC](https://discuss.elastic.co/t/getting-api-throttled-by-elastic-cannot-understand-why/382955 "2026-01-08T11:33:06Z")
Hi. We have an Elastic Cloud 7.17.18 managed instance we use for our staging app, along with two others we use for Training and Production. In the staging environment we’re rather frequently unable to connect to our El… --- ## [Version 8.17.3 is unable to record the operation log of '\_settings'](https://discuss.elastic.co/t/version-8-17-3-is-unable-to-record-the-operation-log-of-settings/384226)
**Author:** [@luxiaodui](https://discuss.elastic.co/u/luxiaodui)\ **Replies:** 1\ **Last updated:** [December 26, 2025, 10:01pm UTC](https://discuss.elastic.co/t/version-8-17-3-is-unable-to-record-the-operation-log-of-settings/384226 "2025-12-26T22:01:48Z")
Hi, We are currently using version 8.17.3, but we noticed that when calling the /\_settings API to set the refresh interval, no relevant operations are recorded in the ES logs. In previous versions, the ES logs would nor… --- ## [Refresh\_interval affects search time queries?](https://discuss.elastic.co/t/refresh-interval-affects-search-time-queries/383213)
**Author:** [@nascimento](https://discuss.elastic.co/u/nascimento)\ **Replies:** 3\ **Last updated:** [December 26, 2025, 6:04am UTC](https://discuss.elastic.co/t/refresh-interval-affects-search-time-queries/383213 "2025-12-26T06:04:29Z")
So I need to understand exactly, because I feel like the more I read, the more I don’t understand. If I ingest, let’s say just during nighttime, but I have my refresh\_interval set to 60s, during the day, when normal user… --- ## [Obtain “CVE ID” from Fortinet and correlate with Tenable](https://discuss.elastic.co/t/obtain-cve-id-from-fortinet-and-correlate-with-tenable/384153)
**Author:** [@juancamiloll](https://discuss.elastic.co/u/juancamiloll)\ **Replies:** 0\ **Last updated:** [December 17, 2025, 9:37pm UTC](https://discuss.elastic.co/t/obtain-cve-id-from-fortinet-and-correlate-with-tenable/384153 "2025-12-17T21:37:02Z")
Hello, I am currently receiving logs from Tenable where I can see the vulnerabilities and the associated CVE. At the same time, I am receiving logs from Fortinet where, in the IPS logs, I can see the signatures of the … --- ## [Elasticsearch fails to start after install with custom paths, possible BUG](https://discuss.elastic.co/t/elasticsearch-fails-to-start-after-install-with-custom-paths-possible-bug/384091)
**Author:** [@commandline](https://discuss.elastic.co/u/commandline)\ **Replies:** 1\ **Last updated:** [December 15, 2025, 8:49pm UTC](https://discuss.elastic.co/t/elasticsearch-fails-to-start-after-install-with-custom-paths-possible-bug/384091 "2025-12-15T20:49:19Z")
when installing elasticsearch with custom paths set in /etc/elasticsearch/elasticsearch.yml and no other change this throws a very uninformative and annoying error. systemd-entrypoint\\\[13576\\\]: ERROR: Unable to create l… --- ## [Billing Insane ECU for learning Elastic Serverless instance](https://discuss.elastic.co/t/billing-insane-ecu-for-learning-elastic-serverless-instance/383973)
**Author:** [@Bhaskar\_Reddy](https://discuss.elastic.co/u/Bhaskar_Reddy)\ **Replies:** 21\ **Last updated:** [December 12, 2025, 4:21pm UTC](https://discuss.elastic.co/t/billing-insane-ecu-for-learning-elastic-serverless-instance/383973 "2025-12-12T16:21:10Z")
Details: I recently provisioned an Elastic Serverless instance on GCP (asia-south1) purely for learning and experimentation. My usage has been extremely minimal: Only one record stored in a single index. At most o… --- ## [Regenerate the SSL Certificate that was auto-generated on setup of ElasticSearch](https://discuss.elastic.co/t/regenerate-the-ssl-certificate-that-was-auto-generated-on-setup-of-elasticsearch/377216)
**Author:** [@frdh-samuelw](https://discuss.elastic.co/u/frdh-samuelw)\ **Replies:** 6\ **Last updated:** [November 27, 2025, 4:32pm UTC](https://discuss.elastic.co/t/regenerate-the-ssl-certificate-that-was-auto-generated-on-setup-of-elasticsearch/377216 "2025-11-27T16:32:26Z")
Hello! We have been using Elasticsearch with Zammad on an Ubuntu server for several months, and we recently moved the server to a new IP address. Because Elasticsearch was set up with the former IP address, the auto-gen… --- ## [Local develop project build error](https://discuss.elastic.co/t/local-develop-project-build-error/383736)
**Author:** [@youdation](https://discuss.elastic.co/u/youdation)\ **Replies:** 2\ **Last updated:** [November 27, 2025, 3:46pm UTC](https://discuss.elastic.co/t/local-develop-project-build-error/383736 "2025-11-27T15:46:35Z")
master latest code idea jdk 21 gradle 9.2.0 \`Build file 'D:\\project\\elasticsearch\\rest-api-spec\\build.gradle' line: 5 A problem occurred evaluating project ':rest-api-spec'. Failed to apply plugin class 'org.elasti… --- ## [Java Client: How to set \_source.exclude\_vectors: false when searching an index?](https://discuss.elastic.co/t/java-client-how-to-set-source-exclude-vectors-false-when-searching-an-index/383737)
**Author:** [@baekgwa](https://discuss.elastic.co/u/baekgwa)\ **Replies:** 1\ **Last updated:** [November 27, 2025, 2:31pm UTC](https://discuss.elastic.co/t/java-client-how-to-set-source-exclude-vectors-false-when-searching-an-index/383737 "2025-11-27T14:31:41Z")
Hello everyone, I am currently working with Elasticsearch server version 9.2.0. I would like to retrieve vector fields in search responses by specifying: "\_source": { "exclude\_vectors": false } However, when using… --- ## [Meaning of configuration options ( General purpose or Optimized for Vectors) for azure erverless](https://discuss.elastic.co/t/meaning-of-configuration-options-general-purpose-or-optimized-for-vectors-for-azure-erverless/383654)
**Author:** [@RobinSteil](https://discuss.elastic.co/u/RobinSteil)\ **Replies:** 1\ **Last updated:** [November 27, 2025, 5:49am UTC](https://discuss.elastic.co/t/meaning-of-configuration-options-general-purpose-or-optimized-for-vectors-for-azure-erverless/383654 "2025-11-27T05:49:14Z")
What do the configuration options ( General purpose or Optimized for Vectors) for azure erverless mean. I found this blog but it does not contain any specifics. The Azure docs have nothing aswell (it told me I cant lin… --- ## [Migration Strategy (ES7 → ES8) via Dual‑Write + Snapshot Restore + Selective Merge by updated\_at](https://discuss.elastic.co/t/migration-strategy-es7-es8-via-dual-write-snapshot-restore-selective-merge-by-updated-at/383235)
**Author:** [@Aditya\_Rathi](https://discuss.elastic.co/u/Aditya_Rathi)\ **Replies:** 10\ **Last updated:** [November 5, 2025, 4:41pm UTC](https://discuss.elastic.co/t/migration-strategy-es7-es8-via-dual-write-snapshot-restore-selective-merge-by-updated-at/383235 "2025-11-05T16:41:51Z")
Environment / Versions: Source cluster: Elasticsearch 7.x ( live on production ) Target cluster: Elasticsearch 8.x Data volume: ~1 TB across ~100+ indices Write throughput: ~53 requests/sec, ~1,100 docs/sec (… --- ## [Managing Thousands of Small Vector Indices in Elasticsearch: Potential Issues and Best Practices](https://discuss.elastic.co/t/managing-thousands-of-small-vector-indices-in-elasticsearch-potential-issues-and-best-practices/383172)
**Author:** [@noday](https://discuss.elastic.co/u/noday)\ **Replies:** 1\ **Last updated:** [November 3, 2025, 3:40pm UTC](https://discuss.elastic.co/t/managing-thousands-of-small-vector-indices-in-elasticsearch-potential-issues-and-best-practices/383172 "2025-11-03T15:40:13Z")
If using Elasticsearch as a vector database, and considering that many knowledge bases employ different embedding models, over time this can result in a large number of small indices, for example, tens of thousands. Coul… --- ## [Trained model deployment is not allocated to any nodes](https://discuss.elastic.co/t/trained-model-deployment-is-not-allocated-to-any-nodes/383133)
**Author:** [@Carlos\_Fernando\_Palm](https://discuss.elastic.co/u/Carlos_Fernando_Palm)\ **Replies:** 0\ **Last updated:** [October 31, 2025, 7:16pm UTC](https://discuss.elastic.co/t/trained-model-deployment-is-not-allocated-to-any-nodes/383133 "2025-10-31T19:16:31Z")
Hello everyone! I am part of a project in which we are moving to elastic cloud. We also leverage some of the models for semantic search. When testing we have found several instances of the following error: co.elastic.cl… --- ## [How can I increase React App Search UI to show more than 10,000 records and 100 pages?](https://discuss.elastic.co/t/how-can-i-increase-react-app-search-ui-to-show-more-than-10-000-records-and-100-pages/382418)
**Author:** [@eliezra236](https://discuss.elastic.co/u/eliezra236)\ **Replies:** 1\ **Last updated:** [October 31, 2025, 2:25pm UTC](https://discuss.elastic.co/t/how-can-i-increase-react-app-search-ui-to-show-more-than-10-000-records-and-100-pages/382418 "2025-10-31T14:25:37Z")
Back at 2024 I asked it on Elastic Forums for App Search: https://discuss.elastic.co/t/how-can-i-increase-react-app-search-ui-to-show-more-than-10-000-records-and-100-pages/353335 The answer stated it's a limitation wi… --- ## [Error when combining search and suggest across multiple indices with missing fields (ReactiveElasticsearchClient)](https://discuss.elastic.co/t/error-when-combining-search-and-suggest-across-multiple-indices-with-missing-fields-reactiveelasticsearchclient/382476)
**Author:** [@Adwaith\_Shaju](https://discuss.elastic.co/u/Adwaith_Shaju)\ **Replies:** 1\ **Last updated:** [October 31, 2025, 11:01am UTC](https://discuss.elastic.co/t/error-when-combining-search-and-suggest-across-multiple-indices-with-missing-fields-reactiveelasticsearchclient/382476 "2025-10-31T11:01:03Z")
Description I’m using the ReactiveElasticsearchClient in my Spring Boot application, and I’m trying to perform a single search request that includes both a query and suggestions across multiple indices. Each index has s… --- ## [Snapshot and Restore settings only](https://discuss.elastic.co/t/snapshot-and-restore-settings-only/382930)
**Author:** [@juancamiloll](https://discuss.elastic.co/u/juancamiloll)\ **Replies:** 1\ **Last updated:** [October 26, 2025, 5:53am UTC](https://discuss.elastic.co/t/snapshot-and-restore-settings-only/382930 "2025-10-26T05:53:40Z")
At the moment, I don't have the capacity to take a snapshot of the ingested data or the indexes as such. I'm sure that 100GB isn't enough to back up ingested data. But thinking about disaster recovery, I would like to h… --- ## [Remote transport exception .. nested repository verification exception.. nested io exception could not obtain block](https://discuss.elastic.co/t/remote-transport-exception-nested-repository-verification-exception-nested-io-exception-could-not-obtain-block/382944)
**Author:** [@Swathi\_Rajendran](https://discuss.elastic.co/u/Swathi_Rajendran)\ **Replies:** 1\ **Last updated:** [October 24, 2025, 8:49am UTC](https://discuss.elastic.co/t/remote-transport-exception-nested-repository-verification-exception-nested-io-exception-could-not-obtain-block/382944 "2025-10-24T08:49:54Z")
Issue with Snapshot Remote transport exception .. nested repository verification exception.. nested io exception could not obtain block --- ## [Elastic search(elasticsearch-8.9.2) stopping abruptly](https://discuss.elastic.co/t/elastic-search-elasticsearch-8-9-2-stopping-abruptly/382548)
**Author:** [@Nataraj](https://discuss.elastic.co/u/Nataraj)\ **Replies:** 7\ **Last updated:** [October 9, 2025, 7:20pm UTC](https://discuss.elastic.co/t/elastic-search-elasticsearch-8-9-2-stopping-abruptly/382548 "2025-10-09T19:20:30Z")
we are using elasticsearch-8.9.2 for our application on azure VM with 64GB RAM out of which 32 GB RAM is set for Elastic search. Elastic search keep on failing with below exceptions. \[2025-10-09T12:09:05,309\]\[INFO \]\[o.… --- ## [Where is behavioral analytics?](https://discuss.elastic.co/t/where-is-behavioral-analytics/379203)
**Author:** [@Sami\_Jan](https://discuss.elastic.co/u/Sami_Jan)\ **Replies:** 5\ **Last updated:** [October 2, 2025, 8:19am UTC](https://discuss.elastic.co/t/where-is-behavioral-analytics/379203 "2025-10-02T08:19:25Z")
I am using Elastic cloud and want to follow this tutorial: Get started with Behavioral Analytics | Elasticsearch Guide \[8.18\] | Elastic but i can't find "Search -\> Behavioural Analytics" --- ## [Best practices for preprocessing data and monitoring resource usage in predefined ML jobs (security:host)](https://discuss.elastic.co/t/best-practices-for-preprocessing-data-and-monitoring-resource-usage-in-predefined-ml-jobs-security-host/382324)
**Author:** [@ilyes](https://discuss.elastic.co/u/ilyes)\ **Replies:** 0\ **Last updated:** [September 30, 2025, 1:53pm UTC](https://discuss.elastic.co/t/best-practices-for-preprocessing-data-and-monitoring-resource-usage-in-predefined-ml-jobs-security-host/382324 "2025-09-30T13:53:25Z")
This category relates to the Enterprise Search set of products - App Search, Site Search and Workplace Search. If your question relates to core Elasticsearch functionality, please head over to the Elastic Stack \> Elasti… --- ## [BM25: How not to add up document lengths for each element in array field](https://discuss.elastic.co/t/bm25-how-not-to-add-up-document-lengths-for-each-element-in-array-field/382184)
**Author:** [@jorgenfu](https://discuss.elastic.co/u/jorgenfu)\ **Replies:** 1\ **Last updated:** [September 24, 2025, 12:51pm UTC](https://discuss.elastic.co/t/bm25-how-not-to-add-up-document-lengths-for-each-element-in-array-field/382184 "2025-09-24T12:51:37Z")
One of the fields in our search is an array of person names. We see that when searching for a the name of a single person, documents with several people attached score lower. From what I can tell this is because the docu… --- ## [Service Tokens Replication Across Nodes and Kibana Integration](https://discuss.elastic.co/t/service-tokens-replication-across-nodes-and-kibana-integration/381462)
**Author:** [@Somalic](https://discuss.elastic.co/u/Somalic)\ **Replies:** 3\ **Last updated:** [September 22, 2025, 6:35am UTC](https://discuss.elastic.co/t/service-tokens-replication-across-nodes-and-kibana-integration/381462 "2025-09-22T06:35:22Z")
Hello Elastic Community, I am exploring the use of service tokens for connecting Kibana to a 3-node Elasticsearch cluster with TLS/SSL enabled. I have observed the following behavior and would like some clarification an… [Previous page](https://discuss.elastic.co/c/search/84.md) [Next page](https://discuss.elastic.co/c/search/84.md?page=2)