# \#none **URL:** https://discuss.elastic.co/tag/none.md?page=1148 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1149 --- ## [Disable specific roles for a node in 7.X+](https://discuss.elastic.co/t/disable-specific-roles-for-a-node-in-7-x/255779)
**Author:** [@Dennis1](https://discuss.elastic.co/u/Dennis1)\ **Replies:** 0\ **Last updated:** [November 18, 2020, 3:15am UTC](https://discuss.elastic.co/t/disable-specific-roles-for-a-node-in-7-x/255779 "2020-11-18T03:15:51Z")
Hello, I noticed that the manner for enabling specific roles for nodes changed between Elasticsearch versions 6.X and 7.X, and am wondering what is the new way to disable specific roles for nodes? In particular, the doc… --- ## [ElasticSearch master and slaves](https://discuss.elastic.co/t/elasticsearch-master-and-slaves/255735)
**Author:** [@Dzyann](https://discuss.elastic.co/u/Dzyann)\ **Replies:** 6\ **Last updated:** [November 18, 2020, 12:58am UTC](https://discuss.elastic.co/t/elasticsearch-master-and-slaves/255735 "2020-11-18T00:58:13Z")
I don't usually work much with Elastic, I have been reading about Elastic Configuration. It is my understanding that Elastic is designed to run clustered, where several nodes, at least 3, should be master. And there are … --- ## [Difference between Ingest Node and Coordinating Node?](https://discuss.elastic.co/t/difference-between-ingest-node-and-coordinating-node/255753)
**Author:** [@Divit\_Sharma](https://discuss.elastic.co/u/Divit_Sharma)\ **Replies:** 7\ **Last updated:** [November 18, 2020, 12:23am UTC](https://discuss.elastic.co/t/difference-between-ingest-node-and-coordinating-node/255753 "2020-11-18T00:23:18Z")
Do Ingest node apply only to indexing from ingest pipelines? And Coordinating Node to all other kinds of indexing? Also client and Coordinating nodes are same right? --- ## [Upgrade ES 5.6.3 to ES 7.8.0: Slower queries. Trying to explain/find out why](https://discuss.elastic.co/t/upgrade-es-5-6-3-to-es-7-8-0-slower-queries-trying-to-explain-find-out-why/255293)
**Author:** [@pvdp](https://discuss.elastic.co/u/pvdp)\ **Replies:** 2\ **Last updated:** [November 17, 2020, 11:52pm UTC](https://discuss.elastic.co/t/upgrade-es-5-6-3-to-es-7-8-0-slower-queries-trying-to-explain-find-out-why/255293 "2020-11-17T23:52:16Z")
We are upgrading from ES 5.6.3 to ES 7.8.0. As part of this, we are doing performance tests to see if there is an improvement or actual degradation in performance. For this we've setup 2 identical clusters in AWS, each… --- ## [ILM Policy for non writing existing index](https://discuss.elastic.co/t/ilm-policy-for-non-writing-existing-index/255217)
**Author:** [@ksaha](https://discuss.elastic.co/u/ksaha)\ **Replies:** 1\ **Last updated:** [November 17, 2020, 11:20pm UTC](https://discuss.elastic.co/t/ilm-policy-for-non-writing-existing-index/255217 "2020-11-17T23:20:39Z")
Hi, I am exploring ILM in Elasticsearch. I am having one question, can we apply ILM policy to non writing existing index? Thanks. --- ## [Kibana is not ready yet](https://discuss.elastic.co/t/kibana-is-not-ready-yet/255326)
**Author:** [@frederiksf](https://discuss.elastic.co/u/frederiksf)\ **Replies:** 1\ **Last updated:** [November 17, 2020, 11:18pm UTC](https://discuss.elastic.co/t/kibana-is-not-ready-yet/255326 "2020-11-17T23:18:58Z")
We faced this error for at least 24 hours. We think we had no resource issues but we are 100 % sure. I checked out these metrics; root@-0:/# curl https://vpc-es-eu-central-1-prd-xxx.eu-central-1.es.amazonaws.com/\_nodes/… --- ## [Elasticsearch v 7.8.0 issue with disk quota](https://discuss.elastic.co/t/elasticsearch-v-7-8-0-issue-with-disk-quota/255334)
**Author:** [@nipul\_sawant](https://discuss.elastic.co/u/nipul_sawant)\ **Replies:** 2\ **Last updated:** [November 17, 2020, 11:18pm UTC](https://discuss.elastic.co/t/elasticsearch-v-7-8-0-issue-with-disk-quota/255334 "2020-11-17T23:18:27Z")
Elasticsearch v 7.8.0 stop working after hits reached 25GB. Any suggestions ? --- ## [DSL Aggregations: How to get results, even if one of the aggs field is not present?](https://discuss.elastic.co/t/dsl-aggregations-how-to-get-results-even-if-one-of-the-aggs-field-is-not-present/255360)
**Author:** [@kelk](https://discuss.elastic.co/u/kelk)\ **Replies:** 1\ **Last updated:** [November 17, 2020, 11:17pm UTC](https://discuss.elastic.co/t/dsl-aggregations-how-to-get-results-even-if-one-of-the-aggs-field-is-not-present/255360 "2020-11-17T23:17:15Z")
We have to do aggregations for host.os.name, host.name, host.ip 99% data has host.os.name 95% has host.name 25% has host.ip How to ensure I get all the results, even if the field is not present? So i'm looking for … --- ## [Compare two fields and achieve a left outer comparison](https://discuss.elastic.co/t/compare-two-fields-and-achieve-a-left-outer-comparison/255377)
**Author:** [@kelk](https://discuss.elastic.co/u/kelk)\ **Replies:** 1\ **Last updated:** [November 17, 2020, 11:16pm UTC](https://discuss.elastic.co/t/compare-two-fields-and-achieve-a-left-outer-comparison/255377 "2020-11-17T23:16:11Z")
I've following data { "index" : { "\_index" : "host\_compare", "\_id" : "1" } } { "host\_name" : "myhost2" , "host\_count" : "10", "@timestamp": "2020-11-12T02:00:00Z" } { "index" : { "\_index" : "host\_compare", "\_id" : "3" }… --- ## [Multiple pipelines in Logstash](https://discuss.elastic.co/t/multiple-pipelines-in-logstash/255418)
**Author:** [@Cosmin\_Ciobanu1](https://discuss.elastic.co/u/Cosmin_Ciobanu1)\ **Replies:** 1\ **Last updated:** [November 17, 2020, 11:13pm UTC](https://discuss.elastic.co/t/multiple-pipelines-in-logstash/255418 "2020-11-17T23:13:25Z")
Hi! I'm trying to make multiple pipelines and I'm getting those errors every time: \[2020-11-15T00:33:36,799\]\[WARN \]\[org.logstash.execution.ShutdownWatcherExt\] {"inflight\_count"=\>0, "stalling\_threads\_info"=\>{"other"=\>\[{… --- ## [org.elasticsearch.index.mapper.MapperParsingException after a pipeline](https://discuss.elastic.co/t/org-elasticsearch-index-mapper-mapperparsingexception-after-a-pipeline/255484)
**Author:** [@samsalvatico](https://discuss.elastic.co/u/samsalvatico)\ **Replies:** 1\ **Last updated:** [November 17, 2020, 11:10pm UTC](https://discuss.elastic.co/t/org-elasticsearch-index-mapper-mapperparsingexception-after-a-pipeline/255484 "2020-11-17T23:10:46Z")
Hi, this is my scenario: I receive messages by Fluentbit through an elastic ingestion pipeline. This is my ingestion pipeline: { "jsonize\_account\_backend":{ "processors":\[ { "gr… --- ## [Annotate a doc thru Kibana](https://discuss.elastic.co/t/annotate-a-doc-thru-kibana/255561)
**Author:** [@Narendra\_Jain](https://discuss.elastic.co/u/Narendra_Jain)\ **Replies:** 1\ **Last updated:** [November 17, 2020, 10:51pm UTC](https://discuss.elastic.co/t/annotate-a-doc-thru-kibana/255561 "2020-11-17T22:51:05Z")
Hi, Is there a way a Kibana user can annotate a document, eg. a doc show some random value which operation team reason and annotate the doc so next person understand the behavior same for exception log --- ## [Is Storage Size under Index Management includes replicated data storage size as well?](https://discuss.elastic.co/t/is-storage-size-under-index-management-includes-replicated-data-storage-size-as-well/255662)
**Author:** [@KunwarAkanksha](https://discuss.elastic.co/u/KunwarAkanksha)\ **Replies:** 1\ **Last updated:** [November 17, 2020, 10:45pm UTC](https://discuss.elastic.co/t/is-storage-size-under-index-management-includes-replicated-data-storage-size-as-well/255662 "2020-11-17T22:45:57Z")
I am wondering if the storage size under Index Management is calculated for data and replicated data both. Example if my replication Factor is 2 , then do storage size tells the ( data storage + 2 \* replicated data stor… --- ## [Replacing Elasticsearch Node](https://discuss.elastic.co/t/replacing-elasticsearch-node/255654)
**Author:** [@junydania](https://discuss.elastic.co/u/junydania)\ **Replies:** 1\ **Last updated:** [November 17, 2020, 10:45pm UTC](https://discuss.elastic.co/t/replacing-elasticsearch-node/255654 "2020-11-17T22:45:17Z")
Hello, I have a 3 node elasticsearch cluster running on version 7.6.2 in a container environment. Three nodes used with each container running on unique host machines. Each node in the cluster is both a master and data… --- ## [Assistance with fields and filtering on Elk query](https://discuss.elastic.co/t/assistance-with-fields-and-filtering-on-elk-query/255695)
**Author:** [@douglasnew](https://discuss.elastic.co/u/douglasnew)\ **Replies:** 1\ **Last updated:** [November 17, 2020, 10:39pm UTC](https://discuss.elastic.co/t/assistance-with-fields-and-filtering-on-elk-query/255695 "2020-11-17T22:39:11Z")
HI all. Can someone assist. I am trying to add an additional field to this query but it does not seem to work as expected. I am trying to simply ass the field "message" and filter based on a matched string. Here is my … --- ## [Logstash as daemon won't start](https://discuss.elastic.co/t/logstash-as-daemon-wont-start/255716)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 1\ **Last updated:** [November 17, 2020, 10:05pm UTC](https://discuss.elastic.co/t/logstash-as-daemon-wont-start/255716 "2020-11-17T22:05:25Z")
I just upgraded system to 7.10.0 this is test system. and logstash daemon won't start. here is result of journalctl -xe start-up result is done. Nov 17 08:28:25 elkdev01 logstash\[13918\]: Using bundled JDK: /usr/sha… --- ## [Sort Discover Search Table 7.10](https://discuss.elastic.co/t/sort-discover-search-table-7-10/255708)
**Author:** [@weand](https://discuss.elastic.co/u/weand)\ **Replies:** 2\ **Last updated:** [November 17, 2020, 8:36pm UTC](https://discuss.elastic.co/t/sort-discover-search-table-7-10/255708 "2020-11-17T20:36:28Z")
Hi, it seems sorting in the Discover Search Table does not work in anymore in recent Releases. Tested with 7.9 and 7.10. Is that a known bug ? Cheers Andreas --- ## [Elasticsearch heap dump phd](https://discuss.elastic.co/t/elasticsearch-heap-dump-phd/255572)
**Author:** [@perezs](https://discuss.elastic.co/u/perezs)\ **Replies:** 3\ **Last updated:** [November 17, 2020, 8:12pm UTC](https://discuss.elastic.co/t/elasticsearch-heap-dump-phd/255572 "2020-11-17T20:12:33Z")
Does Elasticsearch have plugin's to analyze Java heap dumps phd format? --- ## [Accessing nested fields in ruby filter for math](https://discuss.elastic.co/t/accessing-nested-fields-in-ruby-filter-for-math/255740)
**Author:** [@Andrew22](https://discuss.elastic.co/u/Andrew22)\ **Replies:** 4\ **Last updated:** [November 17, 2020, 7:30pm UTC](https://discuss.elastic.co/t/accessing-nested-fields-in-ruby-filter-for-math/255740 "2020-11-17T19:30:54Z")
Hello, I am having issues with this bit of code where I am trying to add 3 nested fields together and place them in a new nested field. here is my bit of ruby code ruby { code =\> "event.set('\[device\]\[disconnect\]\[dura… --- ## [Elastisearch daterange filter - days of week](https://discuss.elastic.co/t/elastisearch-daterange-filter-days-of-week/255750)
**Author:** [@shifra](https://discuss.elastic.co/u/shifra)\ **Replies:** 0\ **Last updated:** [November 17, 2020, 6:51pm UTC](https://discuss.elastic.co/t/elastisearch-daterange-filter-days-of-week/255750 "2020-11-17T18:51:28Z")
Hi! This is my first time on this forum, I hope my question is clear. Please let me know if I should add any details. My goal: Implement a filter on days of week and time I'm trying to implement a filter for open hour… --- ## [Sort array before concatenated fingerprint hash?](https://discuss.elastic.co/t/sort-array-before-concatenated-fingerprint-hash/255602)
**Author:** [@sliddjur](https://discuss.elastic.co/u/sliddjur)\ **Replies:** 5\ **Last updated:** [November 17, 2020, 6:56pm UTC](https://discuss.elastic.co/t/sort-array-before-concatenated-fingerprint-hash/255602 "2020-11-17T18:56:02Z")
I have src\_ip and dst\_ip fields. I have copied both those values to "\[fw\]\[talkers\]" field to produce this: "fw": { "talkers": \[ "172.16.216.118", "172.23.253.22" \] Now I run fingerprint on this value to pr… --- ## [EnterpriseSearch : "Could not perform access check to Enterprise Search"](https://discuss.elastic.co/t/enterprisesearch-could-not-perform-access-check-to-enterprise-search/255548)
**Author:** [@flavienbwk](https://discuss.elastic.co/u/flavienbwk)\ **Replies:** 2\ **Last updated:** [November 17, 2020, 6:46pm UTC](https://discuss.elastic.co/t/enterprisesearch-could-not-perform-access-check-to-enterprise-search/255548 "2020-11-17T18:46:13Z")
Hi, I am trying to bind my Enterprise Search instance to my Kibana with SSL. My Enterprise Search instance works well alone, but Kibana refuses to connect to it : {"type":"log","@timestamp":"2020-11-16T13:44:55Z","ta… --- ## [Python3 Large Query Cardinality & Query return different results](https://discuss.elastic.co/t/python3-large-query-cardinality-query-return-different-results/255717)
**Author:** [@stcdarrell](https://discuss.elastic.co/u/stcdarrell)\ **Replies:** 4\ **Last updated:** [November 17, 2020, 6:45pm UTC](https://discuss.elastic.co/t/python3-large-query-cardinality-query-return-different-results/255717 "2020-11-17T18:45:44Z")
hi, i'm using python3 and the elasticsearch library to query some very large ES indexes. I've been following this blog post as a reference: I'm getting some results i dont understand, the Cardnality returns a certa… --- ## [FVH Highlighter Not Being Used By Default](https://discuss.elastic.co/t/fvh-highlighter-not-being-used-by-default/255743)
**Author:** [@jdouty](https://discuss.elastic.co/u/jdouty)\ **Replies:** 0\ **Last updated:** [November 17, 2020, 6:12pm UTC](https://discuss.elastic.co/t/fvh-highlighter-not-being-used-by-default/255743 "2020-11-17T18:12:16Z")
Hi everyone! I've been playing around with the FVH and noticed the highlighter isn't behaving as it's described in the term vector documention. Down at the bottom of that page it shows that you can use the default high… --- ## [Trouble Mutating](https://discuss.elastic.co/t/trouble-mutating/255598)
**Author:** [@stevezemlicka](https://discuss.elastic.co/u/stevezemlicka)\ **Replies:** 6\ **Last updated:** [November 17, 2020, 5:36pm UTC](https://discuss.elastic.co/t/trouble-mutating/255598 "2020-11-17T17:36:19Z")
I am having trouble performing a mutate. I thought I had it working with a more simplified version of this config but cannot seem to get it going in this new one (though everything else seems to be working much better). … --- ## [Connect both ES 6.7 & ES 7.x to the same Kibana host](https://discuss.elastic.co/t/connect-both-es-6-7-es-7-x-to-the-same-kibana-host/255649)
**Author:** [@Minh\_Ti\_n\_Tr\_n](https://discuss.elastic.co/u/Minh_Ti_n_Tr_n)\ **Replies:** 4\ **Last updated:** [November 17, 2020, 3:46pm UTC](https://discuss.elastic.co/t/connect-both-es-6-7-es-7-x-to-the-same-kibana-host/255649 "2020-11-17T15:46:52Z")
Hi mates, Now I am running old Security Onion 16 (ElasticStack v6.7) and want to upgrade to S.O2.3 but I see the incident response process is much more complicated so I decide to build a new ES + Kibana v7.10, then the … --- ## [Prune filter plugin - How whitelist a nested field?](https://discuss.elastic.co/t/prune-filter-plugin-how-whitelist-a-nested-field/255720)
**Author:** [@21908](https://discuss.elastic.co/u/21908)\ **Replies:** 3\ **Last updated:** [November 17, 2020, 3:16pm UTC](https://discuss.elastic.co/t/prune-filter-plugin-how-whitelist-a-nested-field/255720 "2020-11-17T15:16:14Z")
Documentation at has this example and it mentions that it would allow only "msg" through. filter { prune { whitelist\_names =\> \["^msg$"\] } } If I have a single record that has "source" … --- ## [Full Index Rebuild with 5M documents on Elastic search 7.6 takes 1 week to complete](https://discuss.elastic.co/t/full-index-rebuild-with-5m-documents-on-elastic-search-7-6-takes-1-week-to-complete/255624)
**Author:** [@nimohara](https://discuss.elastic.co/u/nimohara)\ **Replies:** 14\ **Last updated:** [November 17, 2020, 2:46pm UTC](https://discuss.elastic.co/t/full-index-rebuild-with-5m-documents-on-elastic-search-7-6-takes-1-week-to-complete/255624 "2020-11-17T14:46:50Z")
Hey There Hope all are doing well Please have a look in to the below issue and provide your valuable suggestion on this. Currently Elastic 7.6 is running on cluster with 3 nodes and it's having 5M records in it. Whil… --- ## [Field analyzer for matching concepts and names](https://discuss.elastic.co/t/field-analyzer-for-matching-concepts-and-names/254521)
**Author:** [@jporzelt](https://discuss.elastic.co/u/jporzelt)\ **Replies:** 3\ **Last updated:** [November 17, 2020, 2:38pm UTC](https://discuss.elastic.co/t/field-analyzer-for-matching-concepts-and-names/254521 "2020-11-17T14:38:12Z")
Dear Elasticsearch community, dear Elastic team, I have a question about field analyzers that I would like to discuss here. In our index we have fields (field cities in the below example) that store known concepts or n… --- ## [Mutate rename filter not working on nested fields](https://discuss.elastic.co/t/mutate-rename-filter-not-working-on-nested-fields/255713)
**Author:** [@blastodorm](https://discuss.elastic.co/u/blastodorm)\ **Replies:** 2\ **Last updated:** [November 17, 2020, 2:33pm UTC](https://discuss.elastic.co/t/mutate-rename-filter-not-working-on-nested-fields/255713 "2020-11-17T14:33:03Z")
I'm trying to rename a field to work with my data. The field I'm attempting to rename is nested. My config: filter { mutate {rename =\> { "\[message\]\[context\]\[payload\]\[geolocation\]\[latitude\]" =\> "\[message\]\[context\]\[payl… [Previous page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1147) [Next page](https://discuss.elastic.co/tag/none.md?no_tags=true&page=1149)