Re: elk cluster plan with 7000EPS an 100/s search

2014-12-17 Thread joergpra...@gmail.com
Just a note: if you have a machine where 24 cores must handle six times the RAM than another machine, it is not more powerful, it is less powerful. You should really use machines with exact same hardware specs for ease of node deployment, data distribution, maintenance times, and scalability.

Calculate term co-occurrence matrix

2014-12-17 Thread Aeneas Wiener
Hi, Is there an efficient way to calculate a term co-occurrence matrix http://lucene.472066.n3.nabble.com/Calculate-Term-Co-occurrence-Matrix-td1226990.html (i.e. a matrix showing how often a pair of terms of occurred in the same document.) I tried fetching a list of relevant terms using a

node.rack or node.rack_id

2014-12-17 Thread panfei
in the default elasticsearch.yml file I see there is a node.rack configuration parameter: *# A node can have generic attributes associated with it, which can later be used* *# for customized shard allocation filtering, or allocation awareness. An attribute* *# is a simple key value pair, similar

Sum of total term frequency in ONE document

2014-12-17 Thread valerij . vasilcenko
I need sumttf of ONE document in a field. However I can get sumttf of all documents only... I need to be able to access the variable in script like _index['field'].sumttf() of that particular document. This is what I've got so far. Mapping: {document2 : { mappings : {

Rollback ES upgrade

2014-12-17 Thread phani . nadiminti
Hi All, I have elastic search version 1.1.1 i am planning to upgrade it to 1.3.4.let say i upgraded the ES node.how can we rollback es node to 1.1.1 again. or once we upgrade node ES can we roll back to 1.1.1 from 1.3.4 again is it possible? Operating system using is Redhat enterprise

Connecting Linux and Windows Eastic servers

2014-12-17 Thread Gal Artsi
hey guys! i need a little help here. i am trying to create a cluster with 3 linux machines and a few windows machines, but i want the windows machine to do nothing and that all of the work will be on the linux maching. my question is this: can i configure the windows machine to see the linux

Re: Rollback ES upgrade

2014-12-17 Thread David Pilato
No you can’t downgrade. You can restore your backups though if you snapshot before upgrading. -- David Pilato | Technical Advocate | Elasticsearch.com @dadoonet https://twitter.com/dadoonet | @elasticsearchfr https://twitter.com/elasticsearchfr | @scrutmydocs https://twitter.com/scrutmydocs

Re: Connecting Linux and Windows Eastic servers

2014-12-17 Thread David Pilato
Why launching windows ES nodes in that case? May be you want to have client nodes only on windows? If so, change elasticsearch.yml on windows nodes and set node.master: false and node.data: false -- David Pilato | Technical Advocate | Elasticsearch.com @dadoonet https://twitter.com/dadoonet

bool and and/or filter

2014-12-17 Thread Han JU
Hi, We're revising our usage of ElasticSearch. Currently we use and/or filter to glue multiple filters together, but after some reading on the documentation I wonders if it's better to use bool. As far as I understand, bool filters uses a bitmap approach, that is sub-filters returns bitmaps

Re: bool and and/or filter

2014-12-17 Thread David Pilato
You should read this: http://www.elasticsearch.org/blog/all-about-elasticsearch-filter-bitsets/ http://www.elasticsearch.org/blog/all-about-elasticsearch-filter-bitsets/ -- David Pilato | Technical Advocate | Elasticsearch.com @dadoonet https://twitter.com/dadoonet | @elasticsearchfr

Re: $ES_HEAP_SIZE

2014-12-17 Thread 潘飞
在 2013年2月8日星期五UTC+8下午7时11分24秒,Clinton Gormley写道: On Fri, 2013-02-08 at 02:59 -0800, Shawn Ritchie wrote: Shouldn't be problematic as the server has 128GB of RAM. So if i set that ES_HEAP_SIZE to 30GB and run elastic search using top should i see elastic search using up 30GB of ram?

Elasticsearch fills the heap then spends all its time doing garbage collection

2014-12-17 Thread Wilfred Hughes
Hi folks After a few hours/days of uptime, our elasticsearch cluster is spending all its time in GC. We're forced to restart nodes to bring response times back to what they should be. We're using G1GC with a 25 GiB heap on Java 8. In the GC logs, we just see lots of stop-the-world collections:

Re: node.rack or node.rack_id

2014-12-17 Thread Mark Walkom
It doesn't matter, the value after node. is just an arbitrary label. On 17 December 2014 at 10:26, panfei cnwe...@gmail.com wrote: in the default elasticsearch.yml file I see there is a node.rack configuration parameter: *# A node can have generic attributes associated with it, which can

Re: Connecting Linux and Windows Eastic servers

2014-12-17 Thread Gal Artsi
thanks, i'll do so. but i also need to create a lot of windows machines with a local ES installed so each machine will talk to localhost). will my machine be able to talk to linux machine, if their IP's wont be configured there? i want to deploy new windows machines without the need to

Re: Elasticsearch fills the heap then spends all its time doing garbage collection

2014-12-17 Thread Mark Walkom
How many nodes, how much data and in how many indexes? What ES version? On 17 December 2014 at 11:47, Wilfred Hughes yowilf...@gmail.com wrote: Hi folks After a few hours/days of uptime, our elasticsearch cluster is spending all its time in GC. We're forced to restart nodes to bring response

elastic4s scala API and scroll search

2014-12-17 Thread Ramdev Wudali
Hi: I have been using the elastic4s Scala API quite succesfully. However, I just ran into an issue that is puzzling: My Situation: I set up a ElasticClient using a single node from the ES cluster (a Cluster of 2 nodes). I am able to scroll through the search results to get all my search

Curator

2014-12-17 Thread Chetan Dev
Hi, after executing the command curator delete --older-than 3 i got the following response 2014-12-17 18:39:02,088 INFO Job starting... 2014-12-17 18:39:02,104 INFO Deleting indices... 2014-12-17 18:39:02,104 INFO Speficied indices deleted. 2014-12-17 18:39:02,104 INFO

Elasticsearch Indexing slows down after having indexed 1000 Documents

2014-12-17 Thread Michael Hoppe
Hi all, I am testing indexing with elasticsearch 1.3.2 on my Ubuntu-PC with 8GB of RAM and an SSD-Disk. export ES_HEAP_SIZE=5g in elasticsearch.yml I set bootstrap.mlockall: true all other attributes are commented out First i am creating an index with curl -XPUT 'http://localhost:9200/mih'

Re: Curator

2014-12-17 Thread Mark Walkom
Try it with the -n and -D flags and see if that provides more info. On 17 December 2014 at 14:12, Chetan Dev cheten@carwale.com wrote: Hi, after executing the command curator delete --older-than 3 i got the following response 2014-12-17 18:39:02,088 INFO Job starting...

Re: Elasticsearch fills the heap then spends all its time doing garbage collection

2014-12-17 Thread Wilfred Hughes
We're running three nodes (two data and one dataless) and using ES 1.2.4, for storing logstash data. 500 GiB data total, 49 indexes, 5 shards per index. On Wednesday, 17 December 2014 11:39:29 UTC, Mark Walkom wrote: How many nodes, how much data and in how many indexes? What ES version? On

match_phrase_prefix finds not related elements

2014-12-17 Thread Carlos Saura
I have implemented a full search and the matcher that fits better my approach is match_phrase_prefix. elements: title: 'search test' title: 'search test 1' title: 'search test 12' title: 'search test 2' title: 'search test b' title: 'new search test' The weird case is when I search with the

damaged ES cluster after upgrade - serious problem - please help

2014-12-17 Thread Grzegorz K
Hello, I have updated ElasticSearch from ver 0.90.3 to ver 1.3.4 ( OS - Debian Wheezy, deb package version ). This is a cluster configuration, with 3 nodes connected to unicast. Update was done with ElasticSearch switched off. Afters start new verion ElasticSearch cluster health is in 'yellow'

Re: bool and and/or filter

2014-12-17 Thread Han JU
Oh thanks David .. Maybe add some information in the and/or filter documentation page. 在 2014年12月17日星期三UTC+1上午11时10分39秒,David Pilato写道: You should read this: http://www.elasticsearch.org/blog/all-about-elasticsearch-filter-bitsets/ -- *David Pilato* | *Technical Advocate* |

Re: bool and and/or filter

2014-12-17 Thread David Pilato
AFAIK things are subject to change in ES 2.0 and may be only bool will remain. -- David ;-) Twitter : @dadoonet / @elasticsearchfr / @scrutmydocs Le 17 déc. 2014 à 15:45, Han JU ju.han.fe...@gmail.com a écrit : Oh thanks David .. Maybe add some information in the and/or filter documentation

Re: Elasticsearch fills the heap then spends all its time doing garbage collection

2014-12-17 Thread Mark Walkom
Then you're quite possibly at the limits for your heap/nodes. You can try adding more nodes (recommended), increasing your heap to a max of 31GB or removing or closing old indexes. If you are using time based indexes, you can also try disabling bloom filter to get a little bit of memory back from

Re: File Descriptors

2014-12-17 Thread Andrew Selden
On Windows I think you can safely ignore the file descriptors value. On Dec 16, 2014, at 10:06 PM, Chetan Dev cheten@carwale.com wrote: Hi, I am on windows Thanks On Wednesday, December 17, 2014 2:12:16 AM UTC+5:30, Andrew Selden wrote: What OS are you on? My guess would be

Re: Elasticsearch fills the heap then spends all its time doing garbage collection

2014-12-17 Thread Wilfred Hughes
Thanks, that sort of feedback is invaluable. We send JSON representing API calls to logstash, which forwards them to elasticsearch. Users then use Kibana to do queries like what are the most common values passed to this function or how has the time taken for this function varied over time?

Re: damaged ES cluster after upgrade - serious problem - please help

2014-12-17 Thread Peter Portante
On Wednesday, December 17, 2014 9:23:28 AM UTC-5, Grzegorz K wrote: Hello, I have updated ElasticSearch from ver 0.90.3 to ver 1.3.4 ( OS - Debian Wheezy, deb package version ). This is a cluster configuration, with 3 nodes connected to unicast. Update was done with ElasticSearch

Re: Connecting Linux and Windows Eastic servers

2014-12-17 Thread Elvar Böðvarsson
Should be fine if you configure the Windows nodes as master:no and data:no I read discussion a while ago where a user had a mix of windows and linux machines as data nodes. Worked fine, but it was kinda risky, fine for a short time during a migration or upgrade, but dont do it for a long time.

Re: damaged ES cluster after upgrade - serious problem - please help

2014-12-17 Thread Mark Walkom
Did you take a backup? Did you go from 0.90.0 to 1.3.4 directly? On 17 December 2014 at 19:21, Peter Portante peter.a.porta...@gmail.com wrote: On Wednesday, December 17, 2014 9:23:28 AM UTC-5, Grzegorz K wrote: Hello, I have updated ElasticSearch from ver 0.90.3 to ver 1.3.4 ( OS -

unwind aggregation

2014-12-17 Thread Facundo Viale
Hi, I'm working on an application that use the aggregation API for making reports. It would be great if there were something like mongo's unwind operator http://docs.mongodb.org/manual/reference/operator/aggregation/unwind/, but I found nothing about this. Are there any plans to support this

Pruning logs - how to get maxBackupIndex to work?

2014-12-17 Thread Pauline Kelly
Elasticsearch isn't pruning the logs, so I found this input to add to logging.yml. However, this isn't working for me. Is there any other workarounds- configs for this file that will work? file: type: dailyRollingFile file: ${path.logs}/${cluster.name}.log datePattern:

Re: Pruning logs - how to get maxBackupIndex to work?

2014-12-17 Thread joergpra...@gmail.com
Something like this should work. The dailyRollingFile appender does not support maxBackupIndex. appender: . file: type: rollingFile file: ${path.logs}/${cluster.name}.log maxFileSize: 1000 maxBackupIndex: 10 layout: type: pattern conversionPattern:

Re: damaged ES cluster after upgrade - serious problem - please help

2014-12-17 Thread Grzegorz K
On Wednesday, December 17, 2014 7:44:54 PM UTC+1, Mark Walkom wrote: Did you take a backup? Yes I have a backup data catalog Did you go from 0.90.0 to 1.3.4 directly? Yes, upgrade was go from 0.90.3 to 1.3.4 directly On 17 December 2014 at 19:21, Peter Portante

Re: Return Logstash Failed User logons by day and return code.

2014-12-17 Thread Rod Clayton
Dear Sachin, I got your query working with curl. Thanks for your help!!! Rod On Tuesday, December 16, 2014 1:17:56 PM UTC-5, Sachin Divekar wrote: Hi Rod, What you need to use is multi level terms aggregation. General format of such query is as following. { aggs: { agg1: { terms: {

Kibana 4.0 and CORS?

2014-12-17 Thread Kevin Burton
It looks like in Kibana 4.0 that /elasticsearch just forwards requests to your real ES cluster. However, it doesn't have CORS enabled.. which would be super nice. Would be nice if there was a configuration directive for this. -- You received this message because you are subscribed to the

Re: Is ElasticSearch truly scalable for analytics?

2014-12-17 Thread Yifan Wang
node is referring to individual data node. Currently Reduce is only done once on the Client Node, not on each individual data node. I am just wondering how scalable it is for analytics with current architecture. I would like to hear if anyone had any experience. On Tuesday, December 16, 2014

Re: Is ElasticSearch truly scalable for analytics?

2014-12-17 Thread Yifan Wang
How the ranking will work across clusters? On Tuesday, December 16, 2014 1:31:03 PM UTC-5, Elvar Böðvarsson wrote: Elasticsearch supports tribe nodes, so you can combine multiple clusters, you then query the tribe node to access data on all of them. On Monday, December 15, 2014 9:52:45 PM

Re: Is ElasticSearch truly scalable for analytics?

2014-12-17 Thread Yifan Wang
I thought ES only Collect on individual shards, and Reduce on Client Node (master if you call it), nothing is done at the data node level. On Tuesday, December 16, 2014 1:31:30 PM UTC-5, AlexR wrote: ES already doing aggregations on each node. it is not like it is shipping row level query

Re: Curator

2014-12-17 Thread Aaron Mildenstein
I'm presuming you're trying to prune marvel indices. Your command-line would look similar to: curator delete --older-than 3 --prefix .marvel- Do not forget the trailing hyphen on that prefix. The prefix is supposed to be everything preceding the time/datestamp on the index name, and the

Re: ClusterBlockException after closing an index

2014-12-17 Thread Aaron Mildenstein
What you're seeing with that error is that the time window selected in Kibana includes indices which have been marked closed. Elasticsearch is simply passing on the message, I can't query that, it's closed on to Kibana. It's a non-fatal error. You can avoid the error by selecting a time

Re: Failed to delete index using curator

2014-12-17 Thread Aaron Mildenstein
I know this is a late reply, but in case anyone else sees this: Curator timed out its connection after waiting for 30 seconds. You can increase the value with --timeout should something like this happen to you. Truthfully, though, a delete operation that takes longer than even 3 seconds is

Re: Accuracy issue of aggregation results

2014-12-17 Thread Yifan Wang
Just in case anyone is interested, weighted collect (collect more on shards of more documents) actually does not necessarily improve the accuracy if the documents are distributed by default hash algorithm. There is no such correlations. On Tuesday, September 16, 2014 5:09:51 PM UTC-4, Yifan

Re: Decommission of multiple nodes

2014-12-17 Thread Ye D
Hi Nik, I found the that I am not able to do decommissioning over multiple nodes. I can do decommissioning over a single node. These cmds below work perfectly for my ES cluster: cluster.routing.allocation.exclude._name: node-1 cluster.routing.allocation.exclude._name: node-2

Re: Decommission of multiple nodes

2014-12-17 Thread Nikolas Everett
On Wed, Dec 17, 2014 at 6:03 PM, Ye D y...@volarvideo.com wrote: cluster.routing.allocation.exclude._ip: ip1, ip2 I use this one and I'm pretty sure its worked for me in the past. Nik -- You received this message because you are subscribed to the Google Groups elasticsearch group. To

Re: Is ElasticSearch truly scalable for analytics?

2014-12-17 Thread AlexR
if you take a terms aggregation, the heavy lifting of the aggregation is done on each node then aggregated results are combined on the master node. So if you have thousands of nodes and very high cardinality nested aggs the merging part may become a bottleneck but cost of doing actual

scripted fields and type conversion with Kibana4B3

2014-12-17 Thread Jay Swan
I just started playing with scripted fields in Kibana4 Beta3. I'm looking for guidance on how to do type conversions with the new scripted fields feature. Specifically, I have some ES fields that I've typed as ip to (obviously) store IPv4 addresses. I'd line to convert these to strings when

Where to find timelines for estimated release dates?

2014-12-17 Thread Peter Portante
Looking for a possible timeline for the release of 1.5 (anticipating inner_hits support). Is there a place in the community where a timeline is discussed or worked out? Thanks, -peter -- You received this message because you are subscribed to the Google Groups elasticsearch group. To

Elasticsearch index creation / deletion incredibly slow

2014-12-17 Thread Swaraj Banerjee
Hi all, I have a an ES cluster hosted on amazon with ~ 7000 indexes (most of which are sparsely populated 100 docs). Up till today, creating or deleting an index in the cluster took ~3 seconds. All of a sudden, creating or deleting an index is taking ~30 seconds. We have looked through all the

Re: Elasticsearch index creation / deletion incredibly slow

2014-12-17 Thread Nikolas Everett
On Dec 17, 2014 11:20 PM, Swaraj Banerjee swaraj...@gmail.com wrote: Hi all, I have a an ES cluster hosted on amazon with ~ 7000 indexes (most of which are sparsely populated 100 docs). Up till today, creating or deleting an index in the cluster took ~3 seconds. All of a sudden, creating or

Re: scripted fields and type conversion with Kibana4B3

2014-12-17 Thread Jay Swan
Well, I figured out that I can use doc['field_name'].value.toString(), but that returns the integer version of the IP address as a string rather than the dotted decimal version. I see some discussion of this problem in the ES Github issues, but I can't tell if there's a solution. On Wednesday,

Re: Elasticsearch index creation / deletion incredibly slow

2014-12-17 Thread Swaraj Banerjee
Thanks for the reply, To answer your first question: how can I tell what part of the index creation is taking longer? When I make the REST call, it takes ~30 seconds before it is complete. As soon as I receive an HTTP response, however, the new index looks to be allocated and I can add

Error while invoking restful web service

2014-12-17 Thread Vijayakumari B N
Hi, i wanted elasticsearch functionality exposed as restfull webservice. I tried the restful example from below branch. https://github.com/dadoonet/legacy-search/blob/01-direct/src/main/java/fr/pilato/demo/legacysearch/service/PersonService.java#L40 My controller class is below import

Re: Curator

2014-12-17 Thread Chetan Dev
Thanks that worked :) On Thursday, December 18, 2014 2:53:58 AM UTC+5:30, Aaron Mildenstein wrote: I'm presuming you're trying to prune marvel indices. Your command-line would look similar to: curator delete --older-than 3 --prefix .marvel- Do not forget the trailing hyphen on that

Re: Error while invoking restful web service

2014-12-17 Thread David Pilato
Well. There is no elasticsearch code here. What is your incident service is doing here? David Le 18 déc. 2014 à 06:40, Vijayakumari B N vijayakumari...@gmail.com a écrit : Hi, i wanted elasticsearch functionality exposed as restfull webservice. I tried the restful example from below

elasticsearch 1.1 conflict setting routing.allocation.enable:all and disable_allocation:true

2014-12-17 Thread Mano Ksoin
I have elasticsearch 1.1 with four nodes. i had an issue with one of the node and modified settings. when the failed node came up and joined the cluster, i try to enable the allocation. it fails and as well noticed the conflict options. in my case, routing.allocation.enable:all and

Re: Error while invoking restful web service

2014-12-17 Thread Vijayakumari B N
Hi David, My IncidentService invokes the elastic server to populate data. The below POC is returning valid JSON response public String search(String inputText, Integer from, Integer size) throws Exception { QueryBuilder query = QueryBuilders.multiMatchQuery(inputText,keywords,

@uboness how to improve the accuracy of terms aggregation

2014-12-17 Thread yang ming
Hi All we use the terms aggregation to get the top n authors, but the aggregation may not return the top n authors. As the elasticsearch guide said, the aggregated results are not always accurate. Indeed we can increase the shard size to get more accurate results, but if the

Re: Error while invoking restful web service

2014-12-17 Thread David Pilato
Hard to say without seeing the whole code. May be you could share what you are doing on github? Strange thing: incidentService = new IncidentService(); You are using Spring here so I guess you should better inject IncidentService. But, I’m pretty much blind so I can’t really

ElasticSearch Aggregation Result In Asending Order of any Field Value (Instead of aggregation field count order)

2014-12-17 Thread gopal . m
I need to get the list of Field values from the aggreation query. The result is always sorted based on the count. But I want that to be the order of some other Field value. How to get it. -- You received this message because you are subscribed to the Google Groups elasticsearch group. To