# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=1 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 2 --- ## [Best practices for indexing and mapping Brazilian postal code (CEP) datasets in Elasticsearch](https://discuss.elastic.co/t/best-practices-for-indexing-and-mapping-brazilian-postal-code-cep-datasets-in-elasticsearch/391195)
**Author:** [@EmmettSinclair](https://discuss.elastic.co/u/EmmettSinclair)\ **Replies:** 0\ **Last updated:** [October 26, 2026, 1:27pm UTC](https://discuss.elastic.co/t/best-practices-for-indexing-and-mapping-brazilian-postal-code-cep-datasets-in-elasticsearch/391195 "2026-10-26T13:27:17Z")
Hi Elastic Community, We are designing an Elasticsearch index mapping for Brazilian postal code (CEP) data to support fast address lookups and geo-location auto-complete features. During development, we parse 8-digit C… --- ## [Handling of eMudhra CA compromise (CVE-2026-91403) local Elastic](https://discuss.elastic.co/t/handling-of-emudhra-ca-compromise-cve-2026-91403-local-elastic/391128)
**Author:** [@john90](https://discuss.elastic.co/u/john90)\ **Replies:** 2\ **Last updated:** [October 26, 2026, 10:05am UTC](https://discuss.elastic.co/t/handling-of-emudhra-ca-compromise-cve-2026-91403-local-elastic/391128 "2026-10-26T10:05:05Z")
Hi, can find any thread about how users are handling this vulnerability in Java (that is delivered with Elasticsearch tar file distribution). Is it a non-issue for plain Elasticsearch service? We use v8, vulnerable cer… --- ## [Elastic-otel-collector 9.5.5 (AutoOps ES collectors): monotonic memory growth ~100 MB/day per collector, fleet ~1 GB/day](https://discuss.elastic.co/t/elastic-otel-collector-9-5-5-autoops-es-collectors-monotonic-memory-growth-100-mb-day-per-collector-fleet-1-gb-day/391165)
**Author:** [@tmu-sprd](https://discuss.elastic.co/u/tmu-sprd)\ **Replies:** 1\ **Last updated:** [October 26, 2026, 8:01am UTC](https://discuss.elastic.co/t/elastic-otel-collector-9-5-5-autoops-es-collectors-monotonic-memory-growth-100-mb-day-per-collector-fleet-1-gb-day/391165 "2026-10-26T08:01:46Z")
We run 10 AutoOps OTel collectors (docker.elastic.co/elastic-agent/elastic-otel-collector-wolfi:9.5.5, the recommended autoops\_es\_ssl.yml config, metricbeatreceiver with autoops\_es: cat\_shards/node\_stats/tasks\_management … --- ## [External Inference using google vertex ai and gemini-3.6-flash error](https://discuss.elastic.co/t/external-inference-using-google-vertex-ai-and-gemini-3-6-flash-error/390296)
**Author:** [@tallakh](https://discuss.elastic.co/u/tallakh)\ **Replies:** 3\ **Last updated:** [October 21, 2026, 8:11pm UTC](https://discuss.elastic.co/t/external-inference-using-google-vertex-ai-and-gemini-3-6-flash-error/390296 "2026-10-21T20:11:54Z")
Hi! I'm trying to set up an external inference using our Google vertex ai account and the model gemini-3.6-flash. The inference creation works, but trying to use it as a chat-completion fails with an error: Error: Rec… --- ## [Access forbidden to download filebeat deb package](https://discuss.elastic.co/t/access-forbidden-to-download-filebeat-deb-package/391055)
**Author:** [@helioxensam](https://discuss.elastic.co/u/helioxensam)\ **Replies:** 5\ **Last updated:** [October 21, 2026, 2:04pm UTC](https://discuss.elastic.co/t/access-forbidden-to-download-filebeat-deb-package/391055 "2026-10-21T14:04:00Z")
We use a nordic provider for cloud services, and one of our VMs is getting blocked. curl https://artifacts.elastic.co/packages/8.x/apt/dists/stable/InRelease 403 Forbidden Error: Forbidden Your client does not have… --- ## [Logstash packages missing in YUM repository](https://discuss.elastic.co/t/logstash-packages-missing-in-yum-repository/391010)
**Author:** [@Borut\_Lape](https://discuss.elastic.co/u/Borut_Lape)\ **Replies:** 10\ **Last updated:** [October 21, 2026, 4:46am UTC](https://discuss.elastic.co/t/logstash-packages-missing-in-yum-repository/391010 "2026-10-21T04:46:28Z")
Hi, last week we have installed logstash on 2 servers, following the official instructions on Installing Logstash | Logstash. In the last 2 days we are trying to perform the same but the logstash package is missing in … --- ## [Which node roles actually consume our Enterprise ERU license?](https://discuss.elastic.co/t/which-node-roles-actually-consume-our-enterprise-eru-license/391080)
**Author:** [@kkumar123](https://discuss.elastic.co/u/kkumar123)\ **Replies:** 4\ **Last updated:** [October 20, 2026, 3:08pm UTC](https://discuss.elastic.co/t/which-node-roles-actually-consume-our-enterprise-eru-license/391080 "2026-10-20T15:08:29Z")
Hi everyone, We are currently running on an Enterprise ERU (capacity-based) license IN SELF HOSTED ON PREMISES CLUSTERSl. Based on my understanding, Master, Data, and Machine Learning (ML) nodes are the primary nodes … --- ## [Investigate high cpu/rogue task on certain shard/node](https://discuss.elastic.co/t/investigate-high-cpu-rogue-task-on-certain-shard-node/390956)
**Author:** [@dna01](https://discuss.elastic.co/u/dna01)\ **Replies:** 9\ **Last updated:** [October 20, 2026, 11:36am UTC](https://discuss.elastic.co/t/investigate-high-cpu-rogue-task-on-certain-shard-node/390956 "2026-10-20T11:36:31Z")
for some reason, some nodes/shards doing more "stuff" than others and thus consuming more cpu. here is setup ES deployed in kubernetes with 40+ data nodes (with different specs) ES version 8.10.4 the nodes are partiti… --- ## [What decides Kibana Visualization time\_zone?](https://discuss.elastic.co/t/what-decides-kibana-visualization-time-zone/391075)
**Author:** [@nilsen](https://discuss.elastic.co/u/nilsen)\ **Replies:** 0\ **Last updated:** [October 20, 2026, 9:22am UTC](https://discuss.elastic.co/t/what-decides-kibana-visualization-time-zone/391075 "2026-10-20T09:22:56Z")
My Kibana Dashboard Table Visualization defaults the date\_histogram.time\_zone to UTC, and I'm not sure what decides this. I need it to be UTC+2 or Europe/Oslo. ▶ Json Request Example My other spaces that uses ECS default… --- ## [Filebeat 9.5.3 built with Go 1.26.7 is reported as containing vulnerable Go stdlib 1.19.9 and golang\_org/x/net 0.7.0](https://discuss.elastic.co/t/filebeat-9-5-3-built-with-go-1-26-7-is-reported-as-containing-vulnerable-go-stdlib-1-19-9-and-golang-org-x-net-0-7-0/391053)
**Author:** [@Sam2nd](https://discuss.elastic.co/u/Sam2nd)\ **Replies:** 0\ **Last updated:** [October 19, 2026, 7:20am UTC](https://discuss.elastic.co/t/filebeat-9-5-3-built-with-go-1-26-7-is-reported-as-containing-vulnerable-go-stdlib-1-19-9-and-golang-org-x-net-0-7-0/391053 "2026-10-19T07:20:16Z")
Hi Team, Our vulnerability scanner reports multiple CVEs against the Filebeat 9.5.3 binary, including: CVE-2023-45288 CVE-2023-39325 CVE-2026-39821 CVE-2026-33814 CVE-2026-46600 The scanner identifies the following d… --- ## [Elasticsearch Search Results Become Incomplete When My Website Applies Multiple Filters to the Same Query](https://discuss.elastic.co/t/elasticsearch-search-results-become-incomplete-when-my-website-applies-multiple-filters-to-the-same-query/390994)
**Author:** [@joeroot](https://discuss.elastic.co/u/joeroot)\ **Replies:** 2\ **Last updated:** [October 18, 2026, 9:13pm UTC](https://discuss.elastic.co/t/elasticsearch-search-results-become-incomplete-when-my-website-applies-multiple-filters-to-the-same-query/390994 "2026-10-18T21:13:31Z")
Hi All, I am having a problem with the search functionality on my website, which uses Elasticsearch to retrieve records based on visitors' search terms and selected filters. The basic search works correctly when a user … --- ## [Agent Policy Checkin Storm after activating version specifig policy](https://discuss.elastic.co/t/agent-policy-checkin-storm-after-activating-version-specifig-policy/391016)
**Author:** [@kgorskowski](https://discuss.elastic.co/u/kgorskowski)\ **Replies:** 1\ **Last updated:** [October 16, 2026, 12:24pm UTC](https://discuss.elastic.co/t/agent-policy-checkin-storm-after-activating-version-specifig-policy/391016 "2026-10-16T12:24:35Z")
Hi community. I have a question about the behavior of Elastic Agents that are/were stuck in a policy acknowledgement storm/loop against a fleet server. PSA I am a system/platform engineer not an elastic specialist but … --- ## [Elasticsearch Netflow Top-N dashboard showing data in bytes instead of MB.GB etc](https://discuss.elastic.co/t/elasticsearch-netflow-top-n-dashboard-showing-data-in-bytes-instead-of-mb-gb-etc/390772)
**Author:** [@ahsan0331](https://discuss.elastic.co/u/ahsan0331)\ **Replies:** 4\ **Last updated:** [October 14, 2026, 7:24am UTC](https://discuss.elastic.co/t/elasticsearch-netflow-top-n-dashboard-showing-data-in-bytes-instead-of-mb-gb-etc/390772 "2026-10-14T07:24:01Z")
Hi i have upgraded "or so to speak" from filebeat netflow module to elastic netflow fleet based. And while i see its dashboards are somewhat good compared to the filebeat ones. but one dashboard that i used a lot in fil… --- ## [Is it useless to have a hot, warm, and cold nodes running on the same server?](https://discuss.elastic.co/t/is-it-useless-to-have-a-hot-warm-and-cold-nodes-running-on-the-same-server/390977)
**Author:** [@YousefNein](https://discuss.elastic.co/u/YousefNein)\ **Replies:** 1\ **Last updated:** [October 13, 2026, 2:54pm UTC](https://discuss.elastic.co/t/is-it-useless-to-have-a-hot-warm-and-cold-nodes-running-on-the-same-server/390977 "2026-10-13T14:54:10Z")
Like the title suggests. I saw that in the ILM policy, it says that it's recommended to move the data to warm nodes. So I made a Docker container dedicated to a warm node to move my data into, but the hot data and th… --- ## [Space-aware fleet settings (server, proxy, output)](https://discuss.elastic.co/t/space-aware-fleet-settings-server-proxy-output/390899)
**Author:** [@jameswiggins](https://discuss.elastic.co/u/jameswiggins)\ **Replies:** 1\ **Last updated:** [October 8, 2026, 3:26pm UTC](https://discuss.elastic.co/t/space-aware-fleet-settings-server-proxy-output/390899 "2026-10-08T15:26:43Z")
In the UI and in the API you can create settings for fleet (proxy, server, outputs) in a specific space in the UI by navigating to a specific space with the API by using /s/{sapce\_id}/api/fleet/{resource} But that res… --- ## [Architecture Desing CCR](https://discuss.elastic.co/t/architecture-desing-ccr/390890)
**Author:** [@chandrakt](https://discuss.elastic.co/u/chandrakt)\ **Replies:** 6\ **Last updated:** [October 8, 2026, 3:12pm UTC](https://discuss.elastic.co/t/architecture-desing-ccr/390890 "2026-10-08T15:12:37Z")
Dear Team, We are planning to implement an on-premises Elastic SIEM/EDR solution for an OT/IT security environment comprising approximately 60 endpoints and an estimated daily log ingestion volume of 50 GB/day. Before … --- ## [The impact of /etc/timezone on the ES cluster](https://discuss.elastic.co/t/the-impact-of-etc-timezone-on-the-es-cluster/390756)
**Author:** [@mloine](https://discuss.elastic.co/u/mloine)\ **Replies:** 2\ **Last updated:** [October 8, 2026, 9:44am UTC](https://discuss.elastic.co/t/the-impact-of-etc-timezone-on-the-es-cluster/390756 "2026-10-08T09:44:56Z")
I'm facing a situation now: There are two batches of nodes in an ES cluster. One batch loads 'user.timezone=Asia/Bangkok' from etc/timezone at startup, while the other batch loads 'user.timezone=America/Bogota'. Even tho… --- ## [Elasticsearch does not remove shards on closing due to locking issues](https://discuss.elastic.co/t/elasticsearch-does-not-remove-shards-on-closing-due-to-locking-issues/361321)
**Author:** [@spinscale](https://discuss.elastic.co/u/spinscale)\ **Replies:** 7\ **Last updated:** [October 8, 2026, 9:38am UTC](https://discuss.elastic.co/t/elasticsearch-does-not-remove-shards-on-closing-due-to-locking-issues/361321 "2026-10-08T09:38:37Z")
Hey, we have an issue with out 7.18.18 cluster. It seems that closing a shard is throwing issues. This happens with several data nodes, so it's not a single glitch. This has never happened with out previous 7.12 version… --- ## [Elastic siem and EDR architecture validation](https://discuss.elastic.co/t/elastic-siem-and-edr-architecture-validation/390884)
**Author:** [@chandrakt](https://discuss.elastic.co/u/chandrakt)\ **Replies:** 3\ **Last updated:** [October 7, 2026, 11:29am UTC](https://discuss.elastic.co/t/elastic-siem-and-edr-architecture-validation/390884 "2026-10-07T11:29:44Z")
please let me know isthis correct diagram for 50gb par day dat ingestion and i need DC and DR both --- ## [Upgrade adding new nodes of newer version instead of rolling upgrade](https://discuss.elastic.co/t/upgrade-adding-new-nodes-of-newer-version-instead-of-rolling-upgrade/390839)
**Author:** [@carlosmg1](https://discuss.elastic.co/u/carlosmg1)\ **Replies:** 6\ **Last updated:** [October 6, 2026, 11:04am UTC](https://discuss.elastic.co/t/upgrade-adding-new-nodes-of-newer-version-instead-of-rolling-upgrade/390839 "2026-10-06T11:04:28Z")
Hi, We've done plenty of upgrades of newer version in a cluster with around 40 nodes, upgrading 8.x version. For an upgrade from the 8.x to the 9.x we're analyzing how viable is to add new nodes during the upgrade of 9.… --- ## [Kibana 9.5.4 / Node 24 V8Worker triggers Linux kernel NULL pointer dereference and RCU stall](https://discuss.elastic.co/t/kibana-9-5-4-node-24-v8worker-triggers-linux-kernel-null-pointer-dereference-and-rcu-stall/390830)
**Author:** [@Beta](https://discuss.elastic.co/u/Beta)\ **Replies:** 1\ **Last updated:** [October 5, 2026, 1:28pm UTC](https://discuss.elastic.co/t/kibana-9-5-4-node-24-v8worker-triggers-linux-kernel-null-pointer-dereference-and-rcu-stall/390830 "2026-10-05T13:28:48Z")
I'm experiencing a recurring kernel crash on a Debian 13 VM running Kibana 9.5.4 (I have had this issue for a while now and have upgraded Kibana and the Linux kernel multiple times). The crash occurs in the Linux kernel … --- ## [Kibana 9 - Detail pane is a bad replacement for Expandable row for my use cases](https://discuss.elastic.co/t/kibana-9-detail-pane-is-a-bad-replacement-for-expandable-row-for-my-use-cases/390555)
**Author:** [@poifir](https://discuss.elastic.co/u/poifir)\ **Replies:** 3\ **Last updated:** [October 5, 2026, 8:57am UTC](https://discuss.elastic.co/t/kibana-9-detail-pane-is-a-bad-replacement-for-expandable-row-for-my-use-cases/390555 "2026-10-05T08:57:00Z")
In Kibana 8 we continued to use the "old" UI that offered to expand each row individually to show it's detail values. This works good as the full width of the windows is also available to the detailed attributes and so … --- ## [Elasticsearch Sometimes Returns Incomplete Search Results From My Website Even Though the Documents Are Indexed](https://discuss.elastic.co/t/elasticsearch-sometimes-returns-incomplete-search-results-from-my-website-even-though-the-documents-are-indexed/390803)
**Author:** [@joeroot](https://discuss.elastic.co/u/joeroot)\ **Replies:** 3\ **Last updated:** [October 5, 2026, 8:16am UTC](https://discuss.elastic.co/t/elasticsearch-sometimes-returns-incomplete-search-results-from-my-website-even-though-the-documents-are-indexed/390803 "2026-10-05T08:16:53Z")
Hi All, I am having an issue with Elasticsearch on my website where search requests sometimes return incomplete results even though the relevant documents are already present in the Elasticsearch index. The website uses… --- ## [Best way to analyze secure document activity logs in Elasticsearch?](https://discuss.elastic.co/t/best-way-to-analyze-secure-document-activity-logs-in-elasticsearch/390834)
**Author:** [@George4](https://discuss.elastic.co/u/George4)\ **Replies:** 0\ **Last updated:** [October 5, 2026, 8:14am UTC](https://discuss.elastic.co/t/best-way-to-analyze-secure-document-activity-logs-in-elasticsearch/390834 "2026-10-05T08:14:44Z")
I’m exploring how to structure document activity data in Elasticsearch for a secure document-sharing / virtual data room workflow. One of the platforms I’m looking at is SendNow. The activity data includes document ope… --- ## [Kibana Alert Email - URL broken in SMTP email notifications](https://discuss.elastic.co/t/kibana-alert-email-url-broken-in-smtp-email-notifications/390797)
**Author:** [@Omar2](https://discuss.elastic.co/u/Omar2)\ **Replies:** 2\ **Last updated:** [October 2, 2026, 7:56am UTC](https://discuss.elastic.co/t/kibana-alert-email-url-broken-in-smtp-email-notifications/390797 "2026-10-02T07:56:01Z")
Hello, I'm experiencing an issue with Kibana alert emails sent through an SMTP connector. Kibana version: 9.4.3 Alert message: La règle Kibana {{rule.name}} s'est déclenchée: Nombre d'erreurs : {{context.value}} … --- ## [How do you verify that an eland-imported tree model matches the original?](https://discuss.elastic.co/t/how-do-you-verify-that-an-eland-imported-tree-model-matches-the-original/390787)
**Author:** [@Milivoje\_Simonovic](https://discuss.elastic.co/u/Milivoje_Simonovic)\ **Replies:** 1\ **Last updated:** [October 1, 2026, 1:34am UTC](https://discuss.elastic.co/t/how-do-you-verify-that-an-eland-imported-tree-model-matches-the-original/390787 "2026-10-01T01:34:37Z")
Hi, Laura Trotta at Elastic suggested I post this here. When eland imports an XGBoost, LightGBM or scikit-learn model into Elasticsearch, what Elasticsearch runs is a converted copy of the trained model. I am curious h… --- ## [Missing Export button for custom role despite enabling "Generate PDF or PNG report" privilege (v8.19.11)](https://discuss.elastic.co/t/missing-export-button-for-custom-role-despite-enabling-generate-pdf-or-png-report-privilege-v8-19-11/390775)
**Author:** [@WANASANAN815](https://discuss.elastic.co/u/WANASANAN815)\ **Replies:** 1\ **Last updated:** [October 1, 2026, 12:02am UTC](https://discuss.elastic.co/t/missing-export-button-for-custom-role-despite-enabling-generate-pdf-or-png-report-privilege-v8-19-11/390775 "2026-10-01T00:02:38Z")
Hi everyone, I’m currently having an issue creating a custom role in Elastic SIEM. I am trying to create a role that allows users to export dashboards as PDFs. Environment: Elastic Version: 8.19.11 License: Enter… --- ## [Missing Export button for custom role despite enabling "Generate PDF or PNG report" privilege (v8.19.11)](https://discuss.elastic.co/t/missing-export-button-for-custom-role-despite-enabling-generate-pdf-or-png-report-privilege-v8-19-11/390774)
**Author:** [@WANASANAN815](https://discuss.elastic.co/u/WANASANAN815)\ **Replies:** 1\ **Last updated:** [September 30, 2026, 2:25pm UTC](https://discuss.elastic.co/t/missing-export-button-for-custom-role-despite-enabling-generate-pdf-or-png-report-privilege-v8-19-11/390774 "2026-09-30T14:25:19Z")
Hi everyone, I’m currently having an issue creating a custom role in Elastic SIEM. I am trying to create a role that allows users to export dashboards as PDFs. Environment: Elastic Version: 8.19.11 License: Enter… --- ## [Downsampling non-dimension labels to last value is misleading](https://discuss.elastic.co/t/downsampling-non-dimension-labels-to-last-value-is-misleading/390779)
**Author:** [@pmcc](https://discuss.elastic.co/u/pmcc)\ **Replies:** 0\ **Last updated:** [September 30, 2026, 11:36am UTC](https://discuss.elastic.co/t/downsampling-non-dimension-labels-to-last-value-is-misleading/390779 "2026-09-30T11:36:22Z")
I'm upgrading from v7 to 9.5 - lots of great new features! For my application, TSDS look ideal, and downsampling will be a major improvement. There appears to be one flaw with downsampling for my use cases. Keyword fiel… --- ## [Support for metrics for kafka consumer group using new Consumer Rebalance Protocol](https://discuss.elastic.co/t/support-for-metrics-for-kafka-consumer-group-using-new-consumer-rebalance-protocol/390766)
**Author:** [@rakesh.iitism95](https://discuss.elastic.co/u/rakesh.iitism95)\ **Replies:** 0\ **Last updated:** [September 29, 2026, 8:29pm UTC](https://discuss.elastic.co/t/support-for-metrics-for-kafka-consumer-group-using-new-consumer-rebalance-protocol/390766 "2026-09-29T20:29:36Z")
We are currently using elastic agent to collect kafka consumer group metric. After a consumer group was configured to use the new consumer rebalance protocol available in Kafka 4.0 , the agent was not collecting the metr… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=2)