# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=10 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 11 --- ## [Question on the Default Kibana NodeJS Setting --max-old-space-size=2048](https://discuss.elastic.co/t/question-on-the-default-kibana-nodejs-setting-max-old-space-size-2048/386310)
**Author:** [@metalshanked](https://discuss.elastic.co/u/metalshanked)\ **Replies:** 2\ **Last updated:** [May 15, 2026, 1:57am UTC](https://discuss.elastic.co/t/question-on-the-default-kibana-nodejs-setting-max-old-space-size-2048/386310 "2026-05-15T01:57:21Z")
The below note for ECK seems to imply that setting the container mem limits should suffice instead of overriding the pod spec template for kibana. https://www.elastic.co/docs/deploy-manage/production-guidance/kibana-con… --- ## [Syncing Tables from Microsoft SQL Server to Elastic using Logstash](https://discuss.elastic.co/t/syncing-tables-from-microsoft-sql-server-to-elastic-using-logstash/386309)
**Author:** [@Mevevlin](https://discuss.elastic.co/u/Mevevlin)\ **Replies:** 9\ **Last updated:** [May 15, 2026, 12:23am UTC](https://discuss.elastic.co/t/syncing-tables-from-microsoft-sql-server-to-elastic-using-logstash/386309 "2026-05-15T00:23:14Z")
I'm trying to sync my SQL server database to my elasticsearch database. I've got the following input setup now: input { jdbc { jdbc\_driver\_library =\> "/usr/share/logstash/drivers/mssql-jdbc.jre8.jar" jdbc\_driv… --- ## [Collect Kubernetes audit logs from local files only if node label exists via fleet](https://discuss.elastic.co/t/collect-kubernetes-audit-logs-from-local-files-only-if-node-label-exists-via-fleet/386344)
**Author:** [@AndrewDatTeranet](https://discuss.elastic.co/u/AndrewDatTeranet)\ **Replies:** 0\ **Last updated:** [May 14, 2026, 6:10pm UTC](https://discuss.elastic.co/t/collect-kubernetes-audit-logs-from-local-files-only-if-node-label-exists-via-fleet/386344 "2026-05-14T18:10:16Z")
While trying to set up the "Collect Kubernetes audit logs from local files" with the Kubernetes integration in fleet, I was trying to add a condition to only collect logs if the node label kubernetes.labels.node-role\_kub… --- ## [ Switching Elasticsearch from HTTP to HTTPS with Active Fleet Agents](https://discuss.elastic.co/t/switching-elasticsearch-from-http-to-https-with-active-fleet-agents/386339)
**Author:** [@saeedelfiky](https://discuss.elastic.co/u/saeedelfiky)\ **Replies:** 0\ **Last updated:** [May 14, 2026, 3:08pm UTC](https://discuss.elastic.co/t/switching-elasticsearch-from-http-to-https-with-active-fleet-agents/386339 "2026-05-14T15:08:18Z")
Hey everyone, I currently have a self-managed Elastic Stack environment running over HTTP with: Elasticsearch Kibana Fleet Around 20 connected Elastic Agent instances I want to migrate Elasticsearch from … --- ## [Cluster name is logged as ${sys:es.logs.cluster\_name}](https://discuss.elastic.co/t/cluster-name-is-logged-as-sys-es-logs-cluster-name/385225)
**Author:** [@CD9820](https://discuss.elastic.co/u/CD9820)\ **Replies:** 2\ **Last updated:** [May 14, 2026, 1:45pm UTC](https://discuss.elastic.co/t/cluster-name-is-logged-as-sys-es-logs-cluster-name/385225 "2026-05-14T13:45:35Z")
Hello we are upgrading our Elastic clusters to 9.2.5. I upgraded my monitoring cluster from 8.19.4 to 8.19.11, since this upgrade the cluster\_name in the elasticsearch server logs is logged as ${sys:es.logs.cluster\_nam… --- ## [Filebeat-logstash question](https://discuss.elastic.co/t/filebeat-logstash-question/386311)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 6\ **Last updated:** [May 13, 2026, 11:48pm UTC](https://discuss.elastic.co/t/filebeat-logstash-question/386311 "2026-05-13T23:48:05Z")
filebeat.inputs: - type: filestream id: tad-run-logs enabled: true paths: - /run/\*/\*.tl - /run/\*/extra\_info exclude\_files: - '/run/cleanup\_rack/' file\_identity.native: ~ prospe… --- ## [Best practices for dashboards and rules](https://discuss.elastic.co/t/best-practices-for-dashboards-and-rules/386316)
**Author:** [@PatreKerier](https://discuss.elastic.co/u/PatreKerier)\ **Replies:** 0\ **Last updated:** [May 13, 2026, 6:42am UTC](https://discuss.elastic.co/t/best-practices-for-dashboards-and-rules/386316 "2026-05-13T06:42:46Z")
Good afternoon, colleagues! If it's not too much trouble, could you please share your ready-made correlation rules and dashboards that are really useful to you in practice. According to Best Practice. I will be very gra… --- ## [Kibana does not load in brower](https://discuss.elastic.co/t/kibana-does-not-load-in-brower/385546)
**Author:** [@riahc3](https://discuss.elastic.co/u/riahc3)\ **Replies:** 9\ **Last updated:** [May 12, 2026, 2:00pm UTC](https://discuss.elastic.co/t/kibana-does-not-load-in-brower/385546 "2026-05-12T14:00:17Z")
Hello I upgraded Kibana 8 to 9 (obviously everything else) but it does not load in my browser. I see this in the logs: tail -f /data/kibana/logs/kibana.log | jq { "service": { "node": { "roles": \[ "background\_tasks… --- ## [Elasticsearch And Kibana Dashboard Ideas for a Hotel Booking and Guest Analytics System](https://discuss.elastic.co/t/elasticsearch-and-kibana-dashboard-ideas-for-a-hotel-booking-and-guest-analytics-system/386301)
**Author:** [@Jixcy001](https://discuss.elastic.co/u/Jixcy001)\ **Replies:** 0\ **Last updated:** [May 12, 2026, 9:21am UTC](https://discuss.elastic.co/t/elasticsearch-and-kibana-dashboard-ideas-for-a-hotel-booking-and-guest-analytics-system/386301 "2026-05-12T09:21:32Z")
Hello Elastic Community, I’m exploring how Elasticsearch and Kibana can be used for a hospitality/travel project related to a luxury budget hotel in Varanasi called Hotel KB Palace. The idea is to build a small hotel an… --- ## [Elasticsearch Serverless + Vector Search + Data Streams / Time Series Tradeoffs](https://discuss.elastic.co/t/elasticsearch-serverless-vector-search-data-streams-time-series-tradeoffs/386275)
**Author:** [@Januka\_Samaranayake](https://discuss.elastic.co/u/Januka_Samaranayake)\ **Replies:** 3\ **Last updated:** [May 12, 2026, 8:16am UTC](https://discuss.elastic.co/t/elasticsearch-serverless-vector-search-data-streams-time-series-tradeoffs/386275 "2026-05-12T08:16:25Z")
Hello everyone, I am trying to better understand the tradeoffs between Elasticsearch Serverless, Data Streams, TSDS (index.mode=time\_series), and future vector search workloads. Current Situation We currently have arou… --- ## [Unable to create snapshots with cifs share 9.4.0](https://discuss.elastic.co/t/unable-to-create-snapshots-with-cifs-share-9-4-0/386271)
**Author:** [@expErg](https://discuss.elastic.co/u/expErg)\ **Replies:** 4\ **Last updated:** [May 12, 2026, 7:19am UTC](https://discuss.elastic.co/t/unable-to-create-snapshots-with-cifs-share-9-4-0/386271 "2026-05-12T07:19:04Z")
Hello, Since upgrading to 9.4.0, we are experiencing snapshot failures on our CIFS-mounted shared repository. Timeline: Last successful snapshot: May 6, before the upgrade Upgrade to 9.4.0 performed: May 6 at 12:00 P… --- ## [Kibana Error Reporting](https://discuss.elastic.co/t/kibana-error-reporting/385720)
**Author:** [@geoffrey](https://discuss.elastic.co/u/geoffrey)\ **Replies:** 1\ **Last updated:** [May 12, 2026, 12:43am UTC](https://discuss.elastic.co/t/kibana-error-reporting/385720 "2026-05-12T00:43:13Z")
I’m interested in other people’s view of the Kibana error reporting, and this is in particular reference to using the DEV TOOLS. With some recent reorganization of indexes I was presented with an error 502. To cut a … --- ## [Help in selecting the right Stack Monitoring Mode - Node vs Cluster?](https://discuss.elastic.co/t/help-in-selecting-the-right-stack-monitoring-mode-node-vs-cluster/386238)
**Author:** [@RalphDibney](https://discuss.elastic.co/u/RalphDibney)\ **Replies:** 1\ **Last updated:** [May 11, 2026, 1:23pm UTC](https://discuss.elastic.co/t/help-in-selecting-the-right-stack-monitoring-mode-node-vs-cluster/386238 "2026-05-11T13:23:32Z")
Hey everyone, we are still on version 8.x, since we still have selfmonitoring enabled, but we want to move to version 9 as soon as possible. For now we want to switch to agent based monitoring (AutoOps is a possibility… --- ## [Elasticsearch reindex with ELSER pipeline succeeds but only generates embeddings for fraction of documents - no failures reported](https://discuss.elastic.co/t/elasticsearch-reindex-with-elser-pipeline-succeeds-but-only-generates-embeddings-for-fraction-of-documents-no-failures-reported/386228)
**Author:** [@Roland-02](https://discuss.elastic.co/u/Roland-02)\ **Replies:** 2\ **Last updated:** [May 8, 2026, 2:02pm UTC](https://discuss.elastic.co/t/elasticsearch-reindex-with-elser-pipeline-succeeds-but-only-generates-embeddings-for-fraction-of-documents-no-failures-reported/386228 "2026-05-08T14:02:16Z")
I'm reindexing documents with an ELSER inference pipeline to generate embeddings, but only a fraction of documents (usually around half) end up with embeddings despite the reindex completing successfully with no failures… --- ## [Averaging last values of multiple beats](https://discuss.elastic.co/t/averaging-last-values-of-multiple-beats/386182)
**Author:** [@Benjamin\_Klein](https://discuss.elastic.co/u/Benjamin_Klein)\ **Replies:** 4\ **Last updated:** [May 7, 2026, 6:28pm UTC](https://discuss.elastic.co/t/averaging-last-values-of-multiple-beats/386182 "2026-05-07T18:28:51Z")
I have a collection of Heartbeat monitors pinging several different hosts. Each host has multiple services being pinged (by different beats). Is there a way to display, for each host, either the number of beats that came… --- ## [Request for product remediation guidance – bundled Apache Log4j vulnerabilities in Elasticsearch/Logstash](https://discuss.elastic.co/t/request-for-product-remediation-guidance-bundled-apache-log4j-vulnerabilities-in-elasticsearch-logstash/386221)
**Author:** [@sankalita](https://discuss.elastic.co/u/sankalita)\ **Replies:** 1\ **Last updated:** [May 7, 2026, 4:43pm UTC](https://discuss.elastic.co/t/request-for-product-remediation-guidance-bundled-apache-log4j-vulnerabilities-in-elasticsearch-logstash/386221 "2026-05-07T16:43:37Z")
Security scans have identified vulnerable Apache Log4j Core versions bundled with Elasticsearch 8.19.14 and Logstash on the host. Nessus reports CVE‑2026‑34477 and CVE‑2026‑34480, requiring Log4j 2.25.3/2.25.4 or later. … --- ## [The Agents Health is not stable](https://discuss.elastic.co/t/the-agents-health-is-not-stable/386202)
**Author:** [@5037\_DHIVAGAR\_S](https://discuss.elastic.co/u/5037_DHIVAGAR_S)\ **Replies:** 0\ **Last updated:** [May 7, 2026, 5:09am UTC](https://discuss.elastic.co/t/the-agents-health-is-not-stable/386202 "2026-05-07T05:09:08Z")
Hi Everyone, We are using Elastic Cloud (SaaS) with Fleet-managed Elastic Agents on Windows servers. Some of our agents are intermittently switching between Healthy and Unhealthy states, and the status is not stable. I… --- ## [No data/log from elastic agent on Security onion](https://discuss.elastic.co/t/no-data-log-from-elastic-agent-on-security-onion/386140)
**Author:** [@Mojamed\_Pika\_SANOGO](https://discuss.elastic.co/u/Mojamed_Pika_SANOGO)\ **Replies:** 4\ **Last updated:** [May 6, 2026, 7:58pm UTC](https://discuss.elastic.co/t/no-data-log-from-elastic-agent-on-security-onion/386140 "2026-05-06T19:58:07Z")
Hi, I need help. I installed Elastic Agent on Windows machines for monitoring on Security Onion. I chose the distributed mode. Although the agents appear in Fleet and are in a healthy state, and I've integrated Elastic D… --- ## [After upgrade to 9.3.4 problem with version\_conflict\_engine\_exception](https://discuss.elastic.co/t/after-upgrade-to-9-3-4-problem-with-version-conflict-engine-exception/386162)
**Author:** [@Mario\_22](https://discuss.elastic.co/u/Mario_22)\ **Replies:** 4\ **Last updated:** [May 6, 2026, 7:53pm UTC](https://discuss.elastic.co/t/after-upgrade-to-9-3-4-problem-with-version-conflict-engine-exception/386162 "2026-05-06T19:53:38Z")
After upgrading the Elastic Stack, Fleet Server, and Elastic Agents to 9.3.4, and after re-enabling / upgrading integrations, we started seeing a very large number of errors in logs-elastic\_agent-\*. The errors look like… --- ## [Workflows/fields actions](https://discuss.elastic.co/t/workflows-fields-actions/386190)
**Author:** [@proclick](https://discuss.elastic.co/u/proclick)\ **Replies:** 0\ **Last updated:** [May 6, 2026, 1:52pm UTC](https://discuss.elastic.co/t/workflows-fields-actions/386190 "2026-05-06T13:52:36Z")
Hey team, The workflows are pretty useful, but you still need to do a lot of extra steps to, for example, check the hash from the alert (without using Trigger Alert and On Alert). Is it planned to add an option to run t… --- ## [AI assistant data access restrictions](https://discuss.elastic.co/t/ai-assistant-data-access-restrictions/386002)
**Author:** [@venkatkumar229](https://discuss.elastic.co/u/venkatkumar229)\ **Replies:** 2\ **Last updated:** [May 6, 2026, 5:47am UTC](https://discuss.elastic.co/t/ai-assistant-data-access-restrictions/386002 "2026-05-06T05:47:33Z")
We are seeking clarification regarding data access restrictions when using the Elastic AI Assistant. We are planning to enable the Elastic AI Assistant feature for our users. Before proceeding, we would like to understa… --- ## [CEF processor](https://discuss.elastic.co/t/cef-processor/386165)
**Author:** [@Moe\_Hmaidan](https://discuss.elastic.co/u/Moe_Hmaidan)\ **Replies:** 4\ **Last updated:** [May 5, 2026, 3:42pm UTC](https://discuss.elastic.co/t/cef-processor/386165 "2026-05-05T15:42:35Z")
Does the newly introduced cef processor require license? --- ## [Filter for specific field values and create another index to store for longterm storage](https://discuss.elastic.co/t/filter-for-specific-field-values-and-create-another-index-to-store-for-longterm-storage/385273)
**Author:** [@C\_Shah](https://discuss.elastic.co/u/C_Shah)\ **Replies:** 3\ **Last updated:** [May 5, 2026, 3:34pm UTC](https://discuss.elastic.co/t/filter-for-specific-field-values-and-create-another-index-to-store-for-longterm-storage/385273 "2026-05-05T15:34:55Z")
I have filebeat sending logs from multiple files into an elasticseash index. What is the best way for me to filter on those logs and only store those filtered logs in an index for longer time (longer ILM policy)? k8s po… --- ## [Creating MSSP setup for lab (no license)](https://discuss.elastic.co/t/creating-mssp-setup-for-lab-no-license/386163)
**Author:** [@jatin3101](https://discuss.elastic.co/u/jatin3101)\ **Replies:** 1\ **Last updated:** [May 5, 2026, 1:07pm UTC](https://discuss.elastic.co/t/creating-mssp-setup-for-lab-no-license/386163 "2026-05-05T13:07:07Z")
Hi There!! i was just tasked with making a lab of mssp setup without cluster (we will have 4 users ) Users:- CustA - windows logs and only alerts of windows (can only see this ) CustB - linux logs and its alerts sup… --- ## [EDOT otel collector not working on read-only filesystem](https://discuss.elastic.co/t/edot-otel-collector-not-working-on-read-only-filesystem/385897)
**Author:** [@Jaybee18](https://discuss.elastic.co/u/Jaybee18)\ **Replies:** 1\ **Last updated:** [May 5, 2026, 11:10am UTC](https://discuss.elastic.co/t/edot-otel-collector-not-working-on-read-only-filesystem/385897 "2026-05-05T11:10:54Z")
Hello, we want to deploy the elastic agent (or rather the EDOT collector) in otel mode in our cluster but with a read-only root filesystem. It seems that this is currently not possible. We get the following error: fail… --- ## [After upgrade to 9.3.4 problem with system and windows integration](https://discuss.elastic.co/t/after-upgrade-to-9-3-4-problem-with-system-and-windows-integration/386156)
**Author:** [@Mario\_22](https://discuss.elastic.co/u/Mario_22)\ **Replies:** 2\ **Last updated:** [May 5, 2026, 5:49am UTC](https://discuss.elastic.co/t/after-upgrade-to-9-3-4-problem-with-system-and-windows-integration/386156 "2026-05-05T05:49:04Z")
Windows Event Logs stop indexing after upgrade to Elastic Agent 9.3.4 — system.application, system.system, Sysmon, PowerShell, and Custom Windows logs dropped with HTTP 400 Malformed content / dataset mapping conflict; p… --- ## [We are trying to configure Kibana with Entra ID(Azure Active directory) and it is not working properly](https://discuss.elastic.co/t/we-are-trying-to-configure-kibana-with-entra-id-azure-active-directory-and-it-is-not-working-properly/386130)
**Author:** [@AKAM14](https://discuss.elastic.co/u/AKAM14)\ **Replies:** 4\ **Last updated:** [May 2, 2026, 5:30pm UTC](https://discuss.elastic.co/t/we-are-trying-to-configure-kibana-with-entra-id-azure-active-directory-and-it-is-not-working-properly/386130 "2026-05-02T17:30:13Z")
Hello Everyone, We are having a onprem cluster 8.17.x where we are trying to configure entra id for kibana login. unable to successfully do it. unfortunately we are not getting any logs in kibana or elk after the config… --- ## [Need help indexing high-frequency manufacturing data from stamping processes in Elasticsearch](https://discuss.elastic.co/t/need-help-indexing-high-frequency-manufacturing-data-from-stamping-processes-in-elasticsearch/386107)
**Author:** [@jixcy](https://discuss.elastic.co/u/jixcy)\ **Replies:** 1\ **Last updated:** [May 2, 2026, 5:40am UTC](https://discuss.elastic.co/t/need-help-indexing-high-frequency-manufacturing-data-from-stamping-processes-in-elasticsearch/386107 "2026-05-02T05:40:01Z")
Hello everyone, I’m currently working on a real-time industrial data pipeline where we are capturing continuous machine-level outputs from stamping processes in a manufacturing environment. In our setup, we are dealing… --- ## [Beats Input Logging](https://discuss.elastic.co/t/beats-input-logging/386116)
**Author:** [@dawiro](https://discuss.elastic.co/u/dawiro)\ **Replies:** 1\ **Last updated:** [May 1, 2026, 1:56pm UTC](https://discuss.elastic.co/t/beats-input-logging/386116 "2026-05-01T13:56:34Z")
Hi, Can anyone give me a steer regarding difference between logstash.input.beats and org.logstash.beats in the logging hierarchy? How do they relate to one another and how do they differ? Thx D --- ## [Can i use the same fleet server policy to enroll two fleet servers for HA?](https://discuss.elastic.co/t/can-i-use-the-same-fleet-server-policy-to-enroll-two-fleet-servers-for-ha/386106)
**Author:** [@Mansi\_Sharma1](https://discuss.elastic.co/u/Mansi_Sharma1)\ **Replies:** 1\ **Last updated:** [April 30, 2026, 9:32pm UTC](https://discuss.elastic.co/t/can-i-use-the-same-fleet-server-policy-to-enroll-two-fleet-servers-for-ha/386106 "2026-04-30T21:32:43Z")
Hello, I have two VMs where i want to setup my fleet servers. VM1 as Fleet1 and VM2 as Fleet2 I have a Load Balancer for that too. i am wondering if i can use the only one fleet server policy for enrolling both of th… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=9) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=11)