# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=105 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 106 --- ## [Mac address changed to mixed datatype in elastic](https://discuss.elastic.co/t/mac-address-changed-to-mixed-datatype-in-elastic/374051)
**Author:** [@meghananagaraja](https://discuss.elastic.co/u/meghananagaraja)\ **Replies:** 3\ **Last updated:** [February 5, 2025, 10:53am UTC](https://discuss.elastic.co/t/mac-address-changed-to-mixed-datatype-in-elastic/374051 "2025-02-05T10:53:38Z")
I am feeding data into ES index. The data has mac address. Elastic is mapping it to a mixed data type (part string part numeric). How to fix this issue. I am not able to use "term" option while querying. It wont fetch. … --- ## [We have facing some issue with elastic search 8.15.1](https://discuss.elastic.co/t/we-have-facing-some-issue-with-elastic-search-8-15-1/374113)
**Author:** [@calvin01](https://discuss.elastic.co/u/calvin01)\ **Replies:** 0\ **Last updated:** [February 5, 2025, 10:06am UTC](https://discuss.elastic.co/t/we-have-facing-some-issue-with-elastic-search-8-15-1/374113 "2025-02-05T10:06:24Z")
Hello Community, We are running an Elasticsearch 8.15.1 cluster with 7 nodes, each configured with -Xms28g -Xmx28g heap memory. Additionally, we have set vm.max\_map\_count=262144 on the instances. Unfortunately, our Ela… --- ## [Converting date into date format in logstash](https://discuss.elastic.co/t/converting-date-into-date-format-in-logstash/374111)
**Author:** [@roopeshetty](https://discuss.elastic.co/u/roopeshetty)\ **Replies:** 0\ **Last updated:** [February 5, 2025, 9:09am UTC](https://discuss.elastic.co/t/converting-date-into-date-format-in-logstash/374111 "2025-02-05T09:09:50Z")
Hi We are trying to ship a csv file from Filebeat \> Logstash \> Elasticsearch. This csv files has column by name “CreateOn” which will have the dates as below; Thursday, March 10, 2016 3:00:23 PM UTC Thursday, May 4, … --- ## [Reindex with embeddings](https://discuss.elastic.co/t/reindex-with-embeddings/374088)
**Author:** [@Carlos\_Fernando\_Palm](https://discuss.elastic.co/u/Carlos_Fernando_Palm)\ **Replies:** 1\ **Last updated:** [February 5, 2025, 2:30am UTC](https://discuss.elastic.co/t/reindex-with-embeddings/374088 "2025-02-05T02:30:49Z")
I was trying to use the E5 model to generate embeddings for non english documents and I created a field that was a sparse\_vector. The index where I changed the mapping already has a sparse\_vector for another embedding a… --- ## [Timestamp sorting in a search, is not sorting on milliseconds](https://discuss.elastic.co/t/timestamp-sorting-in-a-search-is-not-sorting-on-milliseconds/373842)
**Author:** [@Casper\_Thrane](https://discuss.elastic.co/u/Casper_Thrane)\ **Replies:** 1\ **Last updated:** [February 4, 2025, 10:12pm UTC](https://discuss.elastic.co/t/timestamp-sorting-in-a-search-is-not-sorting-on-milliseconds/373842 "2025-02-04T22:12:18Z")
Hi We have a search, which is sorted default by @timestamp. But is it not sorted correctly, on the milliseconds level. Here are the lines from the search. Jan 29, 2025 @ 16:34:36.040 dokument-lager-service-spring ERROR… --- ## [Elastic Agent service installed on Windows without noncrash failure flag](https://discuss.elastic.co/t/elastic-agent-service-installed-on-windows-without-noncrash-failure-flag/374043)
**Author:** [@jeremyvisser](https://discuss.elastic.co/u/jeremyvisser)\ **Replies:** 0\ **Last updated:** [February 4, 2025, 6:19am UTC](https://discuss.elastic.co/t/elastic-agent-service-installed-on-windows-without-noncrash-failure-flag/374043 "2025-02-04T06:19:30Z")
On Windows, services have a variety of options for automatic restarts, depending on the failure modes (similar to systemd serviced options). The problem is that the FAILURE\_ACTIONS\_ON\_NONCRASH\_FAILURES (or the "Enable a… --- ## [New Install 8.17 scripts not working - java](https://discuss.elastic.co/t/new-install-8-17-scripts-not-working-java/373862)
**Author:** [@mjanzen](https://discuss.elastic.co/u/mjanzen)\ **Replies:** 2\ **Last updated:** [February 4, 2025, 8:57pm UTC](https://discuss.elastic.co/t/new-install-8-17-scripts-not-working-java/373862 "2025-02-04T20:57:56Z")
New to Elasticsearch. Working on setting up a proof of concept. I'm using the tutorial here Tutorial 1: Installing a self-managed Elastic Stack | Elastic Installation and Upgrade Guide \[8.17\] | Elastic Anytime I try … --- ## [How to use the bulk api from kibana](https://discuss.elastic.co/t/how-to-use-the-bulk-api-from-kibana/374081)
**Author:** [@Carlos\_Fernando\_Palm](https://discuss.elastic.co/u/Carlos_Fernando_Palm)\ **Replies:** 1\ **Last updated:** [February 4, 2025, 8:20pm UTC](https://discuss.elastic.co/t/how-to-use-the-bulk-api-from-kibana/374081 "2025-02-04T20:20:28Z")
I am trying to upload data using the bulk api from kibana. I was following this I have tried a syntax like this: POST /my-index/\_bulk { { "index": { "\_index": "myindex", "\_id": "1" } } { "name": "John Doe", "age"… --- ## [Use ELSER on data already in elastic](https://discuss.elastic.co/t/use-elser-on-data-already-in-elastic/373911)
**Author:** [@Carlos\_Fernando\_Palm](https://discuss.elastic.co/u/Carlos_Fernando_Palm)\ **Replies:** 2\ **Last updated:** [February 4, 2025, 8:15pm UTC](https://discuss.elastic.co/t/use-elser-on-data-already-in-elastic/373911 "2025-02-04T20:15:04Z")
I was going through the documentation for the ELSER model and I keep seeing that when using an inference point the model is applied to the data at ingestion time. Is there a way to populate the semantic\_text field for da… --- ## [Unable to set logging level for docker container](https://discuss.elastic.co/t/unable-to-set-logging-level-for-docker-container/374073)
**Author:** [@instantdreams](https://discuss.elastic.co/u/instantdreams)\ **Replies:** 0\ **Last updated:** [February 4, 2025, 4:42pm UTC](https://discuss.elastic.co/t/unable-to-set-logging-level-for-docker-container/374073 "2025-02-04T16:42:28Z")
I have an elasticsearch container using the following compose.yaml file: services: elasticsearch: image: docker.elastic.co/elasticsearch/elasticsearch:latest container\_name: elasticsearch expose: - 9… --- ## [How to smoothly replace deprecated reporting\_user by Kibana Feature privileges?](https://discuss.elastic.co/t/how-to-smoothly-replace-deprecated-reporting-user-by-kibana-feature-privileges/373780)
**Author:** [@bianca\_s](https://discuss.elastic.co/u/bianca_s)\ **Replies:** 1\ **Last updated:** [February 4, 2025, 3:41pm UTC](https://discuss.elastic.co/t/how-to-smoothly-replace-deprecated-reporting-user-by-kibana-feature-privileges/373780 "2025-02-04T15:41:09Z")
Hi all, we want to get rid of the deprecated reporting\_user and wonder how to do that smoothly. We have already found out that as a replacement one can use Kibana Feature Privileges which are available in the UI when s… --- ## [How to change the policy of an existing datastream](https://discuss.elastic.co/t/how-to-change-the-policy-of-an-existing-datastream/373811)
**Author:** [@ataylor](https://discuss.elastic.co/u/ataylor)\ **Replies:** 4\ **Last updated:** [February 4, 2025, 3:21pm UTC](https://discuss.elastic.co/t/how-to-change-the-policy-of-an-existing-datastream/373811 "2025-02-04T15:21:55Z")
Hey all, so current situation is that we set up logging for openshift into elastic, and it has taken the standard Logs index lifecycle policy, However this has a silly retention period, and i need to change this. I hav… --- ## [All fields have the status "unknown field"](https://discuss.elastic.co/t/all-fields-have-the-status-unknown-field/371760)
**Author:** [@atbc](https://discuss.elastic.co/u/atbc)\ **Replies:** 17\ **Last updated:** [February 4, 2025, 3:17pm UTC](https://discuss.elastic.co/t/all-fields-have-the-status-unknown-field/371760 "2025-02-04T15:17:40Z")
Hello, We have a problem, all fields have the status "unknown field" on our Kibana, wich breaks most of our searches.. Do you know how to solve this ? Regards, --- ## [If math get unknown error](https://discuss.elastic.co/t/if-math-get-unknown-error/373851)
**Author:** [@MattiHatem](https://discuss.elastic.co/u/MattiHatem)\ **Replies:** 1\ **Last updated:** [February 4, 2025, 2:38pm UTC](https://discuss.elastic.co/t/if-math-get-unknown-error/373851 "2025-02-04T14:38:53Z")
Hi, when I try to pass the blow I got this error Expression failed with the message: \[if\] \> \[math\] \> Unknown variable: count filters | essql query="SELECT COUNT(\*) as count FROM \\"reservation-event\*\\" WHERE message… --- ## [Docker compose file for v8.16](https://discuss.elastic.co/t/docker-compose-file-for-v8-16/374057)
**Author:** [@Amol\_Nagotkar](https://discuss.elastic.co/u/Amol_Nagotkar)\ **Replies:** 1\ **Last updated:** [February 4, 2025, 1:11pm UTC](https://discuss.elastic.co/t/docker-compose-file-for-v8-16/374057 "2025-02-04T13:11:24Z")
Hi all, i need docker-compose file for elastic v.8.16.3 i followed this link -\> Install Elasticsearch with Docker | Elasticsearch Guide \[8.16\] | Elastic tried below compose file-\> version: '3.8' services: es01: … --- ## [Monitoring a Dataview (Watcher vs. Rule)](https://discuss.elastic.co/t/monitoring-a-dataview-watcher-vs-rule/374058)
**Author:** [@MGBSLC](https://discuss.elastic.co/u/MGBSLC)\ **Replies:** 0\ **Last updated:** [February 4, 2025, 10:19am UTC](https://discuss.elastic.co/t/monitoring-a-dataview-watcher-vs-rule/374058 "2025-02-04T10:19:44Z")
Hi Community We would like to monitor a dataview and generate an alert, if there is no data sent to it. we saw that there are several options to create monitors. we focused on "watcher" or "rule". but what is exactely … --- ## [Pipelines execution in Elastic.Serilog.Sinks](https://discuss.elastic.co/t/pipelines-execution-in-elastic-serilog-sinks/374056)
**Author:** [@Wojciech\_Szabowicz](https://discuss.elastic.co/u/Wojciech_Szabowicz)\ **Replies:** 0\ **Last updated:** [February 4, 2025, 10:15am UTC](https://discuss.elastic.co/t/pipelines-execution-in-elastic-serilog-sinks/374056 "2025-02-04T10:15:33Z")
Hi, I am using Elastic.Serilog.Sinks to stream some data directly to elasticsearch a very simple mechanism .WriteTo.Logger(lc =\> { lc.Filter.ByIncludingOnly(le =\> le.Properties.ContainsKey("ecs.ver… --- ## [Elasticsearch:9200 rest api tunneled through kibana:5601](https://discuss.elastic.co/t/elasticsearch-9200-rest-api-tunneled-through-kibana-5601/371587)
**Author:** [@mortenb123](https://discuss.elastic.co/u/mortenb123)\ **Replies:** 2\ **Last updated:** [February 4, 2025, 10:07am UTC](https://discuss.elastic.co/t/elasticsearch-9200-rest-api-tunneled-through-kibana-5601/371587 "2025-02-04T10:07:16Z")
Is it possible to tunnel elasticsearch:9200 queries via kibana:5601 --- ## [Search for Variations of Persian Names in Elasticsearch?](https://discuss.elastic.co/t/search-for-variations-of-persian-names-in-elasticsearch/374039)
**Author:** [@HassanJalali](https://discuss.elastic.co/u/HassanJalali)\ **Replies:** 0\ **Last updated:** [February 4, 2025, 4:04am UTC](https://discuss.elastic.co/t/search-for-variations-of-persian-names-in-elasticsearch/374039 "2025-02-04T04:04:06Z")
I'm using Elasticsearch in my .NET app and i construct a query like this: POST xxx/\_search?typed\_keys=true { "query": { "bool": { "must": \[ { "query\_string": { "fields": \[ … --- ## [Include\_lower / include\_upper is deprecated?](https://discuss.elastic.co/t/include-lower-include-upper-is-deprecated/373295)
**Author:** [@Jamshid](https://discuss.elastic.co/u/Jamshid)\ **Replies:** 3\ **Last updated:** [February 3, 2025, 10:36pm UTC](https://discuss.elastic.co/t/include-lower-include-upper-is-deprecated/373295 "2025-02-03T22:36:24Z")
After upgrading to elasticsearch 8.17 it seems I started seeing this deprecation log. \],\[299 Elasticsearch-8.17.0-2b6a7fed44faa321997703718f07ee0420804b41 "Deprecated field \[include\_upper\] used, this field is unused and… --- ## [New index not created by ingestion pipeline](https://discuss.elastic.co/t/new-index-not-created-by-ingestion-pipeline/374018)
**Author:** [@umesh2020](https://discuss.elastic.co/u/umesh2020)\ **Replies:** 19\ **Last updated:** [February 3, 2025, 10:24pm UTC](https://discuss.elastic.co/t/new-index-not-created-by-ingestion-pipeline/374018 "2025-02-03T22:24:06Z")
Hi I am using elastic-agent in k8s cluster with kubernetes integration. I have added a custom pipeline for kubernetes container logs to re-route all logs from containers in a specific namespace. The following is the … --- ## [Complex search queries with multiple nested aggregations](https://discuss.elastic.co/t/complex-search-queries-with-multiple-nested-aggregations/374032)
**Author:** [@Petar\_Vitanov](https://discuss.elastic.co/u/Petar_Vitanov)\ **Replies:** 0\ **Last updated:** [February 3, 2025, 7:43pm UTC](https://discuss.elastic.co/t/complex-search-queries-with-multiple-nested-aggregations/374032 "2025-02-03T19:43:45Z")
Hello everyone, I want to use Elasticsearch to track user events like placing bets, making deposits, withdrawals etc. I have created a data stream with document which track timestamp of the event, user\_id as keyword an… --- ## [Kibana Elastic Cloud default snapshot policy and searchable snapshots](https://discuss.elastic.co/t/kibana-elastic-cloud-default-snapshot-policy-and-searchable-snapshots/373981)
**Author:** [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Replies:** 0\ **Last updated:** [February 2, 2025, 1:24pm UTC](https://discuss.elastic.co/t/kibana-elastic-cloud-default-snapshot-policy-and-searchable-snapshots/373981 "2025-02-02T13:24:03Z")
On Elastic Cloud there is a default snapshot policy that takes a snapshot fo the entire cluster, per default this policy runs every 30 minutes and cannot be disabeld, just tricked into not running (by setting a distant f… --- ## [Backup repository s3 bucket size is almost 5 times the actual index size](https://discuss.elastic.co/t/backup-repository-s3-bucket-size-is-almost-5-times-the-actual-index-size/373910)
**Author:** [@Dharani\_Vattamwar](https://discuss.elastic.co/u/Dharani_Vattamwar)\ **Replies:** 25\ **Last updated:** [February 3, 2025, 3:26pm UTC](https://discuss.elastic.co/t/backup-repository-s3-bucket-size-is-almost-5-times-the-actual-index-size/373910 "2025-02-03T15:26:18Z")
our elasticsearch indices are about 12TB and we have backups happening on daily basis with retention of 3 days. How can the snapshot storage s3 size be 60TB? Is there any way to estimate the size if we retain snapshots … --- ## [Shape issue in Canvas](https://discuss.elastic.co/t/shape-issue-in-canvas/374013)
**Author:** [@MattiHatem](https://discuss.elastic.co/u/MattiHatem)\ **Replies:** 1\ **Last updated:** [February 3, 2025, 3:19pm UTC](https://discuss.elastic.co/t/shape-issue-in-canvas/374013 "2025-02-03T15:19:30Z")
the below is giving me the following error (\[if\] \> \[gte\] \> Can not cast 'shape' to any of 'number, string'), I have tried the switch case but also didn't work, can anyone help me please filters | essql query="SELECT… --- ## [String\_index\_out\_of\_bounds\_exception when attempting to register S3 bucket with Elasticsearch instance](https://discuss.elastic.co/t/string-index-out-of-bounds-exception-when-attempting-to-register-s3-bucket-with-elasticsearch-instance/373958)
**Author:** [@trai](https://discuss.elastic.co/u/trai)\ **Replies:** 3\ **Last updated:** [February 3, 2025, 1:59pm UTC](https://discuss.elastic.co/t/string-index-out-of-bounds-exception-when-attempting-to-register-s3-bucket-with-elasticsearch-instance/373958 "2025-02-03T13:59:25Z")
I'm wanting to do a backup & restore on an Elasticsearch 7.10 instance. I've used Terraform to create a role which the user assumes using PassRole which seems to work, however I'm getting an error when attempting to add … --- ## [Help sanitizing new lines](https://discuss.elastic.co/t/help-sanitizing-new-lines/373823)
**Author:** [@Jose\_E](https://discuss.elastic.co/u/Jose_E)\ **Replies:** 2\ **Last updated:** [February 3, 2025, 1:50pm UTC](https://discuss.elastic.co/t/help-sanitizing-new-lines/373823 "2025-02-03T13:50:08Z")
Hi there, I need help with what I thought was a very simple issue, but turns out it isn't. I have updated from logstash 7.x to 8.x, and even though all of my tests have passed correctly, I found several issues with one … --- ## [Migrate agent policies to a new fleet server](https://discuss.elastic.co/t/migrate-agent-policies-to-a-new-fleet-server/373994)
**Author:** [@Dth\_Revan](https://discuss.elastic.co/u/Dth_Revan)\ **Replies:** 1\ **Last updated:** [February 3, 2025, 1:25pm UTC](https://discuss.elastic.co/t/migrate-agent-policies-to-a-new-fleet-server/373994 "2025-02-03T13:25:49Z")
Hello everyone! i have a test cluster with fleet server where there is an elastic agent with synthetics (heartbeat) policy. as this is a test cluster i decided to make a single policy "fleet+heartbeat policy" and assign … --- ## [Searchable snapshot](https://discuss.elastic.co/t/searchable-snapshot/364764)
**Author:** [@Lim](https://discuss.elastic.co/u/Lim)\ **Replies:** 2\ **Last updated:** [February 3, 2025, 10:52am UTC](https://discuss.elastic.co/t/searchable-snapshot/364764 "2025-02-03T10:52:52Z")
Hello, I’m conducting performance tests on Searchable Snapshots and would like to discuss my approach to see if it is correct. Currently, I’ve created a snapshot repository on NAS to generate a 100GB partial shard for … --- ## [Compatible version for ARM machines](https://discuss.elastic.co/t/compatible-version-for-arm-machines/374005)
**Author:** [@wasim\_wasim](https://discuss.elastic.co/u/wasim_wasim)\ **Replies:** 3\ **Last updated:** [February 3, 2025, 10:49am UTC](https://discuss.elastic.co/t/compatible-version-for-arm-machines/374005 "2025-02-03T10:49:18Z")
Elastisearch docker image is not supporting for arm machines. IMAGE - docker.elastic.co/elasticsearch/elasticsearch:8.6.0 ARCH - Linux AIG-OCTEONTX-84-CSK 5.15.72 #12 SMP PREEMPT Mon Dec 9 08:57:20 UTC 2024 aarch64 … [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=104) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=106)