# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=107 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 108 --- ## [Assume Role snapshot S3](https://discuss.elastic.co/t/assume-role-snapshot-s3/373848)
**Author:** [@suarna](https://discuss.elastic.co/u/suarna)\ **Replies:** 7\ **Last updated:** [January 30, 2025, 4:47pm UTC](https://discuss.elastic.co/t/assume-role-snapshot-s3/373848 "2025-01-30T16:47:30Z")
Hi everybody, How is it going? Let's see if someone can help me with this. Sorry if the question is trivial (I am new in using elasticsearch) I have a question regarding the use of the s3 repository plugin in order to… --- ## [Master node recommendation](https://discuss.elastic.co/t/master-node-recommendation/373881)
**Author:** [@searchwithme](https://discuss.elastic.co/u/searchwithme)\ **Replies:** 1\ **Last updated:** [January 30, 2025, 4:36pm UTC](https://discuss.elastic.co/t/master-node-recommendation/373881 "2025-01-30T16:36:28Z")
If I configure 2 nodes as hot and 2 nodes as warm in my on prem deployment, can 3 out of 4 of these nodes be a master? (instead of having to configure separate master nodes?) If yes, is it okay 2 of the master nodes are… --- ## [Problem creating a custom color ramp for a layer](https://discuss.elastic.co/t/problem-creating-a-custom-color-ramp-for-a-layer/373890)
**Author:** [@juandres117](https://discuss.elastic.co/u/juandres117)\ **Replies:** 2\ **Last updated:** [January 30, 2025, 4:34pm UTC](https://discuss.elastic.co/t/problem-creating-a-custom-color-ramp-for-a-layer/373890 "2025-01-30T16:34:47Z")
Hey there! I am uploading different economics indicators to Kibana. However, I am having troubles with the definition of the values of the ramp. As you can see I have negative values in some countries. I have to cha… --- ## [Kibana Semaphore - no logs in 5min, 10min, 30min](https://discuss.elastic.co/t/kibana-semaphore-no-logs-in-5min-10min-30min/373892)
**Author:** [@Rnx](https://discuss.elastic.co/u/Rnx)\ **Replies:** 2\ **Last updated:** [January 30, 2025, 4:17pm UTC](https://discuss.elastic.co/t/kibana-semaphore-no-logs-in-5min-10min-30min/373892 "2025-01-30T16:17:14Z")
How to create any kind of vizualisation in Kibana, which change the color according to amount of logs in time. Let's say, it should be green if there is any amount of logs within 5minutes, if no log is present in 5 mins,… --- ## [Providing agent ip to the proxy](https://discuss.elastic.co/t/providing-agent-ip-to-the-proxy/373896)
**Author:** [@atnestors](https://discuss.elastic.co/u/atnestors)\ **Replies:** 0\ **Last updated:** [January 30, 2025, 2:14pm UTC](https://discuss.elastic.co/t/providing-agent-ip-to-the-proxy/373896 "2025-01-30T14:14:30Z")
Hello, I have a reverse proxy running Flask that needs to check and log the ip of an agent before allowing the connection. Is there a way to make Elastic send the target agent ip along with the CONNECT request? I've see… --- ## [Query\_string with wildcard not working as expected (or wrong understanging of analyze\_wildcard)](https://discuss.elastic.co/t/query-string-with-wildcard-not-working-as-expected-or-wrong-understanging-of-analyze-wildcard/371910)
**Author:** [@Zer0](https://discuss.elastic.co/u/Zer0)\ **Replies:** 12\ **Last updated:** [January 30, 2025, 1:21pm UTC](https://discuss.elastic.co/t/query-string-with-wildcard-not-working-as-expected-or-wrong-understanging-of-analyze-wildcard/371910 "2025-01-30T13:21:03Z")
Hi I am wondering why the following query does not hit. Here is the reproducer: // put index PUT /test { "mappings" : { "properties" : { "title": { "type": "text", "analyzer": "german… --- ## [Storage to RAM](https://discuss.elastic.co/t/storage-to-ram/373888)
**Author:** [@searchwithme](https://discuss.elastic.co/u/searchwithme)\ **Replies:** 1\ **Last updated:** [January 30, 2025, 11:22am UTC](https://discuss.elastic.co/t/storage-to-ram/373888 "2025-01-30T11:22:33Z")
From the pricing calculator, I see elastic recommends 1 GB RAM for 30 GB storage (hot data). for my on prem set up, is it okay if I have 2 data nodes with 5 TB of data each? If I follow the 1:30 rule, number of data no… --- ## [Lackluster azure.resource.type data in billing metricset](https://discuss.elastic.co/t/lackluster-azure-resource-type-data-in-billing-metricset/373886)
**Author:** [@janb](https://discuss.elastic.co/u/janb)\ **Replies:** 0\ **Last updated:** [January 30, 2025, 11:03am UTC](https://discuss.elastic.co/t/lackluster-azure-resource-type-data-in-billing-metricset/373886 "2025-01-30T11:03:19Z")
Hi, we've introduced azure billing metricset into our metricbeat (8.15.2 version) configuration, and I've noticed that azure.resource.type is a little lackluster. Microsoft.Compute microsoft.compute Microsoft.Storage… --- ## [See aggregation value in a custom threshold (using webhook)](https://discuss.elastic.co/t/see-aggregation-value-in-a-custom-threshold-using-webhook/373805)
**Author:** [@juanmgarciaf](https://discuss.elastic.co/u/juanmgarciaf)\ **Replies:** 2\ **Last updated:** [January 30, 2025, 9:41am UTC](https://discuss.elastic.co/t/see-aggregation-value-in-a-custom-threshold-using-webhook/373805 "2025-01-30T09:41:15Z")
Hello all, I have created a custom threshold rule in Kibana 8.15.3 where I have defined two aggregations: Aggregation A --\> count (all documents) Aggregation B --\> count (eventType: F\*) I have also created a webhook … --- ## [Is it correct to response to HEAD req from elastic API with empty "transfer-encoding: chunked"?](https://discuss.elastic.co/t/is-it-correct-to-response-to-head-req-from-elastic-api-with-empty-transfer-encoding-chunked/372941)
**Author:** [@pencakj](https://discuss.elastic.co/u/pencakj)\ **Replies:** 14\ **Last updated:** [January 30, 2025, 8:07am UTC](https://discuss.elastic.co/t/is-it-correct-to-response-to-head-req-from-elastic-api-with-empty-transfer-encoding-chunked/372941 "2025-01-30T08:07:24Z")
Hello, we're troubleshooting issue in communication between client and elastic 8.13 in between with HAProxy. Is it correct to response to HEAD request with EMPTY "transfer-encoding: chunked"? In other words - to HEAD re… --- ## [Flattened fields and \`query\_string\` queries with leading wildcard](https://discuss.elastic.co/t/flattened-fields-and-query-string-queries-with-leading-wildcard/373576)
**Author:** [@ddittmar](https://discuss.elastic.co/u/ddittmar)\ **Replies:** 3\ **Last updated:** [January 30, 2025, 7:14am UTC](https://discuss.elastic.co/t/flattened-fields-and-query-string-queries-with-leading-wildcard/373576 "2025-01-30T07:14:03Z")
Hi, I'm seeing unexpected behaviors with flattened fields and query\_string queries with leading wildcard. I'm new to Elasticsearch so maybe someone could help me out. I'm using 8.15.2 but I see the same behavior on 8.17… --- ## [Wrong positionLength using output\_unigrams=false](https://discuss.elastic.co/t/wrong-positionlength-using-output-unigrams-false/373870)
**Author:** [@alexander.korkhov](https://discuss.elastic.co/u/alexander.korkhov)\ **Replies:** 0\ **Last updated:** [January 30, 2025, 6:23am UTC](https://discuss.elastic.co/t/wrong-positionlength-using-output-unigrams-false/373870 "2025-01-30T06:23:12Z")
For example, I have next settings: PUT test\_search\_05 { "settings": { "analysis": { "analyzer": { "shingle": { "tokenizer": "standard", "filter": \[ "my\_shingle\_filter" \] }… --- ## [\[elastic\_agent.metricbeat\]\[info\] CA certificate matching 'ca\_trusted\_fingerprint' found, adding it to 'certificate\_authorities'](https://discuss.elastic.co/t/elastic-agent-metricbeat-info-ca-certificate-matching-ca-trusted-fingerprint-found-adding-it-to-certificate-authorities/358418)
**Author:** [@otortosa](https://discuss.elastic.co/u/otortosa)\ **Replies:** 7\ **Last updated:** [January 30, 2025, 12:49am UTC](https://discuss.elastic.co/t/elastic-agent-metricbeat-info-ca-certificate-matching-ca-trusted-fingerprint-found-adding-it-to-certificate-authorities/358418 "2025-01-30T00:49:20Z")
Hello team! I receive from my Ubuntu host these logs all the time. \[elastic\_agent.metricbeat\]\[info\] CA certificate matching 'ca\_trusted\_fingerprint' found, adding it to 'certificate\_authorities' \[elastic\_agent.metricb… --- ## [Unable to delete index, unable to mark it as read-only false](https://discuss.elastic.co/t/unable-to-delete-index-unable-to-mark-it-as-read-only-false/373857)
**Author:** [@Carlos\_Fernando\_Palm](https://discuss.elastic.co/u/Carlos_Fernando_Palm)\ **Replies:** 1\ **Last updated:** [January 29, 2025, 10:12pm UTC](https://discuss.elastic.co/t/unable-to-delete-index-unable-to-mark-it-as-read-only-false/373857 "2025-01-29T22:12:31Z")
I tried following the solution here But in my case running PUT my\_index/\_settings { "settings": { "index.blocks.read-only": false } } yields FORBIDDEN/5/index read-only (api) So I am in a catch 22 situation wh… --- ## [Add\_field in filebeat individuell for each pattern](https://discuss.elastic.co/t/add-field-in-filebeat-individuell-for-each-pattern/373742)
**Author:** [@mayer](https://discuss.elastic.co/u/mayer)\ **Replies:** 1\ **Last updated:** [January 29, 2025, 8:55pm UTC](https://discuss.elastic.co/t/add-field-in-filebeat-individuell-for-each-pattern/373742 "2025-01-29T20:55:51Z")
Dear All, my environment is ES and filebeat version 8.17.1 to analyse log files. In "pipeline.yml" I have a setup like this - grok: field: message patterns: - 'grok pattern 1' - 'some grok pattern … --- ## [How to separate input with jmx input plugin?](https://discuss.elastic.co/t/how-to-separate-input-with-jmx-input-plugin/373803)
**Author:** [@Elgis\_Migle](https://discuss.elastic.co/u/Elgis_Migle)\ **Replies:** 1\ **Last updated:** [January 29, 2025, 6:23pm UTC](https://discuss.elastic.co/t/how-to-separate-input-with-jmx-input-plugin/373803 "2025-01-29T18:23:08Z")
Hello all, I'm trying to set up some monitoring of a confluentinc/cp-server-connect:7.6.0 docker container and the connectors I run within that. I am using the input-jmx plugin. Now I would like to separate the pipelin… --- ## [Suricata Integration Delay](https://discuss.elastic.co/t/suricata-integration-delay/373847)
**Author:** [@elastic\_c](https://discuss.elastic.co/u/elastic_c)\ **Replies:** 0\ **Last updated:** [January 29, 2025, 4:16pm UTC](https://discuss.elastic.co/t/suricata-integration-delay/373847 "2025-01-29T16:16:32Z")
Hello Everyone, Been stuck on this issue for a while and wondering if anyone can provide me some more information on what could be going on here. I set up the Suricata integration using fleet server, elastic agent, Kib… --- ## [WATCHER SCRIPTS](https://discuss.elastic.co/t/watcher-scripts/373850)
**Author:** [@PRASHANT\_MEHTA](https://discuss.elastic.co/u/PRASHANT_MEHTA)\ **Replies:** 0\ **Last updated:** [January 29, 2025, 4:43pm UTC](https://discuss.elastic.co/t/watcher-scripts/373850 "2025-01-29T16:43:22Z")
TOMCAT ALERT COUNT PUT \_watcher/watch/tomcat\_error\_count\_alerts { "trigger": { "schedule": { "interval": "1h" } }, "input": { "search": { "request": { "search\_type": "query\_then\_fet… --- ## [Vectorised search in ES returning different result if i am changing the result size](https://discuss.elastic.co/t/vectorised-search-in-es-returning-different-result-if-i-am-changing-the-result-size/373715)
**Author:** [@Gaurav\_Duseja](https://discuss.elastic.co/u/Gaurav_Duseja)\ **Replies:** 5\ **Last updated:** [January 29, 2025, 4:04pm UTC](https://discuss.elastic.co/t/vectorised-search-in-es-returning-different-result-if-i-am-changing-the-result-size/373715 "2025-01-29T16:04:26Z")
my query looks like this - below i am passing the size as well and if i am changing the size from 30 to 300 i am seeing completely different results. { "query": { "bool": { … --- ## [Upgrading to 8.15 got Bad certificate error](https://discuss.elastic.co/t/upgrading-to-8-15-got-bad-certificate-error/373748)
**Author:** [@rachelyang](https://discuss.elastic.co/u/rachelyang)\ **Replies:** 5\ **Last updated:** [January 29, 2025, 3:42pm UTC](https://discuss.elastic.co/t/upgrading-to-8-15-got-bad-certificate-error/373748 "2025-01-29T15:42:16Z")
I am tring to upgrade Elasticsearch from 7.17 to 8.15. I've got a bad certificate error . Caused by: javax.net.ssl.SSLHandshakeException: Received fatal alert: bad\_certificate Here is my ssl setting in elasticsearch.ym… --- ## [Controls drag drop position feature missing in elasticsearch version 8.16.1](https://discuss.elastic.co/t/controls-drag-drop-position-feature-missing-in-elasticsearch-version-8-16-1/373759)
**Author:** [@mittal\_rawal1](https://discuss.elastic.co/u/mittal_rawal1)\ **Replies:** 1\ **Last updated:** [January 29, 2025, 12:39pm UTC](https://discuss.elastic.co/t/controls-drag-drop-position-feature-missing-in-elasticsearch-version-8-16-1/373759 "2025-01-29T12:39:52Z")
I have migrated my dashboard from 8.1.0 version to 8.16.1 and in this i was using controls which is deprecated, and now new controls are there but i am not able to move controls below the dashboard header. here i wan… --- ## [Elasticsearch input size not working](https://discuss.elastic.co/t/elasticsearch-input-size-not-working/373818)
**Author:** [@Amit\_Saini](https://discuss.elastic.co/u/Amit_Saini)\ **Replies:** 0\ **Last updated:** [January 29, 2025, 12:23pm UTC](https://discuss.elastic.co/t/elasticsearch-input-size-not-working/373818 "2025-01-29T12:23:48Z")
Hi Team, I'm working on an incremental data pipeline using Logstash. I'm using the Elasticsearch input plugin to retrieve the last processed document from an index. I intend to store the relevant field from this documen… --- ## [Need to send query in my data view on 2 separate document](https://discuss.elastic.co/t/need-to-send-query-in-my-data-view-on-2-separate-document/373792)
**Author:** [@ermisma](https://discuss.elastic.co/u/ermisma)\ **Replies:** 3\ **Last updated:** [January 29, 2025, 10:05am UTC](https://discuss.elastic.co/t/need-to-send-query-in-my-data-view-on-2-separate-document/373792 "2025-01-29T10:05:45Z")
Hi, I’m working with a Dataview where I’m querying to extract specific information from raw data for my use case. The issue I’m facing is that I have multiple documents, and some of the fields I need to query are not in… --- ## [Painless script outputs literal "key" field](https://discuss.elastic.co/t/painless-script-outputs-literal-key-field/373800)
**Author:** [@Henning\_Oden](https://discuss.elastic.co/u/Henning_Oden)\ **Replies:** 0\ **Last updated:** [January 29, 2025, 8:03am UTC](https://discuss.elastic.co/t/painless-script-outputs-literal-key-field/373800 "2025-01-29T08:03:48Z")
I have a Painless script I run in a Script processor in an Ingest Pipeline which moves fields from within a temporary jsonPayload field to the document root. The source looks like this (field names redacted for safety): … --- ## [Backup and Restore](https://discuss.elastic.co/t/backup-and-restore/373796)
**Author:** [@Moni\_Hazarika](https://discuss.elastic.co/u/Moni_Hazarika)\ **Replies:** 0\ **Last updated:** [January 29, 2025, 5:09am UTC](https://discuss.elastic.co/t/backup-and-restore/373796 "2025-01-29T05:09:10Z")
Hi Team, We have 2 variants of Elasticsearch clusters in our organisation. We have the ES cloud platinum license for some use cases while for others we have our own self-hosted ES clusters for some valid reasons. For … --- ## [If FSCrawler stops mid-scan, will it restart from scratch?](https://discuss.elastic.co/t/if-fscrawler-stops-mid-scan-will-it-restart-from-scratch/373787)
**Author:** [@syoo](https://discuss.elastic.co/u/syoo)\ **Replies:** 3\ **Last updated:** [January 29, 2025, 1:15am UTC](https://discuss.elastic.co/t/if-fscrawler-stops-mid-scan-will-it-restart-from-scratch/373787 "2025-01-29T01:15:27Z")
As a newcomer to Elasticsearch, I want to index a large filesystem (100TB) with FSCrawler. I’ve heard that if the initial scan is interrupted, FSCrawler might re-scan everything from the beginning. What’s the best stra… --- ## [Elastic agent input filtering](https://discuss.elastic.co/t/elastic-agent-input-filtering/373711)
**Author:** [@Mohit\_Verma1](https://discuss.elastic.co/u/Mohit_Verma1)\ **Replies:** 0\ **Last updated:** [January 27, 2025, 10:12am UTC](https://discuss.elastic.co/t/elastic-agent-input-filtering/373711 "2025-01-27T10:12:17Z")
I want to filter the input during elasticsearch intergration with agent policy . Means i want only to collect the log.level == Error. How to do it in fleet server. --- ## [Logstash pushing event to older index](https://discuss.elastic.co/t/logstash-pushing-event-to-older-index/373730)
**Author:** [@devops\_training](https://discuss.elastic.co/u/devops_training)\ **Replies:** 10\ **Last updated:** [January 28, 2025, 8:37pm UTC](https://discuss.elastic.co/t/logstash-pushing-event-to-older-index/373730 "2025-01-28T20:37:29Z")
\[2025-01-27T11:17:59,721\]\[INFO \]\[logstash.outputs.elastic\]\[main\]\[160e296c5399e510649e9432dfb7810d3b2916f58b5ee2e872c7b33dd0983a64\] Retrying failed action {:status=\>429, :action=\>\["index", {:\_id=\>"a01a2730453bbd683e5db277… --- ## [Multiple unmapped / unknow Elastic Agent log fields](https://discuss.elastic.co/t/multiple-unmapped-unknow-elastic-agent-log-fields/360653)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 3\ **Last updated:** [January 28, 2025, 7:54pm UTC](https://discuss.elastic.co/t/multiple-unmapped-unknow-elastic-agent-log-fields/360653 "2025-01-28T19:54:45Z")
Hello, I noticed a lot of Elastic Agent log fields have a question mark and seem unmapped. Imho it would be useful if we can aggregate on these fields. Could the mapping please be updated so these fields can be used pro… --- ## [Controls - Adding Links?](https://discuss.elastic.co/t/controls-adding-links/373785)
**Author:** [@erikg](https://discuss.elastic.co/u/erikg)\ **Replies:** 0\ **Last updated:** [January 28, 2025, 5:25pm UTC](https://discuss.elastic.co/t/controls-adding-links/373785 "2025-01-28T17:25:44Z")
Hello, With the use of Controls, we can have the user select an option from a list (granted you have a data view). Is it possible to have hyperlinks or links to other dashboard using Controls (drop down)? I have al… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=106) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=108)