# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=108 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 109 --- ## [Filebeat not collecting logs from Kubernetes pods in specified namespace](https://discuss.elastic.co/t/filebeat-not-collecting-logs-from-kubernetes-pods-in-specified-namespace/373589)
**Author:** [@paolovalladolid](https://discuss.elastic.co/u/paolovalladolid)\ **Replies:** 1\ **Last updated:** [January 28, 2025, 3:33pm UTC](https://discuss.elastic.co/t/filebeat-not-collecting-logs-from-kubernetes-pods-in-specified-namespace/373589 "2025-01-28T15:33:19Z")
We have a pod running in a namespace called ceo-qa1. We tried to configure the manifest file to run Filebeat in the ceo-qa1 namespace. However we are not seeing the expected index .ds-logs-ceo-api\* in Kibana Dev Tools… --- ## [Storage in Frozen nodes on Elastic Cloud](https://discuss.elastic.co/t/storage-in-frozen-nodes-on-elastic-cloud/373770)
**Author:** [@yago82](https://discuss.elastic.co/u/yago82)\ **Replies:** 1\ **Last updated:** [January 28, 2025, 3:22pm UTC](https://discuss.elastic.co/t/storage-in-frozen-nodes-on-elastic-cloud/373770 "2025-01-28T15:22:57Z")
Hi, Can anyone clarify what the storage of Frozen nodes on Elastic Cloud refers to? Is it the local storage of the node itself, or does it represent the storage used by the repository for searchable snapshots (e.g., S3)… --- ## [Webhook Body for Machine Learning Alerts](https://discuss.elastic.co/t/webhook-body-for-machine-learning-alerts/373416)
**Author:** [@catarina](https://discuss.elastic.co/u/catarina)\ **Replies:** 2\ **Last updated:** [January 28, 2025, 3:04pm UTC](https://discuss.elastic.co/t/webhook-body-for-machine-learning-alerts/373416 "2025-01-28T15:04:33Z")
Hello Elastic Community, I’ve set up an advanced Machine Learning job to detect anomalies in user logins, with 6 detectors focusing on unusual source.ip, country, hostname, hour, and time of the week per user. I create… --- ## [Metric or legacy lens does not apply dashboard context filter](https://discuss.elastic.co/t/metric-or-legacy-lens-does-not-apply-dashboard-context-filter/373707)
**Author:** [@j-nash](https://discuss.elastic.co/u/j-nash)\ **Replies:** 4\ **Last updated:** [January 28, 2025, 2:36pm UTC](https://discuss.elastic.co/t/metric-or-legacy-lens-does-not-apply-dashboard-context-filter/373707 "2025-01-28T14:36:28Z")
Hello, I'm creating a dashboard in Kibana to visualize some metrics, and I'm encountering an issue with the date selector. The date selector works perfectly for most visualizations, but when I use either the "legacy" l… --- ## [Elastic Agent vs System integration](https://discuss.elastic.co/t/elastic-agent-vs-system-integration/373771)
**Author:** [@panagiss](https://discuss.elastic.co/u/panagiss)\ **Replies:** 1\ **Last updated:** [January 28, 2025, 2:31pm UTC](https://discuss.elastic.co/t/elastic-agent-vs-system-integration/373771 "2025-01-28T14:31:37Z")
In my ELK stack deployment I have for most agent policies the System integration set with the "Collect metrics from System instances" enabled as can be seen below: Recently I saw that there is a setting to enable log… --- ## [Storage differentiation. Multiple nodes on single host?](https://discuss.elastic.co/t/storage-differentiation-multiple-nodes-on-single-host/373719)
**Author:** [@catn0b0t](https://discuss.elastic.co/u/catn0b0t)\ **Replies:** 7\ **Last updated:** [January 28, 2025, 12:15pm UTC](https://discuss.elastic.co/t/storage-differentiation-multiple-nodes-on-single-host/373719 "2025-01-28T12:15:27Z")
We have hosts with both nvme storage and sata storage. Currently we run a single elasticsearch instance on each host and to keep performance up we only use the nvme storage. Now, we would like to start using the sata-dis… --- ## [How to Filter and Group Values by Type in an Array Nested Field in Kibana](https://discuss.elastic.co/t/how-to-filter-and-group-values-by-type-in-an-array-nested-field-in-kibana/373643)
**Author:** [@Shell\_Dias](https://discuss.elastic.co/u/Shell_Dias)\ **Replies:** 1\ **Last updated:** [January 28, 2025, 8:35am UTC](https://discuss.elastic.co/t/how-to-filter-and-group-values-by-type-in-an-array-nested-field-in-kibana/373643 "2025-01-28T08:35:00Z")
How can I filter and group a field from a document? Inside the document, I have a field with an array of type and values. I would like to filter by type X and group only the values related to it in Kibana. --- ## [Elastic Agent output to Azure Event Hub](https://discuss.elastic.co/t/elastic-agent-output-to-azure-event-hub/373752)
**Author:** [@linuschewpet](https://discuss.elastic.co/u/linuschewpet)\ **Replies:** 0\ **Last updated:** [January 28, 2025, 3:36am UTC](https://discuss.elastic.co/t/elastic-agent-output-to-azure-event-hub/373752 "2025-01-28T03:36:37Z")
Recently I have seen a post on Elastic Agent new output to kafka Would the output be doable with Azure Event Hub since its technically kafka as well. --- ## [Move default elastic data/index storage to a newly created volume](https://discuss.elastic.co/t/move-default-elastic-data-index-storage-to-a-newly-created-volume/373658)
**Author:** [@ermisma](https://discuss.elastic.co/u/ermisma)\ **Replies:** 7\ **Last updated:** [January 27, 2025, 10:50pm UTC](https://discuss.elastic.co/t/move-default-elastic-data-index-storage-to-a-newly-created-volume/373658 "2025-01-27T22:50:33Z")
We have successfully deployed ELK and it's up and running. We've created a new volume and attached it to the VM hosting the ELK stack. Our goal is to store all data, including indices, on this newly mounted volume. To d… --- ## [Cross Cluster Replication: To find overall time taken for data replication](https://discuss.elastic.co/t/cross-cluster-replication-to-find-overall-time-taken-for-data-replication/373750)
**Author:** [@lochinvar](https://discuss.elastic.co/u/lochinvar)\ **Replies:** 0\ **Last updated:** [January 27, 2025, 10:50pm UTC](https://discuss.elastic.co/t/cross-cluster-replication-to-find-overall-time-taken-for-data-replication/373750 "2025-01-27T22:50:28Z")
Hi All, I have done CCR setup and was able to get the existing data replicated from leader to follower. Working on to know the overall time taken to replicate the data from leader to follower. I ran "\_ccr/stats" to gat… --- ## [How to configure elastic stack, i want to migrate from Prometheus to elastic](https://discuss.elastic.co/t/how-to-configure-elastic-stack-i-want-to-migrate-from-prometheus-to-elastic/373395)
**Author:** [@vagharsh](https://discuss.elastic.co/u/vagharsh)\ **Replies:** 7\ **Last updated:** [January 27, 2025, 9:50pm UTC](https://discuss.elastic.co/t/how-to-configure-elastic-stack-i-want-to-migrate-from-prometheus-to-elastic/373395 "2025-01-27T21:50:52Z")
hi everyone, i am using elastic/eck-stack helm chart, my helm values are posted below, i want to migrate away from my current prometheus monitoring solution but since my environment is using servicemonitors and pod mon… --- ## [Elastic Data at Rest Encryption](https://discuss.elastic.co/t/elastic-data-at-rest-encryption/373746)
**Author:** [@Elk\_huh](https://discuss.elastic.co/u/Elk_huh)\ **Replies:** 1\ **Last updated:** [January 27, 2025, 8:39pm UTC](https://discuss.elastic.co/t/elastic-data-at-rest-encryption/373746 "2025-01-27T20:39:48Z")
Is there Data at rest Encryption on self-hosted Elasticsearch ? If so how can i achieve this --- ## [Elastic-agent-complete:\>=8.16.0 chowns NSSDB](https://discuss.elastic.co/t/elastic-agent-complete-8-16-0-chowns-nssdb/371556)
**Author:** [@DougR](https://discuss.elastic.co/u/DougR)\ **Replies:** 3\ **Last updated:** [January 27, 2025, 8:35pm UTC](https://discuss.elastic.co/t/elastic-agent-complete-8-16-0-chowns-nssdb/371556 "2025-01-27T20:35:12Z")
I am having an issue with elastic-agent-complete:8.16.1. We use self-signed certs on many of the internal sites we monitor, so I have to add these certs to the nssdb, however they need to be chown'd to elastic-agent:ela… --- ## [Multiple inputs matching the same log path](https://discuss.elastic.co/t/multiple-inputs-matching-the-same-log-path/373744)
**Author:** [@cheesypie54321](https://discuss.elastic.co/u/cheesypie54321)\ **Replies:** 1\ **Last updated:** [January 27, 2025, 8:03pm UTC](https://discuss.elastic.co/t/multiple-inputs-matching-the-same-log-path/373744 "2025-01-27T20:03:43Z")
I was just wondering if it is advisable to set up a filebeat config with multiple inputs matching the same log paths and potentially the same lines. Is there any uniqueness required in separate file streams? - type: fil… --- ## [Docker-compose.yml & corporate man in the middle ca](https://discuss.elastic.co/t/docker-compose-yml-corporate-man-in-the-middle-ca/373745)
**Author:** [@Hans\_Kruse](https://discuss.elastic.co/u/Hans_Kruse)\ **Replies:** 0\ **Last updated:** [January 27, 2025, 6:34pm UTC](https://discuss.elastic.co/t/docker-compose-yml-corporate-man-in-the-middle-ca/373745 "2025-01-27T18:34:40Z")
Hi, In our company we have a man in the middle firewall/proxy for deep packet inspection with self signed certificates. For local experiments I want to run the docker-compose.yml with Elasticsearch and Kibana. When t… --- ## [Cant run elasticsearch on mastodon](https://discuss.elastic.co/t/cant-run-elasticsearch-on-mastodon/373717)
**Author:** [@rasitha](https://discuss.elastic.co/u/rasitha)\ **Replies:** 1\ **Last updated:** [January 27, 2025, 5:08pm UTC](https://discuss.elastic.co/t/cant-run-elasticsearch-on-mastodon/373717 "2025-01-27T17:08:21Z")
hi im having trouble connecting elasticsearch to mastodon i can connect with curl without problem when i run RAILS\_ENV=production bin/tootctl search deploy i get this error INFO -- : \[dotenv\] Loaded .env.production Th… --- ## [M3 16" macbookpro trackpad scrolling issue with kibana console?](https://discuss.elastic.co/t/m3-16-macbookpro-trackpad-scrolling-issue-with-kibana-console/373480)
**Author:** [@linkerc](https://discuss.elastic.co/u/linkerc)\ **Replies:** 5\ **Last updated:** [January 27, 2025, 4:50pm UTC](https://discuss.elastic.co/t/m3-16-macbookpro-trackpad-scrolling-issue-with-kibana-console/373480 "2025-01-27T16:50:38Z")
Has anybody encountered issue with scrolling? Whenever I reverse 2 finger scrolling, the screen would stutter or stops the scrolling action. It only happens with kibana console page. Both on firefox and safari. I hav… --- ## [Kibana 8.12.2 load image local](https://discuss.elastic.co/t/kibana-8-12-2-load-image-local/373593)
**Author:** [@ferchovi90](https://discuss.elastic.co/u/ferchovi90)\ **Replies:** 3\ **Last updated:** [January 27, 2025, 4:45pm UTC](https://discuss.elastic.co/t/kibana-8-12-2-load-image-local/373593 "2025-01-27T16:45:37Z")
Hello! I want to display in my kibana visualization my local image. I placed the images in this path "/usr/share/kibana/src/plugins/index\_pattern\_management/public/assets/icons/topologias/Portales" but they do not load… --- ## [Proxy to Elastic Cloud](https://discuss.elastic.co/t/proxy-to-elastic-cloud/373734)
**Author:** [@rugenl](https://discuss.elastic.co/u/rugenl)\ **Replies:** 0\ **Last updated:** [January 27, 2025, 4:05pm UTC](https://discuss.elastic.co/t/proxy-to-elastic-cloud/373734 "2025-01-27T16:05:58Z")
We have some private network servers where we may want to send data to our Elastic cloud service. Our desire is to use Fleet managed agents on these servers. Of course, that means "special handling". :slight\_smile: I… --- ## [Logstash benchmark](https://discuss.elastic.co/t/logstash-benchmark/373567)
**Author:** [@devops\_training](https://discuss.elastic.co/u/devops_training)\ **Replies:** 2\ **Last updated:** [January 27, 2025, 3:16pm UTC](https://discuss.elastic.co/t/logstash-benchmark/373567 "2025-01-27T15:16:49Z")
I see the below error in logstash \[2025-01-17T16:10:51,266\]\[ERROR\]\[logstash.outputs.elasticsearch\]\[main\]\[e65c1c48441d9162efee01ea49bd87b3c33b47189f25296954c014186f3f1bca\] Encountered a retryable error (will retry with e… --- ## [Identifying number of logs per 5 minutes, over a week?](https://discuss.elastic.co/t/identifying-number-of-logs-per-5-minutes-over-a-week/373586)
**Author:** [@user-27022024](https://discuss.elastic.co/u/user-27022024)\ **Replies:** 3\ **Last updated:** [January 27, 2025, 12:42pm UTC](https://discuss.elastic.co/t/identifying-number-of-logs-per-5-minutes-over-a-week/373586 "2025-01-27T12:42:01Z")
We ship AWS ALB logs to Kibana. Each log has a lot of key value fields but the two we are interested in are client\_ip and timestamp. For example: timestamp: Jan 23, 2025 @ 14:40:00.268 client\_ip: 8.8.8.8 I am trying… --- ## [Moving from source to synthetic\_source](https://discuss.elastic.co/t/moving-from-source-to-synthetic-source/358107)
**Author:** [@Aditya\_Teltia](https://discuss.elastic.co/u/Aditya_Teltia)\ **Replies:** 4\ **Last updated:** [January 27, 2025, 11:16am UTC](https://discuss.elastic.co/t/moving-from-source-to-synthetic-source/358107 "2025-01-27T11:16:26Z")
Hi everyone, I am moving set of indices from ES7 to ES8 with synthetic source. I added "mappings": { "\_source": { "mode": "synthetic" } } this in the mappings. But now I am getting following error - o… --- ## [Global search shows Index Names. How to avoid that, as they spam result?](https://discuss.elastic.co/t/global-search-shows-index-names-how-to-avoid-that-as-they-spam-result/373708)
**Author:** [@arberg](https://discuss.elastic.co/u/arberg)\ **Replies:** 0\ **Last updated:** [January 27, 2025, 10:06am UTC](https://discuss.elastic.co/t/global-search-shows-index-names-how-to-avoid-that-as-they-spam-result/373708 "2025-01-27T10:06:40Z")
In the new Kibana 8.17.1 (coming from 8.11.4) the global search now find index names when I search. This makes it difficult to use. I can see i can wrtie tag:search but that makes it slow and much less useful than just u… --- ## [How to send the cloud watch logs into elastic search](https://discuss.elastic.co/t/how-to-send-the-cloud-watch-logs-into-elastic-search/372829)
**Author:** [@sandraimmaculate](https://discuss.elastic.co/u/sandraimmaculate)\ **Replies:** 2\ **Last updated:** [January 27, 2025, 8:23am UTC](https://discuss.elastic.co/t/how-to-send-the-cloud-watch-logs-into-elastic-search/372829 "2025-01-27T08:23:46Z")
Hello, I want to send the AWS VPC flow logs to elaticsearch using aws vpc flow log integration my vpc flow logs are in cloud watch. So i have added the access key secret key and log group arn in cloud watch session. and… --- ## [Filebeat-oss repository returns 404](https://discuss.elastic.co/t/filebeat-oss-repository-returns-404/373701)
**Author:** [@Rihards](https://discuss.elastic.co/u/Rihards)\ **Replies:** 0\ **Last updated:** [January 27, 2025, 8:20am UTC](https://discuss.elastic.co/t/filebeat-oss-repository-returns-404/373701 "2025-01-27T08:20:02Z")
Repositories for APT and YUM | Filebeat Reference \[8.17\] | Elastic says that the OSS version setup should contain: baseurl=https://artifacts.elastic.co/packages/oss-8.x/yum But that URL returns 404. Is the repository … --- ## [How Can Elasticsearch Be Optimized for AI Workloads on Laptops?](https://discuss.elastic.co/t/how-can-elasticsearch-be-optimized-for-ai-workloads-on-laptops/373695)
**Author:** [@leoarthur](https://discuss.elastic.co/u/leoarthur)\ **Replies:** 1\ **Last updated:** [January 27, 2025, 7:58am UTC](https://discuss.elastic.co/t/how-can-elasticsearch-be-optimized-for-ai-workloads-on-laptops/373695 "2025-01-27T07:58:05Z")
Hi everyone, I’ve recently started using Elasticsearch on my AI-enabled laptop (with a decent GPU and an AI accelerator), primarily for small-scale machine learning experiments and AI data processing. However, I’ve noti… --- ## [Elasticsearch with trino not working for a specific field present in an index](https://discuss.elastic.co/t/elasticsearch-with-trino-not-working-for-a-specific-field-present-in-an-index/373684)
**Author:** [@Karan\_Rawat](https://discuss.elastic.co/u/Karan_Rawat)\ **Replies:** 0\ **Last updated:** [January 26, 2025, 3:41pm UTC](https://discuss.elastic.co/t/elasticsearch-with-trino-not-working-for-a-specific-field-present-in-an-index/373684 "2025-01-26T15:41:59Z")
just using trino on my elasticsearch ,ran a query on my accounts index SELECT \* FROM elasticsearch."default".accounts WHERE id = 24862540; which resulted in an error SQL Error \[58\]: Query failed (#20250126\_153854\_0014… --- ## [Add custom field via Fleet](https://discuss.elastic.co/t/add-custom-field-via-fleet/373681)
**Author:** [@Viktor\_Movita](https://discuss.elastic.co/u/Viktor_Movita)\ **Replies:** 0\ **Last updated:** [January 26, 2025, 2:11pm UTC](https://discuss.elastic.co/t/add-custom-field-via-fleet/373681 "2025-01-26T14:11:11Z")
Hello everyone, I am using Elastic Agents and managing them through the Fleet server. I usually add an ID to every document collected by the agent using the following option: - add\_id: target\_field: "event.id" Can … --- ## [ILM problem](https://discuss.elastic.co/t/ilm-problem/373646)
**Author:** [@Mehran\_Noorani](https://discuss.elastic.co/u/Mehran_Noorani)\ **Replies:** 12\ **Last updated:** [January 26, 2025, 1:06am UTC](https://discuss.elastic.co/t/ilm-problem/373646 "2025-01-26T01:06:30Z")
hello all . I'm using ELK 8.17.1 and have ILM configured with a Hot phase. my problem is : my policy : name = policy\_ipas age = 2min size = 5mb and my indexes : also index2 : No logs are thrown inside it. ===… --- ## [Unable to create fleet server with default logstash output](https://discuss.elastic.co/t/unable-to-create-fleet-server-with-default-logstash-output/373663)
**Author:** [@Vladimir7172](https://discuss.elastic.co/u/Vladimir7172)\ **Replies:** 1\ **Last updated:** [January 25, 2025, 10:49pm UTC](https://discuss.elastic.co/t/unable-to-create-fleet-server-with-default-logstash-output/373663 "2025-01-25T22:49:31Z")
I encountered a problem that completely interferes with the normal operation of the service. I opened an issue on Git, but so far they are silent, I want to know if this is the expected behavior Details below Stack Ve… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=107) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=109)