# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=11 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 12 --- ## [BUG: xml\_query endlessly repeats same record in Winlogbeat 9.2.7+, 9.3](https://discuss.elastic.co/t/bug-xml-query-endlessly-repeats-same-record-in-winlogbeat-9-2-7-9-3/386112)
**Author:** [@lh317](https://discuss.elastic.co/u/lh317)\ **Replies:** 1\ **Last updated:** [April 30, 2026, 3:45pm UTC](https://discuss.elastic.co/t/bug-xml-query-endlessly-repeats-same-record-in-winlogbeat-9-2-7-9-3/386112 "2026-04-30T15:45:02Z")
I've run into an issue with newer versions of Winlogbeat that attempt to perform gap detection against the Windows channels. First, create any XML query that results in gaps in the record IDs (this should hopefully work… --- ## [Custom user guide - Link](https://discuss.elastic.co/t/custom-user-guide-link/386104)
**Author:** [@Vignesh2](https://discuss.elastic.co/u/Vignesh2)\ **Replies:** 1\ **Last updated:** [April 30, 2026, 9:37am UTC](https://discuss.elastic.co/t/custom-user-guide-link/386104 "2026-04-30T09:37:53Z")
Hi, I have a custom user guide (PDF) that explains how to use our dashboards, alerts, and other features. I’d like to know if there’s a way to integrate or attach this guide directly within the Kibana UI—something like… --- ## [Winlogbeat supports for TPM Windows certificates store](https://discuss.elastic.co/t/winlogbeat-supports-for-tpm-windows-certificates-store/386098)
**Author:** [@MiguelN](https://discuss.elastic.co/u/MiguelN)\ **Replies:** 0\ **Last updated:** [April 29, 2026, 2:57pm UTC](https://discuss.elastic.co/t/winlogbeat-supports-for-tpm-windows-certificates-store/386098 "2026-04-29T14:57:01Z")
I want to deploy per-device client certificates to Windows workstations via Intune SCEP, with the private key generated and bound to the TPM (Microsoft Platform Crypto Provider, non-exportable). Winlogbeat would then use… --- ## [Freeze one or more columns in Lens Table visualisation](https://discuss.elastic.co/t/freeze-one-or-more-columns-in-lens-table-visualisation/378300)
**Author:** [@tallakh](https://discuss.elastic.co/u/tallakh)\ **Replies:** 4\ **Last updated:** [April 29, 2026, 1:15pm UTC](https://discuss.elastic.co/t/freeze-one-or-more-columns-in-lens-table-visualisation/378300 "2026-04-29T13:15:42Z")
I have a Lens Table that contains quite many columns which leads to a lot of horisontal scrolling. Is it possible to pin/freeze columns? That would make it a lot easier to keep track when scrolling? It would also be rea… --- ## [Alert re-triggering & limited context (recovery actions)](https://discuss.elastic.co/t/alert-re-triggering-limited-context-recovery-actions/386049)
**Author:** [@Actor01](https://discuss.elastic.co/u/Actor01)\ **Replies:** 1\ **Last updated:** [April 29, 2026, 7:42am UTC](https://discuss.elastic.co/t/alert-re-triggering-limited-context-recovery-actions/386049 "2026-04-29T07:42:31Z")
Hello, we are currently working with Kibana alerting in a production environment and ran into a couple of challenges. We would like to ask if there are recommended approaches or built-in solutions for the following scen… --- ## [Unifi Syslog ECS Mapping](https://discuss.elastic.co/t/unifi-syslog-ecs-mapping/386089)
**Author:** [@AxelZoldik](https://discuss.elastic.co/u/AxelZoldik)\ **Replies:** 0\ **Last updated:** [April 29, 2026, 7:24am UTC](https://discuss.elastic.co/t/unifi-syslog-ecs-mapping/386089 "2026-04-29T07:24:33Z")
Hello everyone I hope you are all doing well, I'm wondering if someone has already a pipeline logstash for mapping Unifi firewall logs to ECS, It might be worth to create an integration directly in Kibana if I'm not al… --- ## [Clarification on shard allocation with 4 nodes across 3 zones using awareness](https://discuss.elastic.co/t/clarification-on-shard-allocation-with-4-nodes-across-3-zones-using-awareness/386077)
**Author:** [@yago82](https://discuss.elastic.co/u/yago82)\ **Replies:** 1\ **Last updated:** [April 29, 2026, 6:15am UTC](https://discuss.elastic.co/t/clarification-on-shard-allocation-with-4-nodes-across-3-zones-using-awareness/386077 "2026-04-29T06:15:10Z")
Hi, I’d like to clarify how shard allocation behaves in a specific setup using shard allocation awareness. Cluster setup: 4 data nodes 3 zones (AZ-A, AZ-B, AZ-C) AZ-A: 2 nodes AZ-B: 1 node AZ-C: 1 node … --- ## [Parse syslog with filepath backslashes](https://discuss.elastic.co/t/parse-syslog-with-filepath-backslashes/385919)
**Author:** [@Adrian\_Wallis](https://discuss.elastic.co/u/Adrian_Wallis)\ **Replies:** 2\ **Last updated:** [April 28, 2026, 2:28pm UTC](https://discuss.elastic.co/t/parse-syslog-with-filepath-backslashes/385919 "2026-04-28T14:28:55Z")
Hello, I have some syslogs to parse which are in a very basic comma delimited format. Everything looks and works fine apart from a file path with backslashes. I've seen several suggestions on the forum around mutate an… --- ## [Data from server is not flowing from elastic agent to elastic](https://discuss.elastic.co/t/data-from-server-is-not-flowing-from-elastic-agent-to-elastic/385333)
**Author:** [@sathish12](https://discuss.elastic.co/u/sathish12)\ **Replies:** 5\ **Last updated:** [April 28, 2026, 2:16pm UTC](https://discuss.elastic.co/t/data-from-server-is-not-flowing-from-elastic-agent-to-elastic/385333 "2026-04-28T14:16:46Z")
I have installed fleet server in one machine and server agent to collect logs and metrics in one web server. for the both the agents I have created respective default policies and integration. For web server, I have prov… --- ## [How to filter an ESQL dashboard on a field in the index being looked up on](https://discuss.elastic.co/t/how-to-filter-an-esql-dashboard-on-a-field-in-the-index-being-looked-up-on/386052)
**Author:** [@TSlump](https://discuss.elastic.co/u/TSlump)\ **Replies:** 3\ **Last updated:** [April 28, 2026, 10:07am UTC](https://discuss.elastic.co/t/how-to-filter-an-esql-dashboard-on-a-field-in-the-index-being-looked-up-on/386052 "2026-04-28T10:07:39Z")
Hi, I'm having trouble finding a nice intuitive way to filter an ESQL dashboard. Any ideas would be greatly appreciated ! I have two indices: buildings and rooms, where each room has a building Id. On the dashboard I ha… --- ## [Ingesting daily health data into Logstash pipeline for time-series monitoring](https://discuss.elastic.co/t/ingesting-daily-health-data-into-logstash-pipeline-for-time-series-monitoring/386059)
**Author:** [@jesscia](https://discuss.elastic.co/u/jesscia)\ **Replies:** 1\ **Last updated:** [April 28, 2026, 4:58am UTC](https://discuss.elastic.co/t/ingesting-daily-health-data-into-logstash-pipeline-for-time-series-monitoring/386059 "2026-04-28T04:58:50Z")
Hello everyone, I am working on a Logstash pipeline to ingest and process daily health monitoring data from a home BP device. The context of this data is post-operative recovery after a medical procedure (DIEP flap bre… --- ## [Does doing a POST query via the devtools alter any elastic data or database?](https://discuss.elastic.co/t/does-doing-a-post-query-via-the-devtools-alter-any-elastic-data-or-database/385936)
**Author:** [@Whoami1980](https://discuss.elastic.co/u/Whoami1980)\ **Replies:** 2\ **Last updated:** [April 28, 2026, 4:07am UTC](https://discuss.elastic.co/t/does-doing-a-post-query-via-the-devtools-alter-any-elastic-data-or-database/385936 "2026-04-28T04:07:00Z")
Its been brought to my attention that my post query is updating the database. I would like to seek clarification that such queries like below are purely querying instead of altering or updating any data in the elastics e… --- ## [Filebeat filestream offset mismatch when using include\_message with multiline](https://discuss.elastic.co/t/filebeat-filestream-offset-mismatch-when-using-include-message-with-multiline/386057)
**Author:** [@sem1308](https://discuss.elastic.co/u/sem1308)\ **Replies:** 0\ **Last updated:** [April 27, 2026, 7:26pm UTC](https://discuss.elastic.co/t/filebeat-filestream-offset-mismatch-when-using-include-message-with-multiline/386057 "2026-04-27T19:26:47Z")
Version 8.18.4 Operating System macOS (build & test) Steps to Reproduce 1. Configuration filebeat.inputs: - type: filestream id: filebeat-test paths: - /path/to/log/\* parsers: - include\_message.patterns:… --- ## [A major issue with cluster state handling and persistent tasks cancellation](https://discuss.elastic.co/t/a-major-issue-with-cluster-state-handling-and-persistent-tasks-cancellation/386014)
**Author:** [@sherman81](https://discuss.elastic.co/u/sherman81)\ **Replies:** 7\ **Last updated:** [April 27, 2026, 8:15am UTC](https://discuss.elastic.co/t/a-major-issue-with-cluster-state-handling-and-persistent-tasks-cancellation/386014 "2026-04-27T08:15:53Z")
We are using ES 9.3.0. Our cluster has many data streams and indices. The cluster state is ~350 MB (compressed on disk) under normal conditions. I mistakenly scheduled a large number of downsampling tasks for historica… --- ## [Logstash 8.19.x is required which java 17 or Java 21](https://discuss.elastic.co/t/logstash-8-19-x-is-required-which-java-17-or-java-21/386036)
**Author:** [@Siddhartha](https://discuss.elastic.co/u/Siddhartha)\ **Replies:** 2\ **Last updated:** [April 27, 2026, 7:06am UTC](https://discuss.elastic.co/t/logstash-8-19-x-is-required-which-java-17-or-java-21/386036 "2026-04-27T07:06:23Z")
Logstash 8.19.x is required which java 17 or Java 21 though JDK 21 is bundled with it --- ## [Kibana Workflows and secrets](https://discuss.elastic.co/t/kibana-workflows-and-secrets/386028)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 3\ **Last updated:** [April 25, 2026, 8:27am UTC](https://discuss.elastic.co/t/kibana-workflows-and-secrets/386028 "2026-04-25T08:27:41Z")
Hello, I’ve been experimenting with Kibana Workflows and really like the direction. It’s a powerful addition for automation and enrichment use cases. One thing I’m currently struggling with is securely handling secrets… --- ## [Kibana 8.19.9 bootstrap reports "Integrity check failed for @elastic/eui"](https://discuss.elastic.co/t/kibana-8-19-9-bootstrap-reports-integrity-check-failed-for-elastic-eui/384414)
**Author:** [@kbujold\_wr](https://discuss.elastic.co/u/kbujold_wr)\ **Replies:** 1\ **Last updated:** [April 23, 2026, 3:35pm UTC](https://discuss.elastic.co/t/kibana-8-19-9-bootstrap-reports-integrity-check-failed-for-elastic-eui/384414 "2026-04-23T15:35:45Z")
Hi, We have moved from ELK 8.18.3 to ELK 8.19.9. There appears to have been changes with bootstrap. I am getting this error BUILD\_TS\_REFS\_DISABLE=true yarn kbn bootstrap yarn run v1.22.22 $ node --no-experimental-requi… --- ## [Index lifecycle policy not being applied on indices after updating](https://discuss.elastic.co/t/index-lifecycle-policy-not-being-applied-on-indices-after-updating/386004)
**Author:** [@YousefNein](https://discuss.elastic.co/u/YousefNein)\ **Replies:** 5\ **Last updated:** [April 23, 2026, 3:00pm UTC](https://discuss.elastic.co/t/index-lifecycle-policy-not-being-applied-on-indices-after-updating/386004 "2026-04-23T15:00:55Z")
As the title suggests, I have updated an index lifecycle policy, and the old indices are still stuck with the old settings. I have tried refreshing the index, clearing the cache, removing the ILM policy and adding it aga… --- ## [Crowdstrike Integration Degraded](https://discuss.elastic.co/t/crowdstrike-integration-degraded/385987)
**Author:** [@4l13v](https://discuss.elastic.co/u/4l13v)\ **Replies:** 2\ **Last updated:** [April 22, 2026, 1:23pm UTC](https://discuss.elastic.co/t/crowdstrike-integration-degraded/385987 "2026-04-22T13:23:18Z")
The problem is 3 months ago, I have integrated Crowdstrike via API. It okay, and I am getting alerts from Falcon without problems. But Fleet server came unhealthy in these days. {failed to decode discover body: EOF} . … --- ## [Logstash SNMP plugin not polling all OIDs](https://discuss.elastic.co/t/logstash-snmp-plugin-not-polling-all-oids/385975)
**Author:** [@tom.verbeek](https://discuss.elastic.co/u/tom.verbeek)\ **Replies:** 8\ **Last updated:** [April 22, 2026, 12:40pm UTC](https://discuss.elastic.co/t/logstash-snmp-plugin-not-polling-all-oids/385975 "2026-04-22T12:40:11Z")
Hi, I'm setting up a logstash that has a snmp input plugin and an elasticsearch output. Everything works except 1 specific OID, I checked and the OID has data and it is available. I ca't figure out why he is not pollin… --- ## [Elasticsearch Indexes are being created for Older dates](https://discuss.elastic.co/t/elasticsearch-indexes-are-being-created-for-older-dates/385959)
**Author:** [@Saikumar77](https://discuss.elastic.co/u/Saikumar77)\ **Replies:** 6\ **Last updated:** [April 22, 2026, 12:34pm UTC](https://discuss.elastic.co/t/elasticsearch-indexes-are-being-created-for-older-dates/385959 "2026-04-22T12:34:36Z")
Hi, We are hosting the ELK Stack on a VM and using Index Lifecycle Policies to manage log retention for different environments. However, we are currently facing an issue. We have configured a 4-day retention policy, an… --- ## [Elastic - ESET AV integration](https://discuss.elastic.co/t/elastic-eset-av-integration/385971)
**Author:** [@PatreKerier](https://discuss.elastic.co/u/PatreKerier)\ **Replies:** 2\ **Last updated:** [April 22, 2026, 12:25pm UTC](https://discuss.elastic.co/t/elastic-eset-av-integration/385971 "2026-04-22T12:25:04Z")
Good afternoon! Please tell me if anyone has configured the integration of ESET AntiVirus with ELASTIC. I deployed a Linux-based syslog server, specified the address and port 514 or 6514 in ESET, but there are no logs, … --- ## [Elasticsearch API request](https://discuss.elastic.co/t/elasticsearch-api-request/385892)
**Author:** [@Cdotisp\_Delhi](https://discuss.elastic.co/u/Cdotisp_Delhi)\ **Replies:** 5\ **Last updated:** [April 22, 2026, 10:22am UTC](https://discuss.elastic.co/t/elasticsearch-api-request/385892 "2026-04-22T10:22:47Z")
GET /lb-2026.04/\_search { "size": 10000, "aggs": { "last\_entry": { "max": { "field": "@timestamp" } } } } I want to retrieve all latest timestamp documents from Index lb-2026.04 but number of documents are exc… --- ## [Using multiple path.data (local + NAS/SAN per node folders) to separate hot and old data – is this supported?](https://discuss.elastic.co/t/using-multiple-path-data-local-nas-san-per-node-folders-to-separate-hot-and-old-data-is-this-supported/385992)
**Author:** [@Shubham\_Khodpe](https://discuss.elastic.co/u/Shubham_Khodpe)\ **Replies:** 2\ **Last updated:** [April 22, 2026, 9:01am UTC](https://discuss.elastic.co/t/using-multiple-path-data-local-nas-san-per-node-folders-to-separate-hot-and-old-data-is-this-supported/385992 "2026-04-22T09:01:56Z")
Hi Team, I am working on a Elasticsearch cluster and need clarification on a storage architecture I am planning. My Architecture I have the following setup: 4 Elasticsearch data nodes Node1 → 1 TB Node2 → 1 TB Nod… --- ## [Cluster holds an odd number of shards](https://discuss.elastic.co/t/cluster-holds-an-odd-number-of-shards/385986)
**Author:** [@stefws](https://discuss.elastic.co/u/stefws)\ **Replies:** 2\ **Last updated:** [April 22, 2026, 7:29am UTC](https://discuss.elastic.co/t/cluster-holds-an-odd-number-of-shards/385986 "2026-04-22T07:29:39Z")
Hi Wondering about the number of shards in our v.8.19.9 cluster been odd like this when all shards ought to have exactly 1 replica: $ eshealth { "cluster\_name" : "pjp-es-epj", "status" : "green", "timed\_out" : fa… --- ## [Unified Multilingual search](https://discuss.elastic.co/t/unified-multilingual-search/385388)
**Author:** [@cptX](https://discuss.elastic.co/u/cptX)\ **Replies:** 1\ **Last updated:** [April 21, 2026, 2:28pm UTC](https://discuss.elastic.co/t/unified-multilingual-search/385388 "2026-04-21T14:28:16Z")
UPDATE: Sorry for posting it here, it was meant for magento 2, smile/elasticsuite. I’ll keep it here for reference if somebody wants to shed some light on my problems. Hi, several years now I’m facing the following prob… --- ## [ES|QL LOOKUP JOIN between fields containing a list of values](https://discuss.elastic.co/t/es-ql-lookup-join-between-fields-containing-a-list-of-values/385960)
**Author:** [@smyttie](https://discuss.elastic.co/u/smyttie)\ **Replies:** 2\ **Last updated:** [April 21, 2026, 4:58am UTC](https://discuss.elastic.co/t/es-ql-lookup-join-between-fields-containing-a-list-of-values/385960 "2026-04-21T04:58:54Z")
Hi all, creating a LOOKUP JOIN query is working fine, but I am not getting results when I have to do it between 2 fields containing a list of values. For example : main index field = "sizes" : \["S", "M"\] lookup index… --- ## [Improving ElasticSearch relevance with better normalization (beyond stemming)](https://discuss.elastic.co/t/improving-elasticsearch-relevance-with-better-normalization-beyond-stemming/385966)
**Author:** [@tonyj](https://discuss.elastic.co/u/tonyj)\ **Replies:** 0\ **Last updated:** [April 20, 2026, 4:11pm UTC](https://discuss.elastic.co/t/improving-elasticsearch-relevance-with-better-normalization-beyond-stemming/385966 "2026-04-20T16:11:20Z")
Hi everyone, In several Elasticsearch projects we’ve seen stemming introduce noise early in the analysis pipeline, especially in multilingual setups. For example: “organization” → “organ” “news” → “new” “united” → “u… --- ## [Netflow Fleet integration problem](https://discuss.elastic.co/t/netflow-fleet-integration-problem/385965)
**Author:** [@BenoitSERRA](https://discuss.elastic.co/u/BenoitSERRA)\ **Replies:** 0\ **Last updated:** [April 20, 2026, 3:34pm UTC](https://discuss.elastic.co/t/netflow-fleet-integration-problem/385965 "2026-04-20T15:34:47Z")
Hi all, Not sure if the category is the right one here, but here goes. I've deployed an ELK stack on a server of mine and deployed Fleet and several agents. I've deployed Fleet's Netflow integration and set up my OPNse… --- ## [Elasticsearch data node instability and indexing failures when using NAS (shared storage) with separate folders per node](https://discuss.elastic.co/t/elasticsearch-data-node-instability-and-indexing-failures-when-using-nas-shared-storage-with-separate-folders-per-node/385952)
**Author:** [@Shubham\_Khodpe](https://discuss.elastic.co/u/Shubham_Khodpe)\ **Replies:** 3\ **Last updated:** [April 20, 2026, 12:41pm UTC](https://discuss.elastic.co/t/elasticsearch-data-node-instability-and-indexing-failures-when-using-nas-shared-storage-with-separate-folders-per-node/385952 "2026-04-20T12:41:48Z")
I am facing stability and performance issues in my Elasticsearch cluster and would like to understand if the storage architecture is the root cause. We have multiple Elasticsearch data nodes running on Windows servers. … [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=10) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=12)