# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=112 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 113 --- ## [Elasticsearch is very slow](https://discuss.elastic.co/t/elasticsearch-is-very-slow/373362)
**Author:** [@Unknown\_Device](https://discuss.elastic.co/u/Unknown_Device)\ **Replies:** 6\ **Last updated:** [January 20, 2025, 3:45am UTC](https://discuss.elastic.co/t/elasticsearch-is-very-slow/373362 "2025-01-20T03:45:54Z")
I set up Elastic Search about a month ago for my pet-project. Elastic Search is hosted locally on my machine on Windows. Everything was working fine. Now when I try to access it in any way it doesn't respond and I get an… --- ## [Documents Dropped in Ingestion Pipeline for Okta Integration](https://discuss.elastic.co/t/documents-dropped-in-ingestion-pipeline-for-okta-integration/373375)
**Author:** [@Felipe\_Matamoros](https://discuss.elastic.co/u/Felipe_Matamoros)\ **Replies:** 0\ **Last updated:** [January 20, 2025, 3:30am UTC](https://discuss.elastic.co/t/documents-dropped-in-ingestion-pipeline-for-okta-integration/373375 "2025-01-20T03:30:53Z")
Hello Elastic Community, I hope you’re all doing well. I’m reaching out to request your guidance on an issue I’m facing with an ingestion pipeline in Elastic for an Okta 2.11 integration. Some documents are being dropp… --- ## [Segregating Data Between Spaces in a Single Deployment](https://discuss.elastic.co/t/segregating-data-between-spaces-in-a-single-deployment/373370)
**Author:** [@Core990](https://discuss.elastic.co/u/Core990)\ **Replies:** 2\ **Last updated:** [January 19, 2025, 11:47pm UTC](https://discuss.elastic.co/t/segregating-data-between-spaces-in-a-single-deployment/373370 "2025-01-19T23:47:47Z")
Hello, I have a use case where I want to create multiple spaces in a single Elastic deployment, and I need to ensure strict data segregation between these spaces. Specifically: I want the logs collected by agents in S… --- ## [Problem using ES as a service on W10](https://discuss.elastic.co/t/problem-using-es-as-a-service-on-w10/373356)
**Author:** [@mrodent](https://discuss.elastic.co/u/mrodent)\ **Replies:** 2\ **Last updated:** [January 19, 2025, 6:38pm UTC](https://discuss.elastic.co/t/problem-using-es-as-a-service-on-w10/373356 "2025-01-19T18:38:20Z")
I saw this question from 2021. But for one thing my system doesn't have an "elastic-agent.exe" file. I was using ES 7.10.2 up until about 3 years ago. Then I decided to upgrade to 8.x ... and eventually settled on 8.13.… --- ## [Need to include a certain field from my Log into the Message part of my log without pulling the entire log in](https://discuss.elastic.co/t/need-to-include-a-certain-field-from-my-log-into-the-message-part-of-my-log-without-pulling-the-entire-log-in/373342)
**Author:** [@backlog](https://discuss.elastic.co/u/backlog)\ **Replies:** 5\ **Last updated:** [January 18, 2025, 12:41pm UTC](https://discuss.elastic.co/t/need-to-include-a-certain-field-from-my-log-into-the-message-part-of-my-log-without-pulling-the-entire-log-in/373342 "2025-01-18T12:41:16Z")
Hello, I am currently using security onion for pulling in zeek logs to our SIEM, and they are very particular about the JSON formatting of the data to have it show up properly parsed in the SIEM. For my logstash pipeli… --- ## [New Kibana install but "urlForwarding" error after login](https://discuss.elastic.co/t/new-kibana-install-but-urlforwarding-error-after-login/365310)
**Author:** [@ivanlawrence](https://discuss.elastic.co/u/ivanlawrence)\ **Replies:** 3\ **Last updated:** [January 18, 2025, 10:29am UTC](https://discuss.elastic.co/t/new-kibana-install-but-urlforwarding-error-after-login/365310 "2025-01-18T10:29:48Z")
After following the ELK demo install I can login but get a page with an error Version: 8.15.0 Build: 76360 Error: Definition of plugin "urlForwarding" not found and may have failed to load. at https://\/kib… --- ## [Deployment architecture of ELK stack in on premise Windows Server](https://discuss.elastic.co/t/deployment-architecture-of-elk-stack-in-on-premise-windows-server/373251)
**Author:** [@grootlin](https://discuss.elastic.co/u/grootlin)\ **Replies:** 6\ **Last updated:** [January 18, 2025, 12:33am UTC](https://discuss.elastic.co/t/deployment-architecture-of-elk-stack-in-on-premise-windows-server/373251 "2025-01-18T00:33:47Z")
I have found myself as an administrator in an environment where ELK stack is used for log aggregation. We need to be pulling in Syslog data from our Network devices, virtualization cluster, and logs from our Windows / Li… --- ## [Bug in Metricbeat Prometheus module causes \_count and \_sum of summary typed to be labeled with quantile](https://discuss.elastic.co/t/bug-in-metricbeat-prometheus-module-causes-count-and-sum-of-summary-typed-to-be-labeled-with-quantile/373344)
**Author:** [@smarsching](https://discuss.elastic.co/u/smarsching)\ **Replies:** 0\ **Last updated:** [January 17, 2025, 10:20pm UTC](https://discuss.elastic.co/t/bug-in-metricbeat-prometheus-module-causes-count-and-sum-of-summary-typed-to-be-labeled-with-quantile/373344 "2025-01-17T22:20:24Z")
I believe that I found a bug in the Prometheus module of Metricbeat. Consider the following Prometheus metric of type summary: # HELP cassandra\_client\_request\_latency\_seconds Request latency. # TYPE cassandra\_client\_req… --- ## [Running Elastic agent 8.17 on Raspberry Pi 4](https://discuss.elastic.co/t/running-elastic-agent-8-17-on-raspberry-pi-4/373335)
**Author:** [@Vincent\_Maury](https://discuss.elastic.co/u/Vincent_Maury)\ **Replies:** 1\ **Last updated:** [January 17, 2025, 3:18pm UTC](https://discuss.elastic.co/t/running-elastic-agent-8-17-on-raspberry-pi-4/373335 "2025-01-17T15:18:16Z")
Hi! I'm trying to run the Elastic agent 8.17.0 on a raspberry Pi 4. I tried several flavours, starting with the arm64: vincent@raspberrypi:~/elastic-agent-8.17.0-linux-arm64 $ sudo ./elastic-agent install --url=URL --… --- ## [ESQL - diff with NOW()](https://discuss.elastic.co/t/esql-diff-with-now/373321)
**Author:** [@mortenb123](https://discuss.elastic.co/u/mortenb123)\ **Replies:** 1\ **Last updated:** [January 17, 2025, 2:36pm UTC](https://discuss.elastic.co/t/esql-diff-with-now/373321 "2025-01-17T14:36:22Z")
How can I create a nowdiff: FROM \*.events.\* | limit 1 | EVAL mynow=now() | KEEP time,mynow time mynow 2023-05-20T03:22:16.976Z 2025-01-17T10:07:54.328Z But: FROM \*.events.\* | li… --- ## [No doc count in destination index of transform](https://discuss.elastic.co/t/no-doc-count-in-destination-index-of-transform/373284)
**Author:** [@sintim](https://discuss.elastic.co/u/sintim)\ **Replies:** 3\ **Last updated:** [January 17, 2025, 2:00pm UTC](https://discuss.elastic.co/t/no-doc-count-in-destination-index-of-transform/373284 "2025-01-17T14:00:27Z")
I created a transform on ELK and it is up and HEALTHY but till now there's still no documents in the destination index for a data view. It's been about 6 hours. Is that supposed to be normal? or if not how can I check if… --- ## [System integration not follow new mapping structure for index.mapping.source.mode](https://discuss.elastic.co/t/system-integration-not-follow-new-mapping-structure-for-index-mapping-source-mode/373330)
**Author:** [@dbc](https://discuss.elastic.co/u/dbc)\ **Replies:** 0\ **Last updated:** [January 17, 2025, 1:34pm UTC](https://discuss.elastic.co/t/system-integration-not-follow-new-mapping-structure-for-index-mapping-source-mode/373330 "2025-01-17T13:34:41Z")
After updating Elastic to version 8.17, and having updated all integrations and Elastic Agents, I noticed that I get several Critical deprecation issues related to the change to use index.mapping.source.mode. Having loo… --- ## [Loss of cloudwatch data in filebeat](https://discuss.elastic.co/t/loss-of-cloudwatch-data-in-filebeat/361479)
**Author:** [@vijay117](https://discuss.elastic.co/u/vijay117)\ **Replies:** 2\ **Last updated:** [January 17, 2025, 10:07am UTC](https://discuss.elastic.co/t/loss-of-cloudwatch-data-in-filebeat/361479 "2025-01-17T10:07:32Z")
Hi Community, I observed that there is some data is getting lost while ingesting cloudwatch logs to logstash via filebeat. Any idea how to debug/fix the issue? --- ## [Centralized managed logstash pipeline issue](https://discuss.elastic.co/t/centralized-managed-logstash-pipeline-issue/373268)
**Author:** [@Joey\_Visbeen](https://discuss.elastic.co/u/Joey_Visbeen)\ **Replies:** 2\ **Last updated:** [January 17, 2025, 9:22am UTC](https://discuss.elastic.co/t/centralized-managed-logstash-pipeline-issue/373268 "2025-01-17T09:22:58Z")
We use the centralized pipeline manager in Kibana to update and upload Logstash pipeline(s) to our Logstash server. In general, everything works fine, but in the case an output filter is unable to process an event due to… --- ## [Kibana Lens Table: Filter Table Rows](https://discuss.elastic.co/t/kibana-lens-table-filter-table-rows/373286)
**Author:** [@lavaplanet](https://discuss.elastic.co/u/lavaplanet)\ **Replies:** 3\ **Last updated:** [January 17, 2025, 8:44am UTC](https://discuss.elastic.co/t/kibana-lens-table-filter-table-rows/373286 "2025-01-17T08:44:02Z")
Hi there, I want to create a Kibana lens table where the rows are divided based on field values. However, I want to filter the individual rows by specific values. I only want to see all rows starting with Keyword\_Aor… --- ## [Combination of faceted and full-text query](https://discuss.elastic.co/t/combination-of-faceted-and-full-text-query/373310)
**Author:** [@SLEZ\_DOM](https://discuss.elastic.co/u/SLEZ_DOM)\ **Replies:** 1\ **Last updated:** [January 17, 2025, 7:54am UTC](https://discuss.elastic.co/t/combination-of-faceted-and-full-text-query/373310 "2025-01-17T07:54:58Z")
Task: I am using full-text search and faceted search in a single query. However, I encountered an issue: if the search by query (e.g., brand or product name) yields no results, it returns all products that match the fil… --- ## [ILM action - lifecycle action \[migrate\] waiting for \[3\] shards to be moved to the \[data\_warm\] tier](https://discuss.elastic.co/t/ilm-action-lifecycle-action-migrate-waiting-for-3-shards-to-be-moved-to-the-data-warm-tier/373179)
**Author:** [@NikolaySh1](https://discuss.elastic.co/u/NikolaySh1)\ **Replies:** 2\ **Last updated:** [January 17, 2025, 7:52am UTC](https://discuss.elastic.co/t/ilm-action-lifecycle-action-migrate-waiting-for-3-shards-to-be-moved-to-the-data-warm-tier/373179 "2025-01-17T07:52:59Z")
Hello everyone! I have ILM configured: "filebeat-prod": { "version": 5, "modified\_date": "2025-01-13T15:41:59.287Z", "policy": { "phases": { "warm": { "min\_age": "1d", "actions": { … --- ## [Regarding the Metricbeat ship the Metrics One to another Cluster](https://discuss.elastic.co/t/regarding-the-metricbeat-ship-the-metrics-one-to-another-cluster/373265)
**Author:** [@sarath.vinsar](https://discuss.elastic.co/u/sarath.vinsar)\ **Replies:** 0\ **Last updated:** [January 16, 2025, 9:37am UTC](https://discuss.elastic.co/t/regarding-the-metricbeat-ship-the-metrics-one-to-another-cluster/373265 "2025-01-16T09:37:30Z")
I have two elasticsearch cluster's that named as es-dev and another one is elastisearch, In the es-dev cluster side we have 3master and 3data nodes and one kibana node. And we have another one cluster that was named as… --- ## [Difference between \`terms\` and \`term\` query for a single term?](https://discuss.elastic.co/t/difference-between-terms-and-term-query-for-a-single-term/373248)
**Author:** [@yeikel](https://discuss.elastic.co/u/yeikel)\ **Replies:** 5\ **Last updated:** [January 17, 2025, 5:00am UTC](https://discuss.elastic.co/t/difference-between-terms-and-term-query-for-a-single-term/373248 "2025-01-17T05:00:39Z")
Is there any significant implementation difference between terms and term query when there is a single term to search? In a situation where I know the number of terms in advance, is it worth it to implement them separat… --- ## [Elasticsearch 8.17.0 failing to start in minikube with older manifests (used to work with 7.12.1)](https://discuss.elastic.co/t/elasticsearch-8-17-0-failing-to-start-in-minikube-with-older-manifests-used-to-work-with-7-12-1/373299)
**Author:** [@dangerouspython](https://discuss.elastic.co/u/dangerouspython)\ **Replies:** 0\ **Last updated:** [January 16, 2025, 9:53pm UTC](https://discuss.elastic.co/t/elasticsearch-8-17-0-failing-to-start-in-minikube-with-older-manifests-used-to-work-with-7-12-1/373299 "2025-01-16T21:53:33Z")
Elasticsearch Version 8.17.0 Installed Plugins kibana, istio Java Version bundled OS Version Darwin GGN-MAC-10089 24.2.0 Darwin Kernel Version 24.2.0: Fri Dec 6 18:41:43 PST 2024; root:xnu-11215.61.5~2/RELEASE\_X86\_64… --- ## [Index breaking for a few seconds/minutes](https://discuss.elastic.co/t/index-breaking-for-a-few-seconds-minutes/370901)
**Author:** [@nunex\_17](https://discuss.elastic.co/u/nunex_17)\ **Replies:** 7\ **Last updated:** [January 16, 2025, 9:31pm UTC](https://discuss.elastic.co/t/index-breaking-for-a-few-seconds-minutes/370901 "2025-01-16T21:31:36Z")
Started to notice that my indexing rate has some breaks which leads delay in the indexing of the documents. What can be the cause of this? --- ## [ES|QL : Adding Days to a Date](https://discuss.elastic.co/t/es-ql-adding-days-to-a-date/373288)
**Author:** [@erikg](https://discuss.elastic.co/u/erikg)\ **Replies:** 3\ **Last updated:** [January 16, 2025, 9:02pm UTC](https://discuss.elastic.co/t/es-ql-adding-days-to-a-date/373288 "2025-01-16T21:02:29Z")
Hello, I was wondering if its possible with ES|QL to use a date field and add x amount of days to create a new date field. Or would a runtime field work for this? Or would an ingest pipeline be the only solution. Tha… --- ## [Does searching through alias return data from all rolling index?](https://discuss.elastic.co/t/does-searching-through-alias-return-data-from-all-rolling-index/373292)
**Author:** [@linkerc](https://discuss.elastic.co/u/linkerc)\ **Replies:** 0\ **Last updated:** [January 16, 2025, 8:01pm UTC](https://discuss.elastic.co/t/does-searching-through-alias-return-data-from-all-rolling-index/373292 "2025-01-16T20:01:13Z")
Version 8.10.2 Is this new change comparing to version 7.x? What if I just want to search the latest rolling index pointed by the alias? Anybody knows why such behavior change? --- ## [Shard recovery in 8.10.2 seems to happen more often](https://discuss.elastic.co/t/shard-recovery-in-8-10-2-seems-to-happen-more-often/357024)
**Author:** [@linkerc](https://discuss.elastic.co/u/linkerc)\ **Replies:** 14\ **Last updated:** [January 16, 2025, 7:59pm UTC](https://discuss.elastic.co/t/shard-recovery-in-8-10-2-seems-to-happen-more-often/357024 "2025-01-16T19:59:11Z")
I have noticed that in version 8.10.2, shard allocation seems to prioritize on storage space first then the shard delta. Which is fine. I don't really have a preference either way. But as the result, shard moving seem… --- ## [ERROR: Elasticsearch died while starting up, with exit code 78](https://discuss.elastic.co/t/error-elasticsearch-died-while-starting-up-with-exit-code-78/373287)
**Author:** [@juancamiloll](https://discuss.elastic.co/u/juancamiloll)\ **Replies:** 6\ **Last updated:** [January 16, 2025, 7:39pm UTC](https://discuss.elastic.co/t/error-elasticsearch-died-while-starting-up-with-exit-code-78/373287 "2025-01-16T19:39:38Z")
Today I found some errors in kibana where dasboards were not loading. I have a cluster of 3 servers for elasticsearch, one for kibana, one for logstash and one for fleet server. When I checked each of the elasticsea… --- ## [Deletions failing until index is refreshed](https://discuss.elastic.co/t/deletions-failing-until-index-is-refreshed/373290)
**Author:** [@buitcj](https://discuss.elastic.co/u/buitcj)\ **Replies:** 0\ **Last updated:** [January 16, 2025, 6:19pm UTC](https://discuss.elastic.co/t/deletions-failing-until-index-is-refreshed/373290 "2025-01-16T18:19:18Z")
For a very small number of my elasticsearch instances, deletions are failing due to timeout and not succeeding until a refresh is performed. Might this be expected? Do refreshes trigger merges or something that will imp… --- ## [Kibana Anomaly Alerts by PartitionField](https://discuss.elastic.co/t/kibana-anomaly-alerts-by-partitionfield/373133)
**Author:** [@jlrivera81](https://discuss.elastic.co/u/jlrivera81)\ **Replies:** 3\ **Last updated:** [January 16, 2025, 6:09pm UTC](https://discuss.elastic.co/t/kibana-anomaly-alerts-by-partitionfield/373133 "2025-01-16T18:09:21Z")
I currently have a working anomaly detection job for which i have configured my detector as: high\_count over Supervisor.routine.name partitionfield=Supervisor.resource.type For my alerts, I'd like to get an alert for t… --- ## [How to push old missing logs using filebeat so that it is reflecting in kibana](https://discuss.elastic.co/t/how-to-push-old-missing-logs-using-filebeat-so-that-it-is-reflecting-in-kibana/373289)
**Author:** [@jhankar\_jhankar](https://discuss.elastic.co/u/jhankar_jhankar)\ **Replies:** 0\ **Last updated:** [January 16, 2025, 5:51pm UTC](https://discuss.elastic.co/t/how-to-push-old-missing-logs-using-filebeat-so-that-it-is-reflecting-in-kibana/373289 "2025-01-16T17:51:19Z")
Hello everyone, I’ve been using Elasticsearch, Kibana, and Filebeat to monitor application logs. However, for the past couple of weeks, my Elasticsearch instance was down, so application logs were not being pushed to Ki… --- ## [Elasticsearch query - subject line for email](https://discuss.elastic.co/t/elasticsearch-query-subject-line-for-email/373237)
**Author:** [@erikg](https://discuss.elastic.co/u/erikg)\ **Replies:** 3\ **Last updated:** [January 16, 2025, 3:27pm UTC](https://discuss.elastic.co/t/elasticsearch-query-subject-line-for-email/373237 "2025-01-16T15:27:37Z")
Hello, I used to be able to add the grouped by field in the subject line under {{context.group}}. Did something change? Is there another field I can use? Kibana/ES: 8.16.1 --- ## [Disable system metrics on packetbeat](https://discuss.elastic.co/t/disable-system-metrics-on-packetbeat/373281)
**Author:** [@fcecagno](https://discuss.elastic.co/u/fcecagno)\ **Replies:** 0\ **Last updated:** [January 16, 2025, 2:29pm UTC](https://discuss.elastic.co/t/disable-system-metrics-on-packetbeat/373281 "2025-01-16T14:29:57Z")
Hi, I'm running packetbeat and I'm not interested in the system metrics reported by it - I use a different method to monitoring the host. Because I didn't add the SYS\_PTRACE capability to the docker container, I keep rec… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=111) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=113)