# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=113 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 114 --- ## [No index created in Elasticsearch. Can see logs in Docker](https://discuss.elastic.co/t/no-index-created-in-elasticsearch-can-see-logs-in-docker/372992)
**Author:** [@jcklam](https://discuss.elastic.co/u/jcklam)\ **Replies:** 4\ **Last updated:** [January 16, 2025, 2:05pm UTC](https://discuss.elastic.co/t/no-index-created-in-elasticsearch-can-see-logs-in-docker/372992 "2025-01-16T14:05:42Z")
Hi, I'm trying to get a simple ELK setup working with Docker. Issue is I don't see the index I've defined created docker-compose.yml I've verified that log files are copied over correctly onto the Docker container s… --- ## [ESQL pass a stats column to next stage](https://discuss.elastic.co/t/esql-pass-a-stats-column-to-next-stage/373276)
**Author:** [@mortenb123](https://discuss.elastic.co/u/mortenb123)\ **Replies:** 2\ **Last updated:** [January 16, 2025, 1:42pm UTC](https://discuss.elastic.co/t/esql-pass-a-stats-column-to-next-stage/373276 "2025-01-16T13:42:50Z")
I need to find the first and the last inserts of sources in events: FROM \*.events.\* | KEEP @timestamp,source | stats latest=max(@timestamp) by source FROM \*.events.\* | KEEP @timestamp,source | stats first=min(@timesta… --- ## [Track the user activity in an application using ElasticSearch](https://discuss.elastic.co/t/track-the-user-activity-in-an-application-using-elasticsearch/373278)
**Author:** [@subash](https://discuss.elastic.co/u/subash)\ **Replies:** 0\ **Last updated:** [January 16, 2025, 1:00pm UTC](https://discuss.elastic.co/t/track-the-user-activity-in-an-application-using-elasticsearch/373278 "2025-01-16T13:00:30Z")
Is there a way to track how much time a user is using a desktop application using Elasticsearch? --- ## [Converting 7x. into 8.x Java client code. Getting the counts of individual buckets](https://discuss.elastic.co/t/converting-7x-into-8-x-java-client-code-getting-the-counts-of-individual-buckets/373223)
**Author:** [@Hans\_Kruse](https://discuss.elastic.co/u/Hans_Kruse)\ **Replies:** 2\ **Last updated:** [January 16, 2025, 8:52am UTC](https://discuss.elastic.co/t/converting-7x-into-8-x-java-client-code-getting-the-counts-of-individual-buckets/373223 "2025-01-16T08:52:24Z")
In our journey of converting 7.x client code into 8.x code we ran into one more challenge. Observe the following code that converts aggregation data retrieved from the client into a list of our Agg dto objects. public … --- ## [What is the solution in order to search for the entire text accurately without increasing ignore\_above in order for the space to remain the same?](https://discuss.elastic.co/t/what-is-the-solution-in-order-to-search-for-the-entire-text-accurately-without-increasing-ignore-above-in-order-for-the-space-to-remain-the-same/372569)
**Author:** [@dsagent](https://discuss.elastic.co/u/dsagent)\ **Replies:** 19\ **Last updated:** [January 16, 2025, 10:26am UTC](https://discuss.elastic.co/t/what-is-the-solution-in-order-to-search-for-the-entire-text-accurately-without-increasing-ignore-above-in-order-for-the-space-to-remain-the-same/372569 "2025-01-16T10:26:45Z")
Hi I have data that I store in elasticsearch and from these data there are long fields of up to 2000 characters and I want to search for them by term It is known in elasticsearch that the keyword field type reaches a le… --- ## [Selfhosted Sharepoint Connector and self-signed Certs](https://discuss.elastic.co/t/selfhosted-sharepoint-connector-and-self-signed-certs/371522)
**Author:** [@fal77](https://discuss.elastic.co/u/fal77)\ **Replies:** 5\ **Last updated:** [January 16, 2025, 8:08am UTC](https://discuss.elastic.co/t/selfhosted-sharepoint-connector-and-self-signed-certs/371522 "2025-01-16T08:08:48Z")
Hi everyone, I run ES 8.16.1 secured as to the documentation. Downloaded the source for the sharepoint connector and did a clean install. My config.yml looks like this: connectors: - connector\_id: "cLzelZMBUWuJQBqZq… --- ## [Elasticsearch backup on Object storage S3 Compatibility API](https://discuss.elastic.co/t/elasticsearch-backup-on-object-storage-s3-compatibility-api/373010)
**Author:** [@samozx](https://discuss.elastic.co/u/samozx)\ **Replies:** 3\ **Last updated:** [January 16, 2025, 6:56am UTC](https://discuss.elastic.co/t/elasticsearch-backup-on-object-storage-s3-compatibility-api/373010 "2025-01-16T06:56:16Z")
Hello everyone, I have Elasticsearch version 8.12.2 installed on Oracle OCI - OKE , I am trying to configure the snapshot to be uploaded to the Object Storage Amazon S3 Compatibility API (From oracle documentation). n… --- ## [Float value rendered incorrectly by elastic API](https://discuss.elastic.co/t/float-value-rendered-incorrectly-by-elastic-api/373180)
**Author:** [@eeijlar](https://discuss.elastic.co/u/eeijlar)\ **Replies:** 3\ **Last updated:** [January 15, 2025, 11:55pm UTC](https://discuss.elastic.co/t/float-value-rendered-incorrectly-by-elastic-api/373180 "2025-01-15T23:55:36Z")
I have an index template which defines the data type for the field liableban as follows: "liableBan": { "meta": { "entity": "usageCharacteristic.liableBan" }, "null\_value": 0, "store": true, "type": "long"… --- ## [Elastic Agent with Kubernetes integration conflicting with System integration](https://discuss.elastic.co/t/elastic-agent-with-kubernetes-integration-conflicting-with-system-integration/371106)
**Author:** [@ingmf](https://discuss.elastic.co/u/ingmf)\ **Replies:** 3\ **Last updated:** [January 15, 2025, 6:23pm UTC](https://discuss.elastic.co/t/elastic-agent-with-kubernetes-integration-conflicting-with-system-integration/371106 "2025-01-15T18:23:57Z")
Hello, I have installed a Fleet Server and I am using Elastic Agent 8.15.5 as Daemonset on Kubernetes. In my Agent Policy I have added system & kubernetes integration together but not all Kubernetes metrics are coming … --- ## [How do I query the full field value using match as if I am searching using term, but it is not case sensitive?](https://discuss.elastic.co/t/how-do-i-query-the-full-field-value-using-match-as-if-i-am-searching-using-term-but-it-is-not-case-sensitive/373240)
**Author:** [@dsagent](https://discuss.elastic.co/u/dsagent)\ **Replies:** 6\ **Last updated:** [January 15, 2025, 6:10pm UTC](https://discuss.elastic.co/t/how-do-i-query-the-full-field-value-using-match-as-if-i-am-searching-using-term-but-it-is-not-case-sensitive/373240 "2025-01-15T18:10:24Z")
Hi I want to query a field of type text using match, but I want to query the full text and also be case-insensitive What I mean is I have a search I want to search as if I am searching using the term but not sensitive… --- ## [Vizualisation of type "Control" to reuse control groups across dashboards](https://discuss.elastic.co/t/vizualisation-of-type-control-to-reuse-control-groups-across-dashboards/373243)
**Author:** [@npr](https://discuss.elastic.co/u/npr)\ **Replies:** 0\ **Last updated:** [January 15, 2025, 5:30pm UTC](https://discuss.elastic.co/t/vizualisation-of-type-control-to-reuse-control-groups-across-dashboards/373243 "2025-01-15T17:30:24Z")
Hi, I'm using Kibana 8.10.2, and my goal is to reuse groups of controls across multiple dashboards. In previous versions, I noticed that it was possible to create a "Controls" visualization. Is this functionality stil… --- ## [Configuration of kibana with elasticsearch 8 Cluster](https://discuss.elastic.co/t/configuration-of-kibana-with-elasticsearch-8-cluster/373235)
**Author:** [@b\_Ensberg](https://discuss.elastic.co/u/b_Ensberg)\ **Replies:** 1\ **Last updated:** [January 15, 2025, 5:03pm UTC](https://discuss.elastic.co/t/configuration-of-kibana-with-elasticsearch-8-cluster/373235 "2025-01-15T17:03:09Z")
Good morning; Please, I would like to ask you a question regarding the configuration of kibana. Normally there are two ways to configure the kibana connection with elasticsearch : Elasticsearch.username/elasticsearch… --- ## [Debug logs not working](https://discuss.elastic.co/t/debug-logs-not-working/362801)
**Author:** [@chntatxt](https://discuss.elastic.co/u/chntatxt)\ **Replies:** 3\ **Last updated:** [January 15, 2025, 4:58pm UTC](https://discuss.elastic.co/t/debug-logs-not-working/362801 "2025-01-15T16:58:30Z")
Hello Elastic community, I have an issue with elastic-agent debug logging, perhaps you could help me ? Some events are dropped because the mapping changed o logs, but it's impossible for me to find where exactly, i hav… --- ## [How to Configure Logstash to Forward Data When New Data is Available in Elasticsearch?](https://discuss.elastic.co/t/how-to-configure-logstash-to-forward-data-when-new-data-is-available-in-elasticsearch/373151)
**Author:** [@Wei\_Li](https://discuss.elastic.co/u/Wei_Li)\ **Replies:** 1\ **Last updated:** [January 15, 2025, 4:54pm UTC](https://discuss.elastic.co/t/how-to-configure-logstash-to-forward-data-when-new-data-is-available-in-elasticsearch/373151 "2025-01-15T16:54:49Z")
Dear All. I am a beginner and I have the following questions to ask: Environment: I have a program that fetches data from a network device API every five minutes and stores it into an Elasticsearch index. The data in t… --- ## [How to create a Kibana Plugin and customize it Via ReactJS? Yarn command not Working](https://discuss.elastic.co/t/how-to-create-a-kibana-plugin-and-customize-it-via-reactjs-yarn-command-not-working/373159)
**Author:** [@K213151](https://discuss.elastic.co/u/K213151)\ **Replies:** 1\ **Last updated:** [January 15, 2025, 4:46pm UTC](https://discuss.elastic.co/t/how-to-create-a-kibana-plugin-and-customize-it-via-reactjs-yarn-command-not-working/373159 "2025-01-15T16:46:54Z")
Im new to ELK Stack, I followed all steps but unable to develop and setup Kibana Plugin. Can anyone guide me step by step on how to do it? With the latest versions. Additionally none of my yarn commands are working, be i… --- ## [Tenant Kibana as BI](https://discuss.elastic.co/t/tenant-kibana-as-bi/372324)
**Author:** [@jodinathan](https://discuss.elastic.co/u/jodinathan)\ **Replies:** 1\ **Last updated:** [January 15, 2025, 4:40pm UTC](https://discuss.elastic.co/t/tenant-kibana-as-bi/372324 "2025-01-15T16:40:43Z")
We are considering using the ELK stack for a project that needs to provide BI capabilities to clients. To ensure security, we plan to implement RLS (Row-Level Security) and FLS (Field-Level Security), so clients only see… --- ## [Using nested aggregation average result in condition](https://discuss.elastic.co/t/using-nested-aggregation-average-result-in-condition/373233)
**Author:** [@John\_Harris](https://discuss.elastic.co/u/John_Harris)\ **Replies:** 0\ **Last updated:** [January 15, 2025, 2:35pm UTC](https://discuss.elastic.co/t/using-nested-aggregation-average-result-in-condition/373233 "2025-01-15T14:35:23Z")
When attempting to using a sub aggregation metric average in a condition, I'm receiving "aggregations": { "modules": { "terms": { "field": "host.hostname.keyword", "size"… --- ## [Kibana data table to CSV (Duplicate Columns)](https://discuss.elastic.co/t/kibana-data-table-to-csv-duplicate-columns/372970)
**Author:** [@Yokesh\_GK](https://discuss.elastic.co/u/Yokesh_GK)\ **Replies:** 6\ **Last updated:** [January 15, 2025, 2:01pm UTC](https://discuss.elastic.co/t/kibana-data-table-to-csv-duplicate-columns/372970 "2025-01-15T14:01:14Z")
The first image shows the data table I designed in Kibana, while the second image is the CSV file downloaded from that table. You can see that the columns are duplicated from "Initiated" to "Errored." However, there … --- ## [High Latency on KNN Search](https://discuss.elastic.co/t/high-latency-on-knn-search/372828)
**Author:** [@Ahmad2356](https://discuss.elastic.co/u/Ahmad2356)\ **Replies:** 11\ **Last updated:** [January 15, 2025, 12:54pm UTC](https://discuss.elastic.co/t/high-latency-on-knn-search/372828 "2025-01-15T12:54:48Z")
Hi everyone, I’m running an Elasticsearch cluster (version 8.17) with the basic license. The cluster has 3 nodes, each on Linux servers with 62 GB RAM and 1 TB disk space. I’ve set up an index for vector search using th… --- ## [Authentication problem with Entra App OIDC on 8.13.4](https://discuss.elastic.co/t/authentication-problem-with-entra-app-oidc-on-8-13-4/373217)
**Author:** [@tdvo1996](https://discuss.elastic.co/u/tdvo1996)\ **Replies:** 0\ **Last updated:** [January 15, 2025, 6:33am UTC](https://discuss.elastic.co/t/authentication-problem-with-entra-app-oidc-on-8-13-4/373217 "2025-01-15T06:33:36Z")
Hi, we have configured Entra App for OIDC with the correct redirect uri, and correct group claim. I want the OIDC configuration to check the claim if I am a part of a specific AD group. Client secret is also stored in ke… --- ## [Editing visualization based on conditions](https://discuss.elastic.co/t/editing-visualization-based-on-conditions/373207)
**Author:** [@Ankita\_Mehta](https://discuss.elastic.co/u/Ankita_Mehta)\ **Replies:** 1\ **Last updated:** [January 15, 2025, 10:37am UTC](https://discuss.elastic.co/t/editing-visualization-based-on-conditions/373207 "2025-01-15T10:37:52Z")
THis topic was created in 2018. Can we hide a certain visualization based on a certain condition? Has there been any improvement in this regard? --- ## [Does roles assigned to nodes affect the disk rebalancing?](https://discuss.elastic.co/t/does-roles-assigned-to-nodes-affect-the-disk-rebalancing/373215)
**Author:** [@mike123](https://discuss.elastic.co/u/mike123)\ **Replies:** 2\ **Last updated:** [January 15, 2025, 9:10am UTC](https://discuss.elastic.co/t/does-roles-assigned-to-nodes-affect-the-disk-rebalancing/373215 "2025-01-15T09:10:20Z")
I have 10 data nodes of which 3 have additional ML and transform role to it. I could observe that almost all the primary shards are assigned to nodes with ml role assigned to it. And replicas are distributed. This is ca… --- ## [What is the appropriate document size in Elasticsearch？](https://discuss.elastic.co/t/what-is-the-appropriate-document-size-in-elasticsearch/358191)
**Author:** [@jiankunking](https://discuss.elastic.co/u/jiankunking)\ **Replies:** 1\ **Last updated:** [January 15, 2025, 8:15am UTC](https://discuss.elastic.co/t/what-is-the-appropriate-document-size-in-elasticsearch/358191 "2025-01-15T08:15:26Z")
// Reduced irrelevant attributes { "code": "product code", "saleIncludeCustomers": \[ // Object { "code": "Customer code", "launchId": "la… --- ## [Elasticsearch Virtual Machine Requirement](https://discuss.elastic.co/t/elasticsearch-virtual-machine-requirement/371345)
**Author:** [@Hendrawns](https://discuss.elastic.co/u/Hendrawns)\ **Replies:** 2\ **Last updated:** [January 15, 2025, 8:13am UTC](https://discuss.elastic.co/t/elasticsearch-virtual-machine-requirement/371345 "2025-01-15T08:13:35Z")
Hello Everyone, I plan to move the Elasticsearch environment to a virtual machine because the bare metal server that I currently use is always full quickly, so my team decided to migrate to a virtual machine that is easy… --- ## [Finding number of hits for an index](https://discuss.elastic.co/t/finding-number-of-hits-for-an-index/373197)
**Author:** [@zaeemmasood](https://discuss.elastic.co/u/zaeemmasood)\ **Replies:** 1\ **Last updated:** [January 15, 2025, 2:26am UTC](https://discuss.elastic.co/t/finding-number-of-hits-for-an-index/373197 "2025-01-15T02:26:01Z")
Hi All, I am trying to determine number of hits that an index experiences in a 24 hours period. I see the number as 87,366,378 for a 24 hour period between Jan 6th and 7th as follows: How can I get this number 87,3… --- ## [Filebeat Microsoft Module - Documents Incomplete](https://discuss.elastic.co/t/filebeat-microsoft-module-documents-incomplete/372900)
**Author:** [@mgotechlock](https://discuss.elastic.co/u/mgotechlock)\ **Replies:** 5\ **Last updated:** [January 14, 2025, 11:50pm UTC](https://discuss.elastic.co/t/filebeat-microsoft-module-documents-incomplete/372900 "2025-01-14T23:50:50Z")
Posting as FYI. The instructions for the Filebeat Microsoft Module at Microsoft module | Filebeat Reference \[8.17\] | Elastic are incomplete. You need to also add the permissions for the WindowsDefenderATP API \> Alerts \> … --- ## [Elasticsearch Architecture](https://discuss.elastic.co/t/elasticsearch-architecture/373127)
**Author:** [@rolindroy](https://discuss.elastic.co/u/rolindroy)\ **Replies:** 3\ **Last updated:** [January 14, 2025, 11:32pm UTC](https://discuss.elastic.co/t/elasticsearch-architecture/373127 "2025-01-14T23:32:32Z")
I have set up an Elasticsearch cluster to handle logs from a Kubernetes (K8s) cluster hosting over 500 applications. Retention policies need to be configured per application, with a default retention of 20 days and exten… --- ## [Kibana Discover: configure the default fields shown in results](https://discuss.elastic.co/t/kibana-discover-configure-the-default-fields-shown-in-results/373195)
**Author:** [@jhfrontz](https://discuss.elastic.co/u/jhfrontz)\ **Replies:** 2\ **Last updated:** [January 14, 2025, 11:26pm UTC](https://discuss.elastic.co/t/kibana-discover-configure-the-default-fields-shown-in-results/373195 "2025-01-14T23:26:02Z")
We have two ELK instances, ostensibly with the same data. One is accessed via a Kibana version 7 interface, one via Kibana 8. The default fields displayed in Discover results differ between the two (see below). I'm unsu… --- ## [Multiline config](https://discuss.elastic.co/t/multiline-config/373203)
**Author:** [@stecino](https://discuss.elastic.co/u/stecino)\ **Replies:** 0\ **Last updated:** [January 14, 2025, 8:48pm UTC](https://discuss.elastic.co/t/multiline-config/373203 "2025-01-14T20:48:28Z")
Trying to identify log events that start either with \<\<\< or \>\>\> or \[ Would this be correct? multiline.pattern: '^(\<\<\<\<|\>\>\>\>|\])' --- ## [Elastic search trained model inference not working](https://discuss.elastic.co/t/elastic-search-trained-model-inference-not-working/359649)
**Author:** [@likealam](https://discuss.elastic.co/u/likealam)\ **Replies:** 5\ **Last updated:** [January 14, 2025, 8:45pm UTC](https://discuss.elastic.co/t/elastic-search-trained-model-inference-not-working/359649 "2025-01-14T20:45:17Z")
After importing the text embedding sentence-transformers/msmarco-MiniLM-L12-cos-v5 model to elasticsearch using eland the model infering doesnt work. eland command: eland\_import\_hub\_model --url http://localhost:9200 --… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=112) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=114)