# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=115 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 116 --- ## [Logstash Health Report API - Not Found](https://discuss.elastic.co/t/logstash-health-report-api-not-found/372952)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 5\ **Last updated:** [January 10, 2025, 4:40pm UTC](https://discuss.elastic.co/t/logstash-health-report-api-not-found/372952 "2025-01-10T16:40:24Z")
ELK version : 8.15 Below API is giving the Not Found Output . curl -XGET 'localhost:9600/\_health\_report?pretty' While below api is working and giving output curl -XGET 'localhost:9600/?pretty' --- ## [Update Logstash Keystore while it's running as a Service](https://discuss.elastic.co/t/update-logstash-keystore-while-its-running-as-a-service/323268)
**Author:** [@Hichem](https://discuss.elastic.co/u/Hichem)\ **Replies:** 2\ **Last updated:** [January 10, 2025, 4:33pm UTC](https://discuss.elastic.co/t/update-logstash-keystore-while-its-running-as-a-service/323268 "2025-01-10T16:33:24Z")
Is there is any recommendation on how to make changes to Logstash keystore variables (update variable or add new ones) while the service is running. Do we need to stop the service before making changes? Does it require… --- ## [Java not found when executing script that needs Java](https://discuss.elastic.co/t/java-not-found-when-executing-script-that-needs-java/373058)
**Author:** [@nilsen](https://discuss.elastic.co/u/nilsen)\ **Replies:** 3\ **Last updated:** [January 10, 2025, 3:17pm UTC](https://discuss.elastic.co/t/java-not-found-when-executing-script-that-needs-java/373058 "2025-01-10T15:17:46Z")
After upgrading to Logstash 8.11.3, our Logstash stopped working because it can no longer execute a script that needs Java. I believe this is caused by Logstash now using it's internally shipped JDK. Logstash Exec Input… --- ## [How to monitor Elasticsearch snapshots](https://discuss.elastic.co/t/how-to-monitor-elasticsearch-snapshots/373069)
**Author:** [@Akinator](https://discuss.elastic.co/u/Akinator)\ **Replies:** 0\ **Last updated:** [January 10, 2025, 2:51pm UTC](https://discuss.elastic.co/t/how-to-monitor-elasticsearch-snapshots/373069 "2025-01-10T14:51:51Z")
Hello, I would like to use an alert to notify me of a snapshot failure. However, I quickly find myself limited because I am unable to define the type of monitor (Per query or per cluster metrics monitor). I need to retr… --- ## [Mocking SearchResponse in New .NET client](https://discuss.elastic.co/t/mocking-searchresponse-in-new-net-client/371925)
**Author:** [@imhoffdavid](https://discuss.elastic.co/u/imhoffdavid)\ **Replies:** 5\ **Last updated:** [January 10, 2025, 2:37pm UTC](https://discuss.elastic.co/t/mocking-searchresponse-in-new-net-client/371925 "2025-01-10T14:37:46Z")
Hello, I'm relatively new to .NET ecosystem and I'm trying to write some unit tests for the new elasticsearch .NET client (v 8.16.3) and I'm running into some issues. It seems in the past, (NEST client) you were able to… --- ## [How to create dynamic scripted field based on date-time range selection](https://discuss.elastic.co/t/how-to-create-dynamic-scripted-field-based-on-date-time-range-selection/373045)
**Author:** [@rkidev](https://discuss.elastic.co/u/rkidev)\ **Replies:** 1\ **Last updated:** [January 10, 2025, 2:29pm UTC](https://discuss.elastic.co/t/how-to-create-dynamic-scripted-field-based-on-date-time-range-selection/373045 "2025-01-10T14:29:35Z")
I want to create dynamic scripted field (Avg(NA-NB)), which is the average of NA-NB field values based on the date-time range selection. Currently the average is calculated on the total rows of the NA-NB. What I want… --- ## [Weird behavior of dot\_product similarity on dense\_vector field](https://discuss.elastic.co/t/weird-behavior-of-dot-product-similarity-on-dense-vector-field/373007)
**Author:** [@elaj](https://discuss.elastic.co/u/elaj)\ **Replies:** 3\ **Last updated:** [January 10, 2025, 1:10pm UTC](https://discuss.elastic.co/t/weird-behavior-of-dot-product-similarity-on-dense-vector-field/373007 "2025-01-10T13:10:36Z")
Hello, TLDR: What's the "indexation" difference between different similarities for dense\_vector field? I have an index with filed dense\_vector defined with similarity: cosine. Now, I want to experiment with similarity… --- ## [Elastic endpoint high CPU usage](https://discuss.elastic.co/t/elastic-endpoint-high-cpu-usage/373055)
**Author:** [@mike123](https://discuss.elastic.co/u/mike123)\ **Replies:** 0\ **Last updated:** [January 10, 2025, 11:04am UTC](https://discuss.elastic.co/t/elastic-endpoint-high-cpu-usage/373055 "2025-01-10T11:04:01Z")
I could observe high CPU usage by elastic endpoint in my machines. I also found that elastic agents CPU usage can be controlled using Limit CPU usage option in elastic agent policy settings. Will this setting be applied … --- ## [Table visualization using few logs in the index](https://discuss.elastic.co/t/table-visualization-using-few-logs-in-the-index/371529)
**Author:** [@poewyd](https://discuss.elastic.co/u/poewyd)\ **Replies:** 7\ **Last updated:** [January 10, 2025, 10:04am UTC](https://discuss.elastic.co/t/table-visualization-using-few-logs-in-the-index/371529 "2025-01-10T10:04:29Z")
I am new with Kibana visualizations and need help with current task. I have 2 logs in same index with different data. Both has message with different log data. 1st one stores information about locations used for searc… --- ## [Multi-tenant with Fleet and one single policy with integrations](https://discuss.elastic.co/t/multi-tenant-with-fleet-and-one-single-policy-with-integrations/373019)
**Author:** [@ArgoAdvisory](https://discuss.elastic.co/u/ArgoAdvisory)\ **Replies:** 2\ **Last updated:** [January 10, 2025, 9:30am UTC](https://discuss.elastic.co/t/multi-tenant-with-fleet-and-one-single-policy-with-integrations/373019 "2025-01-10T09:30:51Z")
I have a question. I built a structure using Elasticsearch and Fleet Server. In Fleet Server I have a policy called "Agent Windows" with some integrations. I want to install the SAME "Agent Windows" for DIFFERENT compa… --- ## [Are GET by ID requests impacted by index refresh?](https://discuss.elastic.co/t/are-get-by-id-requests-impacted-by-index-refresh/373042)
**Author:** [@yeikel](https://discuss.elastic.co/u/yeikel)\ **Replies:** 1\ **Last updated:** [January 10, 2025, 5:59am UTC](https://discuss.elastic.co/t/are-get-by-id-requests-impacted-by-index-refresh/373042 "2025-01-10T05:59:43Z")
From what I understand, searches may be impacted by index refreshes in that the results may be based on a previous state of the index while the refresh is in progress. But how about get requests by the document ID? Can … --- ## [Kibana, file truncated](https://discuss.elastic.co/t/kibana-file-truncated/373041)
**Author:** [@SAMY-ELK](https://discuss.elastic.co/u/SAMY-ELK)\ **Replies:** 0\ **Last updated:** [January 10, 2025, 3:35am UTC](https://discuss.elastic.co/t/kibana-file-truncated/373041 "2025-01-10T03:35:08Z")
Hello Team, I discovered that in kibana a certain specific log received is truncated, Here is an example of a truncated log in KIBANA and the original log file : Truncated log : Screenshot 1 Log file before ingest… --- ## [Multiline as single event](https://discuss.elastic.co/t/multiline-as-single-event/373040)
**Author:** [@rubhamra](https://discuss.elastic.co/u/rubhamra)\ **Replies:** 0\ **Last updated:** [January 10, 2025, 3:11am UTC](https://discuss.elastic.co/t/multiline-as-single-event/373040 "2025-01-10T03:11:19Z")
I am trying to extract log line using custom log integration fleet agent, It's a single event but every event is seperate. \ \ \ \ \ **Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 3\ **Last updated:** [January 9, 2025, 7:19pm UTC](https://discuss.elastic.co/t/how-to-set-logstash-worker/373021 "2025-01-09T19:19:37Z") ELK version : 8.15 We have 2 Logstash instances having 32gb of heap size per node and 6 CPU per node. We have 5 pipeline IDs in both these nodes . For one pipeline id we have set 6 worker , second pipeline id 3 and for… --- ## [I need to show hosts with uptime less than selected timeFilter](https://discuss.elastic.co/t/i-need-to-show-hosts-with-uptime-less-than-selected-timefilter/373027)
**Author:** [@shreedharanand](https://discuss.elastic.co/u/shreedharanand)\ **Replies:** 0\ **Last updated:** [January 9, 2025, 7:06pm UTC](https://discuss.elastic.co/t/i-need-to-show-hosts-with-uptime-less-than-selected-timefilter/373027 "2025-01-09T19:06:35Z")
I am using Kibana 8.12. I need to create a visualization which shows the unique count of host which is having uptime less than equal to the selected timeFilter. uptime coming from metricset is in ms. For example - If t… --- ## [Struggling with Elastic Agent Log Forwarding in ELK Stack Setup](https://discuss.elastic.co/t/struggling-with-elastic-agent-log-forwarding-in-elk-stack-setup/373024)
**Author:** [@pok\_lehbim](https://discuss.elastic.co/u/pok_lehbim)\ **Replies:** 1\ **Last updated:** [January 9, 2025, 6:55pm UTC](https://discuss.elastic.co/t/struggling-with-elastic-agent-log-forwarding-in-elk-stack-setup/373024 "2025-01-09T18:55:44Z")
Hello everyone, I'm in the process of setting up an ELK stack for my home lab, and I've hit a brick wall regarding Elastic Agent's ability to send logs. Despite following the setup carefully and ensuring everything conn… --- ## [Add Synthetic Test Tags to Alerts?](https://discuss.elastic.co/t/add-synthetic-test-tags-to-alerts/361053)
**Author:** [@DougR](https://discuss.elastic.co/u/DougR)\ **Replies:** 1\ **Last updated:** [January 9, 2025, 6:14pm UTC](https://discuss.elastic.co/t/add-synthetic-test-tags-to-alerts/361053 "2025-01-09T18:14:47Z")
Can I add synthetic test tags to my Synthetics alerts? E.g., in the following test, can I add the contents of the tags field to my alert in the event of a failure? heartbeat.monitors: - id: '7cdb4578-aa8a-4d46-86fe-a… --- ## [Index Templates: One or more for an intergration?](https://discuss.elastic.co/t/index-templates-one-or-more-for-an-intergration/373000)
**Author:** [@panagiss](https://discuss.elastic.co/u/panagiss)\ **Replies:** 3\ **Last updated:** [January 9, 2025, 5:46pm UTC](https://discuss.elastic.co/t/index-templates-one-or-more-for-an-intergration/373000 "2025-01-09T17:46:27Z")
I have deployed Elastic agents to few windows hosts and are managed by fleet. I need to create a custom index template so I can change the ILP based on my custom namespace. So for example for the System integration ther… --- ## [S3 input plugin problem with %](https://discuss.elastic.co/t/s3-input-plugin-problem-with/372928)
**Author:** [@Martin\_IT](https://discuss.elastic.co/u/Martin_IT)\ **Replies:** 4\ **Last updated:** [January 9, 2025, 4:22pm UTC](https://discuss.elastic.co/t/s3-input-plugin-problem-with/372928 "2025-01-09T16:22:58Z")
Hi, we use S3 input plugin and we have a problem with backup of indexed files. Our files contain character % because URL encoded format. Indexing is OK but than when file should be moved to the archive we receive errors: … --- ## [Splitting message using Logstash mutate filter](https://discuss.elastic.co/t/splitting-message-using-logstash-mutate-filter/373011)
**Author:** [@zaeemmasood](https://discuss.elastic.co/u/zaeemmasood)\ **Replies:** 0\ **Last updated:** [January 9, 2025, 3:49pm UTC](https://discuss.elastic.co/t/splitting-message-using-logstash-mutate-filter/373011 "2025-01-09T15:49:58Z")
Hi All, The incoming feed (log) to Logstash has parameters which are delimited by ~|~ These are being mutated and split in Logstash as follows. : if \[type\] == "tv\_dmz\_access" { mutate { … --- ## [TVSB - Markdown Help for Title Panel](https://discuss.elastic.co/t/tvsb-markdown-help-for-title-panel/372957)
**Author:** [@erikg](https://discuss.elastic.co/u/erikg)\ **Replies:** 5\ **Last updated:** [January 9, 2025, 3:41pm UTC](https://discuss.elastic.co/t/tvsb-markdown-help-for-title-panel/372957 "2025-01-09T15:41:04Z")
Hello, I want to create a text panel where I can add links to the right and wording on the left. This is what I am trying to do: ^ Like the image above, I want to say something like "Welcome to Elastic" and the le… --- ## [Combine connect and disconnect documents with transform?](https://discuss.elastic.co/t/combine-connect-and-disconnect-documents-with-transform/372477)
**Author:** [@Jokke](https://discuss.elastic.co/u/Jokke)\ **Replies:** 3\ **Last updated:** [January 9, 2025, 1:29pm UTC](https://discuss.elastic.co/t/combine-connect-and-disconnect-documents-with-transform/372477 "2025-01-09T13:29:02Z")
Hello! I'm new to transforms so not really sure, but I think transforms is what I need here. Logs are pushed from web application to ES (fluentd) and there among connect and disconnect messages. What I would want is to… --- ## [Accidentally deleted synthetic browser data stream](https://discuss.elastic.co/t/accidentally-deleted-synthetic-browser-data-stream/372938)
**Author:** [@Emanuel](https://discuss.elastic.co/u/Emanuel)\ **Replies:** 1\ **Last updated:** [January 8, 2025, 3:57pm UTC](https://discuss.elastic.co/t/accidentally-deleted-synthetic-browser-data-stream/372938 "2025-01-08T15:57:58Z")
Hello, I accidentally deleted the datastream from synthetic browser via kibana UI, Stack management -\> index management -\> data stream This datastream was in a space so it had a namespace in its name synthetics-browse… --- ## [Fleet server - dial tcp connection refused](https://discuss.elastic.co/t/fleet-server-dial-tcp-connection-refused/372912)
**Author:** [@aldafalda](https://discuss.elastic.co/u/aldafalda)\ **Replies:** 4\ **Last updated:** [January 9, 2025, 11:51am UTC](https://discuss.elastic.co/t/fleet-server-dial-tcp-connection-refused/372912 "2025-01-09T11:51:18Z")
Hi, I have docker compose file for elasticsearch, kibana, elastic-agent and fleet server (version 8.17.0). Elasticsearch works well with Kibana. The problem is with starting fleet server where the starting procedure fai… --- ## [Sending data to index through vega or by any other kibana feature](https://discuss.elastic.co/t/sending-data-to-index-through-vega-or-by-any-other-kibana-feature/370691)
**Author:** [@aman\_kumar4](https://discuss.elastic.co/u/aman_kumar4)\ **Replies:** 3\ **Last updated:** [January 9, 2025, 11:49am UTC](https://discuss.elastic.co/t/sending-data-to-index-through-vega-or-by-any-other-kibana-feature/370691 "2025-01-09T11:49:59Z")
I want to calculate that how much an user spent time on a particular dashboard i have created a timer through vega ( working) now want to send this timer data when user closes/leaves the dashboard so that I can use thi… --- ## [Performance: Adding multiple indexes in term query in a search request](https://discuss.elastic.co/t/performance-adding-multiple-indexes-in-term-query-in-a-search-request/372994)
**Author:** [@ajayraghav](https://discuss.elastic.co/u/ajayraghav)\ **Replies:** 0\ **Last updated:** [January 9, 2025, 11:47am UTC](https://discuss.elastic.co/t/performance-adding-multiple-indexes-in-term-query-in-a-search-request/372994 "2025-01-09T11:47:02Z")
I intend to use query\_string and term queries (across multiple indexes) on \_search. My combined query is this, "query": { "bool": { "must": \[ { "query\_string": { "fields": \[ "\*" \], "query": "tes" } } \], "sh… --- ## [Double Terms aggregation with top\_hits sub-aggregation not working](https://discuss.elastic.co/t/double-terms-aggregation-with-top-hits-sub-aggregation-not-working/372668)
**Author:** [@Clement\_Naudet](https://discuss.elastic.co/u/Clement_Naudet)\ **Replies:** 5\ **Last updated:** [January 9, 2025, 11:36am UTC](https://discuss.elastic.co/t/double-terms-aggregation-with-top-hits-sub-aggregation-not-working/372668 "2025-01-09T11:36:18Z")
Hello everyone, Here is my mapping in my index "my-index-000001" { "mappings": { "properties": { "objectId": { "type": "keyword" }, "dateTime": { "type": "date" }, "status": { "type": "keyword" … --- ## [To big index for ML job - how to add ILM?](https://discuss.elastic.co/t/to-big-index-for-ml-job-how-to-add-ilm/357611)
**Author:** [@Wojciech\_Kwiecien](https://discuss.elastic.co/u/Wojciech_Kwiecien)\ **Replies:** 1\ **Last updated:** [January 9, 2025, 11:11am UTC](https://discuss.elastic.co/t/to-big-index-for-ml-job-how-to-add-ilm/357611 "2025-01-09T11:11:56Z")
Hello Everyone, I’ve encountered an issue while working with Machine Learning jobs in Elasticsearch, where the result indices aren't being properly managed post-rollover. I have to figured out something because index f… --- ## [Perform aggregation as part of a Kibana FIlter using DSL](https://discuss.elastic.co/t/perform-aggregation-as-part-of-a-kibana-filter-using-dsl/371468)
**Author:** [@bjornbear](https://discuss.elastic.co/u/bjornbear)\ **Replies:** 1\ **Last updated:** [January 9, 2025, 11:01am UTC](https://discuss.elastic.co/t/perform-aggregation-as-part-of-a-kibana-filter-using-dsl/371468 "2025-01-09T11:01:50Z")
Is it possible to perform filtering based on aggregation? I have a large number of components as part of a service and am only interested to show metric tiles for those that exceed certain thresholds instead of everythin… --- ## [File was truncated. Begin reading file from offset 0 multiple time](https://discuss.elastic.co/t/file-was-truncated-begin-reading-file-from-offset-0-multiple-time/371459)
**Author:** [@Mimouz](https://discuss.elastic.co/u/Mimouz)\ **Replies:** 5\ **Last updated:** [January 9, 2025, 9:31am UTC](https://discuss.elastic.co/t/file-was-truncated-begin-reading-file-from-offset-0-multiple-time/371459 "2025-01-09T09:31:04Z")
Hi, I'm new to the ELK stack and currently exploring its features for log aggregation. We are using tomcat-9 and elk stack 8.5.1 and we faced an issue that the logs are duplicated in Kibana more then 3 or 5 times depen… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=114) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=116)