# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=116 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 117 --- ## [What components come under Enterprise subscription?](https://discuss.elastic.co/t/what-components-come-under-enterprise-subscription/372968)
**Author:** [@searchwithme](https://discuss.elastic.co/u/searchwithme)\ **Replies:** 1\ **Last updated:** [January 9, 2025, 8:08am UTC](https://discuss.elastic.co/t/what-components-come-under-enterprise-subscription/372968 "2025-01-09T08:08:16Z")
Hi! If I put together an architecture with data nodes, master nodes, kibana, logstash, fleet nodes, ingest nodes - which of these are excluded during the RAM calculation to determine the number of licenses? Please help! … --- ## [Grok and special characters in field names](https://discuss.elastic.co/t/grok-and-special-characters-in-field-names/372971)
**Author:** [@Snow](https://discuss.elastic.co/u/Snow)\ **Replies:** 0\ **Last updated:** [January 9, 2025, 6:56am UTC](https://discuss.elastic.co/t/grok-and-special-characters-in-field-names/372971 "2025-01-09T06:56:07Z")
ES field names are like "dns.question, dns.question.type,dns.answers" (DNS Fields | Elastic Common Schema (ECS) Reference \[8.16\] | Elastic)|" (DNS Fields | Elastic Common Schema (ECS) Reference \[8.16\] | Elastic) but wh… --- ## [Dissect first then multiline in filebeat](https://discuss.elastic.co/t/dissect-first-then-multiline-in-filebeat/369748)
**Author:** [@justkind](https://discuss.elastic.co/u/justkind)\ **Replies:** 3\ **Last updated:** [January 8, 2025, 9:50pm UTC](https://discuss.elastic.co/t/dissect-first-then-multiline-in-filebeat/369748 "2025-01-08T21:50:01Z")
Hi everyone, Any help would be greatly appreciated. We recently upgraded our kubernetes cluster and all logs are now coming in with the new kubernetes CRI log format, that includes a timestamp and the output stream typ… --- ## [Timeout for exporting csv in ES|QL](https://discuss.elastic.co/t/timeout-for-exporting-csv-in-es-ql/372350)
**Author:** [@petition2307](https://discuss.elastic.co/u/petition2307)\ **Replies:** 5\ **Last updated:** [January 8, 2025, 9:35pm UTC](https://discuss.elastic.co/t/timeout-for-exporting-csv-in-es-ql/372350 "2025-01-08T21:35:12Z")
I'm an Elasticsearch beginner. I have a problem about exporting csv in ES|QL. Environment OS: Debian 12 Elasticsearch Version: 8.15.2 (elasticsearch and kibana) Problem I tried exporting csv and got timeout error. T… --- ## [Logs Not Appearing in Kibana After Instance Refresh Activity](https://discuss.elastic.co/t/logs-not-appearing-in-kibana-after-instance-refresh-activity/372956)
**Author:** [@ErGeek](https://discuss.elastic.co/u/ErGeek)\ **Replies:** 0\ **Last updated:** [January 8, 2025, 8:44pm UTC](https://discuss.elastic.co/t/logs-not-appearing-in-kibana-after-instance-refresh-activity/372956 "2025-01-08T20:44:33Z")
Our log management pipeline operates as follows: Beats -\> MSK (Kafka) -\> Logstash (hosted in EC2) -\> Elasticsearch -\> Kibana. We handle updates to the Logstash servers through the Instance Refresh activity in AWS. This … --- ## [LogsDB Without Synthetic \_Source: Storage Savings and Upgrade Risks?](https://discuss.elastic.co/t/logsdb-without-synthetic-source-storage-savings-and-upgrade-risks/372858)
**Author:** [@Behnam.R](https://discuss.elastic.co/u/Behnam.R)\ **Replies:** 5\ **Last updated:** [January 8, 2025, 6:16pm UTC](https://discuss.elastic.co/t/logsdb-without-synthetic-source-storage-savings-and-upgrade-risks/372858 "2025-01-08T18:16:05Z")
I am currently on Elasticsearch version 8.16 and considering using the LogsDB index mode for its benefits, particularly the improved querying speed and reduced storage footprint with the new sorting feature (up to 20%, b… --- ## [How do i get AWS cloudwatch metrics to elastic for serverless](https://discuss.elastic.co/t/how-do-i-get-aws-cloudwatch-metrics-to-elastic-for-serverless/372669)
**Author:** [@rpeynado1](https://discuss.elastic.co/u/rpeynado1)\ **Replies:** 9\ **Last updated:** [January 8, 2025, 5:26pm UTC](https://discuss.elastic.co/t/how-do-i-get-aws-cloudwatch-metrics-to-elastic-for-serverless/372669 "2025-01-08T17:26:51Z")
Hello, I am trying to push cloudwatch metrics via sqs to elastic. How do i go about doing this? these are for multiple servers and serverless applications --- ## [Logstash's Elasticsearch filter plugin bottleneck](https://discuss.elastic.co/t/logstashs-elasticsearch-filter-plugin-bottleneck/372666)
**Author:** [@lethargicsnailspider](https://discuss.elastic.co/u/lethargicsnailspider)\ **Replies:** 11\ **Last updated:** [January 8, 2025, 4:34pm UTC](https://discuss.elastic.co/t/logstashs-elasticsearch-filter-plugin-bottleneck/372666 "2025-01-08T16:34:29Z")
I have a Logstash pipeline set up with multiple Elasticsearch filter plugins to do a lookup of field values ingested via an input filter. Processing and writing the events into Elasticsearch is around 500,000 events per … --- ## [Kibana snapshot restore status not accurate](https://discuss.elastic.co/t/kibana-snapshot-restore-status-not-accurate/372946)
**Author:** [@Dave\_Houser](https://discuss.elastic.co/u/Dave_Houser)\ **Replies:** 0\ **Last updated:** [January 8, 2025, 4:23pm UTC](https://discuss.elastic.co/t/kibana-snapshot-restore-status-not-accurate/372946 "2025-01-08T16:23:07Z")
Running 8.13. Kibana's Restore Status for a snapshot shows all indexes are complete. But this is not true. If I look at the cluster health it's still yellow, and shards are still being restored. If I refresh cluster hea… --- ## [Heap Allocation Failures on 8.17](https://discuss.elastic.co/t/heap-allocation-failures-on-8-17/372211)
**Author:** [@Evesy](https://discuss.elastic.co/u/Evesy)\ **Replies:** 9\ **Last updated:** [January 8, 2025, 3:20pm UTC](https://discuss.elastic.co/t/heap-allocation-failures-on-8-17/372211 "2025-01-08T15:20:15Z")
We've had 2 different 8.x clusters running for a number of years without issue however since upgrading to 8.17 (from 8.15.1) a couple of days ago we are seeing frequent heap allocation failures such as below: # # There … --- ## [Parsing 'alerts.all.data'](https://discuss.elastic.co/t/parsing-alerts-all-data/372942)
**Author:** [@Cristina\_Marletta\_Li](https://discuss.elastic.co/u/Cristina_Marletta_Li)\ **Replies:** 0\ **Last updated:** [January 8, 2025, 3:15pm UTC](https://discuss.elastic.co/t/parsing-alerts-all-data/372942 "2025-01-08T15:15:37Z")
Hi, How to parse (for example via Json Path) the alerts.all.data field to compose the body of the email sent via Action of an alert rule? --- ## [What is .ent-search-\*-logs-\*,-.ent-search-\*? where is it from?](https://discuss.elastic.co/t/what-is-ent-search-logs-ent-search-where-is-it-from/372873)
**Author:** [@Richard\_Zhang](https://discuss.elastic.co/u/Richard_Zhang)\ **Replies:** 7\ **Last updated:** [January 8, 2025, 2:43pm UTC](https://discuss.elastic.co/t/what-is-ent-search-logs-ent-search-where-is-it-from/372873 "2025-01-08T14:43:52Z")
Hi everyone, In everyone of our Elasticsearch instances in Azure, there is a persistent setting entry like below: "action.auto\_create\_index": ".ent-search-\*-logs-\*,-.ent-search-\*,+\*" But nobody remembers/knows who a… --- ## [Heap filled up after upgrade to 8.17](https://discuss.elastic.co/t/heap-filled-up-after-upgrade-to-8-17/372932)
**Author:** [@cmoi](https://discuss.elastic.co/u/cmoi)\ **Replies:** 0\ **Last updated:** [January 8, 2025, 10:56am UTC](https://discuss.elastic.co/t/heap-filled-up-after-upgrade-to-8-17/372932 "2025-01-08T10:56:43Z")
Hi, I have upgraded my cluster from 8.11 to 8.17 and since it keeps crashing due to full heap used. I have upped the heap memory but it did not solve the issue. After some time with heap memory use steady, it starts gro… --- ## [ESQL - fieldnames with slash('/') not supported just removed in kibana](https://discuss.elastic.co/t/esql-fieldnames-with-slash-not-supported-just-removed-in-kibana/372935)
**Author:** [@mortenb123](https://discuss.elastic.co/u/mortenb123)\ **Replies:** 1\ **Last updated:** [January 8, 2025, 1:53pm UTC](https://discuss.elastic.co/t/esql-fieldnames-with-slash-not-supported-just-removed-in-kibana/372935 "2025-01-08T13:53:04Z")
I have the following fieldnames in index (verified in kibana): python .\\bin\\elkq2.py --getmapping --index='bps-trace-ttl\_7d-8.16.1-rancher2-2025.01.08' fields: @timestamp,@versi… --- ## [Elasticsearch: create a new field based on the value of other fields in a time range](https://discuss.elastic.co/t/elasticsearch-create-a-new-field-based-on-the-value-of-other-fields-in-a-time-range/372929)
**Author:** [@sahere37](https://discuss.elastic.co/u/sahere37)\ **Replies:** 0\ **Last updated:** [January 8, 2025, 10:13am UTC](https://discuss.elastic.co/t/elasticsearch-create-a-new-field-based-on-the-value-of-other-fields-in-a-time-range/372929 "2025-01-08T10:13:17Z")
Hi all, I have some data in different timestamps as below image, imaging that the fields are "src label", "src value" "dst label" , "dst value" and timestamp. how can I define a new fields named as "In" based on th… --- ## [Async search performance on coplex aggregations](https://discuss.elastic.co/t/async-search-performance-on-coplex-aggregations/372922)
**Author:** [@Mahdi\_Moazami](https://discuss.elastic.co/u/Mahdi_Moazami)\ **Replies:** 0\ **Last updated:** [January 8, 2025, 8:53am UTC](https://discuss.elastic.co/t/async-search-performance-on-coplex-aggregations/372922 "2025-01-08T08:53:58Z")
Hello Elastic team, I recently got challenges on a complex aggregation search that when this aggregation is run sequentially by a python script, after some time goes on, it starts receiving circuit breaker errors on sea… --- ## [ILM with rollovers breaking data integrity](https://discuss.elastic.co/t/ilm-with-rollovers-breaking-data-integrity/369426)
**Author:** [@Kruttika](https://discuss.elastic.co/u/Kruttika)\ **Replies:** 16\ **Last updated:** [January 8, 2025, 8:28am UTC](https://discuss.elastic.co/t/ilm-with-rollovers-breaking-data-integrity/369426 "2025-01-08T08:28:35Z")
Hello, We have an index where we need to continuously write new docs, run full-text searches and update the matched docs with a flag. The data consists of social media posts and news articles with timestamps. We previo… --- ## [What does slash stand for in a index request?](https://discuss.elastic.co/t/what-does-slash-stand-for-in-a-index-request/372914)
**Author:** [@Richard\_Zhang](https://discuss.elastic.co/u/Richard_Zhang)\ **Replies:** 2\ **Last updated:** [January 8, 2025, 8:02am UTC](https://discuss.elastic.co/t/what-does-slash-stand-for-in-a-index-request/372914 "2025-01-08T08:02:21Z")
Maybe a stupid question, I ask because I feel like there could be some concept about ES index that I'm not aware of (and maybe many others don't know either.). So it's worth to ask this question because it can be helpful… --- ## [Is it possible to set task\_id?](https://discuss.elastic.co/t/is-it-possible-to-set-task-id/372919)
**Author:** [@asafalroy](https://discuss.elastic.co/u/asafalroy)\ **Replies:** 0\ **Last updated:** [January 8, 2025, 7:06am UTC](https://discuss.elastic.co/t/is-it-possible-to-set-task-id/372919 "2025-01-08T07:06:20Z")
Hey! Our team heavily relies on traces and I wondered if there was a way to set the task\_id of the elastic query to be the traceId from the services that made the request for troubleshooting purposes (long running tasks… --- ## [Proxy Configuration for API Monitoring in Heartbeat](https://discuss.elastic.co/t/proxy-configuration-for-api-monitoring-in-heartbeat/372916)
**Author:** [@vikascateina](https://discuss.elastic.co/u/vikascateina)\ **Replies:** 0\ **Last updated:** [January 8, 2025, 6:26am UTC](https://discuss.elastic.co/t/proxy-configuration-for-api-monitoring-in-heartbeat/372916 "2025-01-08T06:26:01Z")
Hi , I have configured the following settings to monitor APIs through a proxy in Heartbeat to check whether the APIs are up or down. I tested both proxy\_url and HTTP\_PROXY, but neither of them seems to be working as exp… --- ## [ILM created incorrect index name](https://discuss.elastic.co/t/ilm-created-incorrect-index-name/372877)
**Author:** [@Naveen\_S1](https://discuss.elastic.co/u/Naveen_S1)\ **Replies:** 0\ **Last updated:** [January 7, 2025, 5:32am UTC](https://discuss.elastic.co/t/ilm-created-incorrect-index-name/372877 "2025-01-07T05:32:26Z")
I have an ILM policy that creates a new index once the index reaches 250GB. With the incoming data, the current trend is 1 index / 1 day. I have started indexing 2 months before. I have started the initial index with the… --- ## [The inference processor triggers interface rate limiting](https://discuss.elastic.co/t/the-inference-processor-triggers-interface-rate-limiting/369902)
**Author:** [@Huaixinww](https://discuss.elastic.co/u/Huaixinww)\ **Replies:** 4\ **Last updated:** [January 8, 2025, 2:38am UTC](https://discuss.elastic.co/t/the-inference-processor-triggers-interface-rate-limiting/369902 "2025-01-08T02:38:32Z")
When using Elasticsearch's Inference API and Inference Processor to vectorize and write text (using Alibaba's text embedding model, PR:(\[Inference API\] Add Alibaba Cloud AI Search Model support to Inference API #111181),… --- ## [Question: Shard allocation awareness and search routing](https://discuss.elastic.co/t/question-shard-allocation-awareness-and-search-routing/372913)
**Author:** [@Huaixinww](https://discuss.elastic.co/u/Huaixinww)\ **Replies:** 0\ **Last updated:** [January 8, 2025, 2:36am UTC](https://discuss.elastic.co/t/question-shard-allocation-awareness-and-search-routing/372913 "2025-01-08T02:36:06Z")
Elasticsearch Version: 7.10.0 question: We have three awareness zones, and we found that the query traffic of the business is unevenly distributed among these zones. I researched related issues：Shard allocation awarene… --- ## [The update history of cluster settings](https://discuss.elastic.co/t/the-update-history-of-cluster-settings/372872)
**Author:** [@Richard\_Zhang](https://discuss.elastic.co/u/Richard_Zhang)\ **Replies:** 3\ **Last updated:** [January 8, 2025, 1:53am UTC](https://discuss.elastic.co/t/the-update-history-of-cluster-settings/372872 "2025-01-08T01:53:44Z")
as per doc update cluster settings request the api request updates the cluster settings. My question is - Is there any logs for tracking each time this api is called? I ask because we're seeing a strange setting in the… --- ## [How to restart elasticsearch after a power outage?](https://discuss.elastic.co/t/how-to-restart-elasticsearch-after-a-power-outage/372763)
**Author:** [@learningelastic](https://discuss.elastic.co/u/learningelastic)\ **Replies:** 5\ **Last updated:** [January 8, 2025, 1:07am UTC](https://discuss.elastic.co/t/how-to-restart-elasticsearch-after-a-power-outage/372763 "2025-01-08T01:07:42Z")
I have been hosting elasticsearch locally on my computer for over 1 year. It has been operating perfectly. Earlier this morning, there was a power outage in my city which caused my computer to lose power and unexpecte… --- ## [Is it possible to determine if an index was created automatically?](https://discuss.elastic.co/t/is-it-possible-to-determine-if-an-index-was-created-automatically/372874)
**Author:** [@Richard\_Zhang](https://discuss.elastic.co/u/Richard_Zhang)\ **Replies:** 3\ **Last updated:** [January 8, 2025, 12:50am UTC](https://discuss.elastic.co/t/is-it-possible-to-determine-if-an-index-was-created-automatically/372874 "2025-01-08T00:50:12Z")
Hi everyone, there are thousands of indices in our ES cluaster. Some of them were created automatically and some were explicitly created with a PUT request. I need to get the list of indices that were auto created whic… --- ## [Comparing JMeter Test Results in Kibana Dashboards](https://discuss.elastic.co/t/comparing-jmeter-test-results-in-kibana-dashboards/363187)
**Author:** [@JiTZ\_GV](https://discuss.elastic.co/u/JiTZ_GV)\ **Replies:** 4\ **Last updated:** [January 7, 2025, 10:35pm UTC](https://discuss.elastic.co/t/comparing-jmeter-test-results-in-kibana-dashboards/363187 "2025-01-07T22:35:08Z")
I'm using the JMeter Elastic plugin to push performance metrics to an Elasticsearch index. I've created a Kibana Dashboard to view JMeter results for a specific test time window. Now, I'd like to know if there's a way to… --- ## [Is the guidance for cluster.routing.allocation.\* settings still accurate?](https://discuss.elastic.co/t/is-the-guidance-for-cluster-routing-allocation-settings-still-accurate/372909)
**Author:** [@BenB196](https://discuss.elastic.co/u/BenB196)\ **Replies:** 0\ **Last updated:** [January 7, 2025, 9:22pm UTC](https://discuss.elastic.co/t/is-the-guidance-for-cluster-routing-allocation-settings-still-accurate/372909 "2025-01-07T21:22:42Z")
Hi All, I was curious if anyone knows if the guidance for the cluster.routing.allocation.\* settings (ex: cluster.routing.allocation.node\_concurrent\_recoveries & cluster.routing.allocation.node\_initial\_primaries\_recoveri… --- ## [Does Elastic Agent support kafka as an input?](https://discuss.elastic.co/t/does-elastic-agent-support-kafka-as-an-input/372878)
**Author:** [@Priyanka\_chauhan](https://discuss.elastic.co/u/Priyanka_chauhan)\ **Replies:** 4\ **Last updated:** [January 7, 2025, 8:12pm UTC](https://discuss.elastic.co/t/does-elastic-agent-support-kafka-as-an-input/372878 "2025-01-07T20:12:31Z")
If I have to send logs data from kafka topic of cisco ise logs for using CISO integration using elastic agent . how to setup that . As I am getting that kafka input is not supporting in elastic agent yaml . --- ## [Elastic Agent container image cannot read logs from Journal](https://discuss.elastic.co/t/elastic-agent-container-image-cannot-read-logs-from-journal/372905)
**Author:** [@lpeter](https://discuss.elastic.co/u/lpeter)\ **Replies:** 0\ **Last updated:** [January 7, 2025, 6:56pm UTC](https://discuss.elastic.co/t/elastic-agent-container-image-cannot-read-logs-from-journal/372905 "2025-01-07T18:56:02Z")
Hello! I'm fairly certain this is a bug, but on GitHub I'm told to post here, so here we go: Since Journal logs are now read via journalctl (PR) the agent container (8.17.0 for example) cannot read journal system logs … [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=115) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=117)