# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=118 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 119 --- ## [Using join field](https://discuss.elastic.co/t/using-join-field/372753)
**Author:** [@denisbik349](https://discuss.elastic.co/u/denisbik349)\ **Replies:** 0\ **Last updated:** [January 3, 2025, 3:22pm UTC](https://discuss.elastic.co/t/using-join-field/372753 "2025-01-03T15:22:39Z")
Hello everyone! I have problem joining 2 documents in one index by using join type field. I have input, filter and output files configured for Logstash. I have index and index pattern set up in Elasticsearch. I was abl… --- ## [JSON filter plugin](https://discuss.elastic.co/t/json-filter-plugin/372731)
**Author:** [@shaddow](https://discuss.elastic.co/u/shaddow)\ **Replies:** 1\ **Last updated:** [January 3, 2025, 1:08pm UTC](https://discuss.elastic.co/t/json-filter-plugin/372731 "2025-01-03T13:08:45Z")
I want to configure a JSON filter plugin in my ELK stack, but after configuring the following files, I don't see any data in Kibana. I'm not sure if I need to configure any additional files. Can anyone help me? logsta… --- ## [IngressRoute not exposing kibana for ECK operator](https://discuss.elastic.co/t/ingressroute-not-exposing-kibana-for-eck-operator/372747)
**Author:** [@Merthan\_Tukus](https://discuss.elastic.co/u/Merthan_Tukus)\ **Replies:** 0\ **Last updated:** [January 3, 2025, 1:05pm UTC](https://discuss.elastic.co/t/ingressroute-not-exposing-kibana-for-eck-operator/372747 "2025-01-03T13:05:41Z")
IngressRoute (Traefik) not exposing on our domain, while port forwarding works. Cloudflare is correctly set up for dns resolving. Anyone know how to get it working, since we are now getting an internal server error As … --- ## [Incremental snapshots are failing in "Trying to write new repository data over unfinished write"](https://discuss.elastic.co/t/incremental-snapshots-are-failing-in-trying-to-write-new-repository-data-over-unfinished-write/372408)
**Author:** [@Rajesh\_Kannan](https://discuss.elastic.co/u/Rajesh_Kannan)\ **Replies:** 7\ **Last updated:** [January 3, 2025, 12:11pm UTC](https://discuss.elastic.co/t/incremental-snapshots-are-failing-in-trying-to-write-new-repository-data-over-unfinished-write/372408 "2025-01-03T12:11:20Z")
The incremental snapshot is failing with the below error. There is only one successful backup created and the daily crons are failing with the below errors. {"type": "server", "timestamp": "2024-12-26T06:46:46,097Z", "l… --- ## [\_sql/translate api translate incorect case when field](https://discuss.elastic.co/t/sql-translate-api-translate-incorect-case-when-field/372741)
**Author:** [@tung238](https://discuss.elastic.co/u/tung238)\ **Replies:** 1\ **Last updated:** [January 3, 2025, 12:08pm UTC](https://discuss.elastic.co/t/sql-translate-api-translate-incorect-case-when-field/372741 "2025-01-03T12:08:16Z")
I have a query like this and although /\_sql endpoint return correct results. /\_sql/translate only return fields that use in query, without calculation POST /\_sql/translate { "query": "SELECT Broker,IssueCount,Splits,C… --- ## [Cloudwatch logs to Kafka using Elastic agent](https://discuss.elastic.co/t/cloudwatch-logs-to-kafka-using-elastic-agent/372736)
**Author:** [@ErGeek](https://discuss.elastic.co/u/ErGeek)\ **Replies:** 0\ **Last updated:** [January 3, 2025, 8:25am UTC](https://discuss.elastic.co/t/cloudwatch-logs-to-kafka-using-elastic-agent/372736 "2025-01-03T08:25:23Z")
Hi All, We are trying to get Cloudwatch logs to Kafka using the elastic agent using the below config: agent: logging: files: keepfiles: 7 name: elastic-agent path: /var/log/elastic-agent/ … --- ## [ELK 8, Zabbix 7.2, set trigger on Zabbix server](https://discuss.elastic.co/t/elk-8-zabbix-7-2-set-trigger-on-zabbix-server/372681)
**Author:** [@Mostafa\_Faridi](https://discuss.elastic.co/u/Mostafa_Faridi)\ **Replies:** 1\ **Last updated:** [January 2, 2025, 7:06pm UTC](https://discuss.elastic.co/t/elk-8-zabbix-7-2-set-trigger-on-zabbix-server/372681 "2025-01-02T19:06:13Z")
I have ELK 8 server, on this server I have elasticsearch, logstash and kibana, on other servers I install filebeat, filebeat send logs to logstash, I also have Zabbix 7.2 LTS version too, this is sample logs generate b… --- ## [Grok pattern](https://discuss.elastic.co/t/grok-pattern/372704)
**Author:** [@Eshwar\_K](https://discuss.elastic.co/u/Eshwar_K)\ **Replies:** 2\ **Last updated:** [January 2, 2025, 6:46pm UTC](https://discuss.elastic.co/t/grok-pattern/372704 "2025-01-02T18:46:48Z")
Hi All, I have below log content which I am capturing from security application so I want to prepare grok pattern to simplify the log however I couldn't make grok pattern for below logs. Kindly suggest what pattern is s… --- ## [How we can manage to large shards on index?](https://discuss.elastic.co/t/how-we-can-manage-to-large-shards-on-index/372652)
**Author:** [@calvin01](https://discuss.elastic.co/u/calvin01)\ **Replies:** 11\ **Last updated:** [January 2, 2025, 4:19pm UTC](https://discuss.elastic.co/t/how-we-can-manage-to-large-shards-on-index/372652 "2025-01-02T16:19:13Z")
Hello, community Issue Overview: We are encountering an issue with one of our indices, which has entered an alerting state. The shard size for this index is currently 129.27GB, and it continues to increase. The index i… --- ## [Documentation for upgrading elasticsearch from archived repository to eck-stack](https://discuss.elastic.co/t/documentation-for-upgrading-elasticsearch-from-archived-repository-to-eck-stack/366057)
**Author:** [@ashwani.agrawal](https://discuss.elastic.co/u/ashwani.agrawal)\ **Replies:** 5\ **Last updated:** [January 2, 2025, 3:34pm UTC](https://discuss.elastic.co/t/documentation-for-upgrading-elasticsearch-from-archived-repository-to-eck-stack/366057 "2025-01-02T15:34:08Z")
Hi Team, We are currently using elasticsearch on our kubernetes cluster installed using archived helm chart repository: helm-charts/elasticsearch at main · elastic/helm-charts · GitHub 8.1.3 version. Now we need to upd… --- ## [Elasticsearch Semantic\_text Search](https://discuss.elastic.co/t/elasticsearch-semantic-text-search/372361)
**Author:** [@samer\_saleh](https://discuss.elastic.co/u/samer_saleh)\ **Replies:** 1\ **Last updated:** [January 2, 2025, 3:31pm UTC](https://discuss.elastic.co/t/elasticsearch-semantic-text-search/372361 "2025-01-02T15:31:27Z")
Hi, Is there any plans to make the semantic\_text field nested on the future so that chunks can be searched , scored and returned as part of inner\_hits query? Right now it doesnt seem like there is a way to do that. yes… --- ## [Normalizing knn and multi\_match clauses](https://discuss.elastic.co/t/normalizing-knn-and-multi-match-clauses/372307)
**Author:** [@Itay\_Bittan](https://discuss.elastic.co/u/Itay_Bittan)\ **Replies:** 1\ **Last updated:** [January 2, 2025, 1:40pm UTC](https://discuss.elastic.co/t/normalizing-knn-and-multi-match-clauses/372307 "2025-01-02T13:40:37Z")
I have a product catalog as Elasticsearch (8.16.1) index. Each doc represent a product with different fields, such as name, color, etc. I've added a vector as additional field to each product / doc. My search is can b… --- ## [How to stop/start an elastic cluster in AKS](https://discuss.elastic.co/t/how-to-stop-start-an-elastic-cluster-in-aks/371871)
**Author:** [@Manuel\_Osorio](https://discuss.elastic.co/u/Manuel_Osorio)\ **Replies:** 1\ **Last updated:** [January 1, 2025, 7:30pm UTC](https://discuss.elastic.co/t/how-to-stop-start-an-elastic-cluster-in-aks/371871 "2025-01-01T19:30:32Z")
Hi everyone, I need to find a way to stop an elastic cluster for some cost savings, I am looking how to do it and start the cluster only when it's required. could you please share some guidance for this? Thanks a lot --- ## [Shard failure continuously](https://discuss.elastic.co/t/shard-failure-continuously/372581)
**Author:** [@Akesh\_Jadhav](https://discuss.elastic.co/u/Akesh_Jadhav)\ **Replies:** 1\ **Last updated:** [January 1, 2025, 3:37pm UTC](https://discuss.elastic.co/t/shard-failure-continuously/372581 "2025-01-01T15:37:30Z")
Hi , I have on Elasticsearch server with one node with six indexes . I indexing some documents in one of my index name as A , some of my documents are ingested successfully and I can able to see my documents but after s… --- ## [Issues with Persistent Changes in Metricbeat Visuals and Index Mapping](https://discuss.elastic.co/t/issues-with-persistent-changes-in-metricbeat-visuals-and-index-mapping/372635)
**Author:** [@componentByss](https://discuss.elastic.co/u/componentByss)\ **Replies:** 7\ **Last updated:** [December 31, 2024, 3:55pm UTC](https://discuss.elastic.co/t/issues-with-persistent-changes-in-metricbeat-visuals-and-index-mapping/372635 "2024-12-31T15:55:25Z")
Hello everyone, I'm encountering an issue in Kibana 8.9.1 where changes made in the Visualize Library to the Metricbeat Docker ECS table, for example, do not persist after a set number of days. Specifically, the visuali… --- ## [Disable simd vector functionality at compile time](https://discuss.elastic.co/t/disable-simd-vector-functionality-at-compile-time/372665)
**Author:** [@sumitd2](https://discuss.elastic.co/u/sumitd2)\ **Replies:** 0\ **Last updated:** [December 31, 2024, 1:56pm UTC](https://discuss.elastic.co/t/disable-simd-vector-functionality-at-compile-time/372665 "2024-12-31T13:56:11Z")
Hi there, I am wondering if there is a way to disable the simd vector functionality at compile time. Thanks. --- ## [Unable to uninstall elastic agent silently](https://discuss.elastic.co/t/unable-to-uninstall-elastic-agent-silently/372645)
**Author:** [@Al1984](https://discuss.elastic.co/u/Al1984)\ **Replies:** 1\ **Last updated:** [December 30, 2024, 11:37pm UTC](https://discuss.elastic.co/t/unable-to-uninstall-elastic-agent-silently/372645 "2024-12-30T23:37:03Z")
Hi All, I'm trying to use the following query "C:\\Program Files\\Elastic\\Agent\\elastic-agent.exe uninstall" to uninstall the Elastic agent on many devices, if I run that script on one device it uninstall the agent success… --- ## [Can't get \`co.elastic.logs/raw\` hint to work](https://discuss.elastic.co/t/cant-get-co-elastic-logs-raw-hint-to-work/372640)
**Author:** [@rkrzewski](https://discuss.elastic.co/u/rkrzewski)\ **Replies:** 0\ **Last updated:** [December 30, 2024, 9:35pm UTC](https://discuss.elastic.co/t/cant-get-co-elastic-logs-raw-hint-to-work/372640 "2024-12-30T21:35:24Z")
I'm running ELK 8.15.0 on Kubernetes using ECK operator. My cluster-wide filebeat configuration set in a beat.k8s.elastic.co/v1beta1 Beat resource is the following: filebeat: autodiscover: providers: … --- ## [Adding new raw data, requesting suggestions](https://discuss.elastic.co/t/adding-new-raw-data-requesting-suggestions/372607)
**Author:** [@Trent-alex](https://discuss.elastic.co/u/Trent-alex)\ **Replies:** 9\ **Last updated:** [December 30, 2024, 8:17pm UTC](https://discuss.elastic.co/t/adding-new-raw-data-requesting-suggestions/372607 "2024-12-30T20:17:31Z")
Hello Community, I appreciate you. Ok, on to my question. I have 30 TB of data on a windows drive that I plan to move to my linux cluster, hosting elastic stack. All resources are self managed on premises. For referen… --- ## [High build\_scorer value in the query profile result for query wrapped in constant\_score](https://discuss.elastic.co/t/high-build-scorer-value-in-the-query-profile-result-for-query-wrapped-in-constant-score/371976)
**Author:** [@lzz118](https://discuss.elastic.co/u/lzz118)\ **Replies:** 2\ **Last updated:** [December 30, 2024, 7:50pm UTC](https://discuss.elastic.co/t/high-build-scorer-value-in-the-query-profile-result-for-query-wrapped-in-constant-score/371976 "2024-12-30T19:50:39Z")
Hi there, I used the profiler api to investigate a slow query which is wrapped in constant\_score and filter clause. In the query I used term query to match about 12 keyword terms. I don't want any scoring but in the pro… --- ## [Error upgrading kibana to newer version 8.17.0](https://discuss.elastic.co/t/error-upgrading-kibana-to-newer-version-8-17-0/372577)
**Author:** [@lusynda](https://discuss.elastic.co/u/lusynda)\ **Replies:** 4\ **Last updated:** [December 30, 2024, 7:02pm UTC](https://discuss.elastic.co/t/error-upgrading-kibana-to-newer-version-8-17-0/372577 "2024-12-30T19:02:49Z")
Hi all, I've been having this problems for the last 2 kibana version upgrade. from 8.15.0 to 8.16.0 and from 8.16.0 to 8.17.0 Everytime i upgrade using both apt package manager and from deb package it gave me this err… --- ## [Kibana err\_empty\_response from Kibana](https://discuss.elastic.co/t/kibana-err-empty-response-from-kibana/372634)
**Author:** [@douglas\_Garcia](https://discuss.elastic.co/u/douglas_Garcia)\ **Replies:** 1\ **Last updated:** [December 30, 2024, 6:08pm UTC](https://discuss.elastic.co/t/kibana-err-empty-response-from-kibana/372634 "2024-12-30T18:08:14Z")
Hello Team, I have installed on my local machine ES and Kibana to test around I am able to run ES and log in but when it comes to Kibana I have a small issue; I am able to install it and also run the service but when … --- ## [Elasticsearch semantic\_text search](https://discuss.elastic.co/t/elasticsearch-semantic-text-search/372217)
**Author:** [@samer\_saleh](https://discuss.elastic.co/u/samer_saleh)\ **Replies:** 6\ **Last updated:** [December 30, 2024, 5:34pm UTC](https://discuss.elastic.co/t/elasticsearch-semantic-text-search/372217 "2024-12-30T17:34:36Z")
Hi, I'm starting to learn Elasticsearch because I have specific requirement and Im trying to do proof of concept where someone can semantically search document contents (pdf , docx ...etc.). I have used the FSCrawler t… --- ## [Template with msearch in elastic search](https://discuss.elastic.co/t/template-with-msearch-in-elastic-search/372630)
**Author:** [@karthikeyanc2003](https://discuss.elastic.co/u/karthikeyanc2003)\ **Replies:** 0\ **Last updated:** [December 30, 2024, 5:20pm UTC](https://discuss.elastic.co/t/template-with-msearch-in-elastic-search/372630 "2024-12-30T17:20:30Z")
Dear Team, I am working in Elasticsearch and get a new requirement to create template with multiple search (msearch). I created plenty of search templates with only one search. But want to create a template with multipl… --- ## [Logstash trying to map object on empty text "Illegal argument exception STAT\_OBJECT"](https://discuss.elastic.co/t/logstash-trying-to-map-object-on-empty-text-illegal-argument-exception-stat-object/372622)
**Author:** [@grumo35](https://discuss.elastic.co/u/grumo35)\ **Replies:** 2\ **Last updated:** [December 30, 2024, 2:13pm UTC](https://discuss.elastic.co/t/logstash-trying-to-map-object-on-empty-text-illegal-argument-exception-stat-object/372622 "2024-12-30T14:13:24Z")
Hello, I'm facing an ever lasting issue on some dataset where some "dynamic" plugins like kv or json can map certain field values as object. For example service =\> "{}" I'm not a big fan of per dataset fixes where i t… --- ## [Analysis on the Data Usage in Elastic](https://discuss.elastic.co/t/analysis-on-the-data-usage-in-elastic/372614)
**Author:** [@vishal96](https://discuss.elastic.co/u/vishal96)\ **Replies:** 1\ **Last updated:** [December 30, 2024, 1:57pm UTC](https://discuss.elastic.co/t/analysis-on-the-data-usage-in-elastic/372614 "2024-12-30T13:57:30Z")
Hi Elastic Community, I need some guidance in analyzing the data usage in the Elastic Tool. My first objective is to fetch the daily/weekly/monthly data usage. My second objective is to find how much data is sent to t… --- ## [Frequent shard failures](https://discuss.elastic.co/t/frequent-shard-failures/372579)
**Author:** [@Akesh\_Jadhav](https://discuss.elastic.co/u/Akesh_Jadhav)\ **Replies:** 8\ **Last updated:** [December 30, 2024, 12:29pm UTC](https://discuss.elastic.co/t/frequent-shard-failures/372579 "2024-12-30T12:29:19Z")
Hi, We are running a 1node Elasticsearch Cluster on Elastic stack version 7.17.9. The node are running on computer with SSD storage and 128GB RAM. But when I indexing some data on elastic after some time indexing gettin… --- ## [Relation between JVM Usage and multi node in Elasticsearch](https://discuss.elastic.co/t/relation-between-jvm-usage-and-multi-node-in-elasticsearch/372434)
**Author:** [@Fajaruddin\_Shiddiq](https://discuss.elastic.co/u/Fajaruddin_Shiddiq)\ **Replies:** 2\ **Last updated:** [December 30, 2024, 9:29am UTC](https://discuss.elastic.co/t/relation-between-jvm-usage-and-multi-node-in-elasticsearch/372434 "2024-12-30T09:29:31Z")
Hi Team, We’re encountering recurring circuit breaker issues in our Elasticsearch. Our current setup is as follows: RAM: 32GB JVM: 16GB Previously, we had 16GB RAM and 8GB JVM but experienced the same circuit breaker… --- ## [Cross Cluster search (certificate required)](https://discuss.elastic.co/t/cross-cluster-search-certificate-required/372277)
**Author:** [@krzychohoho](https://discuss.elastic.co/u/krzychohoho)\ **Replies:** 1\ **Last updated:** [December 30, 2024, 12:22am UTC](https://discuss.elastic.co/t/cross-cluster-search-certificate-required/372277 "2024-12-30T00:22:56Z")
Hi, I have a huge problem w Elasticsearch cross cluster search. I have two clusters that have the same version and licensing levels. They are both signed by the same CA. I am trying to configure cross cluster search betw… --- ## [Kibana Roles "Show reserved roles" not sticky](https://discuss.elastic.co/t/kibana-roles-show-reserved-roles-not-sticky/372287)
**Author:** [@rugenl](https://discuss.elastic.co/u/rugenl)\ **Replies:** 0\ **Last updated:** [December 20, 2024, 8:25pm UTC](https://discuss.elastic.co/t/kibana-roles-show-reserved-roles-not-sticky/372287 "2024-12-20T20:25:07Z")
When working with roles, unclicking "show reserved roles" to make the list manageable. As soon as you look at a role and come back, that switch becomes "unstuck". Just a suggestion, I think it should stay set, at least… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=117) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=119)