# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=119 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 120 --- ## [Kibana Search Application Customize Returned Result](https://discuss.elastic.co/t/kibana-search-application-customize-returned-result/372609)
**Author:** [@samer\_saleh](https://discuss.elastic.co/u/samer_saleh)\ **Replies:** 0\ **Last updated:** [December 29, 2024, 11:54pm UTC](https://discuss.elastic.co/t/kibana-search-application-customize-returned-result/372609 "2024-12-29T23:54:06Z")
Hi , Im trying the Kibana Search Applications for the first time. Initially when I created the search application against a certain index I was getting all the fields displayed. After some reading I found that I can you… --- ## [Adding a node to a cluster , using 3 hosts, AlmaLinux 9, Elasticsearch 8.17](https://discuss.elastic.co/t/adding-a-node-to-a-cluster-using-3-hosts-almalinux-9-elasticsearch-8-17/372464)
**Author:** [@Trent-alex](https://discuss.elastic.co/u/Trent-alex)\ **Replies:** 14\ **Last updated:** [December 29, 2024, 10:49pm UTC](https://discuss.elastic.co/t/adding-a-node-to-a-cluster-using-3-hosts-almalinux-9-elasticsearch-8-17/372464 "2024-12-29T22:49:23Z")
Hello, I am quite new to Elasticsearch and having trouble adding nodes to my single node cluster. All nodes are on their own servers. Most responses on this subject are several years old. So Im asking again. My first n… --- ## [Improving search results for misspelled queries with ELSER semantic search](https://discuss.elastic.co/t/improving-search-results-for-misspelled-queries-with-elser-semantic-search/370935)
**Author:** [@Sarah2](https://discuss.elastic.co/u/Sarah2)\ **Replies:** 1\ **Last updated:** [December 29, 2024, 6:33pm UTC](https://discuss.elastic.co/t/improving-search-results-for-misspelled-queries-with-elser-semantic-search/370935 "2024-12-29T18:33:35Z")
Using Elastic Search 8.11 and ELSER model to perform semantic search on multiple fields. I have not included any lexical search match in combination as using only embeddings field with text expansion is giving good resul… --- ## [Filter values in Metricbeat 8.7.0](https://discuss.elastic.co/t/filter-values-in-metricbeat-8-7-0/372583)
**Author:** [@Viktor\_Movita](https://discuss.elastic.co/u/Viktor_Movita)\ **Replies:** 1\ **Last updated:** [December 29, 2024, 5:47pm UTC](https://discuss.elastic.co/t/filter-values-in-metricbeat-8-7-0/372583 "2024-12-29T17:47:27Z")
Hello, I am using Metricbeat version 8.7.0 and trying to filter values in the system.process.cmdline field. I added the following section to the system.yml file: - module: system period: 1m metricsets: - proce… --- ## [Seeks advice on designing an efficient and reliable Elastic cluster setup, specifically regarding the placement of Logstash and Kibana nodes within a firewall-based architecture](https://discuss.elastic.co/t/seeks-advice-on-designing-an-efficient-and-reliable-elastic-cluster-setup-specifically-regarding-the-placement-of-logstash-and-kibana-nodes-within-a-firewall-based-architecture/372322)
**Author:** [@Weeltin](https://discuss.elastic.co/u/Weeltin)\ **Replies:** 2\ **Last updated:** [December 29, 2024, 9:58am UTC](https://discuss.elastic.co/t/seeks-advice-on-designing-an-efficient-and-reliable-elastic-cluster-setup-specifically-regarding-the-placement-of-logstash-and-kibana-nodes-within-a-firewall-based-architecture/372322 "2024-12-29T09:58:30Z")
Hi everyone, I'm in the process of setting up an Elastic cluster, and I'm looking for some advice on the best way to proceed to ensure I end up with an efficient and reliable solution. Here's my current setup: My i… --- ## [Dashboards for Suricata \> Filebeat \> Logstash Setup](https://discuss.elastic.co/t/dashboards-for-suricata-filebeat-logstash-setup/372436)
**Author:** [@elastirroot](https://discuss.elastic.co/u/elastirroot)\ **Replies:** 11\ **Last updated:** [December 29, 2024, 3:10am UTC](https://discuss.elastic.co/t/dashboards-for-suricata-filebeat-logstash-setup/372436 "2024-12-29T03:10:19Z")
Hi, I have my Stack setup across two machines. The first with Suricata and filebeat and the other logstash and Kibana/Elasticsearch. tcpdump confirms logs are being sent over and I recently figured out how to import my… --- ## [Setting up a Cluster](https://discuss.elastic.co/t/setting-up-a-cluster/372576)
**Author:** [@thejackal2020](https://discuss.elastic.co/u/thejackal2020)\ **Replies:** 3\ **Last updated:** [December 28, 2024, 8:31pm UTC](https://discuss.elastic.co/t/setting-up-a-cluster/372576 "2024-12-28T20:31:52Z")
I have created a small cluster of 2 nodes. I am planning on adding more. Here is my configuration for the master node.name: node-1 node.roles: \["master", "data"\] path.data: /var/lib/elasticsearch path.logs: /var/log/el… --- ## [Mailing dashborad as PDF using Watcher](https://discuss.elastic.co/t/mailing-dashborad-as-pdf-using-watcher/372359)
**Author:** [@zaeemmasood](https://discuss.elastic.co/u/zaeemmasood)\ **Replies:** 9\ **Last updated:** [December 28, 2024, 4:37pm UTC](https://discuss.elastic.co/t/mailing-dashborad-as-pdf-using-watcher/372359 "2024-12-28T16:37:26Z")
Hi All, I created a dashboard in Kibana and trying to set up a watcher that should send the dashboard as PDF to an email address periodically. My watcher json is as below: { "trigger": { "schedule": { "cro… --- ## [Failed to download geoip databases](https://discuss.elastic.co/t/failed-to-download-geoip-databases/372274)
**Author:** [@ethical20](https://discuss.elastic.co/u/ethical20)\ **Replies:** 15\ **Last updated:** [December 27, 2024, 4:38pm UTC](https://discuss.elastic.co/t/failed-to-download-geoip-databases/372274 "2024-12-27T16:38:27Z")
Hi, I was getting the Geo coordinates and IP countries from my Nginx logs via elastic agents since long time. Now I can see this part is not available to new ingested logs (from same services) and the log field has this… --- ## [Elastichsearch is red and indexes corrupted](https://discuss.elastic.co/t/elastichsearch-is-red-and-indexes-corrupted/372472)
**Author:** [@bkubra](https://discuss.elastic.co/u/bkubra)\ **Replies:** 5\ **Last updated:** [December 27, 2024, 4:09pm UTC](https://discuss.elastic.co/t/elastichsearch-is-red-and-indexes-corrupted/372472 "2024-12-27T16:09:30Z")
how can i fix this problem? --- ## [Unable to authenticate user \[elastic\] for REST request \[/\]](https://discuss.elastic.co/t/unable-to-authenticate-user-elastic-for-rest-request/372371)
**Author:** [@am75](https://discuss.elastic.co/u/am75)\ **Replies:** 7\ **Last updated:** [December 27, 2024, 3:36pm UTC](https://discuss.elastic.co/t/unable-to-authenticate-user-elastic-for-rest-request/372371 "2024-12-27T15:36:12Z")
I'm trying to deploy Elastic Stack as described here: https://www.elastic.co/blog/getting-started-with-the-elastic-stack-and-docker-compose. Docker images start correctly, but I can't authenticate although the password … --- ## [OsQuery high consumption memory](https://discuss.elastic.co/t/osquery-high-consumption-memory/370090)
**Author:** [@Gaston\_Beltramelli](https://discuss.elastic.co/u/Gaston_Beltramelli)\ **Replies:** 3\ **Last updated:** [December 27, 2024, 3:02pm UTC](https://discuss.elastic.co/t/osquery-high-consumption-memory/370090 "2024-12-27T15:02:24Z")
We are trying in production for the first time and in many server, we deployed it in 40 servers and we saw that OsQuery use up to 1.4gb of memory. I couldn´t find any information or workarround or even if it is normal co… --- ## [Heavy SQL execution timeout](https://discuss.elastic.co/t/heavy-sql-execution-timeout/372480)
**Author:** [@Gaston\_Beltramelli](https://discuss.elastic.co/u/Gaston_Beltramelli)\ **Replies:** 0\ **Last updated:** [December 27, 2024, 2:57pm UTC](https://discuss.elastic.co/t/heavy-sql-execution-timeout/372480 "2024-12-27T14:57:28Z")
Hi everyone, I’m having trouble configuring the timeout in the SQL module of Metricbeat. My SQL queries are still taking longer than the default timeout period and i didnt find a way to solve it. Has anyone else exper… --- ## [Windows file server files auditing - parsing logs](https://discuss.elastic.co/t/windows-file-server-files-auditing-parsing-logs/371320)
**Author:** [@Adriano\_Trindade](https://discuss.elastic.co/u/Adriano_Trindade)\ **Replies:** 4\ **Last updated:** [December 26, 2024, 8:41pm UTC](https://discuss.elastic.co/t/windows-file-server-files-auditing-parsing-logs/371320 "2024-12-26T20:41:14Z")
Hello everyone! I've set up Windows logs for auditing a Windows file server. File access logs being generated OK. I've deployed a ELK stack in a VM. Configured Winlogbeats on Windows file server OK. Security logs are be… --- ## [Size\_limit\_exceeded\_exception](https://discuss.elastic.co/t/size-limit-exceeded-exception/372374)
**Author:** [@praveen4bv](https://discuss.elastic.co/u/praveen4bv)\ **Replies:** 1\ **Last updated:** [December 26, 2024, 3:36pm UTC](https://discuss.elastic.co/t/size-limit-exceeded-exception/372374 "2024-12-26T15:36:55Z")
Hi, We have recently upgraded from Elasticsearch 7.17.11 to 7.17.25. Post the upgrade, we started seeing the below exception while querying through Search (Mustache) templates. ElasticsearchStatusException\[Elasticsearc… --- ## [Restore data for only a specific index within a data stream](https://discuss.elastic.co/t/restore-data-for-only-a-specific-index-within-a-data-stream/372386)
**Author:** [@debuggedme](https://discuss.elastic.co/u/debuggedme)\ **Replies:** 5\ **Last updated:** [December 26, 2024, 3:48am UTC](https://discuss.elastic.co/t/restore-data-for-only-a-specific-index-within-a-data-stream/372386 "2024-12-26T03:48:23Z")
Regarding the snapshot and restore functionality for data streams, I can only snapshot all the data within a data stream at once, and when restoring, I can only restore all the data at once as well. Is it possible to re… --- ## [Parsing with logstash shows correct with debug but unable to ingest](https://discuss.elastic.co/t/parsing-with-logstash-shows-correct-with-debug-but-unable-to-ingest/372379)
**Author:** [@Blason](https://discuss.elastic.co/u/Blason)\ **Replies:** 2\ **Last updated:** [December 25, 2024, 11:29am UTC](https://discuss.elastic.co/t/parsing-with-logstash-shows-correct-with-debug-but-unable-to-ingest/372379 "2024-12-25T11:29:38Z")
Hi Everyone, I am struggling to ingest messages using logstash, I have been working on the parser for lst 2 weeks but unable to succeed. Grok debugger and rubydebug perfectly show that messages are correctly parsed howe… --- ## [Logs@custom component template not used](https://discuss.elastic.co/t/logs-custom-component-template-not-used/366909)
**Author:** [@gwychowaniec-zt](https://discuss.elastic.co/u/gwychowaniec-zt)\ **Replies:** 1\ **Last updated:** [December 25, 2024, 9:27am UTC](https://discuss.elastic.co/t/logs-custom-component-template-not-used/366909 "2024-12-25T09:27:45Z")
Hello, I have a problem with the default component templates for logs index. According to the documentation, 4 component templates should be used: logs@mappings logs@settings logs@custom ecs@mappings However, despite… --- ## [Grok Parsing Error When Integrating Elastic Agent with Juniper SRX](https://discuss.elastic.co/t/grok-parsing-error-when-integrating-elastic-agent-with-juniper-srx/372346)
**Author:** [@wangsubo](https://discuss.elastic.co/u/wangsubo)\ **Replies:** 4\ **Last updated:** [December 25, 2024, 7:32am UTC](https://discuss.elastic.co/t/grok-parsing-error-when-integrating-elastic-agent-with-juniper-srx/372346 "2024-12-25T07:32:11Z")
Hello everyone, I encountered an issue while integrating Elastic Agent with Juniper SRX and would like to seek some help or suggestions. I have configured Juniper to send structured-data logs via syslog to Elastic Agen… --- ## [Filebeat doesn't send updated logs](https://discuss.elastic.co/t/filebeat-doesnt-send-updated-logs/372325)
**Author:** [@Sergey\_Ivanov1](https://discuss.elastic.co/u/Sergey_Ivanov1)\ **Replies:** 1\ **Last updated:** [December 24, 2024, 6:13pm UTC](https://discuss.elastic.co/t/filebeat-doesnt-send-updated-logs/372325 "2024-12-24T18:13:03Z")
Good day! Have a problem, my filebeat, wich is installed in Windows doesn't send updated logs. After restart the service, filebeat send all the data from the file, and that is it. After some time I can see that the log … --- ## [Removing persistent cluster settings](https://discuss.elastic.co/t/removing-persistent-cluster-settings/372341)
**Author:** [@zaeemmasood](https://discuss.elastic.co/u/zaeemmasood)\ **Replies:** 5\ **Last updated:** [December 24, 2024, 2:14pm UTC](https://discuss.elastic.co/t/removing-persistent-cluster-settings/372341 "2024-12-24T14:14:34Z")
Hi All, I applied the following in my test environment through Dev tools: PUT /\_cluster/settings { "persistent": { "xpack.notification.email.account.exchange\_account": { "profile": "outloo… --- ## [Migrating from Elasticsearch 7 to Elastic.Clients.Elasticsearch 8.16 - Bulk Upsert Issues](https://discuss.elastic.co/t/migrating-from-elasticsearch-7-to-elastic-clients-elasticsearch-8-16-bulk-upsert-issues/372354)
**Author:** [@trubs](https://discuss.elastic.co/u/trubs)\ **Replies:** 0\ **Last updated:** [December 24, 2024, 10:23am UTC](https://discuss.elastic.co/t/migrating-from-elasticsearch-7-to-elastic-clients-elasticsearch-8-16-bulk-upsert-issues/372354 "2024-12-24T10:23:07Z")
Hi there, my team is in the process of migrating from Elasticsearch 7 to Elastic.Clients.Elasticsearch 8.16, and I'm having some issues with bulk upsert functionality after refactoring my code. I initially had the follo… --- ## [Qualys VMDR bug](https://discuss.elastic.co/t/qualys-vmdr-bug/362777)
**Author:** [@djkprojects](https://discuss.elastic.co/u/djkprojects)\ **Replies:** 5\ **Last updated:** [December 23, 2024, 9:55pm UTC](https://discuss.elastic.co/t/qualys-vmdr-bug/362777 "2024-12-23T21:55:55Z")
Hello, It looks that the v4.0.0 of Qualys VMDR integration is broken as when enabling Host Detection we are getting the following error: failed to check program: failed compilation: ERROR: :15:9: unsupported syntax '?… --- ## [Qualys VMDR integration, add Qualys Tags in documents](https://discuss.elastic.co/t/qualys-vmdr-integration-add-qualys-tags-in-documents/368891)
**Author:** [@Juma](https://discuss.elastic.co/u/Juma)\ **Replies:** 1\ **Last updated:** [December 23, 2024, 9:50pm UTC](https://discuss.elastic.co/t/qualys-vmdr-integration-add-qualys-tags-in-documents/368891 "2024-12-23T21:50:45Z")
Hello everybody, we are an MSP providing security services for our customers. The customers in our Qualys environment are divided by different tags inside of Qualys, like cust:CUST1, cust:CUST2... For now we use a sel… --- ## [Filter part not working as expected for Logstash Filter for processing logs with unique entries](https://discuss.elastic.co/t/filter-part-not-working-as-expected-for-logstash-filter-for-processing-logs-with-unique-entries/372334)
**Author:** [@ErGeek](https://discuss.elastic.co/u/ErGeek)\ **Replies:** 5\ **Last updated:** [December 23, 2024, 7:46pm UTC](https://discuss.elastic.co/t/filter-part-not-working-as-expected-for-logstash-filter-for-processing-logs-with-unique-entries/372334 "2024-12-23T19:46:56Z")
Hi All, We are receiving logs in a Kafka topic in the following format and need to process them using a Logstash filter to send them to Elasticsearch. The requirement is to ignore the first type of log entirely and to s… --- ## [How to rescore Elasticsearch results using semantic search with custom boosting conditions?](https://discuss.elastic.co/t/how-to-rescore-elasticsearch-results-using-semantic-search-with-custom-boosting-conditions/372337)
**Author:** [@Jacques\_du\_Plessis](https://discuss.elastic.co/u/Jacques_du_Plessis)\ **Replies:** 0\ **Last updated:** [December 23, 2024, 5:54pm UTC](https://discuss.elastic.co/t/how-to-rescore-elasticsearch-results-using-semantic-search-with-custom-boosting-conditions/372337 "2024-12-23T17:54:35Z")
I am using Elasticsearch's ELSER inference model to perform semantic searches. I need to rescore the search results based on specific conditions: spotlighted documents should be at the top, followed by verified document… --- ## [Total\_shards\_per\_node and disk usage too high causes shards to stay unallocated](https://discuss.elastic.co/t/total-shards-per-node-and-disk-usage-too-high-causes-shards-to-stay-unallocated/372166)
**Author:** [@voharunado](https://discuss.elastic.co/u/voharunado)\ **Replies:** 7\ **Last updated:** [December 23, 2024, 4:33pm UTC](https://discuss.elastic.co/t/total-shards-per-node-and-disk-usage-too-high-causes-shards-to-stay-unallocated/372166 "2024-12-23T16:33:48Z")
Hi, I noticed that some of my indices are staying in a yellow state with missing replicas shards. When checking the allocation explain, I can see it's because: I have set the total\_shards\_per\_node to one to ensure tho… --- ## [Filebeat is not sending logs from all the pods of same application](https://discuss.elastic.co/t/filebeat-is-not-sending-logs-from-all-the-pods-of-same-application/372330)
**Author:** [@VishalGangrade](https://discuss.elastic.co/u/VishalGangrade)\ **Replies:** 0\ **Last updated:** [December 23, 2024, 3:32pm UTC](https://discuss.elastic.co/t/filebeat-is-not-sending-logs-from-all-the-pods-of-same-application/372330 "2024-12-23T15:32:54Z")
Hi, We are running filebeat as a deamonset in kubernetes environment. where we are directly sending logs to elasticsearch. Lets say we have application (app1) running as kubernetes pods, normally if we are running sing… --- ## [Failed to retrieve password hash for reserved user \[kibana\] org.elasticsearch.action.UnavailableShardsException: at least one primary shard for the index \[.security-7\] is unavailable](https://discuss.elastic.co/t/failed-to-retrieve-password-hash-for-reserved-user-kibana-org-elasticsearch-action-unavailableshardsexception-at-least-one-primary-shard-for-the-index-security-7-is-unavailable/372283)
**Author:** [@Spoorthi](https://discuss.elastic.co/u/Spoorthi)\ **Replies:** 5\ **Last updated:** [December 23, 2024, 2:34pm UTC](https://discuss.elastic.co/t/failed-to-retrieve-password-hash-for-reserved-user-kibana-org-elasticsearch-action-unavailableshardsexception-at-least-one-primary-shard-for-the-index-security-7-is-unavailable/372283 "2024-12-23T14:34:18Z")
We got issue with indices filling the spaces, we removed the indices and restarted the service but it doesn't seem to start properly. When checked elasticSearch log, I am getting the below exception failed to retrieve p… --- ## [Translate plugin breaking my pipelines](https://discuss.elastic.co/t/translate-plugin-breaking-my-pipelines/372077)
**Author:** [@tammyt](https://discuss.elastic.co/u/tammyt)\ **Replies:** 5\ **Last updated:** [December 23, 2024, 1:22pm UTC](https://discuss.elastic.co/t/translate-plugin-breaking-my-pipelines/372077 "2024-12-23T13:22:14Z")
After updating to 8.16 (and today to 8.17 to see if the issue would be fixed), all pipelines that use translate filter plugin started breaking \[2024-12-17T15:38:27,060\]\[ERROR\]\[logstash.agent \] Failed to execut… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=118) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=120)