# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=122 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 123 --- ## [Agent Unable to Start Service](https://discuss.elastic.co/t/agent-unable-to-start-service/358773)
**Author:** [@eleong](https://discuss.elastic.co/u/eleong)\ **Replies:** 3\ **Last updated:** [December 16, 2024, 10:28pm UTC](https://discuss.elastic.co/t/agent-unable-to-start-service/358773 "2024-12-16T22:28:14Z")
Hi, I am having issues with this 1 agent (I have 26 in my environment and all is running fine except for this 1 agent). When trying to start the service, it would start awhile and then shutdown on its own. Tried reins… --- ## [Epoch Time Via Logstash](https://discuss.elastic.co/t/epoch-time-via-logstash/372046)
**Author:** [@DFIR\_Cap](https://discuss.elastic.co/u/DFIR_Cap)\ **Replies:** 4\ **Last updated:** [December 16, 2024, 9:57pm UTC](https://discuss.elastic.co/t/epoch-time-via-logstash/372046 "2024-12-16T21:57:55Z")
I have a JSON Log file that can ingest properly ALL with the exception of the @timestamp field. Here is the format: "@timestamp":1734103443540 I have tried to add the below in my logstash CONF file but it does not wor… --- ## [Restore Snapshot while writing to indexes/data streams?](https://discuss.elastic.co/t/restore-snapshot-while-writing-to-indexes-data-streams/371407)
**Author:** [@Dave\_Houser](https://discuss.elastic.co/u/Dave_Houser)\ **Replies:** 12\ **Last updated:** [December 16, 2024, 8:51pm UTC](https://discuss.elastic.co/t/restore-snapshot-while-writing-to-indexes-data-streams/371407 "2024-12-16T20:51:50Z")
I need to put together a DR plan for our elastic system. I have already tested the snapshot restore process, and it works. However, my process is the following: Adjust cluster settings to allow action.destructive\_requi… --- ## [Way to move many indexes to a data stream backing index?](https://discuss.elastic.co/t/way-to-move-many-indexes-to-a-data-stream-backing-index/372030)
**Author:** [@Dave\_Houser](https://discuss.elastic.co/u/Dave_Houser)\ **Replies:** 0\ **Last updated:** [December 16, 2024, 3:36pm UTC](https://discuss.elastic.co/t/way-to-move-many-indexes-to-a-data-stream-backing-index/372030 "2024-12-16T15:36:56Z")
Hello, I have been working on figuring out a process to restore some of a snapshot, start writing to it and allow our frontend to read from it. Then restore the rest of the snapshot. I think I have a good process. Howe… --- ## [How to find forgotten taskIDs?](https://discuss.elastic.co/t/how-to-find-forgotten-taskids/372024)
**Author:** [@Haoke98](https://discuss.elastic.co/u/Haoke98)\ **Replies:** 1\ **Last updated:** [December 16, 2024, 2:09pm UTC](https://discuss.elastic.co/t/how-to-find-forgotten-taskids/372024 "2024-12-16T14:09:14Z")
Previously, I started a task on Elasticsearch and after a long period of time, I wanted to check its status but forgot its task ID. What should I do? Especially for tasks that terminate abnormally, I want to see their er… --- ## [Grok pattern](https://discuss.elastic.co/t/grok-pattern/372023)
**Author:** [@inkerinmaa](https://discuss.elastic.co/u/inkerinmaa)\ **Replies:** 1\ **Last updated:** [December 16, 2024, 1:51pm UTC](https://discuss.elastic.co/t/grok-pattern/372023 "2024-12-16T13:51:06Z")
Hi. I am trying to parse this log message: 2024-12-09 12:33:53,722 ERROR \[Timer-Driven Process Thread-10\] o.a.n.processors.standard.LogAttribute LogAttribute\[id=9b65f63b-0193-1000-ffff-ffffd5fe4484\] logging for flow fil… --- ## [Is there any way to downgrade elasticsearch from 8.15 to 7.17?](https://discuss.elastic.co/t/is-there-any-way-to-downgrade-elasticsearch-from-8-15-to-7-17/371856)
**Author:** [@debayan1](https://discuss.elastic.co/u/debayan1)\ **Replies:** 8\ **Last updated:** [December 16, 2024, 12:15pm UTC](https://discuss.elastic.co/t/is-there-any-way-to-downgrade-elasticsearch-from-8-15-to-7-17/371856 "2024-12-16T12:15:26Z")
Is there any way to downgrade elasticsearch from 8.15 to 7.17 ? We were using elasticsearch version 7.17. Now, we upgraded to elasticsearch version and using collectors in backward compatibility mode in order to commun… --- ## [Smart rate limiting in a cluster in 2 DC](https://discuss.elastic.co/t/smart-rate-limiting-in-a-cluster-in-2-dc/372017)
**Author:** [@Jose\_E](https://discuss.elastic.co/u/Jose_E)\ **Replies:** 6\ **Last updated:** [December 16, 2024, 10:47am UTC](https://discuss.elastic.co/t/smart-rate-limiting-in-a-cluster-in-2-dc/372017 "2024-12-16T10:47:37Z")
Hi all, A very tricky question here. Our current setup comprises 6 nodes, 3 in one DC and 3 in another DC, so they work in a kind of high availability scenario, where we always have the replica in the other DC. So far … --- ## [Search with multi-values](https://discuss.elastic.co/t/search-with-multi-values/372013)
**Author:** [@stephane\_chan](https://discuss.elastic.co/u/stephane_chan)\ **Replies:** 1\ **Last updated:** [December 16, 2024, 9:58am UTC](https://discuss.elastic.co/t/search-with-multi-values/372013 "2024-12-16T09:58:17Z")
Hi, Is it possible to search with multiple values ? i have a list of words or group of words like \["John","command n345","Paris, France","Destination"\]. and I want to search an items contains with these values, not mu… --- ## [Logstash field is never shown after aggregation](https://discuss.elastic.co/t/logstash-field-is-never-shown-after-aggregation/371963)
**Author:** [@Hannah\_J\_Swystun](https://discuss.elastic.co/u/Hannah_J_Swystun)\ **Replies:** 2\ **Last updated:** [December 16, 2024, 8:49am UTC](https://discuss.elastic.co/t/logstash-field-is-never-shown-after-aggregation/371963 "2024-12-16T08:49:32Z")
I have logstash version 7.8.0 Can someone tell me why the aggregation below never shown THREAD\_ID field into documents please ? My field : thread\_id is added in the end of aggregation .. 2024-12-14 12:00:01 thread-1 SOA… --- ## [Kibana error after login](https://discuss.elastic.co/t/kibana-error-after-login/370200)
**Author:** [@stephane\_chan](https://discuss.elastic.co/u/stephane_chan)\ **Replies:** 3\ **Last updated:** [December 16, 2024, 8:08am UTC](https://discuss.elastic.co/t/kibana-error-after-login/370200 "2024-12-16T08:08:28Z")
Hi, I try to install stack Kibana version 8.15 and Elasticsearch. Elasticsearch and Kibana is successfully installed, but when log into Kibana, I have this error "urlForwarding" is not found --- ## [Unable to retrieve version information from Elasticsearch nodes. security\_exception](https://discuss.elastic.co/t/unable-to-retrieve-version-information-from-elasticsearch-nodes-security-exception/371950)
**Author:** [@vanhaiit90](https://discuss.elastic.co/u/vanhaiit90)\ **Replies:** 1\ **Last updated:** [December 16, 2024, 1:59am UTC](https://discuss.elastic.co/t/unable-to-retrieve-version-information-from-elasticsearch-nodes-security-exception/371950 "2024-12-16T01:59:39Z")
Hi all ! I just configuration elasticsearch & Kibana version 8.6.2 . However I don't access web interface Kibana: http://10.xx.xx.xx/app/home and here is the detailed log error Log Kibana: Dec 13 09:56:29 dc-uat-elk-lo… --- ## [How can I make field analysis closer to the number of documents in Discover?](https://discuss.elastic.co/t/how-can-i-make-field-analysis-closer-to-the-number-of-documents-in-discover/371948)
**Author:** [@aac210214](https://discuss.elastic.co/u/aac210214)\ **Replies:** 2\ **Last updated:** [December 16, 2024, 12:28am UTC](https://discuss.elastic.co/t/how-can-i-make-field-analysis-closer-to-the-number-of-documents-in-discover/371948 "2024-12-16T00:28:56Z")
like this There are more than 90,000 documents But the analysis only shows 5000 --- ## [Watcher / alarm in Kibana 8.15 based on unique values](https://discuss.elastic.co/t/watcher-alarm-in-kibana-8-15-based-on-unique-values/371997)
**Author:** [@MatthewS](https://discuss.elastic.co/u/MatthewS)\ **Replies:** 0\ **Last updated:** [December 15, 2024, 8:01pm UTC](https://discuss.elastic.co/t/watcher-alarm-in-kibana-8-15-based-on-unique-values/371997 "2024-12-15T20:01:32Z")
Hello, I'm using kibana and elastic 8.15 version. I'm sending to elasticsearch custom, parsed logs. One of the fields is type IP, and obviuosly contains IP address. I want to setup custom actions (email / webhook) if ne… --- ## [Field Statistics Export + API](https://discuss.elastic.co/t/field-statistics-export-api/371974)
**Author:** [@elasticfantastik](https://discuss.elastic.co/u/elasticfantastik)\ **Replies:** 1\ **Last updated:** [December 15, 2024, 4:47pm UTC](https://discuss.elastic.co/t/field-statistics-export-api/371974 "2024-12-15T16:47:06Z")
Within Kibana, when clicking the "Field Statistics" for any given index, I was wondering if there's an easy way of saving the results, in particular the top-value statistics for each field. I've tried saving a webarchive… --- ## [Custom mapping in Trend Micro Vision One integration](https://discuss.elastic.co/t/custom-mapping-in-trend-micro-vision-one-integration/371983)
**Author:** [@Cristina\_Marletta\_Li](https://discuss.elastic.co/u/Cristina_Marletta_Li)\ **Replies:** 3\ **Last updated:** [December 15, 2024, 2:23pm UTC](https://discuss.elastic.co/t/custom-mapping-in-trend-micro-vision-one-integration/371983 "2024-12-15T14:23:49Z")
Hi all, in Trend Micro Vision One integration, I added a custom pipeline: { "json": { "field": "event.original", "target\_field": "details", "if": "ctx?.trend\_micro\_vision\_one.detection.product.name == 'Vision One C… --- ## [Calculating index sizes](https://discuss.elastic.co/t/calculating-index-sizes/371980)
**Author:** [@Snow](https://discuss.elastic.co/u/Snow)\ **Replies:** 2\ **Last updated:** [December 15, 2024, 7:40am UTC](https://discuss.elastic.co/t/calculating-index-sizes/371980 "2024-12-15T07:40:14Z")
Hi, Is there any way to visualize index sizes without using mapper size plugin or any other plugin? need to visualize index names - storage occupied ? --- ## [Backward pagination with search\_after and PIT](https://discuss.elastic.co/t/backward-pagination-with-search-after-and-pit/371981)
**Author:** [@sandra\_a](https://discuss.elastic.co/u/sandra_a)\ **Replies:** 5\ **Last updated:** [December 15, 2024, 6:29am UTC](https://discuss.elastic.co/t/backward-pagination-with-search-after-and-pit/371981 "2024-12-15T06:29:20Z")
Hello; I used From and Size for pagination, but it doesn't retrieve more than 10,000 docs. I read Document about pagination and saw search\_after and PIT. I have a question about this. what if i want to see previous pa… --- ## [Elastic agent log](https://discuss.elastic.co/t/elastic-agent-log/371912)
**Author:** [@Cristina\_Marletta\_Li](https://discuss.elastic.co/u/Cristina_Marletta_Li)\ **Replies:** 1\ **Last updated:** [December 14, 2024, 11:09pm UTC](https://discuss.elastic.co/t/elastic-agent-log/371912 "2024-12-14T23:09:08Z")
Hi, where to find the event log (especially the log of a standalone agent where an integration is behaving abnormally)? --- ## [ECE - Searchable object storage](https://discuss.elastic.co/t/ece-searchable-object-storage/371861)
**Author:** [@Catalin1](https://discuss.elastic.co/u/Catalin1)\ **Replies:** 2\ **Last updated:** [December 12, 2024, 11:28am UTC](https://discuss.elastic.co/t/ece-searchable-object-storage/371861 "2024-12-12T11:28:58Z")
Hello, I'm using ECE, and trying to create a script that would give the "Searchable object storage" of a Frozen Instance, that is stored in S3. I have tried to get it through the API : /api/v1/deployments/{deployment\_id… --- ## [Kibana Formula using ifelse with multiple conditions](https://discuss.elastic.co/t/kibana-formula-using-ifelse-with-multiple-conditions/370983)
**Author:** [@bjornbear](https://discuss.elastic.co/u/bjornbear)\ **Replies:** 5\ **Last updated:** [December 13, 2024, 1:57pm UTC](https://discuss.elastic.co/t/kibana-formula-using-ifelse-with-multiple-conditions/370983 "2024-12-13T13:57:12Z")
How can I combine multiple conditions in an ifelse statement? I need to avoid a situation where I divide by zero e.g. any of the following values: count() and count(shift='1w')+count(shift='2w') may not be 0 to avoid a N… --- ## [Using post filter to remove entries whereby collapsed inner hits total is less than X](https://discuss.elastic.co/t/using-post-filter-to-remove-entries-whereby-collapsed-inner-hits-total-is-less-than-x/371722)
**Author:** [@codeMonkey82](https://discuss.elastic.co/u/codeMonkey82)\ **Replies:** 9\ **Last updated:** [December 13, 2024, 12:24pm UTC](https://discuss.elastic.co/t/using-post-filter-to-remove-entries-whereby-collapsed-inner-hits-total-is-less-than-x/371722 "2024-12-13T12:24:24Z")
I have a query that collapses on a field representing a hash that can at most be shared between two entries. What I need to do is via a post filter (or alternative) remove the results from the final list whereby the inne… --- ## [Mocking the .NET Client for ExistsResponse in unit tests](https://discuss.elastic.co/t/mocking-the-net-client-for-existsresponse-in-unit-tests/371915)
**Author:** [@Moni\_Hazarika](https://discuss.elastic.co/u/Moni_Hazarika)\ **Replies:** 2\ **Last updated:** [December 13, 2024, 9:50am UTC](https://discuss.elastic.co/t/mocking-the-net-client-for-existsresponse-in-unit-tests/371915 "2024-12-13T09:50:43Z")
Hello Everyone, I am using .NET 8 and "Elastic.Clients.Elasticsearch" Version="8.15.6" (not NEST) For mocking we are using NSubstitute(not Moq) I tried to go through multiple blogs and even the github repo for .NET cl… --- ## [How to mock Elasticsearch ExistsAsync response](https://discuss.elastic.co/t/how-to-mock-elasticsearch-existsasync-response/371935)
**Author:** [@Guthula\_Baladitya](https://discuss.elastic.co/u/Guthula_Baladitya)\ **Replies:** 1\ **Last updated:** [December 13, 2024, 8:51am UTC](https://discuss.elastic.co/t/how-to-mock-elasticsearch-existsasync-response/371935 "2024-12-13T08:51:39Z")
Hello everyone, I have a piece of code in my repository class where I'm checking whether a specific index exists or not. var IndexExists = await \_elasticClient.Indices.ExistsAsync(IndexName); if ((await \_el… --- ## [Get efficiency of production](https://discuss.elastic.co/t/get-efficiency-of-production/371945)
**Author:** [@MRoed](https://discuss.elastic.co/u/MRoed)\ **Replies:** 0\ **Last updated:** [December 13, 2024, 8:06am UTC](https://discuss.elastic.co/t/get-efficiency-of-production/371945 "2024-12-13T08:06:00Z")
I would like to determine the efficiency of a production process. This should be represented by the number of items produced divided by the target number of items within the selected time period. To achieve this, I want … --- ## [Can you change the index that Machine Learning Jobs use after job creation?](https://discuss.elastic.co/t/can-you-change-the-index-that-machine-learning-jobs-use-after-job-creation/371936)
**Author:** [@Datt\_Mamon](https://discuss.elastic.co/u/Datt_Mamon)\ **Replies:** 2\ **Last updated:** [December 12, 2024, 10:52pm UTC](https://discuss.elastic.co/t/can-you-change-the-index-that-machine-learning-jobs-use-after-job-creation/371936 "2024-12-12T22:52:40Z")
Hello, I am looking for some assistance with a question. I have some machine learning jobs currently using an index called, "Win." Due to some configuration changes, the underlying index structure had to change, so the … --- ## [Loading high transactional data to elasticsearch](https://discuss.elastic.co/t/loading-high-transactional-data-to-elasticsearch/371726)
**Author:** [@amirhosseinbi](https://discuss.elastic.co/u/amirhosseinbi)\ **Replies:** 22\ **Last updated:** [December 12, 2024, 10:15pm UTC](https://discuss.elastic.co/t/loading-high-transactional-data-to-elasticsearch/371726 "2024-12-12T22:15:11Z")
Hi all, I'm ingesting network traffic using tshark and need to load it to elasticsearch for further analysis and troubleshooting. The traffic is transformed to json format and around 1TB daily, my bottleneck is now logs… --- ## [Remove system indices](https://discuss.elastic.co/t/remove-system-indices/371930)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 4\ **Last updated:** [December 12, 2024, 9:49pm UTC](https://discuss.elastic.co/t/remove-system-indices/371930 "2024-12-12T21:49:07Z")
I am trying to remove old system indices from kibana but it gives me errro ".kibana\_7.12.0\_001" when I try to login as kibana\_system it does not allow me to login. How do I remove these old indices? Reason I want … --- ## [Filebeat services fail to start on Windows after an upgrade 8.17.0](https://discuss.elastic.co/t/filebeat-services-fail-to-start-on-windows-after-an-upgrade-8-17-0/371934)
**Author:** [@Alyssa\_Nunez](https://discuss.elastic.co/u/Alyssa_Nunez)\ **Replies:** 0\ **Last updated:** [December 12, 2024, 8:45pm UTC](https://discuss.elastic.co/t/filebeat-services-fail-to-start-on-windows-after-an-upgrade-8-17-0/371934 "2024-12-12T20:45:50Z")
Has anyone encountered an issue with starting the filebeat after upgrading? When installing a previous version (8.16.1) it works without issues. I'm get this error: Service 'Filebeat-PowershellTranscript-Prod (Filebeat-… --- ## [Metricbeat downsample](https://discuss.elastic.co/t/metricbeat-downsample/371932)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 0\ **Last updated:** [December 12, 2024, 8:38pm UTC](https://discuss.elastic.co/t/metricbeat-downsample/371932 "2024-12-12T20:38:08Z")
I was looking to work on downsample. By reading this \[Downsampling a time series data stream | Elasticsearch Guide \[8.17\] | Elastic\] (Downsampling a time series data stream | Elasticsearch Guide \[8.17\] | Elastic) But … [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=121) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=123)