# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=127 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 128 --- ## [Elastic-Agent unexpectedly gets unenrolled (Version 8.16.x)](https://discuss.elastic.co/t/elastic-agent-unexpectedly-gets-unenrolled-version-8-16-x/371463)
**Author:** [@syk](https://discuss.elastic.co/u/syk)\ **Replies:** 1\ **Last updated:** [December 5, 2024, 9:55am UTC](https://discuss.elastic.co/t/elastic-agent-unexpectedly-gets-unenrolled-version-8-16-x/371463 "2024-12-05T09:55:21Z")
@kpollich suggested to transfer the issue from \[Fleet\] Agents erroneously showing "Agent not upgradeable: agent has been unenrolled" · Issue #202440 · elastic/kibana · GitHub to GitHub - elastic/elastic-agent: Elastic A… --- ## [Kibana cannot reach the Elastic Package Registry, which provides Elastic Agent integrations](https://discuss.elastic.co/t/kibana-cannot-reach-the-elastic-package-registry-which-provides-elastic-agent-integrations/371515)
**Author:** [@vanhaiit90](https://discuss.elastic.co/u/vanhaiit90)\ **Replies:** 0\ **Last updated:** [December 5, 2024, 9:10am UTC](https://discuss.elastic.co/t/kibana-cannot-reach-the-elastic-package-registry-which-provides-elastic-agent-integrations/371515 "2024-12-05T09:10:56Z")
ever since I using configure own Elastic Package Registry I got issue relate to add integration from Agent policy I'am tries configure kibana.yml xpack.fleet.registryUrl: "http://10.0.xx.xx:8080" And log form… --- ## [Use plygon that is beyond the geographic scope to query](https://discuss.elastic.co/t/use-plygon-that-is-beyond-the-geographic-scope-to-query/371514)
**Author:** [@baiwenbo1997](https://discuss.elastic.co/u/baiwenbo1997)\ **Replies:** 0\ **Last updated:** [December 5, 2024, 8:29am UTC](https://discuss.elastic.co/t/use-plygon-that-is-beyond-the-geographic-scope-to-query/371514 "2024-12-05T08:29:37Z")
{"query":{"bool":{"filter":\[{"geo\_shape":{"GEOMETRY":{"shape":{"type":"Polygon","coordinates":\[\[\[-322.2866440677966,-206.98235202086046\],\[330.89735593220339,-206.98235202086046\],\[330.89735593220339,141.32567405475886\],\[-… --- ## [Elasticalert windows service is getting paused automatically after starting or resuming it , all the configurations are right](https://discuss.elastic.co/t/elasticalert-windows-service-is-getting-paused-automatically-after-starting-or-resuming-it-all-the-configurations-are-right/371513)
**Author:** [@chaitanya12](https://discuss.elastic.co/u/chaitanya12)\ **Replies:** 0\ **Last updated:** [December 5, 2024, 8:24am UTC](https://discuss.elastic.co/t/elasticalert-windows-service-is-getting-paused-automatically-after-starting-or-resuming-it-all-the-configurations-are-right/371513 "2024-12-05T08:24:44Z")
The elasticalert is going in paused sate automatically after starting and never in runnning state. this is very strange. this is the config.yaml - This is the folder that contains the rule yaml files Any .yaml file wil… --- ## [Only the number of containers are showing in the Metricbeat default dashboard, but no other metrics are appearing](https://discuss.elastic.co/t/only-the-number-of-containers-are-showing-in-the-metricbeat-default-dashboard-but-no-other-metrics-are-appearing/371512)
**Author:** [@abhishekacharya828](https://discuss.elastic.co/u/abhishekacharya828)\ **Replies:** 0\ **Last updated:** [December 5, 2024, 7:30am UTC](https://discuss.elastic.co/t/only-the-number-of-containers-are-showing-in-the-metricbeat-default-dashboard-but-no-other-metrics-are-appearing/371512 "2024-12-05T07:30:19Z")
Metricbeat Logs Dec 05 12:48:26 APMOSYSLT0817 metricbeat\[82993\]: strong text{"log.level":"warn","@timestamp":"2024-12-05T12:48:26.136+0530","log.logger":"elasticsearch","log.origin":{"function":"github.com/elastic/be… --- ## [ES snapshot restore from s3 bucket](https://discuss.elastic.co/t/es-snapshot-restore-from-s3-bucket/371507)
**Author:** [@ashadujjaman](https://discuss.elastic.co/u/ashadujjaman)\ **Replies:** 0\ **Last updated:** [December 5, 2024, 5:58am UTC](https://discuss.elastic.co/t/es-snapshot-restore-from-s3-bucket/371507 "2024-12-05T05:58:31Z")
Please let me know. My 15 Node ES cluster hosted in AWS ec2 instant, This snapshot save in s3 bucket regular basis a periodic time. Snapshot size more than 1 TB and every index size more than 20GB. I want to create anoth… --- ## [What is the key of elasticsearch Query Cache](https://discuss.elastic.co/t/what-is-the-key-of-elasticsearch-query-cache/371506)
**Author:** [@ChatLee](https://discuss.elastic.co/u/ChatLee)\ **Replies:** 0\ **Last updated:** [December 5, 2024, 5:44am UTC](https://discuss.elastic.co/t/what-is-the-key-of-elasticsearch-query-cache/371506 "2024-12-05T05:44:25Z")
Hi team, About the query cache, we want to the answers to the following questions: index.queries.cache.enabled=true would active all caches, right? like, node cache, shard cache and other stuff how to construct the ca… --- ## [Create Separate index for each logfile](https://discuss.elastic.co/t/create-separate-index-for-each-logfile/371493)
**Author:** [@nitesh.srivastava](https://discuss.elastic.co/u/nitesh.srivastava)\ **Replies:** 0\ **Last updated:** [December 4, 2024, 11:50pm UTC](https://discuss.elastic.co/t/create-separate-index-for-each-logfile/371493 "2024-12-04T23:50:39Z")
Hello ppl, I have a Filebeat \> Logstash \> Elasticsearch set up in my environment where we are collecting logs data by installing Filebeat and forwarding the data via logstash input. However, we have a peculiar situation… --- ## [Trying to use an alphabetical bucket sort within a terms aggregation](https://discuss.elastic.co/t/trying-to-use-an-alphabetical-bucket-sort-within-a-terms-aggregation/371490)
**Author:** [@JoshFarwig](https://discuss.elastic.co/u/JoshFarwig)\ **Replies:** 0\ **Last updated:** [December 4, 2024, 10:27pm UTC](https://discuss.elastic.co/t/trying-to-use-an-alphabetical-bucket-sort-within-a-terms-aggregation/371490 "2024-12-04T22:27:34Z")
Hey! I am currently using Elasticsearch 8.15. I am in a bit of a conundrum trying to achieve outer and inner bucket sorting for strings (sorted asc or desc alphabetically). My index, hazard, looks a little something like… --- ## [Time\_zone in sql query](https://discuss.elastic.co/t/time-zone-in-sql-query/371471)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 1\ **Last updated:** [December 4, 2024, 10:02pm UTC](https://discuss.elastic.co/t/time-zone-in-sql-query/371471 "2024-12-04T22:02:47Z")
I have metricbeat time series data. time field is @timestamp due to BST and UTC time difference of one hour I can't get data GET \_sql?format=txt { "query": """ select host.name as host, from "my-metr… --- ## [Fleet searching on policy names](https://discuss.elastic.co/t/fleet-searching-on-policy-names/371489)
**Author:** [@rugenl](https://discuss.elastic.co/u/rugenl)\ **Replies:** 0\ **Last updated:** [December 4, 2024, 9:57pm UTC](https://discuss.elastic.co/t/fleet-searching-on-policy-names/371489 "2024-12-04T21:57:52Z")
Searching on policy names like ingest-agent-policies.name : name seems to be case sensitive, that finds nothing, but ingest-agent-policies.name : NAME Finds the policies. Searching in fleet seems clumsy, it see… --- ## [Finding out cause of circuit breaking exception (Data too large)](https://discuss.elastic.co/t/finding-out-cause-of-circuit-breaking-exception-data-too-large/351217)
**Author:** [@hjazz6](https://discuss.elastic.co/u/hjazz6)\ **Replies:** 4\ **Last updated:** [December 4, 2024, 9:36pm UTC](https://discuss.elastic.co/t/finding-out-cause-of-circuit-breaking-exception-data-too-large/351217 "2024-12-04T21:36:25Z")
Hi, I'm getting the error below occasionally, and I'm trying to find the cause of it so I can try to resolve it. circuit\_breaking\_exception: \[parent\] Data too large, data for \[\\] would be \[32620387928/30.3… --- ## [8.16.1 ignores to\_syslog: false](https://discuss.elastic.co/t/8-16-1-ignores-to-syslog-false/371276)
**Author:** [@t.alexandersen](https://discuss.elastic.co/u/t.alexandersen)\ **Replies:** 4\ **Last updated:** [December 4, 2024, 9:34pm UTC](https://discuss.elastic.co/t/8-16-1-ignores-to-syslog-false/371276 "2024-12-04T21:34:23Z")
We upgraded from 8.15.3 to 8.16.1 and found that filebeat started filling up syslog with debug log messages. It seems to ignore the to\_syslog: false config. Downgraded to 8.15.3 and the problem was gone. Did we miss chan… --- ## [ServiceNow integration issues](https://discuss.elastic.co/t/servicenow-integration-issues/371473)
**Author:** [@karnamonkster](https://discuss.elastic.co/u/karnamonkster)\ **Replies:** 1\ **Last updated:** [December 4, 2024, 5:12pm UTC](https://discuss.elastic.co/t/servicenow-integration-issues/371473 "2024-12-04T17:12:17Z")
Using the ServiceNow integration which is in the preview mode. Everything is working as per network perspective from the elastic-agent where the integration is installed with a policy. Elastic Agent : 8.12.1 Fleet & … --- ## [How to apply filters to some fields in Lens](https://discuss.elastic.co/t/how-to-apply-filters-to-some-fields-in-lens/370344)
**Author:** [@syunusic](https://discuss.elastic.co/u/syunusic)\ **Replies:** 2\ **Last updated:** [December 4, 2024, 4:33pm UTC](https://discuss.elastic.co/t/how-to-apply-filters-to-some-fields-in-lens/370344 "2024-12-04T16:33:25Z")
If I have a Legacy Metric with this formula: sum(data.bills)/(sum(data.sales) And I want to add a filter like this: { "match\_phrase": { "data.style": "Lease" } } But the documents that have the field data.sales never… --- ## [\[KNN\] Semantics Affected by Phrase Similarity](https://discuss.elastic.co/t/knn-semantics-affected-by-phrase-similarity/370180)
**Author:** [@Shell\_Dias](https://discuss.elastic.co/u/Shell_Dias)\ **Replies:** 5\ **Last updated:** [December 4, 2024, 1:11pm UTC](https://discuss.elastic.co/t/knn-semantics-affected-by-phrase-similarity/370180 "2024-12-04T13:11:50Z")
I'm implementing a semantic search for product names, aiming to allow searches based on user intent. However, I'm observing that semantically, it retrieves fragmented data within the text. For example, when searching for… --- ## [Logstash ramping up RAM usage change in behaviour](https://discuss.elastic.co/t/logstash-ramping-up-ram-usage-change-in-behaviour/370599)
**Author:** [@carlosmg1](https://discuss.elastic.co/u/carlosmg1)\ **Replies:** 5\ **Last updated:** [December 4, 2024, 1:06pm UTC](https://discuss.elastic.co/t/logstash-ramping-up-ram-usage-change-in-behaviour/370599 "2024-12-04T13:06:50Z")
Hi everybody, We're having some issue with one of our logstash clusters. There are 6 machines with 32 Gb of RAM + 16 Core AWS instances running logstash docker container. Those are only logstsh servers. We've had an sta… --- ## [Logstash remains in running state](https://discuss.elastic.co/t/logstash-remains-in-running-state/371323)
**Author:** [@Ritik\_Loomba](https://discuss.elastic.co/u/Ritik_Loomba)\ **Replies:** 13\ **Last updated:** [December 4, 2024, 12:25pm UTC](https://discuss.elastic.co/t/logstash-remains-in-running-state/371323 "2024-12-04T12:25:11Z")
Hi , I want to setup a logstash pipeline which will read data from Elasticsearch and load it to s3. For time being i am creating a test pipeline which reads data from one file and create a output file from it (creating … --- ## [Kibana KQL / Filter: How can I apply the dashboard timerange (From & To) to a different date field in my doc](https://discuss.elastic.co/t/kibana-kql-filter-how-can-i-apply-the-dashboard-timerange-from-to-to-a-different-date-field-in-my-doc/371464)
**Author:** [@bjornbear](https://discuss.elastic.co/u/bjornbear)\ **Replies:** 0\ **Last updated:** [December 4, 2024, 11:56am UTC](https://discuss.elastic.co/t/kibana-kql-filter-how-can-i-apply-the-dashboard-timerange-from-to-to-a-different-date-field-in-my-doc/371464 "2024-12-04T11:56:10Z")
I have documents that have several fields containing date/time data: I would like to filter those based on the chosen dashboard timerange (to & from). How can I create a filter that references the From and To date/times… --- ## [Could not index event to Elasticsearch](https://discuss.elastic.co/t/could-not-index-event-to-elasticsearch/371385)
**Author:** [@deepika\_raghav](https://discuss.elastic.co/u/deepika_raghav)\ **Replies:** 2\ **Last updated:** [December 4, 2024, 11:52am UTC](https://discuss.elastic.co/t/could-not-index-event-to-elasticsearch/371385 "2024-12-04T11:52:06Z")
hi I am facing issues while trying to create an index by querying microsoft sql server and the error I am facing as follows Could not index event to Elasticsearch. {:status=\>400, :action=\>\["index", {:\_id=\>nil, :\_index=\>"… --- ## [Elasticsearch log show kibana\_version\_mismatch](https://discuss.elastic.co/t/elasticsearch-log-show-kibana-version-mismatch/371190)
**Author:** [@d.silwon](https://discuss.elastic.co/u/d.silwon)\ **Replies:** 11\ **Last updated:** [December 4, 2024, 7:57am UTC](https://discuss.elastic.co/t/elasticsearch-log-show-kibana-version-mismatch/371190 "2024-12-04T07:57:54Z")
Dears, In elasticsearch log file there is many errors like this: \[2024-11-28T14:17:45,307\]\[ERROR\]\[o.e.x.w.i.s.ExecutableSearchInput\] \[elastic03\] failed to execute \[search\] input for watch \[kfkGWL45QVSehYfLGLGl8g\_kibana… --- ## [Palo Alto Logs Not Parsing Properly with panw Module in Filebeat](https://discuss.elastic.co/t/palo-alto-logs-not-parsing-properly-with-panw-module-in-filebeat/371269)
**Author:** [@ssovee](https://discuss.elastic.co/u/ssovee)\ **Replies:** 9\ **Last updated:** [December 4, 2024, 7:01am UTC](https://discuss.elastic.co/t/palo-alto-logs-not-parsing-properly-with-panw-module-in-filebeat/371269 "2024-12-04T07:01:47Z")
Hi Team, I am using Palo Alto VM version 11.0.1 and forwarding syslogs to Elasticsearch through Filebeat using the panw module. While I can see the logs in Kibana, they are not being parsed properly. All the traffic log… --- ## [Converting Logstash Pipeline to Ingest Pipeline](https://discuss.elastic.co/t/converting-logstash-pipeline-to-ingest-pipeline/371416)
**Author:** [@erikg](https://discuss.elastic.co/u/erikg)\ **Replies:** 8\ **Last updated:** [December 4, 2024, 6:53am UTC](https://discuss.elastic.co/t/converting-logstash-pipeline-to-ingest-pipeline/371416 "2024-12-04T06:53:13Z")
Hello, I have countless of logstash pipelines or logstash filter configs to be more exact. Is there a way to migrate these into ingest pipelines, quickly? I know they offer the same features but is it possible to do t… --- ## [Backup Old data Instead of Deleting](https://discuss.elastic.co/t/backup-old-data-instead-of-deleting/371438)
**Author:** [@Aswath\_Kumar](https://discuss.elastic.co/u/Aswath_Kumar)\ **Replies:** 0\ **Last updated:** [December 4, 2024, 6:31am UTC](https://discuss.elastic.co/t/backup-old-data-instead-of-deleting/371438 "2024-12-04T06:31:20Z")
Hi , We are having some important data in a particular index. But this index keep growing and Queries became slow. Is there anyway to keep only last 30 days of data and rest of the data move to snapshot in s3 This must… --- ## [Create repository with huawei hdfs](https://discuss.elastic.co/t/create-repository-with-huawei-hdfs/371435)
**Author:** [@carpeDiem](https://discuss.elastic.co/u/carpeDiem)\ **Replies:** 0\ **Last updated:** [December 4, 2024, 6:20am UTC](https://discuss.elastic.co/t/create-repository-with-huawei-hdfs/371435 "2024-12-04T06:20:41Z")
Hello experts,. I am using Huawei Cloud's MapReduce service, which includes a hadoop cluster with kerberos started. I downloaded the authentication credentials, including krb5.conf and krb5.keytab, and placed the files i… --- ## [LTR Plugin in Newer Versions of Elasticsearch](https://discuss.elastic.co/t/ltr-plugin-in-newer-versions-of-elasticsearch/370908)
**Author:** [@Shell\_Dias](https://discuss.elastic.co/u/Shell_Dias)\ **Replies:** 2\ **Last updated:** [December 3, 2024, 11:26pm UTC](https://discuss.elastic.co/t/ltr-plugin-in-newer-versions-of-elasticsearch/370908 "2024-12-03T23:26:14Z")
I am trying to implement LTR (Learning to Rank) with a machine learning model. However, for some reason, the training with the judgment list is not succeeding. The LTR is not respecting my judgment list configuration wit… --- ## [Logstash 8.16.0 Java::JavaSql::SQLException: Java heap space](https://discuss.elastic.co/t/logstash-8-16-0-java-java-heap-space/371288)
**Author:** [@nickbarry](https://discuss.elastic.co/u/nickbarry)\ **Replies:** 2\ **Last updated:** [December 3, 2024, 10:19pm UTC](https://discuss.elastic.co/t/logstash-8-16-0-java-java-heap-space/371288 "2024-12-03T22:19:42Z")
Recently upgraded to Elastic 8.16.0, Kibana 8.16.0 and logstash 8.16.0. And things were running smoothly until Friday morning at 1am. Here in the States it was Thanksgiving so I did not change anything recently. Syste… --- ## [Heartbeat to support m2m token auth](https://discuss.elastic.co/t/heartbeat-to-support-m2m-token-auth/371426)
**Author:** [@OK\_SCS](https://discuss.elastic.co/u/OK_SCS)\ **Replies:** 0\ **Last updated:** [December 3, 2024, 9:40pm UTC](https://discuss.elastic.co/t/heartbeat-to-support-m2m-token-auth/371426 "2024-12-03T21:40:03Z")
Is there a plans to add M2M token auth? Most of our REST services migrated to this type of authentcation, so we need possibility to monitor them. it would be good if will be such option to configure token provide url, t… --- ## [Elasticsearch 8.15.3 and Connectors 9.0.0 are incompatible: major versions are different](https://discuss.elastic.co/t/elasticsearch-8-15-3-and-connectors-9-0-0-are-incompatible-major-versions-are-different/371396)
**Author:** [@dev8100](https://discuss.elastic.co/u/dev8100)\ **Replies:** 2\ **Last updated:** [December 3, 2024, 9:14pm UTC](https://discuss.elastic.co/t/elasticsearch-8-15-3-and-connectors-9-0-0-are-incompatible-major-versions-are-different/371396 "2024-12-03T21:14:33Z")
I'm running into the issue below. I'm really not clear on how to modify the version of the connector service since I haven't built one before and can really use some help \[FMWK\]\[14:22:30\]\[INFO\] Running connector service… --- ## [Question on Date Processor](https://discuss.elastic.co/t/question-on-date-processor/371420)
**Author:** [@thejackal2020](https://discuss.elastic.co/u/thejackal2020)\ **Replies:** 0\ **Last updated:** [December 3, 2024, 8:43pm UTC](https://discuss.elastic.co/t/question-on-date-processor/371420 "2024-12-03T20:43:11Z")
I have a field that is currently set as 'keyword' and I want to convert it to be 'date'. I have added the Date processor in my ingest pipeline. I have set the formats to be "YYYY-MM-dd HH:mm:ss,SSS" I have the target … [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=126) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=128)