# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=13 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 14 --- ## [Console.plugin tries to connect to quickstart-es-http.default.svc:9200 even though theres is explicit configuration](https://discuss.elastic.co/t/console-plugin-tries-to-connect-to-quickstart-es-http-default-svc-9200-even-though-theres-is-explicit-configuration/385745)
**Author:** [@slowdown77](https://discuss.elastic.co/u/slowdown77)\ **Replies:** 1\ **Last updated:** [April 7, 2026, 2:18pm UTC](https://discuss.elastic.co/t/console-plugin-tries-to-connect-to-quickstart-es-http-default-svc-9200-even-though-theres-is-explicit-configuration/385745 "2026-04-07T14:18:24Z")
Hi everyone, I have a fresh installation of ECK 3.3.1 and I have deployed Kibana and pointed it to the Elasticsearch instance in the same namespace apiVersion: kibana.k8s.elastic.co/v1 kind: Kibana metadata: name: cm… --- ## [Real cluster state size](https://discuss.elastic.co/t/real-cluster-state-size/385796)
**Author:** [@Nicko](https://discuss.elastic.co/u/Nicko)\ **Replies:** 7\ **Last updated:** [April 7, 2026, 1:54pm UTC](https://discuss.elastic.co/t/real-cluster-state-size/385796 "2026-04-07T13:54:56Z")
When I try to get the cluster state size via GET \_nodes/stats in kibana dev tools it gives me this data from the node, which is holding cluster state now "serialized\_cluster\_states": { "full\_states": { "count": 77… --- ## [Is querying elasticsearch directly from NextJS server-side a bad pattern?](https://discuss.elastic.co/t/is-querying-elasticsearch-directly-from-nextjs-server-side-a-bad-pattern/385747)
**Author:** [@harwin36548](https://discuss.elastic.co/u/harwin36548)\ **Replies:** 1\ **Last updated:** [April 7, 2026, 1:44pm UTC](https://discuss.elastic.co/t/is-querying-elasticsearch-directly-from-nextjs-server-side-a-bad-pattern/385747 "2026-04-07T13:44:29Z")
Hi everyone, I’m building a Next.js app (App Router) and trying to decide on the right way to integrate Elasticsearch. I know Next.js allows direct server-side data access without needing an API layer, which makes this… --- ## [Architecture check: Offloading Logstash gsub regex to K8s pod sidecars to save CPU?](https://discuss.elastic.co/t/architecture-check-offloading-logstash-gsub-regex-to-k8s-pod-sidecars-to-save-cpu/385800)
**Author:** [@Ilya\_Ploskovitov](https://discuss.elastic.co/u/Ilya_Ploskovitov)\ **Replies:** 0\ **Last updated:** [April 7, 2026, 1:43pm UTC](https://discuss.elastic.co/t/architecture-check-offloading-logstash-gsub-regex-to-k8s-pod-sidecars-to-save-cpu/385800 "2026-04-07T13:43:49Z")
Hi everyone, We’ve been dealing with a classic pipeline bottleneck: our Logstash nodes are burning massive amounts of CPU because we have dozens of gsub mutate filters to scrub PII and secrets (like emails, Stripe token… --- ## [Cluster logs for errors in GUI (via filter) if not whatst the specific index to search](https://discuss.elastic.co/t/cluster-logs-for-errors-in-gui-via-filter-if-not-whatst-the-specific-index-to-search/385738)
**Author:** [@Whoami1980](https://discuss.elastic.co/u/Whoami1980)\ **Replies:** 3\ **Last updated:** [April 7, 2026, 10:46am UTC](https://discuss.elastic.co/t/cluster-logs-for-errors-in-gui-via-filter-if-not-whatst-the-specific-index-to-search/385738 "2026-04-07T10:46:11Z")
This morning we were having slowness on our web console. From the cluster overview page. There were many high CPU for nodes. https://XXXXXXXXX.aws.found.io/app/monitoring#/overview? When we zoom it we found that they … --- ## [Error loading data on graph analyzer](https://discuss.elastic.co/t/error-loading-data-on-graph-analyzer/384534)
**Author:** [@Alaeddine\_khadraoui](https://discuss.elastic.co/u/Alaeddine_khadraoui)\ **Replies:** 1\ **Last updated:** [April 7, 2026, 10:39am UTC](https://discuss.elastic.co/t/error-loading-data-on-graph-analyzer/384534 "2026-04-07T10:39:09Z")
Dear Elastic Community, Im checking the alerts on Security on Kibana and when i try to visualise the Graph Analyzer i got Error loading data, what can be the issue, and how to troubleshoot this issue Thanks --- ## [Need help parsing XML and general strategy with logstash](https://discuss.elastic.co/t/need-help-parsing-xml-and-general-strategy-with-logstash/385787)
**Author:** [@Rx7TyreBurna](https://discuss.elastic.co/u/Rx7TyreBurna)\ **Replies:** 2\ **Last updated:** [April 7, 2026, 3:35am UTC](https://discuss.elastic.co/t/need-help-parsing-xml-and-general-strategy-with-logstash/385787 "2026-04-07T03:35:46Z")
I have XML output from a tool called nmap. I am wanting to pull the ports from this, but also want to take the scan information and either append that, or stick that in an Elastic index and hopefully get some unique ID … --- ## [ELK - SAS drivers](https://discuss.elastic.co/t/elk-sas-drivers/385754)
**Author:** [@PatreKerier](https://discuss.elastic.co/u/PatreKerier)\ **Replies:** 1\ **Last updated:** [April 4, 2026, 1:58pm UTC](https://discuss.elastic.co/t/elk-sas-drivers/385754 "2026-04-04T13:58:33Z")
Colleagues, good afternoon! Please tell me about the following issue. We plan to consider the possibility of deploying Elastic in our infrastructure, however, at the moment the main available storage is SAS disks. The… --- ## ["Error" in Documents Count - Index Management](https://discuss.elastic.co/t/error-in-documents-count-index-management/385242)
**Author:** [@ArgoAdvisory](https://discuss.elastic.co/u/ArgoAdvisory)\ **Replies:** 3\ **Last updated:** [April 3, 2026, 2:40pm UTC](https://discuss.elastic.co/t/error-in-documents-count-index-management/385242 "2026-04-03T14:40:51Z")
Hi everyone, I recently upgraded my environment to Elastic 9.3, and I’ve encountered a specific issue in the Index Management section that wasn't present before. The Problem When I set the page to display 100 rows, … --- ## [Elastic-agent stuck in offline status](https://discuss.elastic.co/t/elastic-agent-stuck-in-offline-status/385697)
**Author:** [@Alaeddine\_khadraoui](https://discuss.elastic.co/u/Alaeddine_khadraoui)\ **Replies:** 1\ **Last updated:** [April 3, 2026, 5:59am UTC](https://discuss.elastic.co/t/elastic-agent-stuck-in-offline-status/385697 "2026-04-03T05:59:14Z")
Dear Elastic Community i have elastic agent installed on linux on the host elastic-agent status showing Healthy/running but in fleet server UI it showing always offline ,i did re-installation of the agent but still offl… --- ## [Elasticsearch query timeouts on data stream (50M–170M docs, facets + NOT queries)](https://discuss.elastic.co/t/elasticsearch-query-timeouts-on-data-stream-50m-170m-docs-facets-not-queries/384646)
**Author:** [@Anup\_Kumar](https://discuss.elastic.co/u/Anup_Kumar)\ **Replies:** 4\ **Last updated:** [April 2, 2026, 10:04am UTC](https://discuss.elastic.co/t/elasticsearch-query-timeouts-on-data-stream-50m-170m-docs-facets-not-queries/384646 "2026-04-02T10:04:40Z")
Hi all, I’m facing Elasticsearch query timeouts for a search workload stored in a data stream (immutable data, bulk indexed historical data). We are using Point-in-Time (PIT) searches for query consistency/pagination. B… --- ## [Attempting to match or filter but still always return all values](https://discuss.elastic.co/t/attempting-to-match-or-filter-but-still-always-return-all-values/385708)
**Author:** [@Whoami1980](https://discuss.elastic.co/u/Whoami1980)\ **Replies:** 8\ **Last updated:** [April 2, 2026, 9:13am UTC](https://discuss.elastic.co/t/attempting-to-match-or-filter-but-still-always-return-all-values/385708 "2026-04-02T09:13:12Z")
Can anyone share a working example of how to match or filter a field based on existing data? I have attempted the following query but it still returns all values. Also whats the difference between match and filter? Thank… --- ## [ILM Indices Blocking Master Queue - All Operations Timeout](https://discuss.elastic.co/t/ilm-indices-blocking-master-queue-all-operations-timeout/385725)
**Author:** [@Anup\_Kumar](https://discuss.elastic.co/u/Anup_Kumar)\ **Replies:** 5\ **Last updated:** [April 2, 2026, 8:40am UTC](https://discuss.elastic.co/t/ilm-indices-blocking-master-queue-all-operations-timeout/385725 "2026-04-02T08:40:02Z")
Our ES cluster has blocked master queue for 12+ days. All cluster state change operations timeout after 30s, including: Index open operations Index delete operations ILM move commands ILM stop/start commands … --- ## [Winlogbeat - Mismatched event.action for event.code](https://discuss.elastic.co/t/winlogbeat-mismatched-event-action-for-event-code/385735)
**Author:** [@coldmint](https://discuss.elastic.co/u/coldmint)\ **Replies:** 1\ **Last updated:** [April 2, 2026, 7:35am UTC](https://discuss.elastic.co/t/winlogbeat-mismatched-event-action-for-event-code/385735 "2026-04-02T07:35:31Z")
Hello, We’re running a clean install of Winlogbeat with a pretty barebones configuration, but unfortunately we’re noticing logged events transfer with incorrect event.action values for the respective event.code(Such as … --- ## [Best practice for re-routed datastream and index template mappings](https://discuss.elastic.co/t/best-practice-for-re-routed-datastream-and-index-template-mappings/385729)
**Author:** [@dot-mike](https://discuss.elastic.co/u/dot-mike)\ **Replies:** 2\ **Last updated:** [April 1, 2026, 5:26pm UTC](https://discuss.elastic.co/t/best-practice-for-re-routed-datastream-and-index-template-mappings/385729 "2026-04-01T17:26:03Z")
Hi community, I'm wondering what is the best practice when it comes to rerouted datastreams from log integrations using fleet. For example default datastream is logs-docker.container\_logs-default and it's rerouted to lo… --- ## [Http port 9200 behind Citrix ADC loadbalancing](https://discuss.elastic.co/t/http-port-9200-behind-citrix-adc-loadbalancing/385721)
**Author:** [@stefws](https://discuss.elastic.co/u/stefws)\ **Replies:** 12\ **Last updated:** [April 1, 2026, 5:18pm UTC](https://discuss.elastic.co/t/http-port-9200-behind-citrix-adc-loadbalancing/385721 "2026-04-01T17:18:34Z")
Trying desperately to avoid our Citrix ADC health monitoring of elasticsearch https port 9200 backend services from seeing LB monitoring traffic as plain text and thus avoid log error events like: received plaintext htt… --- ## [Download Files of an API from Kibana Dashboard](https://discuss.elastic.co/t/download-files-of-an-api-from-kibana-dashboard/385646)
**Author:** [@Jonas\_S](https://discuss.elastic.co/u/Jonas_S)\ **Replies:** 7\ **Last updated:** [April 1, 2026, 3:18pm UTC](https://discuss.elastic.co/t/download-files-of-an-api-from-kibana-dashboard/385646 "2026-04-01T15:18:57Z")
Hello, we have a Kibana dashboard showing some metadata of files. Is it somehow possible to integrate a link or button to download the files from our API after filtering the dashboard using controls? The goal should b… --- ## [Elastic-Agent -\> Logstash high EPS missing events](https://discuss.elastic.co/t/elastic-agent-logstash-high-eps-missing-events/385733)
**Author:** [@mamueh](https://discuss.elastic.co/u/mamueh)\ **Replies:** 0\ **Last updated:** [April 1, 2026, 2:05pm UTC](https://discuss.elastic.co/t/elastic-agent-logstash-high-eps-missing-events/385733 "2026-04-01T14:05:40Z")
Hi Everyone We have a rather large setup in which we’ve replaced rsyslog with Elastic Agents as log collectors. We’re running 8.19.8. Currently we have around 1200 devices forwarding mostly syslog to a load balancer th… --- ## [Unique vs Multiple dense vectors](https://discuss.elastic.co/t/unique-vs-multiple-dense-vectors/385710)
**Author:** [@cilasmarques](https://discuss.elastic.co/u/cilasmarques)\ **Replies:** 1\ **Last updated:** [April 1, 2026, 12:58am UTC](https://discuss.elastic.co/t/unique-vs-multiple-dense-vectors/385710 "2026-04-01T00:58:30Z")
Hi there! I'm adding semantic search to my site's search functionality. I use Elasticsearch and my index is structured as follows: "title":{ "type":"text", "analyzer":"general\_analyzer", "fields": { "spell"… --- ## [How to Avoid Stack Mangement Menu](https://discuss.elastic.co/t/how-to-avoid-stack-mangement-menu/385687)
**Author:** [@stefws](https://discuss.elastic.co/u/stefws)\ **Replies:** 2\ **Last updated:** [March 31, 2026, 10:23pm UTC](https://discuss.elastic.co/t/how-to-avoid-stack-mangement-menu/385687 "2026-03-31T22:23:45Z")
Seems in Our Kibana v.8.19 that is hard to avoid having the Stack Management Application showing up in various Spaces for selected Users having multiple Roles Assigned. They seems to always get Index Management and Tran… --- ## [Error: entity content is too long \[105072697\] for the configured buffer limit \[104857600\]](https://discuss.elastic.co/t/error-entity-content-is-too-long-105072697-for-the-configured-buffer-limit-104857600/385636)
**Author:** [@Chen\_Wen](https://discuss.elastic.co/u/Chen_Wen)\ **Replies:** 16\ **Last updated:** [March 31, 2026, 8:49am UTC](https://discuss.elastic.co/t/error-entity-content-is-too-long-105072697-for-the-configured-buffer-limit-104857600/385636 "2026-03-31T08:49:15Z")
When I query data from ES8.2.3 with a big size in one req that the index docs are more than 10K and got en error Error: entity content is too long \[105072697\] for the configured buffer limit \[104857600\]. After search th… --- ## [Date\_Diff function not working as expeceted](https://discuss.elastic.co/t/date-diff-function-not-working-as-expeceted/385653)
**Author:** [@Whoami1980](https://discuss.elastic.co/u/Whoami1980)\ **Replies:** 4\ **Last updated:** [March 31, 2026, 6:09am UTC](https://discuss.elastic.co/t/date-diff-function-not-working-as-expeceted/385653 "2026-03-31T06:09:25Z")
Query works well without this "EVAL dd\_ms = DATE\_DIFF("day", last\_data, latest\_record)" last\_data | latest\_record 2026-03-05T04:58:55.453Z|2026-03-04T17:09:30.155Z| POST /\_query?format=txt { "query": """ FROM .ml… --- ## [Duplicate messages observed in Kafka when using Filebeat with disk queue](https://discuss.elastic.co/t/duplicate-messages-observed-in-kafka-when-using-filebeat-with-disk-queue/385693)
**Author:** [@Thirupathi](https://discuss.elastic.co/u/Thirupathi)\ **Replies:** 1\ **Last updated:** [March 30, 2026, 1:38pm UTC](https://discuss.elastic.co/t/duplicate-messages-observed-in-kafka-when-using-filebeat-with-disk-queue/385693 "2026-03-30T13:38:46Z")
We are observing duplicate messages being published to Kafka from Filebeat, even when the Kafka broker is up and stable. The issue occurs while using the disk queue (queue.disk ) configuration Kafka Output Configuration… --- ## [Looking for Alert rule dataview and index](https://discuss.elastic.co/t/looking-for-alert-rule-dataview-and-index/385650)
**Author:** [@Whoami1980](https://discuss.elastic.co/u/Whoami1980)\ **Replies:** 7\ **Last updated:** [March 30, 2026, 1:30pm UTC](https://discuss.elastic.co/t/looking-for-alert-rule-dataview-and-index/385650 "2026-03-30T13:30:39Z")
Using the API we can get the index of the alert that it is being used curl --request GET 'https://localhost:5601/api/alerting/rules/\_find' \\ If I want to use a query which default dataview or default index for all al… --- ## [How to hide KQL Query Bar and Filter Bar while keeping the Global Time Filter?](https://discuss.elastic.co/t/how-to-hide-kql-query-bar-and-filter-bar-while-keeping-the-global-time-filter/385658)
**Author:** [@Vignesh2](https://discuss.elastic.co/u/Vignesh2)\ **Replies:** 2\ **Last updated:** [March 30, 2026, 12:01pm UTC](https://discuss.elastic.co/t/how-to-hide-kql-query-bar-and-filter-bar-while-keeping-the-global-time-filter/385658 "2026-03-30T12:01:25Z")
Hi everyone, I am building a custom dashboard experience for customers using the new Controls (Input Controls). I want my custom controls to be the primary way users interact with the data. To keep the UI clean, I need… --- ## [Kibana GUI simple filter not able to get it work :(](https://discuss.elastic.co/t/kibana-gui-simple-filter-not-able-to-get-it-work/385598)
**Author:** [@Whoami1980](https://discuss.elastic.co/u/Whoami1980)\ **Replies:** 5\ **Last updated:** [March 30, 2026, 8:02am UTC](https://discuss.elastic.co/t/kibana-gui-simple-filter-not-able-to-get-it-work/385598 "2026-03-30T08:02:19Z")
I thought this was easy but after several attempt i wasnt able to get it working. We have a routine morning health check. i was trying to focus on errors or issue for the snapshot or agent logs but to no avail. For the… --- ## [ML jobs has no warnings or errors but message seems to be lagging](https://discuss.elastic.co/t/ml-jobs-has-no-warnings-or-errors-but-message-seems-to-be-lagging/385542)
**Author:** [@Whoami1980](https://discuss.elastic.co/u/Whoami1980)\ **Replies:** 6\ **Last updated:** [March 30, 2026, 5:55am UTC](https://discuss.elastic.co/t/ml-jobs-has-no-warnings-or-errors-but-message-seems-to-be-lagging/385542 "2026-03-30T05:55:08Z")
In one of our ML jobs. There doesnt appears to be any errors or warning in the job message. However the latest\_record\_timestamp is lagging behind the current\_timestamp KIndly advice how we can further look into this. … --- ## [Query for top xx usage elasticsearch nodes](https://discuss.elastic.co/t/query-for-top-xx-usage-elasticsearch-nodes/385581)
**Author:** [@Whoami1980](https://discuss.elastic.co/u/Whoami1980)\ **Replies:** 7\ **Last updated:** [March 29, 2026, 2:14pm UTC](https://discuss.elastic.co/t/query-for-top-xx-usage-elasticsearch-nodes/385581 "2026-03-29T14:14:30Z")
Trying to create a query for my cluster elasticsearch nodes. I want it to show nodes that is more than xx% of cpu or memory or JVM heap or free space left in % Not sure if I have selected the correct field for CPU , j… --- ## [PQ Size - growth by xx % in xx mins](https://discuss.elastic.co/t/pq-size-growth-by-xx-in-xx-mins/385627)
**Author:** [@Whoami1980](https://discuss.elastic.co/u/Whoami1980)\ **Replies:** 1\ **Last updated:** [March 29, 2026, 1:35am UTC](https://discuss.elastic.co/t/pq-size-growth-by-xx-in-xx-mins/385627 "2026-03-29T01:35:24Z")
We currently have an EQL query that is able to calculate PQ usage percentage. However now we have a new requirement. If there is a sudden increase in the "PQ Size - growth" by let say 10% in 30 mins. we need it to be aw… --- ## [Kibana: Show ‘Access Denied’ instead of ‘Application Not Found’ for read-only users](https://discuss.elastic.co/t/kibana-show-access-denied-instead-of-application-not-found-for-read-only-users/385666)
**Author:** [@Santhosh\_3](https://discuss.elastic.co/u/Santhosh_3)\ **Replies:** 1\ **Last updated:** [March 28, 2026, 6:01am UTC](https://discuss.elastic.co/t/kibana-show-access-denied-instead-of-application-not-found-for-read-only-users/385666 "2026-03-28T06:01:44Z")
Hi, I would like to change the message displayed in Kibana from “Application Not Found” to “Access Denied” for users with viewer (read-only) access. Is it possible to customize or configure this behaviour? [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=12) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=14)