# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=133 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 134 --- ## [Option to add comments to Kibana Dashboard data table](https://discuss.elastic.co/t/option-to-add-comments-to-kibana-dashboard-data-table/370807)
**Author:** [@Sudheer\_Kumar](https://discuss.elastic.co/u/Sudheer_Kumar)\ **Replies:** 1\ **Last updated:** [November 21, 2024, 8:03pm UTC](https://discuss.elastic.co/t/option-to-add-comments-to-kibana-dashboard-data-table/370807 "2024-11-21T20:03:26Z")
Hi, I’m currently integrating ELK with our tools. For any reported issues, I need to add a textbox in each row of the data table in the Kibana dashboard for users to comment, acknowledge, or share the status. Could you p… --- ## [Elastic cloud request entity max length](https://discuss.elastic.co/t/elastic-cloud-request-entity-max-length/370845)
**Author:** [@dealomuss](https://discuss.elastic.co/u/dealomuss)\ **Replies:** 3\ **Last updated:** [November 21, 2024, 7:47pm UTC](https://discuss.elastic.co/t/elastic-cloud-request-entity-max-length/370845 "2024-11-21T19:47:18Z")
Hello, i have an elastic cloud cluster and im facing a request entity payload that seems to be too large the error received on the console is : { "statusCode": 413, "error": "Request Entity Too Large", "message"… --- ## [Elastic Agent Integration - Duo](https://discuss.elastic.co/t/elastic-agent-integration-duo/370895)
**Author:** [@mgotechlock](https://discuss.elastic.co/u/mgotechlock)\ **Replies:** 7\ **Last updated:** [November 21, 2024, 7:31pm UTC](https://discuss.elastic.co/t/elastic-agent-integration-duo/370895 "2024-11-21T19:31:04Z")
I'm trying to use the Duo integration in Elastic Agent. In standalone mode. The issue is that it is not using the last event published time so it is using the default value and re-pulling all Duo events. After much trou… --- ## [Logstask parse failure all the sudden](https://discuss.elastic.co/t/logstask-parse-failure-all-the-sudden/370907)
**Author:** [@devops\_training](https://discuss.elastic.co/u/devops_training)\ **Replies:** 2\ **Last updated:** [November 21, 2024, 6:34pm UTC](https://discuss.elastic.co/t/logstask-parse-failure-all-the-sudden/370907 "2024-11-21T18:34:38Z")
log event "2024-11-21 17:12:48|INFO|endpoint|ar-endpoint|AWS||null|null||Tenant GUID \[ujwujqllkll-232-11919191\], event GUID \[\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\]: Consumed record: thread\[0\], offset\[615049\], key\[null\]" Grok pattern in… --- ## [No option to add custom fields in agent policy](https://discuss.elastic.co/t/no-option-to-add-custom-fields-in-agent-policy/370902)
**Author:** [@Stephen\_IAnson](https://discuss.elastic.co/u/Stephen_IAnson)\ **Replies:** 2\ **Last updated:** [November 21, 2024, 5:33pm UTC](https://discuss.elastic.co/t/no-option-to-add-custom-fields-in-agent-policy/370902 "2024-11-21T17:33:37Z")
Hi, According to: Elastic Agent policies | Fleet and Elastic Agent Guide \[8.16\] | Elastic. I should be able to add custom field to agent policies. I simply don't have the option. If I try and add via an API request: P… --- ## [Kibana rules - Is it anyhow possible to source document that was hit against rule?](https://discuss.elastic.co/t/kibana-rules-is-it-anyhow-possible-to-source-document-that-was-hit-against-rule/370255)
**Author:** [@Dawid\_Popiela](https://discuss.elastic.co/u/Dawid_Popiela)\ **Replies:** 2\ **Last updated:** [November 21, 2024, 4:57pm UTC](https://discuss.elastic.co/t/kibana-rules-is-it-anyhow-possible-to-source-document-that-was-hit-against-rule/370255 "2024-11-21T16:57:06Z")
Hi, as tittle says is it possible to gather document in kibana rule that was hit? My usecase is like this that I am using inventory treshold rule for kubernetes pods to check memory usage treshold. I am ussing index con… --- ## [Ingest multiline auditd events from syslog sources](https://discuss.elastic.co/t/ingest-multiline-auditd-events-from-syslog-sources/370904)
**Author:** [@gamb](https://discuss.elastic.co/u/gamb)\ **Replies:** 0\ **Last updated:** [November 21, 2024, 4:36pm UTC](https://discuss.elastic.co/t/ingest-multiline-auditd-events-from-syslog-sources/370904 "2024-11-21T16:36:32Z")
Hello, I would like to merge (or aggregate) auditd logs with logstash. I have see lot of solutions with an agent but it seem tricky to do with a syslog source :frowning: I received auditd messages form multiple sources… --- ## [Restore of snapshot from s3 is failing](https://discuss.elastic.co/t/restore-of-snapshot-from-s3-is-failing/370785)
**Author:** [@mealbert23](https://discuss.elastic.co/u/mealbert23)\ **Replies:** 3\ **Last updated:** [November 21, 2024, 3:49pm UTC](https://discuss.elastic.co/t/restore-of-snapshot-from-s3-is-failing/370785 "2024-11-21T15:49:12Z")
Hi, I have two elasticsearch clusters (prod and dev). I have both clusters pointing to the same s3 back snapshot repo. The snapshots in prod say they are completing without error. However, when I try to restore from … --- ## [Rule Changing By Itself?](https://discuss.elastic.co/t/rule-changing-by-itself/370787)
**Author:** [@Kris\_Felscher](https://discuss.elastic.co/u/Kris_Felscher)\ **Replies:** 1\ **Last updated:** [November 21, 2024, 3:13pm UTC](https://discuss.elastic.co/t/rule-changing-by-itself/370787 "2024-11-21T15:13:15Z")
We have a rule that seems to have modified itself somehow. Previously the filter for the rule was "healthcheckname : name and not healthstatus : Healthy" However, around midnight last night the filter got modified to: … --- ## [ES|QL Search if a value in a list is in another list](https://discuss.elastic.co/t/es-ql-search-if-a-value-in-a-list-is-in-another-list/370784)
**Author:** [@isugg](https://discuss.elastic.co/u/isugg)\ **Replies:** 2\ **Last updated:** [November 21, 2024, 2:23pm UTC](https://discuss.elastic.co/t/es-ql-search-if-a-value-in-a-list-is-in-another-list/370784 "2024-11-21T14:23:48Z")
Trying to find all instances of "-a" or "-x" in process arguments, from endpoint logs. I have the following values: process.name: "process" process.command\_line: "process -a -b -c" process.args: \["process", "-a", "-b… --- ## [Alert when host(server) is down](https://discuss.elastic.co/t/alert-when-host-server-is-down/370688)
**Author:** [@bex](https://discuss.elastic.co/u/bex)\ **Replies:** 4\ **Last updated:** [November 21, 2024, 1:56pm UTC](https://discuss.elastic.co/t/alert-when-host-server-is-down/370688 "2024-11-21T13:56:17Z")
Hello everyone! Could you please tell me if there are any ways to create an alert if some server is down or elastic-agent stopped send logs to the Elastic --- ## [Help to understand fuzzy score](https://discuss.elastic.co/t/help-to-understand-fuzzy-score/370870)
**Author:** [@yeikel](https://discuss.elastic.co/u/yeikel)\ **Replies:** 3\ **Last updated:** [November 21, 2024, 12:57pm UTC](https://discuss.elastic.co/t/help-to-understand-fuzzy-score/370870 "2024-11-21T12:57:23Z")
Given the following search: { "size": 100, "query": { "bool": { "must": \[ { "match": { "business\_names": { "query": "my company", "operator": "and"… --- ## [Elastic Search .Net Combine Must and Should Showing All Queries rather than correct combination](https://discuss.elastic.co/t/elastic-search-net-combine-must-and-should-showing-all-queries-rather-than-correct-combination/370852)
**Author:** [@GaryBtP](https://discuss.elastic.co/u/GaryBtP)\ **Replies:** 2\ **Last updated:** [November 21, 2024, 12:22pm UTC](https://discuss.elastic.co/t/elastic-search-net-combine-must-and-should-showing-all-queries-rather-than-correct-combination/370852 "2024-11-21T12:22:27Z")
I'm struggling to generate a .Net search which will combine a must field of one value and a should search of one of two values from a different field - e.g. results must contain value1 from field1 and either value2 or va… --- ## [Ingesting whole files](https://discuss.elastic.co/t/ingesting-whole-files/370891)
**Author:** [@Rihards](https://discuss.elastic.co/u/Rihards)\ **Replies:** 0\ **Last updated:** [November 21, 2024, 12:22pm UTC](https://discuss.elastic.co/t/ingesting-whole-files/370891 "2024-11-21T12:22:21Z")
Looking for the best way to ingest whole files. Potentially three outcomes would be of interest: a) Ingest the whole plaintext file as a single-field document. b) Ingest the file as k-v pairs (ini-style file). c) Ing… --- ## [New nodes added to cluster are not rebalancing](https://discuss.elastic.co/t/new-nodes-added-to-cluster-are-not-rebalancing/370715)
**Author:** [@mpniel](https://discuss.elastic.co/u/mpniel)\ **Replies:** 9\ **Last updated:** [November 21, 2024, 12:12pm UTC](https://discuss.elastic.co/t/new-nodes-added-to-cluster-are-not-rebalancing/370715 "2024-11-21T12:12:11Z")
I have 50 nodes in the Elasticsearch 7.5 cluster and added five new nodes. All shards are balancing between nodes . These five new nodes for some reason do not go into balance, and their disks are near empty. There are… --- ## [Http client did not trust this server's certificate, closing connection](https://discuss.elastic.co/t/http-client-did-not-trust-this-servers-certificate-closing-connection/357189)
**Author:** [@abhinavtyagi](https://discuss.elastic.co/u/abhinavtyagi)\ **Replies:** 5\ **Last updated:** [November 21, 2024, 11:24am UTC](https://discuss.elastic.co/t/http-client-did-not-trust-this-servers-certificate-closing-connection/357189 "2024-11-21T11:24:43Z")
I am trying to sync MySQL with Elasticsearch and using version 8.13.2. I followed the docs for setup. But getting below error in my Elasticsearch logs: {"@timestamp":"2024-04-11T07:52:04.039Z", "log.level": "WARN", "m… --- ## [Nginx logs with filebeat and parsing with pipeline](https://discuss.elastic.co/t/nginx-logs-with-filebeat-and-parsing-with-pipeline/370413)
**Author:** [@Enol](https://discuss.elastic.co/u/Enol)\ **Replies:** 4\ **Last updated:** [November 21, 2024, 10:24am UTC](https://discuss.elastic.co/t/nginx-logs-with-filebeat-and-parsing-with-pipeline/370413 "2024-11-21T10:24:12Z")
Hello,I have filebeat installed in one server that have docker containers running inside. One of those container is a nginx container and I need to parse the log to see it well in elastic. I have configured filebeat tu … --- ## [Sending data to index through vega or by any other kibana feature from dahsboard](https://discuss.elastic.co/t/sending-data-to-index-through-vega-or-by-any-other-kibana-feature-from-dahsboard/370877)
**Author:** [@aman\_kumar4](https://discuss.elastic.co/u/aman_kumar4)\ **Replies:** 0\ **Last updated:** [November 21, 2024, 8:36am UTC](https://discuss.elastic.co/t/sending-data-to-index-through-vega-or-by-any-other-kibana-feature-from-dahsboard/370877 "2024-11-21T08:36:37Z")
I want to calculate that how much an user spent time on a particular dashboard i have created a timer through vega ( working) now want to send this timer data when user closes/leaves the dashboard so that I can use thi… --- ## [Filter\_path usage in multi-search](https://discuss.elastic.co/t/filter-path-usage-in-multi-search/370822)
**Author:** [@sevdog](https://discuss.elastic.co/u/sevdog)\ **Replies:** 1\ **Last updated:** [November 21, 2024, 8:10am UTC](https://discuss.elastic.co/t/filter-path-usage-in-multi-search/370822 "2024-11-21T08:10:31Z")
Hello everybody, i recenlty started using the filter\_path parameter (Common options | Elasticsearch Guide \[8.16\] | Elastic) to reduce output of a msearch performed on some metricbeat indicies: the first search looks for … --- ## [ElasticsearchClient.healthReport() give cluster status as yellow even though cluster is green](https://discuss.elastic.co/t/elasticsearchclient-healthreport-give-cluster-status-as-yellow-even-though-cluster-is-green/370695)
**Author:** [@sibasish.palo](https://discuss.elastic.co/u/sibasish.palo)\ **Replies:** 9\ **Last updated:** [November 21, 2024, 6:36am UTC](https://discuss.elastic.co/t/elasticsearchclient-healthreport-give-cluster-status-as-yellow-even-though-cluster-is-green/370695 "2024-11-21T06:36:44Z")
Hi Noticing one weird issue where ElasticsearchClient.healthReport() gives status as Yellow even though the cluster status is green /\_cluster/health { "cluster\_name": "es\_cluster", "status": "green", "timed\_out"… --- ## [Kibana Dashboard with error Code 504](https://discuss.elastic.co/t/kibana-dashboard-with-error-code-504/370872)
**Author:** [@balaa](https://discuss.elastic.co/u/balaa)\ **Replies:** 0\ **Last updated:** [November 21, 2024, 4:39am UTC](https://discuss.elastic.co/t/kibana-dashboard-with-error-code-504/370872 "2024-11-21T04:39:48Z")
Hi Team, We have recently upgraded elk stack from 7.17 to 8.12 and from then onwards we are getting the below error when we run dashboards for more than 7days. Any one please suggest what could be the cause and how to … --- ## [Query rules / Curations](https://discuss.elastic.co/t/query-rules-curations/370868)
**Author:** [@pngworkforce](https://discuss.elastic.co/u/pngworkforce)\ **Replies:** 0\ **Last updated:** [November 21, 2024, 12:50am UTC](https://discuss.elastic.co/t/query-rules-curations/370868 "2024-11-21T00:50:59Z")
Hello! I have created the following ruleset in my Elastic Cloud instance PUT \_query\_rules/rule1 { "rules": \[ { "rule\_id": "rates", "type": "pinned", "criteria": \[ { "… --- ## [Force a full recrawl](https://discuss.elastic.co/t/force-a-full-recrawl/370484)
**Author:** [@pngworkforce](https://discuss.elastic.co/u/pngworkforce)\ **Replies:** 4\ **Last updated:** [November 21, 2024, 12:41am UTC](https://discuss.elastic.co/t/force-a-full-recrawl/370484 "2024-11-21T00:41:00Z")
Hello! Is there a way to force a full recrawl of all documents in the Elastic Cloud UI? We have added some mapped fields but they are not applied to docs indexed before the mapped fields were added. I read that a rein… --- ## [Creating jmeter transaction comparison table using Runtime Fields](https://discuss.elastic.co/t/creating-jmeter-transaction-comparison-table-using-runtime-fields/370863)
**Author:** [@2bitlong](https://discuss.elastic.co/u/2bitlong)\ **Replies:** 0\ **Last updated:** [November 20, 2024, 11:16pm UTC](https://discuss.elastic.co/t/creating-jmeter-transaction-comparison-table-using-runtime-fields/370863 "2024-11-20T23:16:43Z")
I am trying to build a table in lens for the Jmeter test results. The table is supposed to have 4 columns: SampleLabel 90th Perc of ResponseTime for Test1 90th Perc of ResponseTime for Test2 Difference of above 2 Resp… --- ## [Using syslog input plugin not working](https://discuss.elastic.co/t/using-syslog-input-plugin-not-working/370856)
**Author:** [@yquirion](https://discuss.elastic.co/u/yquirion)\ **Replies:** 2\ **Last updated:** [November 20, 2024, 8:43pm UTC](https://discuss.elastic.co/t/using-syslog-input-plugin-not-working/370856 "2024-11-20T20:43:27Z")
Dear all, I'm having a strange issue. I have a pipeline listening for syslog data. When the data comes in, I just see there is a new connection coming from the client (the syslog server) and the connection if close. No… --- ## [How can an one node server handle shards limit?](https://discuss.elastic.co/t/how-can-an-one-node-server-handle-shards-limit/370855)
**Author:** [@Benny-RR](https://discuss.elastic.co/u/Benny-RR)\ **Replies:** 3\ **Last updated:** [November 20, 2024, 8:01pm UTC](https://discuss.elastic.co/t/how-can-an-one-node-server-handle-shards-limit/370855 "2024-11-20T20:01:05Z")
Hello, I have been assiged to maintain an ELK stack server where there are scripts that run automatically, these scripts get reports from IntelMQ and VulnWhisperer. IntelMQ's reports generate an index per day and the Vul… --- ## [Dial tcp \*.\*.\*.\*:9200 connct : cannot assign requested](https://discuss.elastic.co/t/dial-tcp-9200-connct-cannot-assign-requested/370779)
**Author:** [@dsagent](https://discuss.elastic.co/u/dsagent)\ **Replies:** 11\ **Last updated:** [November 20, 2024, 7:08pm UTC](https://discuss.elastic.co/t/dial-tcp-9200-connct-cannot-assign-requested/370779 "2024-11-20T19:08:42Z")
Hi How to get elasticsearch to receive orders up to 100,000 Because when I search elasticsearch I get the following error dial tcp ...:9200 connct : cannot assign requested --- ## [Remote node](https://discuss.elastic.co/t/remote-node/370287)
**Author:** [@sandra\_a](https://discuss.elastic.co/u/sandra_a)\ **Replies:** 2\ **Last updated:** [November 20, 2024, 6:33pm UTC](https://discuss.elastic.co/t/remote-node/370287 "2024-11-20T18:33:01Z")
I want to setup two nodes remotely which mean master node will be in host 1 (eg. 172.16.3.8) and node 2 be in 172.16.3.10 and node 3 be in 172.16.3.70 how should i setup docker-compose? is there any documents or anythi… --- ## [IgnoreUrls](https://discuss.elastic.co/t/ignoreurls/370844)
**Author:** [@Kirtash](https://discuss.elastic.co/u/Kirtash)\ **Replies:** 0\ **Last updated:** [November 20, 2024, 3:23pm UTC](https://discuss.elastic.co/t/ignoreurls/370844 "2024-11-20T15:23:19Z")
Good morning, I'm using the package "Elastic.Apm.NetCoreAll (1.25.3)" in a dotnet service and my intention is that some transactions not appears in APM, but it don't works :frowning: I have configured the appsettings: … --- ## [Elastic agent metrics](https://discuss.elastic.co/t/elastic-agent-metrics/370833)
**Author:** [@harshpanchal](https://discuss.elastic.co/u/harshpanchal)\ **Replies:** 3\ **Last updated:** [November 20, 2024, 1:20pm UTC](https://discuss.elastic.co/t/elastic-agent-metrics/370833 "2024-11-20T13:20:05Z")
Does the Elastic Agent, with the system integration enabled, expose system metrics in a way that Prometheus can consume them and then display them in Grafana for monitoring ? [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=132) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=134)