# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=149 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 150 --- ## [Getting error while setting up new cluster ES version 8.1.1](https://discuss.elastic.co/t/getting-error-while-setting-up-new-cluster-es-version-8-1-1/369133)
**Author:** [@greatvikas123](https://discuss.elastic.co/u/greatvikas123)\ **Replies:** 2\ **Last updated:** [October 22, 2024, 3:29am UTC](https://discuss.elastic.co/t/getting-error-while-setting-up-new-cluster-es-version-8-1-1/369133 "2024-10-22T03:29:33Z")
ES is not starting. systemctl start elasticsearch Job for elasticsearch.service failed because the control process exited with error code. See "systemctl status elasticsearch.service" and "journalctl -xeu elasticsearc… --- ## [Why can't this match successfully?](https://discuss.elastic.co/t/why-cant-this-match-successfully/369146)
**Author:** [@WeirdorPersist](https://discuss.elastic.co/u/WeirdorPersist)\ **Replies:** 4\ **Last updated:** [October 22, 2024, 2:34am UTC](https://discuss.elastic.co/t/why-cant-this-match-successfully/369146 "2024-10-22T02:34:06Z")
I am trying to mark missing fields in the logs, but some log entries with missing fields cannot match successfully, which prevents them from being marked. What should I do? Is there something wrong with my configurati… --- ## [Dashboard drilldown option not showing in Kibana 7.10.1](https://discuss.elastic.co/t/dashboard-drilldown-option-not-showing-in-kibana-7-10-1/368915)
**Author:** [@audioman](https://discuss.elastic.co/u/audioman)\ **Replies:** 4\ **Last updated:** [October 22, 2024, 1:37am UTC](https://discuss.elastic.co/t/dashboard-drilldown-option-not-showing-in-kibana-7-10-1/368915 "2024-10-22T01:37:25Z")
Hi Team, I'm trying to create some dashboard drilldown from a pie chart, but unfortunately I can't find the "Create drilldown" option. Am I doing something wrong? I'm new to Kibana, so please let me know what I'm do… --- ## [Upgrade fleet server](https://discuss.elastic.co/t/upgrade-fleet-server/369177)
**Author:** [@juancamiloll](https://discuss.elastic.co/u/juancamiloll)\ **Replies:** 1\ **Last updated:** [October 21, 2024, 9:39pm UTC](https://discuss.elastic.co/t/upgrade-fleet-server/369177 "2024-10-21T21:39:16Z")
Hello As I have seen a new version available I decided to upgrade Elasticsearch server OK :white\_check\_mark: Logstas server OK :white\_check\_mark: Elasticsearch server OK :white\_check\_mark: kibana server OK … --- ## [Kibana Dashboard - Navigation Tips](https://discuss.elastic.co/t/kibana-dashboard-navigation-tips/367194)
**Author:** [@erikg](https://discuss.elastic.co/u/erikg)\ **Replies:** 1\ **Last updated:** [October 21, 2024, 9:32pm UTC](https://discuss.elastic.co/t/kibana-dashboard-navigation-tips/367194 "2024-10-21T21:32:00Z")
Hello, I was wondering how people navigate in elastic with custom dashboards? Do people normally rely on Dashboards UI to find their unrelated dashboards? The main reason I ask is that I find myself creating to many l… --- ## [Using Windows integration with policy that is applied to both Windows and Linux hosts](https://discuss.elastic.co/t/using-windows-integration-with-policy-that-is-applied-to-both-windows-and-linux-hosts/369152)
**Author:** [@Zaptros](https://discuss.elastic.co/u/Zaptros)\ **Replies:** 1\ **Last updated:** [October 21, 2024, 8:39pm UTC](https://discuss.elastic.co/t/using-windows-integration-with-policy-that-is-applied-to-both-windows-and-linux-hosts/369152 "2024-10-21T20:39:52Z")
Hi, is it a good idea to use an agent policy with the System and Windows integration for log collection for both Windows and Linux machines? Will the Windows integration consume too much resources on a OS it does not rea… --- ## [Return distinct values of a field in an alert](https://discuss.elastic.co/t/return-distinct-values-of-a-field-in-an-alert/368945)
**Author:** [@Austin\_R](https://discuss.elastic.co/u/Austin_R)\ **Replies:** 0\ **Last updated:** [October 16, 2024, 8:18pm UTC](https://discuss.elastic.co/t/return-distinct-values-of-a-field-in-an-alert/368945 "2024-10-16T20:18:05Z")
I've created an alert that returns the results I'm looking for, but I want to return only one event per unique id field. I've tried a couple different things, but neither of them have worked for me so far. Using Query D… --- ## [Unable to Save Fleet Settings - Logstash Output](https://discuss.elastic.co/t/unable-to-save-fleet-settings-logstash-output/363309)
**Author:** [@wangsubo](https://discuss.elastic.co/u/wangsubo)\ **Replies:** 5\ **Last updated:** [October 21, 2024, 7:53pm UTC](https://discuss.elastic.co/t/unable-to-save-fleet-settings-logstash-output/363309 "2024-10-21T19:53:34Z")
I am experiencing issues with saving my Fleet settings Logstash Output . Despite multiple attempts, the configuration just won't save. Could this be related to using the free version? Has anyone else encountered this pro… --- ## [Problem with Homebrew installation (7.17.4) and JDK](https://discuss.elastic.co/t/problem-with-homebrew-installation-7-17-4-and-jdk/369181)
**Author:** [@patrick7k](https://discuss.elastic.co/u/patrick7k)\ **Replies:** 0\ **Last updated:** [October 21, 2024, 7:44pm UTC](https://discuss.elastic.co/t/problem-with-homebrew-installation-7-17-4-and-jdk/369181 "2024-10-21T19:44:50Z")
I'm attempting to re-install Elasticsearch via Homebrew on Mac, after a system update, following these instructions. When running brew services restart elastic/tap/elasticsearch-full, a popup appears with the message: "… --- ## [Error while upgrading Logstash to version 8.15.3](https://discuss.elastic.co/t/error-while-upgrading-logstash-to-version-8-15-3/369027)
**Author:** [@juancamiloll](https://discuss.elastic.co/u/juancamiloll)\ **Replies:** 4\ **Last updated:** [October 21, 2024, 6:39pm UTC](https://discuss.elastic.co/t/error-while-upgrading-logstash-to-version-8-15-3/369027 "2024-10-21T18:39:42Z")
Hello to all After noticing that there is a new version of ELK 8.15.13 I set out to perform the upgrade initially on the elasticsearch cluster servers and all normal, kibana all normal. I started to have problems when … --- ## [How to query rollup jobs progress](https://discuss.elastic.co/t/how-to-query-rollup-jobs-progress/369176)
**Author:** [@marcosrobles-qo](https://discuss.elastic.co/u/marcosrobles-qo)\ **Replies:** 0\ **Last updated:** [October 21, 2024, 6:09pm UTC](https://discuss.elastic.co/t/how-to-query-rollup-jobs-progress/369176 "2024-10-21T18:09:08Z")
Hello Elastic Community, I am currently working with Elasticsearch and I need some assistance with monitoring the progress of my rollup jobs. I have set up a rollup job with the following configuration: { "config": {… --- ## [Can an fleet server be configured using http](https://discuss.elastic.co/t/can-an-fleet-server-be-configured-using-http/366697)
**Author:** [@jack\_a](https://discuss.elastic.co/u/jack_a)\ **Replies:** 1\ **Last updated:** [October 21, 2024, 6:00pm UTC](https://discuss.elastic.co/t/can-an-fleet-server-be-configured-using-http/366697 "2024-10-21T18:00:28Z")
so following the official document Step 7: Install Fleet Server when i try to add my host address like http://10.128.0.203:8220 i get the error Invalid URL (must be an https URL). what should i do? --- ## [Ingesting old data to a TSDS - Problems?](https://discuss.elastic.co/t/ingesting-old-data-to-a-tsds-problems/369174)
**Author:** [@deedubbs](https://discuss.elastic.co/u/deedubbs)\ **Replies:** 0\ **Last updated:** [October 21, 2024, 5:53pm UTC](https://discuss.elastic.co/t/ingesting-old-data-to-a-tsds-problems/369174 "2024-10-21T17:53:45Z")
We are about to stand up a time series datastream for some metrics data that we've been tracking via multiple indices. One of the notes on the TSDS documentation page suggests that you should only use a TSDS "if you typi… --- ## [Log Alerts - Latest Events](https://discuss.elastic.co/t/log-alerts-latest-events/369173)
**Author:** [@erikg](https://discuss.elastic.co/u/erikg)\ **Replies:** 0\ **Last updated:** [October 21, 2024, 5:50pm UTC](https://discuss.elastic.co/t/log-alerts-latest-events/369173 "2024-10-21T17:50:15Z")
How can I create a alert that checks for the last events? For example I might collect 36 documents of the same event but the timestamp is different. I don't really care about the all the events because it might create s… --- ## [Unable to access Elasticsearch](https://discuss.elastic.co/t/unable-to-access-elasticsearch/369170)
**Author:** [@Gary\_Foster](https://discuss.elastic.co/u/Gary_Foster)\ **Replies:** 3\ **Last updated:** [October 21, 2024, 5:40pm UTC](https://discuss.elastic.co/t/unable-to-access-elasticsearch/369170 "2024-10-21T17:40:17Z")
Hi I have installed Elasticsearch on my local Ubuntu machine today, but when I navigate to localhost:9200 I get the error: # This page isn’t working \*\*127.0.0.1\*\* didn’t send any data. ERR\_EMPTY\_RESPONSE When I run: s… --- ## [Kibana - minimum time interval](https://discuss.elastic.co/t/kibana-minimum-time-interval/369009)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 2\ **Last updated:** [October 21, 2024, 5:18pm UTC](https://discuss.elastic.co/t/kibana-minimum-time-interval/369009 "2024-10-21T17:18:45Z")
How do I setup lens to do fixed time interval aggregation? when I do 15 min minimum interval it work for short timeframe like 24 hour window but when I select larger window it goes back to auto. is there way we can fixe… --- ## [URLs behind text in Excel cells concatenated during ingestion using Ingest Attachment Processor](https://discuss.elastic.co/t/urls-behind-text-in-excel-cells-concatenated-during-ingestion-using-ingest-attachment-processor/369166)
**Author:** [@mbrb](https://discuss.elastic.co/u/mbrb)\ **Replies:** 0\ **Last updated:** [October 21, 2024, 3:59pm UTC](https://discuss.elastic.co/t/urls-behind-text-in-excel-cells-concatenated-during-ingestion-using-ingest-attachment-processor/369166 "2024-10-21T15:59:23Z")
Hi everyone, I'm using the Ingest Attachment Processor in Elasticsearch to parse and index various document types, including Excel files. The text within the cells is parsed correctly, and it appears separated in the in… --- ## [Elastic agent and osquery file integrity monitoring (FIM) integration](https://discuss.elastic.co/t/elastic-agent-and-osquery-file-integrity-monitoring-fim-integration/369159)
**Author:** [@ganrt](https://discuss.elastic.co/u/ganrt)\ **Replies:** 0\ **Last updated:** [October 21, 2024, 2:50pm UTC](https://discuss.elastic.co/t/elastic-agent-and-osquery-file-integrity-monitoring-fim-integration/369159 "2024-10-21T14:50:26Z")
Hello, I would like to know how to enable the FIM using the agent and the integration of osquery manager, I have set up some configuration according to the documentation of osquery for windows, however it refuses to wor… --- ## [Assistance with Logstash Sizing and Kafka Integration](https://discuss.elastic.co/t/assistance-with-logstash-sizing-and-kafka-integration/369076)
**Author:** [@Will3703](https://discuss.elastic.co/u/Will3703)\ **Replies:** 4\ **Last updated:** [October 19, 2024, 3:14pm UTC](https://discuss.elastic.co/t/assistance-with-logstash-sizing-and-kafka-integration/369076 "2024-10-19T15:14:16Z")
I am new to Elastic and would like to understand the sizing requirements for Logstash based on the following: • Data to process: 7TB over 10 hours • Average event size: 70% of events are 1KB, and 30% are 500 bytes How… --- ## [Why does one of the coordinating nodes in my ES cluster occasionally stop GC for a short period of time?](https://discuss.elastic.co/t/why-does-one-of-the-coordinating-nodes-in-my-es-cluster-occasionally-stop-gc-for-a-short-period-of-time/369155)
**Author:** [@wangxr1985](https://discuss.elastic.co/u/wangxr1985)\ **Replies:** 0\ **Last updated:** [October 21, 2024, 1:39pm UTC](https://discuss.elastic.co/t/why-does-one-of-the-coordinating-nodes-in-my-es-cluster-occasionally-stop-gc-for-a-short-period-of-time/369155 "2024-10-21T13:39:56Z")
My ES cluster frequently experiences issues where a coordinating node triggers the parent breaker every few days. Monitoring reveals that at the times these issues occur, the regular young GC pauses for 2-3 minutes, and … --- ## [Elasticsearch (Version 7.9.0) cannot add new elasticsearch nodes to join an existing cluster](https://discuss.elastic.co/t/elasticsearch-version-7-9-0-cannot-add-new-elasticsearch-nodes-to-join-an-existing-cluster/368981)
**Author:** [@ErikHorus1249](https://discuss.elastic.co/u/ErikHorus1249)\ **Replies:** 1\ **Last updated:** [October 21, 2024, 10:04am UTC](https://discuss.elastic.co/t/elasticsearch-version-7-9-0-cannot-add-new-elasticsearch-nodes-to-join-an-existing-cluster/368981 "2024-10-21T10:04:33Z")
Hello everyone, I'm working with an Elasticsearch cluster that currently has 6 nodes. I'm trying to expand it to 9 nodes by adding 3 more nodes. However, I've only been able to successfully add one of the new nodes. The… --- ## [Winlogbeat is not sending logs to new version of Apache Kafka with KRaft](https://discuss.elastic.co/t/winlogbeat-is-not-sending-logs-to-new-version-of-apache-kafka-with-kraft/368812)
**Author:** [@IamYipi](https://discuss.elastic.co/u/IamYipi)\ **Replies:** 2\ **Last updated:** [October 21, 2024, 7:43am UTC](https://discuss.elastic.co/t/winlogbeat-is-not-sending-logs-to-new-version-of-apache-kafka-with-kraft/368812 "2024-10-21T07:43:35Z")
Hi everyone, I'm having a problem with Apache Kafka, related with the configuration of the output format. The arquitecture I created is with docker containers, where Apache Kafka is one and the windows host (virtualize… --- ## [elasticsearch error: /usr/local/bin/docker-entrypoint.sh: cannot create temp file for here-document: Permission denied](https://discuss.elastic.co/t/elasticsearch-error-usr-local-bin-docker-entrypoint-sh-cannot-create-temp-file-for-here-document-permission-denied/365192)
**Author:** [@gomgom](https://discuss.elastic.co/u/gomgom)\ **Replies:** 1\ **Last updated:** [October 21, 2024, 7:14am UTC](https://discuss.elastic.co/t/elasticsearch-error-usr-local-bin-docker-entrypoint-sh-cannot-create-temp-file-for-here-document-permission-denied/365192 "2024-10-21T07:14:51Z")
I am new to elasticsearch and i want to install ELK on my linux local server using docker compose method. I took the .env and docker-compose files from the following url: \[elasticsearch/docs/reference/setup/install/dock… --- ## [Slow Query Performance](https://discuss.elastic.co/t/slow-query-performance/369083)
**Author:** [@hmacarthur](https://discuss.elastic.co/u/hmacarthur)\ **Replies:** 2\ **Last updated:** [October 21, 2024, 7:14am UTC](https://discuss.elastic.co/t/slow-query-performance/369083 "2024-10-21T07:14:34Z")
Hi. I've been noticing slower than desired query performance on my Elasticsearch cluster, and am hoping for guidance. My queries use exact matching on all terms, except for a single wildcard term match. I've attached a s… --- ## [Separate Documents from log (JSON)](https://discuss.elastic.co/t/separate-documents-from-log-json/369116)
**Author:** [@Naveenchand\_R\_B](https://discuss.elastic.co/u/Naveenchand_R_B)\ **Replies:** 0\ **Last updated:** [October 21, 2024, 5:55am UTC](https://discuss.elastic.co/t/separate-documents-from-log-json/369116 "2024-10-21T05:55:10Z")
Hi, I have a json which has array of json objects. I want to create seperate documents for each item inside the array Example JSON: { "MainID": "12345", "MainDocs": \[ { "PositionId": "p1", "PositionName"… --- ## [Logstash 0f 8.15.2 is not connecting with elasticsearch of 8.15.2](https://discuss.elastic.co/t/logstash-0f-8-15-2-is-not-connecting-with-elasticsearch-of-8-15-2/369034)
**Author:** [@vikascateina](https://discuss.elastic.co/u/vikascateina)\ **Replies:** 3\ **Last updated:** [October 21, 2024, 4:19am UTC](https://discuss.elastic.co/t/logstash-0f-8-15-2-is-not-connecting-with-elasticsearch-of-8-15-2/369034 "2024-10-21T04:19:01Z")
Hi, I am facing an issue with lntegration of logstash 8.15.2 with elasticsearch8.15.2. Logstash is failing to connect to Elasticsearch. The logs show the following errors: EDITED By MOD. Please Format your Code in the… --- ## [Self-signed certificate in certificate chain](https://discuss.elastic.co/t/self-signed-certificate-in-certificate-chain/368976)
**Author:** [@SamehSaeed](https://discuss.elastic.co/u/SamehSaeed)\ **Replies:** 2\ **Last updated:** [October 21, 2024, 3:14am UTC](https://discuss.elastic.co/t/self-signed-certificate-in-certificate-chain/368976 "2024-10-21T03:14:06Z")
Im having trouble running secure kibana on linux, i keep getting the below error : \[ERROR\]\[elasticsearch-service\] Unable to retrieve version information from Elasticsearch nodes. self-signed certificate in certificate c… --- ## [Sending Wazuh alerts to Elasticsearch using logstash integration with Wazuh Indexer](https://discuss.elastic.co/t/sending-wazuh-alerts-to-elasticsearch-using-logstash-integration-with-wazuh-indexer/369096)
**Author:** [@Muhammadh\_Zakir\_Huss](https://discuss.elastic.co/u/Muhammadh_Zakir_Huss)\ **Replies:** 1\ **Last updated:** [October 20, 2024, 11:56am UTC](https://discuss.elastic.co/t/sending-wazuh-alerts-to-elasticsearch-using-logstash-integration-with-wazuh-indexer/369096 "2024-10-20T11:56:01Z")
root@wazuhsiem:~# sudo -E /usr/share/logstash/bin/logstash -f /etc/logstash/conf .d/wazuh-elasticsearch.conf --p… --- ## [Ingestion Rate decreases over time](https://discuss.elastic.co/t/ingestion-rate-decreases-over-time/369102)
**Author:** [@NikoCosmico01](https://discuss.elastic.co/u/NikoCosmico01)\ **Replies:** 0\ **Last updated:** [October 20, 2024, 10:19am UTC](https://discuss.elastic.co/t/ingestion-rate-decreases-over-time/369102 "2024-10-20T10:19:53Z")
Hi everyone, I've created a Logstash ingestion pipeline that takes the logs from OpenSearch (about 30M logs per day) and forwards them into elasticSearch. My goal is to be able to load into ELK the last day of logs (as o… --- ## [Fortinet logs not showing](https://discuss.elastic.co/t/fortinet-logs-not-showing/369087)
**Author:** [@Oolong](https://discuss.elastic.co/u/Oolong)\ **Replies:** 3\ **Last updated:** [October 19, 2024, 2:55pm UTC](https://discuss.elastic.co/t/fortinet-logs-not-showing/369087 "2024-10-19T14:55:06Z")
Hi Guys, I need help with pulling Fortinet logs. I have set my firewall to push logs to my Syslog server(/var/log/syslog) and installed the Fortinet integration which installed successfully but I can't see the logs in a… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=148) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=150)