# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=15 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 16 --- ## [AI Assistant - Need to add a new LLM to Elastic](https://discuss.elastic.co/t/ai-assistant-need-to-add-a-new-llm-to-elastic/385506)
**Author:** [@venkatkumar229](https://discuss.elastic.co/u/venkatkumar229)\ **Replies:** 0\ **Last updated:** [March 18, 2026, 1:02pm UTC](https://discuss.elastic.co/t/ai-assistant-need-to-add-a-new-llm-to-elastic/385506 "2026-03-18T13:02:47Z")
Hi Team, We are currently using Elasticsearch within our ELK platform to reconcile data received from multiple source systems. This is implemented using Elasticsearch transforms, where we compare data across multiple sy… --- ## [Lookup join and visualization on that join](https://discuss.elastic.co/t/lookup-join-and-visualization-on-that-join/385464)
**Author:** [@jai2](https://discuss.elastic.co/u/jai2)\ **Replies:** 5\ **Last updated:** [March 18, 2026, 10:36am UTC](https://discuss.elastic.co/t/lookup-join-and-visualization-on-that-join/385464 "2026-03-18T10:36:45Z")
Consider the following, I have populated 2 indices, both have a task\_id field and I want to join these 2 indices on task\_id to create a dashboard in Kibana. Firstly, I cannot create a data view out of a lookup join. I … --- ## [Anomaly Detection Jobs - Various warning messages](https://discuss.elastic.co/t/anomaly-detection-jobs-various-warning-messages/385501)
**Author:** [@Whoami1980](https://discuss.elastic.co/u/Whoami1980)\ **Replies:** 3\ **Last updated:** [March 18, 2026, 9:49am UTC](https://discuss.elastic.co/t/anomaly-detection-jobs-various-warning-messages/385501 "2026-03-18T09:49:02Z")
We are seeing various warning message below. Is there a guide to kickstart how we can kick start our troubleshooting? Warning datafeed is encountering errors submitting data for analysis exception while flushing jobs … --- ## [Unhelathy host ](https://discuss.elastic.co/t/unhelathy-host/385494)
**Author:** [@a.thiome](https://discuss.elastic.co/u/a.thiome)\ **Replies:** 2\ **Last updated:** [March 18, 2026, 1:58am UTC](https://discuss.elastic.co/t/unhelathy-host/385494 "2026-03-18T01:58:58Z")
I recently installed the Elastic Stack and used Fleet to add hosts, but all Windows and Linux hosts appear as unhealthy. Has anyone else encountered this issue? --- ## [Oracle Integration condition](https://discuss.elastic.co/t/oracle-integration-condition/385431)
**Author:** [@hubkos](https://discuss.elastic.co/u/hubkos)\ **Replies:** 4\ **Last updated:** [March 17, 2026, 9:51pm UTC](https://discuss.elastic.co/t/oracle-integration-condition/385431 "2026-03-17T21:51:49Z")
Hi all, is there a possibility to add a condition for Oracle Integration? Just like PostgreSQL has one, I’d like to “activate” Oracle Integration based on agent Providers. Thanks and greetings, Hubert --- ## [Different responses for search with terms query and get document by id](https://discuss.elastic.co/t/different-responses-for-search-with-terms-query-and-get-document-by-id/385114)
**Author:** [@jprucia](https://discuss.elastic.co/u/jprucia)\ **Replies:** 5\ **Last updated:** [March 17, 2026, 12:42pm UTC](https://discuss.elastic.co/t/different-responses-for-search-with-terms-query-and-get-document-by-id/385114 "2026-03-17T12:42:25Z")
Here is the scenario: app is running an integration test and is spinning up docker container using official docker image, version 8.7.0. When it’s up nd running, test doest its setup (it is using Spring Data Elasticsearc… --- ## [Feedback AutoOps for On-Prem Cluster](https://discuss.elastic.co/t/feedback-autoops-for-on-prem-cluster/385479)
**Author:** [@Wolfram\_Haussig](https://discuss.elastic.co/u/Wolfram_Haussig)\ **Replies:** 4\ **Last updated:** [March 17, 2026, 10:18am UTC](https://discuss.elastic.co/t/feedback-autoops-for-on-prem-cluster/385479 "2026-03-17T10:18:01Z")
Dear All, We are using AutoOps for our on-prem cluster for about 5 months now (we connect AutoOps as soon as we heard of it at the end of october). After the first few hickups trying to install it, the installation was… --- ## [Upgrading from ES 7.17.8 to 8.19.8](https://discuss.elastic.co/t/upgrading-from-es-7-17-8-to-8-19-8/385475)
**Author:** [@winter\_crescents](https://discuss.elastic.co/u/winter_crescents)\ **Replies:** 1\ **Last updated:** [March 17, 2026, 8:08am UTC](https://discuss.elastic.co/t/upgrading-from-es-7-17-8-to-8-19-8/385475 "2026-03-17T08:08:36Z")
I have recently tried to upgrade Elasticsearch from version 7.17.8 to 8.19.8. However, I am facing this error: java.io.EOFException at org.elasticsearch.common.io.stream.InputStreamStreamInput.readByte(InputStreamStre… --- ## [Repository URL Changed: /packages/x.x/yum/ No Longer Working - Official Documentation Needed](https://discuss.elastic.co/t/repository-url-changed-packages-x-x-yum-no-longer-working-official-documentation-needed/385469)
**Author:** [@ven\_off](https://discuss.elastic.co/u/ven_off)\ **Replies:** 0\ **Last updated:** [March 16, 2026, 1:41pm UTC](https://discuss.elastic.co/t/repository-url-changed-packages-x-x-yum-no-longer-working-official-documentation-needed/385469 "2026-03-16T13:41:22Z")
Hello Elasticsearch Community, We're experiencing issues syncing Elasticsearch packages from the official repository and have discovered that the repository URL structure has changed Problem: Our mirrors server is con… --- ## [Generated reports no access for user with limited index patterns](https://discuss.elastic.co/t/generated-reports-no-access-for-user-with-limited-index-patterns/368092)
**Author:** [@tomaszde](https://discuss.elastic.co/u/tomaszde)\ **Replies:** 4\ **Last updated:** [March 16, 2026, 10:37am UTC](https://discuss.elastic.co/t/generated-reports-no-access-for-user-with-limited-index-patterns/368092 "2026-03-16T10:37:58Z")
Hi, I'm having issue with generated reports. When use the user with the role that have read access to \* index pattern, report is generated with data. But if a role only have access to specific index pattern eg. mylogs-… --- ## [Remove semantic duplicates in retrieval](https://discuss.elastic.co/t/remove-semantic-duplicates-in-retrieval/385456)
**Author:** [@alexander.korkhov](https://discuss.elastic.co/u/alexander.korkhov)\ **Replies:** 0\ **Last updated:** [March 15, 2026, 5:30pm UTC](https://discuss.elastic.co/t/remove-semantic-duplicates-in-retrieval/385456 "2026-03-15T17:30:22Z")
ElasticSeach indexes poster events retrieved from different sources. The same event (for example, a performance) can be retrieved from different sources. Is it possible to somehow organize the data retrieval so that only… --- ## [Multi ES Clusters vs single Fleet Service](https://discuss.elastic.co/t/multi-es-clusters-vs-single-fleet-service/385455)
**Author:** [@stefws](https://discuss.elastic.co/u/stefws)\ **Replies:** 5\ **Last updated:** [March 15, 2026, 3:40pm UTC](https://discuss.elastic.co/t/multi-es-clusters-vs-single-fleet-service/385455 "2026-03-15T15:40:21Z")
Hi, Currently in progress of migrating from standalone beats to Fleet Agent Policies. Currently got a Custom Application Observability production ES cluster and a remote monitoring ES cluster, both Air Gapped v.8.19 cl… --- ## [Where to find the Custom Logs (Filestream) integration?](https://discuss.elastic.co/t/where-to-find-the-custom-logs-filestream-integration/385446)
**Author:** [@stefws](https://discuss.elastic.co/u/stefws)\ **Replies:** 6\ **Last updated:** [March 15, 2026, 12:36pm UTC](https://discuss.elastic.co/t/where-to-find-the-custom-logs-filestream-integration/385446 "2026-03-15T12:36:00Z")
We’re trying to run an Air Gapped EPR registry v.1.37.0 with a minimal set of selected integration packages, but kibana v.8.19.9 first of all shows a larger(e) set of integrations (wondering why?) to select among in th… --- ## [Get unique words (tokens ?) from all text fields from all documents in an Index](https://discuss.elastic.co/t/get-unique-words-tokens-from-all-text-fields-from-all-documents-in-an-index/385424)
**Author:** [@sivakumarp11](https://discuss.elastic.co/u/sivakumarp11)\ **Replies:** 3\ **Last updated:** [March 15, 2026, 5:26am UTC](https://discuss.elastic.co/t/get-unique-words-tokens-from-all-text-fields-from-all-documents-in-an-index/385424 "2026-03-15T05:26:40Z")
Is there a way to get list of ‘unique’ words Or terms used in a large text field in ALL the documents ? for ex. if the text field has content like ‘It is the most confidential because confidential or transcendental knowl… --- ## [Is it possible to Downsamp to a list of keyword values!](https://discuss.elastic.co/t/is-it-possible-to-downsamp-to-a-list-of-keyword-values/385393)
**Author:** [@A\_Abdellah](https://discuss.elastic.co/u/A_Abdellah)\ **Replies:** 1\ **Last updated:** [March 15, 2026, 3:37am UTC](https://discuss.elastic.co/t/is-it-possible-to-downsamp-to-a-list-of-keyword-values/385393 "2026-03-15T03:37:21Z")
Hello everyone, I have a time series data stream (TSDS) set up with downsampling configured via ILM (e.g. downsample to 1d intervals daily). The index template is correctly marked with time\_series\_dimension. My data in… --- ## [\[Elastic Log Driver\] Structured JSON logs breaks when Docker splits large log lines](https://discuss.elastic.co/t/elastic-log-driver-structured-json-logs-breaks-when-docker-splits-large-log-lines/385448)
**Author:** [@empee](https://discuss.elastic.co/u/empee)\ **Replies:** 0\ **Last updated:** [March 14, 2026, 2:10am UTC](https://discuss.elastic.co/t/elastic-log-driver-structured-json-logs-breaks-when-docker-splits-large-log-lines/385448 "2026-03-14T02:10:11Z")
Summary When using the Elastic Docker Logging Plugin, applications that already emit structured JSON logs cannot reliably ingest them into Elasticsearch because Docker may split large log lines before they reach the logg… --- ## [Using gMSA account to create API key for Elasticsearch ingestion](https://discuss.elastic.co/t/using-gmsa-account-to-create-api-key-for-elasticsearch-ingestion/385445)
**Author:** [@Vishal\_Reddy\_P](https://discuss.elastic.co/u/Vishal_Reddy_P)\ **Replies:** 1\ **Last updated:** [March 14, 2026, 12:49am UTC](https://discuss.elastic.co/t/using-gmsa-account-to-create-api-key-for-elasticsearch-ingestion/385445 "2026-03-14T00:49:50Z")
Earlier we used a service account to log into Kibana and create an API key for log ingestion or reading events. Now we are moving to a gMSA (Group Managed Service Account) which is passwordless and cannot log in interac… --- ## [Downsampling only works one time](https://discuss.elastic.co/t/downsampling-only-works-one-time/375708)
**Author:** [@bstinchcomb](https://discuss.elastic.co/u/bstinchcomb)\ **Replies:** 1\ **Last updated:** [March 13, 2026, 2:43pm UTC](https://discuss.elastic.co/t/downsampling-only-works-one-time/375708 "2026-03-13T14:43:22Z")
Hello, I am running into an issue with elasticsearch where downsampling will only run a single time, and then subsequent runs seems to just create an empty index. I have tried several different docker versions and still … --- ## [Logstash pipeline shutting off/starting order](https://discuss.elastic.co/t/logstash-pipeline-shutting-off-starting-order/385423)
**Author:** [@Rnx](https://discuss.elastic.co/u/Rnx)\ **Replies:** 3\ **Last updated:** [March 12, 2026, 10:09pm UTC](https://discuss.elastic.co/t/logstash-pipeline-shutting-off-starting-order/385423 "2026-03-12T22:09:16Z")
How to force logstash to switch off pipelines in given order? In my setup, I’m often receiving data via http input and distributing those messages among various pipelines based on content, however if I turn the logstash… --- ## [Does the .tasks index still exist in ES 8 and beyond?](https://discuss.elastic.co/t/does-the-tasks-index-still-exist-in-es-8-and-beyond/385426)
**Author:** [@davysteegen](https://discuss.elastic.co/u/davysteegen)\ **Replies:** 2\ **Last updated:** [March 12, 2026, 8:19pm UTC](https://discuss.elastic.co/t/does-the-tasks-index-still-exist-in-es-8-and-beyond/385426 "2026-03-12T20:19:49Z")
Hi, We are in the process of migrating our ES 7 to ES 8. The Java application that connects to the elasticsearch had a job that periodically removed all documents from the system .tasks index where the completed flag is… --- ## [High availability Ingest architecture](https://discuss.elastic.co/t/high-availability-ingest-architecture/385425)
**Author:** [@fer.mt](https://discuss.elastic.co/u/fer.mt)\ **Replies:** 2\ **Last updated:** [March 12, 2026, 6:29pm UTC](https://discuss.elastic.co/t/high-availability-ingest-architecture/385425 "2026-03-12T18:29:09Z")
Context: My team manages an on-prem Elastic deployment. We have an ECE license. We had an outage a few weeks ago when our elastic nodes ran out of space caused by a problem with the move of data to the frozen layer. S… --- ## [Best way to store document chunks for vector search as production standard](https://discuss.elastic.co/t/best-way-to-store-document-chunks-for-vector-search-as-production-standard/385414)
**Author:** [@grunggy](https://discuss.elastic.co/u/grunggy)\ **Replies:** 2\ **Last updated:** [March 12, 2026, 5:43pm UTC](https://discuss.elastic.co/t/best-way-to-store-document-chunks-for-vector-search-as-production-standard/385414 "2026-03-12T17:43:33Z")
Hi, working on a RAG setup and trying to land on a sensible production architecture for chunk storage and retrieval. Curious what others are running at scale. Large documents get split into chunks at ingestion, each chu… --- ## [Wildcard phrases with slop using string query](https://discuss.elastic.co/t/wildcard-phrases-with-slop-using-string-query/385418)
**Author:** [@S-Dragon0302](https://discuss.elastic.co/u/S-Dragon0302)\ **Replies:** 1\ **Last updated:** [March 12, 2026, 8:29am UTC](https://discuss.elastic.co/t/wildcard-phrases-with-slop-using-string-query/385418 "2026-03-12T08:29:31Z")
Is this kind of query still not supported. This won't work. "query\_string": { "fields": \[ "nickname" \], "query": "content:\\"hello\\" AND \\"Rodan Fields?\\"", "default\_operator": "AND" } Writing "slop" like this w… --- ## [Error Migration 8.19.12 -\> 9.1.3](https://discuss.elastic.co/t/error-migration-8-19-12-9-1-3/385410)
**Author:** [@M1ghty1](https://discuss.elastic.co/u/M1ghty1)\ **Replies:** 5\ **Last updated:** [March 11, 2026, 12:24pm UTC](https://discuss.elastic.co/t/error-migration-8-19-12-9-1-3/385410 "2026-03-11T12:24:55Z")
I am currently migrating from elasticsearch 8.19.12 to 9.1.3. I fixed the issues in upgrade assistant in 8.19.12, created a snapshot which is valid (status = SUCCESS). But when i try to import the snapshot in 9.1.3 i ge… --- ## [Limitations of ElasticSearch & Kibana Combination](https://discuss.elastic.co/t/limitations-of-elasticsearch-kibana-combination/382039)
**Author:** [@geoffrey](https://discuss.elastic.co/u/geoffrey)\ **Replies:** 14\ **Last updated:** [March 11, 2026, 7:19am UTC](https://discuss.elastic.co/t/limitations-of-elasticsearch-kibana-combination/382039 "2026-03-11T07:19:51Z")
Hi everyone, Im here as a 5 day old user of Elasticsearch + Kibana user and have given it a lot of time over this period. One thing which strikes me as a real limitation I am running into is that as a general rule of t… --- ## [Tenable Security Center Integration API Issues](https://discuss.elastic.co/t/tenable-security-center-integration-api-issues/385400)
**Author:** [@AnakinWasRight](https://discuss.elastic.co/u/AnakinWasRight)\ **Replies:** 0\ **Last updated:** [March 11, 2026, 12:14am UTC](https://discuss.elastic.co/t/tenable-security-center-integration-api-issues/385400 "2026-03-11T00:14:09Z")
Self signed cert for Sec Center. The ssl side of the house seems to be fine as the agent is fully healthy. Generated the access/secret key in sec center with an administration account and enabled allow api keys in the gu… --- ## [Suggestion: Unify components](https://discuss.elastic.co/t/suggestion-unify-components/385379)
**Author:** [@Wolfram\_Haussig](https://discuss.elastic.co/u/Wolfram_Haussig)\ **Replies:** 2\ **Last updated:** [March 10, 2026, 4:06pm UTC](https://discuss.elastic.co/t/suggestion-unify-components/385379 "2026-03-10T16:06:23Z")
Dear Elastic Team, I have a small suggestion in terms of wording in Visualizations: I have a Dashboard (for monitoring Postgres, but that doesn't matter here) with multiple components and every component seems to displ… --- ## [Clarification about frozen data on k8s](https://discuss.elastic.co/t/clarification-about-frozen-data-on-k8s/385397)
**Author:** [@Cario](https://discuss.elastic.co/u/Cario)\ **Replies:** 0\ **Last updated:** [March 10, 2026, 3:51pm UTC](https://discuss.elastic.co/t/clarification-about-frozen-data-on-k8s/385397 "2026-03-10T15:51:13Z")
Hello everyone, I am new to the forum and basically self-taught, so I apologize in advance if I lack some basic knowledge. Thank you for your understanding. The elastic cluster works on a k8s cluster as pods, but readi… --- ## [Syslog parser fails on double backslashes in structured data](https://discuss.elastic.co/t/syslog-parser-fails-on-double-backslashes-in-structured-data/385386)
**Author:** [@briandoesdev](https://discuss.elastic.co/u/briandoesdev)\ **Replies:** 2\ **Last updated:** [March 10, 2026, 1:35pm UTC](https://discuss.elastic.co/t/syslog-parser-fails-on-double-backslashes-in-structured-data/385386 "2026-03-10T13:35:19Z")
Hello everyone, My org is using the Custom UDP Logs integration to ingest RFC 5424 syslog messages from several network appliances. One of the appliances includes structured data with a parameter value containing a doub… --- ## [NodeJS FIPS enablement in Kibana](https://discuss.elastic.co/t/nodejs-fips-enablement-in-kibana/385384)
**Author:** [@Reviving9721](https://discuss.elastic.co/u/Reviving9721)\ **Replies:** 1\ **Last updated:** [March 9, 2026, 8:53pm UTC](https://discuss.elastic.co/t/nodejs-fips-enablement-in-kibana/385384 "2026-03-09T20:53:41Z")
The provided instructions from FIPS compliance for Kibana | Elastic Docs specify that this is a requirement: Delegating the implementation of these cryptographic algorithms to a NIST validated cryptographic module (ava… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=14) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=16)