# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=16 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 17 --- ## [Dynamic template mapping overridden by automatic \`dense\_vector\` inference for float arrays](https://discuss.elastic.co/t/dynamic-template-mapping-overridden-by-automatic-dense-vector-inference-for-float-arrays/385359)
**Author:** [@giga811](https://discuss.elastic.co/u/giga811)\ **Replies:** 3\ **Last updated:** [March 7, 2026, 6:16am UTC](https://discuss.elastic.co/t/dynamic-template-mapping-overridden-by-automatic-dense-vector-inference-for-float-arrays/385359 "2026-03-07T06:16:54Z")
I encountered a situation where a dynamic template specifying a field as float is overridden by automatic dense\_vector mapping when indexing a long float array in Elasticsearch. My intention is to store embeddings as a … --- ## [OpenTelemetry Integration on AirGapped Environment](https://discuss.elastic.co/t/opentelemetry-integration-on-airgapped-environment/385042)
**Author:** [@gbschenkel](https://discuss.elastic.co/u/gbschenkel)\ **Replies:** 4\ **Last updated:** [March 6, 2026, 2:11pm UTC](https://discuss.elastic.co/t/opentelemetry-integration-on-airgapped-environment/385042 "2026-03-06T14:11:27Z")
Hi, we have two ELK clusters, one for production and other for monitoring. The cluster don’t have access to internet, so is an AirGapped environment, the Elastic Artifacts are being rerouted using Sonatype Nexus Reposit… --- ## [Lots of shards relocating post restore](https://discuss.elastic.co/t/lots-of-shards-relocating-post-restore/385356)
**Author:** [@ch4zzych4zz](https://discuss.elastic.co/u/ch4zzych4zz)\ **Replies:** 6\ **Last updated:** [March 6, 2026, 2:00pm UTC](https://discuss.elastic.co/t/lots-of-shards-relocating-post-restore/385356 "2026-03-06T14:00:37Z")
Hi, I’m struggling to repetitively backup and restore efficiently indices between two independent ES clusters as this is causing a lot of shards rebalancing. The setup is as follows: ES 8.19 cluster composed of 11 no… --- ## [How to limit bandwidth usage of Windows Filebeat](https://discuss.elastic.co/t/how-to-limit-bandwidth-usage-of-windows-filebeat/385357)
**Author:** [@waitspring](https://discuss.elastic.co/u/waitspring)\ **Replies:** 1\ **Last updated:** [March 6, 2026, 6:18am UTC](https://discuss.elastic.co/t/how-to-limit-bandwidth-usage-of-windows-filebeat/385357 "2026-03-06T06:18:36Z")
Hello, every big brothers: I installed Filebeat in Windows Server 2012, and make Filebeat send log data to Kafka. I want to limit Filebeat’s bandwidth usage in 50Kbit, because my Windows Server 2012 only has 2Mbit band… --- ## [POST /\_fleet/maintenance/cleanup?](https://discuss.elastic.co/t/post-fleet-maintenance-cleanup/385355)
**Author:** [@Juan\_de\_Dios\_Macias1](https://discuss.elastic.co/u/Juan_de_Dios_Macias1)\ **Replies:** 1\ **Last updated:** [March 6, 2026, 4:48am UTC](https://discuss.elastic.co/t/post-fleet-maintenance-cleanup/385355 "2026-03-06T04:48:58Z")
Hi, I have a cluster with a single node where I’m seeing some indices that I can’t delete because Elasticsearch tells me that my elastic user needs superuser permissions. I found the API request POST /\_fleet/maintenance/… --- ## [\[elastic-agent\]\[beats\] Problem when running as a non-root randomized UID](https://discuss.elastic.co/t/elastic-agent-beats-problem-when-running-as-a-non-root-randomized-uid/385353)
**Author:** [@AlexBaranowski](https://discuss.elastic.co/u/AlexBaranowski)\ **Replies:** 0\ **Last updated:** [March 5, 2026, 3:38pm UTC](https://discuss.elastic.co/t/elastic-agent-beats-problem-when-running-as-a-non-root-randomized-uid/385353 "2026-03-05T15:38:18Z")
The OpenShift environment has a security policy that requires containers to run with a randomized UID. This causes issues when running the Elastic Agent. Typically, a standard solution is to ensure the user belongs to gr… --- ## [It looks like winlogbeat (8.19.10) is showing noisy warn logs again](https://discuss.elastic.co/t/it-looks-like-winlogbeat-8-19-10-is-showing-noisy-warn-logs-again/385125)
**Author:** [@Alyssa\_Nunez](https://discuss.elastic.co/u/Alyssa_Nunez)\ **Replies:** 4\ **Last updated:** [March 5, 2026, 2:19pm UTC](https://discuss.elastic.co/t/it-looks-like-winlogbeat-8-19-10-is-showing-noisy-warn-logs-again/385125 "2026-03-05T14:19:59Z")
Hi, I was going over some logs for an incident and noticed that a lot of logs we’re seeing are similar to the ones report here: Channel not found would be suppressed ( \[Winlogbeat\] Suppress excessive channel not found w… --- ## [container input: CRI partial line reassembly ignores max\_bytes, causing OOM](https://discuss.elastic.co/t/container-input-cri-partial-line-reassembly-ignores-max-bytes-causing-oom/385340)
**Author:** [@raychinov](https://discuss.elastic.co/u/raychinov)\ **Replies:** 1\ **Last updated:** [March 5, 2026, 2:15pm UTC](https://discuss.elastic.co/t/container-input-cri-partial-line-reassembly-ignores-max-bytes-causing-oom/385340 "2026-03-05T14:15:36Z")
Filebeat version 8.19.12 Operating system and version Linux (Kubernetes with containerd runtime) Description of the problem including expected versus actual behavior When a container log contains many consecutive CRI p… --- ## [Logstash/Filebeat lag issue - Logs delayed by hours](https://discuss.elastic.co/t/logstash-filebeat-lag-issue-logs-delayed-by-hours/385101)
**Author:** [@Cesar\_Mejia](https://discuss.elastic.co/u/Cesar_Mejia)\ **Replies:** 45\ **Last updated:** [March 5, 2026, 1:02pm UTC](https://discuss.elastic.co/t/logstash-filebeat-lag-issue-logs-delayed-by-hours/385101 "2026-03-05T13:02:46Z")
Hello Elastic Community, I am experiencing a significant lag in log ingestion where logs are arriving with a variable delay (sometimes hours late) despite having a high-performance environment. I would appreciate your a… --- ## [Parent data too large?](https://discuss.elastic.co/t/parent-data-too-large/385254)
**Author:** [@linkerc](https://discuss.elastic.co/u/linkerc)\ **Replies:** 12\ **Last updated:** [March 5, 2026, 10:21am UTC](https://discuss.elastic.co/t/parent-data-too-large/385254 "2026-03-05T10:21:45Z")
I am getting the below error on a shard assignment. org.elasticsearch.common.breaker.CircuitBreakingException: \[parent\] Data too large, data for \[internal:index/shard/recovery/translog\_ops\] would be \[28701173408/26.7gb\]… --- ## [Troubleshooting performance and load](https://discuss.elastic.co/t/troubleshooting-performance-and-load/385292)
**Author:** [@Whoami1980](https://discuss.elastic.co/u/Whoami1980)\ **Replies:** 16\ **Last updated:** [March 5, 2026, 7:23am UTC](https://discuss.elastic.co/t/troubleshooting-performance-and-load/385292 "2026-03-05T07:23:57Z")
Is there a centralise repository or knowledge base that we can start for general troubelshooting. For scenrios not limiting to below. Elastic fleet server Health Check. What are the things to watch out for? Overlo… --- ## [Trial extension request for Elastic ML features on on-premises](https://discuss.elastic.co/t/trial-extension-request-for-elastic-ml-features-on-on-premises/385128)
**Author:** [@abel1](https://discuss.elastic.co/u/abel1)\ **Replies:** 1\ **Last updated:** [March 5, 2026, 5:16am UTC](https://discuss.elastic.co/t/trial-extension-request-for-elastic-ml-features-on-on-premises/385128 "2026-03-05T05:16:38Z")
Hello, I previously submitted a request to extend my Elastic trial license for 30 days to test Machine Learning features on my self-managed (on-premises) setup. I haven’t received a response yet and would appreciate … --- ## [Setting up self managed ELK stack with TLS/HTTPS issue](https://discuss.elastic.co/t/setting-up-self-managed-elk-stack-with-tls-https-issue/385102)
**Author:** [@BenNCSU](https://discuss.elastic.co/u/BenNCSU)\ **Replies:** 11\ **Last updated:** [March 5, 2026, 2:16am UTC](https://discuss.elastic.co/t/setting-up-self-managed-elk-stack-with-tls-https-issue/385102 "2026-03-05T02:16:44Z")
I’m trying to set up an ELK stack for SIEM doing a standard install. I installed Elasticsearch and Kibana, which worked fine using HTTP, but when I tried to set up TLS using a self-signed certificate from our CA, I can’… --- ## [Why does /var/log/logstash\_flow\_stats.log appear by default in RPM installation?](https://discuss.elastic.co/t/why-does-var-log-logstash-flow-stats-log-appear-by-default-in-rpm-installation/385321)
**Author:** [@kuroro](https://discuss.elastic.co/u/kuroro)\ **Replies:** 1\ **Last updated:** [March 5, 2026, 2:16am UTC](https://discuss.elastic.co/t/why-does-var-log-logstash-flow-stats-log-appear-by-default-in-rpm-installation/385321 "2026-03-05T02:16:31Z")
Hi everyone, I’m running Logstash 8.17.6 installed via RPM, with Stack Monitoring enabled (xpack.monitoring.enabled: true). I noticed that a file named: /var/log/logstash\_flow\_stats.log is created automatically. Base… --- ## [Filebeat - duplicated logs when using journald Input with systemd units](https://discuss.elastic.co/t/filebeat-duplicated-logs-when-using-journald-input-with-systemd-units/385347)
**Author:** [@maxp1](https://discuss.elastic.co/u/maxp1)\ **Replies:** 1\ **Last updated:** [March 5, 2026, 12:15am UTC](https://discuss.elastic.co/t/filebeat-duplicated-logs-when-using-journald-input-with-systemd-units/385347 "2026-03-05T00:15:46Z")
Hello, I've encountered an issue while using the journald input in Filebeat, specifically when specifying individual systemd units. Instead of separating logs based on the systemd unit, Filebeat seems to be processing th… --- ## [Same \_id ends up duplicated across rollover indices behind a write alias — can this be prevented via template/ILM?](https://discuss.elastic.co/t/same-id-ends-up-duplicated-across-rollover-indices-behind-a-write-alias-can-this-be-prevented-via-template-ilm/385348)
**Author:** [@juan\_ma\_tejada](https://discuss.elastic.co/u/juan_ma_tejada)\ **Replies:** 1\ **Last updated:** [March 4, 2026, 7:34pm UTC](https://discuss.elastic.co/t/same-id-ends-up-duplicated-across-rollover-indices-behind-a-write-alias-can-this-be-prevented-via-template-ilm/385348 "2026-03-04T19:34:01Z")
Hi all, I’m indexing documents into Elasticsearch using a deterministic \_id (SHA1 of email + normalized\_context). I write to an alias that uses ILM rollover, so over time it creates backing indices like: data-000073 … --- ## [Dashboard anomaly score is not what we wanted](https://discuss.elastic.co/t/dashboard-anomaly-score-is-not-what-we-wanted/385336)
**Author:** [@Whoami1980](https://discuss.elastic.co/u/Whoami1980)\ **Replies:** 1\ **Last updated:** [March 4, 2026, 5:38pm UTC](https://discuss.elastic.co/t/dashboard-anomaly-score-is-not-what-we-wanted/385336 "2026-03-04T17:38:49Z")
We create a dashboard which return a single column to show actual, typical, anomaly score Apparently, the actual is the highest(actual) the typical is the highest(typical) The anomaly score is calculated based on the t… --- ## [Anomoly detection jobs. latest timestamp is updating but more than 2 months back](https://discuss.elastic.co/t/anomoly-detection-jobs-latest-timestamp-is-updating-but-more-than-2-months-back/385311)
**Author:** [@Whoami1980](https://discuss.elastic.co/u/Whoami1980)\ **Replies:** 3\ **Last updated:** [March 4, 2026, 5:15pm UTC](https://discuss.elastic.co/t/anomoly-detection-jobs-latest-timestamp-is-updating-but-more-than-2-months-back/385311 "2026-03-04T17:15:09Z")
Being a newbie to ML. Can anyone advice where I should start troubleshooting? job-name:noise-reduction-system-metrics-consolidated job state: opened. memory status: ok. latest timestamp is updating but more than 2 mo… --- ## [Can I use ESQL Lookup Join to match fields with different names?](https://discuss.elastic.co/t/can-i-use-esql-lookup-join-to-match-fields-with-different-names/385324)
**Author:** [@TSlump](https://discuss.elastic.co/u/TSlump)\ **Replies:** 7\ **Last updated:** [March 4, 2026, 1:33pm UTC](https://discuss.elastic.co/t/can-i-use-esql-lookup-join-to-match-fields-with-different-names/385324 "2026-03-04T13:33:03Z")
Hi, I have two indices with matching fields that I want to use for an ESQL Lookup Join, however, the fields in each index have different names. Am I still able to use a lookup join? As an example, I have a ‘customers’ … --- ## [Tragic failure of primary marks all replica failed](https://discuss.elastic.co/t/tragic-failure-of-primary-marks-all-replica-failed/385277)
**Author:** [@xuanyuan300](https://discuss.elastic.co/u/xuanyuan300)\ **Replies:** 5\ **Last updated:** [March 4, 2026, 12:28am UTC](https://discuss.elastic.co/t/tragic-failure-of-primary-marks-all-replica-failed/385277 "2026-03-04T00:28:52Z")
Hi team We recently encountered the same problem Index with multiple replicas turned red when node with primary went down . Are there any plans to fix it? --- ## [How to apply ILM to ML indices? If not possible what,s the workaround?](https://discuss.elastic.co/t/how-to-apply-ilm-to-ml-indices-if-not-possible-what-s-the-workaround/385310)
**Author:** [@Whoami1980](https://discuss.elastic.co/u/Whoami1980)\ **Replies:** 1\ **Last updated:** [March 3, 2026, 7:31pm UTC](https://discuss.elastic.co/t/how-to-apply-ilm-to-ml-indices-if-not-possible-what-s-the-workaround/385310 "2026-03-03T19:31:37Z")
Understand that ILM cannot be used on ML results indices. ILM is used on the ML state index out-of-the-box. Seems like this is a long open enhancement. \[ML\] Add an ML results index rollover endpoint · Issue #29946 · el… --- ## [How to Access Data About Dashboard Activity](https://discuss.elastic.co/t/how-to-access-data-about-dashboard-activity/385308)
**Author:** [@ArielC](https://discuss.elastic.co/u/ArielC)\ **Replies:** 4\ **Last updated:** [March 3, 2026, 5:05pm UTC](https://discuss.elastic.co/t/how-to-access-data-about-dashboard-activity/385308 "2026-03-03T17:05:33Z")
The dashboard menu now displays dashboard activity, under actions: How can I access this data to make other visualizations? For example, I would like to make a table showing how many views each dashboard has had in … --- ## [Elastic Agent to Logstash](https://discuss.elastic.co/t/elastic-agent-to-logstash/385314)
**Author:** [@arav](https://discuss.elastic.co/u/arav)\ **Replies:** 3\ **Last updated:** [March 3, 2026, 1:14pm UTC](https://discuss.elastic.co/t/elastic-agent-to-logstash/385314 "2026-03-03T13:14:30Z")
I cant send the elastic agent to logstash I have the logstash listed in Fleet → Settings While creating a policy, while selecting output for integration, the logstash option is available but not clickable --- ## [Question about certificates and auto-generating configuration](https://discuss.elastic.co/t/question-about-certificates-and-auto-generating-configuration/385318)
**Author:** [@hairless\_mess](https://discuss.elastic.co/u/hairless_mess)\ **Replies:** 0\ **Last updated:** [March 3, 2026, 9:59am UTC](https://discuss.elastic.co/t/question-about-certificates-and-auto-generating-configuration/385318 "2026-03-03T09:59:36Z")
Hello everyone! I have some questions regarding the certificates used when deploying elasticsearch. Elasticsearch auto generates certificates for http and transport which work out of the box, however from my understand… --- ## [Crowdstrike Integration Degraded](https://discuss.elastic.co/t/crowdstrike-integration-degraded/385312)
**Author:** [@4l13v](https://discuss.elastic.co/u/4l13v)\ **Replies:** 0\ **Last updated:** [March 3, 2026, 8:27am UTC](https://discuss.elastic.co/t/crowdstrike-integration-degraded/385312 "2026-03-03T08:27:00Z")
I have integrated Crowdstrike to Fleet Successfully, It maintains almost 1 month successfully. But due today I got an error. What is the exact issue here --- ## [Does "Serverless" mean it cant be used on self hosted intances?](https://discuss.elastic.co/t/does-serverless-mean-it-cant-be-used-on-self-hosted-intances/385267)
**Author:** [@ItsMeBrille](https://discuss.elastic.co/u/ItsMeBrille)\ **Replies:** 11\ **Last updated:** [March 2, 2026, 7:38pm UTC](https://discuss.elastic.co/t/does-serverless-mean-it-cant-be-used-on-self-hosted-intances/385267 "2026-03-02T19:38:56Z")
Does the "Serverless" tag mean I can’t use those services on self hosted intances? I want to connect to the MCP endpoint /api/agent\_builder/mcp, but it says the docs have the “tag” Serverless. Does this mean I cannot … --- ## [Elasticsearch 8.12.2 Connector Weekly scheduling never triggers sync job](https://discuss.elastic.co/t/elasticsearch-8-12-2-connector-weekly-scheduling-never-triggers-sync-job/385214)
**Author:** [@apostolos.e](https://discuss.elastic.co/u/apostolos.e)\ **Replies:** 3\ **Last updated:** [March 2, 2026, 3:40pm UTC](https://discuss.elastic.co/t/elasticsearch-8-12-2-connector-weekly-scheduling-never-triggers-sync-job/385214 "2026-03-02T15:40:44Z")
Hi all, I am using ELK 8.12.2 along with Elastic PostgreSQL connector 8.12.2. Both have been setup/self-installed on premises. When configuring the connector to get executed on a Weekly schedule, sync jobs do not get c… --- ## [Need an explanation for the Kibana Licensing](https://discuss.elastic.co/t/need-an-explanation-for-the-kibana-licensing/385300)
**Author:** [@ItsMeBrille](https://discuss.elastic.co/u/ItsMeBrille)\ **Replies:** 1\ **Last updated:** [March 2, 2026, 2:59pm UTC](https://discuss.elastic.co/t/need-an-explanation-for-the-kibana-licensing/385300 "2026-03-02T14:59:35Z")
I read this: License settings | Reference but there are some things I dont understand. This issue says it is only for elasticsearch: Unable to configure xpack license setting via ENV vars · Issue #78 · elastic/kibana-do… --- ## [Multiple clusters on EKS](https://discuss.elastic.co/t/multiple-clusters-on-eks/381519)
**Author:** [@searchwithme](https://discuss.elastic.co/u/searchwithme)\ **Replies:** 1\ **Last updated:** [March 1, 2026, 9:36pm UTC](https://discuss.elastic.co/t/multiple-clusters-on-eks/381519 "2026-03-01T21:36:15Z")
Does this mean I can spin up multiple elasticsearch clusters on the same EKS? If that is the case, can I use 1 ERU (64 GB RAM) across 2 clusters if they are under 32 GB RAM each? Also, I do not see any documentation … --- ## [Who has access to which dashboard with what permission?](https://discuss.elastic.co/t/who-has-access-to-which-dashboard-with-what-permission/385260)
**Author:** [@Whoami1980](https://discuss.elastic.co/u/Whoami1980)\ **Replies:** 3\ **Last updated:** [March 1, 2026, 3:05am UTC](https://discuss.elastic.co/t/who-has-access-to-which-dashboard-with-what-permission/385260 "2026-03-01T03:05:58Z")
Along our design and build phase. We have created many users and grant many permission to many dashboard. We would like to clean up our environment to know who have what access or roles? Anyone can advice where to start … [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=15) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=17)