# Elastic Stack

**URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=165

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 166

---

## [Elasticsearch pricing for POCs?](https://discuss.elastic.co/t/elasticsearch-pricing-for-pocs/366997)

<div class="topic-metadata">

**Author:** [@catmanjan](https://discuss.elastic.co/u/catmanjan)\
**Replies:** 3\
**Last updated:** [September 24, 2024, 4:08am UTC](https://discuss.elastic.co/t/elasticsearch-pricing-for-pocs/366997 "2024-09-24T04:08:00Z")

</div>

Hello we want to offer some POCs of our service which uses Elasticsearch SaaS for document indexing - the problem is the pricing. These POCs are fixed price and the customer commits to only indexing a known quantity of …

---

## [Metricbeat (SQL Module) connection issue to MS SQL](https://discuss.elastic.co/t/metricbeat-sql-module-connection-issue-to-ms-sql/366947)

<div class="topic-metadata">

**Author:** [@jhl0129](https://discuss.elastic.co/u/jhl0129)\
**Replies:** 0\
**Last updated:** [September 23, 2024, 9:19am UTC](https://discuss.elastic.co/t/metricbeat-sql-module-connection-issue-to-ms-sql/366947 "2024-09-23T09:19:17Z")

</div>

Hi Team, We're trying to use metricbeat sql module to run custom query on MS SQL. To connect to MS SQL using a domain account, what should we put in the "hosts" portion of sql.yml? We've tried the following but can't …

---

## [Unable to start logstash](https://discuss.elastic.co/t/unable-to-start-logstash/366705)

<div class="topic-metadata">

**Author:** [@Mike\_Reprogle](https://discuss.elastic.co/u/Mike_Reprogle)\
**Replies:** 4\
**Last updated:** [September 24, 2024, 2:35am UTC](https://discuss.elastic.co/t/unable-to-start-logstash/366705 "2024-09-24T02:35:24Z")

</div>

I have seen many other posts that seem similar, but come down to not having a config file set. I have a couple of .conf files located in /etc/logstash/conf.d, as I am trying to set up an Azure VM with logstash for SaaS l…

---

## [Fatal exception while booting Elasticsearch | Missing secret key for s3 client](https://discuss.elastic.co/t/fatal-exception-while-booting-elasticsearch-missing-secret-key-for-s3-client/366857)

<div class="topic-metadata">

**Author:** [@ACoder](https://discuss.elastic.co/u/ACoder)\
**Replies:** 1\
**Last updated:** [September 23, 2024, 7:08pm UTC](https://discuss.elastic.co/t/fatal-exception-while-booting-elasticsearch-missing-secret-key-for-s3-client/366857 "2024-09-23T19:08:12Z")

</div>

I run it as a docker container in swarm environment. The error I got: stamp":"2024-09-20T07:03:20.868Z", "log.level":"ERROR", "message":"fatal exception while booting Elasticsearch", "ecs.version": "1.2.0","service.name…

---

## [8.14.0 Migration : Unknown field 'preserve\_original'](https://discuss.elastic.co/t/8-14-0-migration-unknown-field-preserve-original/366975)

<div class="topic-metadata">

**Author:** [@John.Doe](https://discuss.elastic.co/u/John.Doe)\
**Replies:** 2\
**Last updated:** [September 23, 2024, 5:21pm UTC](https://discuss.elastic.co/t/8-14-0-migration-unknown-field-preserve-original/366975 "2024-09-23T17:21:31Z")

</div>

Hi, I am trying to migrate to version 8.14.0. In my filter mapping, I have the following filter : "leadingZeroTrim": { "type": "pattern\_replace", "preserve\_original": "true", "pattern": "^0+(.\*)", "replacemen…

---

## [Logstash does not appear in Elastic Monitoring - fleet provisioned agent](https://discuss.elastic.co/t/logstash-does-not-appear-in-elastic-monitoring-fleet-provisioned-agent/366795)

<div class="topic-metadata">

**Author:** [@neoaddix](https://discuss.elastic.co/u/neoaddix)\
**Replies:** 6\
**Last updated:** [September 23, 2024, 5:16pm UTC](https://discuss.elastic.co/t/logstash-does-not-appear-in-elastic-monitoring-fleet-provisioned-agent/366795 "2024-09-23T17:16:43Z")

</div>

We have a fleet provisioned agent, installed it on our logstash server, however logstash does not appear in the monitoring dashboard. We do seem to have logging and metrics data in: logstash.stack\_monitoring.node\_stats…

---

## [Kibana cannot connect to browser](https://discuss.elastic.co/t/kibana-cannot-connect-to-browser/366984)

<div class="topic-metadata">

**Author:** [@edemseg](https://discuss.elastic.co/u/edemseg)\
**Replies:** 1\
**Last updated:** [September 23, 2024, 4:59pm UTC](https://discuss.elastic.co/t/kibana-cannot-connect-to-browser/366984 "2024-09-23T16:59:06Z")

</div>

I am new to kibana and trying to setup ELK on ubuntu server 24.04.1 Elasticsearch works fine but Kibana wont open in browser. 192.168.25.80:5601 # Kibana is served by a back end server. This setting specifies the port…

---

## [Downgrade from es version 8.15.0 to 8.13.4](https://discuss.elastic.co/t/downgrade-from-es-version-8-15-0-to-8-13-4/366905)

<div class="topic-metadata">

**Author:** [@hamedheidarian](https://discuss.elastic.co/u/hamedheidarian)\
**Replies:** 7\
**Last updated:** [September 23, 2024, 4:36pm UTC](https://discuss.elastic.co/t/downgrade-from-es-version-8-15-0-to-8-13-4/366905 "2024-09-23T16:36:43Z")

</div>

Hi, Is there any possibility for doing such downgrade without data loss? I have seen this topic and this one before. but I don't have a snapshot before the 8.15.0 version and tried snapshot of 8.15.0 on elastic cluster …

---

## [How to duration between two status changes?](https://discuss.elastic.co/t/how-to-duration-between-two-status-changes/366895)

<div class="topic-metadata">

**Author:** [@vincenty79](https://discuss.elastic.co/u/vincenty79)\
**Replies:** 2\
**Last updated:** [September 23, 2024, 4:17pm UTC](https://discuss.elastic.co/t/how-to-duration-between-two-status-changes/366895 "2024-09-23T16:17:01Z")

</div>

I'm wondering how I would get the duration how long something ran? For example the time when the hvac ran the ac (cooling) and when it stopped (idle). My goal is to keep them and eventually have weekly, monthly and seaso…

---

## [APM Trace is not capturing complete request](https://discuss.elastic.co/t/apm-trace-is-not-capturing-complete-request/366978)

<div class="topic-metadata">

**Author:** [@akash\_bg](https://discuss.elastic.co/u/akash_bg)\
**Replies:** 0\
**Last updated:** [September 23, 2024, 3:51pm UTC](https://discuss.elastic.co/t/apm-trace-is-not-capturing-complete-request/366978 "2024-09-23T15:51:15Z")

</div>

Hi, I have an issue in APM Traces for java-based applications. The elastic Java APM agent is not capturing the complete transaction. Its has captured only the root request. How can I enable it to capture complete trace …

---

## [Hybrid Search high score on irrelevant documents](https://discuss.elastic.co/t/hybrid-search-high-score-on-irrelevant-documents/366519)

<div class="topic-metadata">

**Author:** [@mg3090](https://discuss.elastic.co/u/mg3090)\
**Replies:** 9\
**Last updated:** [September 23, 2024, 3:43pm UTC](https://discuss.elastic.co/t/hybrid-search-high-score-on-irrelevant-documents/366519 "2024-09-23T15:43:15Z")

</div>

Hello, i am building a RAG and i am facing a problem with the \_score returned in the Hybrid Query that uses KNN. Or at least, i am not fully understanding how it works. My elastic contains only economy related document…

---

## [Filebeat exiting](https://discuss.elastic.co/t/filebeat-exiting/366845)

<div class="topic-metadata">

**Author:** [@BINDUN26](https://discuss.elastic.co/u/BINDUN26)\
**Replies:** 1\
**Last updated:** [September 23, 2024, 3:33pm UTC](https://discuss.elastic.co/t/filebeat-exiting/366845 "2024-09-23T15:33:18Z")

</div>

filebeat.service - LSB: Filebeat sends log files to Logstash or directly to Elasticsearch. Loaded: loaded (/etc/init.d/filebeat; generated) Active: active (exited) since Fri 2024-09-20 08:48:04 IST; 13s ago Docs: man:…

---

## [Hit.sort() method contract cnanges](https://discuss.elastic.co/t/hit-sort-method-contract-cnanges/366686)

<div class="topic-metadata">

**Author:** [@surkovoleg2010](https://discuss.elastic.co/u/surkovoleg2010)\
**Replies:** 1\
**Last updated:** [September 23, 2024, 3:31pm UTC](https://discuss.elastic.co/t/hit-sort-method-contract-cnanges/366686 "2024-09-23T15:31:19Z")

</div>

Hello, we use elasticsearch-java client version 8.4.3. after upgrading to 8.13.4 we found that the contract for Hit.sort method changed (returns List\<FieldValue\> instead of List\<String\>). could you suggest please how to…

---

## [Unauthorized User Error and Script Execution Issues During Kibana Setup with Elasticsearch 7.17.13](https://discuss.elastic.co/t/unauthorized-user-error-and-script-execution-issues-during-kibana-setup-with-elasticsearch-7-17-13/366971)

<div class="topic-metadata">

**Author:** [@kshanuy](https://discuss.elastic.co/u/kshanuy)\
**Replies:** 0\
**Last updated:** [September 23, 2024, 3:03pm UTC](https://discuss.elastic.co/t/unauthorized-user-error-and-script-execution-issues-during-kibana-setup-with-elasticsearch-7-17-13/366971 "2024-09-23T15:03:16Z")

</div>

I am encountering multiple errors while setting up Kibana with Elasticsearch version 7.17.13. The primary issues are: Unauthorized User error with the fleet plugin, indicating a failure in setting up central management…

---

## [How to combine KNN and query\_string search](https://discuss.elastic.co/t/how-to-combine-knn-and-query-string-search/366868)

<div class="topic-metadata">

**Author:** [@ivanqwam](https://discuss.elastic.co/u/ivanqwam)\
**Replies:** 5\
**Last updated:** [September 23, 2024, 2:05pm UTC](https://discuss.elastic.co/t/how-to-combine-knn-and-query-string-search/366868 "2024-09-23T14:05:11Z")

</div>

I am trying to combine both: KNN query Query\_string query When I search for a non existing ID with query\_string: POST myindex/\_search { "query": {"query\_string": {"default\_operator": "AND", "query": "id:\\"my\_wrong\_i…

---

## [Process two types of logs format](https://discuss.elastic.co/t/process-two-types-of-logs-format/366021)

<div class="topic-metadata">

**Author:** [@ELK\_enjoyer](https://discuss.elastic.co/u/ELK_enjoyer)\
**Replies:** 6\
**Last updated:** [September 23, 2024, 1:46pm UTC](https://discuss.elastic.co/t/process-two-types-of-logs-format/366021 "2024-09-23T13:46:13Z")

</div>

Hi everyone! I'm using the ELK stack with Kafka to collect and analyze logs from my K8s environment. We have different log formats, mainly plaintext and JSON. How can I process them in Logstash properly? Right now, p…

---

## [Elastic cloud and Java garbage collector](https://discuss.elastic.co/t/elastic-cloud-and-java-garbage-collector/366962)

<div class="topic-metadata">

**Author:** [@Joey\_Visbeen](https://discuss.elastic.co/u/Joey_Visbeen)\
**Replies:** 0\
**Last updated:** [September 23, 2024, 12:57pm UTC](https://discuss.elastic.co/t/elastic-cloud-and-java-garbage-collector/366962 "2024-09-23T12:57:22Z")

</div>

Currently, I have a hosted deployment on the elastic cloud. Within this cluster, I store all the elastic cloud logs in a datastream. Now, I have run into the issue that there is too much garbage collector logs. I would l…

---

## [Configure visualization from dashboard](https://discuss.elastic.co/t/configure-visualization-from-dashboard/365444)

<div class="topic-metadata">

**Author:** [@cjessing](https://discuss.elastic.co/u/cjessing)\
**Replies:** 3\
**Last updated:** [September 23, 2024, 12:23pm UTC](https://discuss.elastic.co/t/configure-visualization-from-dashboard/365444 "2024-09-23T12:23:15Z")

</div>

I have finally managed to get my first visualization working using Vega Lite. Let's call it "host information". However it consists of 3 different queries, each based on the same value (hostname). What I would like is t…

---

## [Logstash output Elastic App Search plugin](https://discuss.elastic.co/t/logstash-output-elastic-app-search-plugin/366884)

<div class="topic-metadata">

**Author:** [@Sanjay\_Samanaboina](https://discuss.elastic.co/u/Sanjay_Samanaboina)\
**Replies:** 0\
**Last updated:** [September 20, 2024, 2:43pm UTC](https://discuss.elastic.co/t/logstash-output-elastic-app-search-plugin/366884 "2024-09-20T14:43:00Z")

</div>

Hi, We have an application which reads emails and store it in Elastic Search using App search Engine where it is working previously with 7.17 Logstash version which is unable to connect to App search with newer versions…

---

## [Copying an image saved to a panel in a dashboard to another space](https://discuss.elastic.co/t/copying-an-image-saved-to-a-panel-in-a-dashboard-to-another-space/366561)

<div class="topic-metadata">

**Author:** [@Hank\_Teran](https://discuss.elastic.co/u/Hank_Teran)\
**Replies:** 1\
**Last updated:** [September 23, 2024, 11:58am UTC](https://discuss.elastic.co/t/copying-an-image-saved-to-a-panel-in-a-dashboard-to-another-space/366561 "2024-09-23T11:58:15Z")

</div>

I am trying to copy an image file (png) that is in a panel in one dashboard to another kibana space. it keeps throwing 404 errors for the panels with an image in them when i copy the saved object

---

## [ELK cluster 5 data 1 master 1 ingest 1 transfer](https://discuss.elastic.co/t/elk-cluster-5-data-1-master-1-ingest-1-transfer/366958)

<div class="topic-metadata">

**Author:** [@sloth\_ape](https://discuss.elastic.co/u/sloth_ape)\
**Replies:** 0\
**Last updated:** [September 23, 2024, 11:40am UTC](https://discuss.elastic.co/t/elk-cluster-5-data-1-master-1-ingest-1-transfer/366958 "2024-09-23T11:40:30Z")

</div>

Hi guys i want to create ELK cluster with 5 data 1 master 1 ingest and 1 transfer i started installing to the all node elasticsearch and i wanna create cluster with enrollment token but i have problem to creating enro…

---

## [Services Not Individually Recognized in Service Map for VS Code Extension Instrumentation](https://discuss.elastic.co/t/services-not-individually-recognized-in-service-map-for-vs-code-extension-instrumentation/366957)

<div class="topic-metadata">

**Author:** [@Harshul](https://discuss.elastic.co/u/Harshul)\
**Replies:** 0\
**Last updated:** [September 23, 2024, 11:39am UTC](https://discuss.elastic.co/t/services-not-individually-recognized-in-service-map-for-vs-code-extension-instrumentation/366957 "2024-09-23T11:39:25Z")

</div>

We are working with a VS Code extension that contains React components, unlike a conventional React app hosted in a web browser. We are using OpenTelemetry for instrumentation and feeding data into ELK (Elastic Observabi…

---

## [How to add/remove the global filter on canvas dashboard](https://discuss.elastic.co/t/how-to-add-remove-the-global-filter-on-canvas-dashboard/366944)

<div class="topic-metadata">

**Author:** [@vijay117](https://discuss.elastic.co/u/vijay117)\
**Replies:** 3\
**Last updated:** [September 23, 2024, 11:15am UTC](https://discuss.elastic.co/t/how-to-add-remove-the-global-filter-on-canvas-dashboard/366944 "2024-09-23T11:15:17Z")

</div>

I have a dashboard currently filtered with global value along with timefilter, can some please help me how to remove that global filter, attached screen shot

---

## [Discrepancy in Shard and Index Count in Cluster Stats](https://discuss.elastic.co/t/discrepancy-in-shard-and-index-count-in-cluster-stats/366953)

<div class="topic-metadata">

**Author:** [@Wajid\_Hussain](https://discuss.elastic.co/u/Wajid_Hussain)\
**Replies:** 0\
**Last updated:** [September 23, 2024, 10:30am UTC](https://discuss.elastic.co/t/discrepancy-in-shard-and-index-count-in-cluster-stats/366953 "2024-09-23T10:30:34Z")

</div>

Hi, I’m noticing a discrepancy in the cluster stats on my Elastic Cloud deployment. When running GET /\_cluster/stats?pretty, it shows 122 indices and shards, despite having only 6 primary indices and shards. Could some…

---

## [Unable to login to Kibana -- 401 error](https://discuss.elastic.co/t/unable-to-login-to-kibana-401-error/366938)

<div class="topic-metadata">

**Author:** [@dinakar](https://discuss.elastic.co/u/dinakar)\
**Replies:** 2\
**Last updated:** [September 23, 2024, 9:45am UTC](https://discuss.elastic.co/t/unable-to-login-to-kibana-401-error/366938 "2024-09-23T09:45:20Z")

</div>

Hi Team, I'm facing the authentication issue on the kibana server when I'm trying to login with elastic user or Kibana user. Error getting: "We couldn't log you in. Please try again." Please find the whole setup and v…

---

## [Decrypted value not available in search box when sending hashed query](https://discuss.elastic.co/t/decrypted-value-not-available-in-search-box-when-sending-hashed-query/366945)

<div class="topic-metadata">

**Author:** [@Pankaj\_yadav](https://discuss.elastic.co/u/Pankaj_yadav)\
**Replies:** 0\
**Last updated:** [September 23, 2024, 9:08am UTC](https://discuss.elastic.co/t/decrypted-value-not-available-in-search-box-when-sending-hashed-query/366945 "2024-09-23T09:08:06Z")

</div>

I am encrypting the search query before sending user to results page , where user is not able to see the query in address bar(only encrypted field is visible), but before sending to Elasticsearch I decrypt the field and …

---

## [AWS API Intergration with Mulesoft](https://discuss.elastic.co/t/aws-api-intergration-with-mulesoft/366937)

<div class="topic-metadata">

**Author:** [@brother\_info](https://discuss.elastic.co/u/brother_info)\
**Replies:** 1\
**Last updated:** [September 23, 2024, 8:10am UTC](https://discuss.elastic.co/t/aws-api-intergration-with-mulesoft/366937 "2024-09-23T08:10:09Z")

</div>

I am trying to call my AWS API through mulesoft. My AWS API is perfectly working in browser and Postman. I have created HTTP listener and HTTP request in mulesoft but it is giving HTTP connectivity error. Does anyone h…

---

## [How to get http status code | Python](https://discuss.elastic.co/t/how-to-get-http-status-code-python/366915)

<div class="topic-metadata">

**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\
**Replies:** 2\
**Last updated:** [September 23, 2024, 7:22am UTC](https://discuss.elastic.co/t/how-to-get-http-status-code-python/366915 "2024-09-23T07:22:58Z")

</div>

Hi Team I want to get status code while connecting to cluster. from elasticsearch import Elasticsearch client = Elasticsearch( "https://0.0.0.0.:9200", basic\_auth=("elastic", "elastic"), verify\_certs=False…

---

## [Migrate from Standalone to Fleet Managed](https://discuss.elastic.co/t/migrate-from-standalone-to-fleet-managed/366934)

<div class="topic-metadata">

**Author:** [@kelvins](https://discuss.elastic.co/u/kelvins)\
**Replies:** 0\
**Last updated:** [September 23, 2024, 6:47am UTC](https://discuss.elastic.co/t/migrate-from-standalone-to-fleet-managed/366934 "2024-09-23T06:47:50Z")

</div>

I have an 8.15.1 cluster, with Fleet managing windows agents. However, the linux servers are installed with .deb elastic-agent packages. I hoped that there would be a guide for how one might move from standalone to fle…

---

## [Size of logs produced per agent](https://discuss.elastic.co/t/size-of-logs-produced-per-agent/366765)

<div class="topic-metadata">

**Author:** [@mike123](https://discuss.elastic.co/u/mike123)\
**Replies:** 3\
**Last updated:** [September 23, 2024, 6:43am UTC](https://discuss.elastic.co/t/size-of-logs-produced-per-agent/366765 "2024-09-23T06:43:56Z")

</div>

Is there any way to find size of logs (in bytes, MB, GB..) for each agent. I checked through the internet, could only find index size and log count.

[Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=164)

[Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=166)
