# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=17 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 18 --- ## [Ceph or LVM disk as ELK storage](https://discuss.elastic.co/t/ceph-or-lvm-disk-as-elk-storage/385279)
**Author:** [@marian.veverka](https://discuss.elastic.co/u/marian.veverka)\ **Replies:** 1\ **Last updated:** [February 28, 2026, 8:22am UTC](https://discuss.elastic.co/t/ceph-or-lvm-disk-as-elk-storage/385279 "2026-02-28T08:22:37Z")
Hello, I have ELK Stack: Nodes have 10G network. On disk for data is Ext4 filesystem and after several weeks have errors on filesystem on all disks. And my question is, is it possible due Ceph and LVM would be bette… --- ## [Syslogs are missing in Kibana](https://discuss.elastic.co/t/syslogs-are-missing-in-kibana/385209)
**Author:** [@pratiksha\_khalkar](https://discuss.elastic.co/u/pratiksha_khalkar)\ **Replies:** 1\ **Last updated:** [February 28, 2026, 6:20am UTC](https://discuss.elastic.co/t/syslogs-are-missing-in-kibana/385209 "2026-02-28T06:20:59Z")
Hi , I am forwarding syslogs from Entuity to ELK. However, in Kibana a few logs appear to be missing. For example, when I forward the same message 10 times from Entuity to ELK, Kibana shows only 8 or 9. Could you please… --- ## [UnHealthy agent](https://discuss.elastic.co/t/unhealthy-agent/385188)
**Author:** [@harry22](https://discuss.elastic.co/u/harry22)\ **Replies:** 3\ **Last updated:** [February 28, 2026, 5:20am UTC](https://discuss.elastic.co/t/unhealthy-agent/385188 "2026-02-28T05:20:36Z")
PS C:\\Program Files\\Elastic\\Agent\> .'.\\elastic-agent.exe' status ┌─ fleet │ └─ status: (STARTING) └─ elastic-agent ├─ status: (DEGRADED) 1 or more components/units in a degraded state └─ endpoint-default ├─ status… --- ## [Reading Auth Logs on Mac devices](https://discuss.elastic.co/t/reading-auth-logs-on-mac-devices/385269)
**Author:** [@HaydenB0101](https://discuss.elastic.co/u/HaydenB0101)\ **Replies:** 0\ **Last updated:** [February 27, 2026, 5:19pm UTC](https://discuss.elastic.co/t/reading-auth-logs-on-mac-devices/385269 "2026-02-27T17:19:30Z")
I want to get auth. logs from my mac devices and am struggling to find a working integration to use. I have been using the Custom macOS Unified Logs integration to try and get this data from the devices since it’s the o… --- ## [Kibana 9.1.5 behind Squid Proxy - Unable to get indices metadata configuration: AxiosError](https://discuss.elastic.co/t/kibana-9-1-5-behind-squid-proxy-unable-to-get-indices-metadata-configuration-axioserror/383302)
**Author:** [@dapster](https://discuss.elastic.co/u/dapster)\ **Replies:** 1\ **Last updated:** [February 27, 2026, 2:49pm UTC](https://discuss.elastic.co/t/kibana-9-1-5-behind-squid-proxy-unable-to-get-indices-metadata-configuration-axioserror/383302 "2026-02-27T14:49:58Z")
Hello, We are running an on-premises Elastic Stack (v9.1.5) on Ubuntu 24. Our Kibana nodes are configured to use an internal Squid proxy for all outbound traffic. We are seeing persistent errors in kibana.log from serv… --- ## ["Explore in Discover" produces very long URLs](https://discuss.elastic.co/t/explore-in-discover-produces-very-long-urls/385236)
**Author:** [@xcq1](https://discuss.elastic.co/u/xcq1)\ **Replies:** 2\ **Last updated:** [February 27, 2026, 1:15pm UTC](https://discuss.elastic.co/t/explore-in-discover-produces-very-long-urls/385236 "2026-02-27T13:15:54Z")
Hello there, I have a Lens Visualization using a table where I now want to look at the matching records in Discover in detail. So I try to click “Explore in Discover”, but that forwards me to a link with 11,000+ charact… --- ## [Metricbeats for podman containers](https://discuss.elastic.co/t/metricbeats-for-podman-containers/370744)
**Author:** [@Vishwadeeptha\_P](https://discuss.elastic.co/u/Vishwadeeptha_P)\ **Replies:** 5\ **Last updated:** [February 27, 2026, 11:38am UTC](https://discuss.elastic.co/t/metricbeats-for-podman-containers/370744 "2026-02-27T11:38:08Z")
I am trying to add metricbeats on linux VM which has hosted 60 podman containers. I am able to fetch all the VM related metrics with configurations based on system.yml. The VM level metrics are displayed on Host Overview… --- ## [Winlogbeat Kafka output not reading SSL certs with "wrong" line ends](https://discuss.elastic.co/t/winlogbeat-kafka-output-not-reading-ssl-certs-with-wrong-line-ends/385257)
**Author:** [@ciranor](https://discuss.elastic.co/u/ciranor)\ **Replies:** 3\ **Last updated:** [February 27, 2026, 10:41am UTC](https://discuss.elastic.co/t/winlogbeat-kafka-output-not-reading-ssl-certs-with-wrong-line-ends/385257 "2026-02-27T10:41:24Z")
I’m setting up Winlogbeat to output to Kafka with SSL certificates used to authenticate. The certificates will be generated, rotated and supplied automatically by another system. But when trying to configure it, winlogbe… --- ## [🐴 Elastic AutoOps is now free for every self-managed cluster — no license upgrade, no credit card, no strings attached](https://discuss.elastic.co/t/elastic-autoops-is-now-free-for-every-self-managed-cluster-no-license-upgrade-no-credit-card-no-strings-attached/385258)
**Author:** [@Musab\_Dogan](https://discuss.elastic.co/u/Musab_Dogan)\ **Replies:** 0\ **Last updated:** [February 26, 2026, 10:50pm UTC](https://discuss.elastic.co/t/elastic-autoops-is-now-free-for-every-self-managed-cluster-no-license-upgrade-no-credit-card-no-strings-attached/385258 "2026-02-26T22:50:08Z")
:partying\_face: Sharing this great news here for more visibility. Elastic AutoOps brings diagnostics and operational insights directly to your environment, transforming the way you manage Elasticsearch. Today, we are m… --- ## [Elastic Agent on Mac in failed state](https://discuss.elastic.co/t/elastic-agent-on-mac-in-failed-state/385255)
**Author:** [@HaydenB0101](https://discuss.elastic.co/u/HaydenB0101)\ **Replies:** 1\ **Last updated:** [February 26, 2026, 6:17pm UTC](https://discuss.elastic.co/t/elastic-agent-on-mac-in-failed-state/385255 "2026-02-26T18:17:22Z")
Hello, I am using the Custom macOS Unified Logs integration with elastic 8.18.8 in order to get logs from my mac device, and I getting errors from the agent elastic-agent status fleet status: (HEALTHY) Connected elas… --- ## [Upgrade to 9.x - logstash-filter-elastic\_integration](https://discuss.elastic.co/t/upgrade-to-9-x-logstash-filter-elastic-integration/385035)
**Author:** [@CD9820](https://discuss.elastic.co/u/CD9820)\ **Replies:** 5\ **Last updated:** [February 25, 2026, 2:24pm UTC](https://discuss.elastic.co/t/upgrade-to-9-x-logstash-filter-elastic-integration/385035 "2026-02-25T14:24:41Z")
Hello, we are planning our upgrade from 8.19.x to 9.2.x For some ingestflows we use the logstash-filter-elastic\_integration In the upgrade documentation Elastic recommends upgrading Elasticsearch first, followed by Ki… --- ## [Is it possible to add additional fields to the elastic serverless forwarder config?](https://discuss.elastic.co/t/is-it-possible-to-add-additional-fields-to-the-elastic-serverless-forwarder-config/385215)
**Author:** [@Lasra\_Bilaj](https://discuss.elastic.co/u/Lasra_Bilaj)\ **Replies:** 0\ **Last updated:** [February 25, 2026, 12:51pm UTC](https://discuss.elastic.co/t/is-it-possible-to-add-additional-fields-to-the-elastic-serverless-forwarder-config/385215 "2026-02-25T12:51:29Z")
In the config.yml for Elastics serverless forwarder, is it possible to do something like this. outputs: - type: elasticsearch args: cloud\_id: ${ELASTIC\_CLOUD\_ID} api\_key: ${ELASTIC\_API\_… --- ## [VMware Vsphere Integration - Tags](https://discuss.elastic.co/t/vmware-vsphere-integration-tags/385193)
**Author:** [@erikg](https://discuss.elastic.co/u/erikg)\ **Replies:** 2\ **Last updated:** [February 24, 2026, 9:17pm UTC](https://discuss.elastic.co/t/vmware-vsphere-integration-tags/385193 "2026-02-24T21:17:05Z")
Hello, has anyone using VMware vSphere integration gotten tags from VMs? It seems like NewRelic can grab custom tags from vSphere: https://docs.newrelic.com/install/vsphere/ Background: Many admins use custom tags on V… --- ## [Cluster overview not working](https://discuss.elastic.co/t/cluster-overview-not-working/385180)
**Author:** [@juancamiloll](https://discuss.elastic.co/u/juancamiloll)\ **Replies:** 1\ **Last updated:** [February 24, 2026, 8:25pm UTC](https://discuss.elastic.co/t/cluster-overview-not-working/385180 "2026-02-24T20:25:46Z")
Hello, I am currently on version 8.19.8 and am preparing to first upgrade to the latest version of 8.x and then to 9.x. In “Upgrade Assistant,” I set out to remove the warnings I had, and when I got to the last one rel… --- ## [Elastic Agent + Security Onion](https://discuss.elastic.co/t/elastic-agent-security-onion/385187)
**Author:** [@harry22](https://discuss.elastic.co/u/harry22)\ **Replies:** 0\ **Last updated:** [February 24, 2026, 4:31pm UTC](https://discuss.elastic.co/t/elastic-agent-security-onion/385187 "2026-02-24T16:31:55Z")
Hi team, I recentely deployed Security onion lab on Vmware workstation Allowed allow hosts on Security Onion with my home private Subnet Checked and verified all services showing up on VM Checked and verified on Pow… --- ## [Is reindexing much heavier than initial indexing?](https://discuss.elastic.co/t/is-reindexing-much-heavier-than-initial-indexing/385177)
**Author:** [@some](https://discuss.elastic.co/u/some)\ **Replies:** 0\ **Last updated:** [February 24, 2026, 11:46am UTC](https://discuss.elastic.co/t/is-reindexing-much-heavier-than-initial-indexing/385177 "2026-02-24T11:46:39Z")
I have single server with ES 9.2.5. It has 40cores/256GB RAM/12TB of SSD. Thers are 2 aliases, ILM is rotating indices at 200GB (10 shards per index). Everything works fine in terms of indexing/search speed, but I can… --- ## [Having 2 allocation IDs in in\_sync\_allocations when there are no replicas](https://discuss.elastic.co/t/having-2-allocation-ids-in-in-sync-allocations-when-there-are-no-replicas/385174)
**Author:** [@winter\_crescents](https://discuss.elastic.co/u/winter_crescents)\ **Replies:** 2\ **Last updated:** [February 24, 2026, 10:23am UTC](https://discuss.elastic.co/t/having-2-allocation-ids-in-in-sync-allocations-when-there-are-no-replicas/385174 "2026-02-24T10:23:14Z")
Hi I am facing this issue where I had an index with an initial replication of 1. However, one year ago, due to disk storage issues I reduced the replication to 0. One year later, I now run this operation: GET /\_cluster… --- ## [Adding license seem to work, then reverts back to Basic](https://discuss.elastic.co/t/adding-license-seem-to-work-then-reverts-back-to-basic/385164)
**Author:** [@michael-a](https://discuss.elastic.co/u/michael-a)\ **Replies:** 4\ **Last updated:** [February 24, 2026, 9:04am UTC](https://discuss.elastic.co/t/adding-license-seem-to-work-then-reverts-back-to-basic/385164 "2026-02-24T09:04:43Z")
Adding the license to our self-hosted Kubernetes cluster using the API, it gets accepted (API response true/valid) and we can see that the license is active in both Kibana and Stack Monitoring. However, shortly after the… --- ## [Filebeat Event Publishing Delay to Kafka](https://discuss.elastic.co/t/filebeat-event-publishing-delay-to-kafka/385064)
**Author:** [@Thirupathi](https://discuss.elastic.co/u/Thirupathi)\ **Replies:** 9\ **Last updated:** [February 24, 2026, 8:52am UTC](https://discuss.elastic.co/t/filebeat-event-publishing-delay-to-kafka/385064 "2026-02-24T08:52:30Z")
From the logs, we can see that the logger timestamp indicates a noticeable time gap between event processing and event publishing to Kafka. Due to this delay, events are not being pushed to Kafka in real-time as expected… --- ## [Stack monitoring understanding](https://discuss.elastic.co/t/stack-monitoring-understanding/385140)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 1\ **Last updated:** [February 24, 2026, 7:05am UTC](https://discuss.elastic.co/t/stack-monitoring-understanding/385140 "2026-02-24T07:05:53Z")
Hi, Community, I am trying to understand this stack monitoring one of my busy index’s advance monitoring show this is this means total 888 search request came in and combine it tool 918.49ms ? or is it just one searc… --- ## [ELK 8.11 Basic License – Alert if logs with specific field are missing for 30 mins](https://discuss.elastic.co/t/elk-8-11-basic-license-alert-if-logs-with-specific-field-are-missing-for-30-mins/385166)
**Author:** [@Alex\_Xavier](https://discuss.elastic.co/u/Alex_Xavier)\ **Replies:** 1\ **Last updated:** [February 23, 2026, 11:09pm UTC](https://discuss.elastic.co/t/elk-8-11-basic-license-alert-if-logs-with-specific-field-are-missing-for-30-mins/385166 "2026-02-23T23:09:26Z")
Hi, I’m using ELK Stack 8.11.0 (Basic License) and need to trigger an Email or SMS alert if logs with a specific field (example: state:132) are not received for 30 minutes. Logs normally arrive every few seconds. If no… --- ## [Agent (Winlogbeat) stop sending data](https://discuss.elastic.co/t/agent-winlogbeat-stop-sending-data/384988)
**Author:** [@Andex](https://discuss.elastic.co/u/Andex)\ **Replies:** 5\ **Last updated:** [February 23, 2026, 8:21pm UTC](https://discuss.elastic.co/t/agent-winlogbeat-stop-sending-data/384988 "2026-02-23T20:21:41Z")
Hi, i’m facing with a problem for some winlogbeat agents. Randomly the agent stop sending data to the cluster. When i restart the service It starts writing data from where it stopped and then after a few hours it stops a… --- ## [Enabling auth after upgrading elasticsearch cluster from 7.17.9 to 8.17.6](https://discuss.elastic.co/t/enabling-auth-after-upgrading-elasticsearch-cluster-from-7-17-9-to-8-17-6/385154)
**Author:** [@syed-asak](https://discuss.elastic.co/u/syed-asak)\ **Replies:** 4\ **Last updated:** [February 23, 2026, 10:42am UTC](https://discuss.elastic.co/t/enabling-auth-after-upgrading-elasticsearch-cluster-from-7-17-9-to-8-17-6/385154 "2026-02-23T10:42:30Z")
Hello everyone, I am looking for guidance on safely enabling security on an existing large Elasticsearch cluster. Current Environment Elasticsearch version: 8.17.6 Deployment type: VM-based cluster (not Kubernetes… --- ## [Selecting only wy WiFi interface for network metric does not seem to work](https://discuss.elastic.co/t/selecting-only-wy-wifi-interface-for-network-metric-does-not-seem-to-work/371486)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 5\ **Last updated:** [February 22, 2026, 3:44pm UTC](https://discuss.elastic.co/t/selecting-only-wy-wifi-interface-for-network-metric-does-not-seem-to-work/371486 "2026-02-22T15:44:58Z")
Hello, I tried multiple variations of WiFi to only log network metrics for my WiFi adapter and not for all the rest: But whatever I try it keeps indexing metrics for all my interfaces. Anyone got an idea what I'm… --- ## [Creation date of logstash created files, with %{+YYYY.MM.dd} in the name, is offset by few hours](https://discuss.elastic.co/t/creation-date-of-logstash-created-files-with-yyyy-mm-dd-in-the-name-is-offset-by-few-hours/385002)
**Author:** [@Toxic\_Bunny](https://discuss.elastic.co/u/Toxic_Bunny)\ **Replies:** 4\ **Last updated:** [February 22, 2026, 3:28pm UTC](https://discuss.elastic.co/t/creation-date-of-logstash-created-files-with-yyyy-mm-dd-in-the-name-is-offset-by-few-hours/385002 "2026-02-22T15:28:31Z")
Logstash sends all unprocessed leftovers into a separate .log file for archiving purposes output{ file { path =\> "/var/log/logstash/archive-%{+YYYY.MM.dd}.log" } } The problem is that logstash additionally offsets … --- ## [Kibana Options List Controls](https://discuss.elastic.co/t/kibana-options-list-controls/385080)
**Author:** [@Vignesh2](https://discuss.elastic.co/u/Vignesh2)\ **Replies:** 3\ **Last updated:** [February 22, 2026, 6:17am UTC](https://discuss.elastic.co/t/kibana-options-list-controls/385080 "2026-02-22T06:17:09Z")
Hi Team, I’m facing an issue with Options List Controls in Kibana dashboards. When the field used in the control has less than 100 unique values, the behavior works as expected. If I type a value in the control search … --- ## [“libvec.dylib” Not Opened](https://discuss.elastic.co/t/libvec-dylib-not-opened/385136)
**Author:** [@anjanesh](https://discuss.elastic.co/u/anjanesh)\ **Replies:** 3\ **Last updated:** [February 21, 2026, 4:16am UTC](https://discuss.elastic.co/t/libvec-dylib-not-opened/385136 "2026-02-21T04:16:04Z")
I can’t seem to get EleasticSearch 9.3.0 working on my MacBook Air M2 - Sequoia 15.7.4 (24G517) bin % ./elasticsearch --version Version: 9.3.0, Build: tar/17b451d8979a29e31935fe1eb901310350b30e62/2026-01-29T10:05:46.708… --- ## [Too\_many\_scroll\_contexts\_exception](https://discuss.elastic.co/t/too-many-scroll-contexts-exception/384981)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 9\ **Last updated:** [February 20, 2026, 10:07pm UTC](https://discuss.elastic.co/t/too-many-scroll-contexts-exception/384981 "2026-02-20T22:07:39Z")
elasticsearch -{"statusCode":500,"error":"Internal Server Error","message":"\[search\_phase\_execution\_exception\\n\\tRoot causes:\\n\\t\\ttoo\_many\_scroll\_contexts\_exception: Trying to create too many scroll contexts. Must be le… --- ## [Elasticsearch classic plugin: problem with entitlements](https://discuss.elastic.co/t/elasticsearch-classic-plugin-problem-with-entitlements/385137)
**Author:** [@Peter\_van\_der\_Weerd](https://discuss.elastic.co/u/Peter_van_der_Weerd)\ **Replies:** 1\ **Last updated:** [February 20, 2026, 3:55pm UTC](https://discuss.elastic.co/t/elasticsearch-classic-plugin-problem-with-entitlements/385137 "2026-02-20T15:55:33Z")
I’m writing a classic plugin for a custom similarity. ES9.0.1. The plugin tries to load resources from its own jar: Enumeration\ resources = Utils.class.getClassLoader().getResources("META-INF/MANIFEST.MF"… --- ## [Windows version for logstash 9.3.0](https://discuss.elastic.co/t/windows-version-for-logstash-9-3-0/385109)
**Author:** [@Bojie](https://discuss.elastic.co/u/Bojie)\ **Replies:** 6\ **Last updated:** [February 20, 2026, 1:35pm UTC](https://discuss.elastic.co/t/windows-version-for-logstash-9-3-0/385109 "2026-02-20T13:35:47Z")
Hi, I would like to ask if there will be a windows version of Logstash 9.3.0 available for download, and if so, when would it be released? I would need version 9.3.0 as it contains the latest version of log4j (2.25.3) wh… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=16) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=18)