# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=173 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 174 --- ## [Parse line error: invalid CRI log format when registry offset points to middle of the log event](https://discuss.elastic.co/t/parse-line-error-invalid-cri-log-format-when-registry-offset-points-to-middle-of-the-log-event/365197)
**Author:** [@sasikiranvaddi](https://discuss.elastic.co/u/sasikiranvaddi)\ **Replies:** 5\ **Last updated:** [September 9, 2024, 8:58am UTC](https://discuss.elastic.co/t/parse-line-error-invalid-cri-log-format-when-registry-offset-points-to-middle-of-the-log-event/365197 "2024-09-09T08:58:51Z")
Filebeat: Version: 8.12.1 Autodiscover enabled. We observe at times filebeat reports an error {"log.level":"error","@timestamp":"2024-08-13T10:25:42.693Z","log.logger":"reader\_docker\_json","log.origin":{"function":"g… --- ## [How does the syncAlerts settings work for case creation?](https://discuss.elastic.co/t/how-does-the-syncalerts-settings-work-for-case-creation/366224)
**Author:** [@Danyal\_Danish](https://discuss.elastic.co/u/Danyal_Danish)\ **Replies:** 0\ **Last updated:** [September 9, 2024, 7:23am UTC](https://discuss.elastic.co/t/how-does-the-syncalerts-settings-work-for-case-creation/366224 "2024-09-09T07:23:01Z")
Hi, I want to know how the syncAlerts settings affect the case creation process. I can't any details or information about on a Elasticsearch documentation pages. --- ## [Client request timeout for One Hour Data , while the same query when executed for 15 minutes or less give the data in some microseconds, What can be the root cause](https://discuss.elastic.co/t/client-request-timeout-for-one-hour-data-while-the-same-query-when-executed-for-15-minutes-or-less-give-the-data-in-some-microseconds-what-can-be-the-root-cause/366217)
**Author:** [@KunwarAkanksha](https://discuss.elastic.co/u/KunwarAkanksha)\ **Replies:** 0\ **Last updated:** [September 9, 2024, 4:17am UTC](https://discuss.elastic.co/t/client-request-timeout-for-one-hour-data-while-the-same-query-when-executed-for-15-minutes-or-less-give-the-data-in-some-microseconds-what-can-be-the-root-cause/366217 "2024-09-09T04:17:34Z")
I am not finding any logs related to such an error on coordination or on any master node, The Elastic nodes have the high bandwidth within themselves, but some time I observe retries when testing the bandwidth , Can thi… --- ## [Logstash deployment in scale to check readiness and liveness probe](https://discuss.elastic.co/t/logstash-deployment-in-scale-to-check-readiness-and-liveness-probe/366213)
**Author:** [@aws.learning](https://discuss.elastic.co/u/aws.learning)\ **Replies:** 2\ **Last updated:** [September 8, 2024, 8:04pm UTC](https://discuss.elastic.co/t/logstash-deployment-in-scale-to-check-readiness-and-liveness-probe/366213 "2024-09-08T20:04:14Z")
We need to tweak the liveness and readiness probe checks For this I deploy one pod and tweak the readiness and liveness probe values ..But filebeat and syslogs are not flowing --- ## [Kibana: Browse Integration loads infinitely](https://discuss.elastic.co/t/kibana-browse-integration-loads-infinitely/366207)
**Author:** [@tripoli](https://discuss.elastic.co/u/tripoli)\ **Replies:** 1\ **Last updated:** [September 8, 2024, 3:22pm UTC](https://discuss.elastic.co/t/kibana-browse-integration-loads-infinitely/366207 "2024-09-08T15:22:52Z")
Hi, I'm creating an elasticsearch cluster with docker (portainer). However, the page to "Browse Integrations" on Kibana loads endlessly. Below is the screen Kibana (Docker-compose) kibana: depends\_on: … --- ## [ElasticSearch Cluster: Logstash works, but does not show up on kibana dashboard](https://discuss.elastic.co/t/elasticsearch-cluster-logstash-works-but-does-not-show-up-on-kibana-dashboard/366205)
**Author:** [@tripoli](https://discuss.elastic.co/u/tripoli)\ **Replies:** 0\ **Last updated:** [September 8, 2024, 1:41pm UTC](https://discuss.elastic.co/t/elasticsearch-cluster-logstash-works-but-does-not-show-up-on-kibana-dashboard/366205 "2024-09-08T13:41:35Z")
Hi, I'm creating a cluster with elasticsearch (2 elastic nodes and a kibana/logstash/filebeat node). Logstash "apparently" seems to work because filebeat sends the data to logstash and consequently logstash sends them … --- ## [Deploying Logstash on ECK returns "Your settings are invalid. Reason: Setting "logstash.yml" doesn't exist. Please check if you haven't made a typo."](https://discuss.elastic.co/t/deploying-logstash-on-eck-returns-your-settings-are-invalid-reason-setting-logstash-yml-doesnt-exist-please-check-if-you-havent-made-a-typo/366203)
**Author:** [@Iftachby](https://discuss.elastic.co/u/Iftachby)\ **Replies:** 0\ **Last updated:** [September 8, 2024, 11:31am UTC](https://discuss.elastic.co/t/deploying-logstash-on-eck-returns-your-settings-are-invalid-reason-setting-logstash-yml-doesnt-exist-please-check-if-you-havent-made-a-typo/366203 "2024-09-08T11:31:26Z")
Hey Im new to Logstash/ECK Ive tried deploying an ECK cluster and then deploying Logstash, using ArgoCD. The ECK works well, for the Logstash I'm having issues with the statefulset. it returns the error; Your setting… --- ## [PatternCaptureGroupTokenFilter is creating the same offset positions, which is causing highlighting issue](https://discuss.elastic.co/t/patterncapturegrouptokenfilter-is-creating-the-same-offset-positions-which-is-causing-highlighting-issue/366200)
**Author:** [@shikha65786](https://discuss.elastic.co/u/shikha65786)\ **Replies:** 0\ **Last updated:** [September 8, 2024, 10:38am UTC](https://discuss.elastic.co/t/patterncapturegrouptokenfilter-is-creating-the-same-offset-positions-which-is-causing-highlighting-issue/366200 "2024-09-08T10:38:19Z")
I am implementing the PatternCaptureGroupTokenFilter in my code to generate tokens based on multiple regular expressions, with the goal of highlighting any matches found within the string. Currently, I am working with Lu… --- ## [Why doesn't the Elastic Package Registry Docker Image have \`/bin/bash\`?](https://discuss.elastic.co/t/why-doesnt-the-elastic-package-registry-docker-image-have-bin-bash/366138)
**Author:** [@linghengqian](https://discuss.elastic.co/u/linghengqian)\ **Replies:** 6\ **Last updated:** [September 8, 2024, 9:20am UTC](https://discuss.elastic.co/t/why-doesnt-the-elastic-package-registry-docker-image-have-bin-bash/366138 "2024-09-08T09:20:03Z")
Assume there is the following docker-compose.yml. services: elastic-package-registry: image: docker.elastic.co/package-registry/distribution:8.15.0 Start it, docker compose pull docker compose up -d docker com… --- ## [Under which conditions could a completion suggestion deplete thread pool and heap memory?](https://discuss.elastic.co/t/under-which-conditions-could-a-completion-suggestion-deplete-thread-pool-and-heap-memory/366197)
**Author:** [@captain-nemo](https://discuss.elastic.co/u/captain-nemo)\ **Replies:** 0\ **Last updated:** [September 8, 2024, 7:15am UTC](https://discuss.elastic.co/t/under-which-conditions-could-a-completion-suggestion-deplete-thread-pool-and-heap-memory/366197 "2024-09-08T07:15:50Z")
Situation: Elasticsearch cluster crashed (thread pool and soon after heap memory depleted). When investigating the heap dump it showed that the suggester was processing unusual queries like this: +"\\uffab-\\uffaa/(+-\\uf… --- ## [Heterogeneous Cluster](https://discuss.elastic.co/t/heterogeneous-cluster/366184)
**Author:** [@Aditya\_Teltia](https://discuss.elastic.co/u/Aditya_Teltia)\ **Replies:** 10\ **Last updated:** [September 8, 2024, 5:57am UTC](https://discuss.elastic.co/t/heterogeneous-cluster/366184 "2024-09-08T05:57:03Z")
Do elasticsearch support Heterogeneous Cluster? Like if I have 1 master node at 7.17.6 , 2 data nodes at 7.17.6 & 1 data node at 8.11.1 will that work? This is to confirm that whether we can rolling upgrade ES without … --- ## [High CPU Usage when laptop outside internal network](https://discuss.elastic.co/t/high-cpu-usage-when-laptop-outside-internal-network/365916)
**Author:** [@Haitham1](https://discuss.elastic.co/u/Haitham1)\ **Replies:** 4\ **Last updated:** [September 7, 2024, 11:33am UTC](https://discuss.elastic.co/t/high-cpu-usage-when-laptop-outside-internal-network/365916 "2024-09-07T11:33:13Z")
Hi, i have setup elastic stack at work , i have installed the agent in few servers and laptops everything works well , but if a laptop is outside the work network then the cpu will hit 100% untill it crash and the do … --- ## [Percolate query - get reason why document was not matched](https://discuss.elastic.co/t/percolate-query-get-reason-why-document-was-not-matched/366186)
**Author:** [@alesmenzel](https://discuss.elastic.co/u/alesmenzel)\ **Replies:** 0\ **Last updated:** [September 7, 2024, 9:23am UTC](https://discuss.elastic.co/t/percolate-query-get-reason-why-document-was-not-matched/366186 "2024-09-07T09:23:30Z")
Hi, I have read through the documentation Percolate query | Elasticsearch Guide \[8.15\] | Elastic but could not find a way to get the reason why a percolate query would not match given documents, is it somehow possible t… --- ## [ElasticPress Authentication for remote server](https://discuss.elastic.co/t/elasticpress-authentication-for-remote-server/364723)
**Author:** [@aiusdyasiudy](https://discuss.elastic.co/u/aiusdyasiudy)\ **Replies:** 4\ **Last updated:** [September 6, 2024, 8:32pm UTC](https://discuss.elastic.co/t/elasticpress-authentication-for-remote-server/364723 "2024-09-06T20:32:43Z")
I am setting up a demo Elasticsearch server to take it for a spin on my Wordpress sites using ElasticPress plugin. I have Elasticsearch setup properly, and Kibana as well in Debian on an OVH virtual machine to test. Th… --- ## [Logstash JDBC Inputs SQL Connections are never closed](https://discuss.elastic.co/t/logstash-jdbc-inputs-sql-connections-are-never-closed/366160)
**Author:** [@lkouts](https://discuss.elastic.co/u/lkouts)\ **Replies:** 3\ **Last updated:** [September 6, 2024, 7:20pm UTC](https://discuss.elastic.co/t/logstash-jdbc-inputs-sql-connections-are-never-closed/366160 "2024-09-06T19:20:05Z")
Hey Folks, I have a logstash configuration that has 10 jdbc inputs connecting to the same SQL Server but to diffrent databases. Scheduler is set to run every 2 minutes. All works correctly however the SQL Connections ar… --- ## [Postgresql connector skipping query](https://discuss.elastic.co/t/postgresql-connector-skipping-query/366058)
**Author:** [@mrtl](https://discuss.elastic.co/u/mrtl)\ **Replies:** 7\ **Last updated:** [September 6, 2024, 6:38pm UTC](https://discuss.elastic.co/t/postgresql-connector-skipping-query/366058 "2024-09-06T18:38:19Z")
Hi, my connector is correcly connected to elasticsearch but in the log ther e is this line : Skipping query select \[...\] as primary key column name is not present in query. I don't understand if it's related to elast… --- ## [Error: Request timeout: "Aborted"](https://discuss.elastic.co/t/error-request-timeout-aborted/366168)
**Author:** [@Ashok-saini](https://discuss.elastic.co/u/Ashok-saini)\ **Replies:** 0\ **Last updated:** [September 6, 2024, 4:13pm UTC](https://discuss.elastic.co/t/error-request-timeout-aborted/366168 "2024-09-06T16:13:30Z")
HI All, We are getting below error when we are searching string in kibana more 24 hours. AS we checked cluster health looks good and file system utilizations also under control. "cluster\_name" : "PROD-ELASTICSEARCH"… --- ## [Logstash won't start due to memory heap issue](https://discuss.elastic.co/t/logstash-wont-start-due-to-memory-heap-issue/366069)
**Author:** [@Carolina\_Molina](https://discuss.elastic.co/u/Carolina_Molina)\ **Replies:** 10\ **Last updated:** [September 6, 2024, 11:35am UTC](https://discuss.elastic.co/t/logstash-wont-start-due-to-memory-heap-issue/366069 "2024-09-06T11:35:23Z")
Hello, I have a instance running logstsh 6.8.2 with Java 11.0.19 and JDK of 64Bits, I changed the filter file do add conditions and terraform logstash to the correct environment. After that logstash refused to start giv… --- ## [\_source field exclusion seems to fail indexing field as well](https://discuss.elastic.co/t/source-field-exclusion-seems-to-fail-indexing-field-as-well/366113)
**Author:** [@RubiHali](https://discuss.elastic.co/u/RubiHali)\ **Replies:** 5\ **Last updated:** [September 6, 2024, 11:30am UTC](https://discuss.elastic.co/t/source-field-exclusion-seems-to-fail-indexing-field-as-well/366113 "2024-09-06T11:30:37Z")
I have some data which we want to only index for filtering but not store in \_source field. We have used \_source exclusion for those fields. We have a scenario where in certain cases, the document doesn't contain that fi… --- ## [Automatic report generation using watcher not able to parse auth](https://discuss.elastic.co/t/automatic-report-generation-using-watcher-not-able-to-parse-auth/364658)
**Author:** [@surya\_dadi\_dhamarake](https://discuss.elastic.co/u/surya_dadi_dhamarake)\ **Replies:** 17\ **Last updated:** [September 6, 2024, 11:09am UTC](https://discuss.elastic.co/t/automatic-report-generation-using-watcher-not-able-to-parse-auth/364658 "2024-09-06T11:09:36Z")
Hi Team, I am trying to generate the automatic report and send an email using the default email service provided by elastic cloud (8.9.0) I have followed all the steps created the user and give all privileges copying… --- ## [Integration issue with Atlassian Jira on Elastic Agent: Error 404](https://discuss.elastic.co/t/integration-issue-with-atlassian-jira-on-elastic-agent-error-404/366052)
**Author:** [@iTiago](https://discuss.elastic.co/u/iTiago)\ **Replies:** 3\ **Last updated:** [September 6, 2024, 8:58am UTC](https://discuss.elastic.co/t/integration-issue-with-atlassian-jira-on-elastic-agent-error-404/366052 "2024-09-06T08:58:08Z")
I'm experiencing an issue with Atlassian Jira integration via Elastic Agent. When the agent tries to process HTTP requests, I am receiving the following error: \[elastic\_agent.filebeat\]\[error\] Error while processing http… --- ## [Cluster\_block\_exception: index \[.kibana\_security\_session\_1\] blocked by: \[TOO\_MANY\_REQUESTS/12/disk usage exceeded flood-stage watermark, index has read-only-allow-delete block\]](https://discuss.elastic.co/t/cluster-block-exception-index-kibana-security-session-1-blocked-by-too-many-requests-12-disk-usage-exceeded-flood-stage-watermark-index-has-read-only-allow-delete-block/366132)
**Author:** [@tuanlt7](https://discuss.elastic.co/u/tuanlt7)\ **Replies:** 2\ **Last updated:** [September 6, 2024, 8:46am UTC](https://discuss.elastic.co/t/cluster-block-exception-index-kibana-security-session-1-blocked-by-too-many-requests-12-disk-usage-exceeded-flood-stage-watermark-index-has-read-only-allow-delete-block/366132 "2024-09-06T08:46:19Z")
Dears Support Team, Today, I login to Elastic in Kibana but have error message \[2024-09-06T04:49:33.914+00:00\]\[ERROR\]\[plugins.security.user-profile\] Failed to activate user profile: { "error": { "root\_cause": \[ { … --- ## [Elastic Agent get refused connections from elasticsearch and fleet after some time](https://discuss.elastic.co/t/elastic-agent-get-refused-connections-from-elasticsearch-and-fleet-after-some-time/366128)
**Author:** [@vitwo](https://discuss.elastic.co/u/vitwo)\ **Replies:** 0\ **Last updated:** [September 6, 2024, 3:00am UTC](https://discuss.elastic.co/t/elastic-agent-get-refused-connections-from-elasticsearch-and-fleet-after-some-time/366128 "2024-09-06T03:00:57Z")
Hello community, I'm suffering with an issue that I don´t know why is happening. I'm using this architecture: 1 - Elasticsearch, Kibana and Fleet on the same server 2 - I'm using elastic agent to collect logs from a … --- ## [GET /\_cat/indices not showing all indices after upgrade to 7.3](https://discuss.elastic.co/t/get-cat-indices-not-showing-all-indices-after-upgrade-to-7-3/366123)
**Author:** [@elastic\_noob1](https://discuss.elastic.co/u/elastic_noob1)\ **Replies:** 1\ **Last updated:** [September 6, 2024, 2:06am UTC](https://discuss.elastic.co/t/get-cat-indices-not-showing-all-indices-after-upgrade-to-7-3/366123 "2024-09-06T02:06:21Z")
I upgraded our cluster from 6.8 to 7.3.2 and I can only view all indices if I authenticate to the cluster. This was not the case on 6.8: I get only system indices without authentication: ➜ curl -s -XGET https://timel… --- ## [Ingest Pipeline - Date Processor - Parsing Failure](https://discuss.elastic.co/t/ingest-pipeline-date-processor-parsing-failure/366122)
**Author:** [@erikg](https://discuss.elastic.co/u/erikg)\ **Replies:** 2\ **Last updated:** [September 5, 2024, 9:50pm UTC](https://discuss.elastic.co/t/ingest-pipeline-date-processor-parsing-failure/366122 "2024-09-05T21:50:14Z")
Hello, I don't know why I am getting this error: This is the format I specified: YYYY/MM/DD HH:MM:SS.SSS This is the field value: 2024/09/04 23:38:49.930 Is this not right? --- ## [\[8.14.3\] build issue](https://discuss.elastic.co/t/8-14-3-build-issue/365628)
**Author:** [@ankita-mehta-bsn](https://discuss.elastic.co/u/ankita-mehta-bsn)\ **Replies:** 1\ **Last updated:** [September 5, 2024, 7:42pm UTC](https://discuss.elastic.co/t/8-14-3-build-issue/365628 "2024-09-05T19:42:43Z")
Can somebody help resolve 8.14. build issue. --- ## [How can I have heartbeat stop generating an index daily?](https://discuss.elastic.co/t/how-can-i-have-heartbeat-stop-generating-an-index-daily/366103)
**Author:** [@SamuelSMendes](https://discuss.elastic.co/u/SamuelSMendes)\ **Replies:** 1\ **Last updated:** [September 5, 2024, 7:04pm UTC](https://discuss.elastic.co/t/how-can-i-have-heartbeat-stop-generating-an-index-daily/366103 "2024-09-05T19:04:28Z")
As in the title, Heartbeat keeps creating an index daily; which is not really a problem by itself, but I'd like to have it in a single index for now. How do I do it? --- ## [Elastic Stack 8.15.0 on Red Hat Enterprise Linux 8.10](https://discuss.elastic.co/t/elastic-stack-8-15-0-on-red-hat-enterprise-linux-8-10/366062)
**Author:** [@kaushalshriyan](https://discuss.elastic.co/u/kaushalshriyan)\ **Replies:** 2\ **Last updated:** [September 5, 2024, 6:25pm UTC](https://discuss.elastic.co/t/elastic-stack-8-15-0-on-red-hat-enterprise-linux-8-10/366062 "2024-09-05T18:25:16Z")
Hi, I am currently running Elastic Stack 8.15.0 on an older hardware server with approximately 150GB of Elasticsearch data on a Red Hat Enterprise Linux 8.10 operating system. We have a brand-new hardware server which … --- ## [Issue with Loading Data from Elasticsearch into Databricks](https://discuss.elastic.co/t/issue-with-loading-data-from-elasticsearch-into-databricks/366087)
**Author:** [@Hernando\_Segovia](https://discuss.elastic.co/u/Hernando_Segovia)\ **Replies:** 2\ **Last updated:** [September 5, 2024, 2:41pm UTC](https://discuss.elastic.co/t/issue-with-loading-data-from-elasticsearch-into-databricks/366087 "2024-09-05T14:41:50Z")
Hello, I'm encountering an issue while trying to load data from Elasticsearch into Databricks. Below is the code I'm using and the error message I'm receiving. Code: es\_read\_conf = { "es.nodes": "your-cluster-url"… --- ## [.NET Elastic.Clients.Elasticsearch (version \>= 8.13.12) - SearchAsync](https://discuss.elastic.co/t/net-elastic-clients-elasticsearch-version-8-13-12-searchasync/366097)
**Author:** [@Premysl\_Capek](https://discuss.elastic.co/u/Premysl_Capek)\ **Replies:** 1\ **Last updated:** [September 5, 2024, 1:58pm UTC](https://discuss.elastic.co/t/net-elastic-clients-elasticsearch-version-8-13-12-searchasync/366097 "2024-09-05T13:58:00Z")
Hi, I have problem with ES client version \>= 8.13.12. In past I use this code to get the latest document from an index but in new version I get a document from a different index. What is correct query for new clients? v… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=172) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=174)