# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=183 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 184 --- ## [Installing Elastic Agent MSI with INSTALLARGS option does not work](https://discuss.elastic.co/t/installing-elastic-agent-msi-with-installargs-option-does-not-work/365268)
**Author:** [@loris\_lx](https://discuss.elastic.co/u/loris_lx)\ **Replies:** 0\ **Last updated:** [August 21, 2024, 10:07am UTC](https://discuss.elastic.co/t/installing-elastic-agent-msi-with-installargs-option-does-not-work/365268 "2024-08-21T10:07:21Z")
Hello, I have a problem installing Elastic Agent with MSI package. When i specify INSTALLARGS="--url=\ --enrollment-token=\ the installation ends with an error and the agent is not installed. So i tried to ru… --- ## [Migrating Winlogbeat to Elastic Agent (WEF/WEC)](https://discuss.elastic.co/t/migrating-winlogbeat-to-elastic-agent-wef-wec/365267)
**Author:** [@erik20](https://discuss.elastic.co/u/erik20)\ **Replies:** 0\ **Last updated:** [August 21, 2024, 10:03am UTC](https://discuss.elastic.co/t/migrating-winlogbeat-to-elastic-agent-wef-wec/365267 "2024-08-21T10:03:27Z")
Are there best practices for Elastic Agent and event forwarding in Windows domains? Scenario: We collect Windows events from domain members via Windows Event Forwarding (WEF). On the collecting machine (WEC) Winlogbeat… --- ## [Logstash processing of files in subfolder's not working when having a large amount of subfolders](https://discuss.elastic.co/t/logstash-processing-of-files-in-subfolders-not-working-when-having-a-large-amount-of-subfolders/365266)
**Author:** [@Maretti](https://discuss.elastic.co/u/Maretti)\ **Replies:** 0\ **Last updated:** [August 21, 2024, 10:01am UTC](https://discuss.elastic.co/t/logstash-processing-of-files-in-subfolders-not-working-when-having-a-large-amount-of-subfolders/365266 "2024-08-21T10:01:22Z")
Hi Context: I am processing a dataset that contains a lot of subfolder's (2359 in total), when I run my logstash config on for example 5 subfolder's everything is getting processed correctly but on the full dataset this… --- ## [Search rejected due to missing shards \[\[tasklist-flownode-instance-1.0.0\_\]\[0\]\]. Consider using \`allow\_partial\_search\_results\` setting to bypass this error](https://discuss.elastic.co/t/search-rejected-due-to-missing-shards-tasklist-flownode-instance-1-0-0-0-consider-using-allow-partial-search-results-setting-to-bypass-this-error/365248)
**Author:** [@mlngupta](https://discuss.elastic.co/u/mlngupta)\ **Replies:** 14\ **Last updated:** [August 21, 2024, 8:57am UTC](https://discuss.elastic.co/t/search-rejected-due-to-missing-shards-tasklist-flownode-instance-1-0-0-0-consider-using-allow-partial-search-results-setting-to-bypass-this-error/365248 "2024-08-21T08:57:37Z")
Hi Team, We have Elasticsearch running with 7 node and version 7.17.1 running on EKS pods. Recently we noticed that the issue with one of the node due to PVC got issue because of EFS\_CSI driver. Once issue fixed PVC re… --- ## [Migration Question/Advice \[HP-\>Dell, Centos-\>Debian, 7.17-\>8.15\]](https://discuss.elastic.co/t/migration-question-advice-hp-dell-centos-debian-7-17-8-15/365227)
**Author:** [@numpty-boy](https://discuss.elastic.co/u/numpty-boy)\ **Replies:** 2\ **Last updated:** [August 21, 2024, 8:23am UTC](https://discuss.elastic.co/t/migration-question-advice-hp-dell-centos-debian-7-17-8-15/365227 "2024-08-21T08:23:48Z")
Hi Team, I have a three node cluster running the latest version of 7.17. I've run the migration assistant and we're clean. Bad news is its running on ancient H/W with centos7. All three machines run master and data role… --- ## [Filebeat not getting Kafka logs](https://discuss.elastic.co/t/filebeat-not-getting-kafka-logs/365256)
**Author:** [@Elgis\_Migle](https://discuss.elastic.co/u/Elgis_Migle)\ **Replies:** 0\ **Last updated:** [August 21, 2024, 8:09am UTC](https://discuss.elastic.co/t/filebeat-not-getting-kafka-logs/365256 "2024-08-21T08:09:05Z")
Hello all, I'm trying to set up monitoring for my Kafka setup. I'm using image: confluentinc/cp-server:7.6.0 and ELK stack with version 7.14. The following is my filebeat.yml kafka.home: /opt/kafka filebeat.confi… --- ## [Alert to Ticket](https://discuss.elastic.co/t/alert-to-ticket/365207)
**Author:** [@Shalinicts](https://discuss.elastic.co/u/Shalinicts)\ **Replies:** 2\ **Last updated:** [August 21, 2024, 7:34am UTC](https://discuss.elastic.co/t/alert-to-ticket/365207 "2024-08-21T07:34:15Z")
Hi Team , We have created an alert whenever the URL is down it has to trigger and create ticket in Servicenow. It is working . However we need to get the description part auto filled with the URL down . example: We ha… --- ## [Ingest data to DataStream Through Filebeat](https://discuss.elastic.co/t/ingest-data-to-datastream-through-filebeat/364510)
**Author:** [@Debasis\_Mallick](https://discuss.elastic.co/u/Debasis_Mallick)\ **Replies:** 21\ **Last updated:** [August 20, 2024, 7:30am UTC](https://discuss.elastic.co/t/ingest-data-to-datastream-through-filebeat/364510 "2024-08-20T07:30:24Z")
Hi Team, Could you please advise how can we ingest data to data streams by using filebeat. Thanks, Debasis --- ## [Struggling with Data Operations and Elastic – Any Advice?](https://discuss.elastic.co/t/struggling-with-data-operations-and-elastic-any-advice/365245)
**Author:** [@Oliviabarn](https://discuss.elastic.co/u/Oliviabarn)\ **Replies:** 1\ **Last updated:** [August 21, 2024, 5:25am UTC](https://discuss.elastic.co/t/struggling-with-data-operations-and-elastic-any-advice/365245 "2024-08-21T05:25:16Z")
Hi everyone, I’m having some trouble with data operations while using Elastic and could use some guidance from the community. Here’s what I’m dealing with: Performance Issues: My data operations are running slower th… --- ## [How to set up hostname correctly when generating certificates for cluster nodes](https://discuss.elastic.co/t/how-to-set-up-hostname-correctly-when-generating-certificates-for-cluster-nodes/365224)
**Author:** [@jack\_a](https://discuss.elastic.co/u/jack_a)\ **Replies:** 1\ **Last updated:** [August 21, 2024, 2:04am UTC](https://discuss.elastic.co/t/how-to-set-up-hostname-correctly-when-generating-certificates-for-cluster-nodes/365224 "2024-08-21T02:04:23Z")
I am trying to follow Tutorial 2: Securing a self-managed Elastic Stack and in step 3.1 there is a place that asks for hostnames and the IP addresses that will be used to connect to my cluster. So assuming i have 3 VMs n… --- ## [Service Account Unable to Authenticate](https://discuss.elastic.co/t/service-account-unable-to-authenticate/364734)
**Author:** [@Matt\_Clairmont](https://discuss.elastic.co/u/Matt_Clairmont)\ **Replies:** 11\ **Last updated:** [August 20, 2024, 10:20pm UTC](https://discuss.elastic.co/t/service-account-unable-to-authenticate/364734 "2024-08-20T22:20:02Z")
Hello, I have a healthy single node elasticsearch cluster but when I created a service token and plugged it into the kibana.yml file, I'm receiving an authentication error. { "name" : "es01", "cluster\_name" : "SANI… --- ## [Split a data stream into separate Indexes - to allow different ILM policies](https://discuss.elastic.co/t/split-a-data-stream-into-separate-indexes-to-allow-different-ilm-policies/365223)
**Author:** [@mgordon](https://discuss.elastic.co/u/mgordon)\ **Replies:** 4\ **Last updated:** [August 20, 2024, 7:22pm UTC](https://discuss.elastic.co/t/split-a-data-stream-into-separate-indexes-to-allow-different-ilm-policies/365223 "2024-08-20T19:22:43Z")
I'm using the Custom UDP Logs integration and need to split the data stream into two separate indexes (data streams), so I can enable different ILM policies on the two different types of data coming in. Is that possible,… --- ## [Iframe error when changing Iframe content](https://discuss.elastic.co/t/iframe-error-when-changing-iframe-content/364903)
**Author:** [@StefanC](https://discuss.elastic.co/u/StefanC)\ **Replies:** 1\ **Last updated:** [August 20, 2024, 6:12pm UTC](https://discuss.elastic.co/t/iframe-error-when-changing-iframe-content/364903 "2024-08-20T18:12:06Z")
Setup: Version 8.15.0 of kibana/elasticseach Create an application where kibana is hosted as an IFrame. Make serveral selections on the different dashboard. Navigate to other dashboards via drilldown When changing the… --- ## [Multi-million indices cluster](https://discuss.elastic.co/t/multi-million-indices-cluster/365160)
**Author:** [@xambr](https://discuss.elastic.co/u/xambr)\ **Replies:** 6\ **Last updated:** [August 20, 2024, 2:54pm UTC](https://discuss.elastic.co/t/multi-million-indices-cluster/365160 "2024-08-20T14:54:54Z")
We're considering deploying an Elasticsearch cluster to support many thousands of users, each with unique and potentially conflicting data mappings. Additionally, the data corpus size varies significantly between users. … --- ## [Visualize - Replicate Last Reboot](https://discuss.elastic.co/t/visualize-replicate-last-reboot/365056)
**Author:** [@erikg](https://discuss.elastic.co/u/erikg)\ **Replies:** 3\ **Last updated:** [August 20, 2024, 4:51pm UTC](https://discuss.elastic.co/t/visualize-replicate-last-reboot/365056 "2024-08-20T16:51:28Z")
Hello, I wanted to recreate this bar chart: --- ## [Stop elastic shard store on old elastic node](https://discuss.elastic.co/t/stop-elastic-shard-store-on-old-elastic-node/365175)
**Author:** [@Julian\_Fazri](https://discuss.elastic.co/u/Julian_Fazri)\ **Replies:** 10\ **Last updated:** [August 20, 2024, 4:43pm UTC](https://discuss.elastic.co/t/stop-elastic-shard-store-on-old-elastic-node/365175 "2024-08-20T16:43:06Z")
Hi All, I want to migrate existing elastic nodes to the new nodes using the join cluster method, So I don't have to backup-restore the data and kibana feature configuration. The details are below: I have 3 existing el… --- ## [Filebeat under ECK logging.level](https://discuss.elastic.co/t/filebeat-under-eck-logging-level/365216)
**Author:** [@atchaikovski](https://discuss.elastic.co/u/atchaikovski)\ **Replies:** 0\ **Last updated:** [August 20, 2024, 4:35pm UTC](https://discuss.elastic.co/t/filebeat-under-eck-logging-level/365216 "2024-08-20T16:35:21Z")
hello! we've got ECK operator and ELK stack under it. working ok, just need to have less messages coming from filebeat. tried logging.level: warning instead of info - doesn't work. is there any other way to make it less… --- ## [How to remove extra characters by using grok pattern in logstash](https://discuss.elastic.co/t/how-to-remove-extra-characters-by-using-grok-pattern-in-logstash/365187)
**Author:** [@upreddy](https://discuss.elastic.co/u/upreddy)\ **Replies:** 3\ **Last updated:** [August 20, 2024, 3:02pm UTC](https://discuss.elastic.co/t/how-to-remove-extra-characters-by-using-grok-pattern-in-logstash/365187 "2024-08-20T15:02:41Z")
Hi I trying to write grok pattern to remove some extra characters in between the message by using grok pattern. after removing these extra characters i want to apply json filter. I am sharing sample logs below. 2024-08… --- ## [Uninstalling beats on Linux does not stop systemd service](https://discuss.elastic.co/t/uninstalling-beats-on-linux-does-not-stop-systemd-service/364560)
**Author:** [@PCChris](https://discuss.elastic.co/u/PCChris)\ **Replies:** 2\ **Last updated:** [August 20, 2024, 2:12pm UTC](https://discuss.elastic.co/t/uninstalling-beats-on-linux-does-not-stop-systemd-service/364560 "2024-08-20T14:12:48Z")
Uninstalling beats (e.g. auditbeat, metricbeat) on Linux (e.g. RHEL 8.10) does not appear to stop the beat process / systemd service. For RPM packages, I believe this should be handled by the %systemd\_preun macro in the … --- ## [Who can save me TypeError: Failed to fetch](https://discuss.elastic.co/t/who-can-save-me-typeerror-failed-to-fetch/365170)
**Author:** [@WHD](https://discuss.elastic.co/u/WHD)\ **Replies:** 1\ **Last updated:** [August 20, 2024, 1:58pm UTC](https://discuss.elastic.co/t/who-can-save-me-typeerror-failed-to-fetch/365170 "2024-08-20T13:58:10Z")
I use docker to install ES and Kibana, ES can be accessed normally， { "name" : "5f6114f4c963", "cluster\_name" : "docker-cluster", "cluster\_uuid" : "e9a2-N-rRMmq\_cpiaJqnBw", "version" : { "number" : "7.10.1",… --- ## [Alerting - Updating the Role\`](https://discuss.elastic.co/t/alerting-updating-the-role/364929)
**Author:** [@erikg](https://discuss.elastic.co/u/erikg)\ **Replies:** 1\ **Last updated:** [August 20, 2024, 1:07pm UTC](https://discuss.elastic.co/t/alerting-updating-the-role/364929 "2024-08-20T13:07:06Z")
In rules, you have to specify a role visibility: So how can I update this? I chose the wrong the role and now the option is missing from my rule: . --- ## [How to get documents added as-is due to fields with dot in them?](https://discuss.elastic.co/t/how-to-get-documents-added-as-is-due-to-fields-with-dot-in-them/365165)
**Author:** [@Michael\_Carter](https://discuss.elastic.co/u/Michael_Carter)\ **Replies:** 5\ **Last updated:** [August 20, 2024, 12:33pm UTC](https://discuss.elastic.co/t/how-to-get-documents-added-as-is-due-to-fields-with-dot-in-them/365165 "2024-08-20T12:33:51Z")
So basically I've got this json file being generated by a system that didn't know how to write json files. Here's the example of my problem: {"snapshot.updated\_by.uid": "mcarter", "snapshot.updated\_by": "michael cart… --- ## [Elastic agent override existing index/datastream](https://discuss.elastic.co/t/elastic-agent-override-existing-index-datastream/363705)
**Author:** [@Mihovil\_Maricic](https://discuss.elastic.co/u/Mihovil_Maricic)\ **Replies:** 6\ **Last updated:** [August 20, 2024, 12:13pm UTC](https://discuss.elastic.co/t/elastic-agent-override-existing-index-datastream/363705 "2024-08-20T12:13:22Z")
Hi all, We have a use case where we use elastic-agent to populate the data where we inject our own document.\_id via the ingest pipeline and everything works fine at first glance. The thing is that when new data arrives… --- ## [Why metricbeat-7.2.0 indexes are created](https://discuss.elastic.co/t/why-metricbeat-7-2-0-indexes-are-created/365128)
**Author:** [@Anand\_Konagala](https://discuss.elastic.co/u/Anand_Konagala)\ **Replies:** 3\ **Last updated:** [August 20, 2024, 11:20am UTC](https://discuss.elastic.co/t/why-metricbeat-7-2-0-indexes-are-created/365128 "2024-08-20T11:20:03Z")
Hey, can anybody tell me. Why these indexes are created automatically.. Are they really important, Can I delete them metricbeat-7.2.0-2023.08.28-000002 0 p STARTED 52673106 15.7gb 10.222.21.245 node-2 metricb… --- ## [.NET client suggest query issue](https://discuss.elastic.co/t/net-client-suggest-query-issue/365061)
**Author:** [@jahedi](https://discuss.elastic.co/u/jahedi)\ **Replies:** 5\ **Last updated:** [August 20, 2024, 11:06am UTC](https://discuss.elastic.co/t/net-client-suggest-query-issue/365061 "2024-08-20T11:06:48Z")
Hi, I had an issue using new .NET client v8. I used to use v7 client (NEST) but recently decided to migrate to v8 client. let me explain my issue in details. I have an index with this mappings: { "mappings": { … --- ## [Elastic 8.15.0 missing InlineScript](https://discuss.elastic.co/t/elastic-8-15-0-missing-inlinescript/364824)
**Author:** [@p4paul](https://discuss.elastic.co/u/p4paul)\ **Replies:** 5\ **Last updated:** [August 20, 2024, 10:40am UTC](https://discuss.elastic.co/t/elastic-8-15-0-missing-inlinescript/364824 "2024-08-20T10:40:51Z")
It seems that co.elastic.clients.elasticsearch.\_types.InlineScript has been removed from 8.15.0 (exists in 8.14.3)? Is this intended? If so how do I migrate existing code? InlineScript inlineScript = InlineScript.of… --- ## [Uploading models to elasticsearch](https://discuss.elastic.co/t/uploading-models-to-elasticsearch/365185)
**Author:** [@devashishpawar](https://discuss.elastic.co/u/devashishpawar)\ **Replies:** 1\ **Last updated:** [August 20, 2024, 10:39am UTC](https://discuss.elastic.co/t/uploading-models-to-elasticsearch/365185 "2024-08-20T10:39:22Z")
Hey there, I am looking for a way to upload trained models to self hosted elasticsearch clusters. I am aware we do have a LTR plugin for uploading the XGBoost models but is there any other way to do that? Or will these … --- ## [Is there any option to default the color themes in visualization libraries in kibana 8.x](https://discuss.elastic.co/t/is-there-any-option-to-default-the-color-themes-in-visualization-libraries-in-kibana-8-x/364815)
**Author:** [@tejashree](https://discuss.elastic.co/u/tejashree)\ **Replies:** 3\ **Last updated:** [August 20, 2024, 10:07am UTC](https://discuss.elastic.co/t/is-there-any-option-to-default-the-color-themes-in-visualization-libraries-in-kibana-8-x/364815 "2024-08-20T10:07:37Z")
We need to default the color codes in visulzation libraries since we have to keep changing the colors for standard dashboards. Please let us know if there is any option called themes in kibana --- ## [ElasticSearch Java Client FunctionScoreQuery score mismatch with Console score](https://discuss.elastic.co/t/elasticsearch-java-client-functionscorequery-score-mismatch-with-console-score/365081)
**Author:** [@mantegna](https://discuss.elastic.co/u/mantegna)\ **Replies:** 1\ **Last updated:** [August 20, 2024, 9:58am UTC](https://discuss.elastic.co/t/elasticsearch-java-client-functionscorequery-score-mismatch-with-console-score/365081 "2024-08-20T09:58:56Z")
Consider I have the following function score query with an idea to find all animals by tags, and score them by mustHaveTags occurances: POST /animals/\_search { "size": 10, "query": { "function\_score": { "q… --- ## [How many nodes are required for 10 TB of data?](https://discuss.elastic.co/t/how-many-nodes-are-required-for-10-tb-of-data/365133)
**Author:** [@AnushreeRaikar](https://discuss.elastic.co/u/AnushreeRaikar)\ **Replies:** 14\ **Last updated:** [August 20, 2024, 9:48am UTC](https://discuss.elastic.co/t/how-many-nodes-are-required-for-10-tb-of-data/365133 "2024-08-20T09:48:59Z")
Data Size: 6.8 TB Monthly Increase: 150 GB Time Period: 18 months Calculation: Total Increase in Data: Total Increase=150GB/month×18months=2700GB=2.7TB Total Data Size After 18 Months: Final Data Size=6.8TB+2.7TB=… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=182) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=184)