# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=19 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 20 --- ## [Completion Suggester Sorting](https://discuss.elastic.co/t/completion-suggester-sorting/384873)
**Author:** [@Pathwax](https://discuss.elastic.co/u/Pathwax)\ **Replies:** 1\ **Last updated:** [February 9, 2026, 8:15pm UTC](https://discuss.elastic.co/t/completion-suggester-sorting/384873 "2026-02-09T20:15:18Z")
Hi, I created an index that only contains the suggest property: PUT /test { "mappings": { "properties": { "suggest": { "type": "completion", "analyzer": "standard", "preserve\_separat… --- ## [Corrupted S3 Repository: 1.3M Metadata lines & snapshot\_missing\_exception (Cluster size: 6.5 TB)](https://discuss.elastic.co/t/corrupted-s3-repository-1-3m-metadata-lines-snapshot-missing-exception-cluster-size-6-5-tb/384970)
**Author:** [@Disha\_Vala](https://discuss.elastic.co/u/Disha_Vala)\ **Replies:** 1\ **Last updated:** [February 9, 2026, 12:31pm UTC](https://discuss.elastic.co/t/corrupted-s3-repository-1-3m-metadata-lines-snapshot-missing-exception-cluster-size-6-5-tb/384970 "2026-02-09T12:31:41Z")
Hi Elastic Team, I am facing a repository corruption issue on Elasticsearch 8.5.3 and would appreciate guidance on how to perform a "surgical" repair of our snapshot metadata. The Situation: Cluster Scale: Our live cl… --- ## [Need to ingest a smaller logs using Custom Logs (Filestream) integration](https://discuss.elastic.co/t/need-to-ingest-a-smaller-logs-using-custom-logs-filestream-integration/384975)
**Author:** [@M311ow](https://discuss.elastic.co/u/M311ow)\ **Replies:** 0\ **Last updated:** [February 9, 2026, 10:15am UTC](https://discuss.elastic.co/t/need-to-ingest-a-smaller-logs-using-custom-logs-filestream-integration/384975 "2026-02-09T10:15:39Z")
Hi, I encounter the issue about the log ingestion. Currently, I have a cluster with the less of microservices and logs and I need to ingest all of that logs to the Kibana. I have use the Elastic Agent with the Custom … --- ## [Vulnerability Apache Tika 1.13 \< 3.2.2 XXE (CVE-2025-66516) and Apache Log4j 2.0-beta9 \< 2.25.3 MitM in VA scan report of server](https://discuss.elastic.co/t/vulnerability-apache-tika-1-13-3-2-2-xxe-cve-2025-66516-and-apache-log4j-2-0-beta9-2-25-3-mitm-in-va-scan-report-of-server/384881)
**Author:** [@Ravinder07Sharma](https://discuss.elastic.co/u/Ravinder07Sharma)\ **Replies:** 1\ **Last updated:** [February 9, 2026, 10:09am UTC](https://discuss.elastic.co/t/vulnerability-apache-tika-1-13-3-2-2-xxe-cve-2025-66516-and-apache-log4j-2-0-beta9-2-25-3-mitm-in-va-scan-report-of-server/384881 "2026-02-09T10:09:04Z")
we are running Elasticsearch-8.17.10 on 6 RHEL 8 servers. But we are getting vulnerability Apache Tika 1.13 \< 3.2.2 XXE (CVE-2025-66516) and Apache Log4j 2.0-beta9 \< 2.25.3 MitM in VA scan report of server. log4j vulnera… --- ## [Upgrade assistant can not migrate system indeces during upgrade from 8.18.10 to 9 version](https://discuss.elastic.co/t/upgrade-assistant-can-not-migrate-system-indeces-during-upgrade-from-8-18-10-to-9-version/384973)
**Author:** [@GyurkanMehmed](https://discuss.elastic.co/u/GyurkanMehmed)\ **Replies:** 1\ **Last updated:** [February 9, 2026, 9:20am UTC](https://discuss.elastic.co/t/upgrade-assistant-can-not-migrate-system-indeces-during-upgrade-from-8-18-10-to-9-version/384973 "2026-02-09T09:20:47Z")
I have two clusters which i am trying to upgade to 9.1.0 from 8.18.10, but migrate system indices throws async\_search: illegal\_state\_exception, so I can not proceed with the upgrade. Both cluster were originally 7v and … --- ## [Failed to decrypt report job data. Please ensure that xpack.reporting.encryptionKey is set and re-generate this report](https://discuss.elastic.co/t/failed-to-decrypt-report-job-data-please-ensure-that-xpack-reporting-encryptionkey-is-set-and-re-generate-this-report/384933)
**Author:** [@francescoa](https://discuss.elastic.co/u/francescoa)\ **Replies:** 2\ **Last updated:** [February 9, 2026, 9:10am UTC](https://discuss.elastic.co/t/failed-to-decrypt-report-job-data-please-ensure-that-xpack-reporting-encryptionkey-is-set-and-re-generate-this-report/384933 "2026-02-09T09:10:10Z")
Hi everyone :slight\_smile: I’m new here, I signed up because we’re having some issues with Kibana and I’m hoping someone can help :heart: We have Kibana v8.13.4 exposed on an AWS EC2 instance. It’s the only one Kibana … --- ## [ElasticSearch in kubernetes is failling with Bad\_certificate](https://discuss.elastic.co/t/elasticsearch-in-kubernetes-is-failling-with-bad-certificate/384959)
**Author:** [@senbe](https://discuss.elastic.co/u/senbe)\ **Replies:** 0\ **Last updated:** [February 8, 2026, 1:27pm UTC](https://discuss.elastic.co/t/elasticsearch-in-kubernetes-is-failling-with-bad-certificate/384959 "2026-02-08T13:27:31Z")
We setup a Elasticsearch using the eck-stack github repo and let elasticsearch creates its own CA transport certificate. within sometimes, we see the Elasticsearch is moving from green to yellow On analysis, we observed… --- ## [Read latest logs from a file](https://discuss.elastic.co/t/read-latest-logs-from-a-file/384957)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 1\ **Last updated:** [February 8, 2026, 10:06am UTC](https://discuss.elastic.co/t/read-latest-logs-from-a-file/384957 "2026-02-08T10:06:09Z")
Hello Folks, I have one log file and it is containing all logs since November 2025 to till now. For doing the parsing of logs i’ve copy-paste sample logs to test.log file and it worked. My question is How to read last… --- ## [The preprocessing for selecting values does not work in discover](https://discuss.elastic.co/t/the-preprocessing-for-selecting-values-does-not-work-in-discover/384951)
**Author:** [@Ruslan\_Hafizov](https://discuss.elastic.co/u/Ruslan_Hafizov)\ **Replies:** 2\ **Last updated:** [February 7, 2026, 8:00am UTC](https://discuss.elastic.co/t/the-preprocessing-for-selecting-values-does-not-work-in-discover/384951 "2026-02-07T08:00:02Z")
When selecting a field in the left menu, no selection is displayed by field. Despite the fact that the value itself is in the index. I couldn't find information in the documentation on how this function works to check wh… --- ## [Elasticsearch upgrade from 7 to 8](https://discuss.elastic.co/t/elasticsearch-upgrade-from-7-to-8/384901)
**Author:** [@zaeemmasood](https://discuss.elastic.co/u/zaeemmasood)\ **Replies:** 5\ **Last updated:** [February 6, 2026, 9:27pm UTC](https://discuss.elastic.co/t/elasticsearch-upgrade-from-7-to-8/384901 "2026-02-06T21:27:27Z")
Hi All, Our current cluster is running on elasticsearch version 7.17.3 and we are planning to upgrade to version 8.15.2 (hopefully an allowed version) We want to adopt a "rolling upgrade" doing one instance at a time. … --- ## [Graylog + Metricbeat + IIS](https://discuss.elastic.co/t/graylog-metricbeat-iis/384950)
**Author:** [@Lev\_Anni](https://discuss.elastic.co/u/Lev_Anni)\ **Replies:** 0\ **Last updated:** [February 6, 2026, 7:20pm UTC](https://discuss.elastic.co/t/graylog-metricbeat-iis/384950 "2026-02-06T19:20:40Z")
Guys, I want to get IIS performance metrics from my IIS servers to use them in Graylog. Metribeat has this nice IIS module but it can not retrieve CPU usage per site, only globally. I can get per site application pool c… --- ## [Hide Entitlement warnings?](https://discuss.elastic.co/t/hide-entitlement-warnings/384929)
**Author:** [@buitcj](https://discuss.elastic.co/u/buitcj)\ **Replies:** 2\ **Last updated:** [February 6, 2026, 5:32pm UTC](https://discuss.elastic.co/t/hide-entitlement-warnings/384929 "2026-02-06T17:32:02Z")
Some of our elasticsearch installations are encountering warnings such as the following and I am wondering, since this is just a warning, is there any way to disable it or set the logging level lower to make this not app… --- ## [Best approach to monitor a Linux Service with the Elastic Agent?](https://discuss.elastic.co/t/best-approach-to-monitor-a-linux-service-with-the-elastic-agent/384916)
**Author:** [@fer.mt](https://discuss.elastic.co/u/fer.mt)\ **Replies:** 4\ **Last updated:** [February 6, 2026, 5:27pm UTC](https://discuss.elastic.co/t/best-approach-to-monitor-a-linux-service-with-the-elastic-agent/384916 "2026-02-06T17:27:12Z")
Hello! I have a software that is critical for us so we want to monitor its availability. We want to start by monitoring the process/service that it creates when running. The software runs on Linux systems. Currently, I … --- ## [ES loses quorum every hour](https://discuss.elastic.co/t/es-loses-quorum-every-hour/384937)
**Author:** [@elastic\_noob1](https://discuss.elastic.co/u/elastic_noob1)\ **Replies:** 3\ **Last updated:** [February 6, 2026, 2:02pm UTC](https://discuss.elastic.co/t/es-loses-quorum-every-hour/384937 "2026-02-06T14:02:12Z")
We have our clusters running for a few years now on 7.17 with java8. Due to company requirements, I upgraded the cluster to use java17. We use our own java binary due to company policies. Once the cluster was on java17, … --- ## [Logstash filter JSON parse error](https://discuss.elastic.co/t/logstash-filter-json-parse-error/384918)
**Author:** [@rokkotnik](https://discuss.elastic.co/u/rokkotnik)\ **Replies:** 7\ **Last updated:** [February 6, 2026, 12:42pm UTC](https://discuss.elastic.co/t/logstash-filter-json-parse-error/384918 "2026-02-06T12:42:06Z")
Hi, I keep getting json parse error and I’ve been playing with filter for hours. \[logstash.codecs.json \]\[main\]\[68389d\] JSON parse error, original data now in message field {:message=\>"Could not set field 'ip' on ob… --- ## [Creating an alarm that outputs the group name](https://discuss.elastic.co/t/creating-an-alarm-that-outputs-the-group-name/384911)
**Author:** [@tractor\_boy](https://discuss.elastic.co/u/tractor_boy)\ **Replies:** 2\ **Last updated:** [February 6, 2026, 9:31am UTC](https://discuss.elastic.co/t/creating-an-alarm-that-outputs-the-group-name/384911 "2026-02-06T09:31:24Z")
I am trying to build an alert that emits data via a web hook. The alert has grouping, so multiple alerts can fire an any one time. What I’ve not managed to do is get the group name to be included in the data sent throu… --- ## [Kibana needs more memory to generate this report. Check RAM requirements](https://discuss.elastic.co/t/kibana-needs-more-memory-to-generate-this-report-check-ram-requirements/384934)
**Author:** [@francescoa](https://discuss.elastic.co/u/francescoa)\ **Replies:** 0\ **Last updated:** [February 5, 2026, 5:15pm UTC](https://discuss.elastic.co/t/kibana-needs-more-memory-to-generate-this-report-check-ram-requirements/384934 "2026-02-05T17:15:29Z")
Hi everyone :slight\_smile: We have Kibana v8.13.4 exposed on an AWS EC2 instance. It’s the only one Kibana instance we have. When I try to create a report, the section Management \> Alerts and Insights \> Reporting somet… --- ## [Elasticsearch trial license downgraded to basic after pod recreation on Kubernetes](https://discuss.elastic.co/t/elasticsearch-trial-license-downgraded-to-basic-after-pod-recreation-on-kubernetes/384885)
**Author:** [@djeannerod](https://discuss.elastic.co/u/djeannerod)\ **Replies:** 1\ **Last updated:** [February 5, 2026, 4:55pm UTC](https://discuss.elastic.co/t/elasticsearch-trial-license-downgraded-to-basic-after-pod-recreation-on-kubernetes/384885 "2026-02-05T16:55:28Z")
I have deployed a ES stack on Kubernetes with the operator (ECK). Just ES + Kibana, and it is Ok. I’m trying to test some enterprise functions, and activate a trial licence, but elasticsearch reverts to a basic license … --- ## [ES|QL Invoke-WebRequest how to](https://discuss.elastic.co/t/es-ql-invoke-webrequest-how-to/384848)
**Author:** [@a11](https://discuss.elastic.co/u/a11)\ **Replies:** 1\ **Last updated:** [February 5, 2026, 3:24pm UTC](https://discuss.elastic.co/t/es-ql-invoke-webrequest-how-to/384848 "2026-02-05T15:24:19Z")
Hello, I’m trying to send a webrequest with a powershell script: { "query": """ FROM packetbeat-tls | WHERE dnsdomain.keyword == "%domain%" AND @timestamp \> NOW() - 7days | KEEP host.name.keyword, source.ip.keyword … --- ## [Elasticsearch Rule SMTP Action - How to include line breaks](https://discuss.elastic.co/t/elasticsearch-rule-smtp-action-how-to-include-line-breaks/384900)
**Author:** [@Elk\_huh](https://discuss.elastic.co/u/Elk_huh)\ **Replies:** 2\ **Last updated:** [February 5, 2026, 2:05pm UTC](https://discuss.elastic.co/t/elasticsearch-rule-smtp-action-how-to-include-line-breaks/384900 "2026-02-05T14:05:38Z")
{{#context.hits}} Source IP Address: {{\_source.src\_ip}} Message {{\_source.new\_port}} {{/context.hits}} I need spaces after every context entry , right now its all jammed together Source IP Address: Message Source … --- ## [SentinelOne Integration with ELK](https://discuss.elastic.co/t/sentinelone-integration-with-elk/384924)
**Author:** [@Jayesh\_Auti](https://discuss.elastic.co/u/Jayesh_Auti)\ **Replies:** 4\ **Last updated:** [February 5, 2026, 1:22pm UTC](https://discuss.elastic.co/t/sentinelone-integration-with-elk/384924 "2026-02-05T13:22:13Z")
Hi Guys, I am integrating SentinelOne with ELK, after adding console URL and API key it showing me to add elastic agent. Elastic agent is required for these type of integrations? Can anyone help me with this? Than… --- ## [Polar encircling geo\_shape geometry](https://discuss.elastic.co/t/polar-encircling-geo-shape-geometry/384919)
**Author:** [@jpolchlo](https://discuss.elastic.co/u/jpolchlo)\ **Replies:** 1\ **Last updated:** [February 5, 2026, 11:25am UTC](https://discuss.elastic.co/t/polar-encircling-geo-shape-geometry/384919 "2026-02-05T11:25:23Z")
I’ve been looking for an answer to this around the internet, but I want to get some clarity before sinking time into it. The question is whether geo\_shape geometry properly handles polar-encircling geometries. I haven’… --- ## [% by breaking subgroup](https://discuss.elastic.co/t/by-breaking-subgroup/384865)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 8\ **Last updated:** [February 4, 2026, 6:12pm UTC](https://discuss.elastic.co/t/by-breaking-subgroup/384865 "2026-02-04T18:12:52Z")
I have following record month client minute 1/1/25 A 100 1/1/25 B 100 2/1/25 A 100 2/1/25 B 100 I want to setup table vz by month aggregation 1/1/25 A 100 25% … --- ## [How to hash sensitive fields in Elasticsearch and show hash vs original based on user permissions?](https://discuss.elastic.co/t/how-to-hash-sensitive-fields-in-elasticsearch-and-show-hash-vs-original-based-on-user-permissions/384905)
**Author:** [@Abhi\_Abhishek](https://discuss.elastic.co/u/Abhi_Abhishek)\ **Replies:** 2\ **Last updated:** [February 4, 2026, 1:09pm UTC](https://discuss.elastic.co/t/how-to-hash-sensitive-fields-in-elasticsearch-and-show-hash-vs-original-based-on-user-permissions/384905 "2026-02-04T13:09:04Z")
We have some fields containing sensitive information, and we do not want all users to see the original values. We want to store these fields in a hashed form while indexing and control what different users can see. I h… --- ## [Index/Datastream Daily ingest size](https://discuss.elastic.co/t/index-datastream-daily-ingest-size/384801)
**Author:** [@Elk\_huh](https://discuss.elastic.co/u/Elk_huh)\ **Replies:** 2\ **Last updated:** [February 3, 2026, 8:07pm UTC](https://discuss.elastic.co/t/index-datastream-daily-ingest-size/384801 "2026-02-03T20:07:35Z")
I need to find out our daily ingest rate how do you do this for Datastreams how do you do this for Indices --- ## [Further enhance TOP ES|QL function please](https://discuss.elastic.co/t/further-enhance-top-es-ql-function-please/384898)
**Author:** [@RainTown](https://discuss.elastic.co/u/RainTown)\ **Replies:** 0\ **Last updated:** [February 3, 2026, 7:50pm UTC](https://discuss.elastic.co/t/further-enhance-top-es-ql-function-please/384898 "2026-02-03T19:50:22Z")
Now that 9.3.0 is out, I notice this added (and very useful) ES|QL feature: Support extra field (outputField) in TOP function. Values of outputField will be returned instead of values of field , as discussed here and t… --- ## [Elastic Stack 9.3?](https://discuss.elastic.co/t/elastic-stack-9-3/384875)
**Author:** [@gauchj](https://discuss.elastic.co/u/gauchj)\ **Replies:** 5\ **Last updated:** [February 3, 2026, 2:57pm UTC](https://discuss.elastic.co/t/elastic-stack-9-3/384875 "2026-02-03T14:57:03Z")
We just upgraded our elastic stack from 8.19 to 9.2. When upgrading kibana (elasticsearch on 9.2.4), we get an error: kibana 9.3 cannot communicate to elasticsearch 9.2.4. There is no announcement on the release notes, … --- ## [Panic: runtime error: makeslice: cap out of range](https://discuss.elastic.co/t/panic-runtime-error-makeslice-cap-out-of-range/384887)
**Author:** [@whanklee](https://discuss.elastic.co/u/whanklee)\ **Replies:** 0\ **Last updated:** [February 3, 2026, 2:00pm UTC](https://discuss.elastic.co/t/panic-runtime-error-makeslice-cap-out-of-range/384887 "2026-02-03T14:00:55Z")
Packetbeat 9.3.0 crashes with Go panic in DHCPv4 parser (makeslice: cap out of range) on Ubuntu 24 Environment • OS: Ubuntu Server 24.04 LTS (amd64) • Packetbeat version: packetbeat version 9.3.0 (amd64) libbeat 9… --- ## [Palo Alto logs not being Ingested](https://discuss.elastic.co/t/palo-alto-logs-not-being-ingested/384882)
**Author:** [@diego.roldan](https://discuss.elastic.co/u/diego.roldan)\ **Replies:** 0\ **Last updated:** [February 3, 2026, 12:02pm UTC](https://discuss.elastic.co/t/palo-alto-logs-not-being-ingested/384882 "2026-02-03T12:02:00Z")
Hi, I’m using Elastic Serverless and trying to ingest Palo Alto Next-Gen Firewall logs using the official Palo Alto integration. The issue appears when using an Elastic Agent on Rocky Linux. The integration is configur… --- ## [Elastic self manage / architecture](https://discuss.elastic.co/t/elastic-self-manage-architecture/384856)
**Author:** [@jatin3101](https://discuss.elastic.co/u/jatin3101)\ **Replies:** 2\ **Last updated:** [February 3, 2026, 11:27am UTC](https://discuss.elastic.co/t/elastic-self-manage-architecture/384856 "2026-02-03T11:27:46Z")
Hello everyone ! i am very new to elastic and while going through the documentation i was not able to find somethings ,so if possible help me understand these and also provide the documentation link so i can verify (in … [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=18) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=20)