# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=195 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 196 --- ## [Elastic Agent Not Sending Logs from Endpoint Outside the Network (AWS Cloud deployemnt on VM)](https://discuss.elastic.co/t/elastic-agent-not-sending-logs-from-endpoint-outside-the-network-aws-cloud-deployemnt-on-vm/364122)
**Author:** [@ahmed\_fetoh](https://discuss.elastic.co/u/ahmed_fetoh)\ **Replies:** 0\ **Last updated:** [July 31, 2024, 8:40am UTC](https://discuss.elastic.co/t/elastic-agent-not-sending-logs-from-endpoint-outside-the-network-aws-cloud-deployemnt-on-vm/364122 "2024-07-31T08:40:29Z")
Hello! Description: I have deployed a setup on AWS with two VMs: One VM running Elasticsearch. Another VM running Kibana and Fleet Server. Issue: When I try to install an agent to collect logs from an endpoint, Ela… --- ## [Highlight fragments of fields that use the html\_strip char filter still contain HTML tags](https://discuss.elastic.co/t/highlight-fragments-of-fields-that-use-the-html-strip-char-filter-still-contain-html-tags/363994)
**Author:** [@paulmuller](https://discuss.elastic.co/u/paulmuller)\ **Replies:** 2\ **Last updated:** [July 30, 2024, 6:14pm UTC](https://discuss.elastic.co/t/highlight-fragments-of-fields-that-use-the-html-strip-char-filter-still-contain-html-tags/363994 "2024-07-30T18:14:36Z")
Why do highlight fragments of HTML-stripped fields still contain HTML tags? From all I know based on what the documentation says, I should get the stripped but highlighted text? Here's what I have. HTML analyzer GET /m… --- ## [How to find the Reason and Event of a warning](https://discuss.elastic.co/t/how-to-find-the-reason-and-event-of-a-warning/364055)
**Author:** [@t.h](https://discuss.elastic.co/u/t.h)\ **Replies:** 3\ **Last updated:** [July 31, 2024, 7:14am UTC](https://discuss.elastic.co/t/how-to-find-the-reason-and-event-of-a-warning/364055 "2024-07-31T07:14:22Z")
Hello, I got often this logstash warning. \[2024-07-30T13:39:05,486\]\[WARN \]\[logstash.filters.throttle\]\[main\]\[34074a72c3b9ba7bd86762d4ae78ed3b6314e6bcc23a9a4cf6c5707484cc7c58\] filters/LogStash::Filters::Throttle: timeslo… --- ## [Storing machine learning results in elasticsearch](https://discuss.elastic.co/t/storing-machine-learning-results-in-elasticsearch/364022)
**Author:** [@Septianingrum.17](https://discuss.elastic.co/u/Septianingrum.17)\ **Replies:** 1\ **Last updated:** [July 31, 2024, 7:04am UTC](https://discuss.elastic.co/t/storing-machine-learning-results-in-elasticsearch/364022 "2024-07-31T07:04:36Z")
Dear All, I have 2 elasticsearch nodes in 1 cluster, I give node 1 all roles except ml, node 2 I only give the ml role, when machine learning runs and displays the results, where are the ml results stored? on node 2 or … --- ## [Index name to match the pattern \`\`^.\*-\\d+\`](https://discuss.elastic.co/t/index-name-to-match-the-pattern-d/364098)
**Author:** [@sundar.s](https://discuss.elastic.co/u/sundar.s)\ **Replies:** 1\ **Last updated:** [July 31, 2024, 6:49am UTC](https://discuss.elastic.co/t/index-name-to-match-the-pattern-d/364098 "2024-07-31T06:49:47Z")
As per the Elastic search documentation, we could see that there is a prerequisite on the indexing name conventions. \*\*\`index name \[x\] does not match pattern \`\`^.\*-\\d+\` The index name’s regex pattern matching is a prer… --- ## [With default\_pipeline, restHighLevelClient's bulkProcessor can't insert records](https://discuss.elastic.co/t/with-default-pipeline-resthighlevelclients-bulkprocessor-cant-insert-records/364015)
**Author:** [@jimmy0](https://discuss.elastic.co/u/jimmy0)\ **Replies:** 3\ **Last updated:** [July 31, 2024, 6:48am UTC](https://discuss.elastic.co/t/with-default-pipeline-resthighlevelclients-bulkprocessor-cant-insert-records/364015 "2024-07-31T06:48:36Z")
with default\_pipeline PUT \_ingest/pipeline/lzm\_pipeline { "description" : "lzm pipeline", "processors" : \[ { "set": { "field": "ts", "value": "{{\_ingest.timestamp}}" } } \] } r… --- ## [How can I sort all 176 documents by location\_details.circle.gps given that bucket\_sort only sorts the first 10 elements and cannot be used with composite aggregations?](https://discuss.elastic.co/t/how-can-i-sort-all-176-documents-by-location-details-circle-gps-given-that-bucket-sort-only-sorts-the-first-10-elements-and-cannot-be-used-with-composite-aggregations/364067)
**Author:** [@Tirthankar\_Roy](https://discuss.elastic.co/u/Tirthankar_Roy)\ **Replies:** 0\ **Last updated:** [July 30, 2024, 2:11pm UTC](https://discuss.elastic.co/t/how-can-i-sort-all-176-documents-by-location-details-circle-gps-given-that-bucket-sort-only-sorts-the-first-10-elements-and-cannot-be-used-with-composite-aggregations/364067 "2024-07-30T14:11:47Z")
I have 176 documents and I want to sort them based on the location\_details.circle.gps field. Here is my mapping: "location\_details": { "properties": { "address": { "properties": { "area\_code": { "type": "keyword", "… --- ## [Getting error while connecting logstash to elastic](https://discuss.elastic.co/t/getting-error-while-connecting-logstash-to-elastic/363830)
**Author:** [@Amol\_Nagotkar](https://discuss.elastic.co/u/Amol_Nagotkar)\ **Replies:** 17\ **Last updated:** [July 31, 2024, 4:01am UTC](https://discuss.elastic.co/t/getting-error-while-connecting-logstash-to-elastic/363830 "2024-07-31T04:01:41Z")
Hi all, elastic -\> sudo docker run -d --name es01 --net elastic -p 9200:9200 -e "discovery.type=single-node" -it -m 2GB docker.elastic.co/elasticsearch/elasticsearch:8.14.3 kibana-\> sudo docker run -d --name kib01 --net… --- ## [Elastic Stack OS Migration](https://discuss.elastic.co/t/elastic-stack-os-migration/364083)
**Author:** [@Moe\_Hmaidan](https://discuss.elastic.co/u/Moe_Hmaidan)\ **Replies:** 4\ **Last updated:** [July 31, 2024, 12:57am UTC](https://discuss.elastic.co/t/elastic-stack-os-migration/364083 "2024-07-31T00:57:55Z")
Hello , We have a requirement where we need to migrate our ES cluster from CentOS 7 to Rocky 9. Cluster Details :- CentOS 7.9 Nodes 15 Nodes (3 master node, 12 data nodes) Stack Version 8.12.2 might upgrade to 8.14.3… --- ## [Customize \`value\_serializerer \` for the](https://discuss.elastic.co/t/customize-value-serializerer-for-the/364095)
**Author:** [@yeikel](https://discuss.elastic.co/u/yeikel)\ **Replies:** 3\ **Last updated:** [July 31, 2024, 12:55am UTC](https://discuss.elastic.co/t/customize-value-serializerer-for-the/364095 "2024-07-31T00:55:36Z")
Hi all, I am currently trying to leverage the Kafka output plugin and one of the options it exposes is the value\_serializerer field Sadly, the docs do not specify how to customize this value with a custom JAR (ie: com.… --- ## [SSL for Elastic Search](https://discuss.elastic.co/t/ssl-for-elastic-search/364043)
**Author:** [@elk.admin](https://discuss.elastic.co/u/elk.admin)\ **Replies:** 2\ **Last updated:** [July 31, 2024, 12:32am UTC](https://discuss.elastic.co/t/ssl-for-elastic-search/364043 "2024-07-31T00:32:40Z")
I have a elasticsearch instance running and I need to enable ssl in it . I created a csr file and gave it to the Certificate Authority for certificates. I received back 3 files - .cer, .p7b and .pem . How to use them in … --- ## [java.io.IOException: entity content is too long \[110846684\] for the configured buffer limit \[104857600\]](https://discuss.elastic.co/t/java-io-ioexception-entity-content-is-too-long-110846684-for-the-configured-buffer-limit-104857600/364086)
**Author:** [@Vansh\_Mohale](https://discuss.elastic.co/u/Vansh_Mohale)\ **Replies:** 0\ **Last updated:** [July 30, 2024, 7:18pm UTC](https://discuss.elastic.co/t/java-io-ioexception-entity-content-is-too-long-110846684-for-the-configured-buffer-limit-104857600/364086 "2024-07-30T19:18:12Z")
I am running ES through a docker image where I am trying to read a few documents from ES and then prepare a new document and then update them. While reading the documents I face this error. Here is the full stack trace: … --- ## [Discover: alerts-\* threshold/value displayed as 0 and not the actual decimal values](https://discuss.elastic.co/t/discover-alerts-threshold-value-displayed-as-0-and-not-the-actual-decimal-values/363874)
**Author:** [@kbujold\_wr](https://discuss.elastic.co/u/kbujold_wr)\ **Replies:** 1\ **Last updated:** [July 30, 2024, 5:48pm UTC](https://discuss.elastic.co/t/discover-alerts-threshold-value-displayed-as-0-and-not-the-actual-decimal-values/363874 "2024-07-30T17:48:33Z")
It appears Kibana is not displaying the decimal values for threshold/value in the alerts-\* indices on the Discover page. If you navigate to the "Expanded document" and select JSON then you see the actual values W… --- ## [Logstash--Using ruby to convert json to fields. Data going to elastic as text. How to set to long?](https://discuss.elastic.co/t/logstash-using-ruby-to-convert-json-to-fields-data-going-to-elastic-as-text-how-to-set-to-long/364075)
**Author:** [@Bhanu\_Praveen](https://discuss.elastic.co/u/Bhanu_Praveen)\ **Replies:** 1\ **Last updated:** [July 30, 2024, 4:46pm UTC](https://discuss.elastic.co/t/logstash-using-ruby-to-convert-json-to-fields-data-going-to-elastic-as-text-how-to-set-to-long/364075 "2024-07-30T16:46:47Z")
Logstash--Using ruby to convert JSON to fields. Data going to elastic as text. Pls let me know how to set to long type? Below is my json log string: { "traceId": "o0uyveRU/8BkjL+lbpDlnQ==", "spanId": "73rmqIRmo34=", … --- ## [Need to capture User input in Kibana](https://discuss.elastic.co/t/need-to-capture-user-input-in-kibana/359387)
**Author:** [@GlebCA](https://discuss.elastic.co/u/GlebCA)\ **Replies:** 2\ **Last updated:** [July 30, 2024, 4:11pm UTC](https://discuss.elastic.co/t/need-to-capture-user-input-in-kibana/359387 "2024-07-30T16:11:11Z")
Hi, We are using Elastic ML to detect anomalies. User receives an email with link to Kibana to see actual anomaly there. Now like to give User possibility to provide feedback for detected anomaly (thumb up/down plus a … --- ## [When to support Embeddings\_SQL](https://discuss.elastic.co/t/when-to-support-embeddings-sql/364064)
**Author:** [@trillionmonster](https://discuss.elastic.co/u/trillionmonster)\ **Replies:** 0\ **Last updated:** [July 30, 2024, 2:08pm UTC](https://discuss.elastic.co/t/when-to-support-embeddings-sql/364064 "2024-07-30T14:08:07Z")
Look at this page : when to support Embeddings\_SQL like this select text, translation(text, 'de', null) 'text (DE)', translation(text, 'es', null) 'text (ES)', translation(text, 'fr', null) 'text (FR)' from txtai whe… --- ## [Snapshot selected indices doesn't work](https://discuss.elastic.co/t/snapshot-selected-indices-doesnt-work/364010)
**Author:** [@sliu](https://discuss.elastic.co/u/sliu)\ **Replies:** 3\ **Last updated:** [July 30, 2024, 1:18pm UTC](https://discuss.elastic.co/t/snapshot-selected-indices-doesnt-work/364010 "2024-07-30T13:18:18Z")
I'm running Elasticsearch on aws ec2, self-hosting, and snapshot to s3. Snapshot works fine except that it always copy ALL indices. Here're commands I used: (1) curl -XPUT localhost:9200/\_snapshot/mybackup -H 'Content-T… --- ## [Elasticsearch fscrawler](https://discuss.elastic.co/t/elasticsearch-fscrawler/362731)
**Author:** [@Yemboaro](https://discuss.elastic.co/u/Yemboaro)\ **Replies:** 18\ **Last updated:** [July 30, 2024, 1:00pm UTC](https://discuss.elastic.co/t/elasticsearch-fscrawler/362731 "2024-07-30T13:00:17Z")
hello elastic community I use elasticsearch and fscrawler for the track of file but my problem is that large file upload is not processed by ocr however small files are processed well so I ask for your help on how to co… --- ## [Elasticsearch on Kubernetes](https://discuss.elastic.co/t/elasticsearch-on-kubernetes/364050)
**Author:** [@avnere](https://discuss.elastic.co/u/avnere)\ **Replies:** 0\ **Last updated:** [July 30, 2024, 12:01pm UTC](https://discuss.elastic.co/t/elasticsearch-on-kubernetes/364050 "2024-07-30T12:01:52Z")
Hi, I am checking the option to insert my elasticsearch cluster into Kubernetes. What are the Consequences? Is there any limitation? Will I get performance issue? --- ## [A tls handshake error on fleet server](https://discuss.elastic.co/t/a-tls-handshake-error-on-fleet-server/364045)
**Author:** [@aristotel](https://discuss.elastic.co/u/aristotel)\ **Replies:** 0\ **Last updated:** [July 30, 2024, 11:46am UTC](https://discuss.elastic.co/t/a-tls-handshake-error-on-fleet-server/364045 "2024-07-30T11:46:22Z")
I'm running fleet agent on Nomad environment. The logs giving this error http: TLS handshake error from x.x.x.x:yyyy EOF\\n","component":{"binary":"fleet-server","dataset":"elastic\_agent.fleet\_server","id":"fleet-server… --- ## [Bulk searching in approximate kNN](https://discuss.elastic.co/t/bulk-searching-in-approximate-knn/364027)
**Author:** [@duty\_sloth](https://discuss.elastic.co/u/duty_sloth)\ **Replies:** 1\ **Last updated:** [July 30, 2024, 11:28am UTC](https://discuss.elastic.co/t/bulk-searching-in-approximate-knn/364027 "2024-07-30T11:28:21Z")
Hi, I tried using bulk search in my approximate kNN (aNN) searches to improve throughput and it did help. However I cannot understand from the results which hit referes to which query\_vector. For example if I search f… --- ## [Yml in inputs.d is not being read](https://discuss.elastic.co/t/yml-in-inputs-d-is-not-being-read/364030)
**Author:** [@riahc3](https://discuss.elastic.co/u/riahc3)\ **Replies:** 0\ **Last updated:** [July 30, 2024, 8:06am UTC](https://discuss.elastic.co/t/yml-in-inputs-d-is-not-being-read/364030 "2024-07-30T08:06:27Z")
Hello I put a yml file in inputs.d (/opt/Elastic/Agent/inputs.d) but it isnt being uploaded (I should see a new listening port) AFAIK, its just put it in there and done. Maybe I could see the Elastic Agent logs and t… --- ## [Changing timezone of instance for ilm and slm](https://discuss.elastic.co/t/changing-timezone-of-instance-for-ilm-and-slm/364026)
**Author:** [@kirik](https://discuss.elastic.co/u/kirik)\ **Replies:** 0\ **Last updated:** [July 30, 2024, 6:57am UTC](https://discuss.elastic.co/t/changing-timezone-of-instance-for-ilm-and-slm/364026 "2024-07-30T06:57:17Z")
Hi, I have elasticsearch running on one instance, logstash and kibana together on another separate instance with UTC timezone, so ilm and slm policy is running according to the UTC timezone. If I change the both server … --- ## [How can I change data type of a field in Filebeat index](https://discuss.elastic.co/t/how-can-i-change-data-type-of-a-field-in-filebeat-index/363946)
**Author:** [@Mahnaz\_Haghighi](https://discuss.elastic.co/u/Mahnaz_Haghighi)\ **Replies:** 2\ **Last updated:** [July 30, 2024, 6:42am UTC](https://discuss.elastic.co/t/how-can-i-change-data-type-of-a-field-in-filebeat-index/363946 "2024-07-30T06:42:18Z")
Hi.I have a string field in my Filebeat index. When I want to make a visualization with that field I cant find it in list of terms. How can I make it aggregatable? --- ## [How to hide create visualizations button in Kibana dashboard using iframe](https://discuss.elastic.co/t/how-to-hide-create-visualizations-button-in-kibana-dashboard-using-iframe/363956)
**Author:** [@tejashree](https://discuss.elastic.co/u/tejashree)\ **Replies:** 4\ **Last updated:** [July 30, 2024, 5:00am UTC](https://discuss.elastic.co/t/how-to-hide-create-visualizations-button-in-kibana-dashboard-using-iframe/363956 "2024-07-30T05:00:52Z")
I need to hide the create visualizations button to specific users, Users should have edit access to dashboards without access to create visualization button. Please let know --- ## [Beats on AIX](https://discuss.elastic.co/t/beats-on-aix/363965)
**Author:** [@swapnilww](https://discuss.elastic.co/u/swapnilww)\ **Replies:** 1\ **Last updated:** [July 29, 2024, 11:13am UTC](https://discuss.elastic.co/t/beats-on-aix/363965 "2024-07-29T11:13:38Z")
Need some help for installing beat agents on AIX servers. --- ## [Single ELK Agent for Both Infrastructure and Application Management Needs?](https://discuss.elastic.co/t/single-elk-agent-for-both-infrastructure-and-application-management-needs/364004)
**Author:** [@airplay](https://discuss.elastic.co/u/airplay)\ **Replies:** 1\ **Last updated:** [July 30, 2024, 2:43am UTC](https://discuss.elastic.co/t/single-elk-agent-for-both-infrastructure-and-application-management-needs/364004 "2024-07-30T02:43:12Z")
Hello everyone, There are two separate departments in the company I work for. One is Infrastructure and the other is Application Management. Infrastructure says this; I only want to access CPU, RAM, Disk, Network metr… --- ## [When will 8.15.0 be released?](https://discuss.elastic.co/t/when-will-8-15-0-be-released/363987)
**Author:** [@i\_ichar](https://discuss.elastic.co/u/i_ichar)\ **Replies:** 3\ **Last updated:** [July 30, 2024, 2:23am UTC](https://discuss.elastic.co/t/when-will-8-15-0-be-released/363987 "2024-07-30T02:23:28Z")
When will 8.15.0 be released? --- ## [Filter index to get the field max value](https://discuss.elastic.co/t/filter-index-to-get-the-field-max-value/363438)
**Author:** [@Liam619](https://discuss.elastic.co/u/Liam619)\ **Replies:** 2\ **Last updated:** [July 30, 2024, 1:53am UTC](https://discuss.elastic.co/t/filter-index-to-get-the-field-max-value/363438 "2024-07-30T01:53:02Z")
Hi everyone, I'm trying to filter my index to display based on the field max value. I searched around the internet but couldn't understand how to do it. Currently running kibana 7.17.1 Below is the sample index, what I… --- ## ["How can I divide a rule into specific time frames in Kibana?](https://discuss.elastic.co/t/how-can-i-divide-a-rule-into-specific-time-frames-in-kibana/363815)
**Author:** [@Marek\_Galbavy](https://discuss.elastic.co/u/Marek_Galbavy)\ **Replies:** 2\ **Last updated:** [July 29, 2024, 11:09pm UTC](https://discuss.elastic.co/t/how-can-i-divide-a-rule-into-specific-time-frames-in-kibana/363815 "2024-07-29T23:09:05Z")
For example, if I want a rule to check logs every 10 hours and apply a 1-hour span for analysis, how would I set this up?" This is my rule: from logs-\* | WHERE (CIDR\_MATCH(source.ip, "10.0.0.0/8") OR CIDR\_MATCH(source… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=194) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=196)