# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=2 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 3 --- ## [CISA KEV integration upgrade to 1.10](https://discuss.elastic.co/t/cisa-kev-integration-upgrade-to-1-10/388850)
**Author:** [@rklee](https://discuss.elastic.co/u/rklee)\ **Replies:** 1\ **Last updated:** [September 29, 2026, 7:59pm UTC](https://discuss.elastic.co/t/cisa-kev-integration-upgrade-to-1-10/388850 "2026-09-29T19:59:16Z")
So I was on a CISA KEV integration before version 1.7. I upgraded it to 1.10 and vulnerability reports are not coming in anymore. The integration says to re-enter configuration details and re-enable the package. However … --- ## [Filebeat postgresql log module produces timestamp fields that are not indexable when using ECS](https://discuss.elastic.co/t/filebeat-postgresql-log-module-produces-timestamp-fields-that-are-not-indexable-when-using-ecs/390640)
**Author:** [@kriller](https://discuss.elastic.co/u/kriller)\ **Replies:** 3\ **Last updated:** [September 29, 2026, 1:41pm UTC](https://discuss.elastic.co/t/filebeat-postgresql-log-module-produces-timestamp-fields-that-are-not-indexable-when-using-ecs/390640 "2026-09-29T13:41:32Z")
When using the ingest-pipeline that filebeat creates for postgresql logs, the resulting event contains the field postgresql.log.timestamp which conflicts with the ecs@mappings component template. The filebeat-9.5.4-post… --- ## [Capture Elasticsearch diagnostics](https://discuss.elastic.co/t/capture-elasticsearch-diagnostics/390628)
**Author:** [@smm](https://discuss.elastic.co/u/smm)\ **Replies:** 2\ **Last updated:** [September 28, 2026, 7:19am UTC](https://discuss.elastic.co/t/capture-elasticsearch-diagnostics/390628 "2026-09-28T07:19:28Z")
Hi there, very soon I am going to purchase elastic licence. In a prior company I had also elastic licences and was used to use the Elasticsearch diagnostics script by the support to collect cluster health parameters. M… --- ## [Logstash at Tenant end or server end?](https://discuss.elastic.co/t/logstash-at-tenant-end-or-server-end/390608)
**Author:** [@searchwithme](https://discuss.elastic.co/u/searchwithme)\ **Replies:** 1\ **Last updated:** [September 25, 2026, 10:59pm UTC](https://discuss.elastic.co/t/logstash-at-tenant-end-or-server-end/390608 "2026-09-25T22:59:52Z")
I’m trying to design an architecture where multiple tenants ingest their logs into Elastic. My understanding is that if the requirement is primarily log collection, I can use Elastic Agent, and if additional enrichment,… --- ## [Time picker in ES|QL query - esql](https://discuss.elastic.co/t/time-picker-in-es-ql-query-esql/390631)
**Author:** [@dot-mike](https://discuss.elastic.co/u/dot-mike)\ **Replies:** 2\ **Last updated:** [September 25, 2026, 1:55pm UTC](https://discuss.elastic.co/t/time-picker-in-es-ql-query-esql/390631 "2026-09-25T13:55:30Z")
Hi community, I was wondering about a weird behaviour that might catch some people off-guard. How does the time picker affect ES|QL searches? For example the following query implies a 24-hour search, but yet the data d… --- ## [Filebeat performance, 430 containers](https://discuss.elastic.co/t/filebeat-performance-430-containers/390622)
**Author:** [@zerkms](https://discuss.elastic.co/u/zerkms)\ **Replies:** 0\ **Last updated:** [September 24, 2026, 5:18am UTC](https://discuss.elastic.co/t/filebeat-performance-430-containers/390622 "2026-09-24T05:18:13Z")
I'm migrating from quite an old ES+fluentbit configuration (logging solution for a small kubernetes cluster). And this is quite simple yet inefficient (?) config I came up with (this file is generated by ECK using the B… --- ## [ILM unable to delete old index since upgrade to 8.19.20](https://discuss.elastic.co/t/ilm-unable-to-delete-old-index-since-upgrade-to-8-19-20/390601)
**Author:** [@numpty-boy](https://discuss.elastic.co/u/numpty-boy)\ **Replies:** 0\ **Last updated:** [September 23, 2026, 8:58am UTC](https://discuss.elastic.co/t/ilm-unable-to-delete-old-index-since-upgrade-to-8-19-20/390601 "2026-09-23T08:58:47Z")
Morning Team, Since upgrading to 8.19.20, I've started getting these errors: policy \[.fleet-actions-results-ilm-policy\] for index \[.ds-.fleet-actions-results-2026.05.02-000014\] on an error step due to a transient error… --- ## [Field formatters in ES|QL table panels](https://discuss.elastic.co/t/field-formatters-in-es-ql-table-panels/390418)
**Author:** [@tallakh](https://discuss.elastic.co/u/tallakh)\ **Replies:** 1\ **Last updated:** [September 23, 2026, 8:07am UTC](https://discuss.elastic.co/t/field-formatters-in-es-ql-table-panels/390418 "2026-09-23T08:07:19Z")
Hi! We have started to use ES|QL a lot in our Kibana dashboards, and I love the flexibility it brings! One of the few missing features compared to Lens table panels is to set formatting on a text/keyword field. F ex a l… --- ## [Integration-level Outputs](https://discuss.elastic.co/t/integration-level-outputs/390582)
**Author:** [@jameswiggins](https://discuss.elastic.co/u/jameswiggins)\ **Replies:** 3\ **Last updated:** [September 22, 2026, 8:17pm UTC](https://discuss.elastic.co/t/integration-level-outputs/390582 "2026-09-22T20:17:35Z")
I'm trying to determine how to configure integration-level outputs: Set integration-level outputs | Elastic Docs I followed the instructions for configuring, but do not see the option. Can someone share a screenshot of… --- ## [Kibana 9 - Detail dialog also shows "Truncated string" as configured for the overview](https://discuss.elastic.co/t/kibana-9-detail-dialog-also-shows-truncated-string-as-configured-for-the-overview/390551)
**Author:** [@poifir](https://discuss.elastic.co/u/poifir)\ **Replies:** 0\ **Last updated:** [September 21, 2026, 11:49am UTC](https://discuss.elastic.co/t/kibana-9-detail-dialog-also-shows-truncated-string-as-configured-for-the-overview/390551 "2026-09-21T11:49:22Z")
In the new Kibana 9 UI it's possible to customize the column visualization with "Edit data view field". This allows to e.g. enable to truncate a field to the first x characters so it only needs a reasonable size i… --- ## [Kibana Dark Theme Now Blue?](https://discuss.elastic.co/t/kibana-dark-theme-now-blue/377919)
**Author:** [@MakoWish](https://discuss.elastic.co/u/MakoWish)\ **Replies:** 4\ **Last updated:** [September 21, 2026, 9:26am UTC](https://discuss.elastic.co/t/kibana-dark-theme-now-blue/377919 "2026-09-21T09:26:32Z")
In Kibana versions up to 8.18.1, the dark theme was black, just as with almost all other software I have used that offers a dark theme. I just upgraded my company's DEV cluster, as well as my home cluster, to 9.0.1, and … --- ## [SAN required in cert?](https://discuss.elastic.co/t/san-required-in-cert/390541)
**Author:** [@rik](https://discuss.elastic.co/u/rik)\ **Replies:** 2\ **Last updated:** [September 20, 2026, 7:06pm UTC](https://discuss.elastic.co/t/san-required-in-cert/390541 "2026-09-20T19:06:49Z")
I am trying to use an ES service from a remote machine, using the cert copied from the container: podman cp app:/usr/share/elasticsearch/config/certs But simply doing a client.info() I am getting a elastic\_transport.Co… --- ## [java.nio.file.NoSuchFileException: /usr/share/elasticsearch/data/\_state/\_pu2t.cfs](https://discuss.elastic.co/t/java-nio-file-nosuchfileexception-usr-share-elasticsearch-data-state-pu2t-cfs/390250)
**Author:** [@TheJ](https://discuss.elastic.co/u/TheJ)\ **Replies:** 15\ **Last updated:** [September 19, 2026, 6:07pm UTC](https://discuss.elastic.co/t/java-nio-file-nosuchfileexception-usr-share-elasticsearch-data-state-pu2t-cfs/390250 "2026-09-19T18:07:12Z")
Hi, I have a problem with one of my elasticsearch node. For some reason node was shutdown due to some error. When I look into the log, I get the error java.nio.file.NoSuchFileException: /usr/share/elasticsearch/data/\_st… --- ## [Kibana error](https://discuss.elastic.co/t/kibana-error/390521)
**Author:** [@vanhung0709](https://discuss.elastic.co/u/vanhung0709)\ **Replies:** 1\ **Last updated:** [September 18, 2026, 4:17am UTC](https://discuss.elastic.co/t/kibana-error/390521 "2026-09-18T04:17:51Z")
I have set up elasticsearch and kibana. All steps have been done. Although i can curl es from kibana pod, kibana doesn’t put request to create index .kibana. When searching logs in pod kibana, it loop curl get nodes, but… --- ## [Upgrade from 7.17.9 to 8.19.18 to 9.4.3](https://discuss.elastic.co/t/upgrade-from-7-17-9-to-8-19-18-to-9-4-3/390473)
**Author:** [@sundar.s](https://discuss.elastic.co/u/sundar.s)\ **Replies:** 4\ **Last updated:** [September 17, 2026, 10:17am UTC](https://discuss.elastic.co/t/upgrade-from-7-17-9-to-8-19-18-to-9-4-3/390473 "2026-09-17T10:17:24Z")
Hi Team, I am trying to run upgrades on a dockerized ES environment. With indices created in 7.17.9, I am able to successfuly migrate to 8.19.18, by just bringing up a new container of ES 8.19.18 pointing to the same v… --- ## [Kibana 8.17.3 – Malware Detection of security\_labs Knowledge Base File (TROJ\_FRS.VSNTIA26)](https://discuss.elastic.co/t/kibana-8-17-3-malware-detection-of-security-labs-knowledge-base-file-troj-frs-vsntia26/390482)
**Author:** [@shiva3](https://discuss.elastic.co/u/shiva3)\ **Replies:** 0\ **Last updated:** [September 16, 2026, 10:21pm UTC](https://discuss.elastic.co/t/kibana-8-17-3-malware-detection-of-security-labs-knowledge-base-file-troj-frs-vsntia26/390482 "2026-09-16T22:21:06Z")
Hello Elastic Team, We are investigating a security alert involving the Kibana 8.17.3 Docker image deployed in our OpenShift environment. Our endpoint security product detected the following file as: Detection: TROJ\_F… --- ## [Filebeat with Salesforce input and batch](https://discuss.elastic.co/t/filebeat-with-salesforce-input-and-batch/390433)
**Author:** [@stephaniearce](https://discuss.elastic.co/u/stephaniearce)\ **Replies:** 1\ **Last updated:** [September 16, 2026, 5:59pm UTC](https://discuss.elastic.co/t/filebeat-with-salesforce-input-and-batch/390433 "2026-09-16T17:59:51Z")
Can anyone explain why I'm running into this issue? I copied the exact config from the docs here: Salesforce input | Beats Salesforce input: object.batch.enabled: true fails with "map has no entry for key batch\_start\_ti… --- ## [POSTFIX Ingest and the future of Logstash](https://discuss.elastic.co/t/postfix-ingest-and-the-future-of-logstash/390279)
**Author:** [@RalphDibney](https://discuss.elastic.co/u/RalphDibney)\ **Replies:** 6\ **Last updated:** [September 16, 2026, 12:40pm UTC](https://discuss.elastic.co/t/postfix-ingest-and-the-future-of-logstash/390279 "2026-09-16T12:40:22Z")
We have a mail gateway based on Postfix, and we want to get these logs into Elastic. For our product, our MSP that helps us with it has a logstash based integration that is also merges the mutliline log of postfix to on… --- ## [Unhealthy EDOT/OTEL Collector in Agent 9.4.x](https://discuss.elastic.co/t/unhealthy-edot-otel-collector-in-agent-9-4-x/388928)
**Author:** [@DavidA](https://discuss.elastic.co/u/DavidA)\ **Replies:** 1\ **Last updated:** [September 15, 2026, 7:09pm UTC](https://discuss.elastic.co/t/unhealthy-edot-otel-collector-in-agent-9-4-x/388928 "2026-09-15T19:09:34Z")
Environment: Elastic Agent / EDOT: 9.4.4 (build baed89504b1a1c0a7642d60dc0b6c1b0eb34f100, elastic-otel-collector service.version 9.4.4) OS: Ubuntu 24.04 (HP thin client) Fleet-managed, policy "Thin Client" Agent runtim… --- ## [Hot/Warm/Cold phases being ignored. Data goes directly to Cold](https://discuss.elastic.co/t/hot-warm-cold-phases-being-ignored-data-goes-directly-to-cold/389910)
**Author:** [@Alberto\_Martinez](https://discuss.elastic.co/u/Alberto_Martinez)\ **Replies:** 7\ **Last updated:** [September 15, 2026, 12:41pm UTC](https://discuss.elastic.co/t/hot-warm-cold-phases-being-ignored-data-goes-directly-to-cold/389910 "2026-09-15T12:41:27Z")
Hello, As the title says, all my streams share a common ILM policy but somehow it is ignored. All nodes are capable of hot/warm/cold. It is a recent setup and we don't have separate roles yet. Any pointer to wha… --- ## [Found not migrated detection alerts](https://discuss.elastic.co/t/found-not-migrated-detection-alerts/385044)
**Author:** [@CD9820](https://discuss.elastic.co/u/CD9820)\ **Replies:** 2\ **Last updated:** [September 10, 2026, 6:57pm UTC](https://discuss.elastic.co/t/found-not-migrated-detection-alerts/385044 "2026-09-10T18:57:35Z")
Hello we are planning our upgrade from 8.19.x to 9.2.x The upgrade assistant contains a warning for Kibana: "Found not migrated detection alerts" I have tried to migrate but this does not work (example with .reindexed… --- ## [Processing Heterogeneous IoT Logs with Fluent Bit and Elasticsearch Ingest Pipelines](https://discuss.elastic.co/t/processing-heterogeneous-iot-logs-with-fluent-bit-and-elasticsearch-ingest-pipelines/390311)
**Author:** [@cchaussat](https://discuss.elastic.co/u/cchaussat)\ **Replies:** 0\ **Last updated:** [September 10, 2026, 4:26pm UTC](https://discuss.elastic.co/t/processing-heterogeneous-iot-logs-with-fluent-bit-and-elasticsearch-ingest-pipelines/390311 "2026-09-10T16:26:18Z")
I would like to report on the experience of developing a simple home automation data collection and processing pipeline able to work with data and metrics from Domoticz and from many other various IoT devices and scripts… --- ## [HA-Cluster: Simple design on prem, self managed](https://discuss.elastic.co/t/ha-cluster-simple-design-on-prem-self-managed/390177)
**Author:** [@smm](https://discuss.elastic.co/u/smm)\ **Replies:** 12\ **Last updated:** [September 9, 2026, 5:33pm UTC](https://discuss.elastic.co/t/ha-cluster-simple-design-on-prem-self-managed/390177 "2026-09-09T17:33:34Z")
Hi there, I am looking for a simple HA-design for a logging use case, on prem & self managed. Would this be a good design? NODE-1 master, data, ingest, kibana, logstash, redis NODE-2 master, data, ingest, kibana, log… --- ## [Elastic Agent 9.3.7 CPU spikes](https://discuss.elastic.co/t/elastic-agent-9-3-7-cpu-spikes/390264)
**Author:** [@etrevino-lumificyber](https://discuss.elastic.co/u/etrevino-lumificyber)\ **Replies:** 1\ **Last updated:** [September 9, 2026, 1:36am UTC](https://discuss.elastic.co/t/elastic-agent-9-3-7-cpu-spikes/390264 "2026-09-09T01:36:06Z")
I mostly see the spiking when apps are being opened or occasionally while they are being used. I tested using standard apps like Outlook, Excel, Word, Chrome. Doing a search in Chrome for example caused a spike from 7% t… --- ## [Upgrading 8.13.0 - 8.19.20 giving migrations error for kibana\_analytics index](https://discuss.elastic.co/t/upgrading-8-13-0-8-19-20-giving-migrations-error-for-kibana-analytics-index/389786)
**Author:** [@drewb](https://discuss.elastic.co/u/drewb)\ **Replies:** 1\ **Last updated:** [September 8, 2026, 5:14pm UTC](https://discuss.elastic.co/t/upgrading-8-13-0-8-19-20-giving-migrations-error-for-kibana-analytics-index/389786 "2026-09-08T17:14:29Z")
Unable to complete saved object migrations for the .kibana\_analytics index. Unexpected Elasticsearch ResponseError: statuscode: 404, method: DELETE, url: /pit error: \[undefiend\]: ("succeeded":false,"num\_freed":0} My err… --- ## [Kibana Dev Tools Console does not execute full \_bulk request](https://discuss.elastic.co/t/kibana-dev-tools-console-does-not-execute-full-bulk-request/390219)
**Author:** [@Abdullah\_Hamza](https://discuss.elastic.co/u/Abdullah_Hamza)\ **Replies:** 1\ **Last updated:** [September 7, 2026, 4:30am UTC](https://discuss.elastic.co/t/kibana-dev-tools-console-does-not-execute-full-bulk-request/390219 "2026-09-07T04:30:33Z")
Description: When running a valid Elasticsearch Bulk API request in Kibana Dev Tools Console, the console does not appear to process all NDJSON operations as a single request. Example: POST /logs/\_bulk {"create":{}} {"@t… --- ## [Logstash Plugin logstash-filter-json\_encode vanishes between 9.x upgrades](https://discuss.elastic.co/t/logstash-plugin-logstash-filter-json-encode-vanishes-between-9-x-upgrades/387482)
**Author:** [@Jesselastic](https://discuss.elastic.co/u/Jesselastic)\ **Replies:** 1\ **Last updated:** [September 5, 2026, 12:51pm UTC](https://discuss.elastic.co/t/logstash-plugin-logstash-filter-json-encode-vanishes-between-9-x-upgrades/387482 "2026-09-05T12:51:22Z")
After upgrading to version 9.x + running plugin updates, the filter "logstash-filter-json\_encode" becomes absent from the system, and pipelines that use it begin to fail. Interestingly, when one does a list query for it… --- ## [System integration does not report filesystem metrics for network-mounted filesystem](https://discuss.elastic.co/t/system-integration-does-not-report-filesystem-metrics-for-network-mounted-filesystem/389722)
**Author:** [@Barbarossa](https://discuss.elastic.co/u/Barbarossa)\ **Replies:** 2\ **Last updated:** [September 3, 2026, 9:07pm UTC](https://discuss.elastic.co/t/system-integration-does-not-report-filesystem-metrics-for-network-mounted-filesystem/389722 "2026-09-03T21:07:15Z")
Hi, I’m collecting host metrics from my Elasticsearch nodes using the System integration. Filesystem metrics are collected correctly for all of my local mount points under /mnt/\*, for example /mnt/es\_data, but I’m not … --- ## [Security labs documentation via API call - ignoreSecurityLabs](https://discuss.elastic.co/t/security-labs-documentation-via-api-call-ignoresecuritylabs/389948)
**Author:** [@novst](https://discuss.elastic.co/u/novst)\ **Replies:** 2\ **Last updated:** [September 3, 2026, 2:25pm UTC](https://discuss.elastic.co/t/security-labs-documentation-via-api-call-ignoresecuritylabs/389948 "2026-09-03T14:25:11Z")
Hello, I am trying to automate installation for the customer and I want to install "Elastic documentation" and "Security labs" under http://localhost:5601/app/management/ai/genAiSettings According to documentation Crea… --- ## [A2A server authentication](https://discuss.elastic.co/t/a2a-server-authentication/390030)
**Author:** [@venkatkumar229](https://discuss.elastic.co/u/venkatkumar229)\ **Replies:** 1\ **Last updated:** [September 2, 2026, 5:03pm UTC](https://discuss.elastic.co/t/a2a-server-authentication/390030 "2026-09-02T17:03:35Z")
Hi Team, We have created a Custom AI Agent in Elasticsearch and are planning to access it from an external application through the A2A (Agent-to-Agent) Server. Currently, we understand that authentication to the A2A Se… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=1) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=3)