# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=206 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 207 --- ## [Max limit for query\_vector in kibana?](https://discuss.elastic.co/t/max-limit-for-query-vector-in-kibana/362710)
**Author:** [@Yoann\_Buzenet](https://discuss.elastic.co/u/Yoann_Buzenet)\ **Replies:** 2\ **Last updated:** [July 10, 2024, 5:33pm UTC](https://discuss.elastic.co/t/max-limit-for-query-vector-in-kibana/362710 "2024-07-10T17:33:21Z")
Hello, Is there a maximum size for query\_vector field in a search ? I am running into a behavior that I can't explain. Here are the details: I'm running this on Kibana 8.13.2 Here are the 3 steps to reproduce : Inde… --- ## [Getting shards from nodes and its data tier](https://discuss.elastic.co/t/getting-shards-from-nodes-and-its-data-tier/362887)
**Author:** [@yquirion](https://discuss.elastic.co/u/yquirion)\ **Replies:** 1\ **Last updated:** [July 10, 2024, 4:11pm UTC](https://discuss.elastic.co/t/getting-shards-from-nodes-and-its-data-tier/362887 "2024-07-10T16:11:11Z")
Gretting everyone! I'm having a question for you guys! Is there an API wil can use into ES to retrive the shards that are on a specific node showing the tier/phase they are in? By "tier/phase", I mean "data\_hot", "da… --- ## [Read huge elastic index with logstash](https://discuss.elastic.co/t/read-huge-elastic-index-with-logstash/360646)
**Author:** [@gueri](https://discuss.elastic.co/u/gueri)\ **Replies:** 1\ **Last updated:** [July 10, 2024, 4:04pm UTC](https://discuss.elastic.co/t/read-huge-elastic-index-with-logstash/360646 "2024-07-10T16:04:58Z")
Hi, I'm running Logstash 8.7 and reading from Elasticsearch 8.13. I want to retrieve all docs from an index with 18 millions logs and copy to Kafka. I thought Logstash was capable of doing that with the elasticsearch … --- ## [Delete lost primary shard](https://discuss.elastic.co/t/delete-lost-primary-shard/362888)
**Author:** [@ALIT](https://discuss.elastic.co/u/ALIT)\ **Replies:** 3\ **Last updated:** [July 10, 2024, 3:45pm UTC](https://discuss.elastic.co/t/delete-lost-primary-shard/362888 "2024-07-10T15:45:46Z")
Hi, due to running out of disk space, I reduced number of replicas to 0 for a few indices. Of course during this time one node had a disk failure and I think the data is lost. Now the cluster is red because one index h… --- ## [Logstash exec ruby script in docker](https://discuss.elastic.co/t/logstash-exec-ruby-script-in-docker/362895)
**Author:** [@Maeris](https://discuss.elastic.co/u/Maeris)\ **Replies:** 0\ **Last updated:** [July 10, 2024, 3:11pm UTC](https://discuss.elastic.co/t/logstash-exec-ruby-script-in-docker/362895 "2024-07-10T15:11:18Z")
Hi, I'm trying to execute a ruby script which prints json data to stdout. I have tried different versions, and right now testing with the most basic script: require 'json' json\_data = \[ { "uuid" =\> "noab14123dws11", … --- ## [Encryption In Elasticsearch](https://discuss.elastic.co/t/encryption-in-elasticsearch/360778)
**Author:** [@Debasis\_Mallick](https://discuss.elastic.co/u/Debasis_Mallick)\ **Replies:** 15\ **Last updated:** [July 10, 2024, 3:09pm UTC](https://discuss.elastic.co/t/encryption-in-elasticsearch/360778 "2024-07-10T15:09:37Z")
HI Team, We need to implement Encryption In Elasticsearch. As we know there are two types of encryption. Encryption in Transit. Encryption while data at REST. Please help us how to achieve the same. Thanks, Debasis … --- ## [KNN search with boost on specific field?](https://discuss.elastic.co/t/knn-search-with-boost-on-specific-field/362772)
**Author:** [@JdKock](https://discuss.elastic.co/u/JdKock)\ **Replies:** 6\ **Last updated:** [July 10, 2024, 2:36pm UTC](https://discuss.elastic.co/t/knn-search-with-boost-on-specific-field/362772 "2024-07-10T14:36:43Z")
Is it possible to do some tweaking with a KNN search? For example I have documents with a title, description, country and a category. I have created the embeddings with the E5 model for the title & description fields (… --- ## [Support for dynamic values in table\_prefix and date\_pattern in the BigQuery Logstash output plugin](https://discuss.elastic.co/t/support-for-dynamic-values-in-table-prefix-and-date-pattern-in-the-bigquery-logstash-output-plugin/362885)
**Author:** [@Deena\_Dayalan](https://discuss.elastic.co/u/Deena_Dayalan)\ **Replies:** 2\ **Last updated:** [July 10, 2024, 2:26pm UTC](https://discuss.elastic.co/t/support-for-dynamic-values-in-table-prefix-and-date-pattern-in-the-bigquery-logstash-output-plugin/362885 "2024-07-10T14:26:55Z")
Im using kafka and BigQuery as input and output plugins. Events coming from kafka are stored in BigQuery. But I want to attach the table\_prefix with some field in the events. For example, if the event contains "userId":… --- ## [Comparing two indexes in java](https://discuss.elastic.co/t/comparing-two-indexes-in-java/362837)
**Author:** [@always\_improving123](https://discuss.elastic.co/u/always_improving123)\ **Replies:** 1\ **Last updated:** [July 10, 2024, 1:58pm UTC](https://discuss.elastic.co/t/comparing-two-indexes-in-java/362837 "2024-07-10T13:58:01Z")
Hello! I am trying to efficiently compare two indexes, one index is formed of my own data (say of many nationalities and their average height) and the other index is incomplete data (only contains nationalities), where … --- ## [Elastic search query - parent child permissions](https://discuss.elastic.co/t/elastic-search-query-parent-child-permissions/362824)
**Author:** [@anuj99](https://discuss.elastic.co/u/anuj99)\ **Replies:** 0\ **Last updated:** [July 9, 2024, 10:10pm UTC](https://discuss.elastic.co/t/elastic-search-query-parent-child-permissions/362824 "2024-07-09T22:10:57Z")
I have the following use case : I have multiple folders each having associated accesses for users and teams. Each folder is associated with multiple files and inherits the folder permissions. I want to query based on… --- ## [Date Parse Logstash](https://discuss.elastic.co/t/date-parse-logstash/358533)
**Author:** [@Ankita\_Pachauri](https://discuss.elastic.co/u/Ankita_Pachauri)\ **Replies:** 2\ **Last updated:** [July 10, 2024, 12:25pm UTC](https://discuss.elastic.co/t/date-parse-logstash/358533 "2024-07-10T12:25:17Z")
Hi Team, I have a field request time whose value is as below: "response\_time" =\> "Wed, 17 Apr 2024 21:36:13 GMT". I need to fetch it in the yyyy-mm-dd format? How to do so? Kindly assist. //Ankita --- ## [EPR image does not work](https://discuss.elastic.co/t/epr-image-does-not-work/362599)
**Author:** [@karnamonkster](https://discuss.elastic.co/u/karnamonkster)\ **Replies:** 1\ **Last updated:** [July 10, 2024, 11:32am UTC](https://discuss.elastic.co/t/epr-image-does-not-work/362599 "2024-07-10T11:32:48Z")
Hi, When setting up the offline EPR, As per the instructions, docker.elastic.co/package-registry/distribution:8.14.1 does not work, i.e., docker pull docker.elastic.co/package-registry/distribution:8.14.1 Error Erro… --- ## [Integration of Logstash with IBM QRadar](https://discuss.elastic.co/t/integration-of-logstash-with-ibm-qradar/362877)
**Author:** [@Rafey\_Zafar](https://discuss.elastic.co/u/Rafey_Zafar)\ **Replies:** 0\ **Last updated:** [July 10, 2024, 11:26am UTC](https://discuss.elastic.co/t/integration-of-logstash-with-ibm-qradar/362877 "2024-07-10T11:26:12Z")
I need to integrate Logstash with QRadar. While I am familiar with the configuration process on the QRadar end, I am new to setting up the integration on the Logstash side using the Syslog protocol. I am seeking detailed… --- ## [Query suggestion for a search engine](https://discuss.elastic.co/t/query-suggestion-for-a-search-engine/362706)
**Author:** [@jahedi](https://discuss.elastic.co/u/jahedi)\ **Replies:** 5\ **Last updated:** [July 10, 2024, 9:10am UTC](https://discuss.elastic.co/t/query-suggestion-for-a-search-engine/362706 "2024-07-10T09:10:58Z")
Hi, I am currently working on a web search engine just like Google for my web site. I have crawled my website pages and indexed data in Elasticsearch. the indexed documents have such fields: string Id string U… --- ## [Elastic.Extensions.Logging - customization](https://discuss.elastic.co/t/elastic-extensions-logging-customization/362874)
**Author:** [@PCDiver](https://discuss.elastic.co/u/PCDiver)\ **Replies:** 0\ **Last updated:** [July 10, 2024, 10:56am UTC](https://discuss.elastic.co/t/elastic-extensions-logging-customization/362874 "2024-07-10T10:56:31Z")
Hi all, I'm working on a .NETlogger that logs directly to Elasticsearch. I looked at the source code for Elastic.Extensions.Logging and I cannot find any "customization" options. Examples: How can we change the user… --- ## [Encryption At REST In ELASTICSEARCH](https://discuss.elastic.co/t/encryption-at-rest-in-elasticsearch/362868)
**Author:** [@Debasis\_Mallick](https://discuss.elastic.co/u/Debasis_Mallick)\ **Replies:** 0\ **Last updated:** [July 10, 2024, 10:19am UTC](https://discuss.elastic.co/t/encryption-at-rest-in-elasticsearch/362868 "2024-07-10T10:19:43Z")
Hi Team, In one of our requirement, we need data encryption at REST so while going through the subscription page (Subscriptions | Elastic Stack Products & Support | Elastic) we found below two things . In one section it… --- ## [Connect To Elastic Sales Team For licensing](https://discuss.elastic.co/t/connect-to-elastic-sales-team-for-licensing/362836)
**Author:** [@Debasis\_Mallick](https://discuss.elastic.co/u/Debasis_Mallick)\ **Replies:** 2\ **Last updated:** [July 10, 2024, 9:35am UTC](https://discuss.elastic.co/t/connect-to-elastic-sales-team-for-licensing/362836 "2024-07-10T09:35:11Z")
Hi Team, One of our colleague trying to reach sales team to discuss for further discussion on Enterprise Elasticsearch but no response from team. Is there any other way to connect for faster processing the request. T… --- ## [If more than one condition is met, then the log will be collected only once or more than once](https://discuss.elastic.co/t/if-more-than-one-condition-is-met-then-the-log-will-be-collected-only-once-or-more-than-once/362199)
**Author:** [@DesireWithin](https://discuss.elastic.co/u/DesireWithin)\ **Replies:** 2\ **Last updated:** [July 10, 2024, 9:04am UTC](https://discuss.elastic.co/t/if-more-than-one-condition-is-met-then-the-log-will-be-collected-only-once-or-more-than-once/362199 "2024-07-10T09:04:41Z")
Hello, I'm using autodiscover in filebeat, I want to know, if there is a pod, name is my-app-backend, does it match only the first condition or all (other) condition ? Was container's log collected once or twice? I hope … --- ## [Filtering first input result as my second input in Watcher](https://discuss.elastic.co/t/filtering-first-input-result-as-my-second-input-in-watcher/362799)
**Author:** [@Seemant\_Bind](https://discuss.elastic.co/u/Seemant_Bind)\ **Replies:** 0\ **Last updated:** [July 9, 2024, 2:03pm UTC](https://discuss.elastic.co/t/filtering-first-input-result-as-my-second-input-in-watcher/362799 "2024-07-09T14:03:03Z")
Hi all, I am using 2 inputs in watcher. In the first input I have aggreagation level detail of error\_codes, I want to use those error\_codes as filter in my second input. I have tried below but this is not working. Kindl… --- ## [Duplicate metadata from \_id into a new field](https://discuss.elastic.co/t/duplicate-metadata-from-id-into-a-new-field/362838)
**Author:** [@mvasqueznr](https://discuss.elastic.co/u/mvasqueznr)\ **Replies:** 0\ **Last updated:** [July 10, 2024, 5:07am UTC](https://discuss.elastic.co/t/duplicate-metadata-from-id-into-a-new-field/362838 "2024-07-10T05:07:41Z")
I have a Filebeat data pipeline that ingests metrics into an Elasticsearch index. In a separate Python application, I fetch some of this data using the SQL API to display it in a web application. The problem arises when … --- ## [Using Painless stored script in role mapping](https://discuss.elastic.co/t/using-painless-stored-script-in-role-mapping/362530)
**Author:** [@jonaslb](https://discuss.elastic.co/u/jonaslb)\ **Replies:** 7\ **Last updated:** [July 10, 2024, 2:32am UTC](https://discuss.elastic.co/t/using-painless-stored-script-in-role-mapping/362530 "2024-07-10T02:32:54Z")
The Kibana interface suggests that it should be possible to use a painless stored script to perform role mapping: I would like to use this feature to put logic around which roles a given SSO realm is allowed to assig… --- ## [Filebeat is not sending any logs to logstash please help urgent!](https://discuss.elastic.co/t/filebeat-is-not-sending-any-logs-to-logstash-please-help-urgent/362161)
**Author:** [@evangelin](https://discuss.elastic.co/u/evangelin)\ **Replies:** 14\ **Last updated:** [July 10, 2024, 1:53am UTC](https://discuss.elastic.co/t/filebeat-is-not-sending-any-logs-to-logstash-please-help-urgent/362161 "2024-07-10T01:53:29Z")
Hello, i have installed elk in an aws ec2 instance ubuntu and filebeat in another ubuntu instance. Below is my filebeat.yml file cat /etc/filebeat/filebeat.yml ###################### Filebeat Configuration Example ###… --- ## [How can logs be forwarded from a Windows server (AD) to a centralized log server using Filebeat and Logstash?](https://discuss.elastic.co/t/how-can-logs-be-forwarded-from-a-windows-server-ad-to-a-centralized-log-server-using-filebeat-and-logstash/362830)
**Author:** [@Sehran\_Rasool](https://discuss.elastic.co/u/Sehran_Rasool)\ **Replies:** 0\ **Last updated:** [July 10, 2024, 12:39am UTC](https://discuss.elastic.co/t/how-can-logs-be-forwarded-from-a-windows-server-ad-to-a-centralized-log-server-using-filebeat-and-logstash/362830 "2024-07-10T00:39:37Z")
I'm seeking assistance with forwarding Windows Server Active Directory logs to my centralized Linux-based log server. I've set up Filebeat on the Windows Server and Logstash on the log server (linux). Despite configuring… --- ## [ElasticSearch Plugins with its own thread pool](https://discuss.elastic.co/t/elasticsearch-plugins-with-its-own-thread-pool/362826)
**Author:** [@ktech007](https://discuss.elastic.co/u/ktech007)\ **Replies:** 0\ **Last updated:** [July 9, 2024, 10:58pm UTC](https://discuss.elastic.co/t/elasticsearch-plugins-with-its-own-thread-pool/362826 "2024-07-09T22:58:53Z")
In a custom script plugin, is it possible to have its thread pool for some concurrency? For example: in this execute method, can I do some concurrency using a thread pool? What I understand is that the script plugin wil… --- ## [SSL for cloudflare integration](https://discuss.elastic.co/t/ssl-for-cloudflare-integration/362820)
**Author:** [@Gabriel\_Cunha](https://discuss.elastic.co/u/Gabriel_Cunha)\ **Replies:** 1\ **Last updated:** [July 9, 2024, 9:41pm UTC](https://discuss.elastic.co/t/ssl-for-cloudflare-integration/362820 "2024-07-09T21:41:47Z")
Hello, we using cloudflare logpush integration to got logs by http request. The problem is, we ssl setup and working bethween all elastic components, but the port used by cloudflare integration on the agent does not wor… --- ## [Exclude\_lines and escape character \*](https://discuss.elastic.co/t/exclude-lines-and-escape-character/362778)
**Author:** [@Martull](https://discuss.elastic.co/u/Martull)\ **Replies:** 1\ **Last updated:** [July 9, 2024, 6:01pm UTC](https://discuss.elastic.co/t/exclude-lines-and-escape-character/362778 "2024-07-09T18:01:07Z")
Hello, I am new to ELK and I am learning as we speak, but I have an issue that I am not able to solve, so I am here requesting your help. I have an index where several log files stream. One of them writes the next thre… --- ## [Logstash Mutate Arrays](https://discuss.elastic.co/t/logstash-mutate-arrays/362813)
**Author:** [@erikg](https://discuss.elastic.co/u/erikg)\ **Replies:** 1\ **Last updated:** [July 9, 2024, 5:42pm UTC](https://discuss.elastic.co/t/logstash-mutate-arrays/362813 "2024-07-09T17:42:07Z")
Hello, I have a simple question on arrays coming into Logstash. Lets say I have this example: Field Value data.root \[true, false\] This is expected behavior. What I want to do: Copy the first value of … --- ## [ECK Adding external agent SSL help!](https://discuss.elastic.co/t/eck-adding-external-agent-ssl-help/362759)
**Author:** [@clockard](https://discuss.elastic.co/u/clockard)\ **Replies:** 2\ **Last updated:** [July 9, 2024, 5:03pm UTC](https://discuss.elastic.co/t/eck-adding-external-agent-ssl-help/362759 "2024-07-09T17:03:29Z")
I've installed ECK on a self-hosted cluster. I cannot get the get data from that agent. Below is the command I am using in my LCX Debian container. I don't know if I'm using the right fingerprint I'm losing my freaking m… --- ## [\[Resolved\] LS pipeline.id not being honoured in logstash.yml](https://discuss.elastic.co/t/resolved-ls-pipeline-id-not-being-honoured-in-logstash-yml/362760)
**Author:** [@blueren](https://discuss.elastic.co/u/blueren)\ **Replies:** 9\ **Last updated:** [July 9, 2024, 3:38pm UTC](https://discuss.elastic.co/t/resolved-ls-pipeline-id-not-being-honoured-in-logstash-yml/362760 "2024-07-09T15:38:32Z")
I have a logstash instance running as a docker continer. Since it is using only a single pipeline, I've not bothered configuring the pipeline.yml. Instead, I've defined the pipeline params in the logstash.yml file itself… --- ## [Managed soc security and architecture](https://discuss.elastic.co/t/managed-soc-security-and-architecture/362807)
**Author:** [@Abdarrahmane](https://discuss.elastic.co/u/Abdarrahmane)\ **Replies:** 0\ **Last updated:** [July 9, 2024, 2:56pm UTC](https://discuss.elastic.co/t/managed-soc-security-and-architecture/362807 "2024-07-09T14:56:52Z")
hello everyone if i'm a company offering managed soc services for a client do we install (reverse proxies + kafka ... + logstash + elasticsearch) in his infrastructure and the kibana instances in the soc managing compan… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=205) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=207)