# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=21 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 22 --- ## [How to make horizontal bar graph?](https://discuss.elastic.co/t/how-to-make-horizontal-bar-graph/384723)
**Author:** [@Miksos](https://discuss.elastic.co/u/Miksos)\ **Replies:** 5\ **Last updated:** [January 24, 2026, 10:11am UTC](https://discuss.elastic.co/t/how-to-make-horizontal-bar-graph/384723 "2026-01-24T10:11:00Z")
I can’t create horizontal bar graphs, I find mentions in old post about them, and videos but in my version of Elastic I am unable to create one ? I will be grateful for some info. Thanks ! --- ## [Gitops: Building Logstash Plugin via gitlab runner?](https://discuss.elastic.co/t/gitops-building-logstash-plugin-via-gitlab-runner/384724)
**Author:** [@teopatl](https://discuss.elastic.co/u/teopatl)\ **Replies:** 0\ **Last updated:** [January 23, 2026, 9:44pm UTC](https://discuss.elastic.co/t/gitops-building-logstash-plugin-via-gitlab-runner/384724 "2026-01-23T21:44:40Z")
Anyone successfully building logstash java plugins as artifacts via gitlab runners? I’ve attempted a multi-stage docker build with the following gitlab-ci.yml, from which fails with the error A problem was found with… --- ## [Vision One Integration Policy - Agent](https://discuss.elastic.co/t/vision-one-integration-policy-agent/384720)
**Author:** [@juancamiloll](https://discuss.elastic.co/u/juancamiloll)\ **Replies:** 1\ **Last updated:** [January 23, 2026, 5:00pm UTC](https://discuss.elastic.co/t/vision-one-integration-policy-agent/384720 "2026-01-23T17:00:51Z")
Hello everyone, I have a question. I would appreciate it if you could help me and explain it to me, as I am confused. I need the Trend Micro Vision One logs. I have already added the integration. The Vision One admin… --- ## [Reporting job is still pending despite having killed previous job](https://discuss.elastic.co/t/reporting-job-is-still-pending-despite-having-killed-previous-job/384714)
**Author:** [@RRecio](https://discuss.elastic.co/u/RRecio)\ **Replies:** 0\ **Last updated:** [January 23, 2026, 12:09pm UTC](https://discuss.elastic.co/t/reporting-job-is-still-pending-despite-having-killed-previous-job/384714 "2026-01-23T12:09:25Z")
Hi. I’m experiencing the same issue as this Closed ticket, which seemingly didn’t have a resolution: Need to stop all Pending jobs in reporting I accidentally hit “Download CSV” in a report that was far too big to be do… --- ## [When using s3-compatible service as inputs, path\_style is un-useful](https://discuss.elastic.co/t/when-using-s3-compatible-service-as-inputs-path-style-is-un-useful/384709)
**Author:** [@luxin88](https://discuss.elastic.co/u/luxin88)\ **Replies:** 0\ **Last updated:** [January 23, 2026, 9:33am UTC](https://discuss.elastic.co/t/when-using-s3-compatible-service-as-inputs-path-style-is-un-useful/384709 "2026-01-23T09:33:30Z")
filebeat: inputs: - type: aws-s3 endpoint: "http://obs.cn-north-4.myhuaweicloud.com" access\_key\_id: "###" secret\_access\_key: "###" non\_aws\_bucket\_name: log-parse path\_style: false … --- ## [Date\_histogram supports 1M, 1Y but not 3M or 6M. Any ways to achieve the same](https://discuss.elastic.co/t/date-histogram-supports-1m-1y-but-not-3m-or-6m-any-ways-to-achieve-the-same/384687)
**Author:** [@mike123](https://discuss.elastic.co/u/mike123)\ **Replies:** 1\ **Last updated:** [January 22, 2026, 7:53am UTC](https://discuss.elastic.co/t/date-histogram-supports-1m-1y-but-not-3m-or-6m-any-ways-to-achieve-the-same/384687 "2026-01-22T07:53:09Z")
3M or 3Y cannot be achieved using fixed interval. While calendar interval only supports 1M, 1Y. Is there any ways to achieve date histogram over 3M or 6M. --- ## [FSCrawler 2.10-SNAPSHOT not indexing PDF content](https://discuss.elastic.co/t/fscrawler-2-10-snapshot-not-indexing-pdf-content/384593)
**Author:** [@DaManDOH](https://discuss.elastic.co/u/DaManDOH)\ **Replies:** 11\ **Last updated:** [January 22, 2026, 12:33am UTC](https://discuss.elastic.co/t/fscrawler-2-10-snapshot-not-indexing-pdf-content/384593 "2026-01-22T00:33:45Z")
TL;DR: Under a full ES v9.2 stack running under Docker Compose, FSCrawler v2.10-SNAPSHOT only returns TesseractOCRParser timeout errors when trying to ingest any PDFs. Full details I’m currently building a local Elasti… --- ## [\[Syslog output\] Erratic message output behavior](https://discuss.elastic.co/t/syslog-output-erratic-message-output-behavior/384670)
**Author:** [@TLB35](https://discuss.elastic.co/u/TLB35)\ **Replies:** 6\ **Last updated:** [January 21, 2026, 6:01pm UTC](https://discuss.elastic.co/t/syslog-output-erratic-message-output-behavior/384670 "2026-01-21T18:01:53Z")
Hi, I'm doing this post as I am encountering a "weird" issue with the syslog-output plugin behavior. My use case is quite simple. My logstash perform a redirection to a nginx cluster. Here is the code snippet : if \[ty… --- ## [Restrict fleet view to only specific namespace](https://discuss.elastic.co/t/restrict-fleet-view-to-only-specific-namespace/384579)
**Author:** [@TheJ](https://discuss.elastic.co/u/TheJ)\ **Replies:** 3\ **Last updated:** [January 21, 2026, 2:12pm UTC](https://discuss.elastic.co/t/restrict-fleet-view-to-only-specific-namespace/384579 "2026-01-21T14:12:21Z")
Hi, I have installed 10 elastic agents in 2 different agent policies: admins personel Also i created role for our helpdesk team (the name of role is helpdesk). Now I want that helpdesk role can see only agents … --- ## [Elastic Serverless: Agent deployment when using both Observability and Security](https://discuss.elastic.co/t/elastic-serverless-agent-deployment-when-using-both-observability-and-security/384673)
**Author:** [@Abdul\_Haseeb\_Q](https://discuss.elastic.co/u/Abdul_Haseeb_Q)\ **Replies:** 0\ **Last updated:** [January 21, 2026, 1:49pm UTC](https://discuss.elastic.co/t/elastic-serverless-agent-deployment-when-using-both-observability-and-security/384673 "2026-01-21T13:49:49Z")
Hey folks, We currently have Elastic Cloud (managed) deployed, where Observability, Security, and other Elastic features are available within a single deployment. In this setup, we install one Elastic Agent per host, an… --- ## [Elasticsearch automatic dashboard access](https://discuss.elastic.co/t/elasticsearch-automatic-dashboard-access/384632)
**Author:** [@Robin\_Gorry](https://discuss.elastic.co/u/Robin_Gorry)\ **Replies:** 2\ **Last updated:** [January 21, 2026, 12:27pm UTC](https://discuss.elastic.co/t/elasticsearch-automatic-dashboard-access/384632 "2026-01-21T12:27:39Z")
Elasticsearch Cloud Hosted, 8. We’ll create separate spaces with a dashboard per space. We’ll provide users (that we create) access to a specific Kibana dashboard on Elastic and an embedded iframe of their application. … --- ## [Elasticsearch RAG - AI Playground - fix needed](https://discuss.elastic.co/t/elasticsearch-rag-ai-playground-fix-needed/384671)
**Author:** [@Musab\_Dogan](https://discuss.elastic.co/u/Musab_Dogan)\ **Replies:** 0\ **Last updated:** [January 21, 2026, 12:18pm UTC](https://discuss.elastic.co/t/elasticsearch-rag-ai-playground-fix-needed/384671 "2026-01-21T12:18:46Z")
Hello guys, Thanks for sharing this amazing Elasticsearch RAG playground. It’s well prepared and easy to follow the instructions. There is a small bug in the last step, Export code =\> Install code dependencies part. The… --- ## [Is it possible to make a template that aggregates by one field and sorts by another?](https://discuss.elastic.co/t/is-it-possible-to-make-a-template-that-aggregates-by-one-field-and-sorts-by-another/384526)
**Author:** [@Phil\_McLachlan](https://discuss.elastic.co/u/Phil_McLachlan)\ **Replies:** 4\ **Last updated:** [January 20, 2026, 8:12pm UTC](https://discuss.elastic.co/t/is-it-possible-to-make-a-template-that-aggregates-by-one-field-and-sorts-by-another/384526 "2026-01-20T20:12:46Z")
Hi, We have a elasticsearch index with a lot of data in it. For this question, I am interested in two fields primarily: brand.brands\_pk and brand.name\_loc.content\_default. I want to create a template to return a uniqu… --- ## [Using ignore\_malformed in dynamic template doesn't seems to work](https://discuss.elastic.co/t/using-ignore-malformed-in-dynamic-template-doesnt-seems-to-work/384647)
**Author:** [@yquirion](https://discuss.elastic.co/u/yquirion)\ **Replies:** 1\ **Last updated:** [January 20, 2026, 5:40pm UTC](https://discuss.elastic.co/t/using-ignore-malformed-in-dynamic-template-doesnt-seems-to-work/384647 "2026-01-20T17:40:49Z")
Dear Community! I’m having a strange problem while trying to implement ignore\_malformed to avoid documents being dropped when a field contains invalid data. From my Logstash logs, I often see messages like this: \[...\]… --- ## [Entitlements and tmpdir](https://discuss.elastic.co/t/entitlements-and-tmpdir/384627)
**Author:** [@frantz45](https://discuss.elastic.co/u/frantz45)\ **Replies:** 4\ **Last updated:** [January 20, 2026, 3:02pm UTC](https://discuss.elastic.co/t/entitlements-and-tmpdir/384627 "2026-01-20T15:02:29Z")
Hello, I’ve just tried v8.19.10 and I get an issue with entitlements: \[2026-01-19T17:13:13,437\]\[ERROR\]\[o.e.b.Elasticsearch \] \[redacted\] fatal exception while booting Elasticsearch java.lang.IllegalArgumentExceptio… --- ## [Primary shards for search](https://discuss.elastic.co/t/primary-shards-for-search/384310)
**Author:** [@Elastic04](https://discuss.elastic.co/u/Elastic04)\ **Replies:** 10\ **Last updated:** [January 20, 2026, 5:56am UTC](https://discuss.elastic.co/t/primary-shards-for-search/384310 "2026-01-20T05:56:30Z")
I a currently using 3 primary shards and 2 replica shards. How reducing number of primary shards affects search and what’s the impact on cluster? --- ## [Filebeat package (filebeat-9.2.1-amd64.deb) is affected by CVE-2025-11226/CVE-2025-5818/CVE-2025-47914](https://discuss.elastic.co/t/filebeat-package-filebeat-9-2-1-amd64-deb-is-affected-by-cve-2025-11226-cve-2025-5818-cve-2025-47914/384618)
**Author:** [@cahl](https://discuss.elastic.co/u/cahl)\ **Replies:** 2\ **Last updated:** [January 19, 2026, 9:56pm UTC](https://discuss.elastic.co/t/filebeat-package-filebeat-9-2-1-amd64-deb-is-affected-by-cve-2025-11226-cve-2025-5818-cve-2025-47914/384618 "2026-01-19T21:56:11Z")
Hi, I see the filebeat-9.2.1-amd64.deb is affected by CVE-2025-10543 which is present on GitHub - eclipse-paho/paho.mqtt.golang 1.3.5 and fixed on 1.5.1. Also, the same package is affected by CVE-2025-58181 and CVE-2025-… --- ## [Installation - receive this message:](https://discuss.elastic.co/t/installation-receive-this-message/384603)
**Author:** [@jwelby](https://discuss.elastic.co/u/jwelby)\ **Replies:** 3\ **Last updated:** [January 19, 2026, 8:45pm UTC](https://discuss.elastic.co/t/installation-receive-this-message/384603 "2026-01-19T20:45:47Z")
error root\_cause 0 type "status\_exception" reason "Cluster state has not been recovered yet, cannot write to the \[null\] index" type "authentication\_processing\_error" reason "failed to promote the aut… --- ## [Unexpected high memory usage in Elasticsearch cluster – looking for optimization advice](https://discuss.elastic.co/t/unexpected-high-memory-usage-in-elasticsearch-cluster-looking-for-optimization-advice/384629)
**Author:** [@jimmykalru](https://discuss.elastic.co/u/jimmykalru)\ **Replies:** 1\ **Last updated:** [January 19, 2026, 5:55pm UTC](https://discuss.elastic.co/t/unexpected-high-memory-usage-in-elasticsearch-cluster-looking-for-optimization-advice/384629 "2026-01-19T17:55:39Z")
I’m running an Elasticsearch cluster in a production environment and recently noticed consistently high memory usage across all data nodes. Even during periods of low query activity, heap usage remains elevated and occas… --- ## [Ingest Pipeline - Why Isn’t My Failure Processor Redirecting Failed Docs to a New Index?](https://discuss.elastic.co/t/ingest-pipeline-why-isn-t-my-failure-processor-redirecting-failed-docs-to-a-new-index/384619)
**Author:** [@nilsen](https://discuss.elastic.co/u/nilsen)\ **Replies:** 3\ **Last updated:** [January 19, 2026, 3:23pm UTC](https://discuss.elastic.co/t/ingest-pipeline-why-isn-t-my-failure-processor-redirecting-failed-docs-to-a-new-index/384619 "2026-01-19T15:23:15Z")
Following the Elastic documentation for Handling pipeline failures I have added a failure processor which is supposed to change the \_index, but it does not seem to work as I thought. ▶ Failure Processors (.json) My Pi… --- ## [How to see status of enhancement requests?](https://discuss.elastic.co/t/how-to-see-status-of-enhancement-requests/384601)
**Author:** [@mistrhanky1](https://discuss.elastic.co/u/mistrhanky1)\ **Replies:** 1\ **Last updated:** [January 19, 2026, 2:43pm UTC](https://discuss.elastic.co/t/how-to-see-status-of-enhancement-requests/384601 "2026-01-19T14:43:03Z")
I have a few enhancement requests filed through elastic support. How can I find the status of these requests? I am sure there is a searchable place to see this, likely in github, but it did not stand out to me. As a fo… --- ## [Watcher chain results not in the ctx.payload for a condition](https://discuss.elastic.co/t/watcher-chain-results-not-in-the-ctx-payload-for-a-condition/384574)
**Author:** [@Joey\_Visbeen](https://discuss.elastic.co/u/Joey_Visbeen)\ **Replies:** 2\ **Last updated:** [January 19, 2026, 9:50am UTC](https://discuss.elastic.co/t/watcher-chain-results-not-in-the-ctx-payload-for-a-condition/384574 "2026-01-19T09:50:01Z")
Lately I ran into an issue I am trying to make a watcher. The main purpose is to see if the elastic agents we are running are still producing logs. The agents run on different hosts, therefore the query on the host names… --- ## [Kibana TSVB shows keyword string "/" as "(empty)"](https://discuss.elastic.co/t/kibana-tsvb-shows-keyword-string-as-empty/384577)
**Author:** [@hylowaker](https://discuss.elastic.co/u/hylowaker)\ **Replies:** 2\ **Last updated:** [January 19, 2026, 8:34am UTC](https://discuss.elastic.co/t/kibana-tsvb-shows-keyword-string-as-empty/384577 "2026-01-19T08:34:24Z")
I loaded Metricbeat dashboards into Kibana. The Disk Usage \[Metricbeat System\] ECS library shows Top 10 mount points with high disk usages. I see an (empty) mount point, but the actual value of system.filesystem.mount\_… --- ## [TRANSFORM Destination index is not using Index Template](https://discuss.elastic.co/t/transform-destination-index-is-not-using-index-template/384611)
**Author:** [@tusharnemade](https://discuss.elastic.co/u/tusharnemade)\ **Replies:** 1\ **Last updated:** [January 19, 2026, 7:29am UTC](https://discuss.elastic.co/t/transform-destination-index-is-not-using-index-template/384611 "2026-01-19T07:29:20Z")
Hello Team, We are using Elasticsearch 7.8.0 version. I understand its very old \[ w are in process of upgradation too \] While using TRANSFORM feature , I am finding that my destination index is not using template sett… --- ## [Kibana login broken after trying to enable reporting. "You do not have permission to access the requested page" message - Need help to fix it](https://discuss.elastic.co/t/kibana-login-broken-after-trying-to-enable-reporting-you-do-not-have-permission-to-access-the-requested-page-message-need-help-to-fix-it/384554)
**Author:** [@eparreiras](https://discuss.elastic.co/u/eparreiras)\ **Replies:** 24\ **Last updated:** [January 18, 2026, 8:34pm UTC](https://discuss.elastic.co/t/kibana-login-broken-after-trying-to-enable-reporting-you-do-not-have-permission-to-access-the-requested-page-message-need-help-to-fix-it/384554 "2026-01-18T20:34:05Z")
Hi there, After trying to enable reporting in Kibana following the document below: I am not able to login into Kibana anymore. I am using a Kibana 8.10.4 container version. The Elasticsearch is a IBM Cloud managed… --- ## [SAVE Option in dashboard appears when no changes made; Sometimes needs clicking twice](https://discuss.elastic.co/t/save-option-in-dashboard-appears-when-no-changes-made-sometimes-needs-clicking-twice/384596)
**Author:** [@geoffrey](https://discuss.elastic.co/u/geoffrey)\ **Replies:** 0\ **Last updated:** [January 18, 2026, 6:54am UTC](https://discuss.elastic.co/t/save-option-in-dashboard-appears-when-no-changes-made-sometimes-needs-clicking-twice/384596 "2026-01-18T06:54:29Z")
I have got some dashboards setup for displaying DMARC information in Kibana (email reporting information). I am running V9.2 of ES and Kibana. What I notice is that the save option frequently appears when no changes hav… --- ## [Elastic Agent vs Logstash with Filebeat](https://discuss.elastic.co/t/elastic-agent-vs-logstash-with-filebeat/384556)
**Author:** [@marian.veverka](https://discuss.elastic.co/u/marian.veverka)\ **Replies:** 5\ **Last updated:** [January 17, 2026, 5:10pm UTC](https://discuss.elastic.co/t/elastic-agent-vs-logstash-with-filebeat/384556 "2026-01-17T17:10:53Z")
Hello, I have a server running several Docker containers (including, for example, Keycloak). I want to send logs from these Docker containers to Elasticsearch. Currently, for one Docker container I'm using a separate D… --- ## [How should logstash connect to ECK created TLS encrypted elasticsearch in kubernets](https://discuss.elastic.co/t/how-should-logstash-connect-to-eck-created-tls-encrypted-elasticsearch-in-kubernets/384586)
**Author:** [@VOCTERMA](https://discuss.elastic.co/u/VOCTERMA)\ **Replies:** 0\ **Last updated:** [January 16, 2026, 3:26pm UTC](https://discuss.elastic.co/t/how-should-logstash-connect-to-eck-created-tls-encrypted-elasticsearch-in-kubernets/384586 "2026-01-16T15:26:13Z")
How should logstash connect to ECK created TLS encrypted elasticsearch in kubernets --- ## [Advices & opinions on my Wazuh-Elastic Stack SIEM](https://discuss.elastic.co/t/advices-opinions-on-my-wazuh-elastic-stack-siem/384567)
**Author:** [@Ken\_1](https://discuss.elastic.co/u/Ken_1)\ **Replies:** 0\ **Last updated:** [January 15, 2026, 9:18pm UTC](https://discuss.elastic.co/t/advices-opinions-on-my-wazuh-elastic-stack-siem/384567 "2026-01-15T21:18:30Z")
Hello everyone, I want to build an open-source SIEM solution using Wazuh and the Elastic Stack to monitor roughly 300 hosts (Linux servers, firewalls, switches, Windows servers, Linux hosts, and Windows hosts). I’d appr… --- ## [Gmail oauth disabled](https://discuss.elastic.co/t/gmail-oauth-disabled/384565)
**Author:** [@Jaydeep\_Rathore1](https://discuss.elastic.co/u/Jaydeep_Rathore1)\ **Replies:** 0\ **Last updated:** [January 15, 2026, 6:29pm UTC](https://discuss.elastic.co/t/gmail-oauth-disabled/384565 "2026-01-15T18:29:37Z")
my gmail account was disabled by google, and i used to login using oauth only. now i dont have access to my gmail, and i am not able to login to elastic cloud console. any idea what i should do? there is not chance of ge… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=20) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=22)