# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=218 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 219 --- ## [Cannot load PEM certificate\_authorities](https://discuss.elastic.co/t/cannot-load-pem-certificate-authorities/361623)
**Author:** [@INS](https://discuss.elastic.co/u/INS)\ **Replies:** 2\ **Last updated:** [June 19, 2024, 4:06am UTC](https://discuss.elastic.co/t/cannot-load-pem-certificate-authorities/361623 "2024-06-19T04:06:02Z")
Hi I have generated a couple of cert under my instance list followed by so at least my config looks like below container\_name: es\_master\_1\_1 environment: - node.name=es\_master\_1\_1 - xpack.ml.enab… --- ## [Fleet Agents and Directing Data to Cluster](https://discuss.elastic.co/t/fleet-agents-and-directing-data-to-cluster/361689)
**Author:** [@digital-thought](https://discuss.elastic.co/u/digital-thought)\ **Replies:** 0\ **Last updated:** [June 19, 2024, 3:11am UTC](https://discuss.elastic.co/t/fleet-agents-and-directing-data-to-cluster/361689 "2024-06-19T03:11:01Z")
We are looking to deploy the Elastic Agent to a large number of devices. The idea would be that they would all use the same Policy. The Policy also controls the default HOT node to which data and agent telemetry is dir… --- ## [No one responded to the post about this issue](https://discuss.elastic.co/t/no-one-responded-to-the-post-about-this-issue/361612)
**Author:** [@ahn](https://discuss.elastic.co/u/ahn)\ **Replies:** 2\ **Last updated:** [June 19, 2024, 1:15am UTC](https://discuss.elastic.co/t/no-one-responded-to-the-post-about-this-issue/361612 "2024-06-19T01:15:13Z")
Are there no heroes here? Thanks in advance. Regards -Ahn --- ## [Dynamically set connection string on jdbc\_streaming filter](https://discuss.elastic.co/t/dynamically-set-connection-string-on-jdbc-streaming-filter/361675)
**Author:** [@DMcP89](https://discuss.elastic.co/u/DMcP89)\ **Replies:** 1\ **Last updated:** [June 18, 2024, 11:56pm UTC](https://discuss.elastic.co/t/dynamically-set-connection-string-on-jdbc-streaming-filter/361675 "2024-06-18T23:56:07Z")
Is it possible to dynamically set the connection string on a jdbc\_streaming filter? Something like this for example: mutate { add\_field =\> { "connection\_string" =\> "jdbc:sqlserver://test.mydb.co… --- ## [Metricbeat Apache Pre-defined dashboard showing jumbled data](https://discuss.elastic.co/t/metricbeat-apache-pre-defined-dashboard-showing-jumbled-data/361680)
**Author:** [@zaeemmasood](https://discuss.elastic.co/u/zaeemmasood)\ **Replies:** 0\ **Last updated:** [June 18, 2024, 9:17pm UTC](https://discuss.elastic.co/t/metricbeat-apache-pre-defined-dashboard-showing-jumbled-data/361680 "2024-06-18T21:17:10Z")
Hi All, I was able to set up metricbeat 8.7.0 after enabling Apache module. server-status (mod\_status) was required to be enabled. Now I can view data in the Kibana dashboard. Issue that I face is that as the number … --- ## [BUG: Tables from lenses - Kibana Dashboards](https://discuss.elastic.co/t/bug-tables-from-lenses-kibana-dashboards/361276)
**Author:** [@aram215](https://discuss.elastic.co/u/aram215)\ **Replies:** 6\ **Last updated:** [June 18, 2024, 8:25pm UTC](https://discuss.elastic.co/t/bug-tables-from-lenses-kibana-dashboards/361276 "2024-06-18T20:25:04Z")
Hi, I've got the following table that has 3 categories (text of: 2021,2022,2023). Each category has data (like the screenshot). However, when I apply a filter to see only one year, the table looks blank, even though … --- ## [Applied a new template to my indices, but new indices are created with the wrong shard/replica count](https://discuss.elastic.co/t/applied-a-new-template-to-my-indices-but-new-indices-are-created-with-the-wrong-shard-replica-count/361651)
**Author:** [@Bogdan\_Laban](https://discuss.elastic.co/u/Bogdan_Laban)\ **Replies:** 2\ **Last updated:** [June 18, 2024, 4:55pm UTC](https://discuss.elastic.co/t/applied-a-new-template-to-my-indices-but-new-indices-are-created-with-the-wrong-shard-replica-count/361651 "2024-06-18T16:55:18Z")
AWS OpenSearch, running 7.10 Elasticsearch version. I have my current template as this: { "ism\_rollover" : { "order" : 100, "index\_patterns" : \[ "default-logs-\*" \], "settings" : { "index" … --- ## [\[Kibana 8\] Cannot disable time field on data view/index pattern](https://discuss.elastic.co/t/kibana-8-cannot-disable-time-field-on-data-view-index-pattern/361656)
**Author:** [@sacalata](https://discuss.elastic.co/u/sacalata)\ **Replies:** 1\ **Last updated:** [June 18, 2024, 4:18pm UTC](https://discuss.elastic.co/t/kibana-8-cannot-disable-time-field-on-data-view-index-pattern/361656 "2024-06-18T16:18:17Z")
The time field is set by default as "@timestamp" Since i don't want to use any time field at all, i would select the option to disable it, however the dropdown is blocked because i have no date fields So my only o… --- ## [Aggregations sorting (between them, not in their results) changes from ES7 to ES8?](https://discuss.elastic.co/t/aggregations-sorting-between-them-not-in-their-results-changes-from-es7-to-es8/361659)
**Author:** [@samyrabih](https://discuss.elastic.co/u/samyrabih)\ **Replies:** 0\ **Last updated:** [June 18, 2024, 3:01pm UTC](https://discuss.elastic.co/t/aggregations-sorting-between-them-not-in-their-results-changes-from-es7-to-es8/361659 "2024-06-18T15:01:52Z")
Hi ! In our application, we use aggregations using this kind of syntax: "aggs": { "question\_1.answer.id": { "terms": { "field": "question\_1.answer.id", "size": 20000 }, "aggs": { … --- ## [Failed to retrieve shards stuck Elastic node and performance](https://discuss.elastic.co/t/failed-to-retrieve-shards-stuck-elastic-node-and-performance/361658)
**Author:** [@todorvgit](https://discuss.elastic.co/u/todorvgit)\ **Replies:** 0\ **Last updated:** [June 18, 2024, 2:52pm UTC](https://discuss.elastic.co/t/failed-to-retrieve-shards-stuck-elastic-node-and-performance/361658 "2024-06-18T14:52:38Z")
Hello, We are having issue with Hot tier in our elasticsearch version 7.16.2 Time to time in last few weeks we are experience issue that Metrics beat stop getting any data of the cluster. What we are seeing in master … --- ## [Elasticsearch 7.17.1 - shards skipped even if they contain data](https://discuss.elastic.co/t/elasticsearch-7-17-1-shards-skipped-even-if-they-contain-data/361649)
**Author:** [@mihail-ca](https://discuss.elastic.co/u/mihail-ca)\ **Replies:** 0\ **Last updated:** [June 18, 2024, 1:48pm UTC](https://discuss.elastic.co/t/elasticsearch-7-17-1-shards-skipped-even-if-they-contain-data/361649 "2024-06-18T13:48:15Z")
Hello, We have the following document in Elasticsearch 7.17.1: { "\_index": "operate-list-view-8.1.0\_2024-06-13", "\_type": "\_doc", "\_id": "2251800712733897", "\_score": 1.0, "\_source": { "id": "225180071273… --- ## [Scalability of Nested Objects & Good Practice](https://discuss.elastic.co/t/scalability-of-nested-objects-good-practice/361609)
**Author:** [@mvkfg](https://discuss.elastic.co/u/mvkfg)\ **Replies:** 2\ **Last updated:** [June 18, 2024, 1:13pm UTC](https://discuss.elastic.co/t/scalability-of-nested-objects-good-practice/361609 "2024-06-18T13:13:03Z")
Hello, I am working in an Elasticsearch environment in which I can monitor and search logs within a game server. This includes a reputation/punishment system, or voting, for example to kick a cheater from the game. Exa… --- ## [Elasticsearch - start checks failing as rootless containers](https://discuss.elastic.co/t/elasticsearch-start-checks-failing-as-rootless-containers/361622)
**Author:** [@alro](https://discuss.elastic.co/u/alro)\ **Replies:** 4\ **Last updated:** [June 18, 2024, 11:53am UTC](https://discuss.elastic.co/t/elasticsearch-start-checks-failing-as-rootless-containers/361622 "2024-06-18T11:53:58Z")
Hi I'm trying to get an Elasctsearch cluster running on RHEL9.4 with Podman. My podman-compose files run and the cluster members try to start. but I get the following error message: {"@timestamp":"2024-06-18T09:25:08.… --- ## [Create group GCP mapping a to viewers groups in kibana](https://discuss.elastic.co/t/create-group-gcp-mapping-a-to-viewers-groups-in-kibana/361639)
**Author:** [@Ignacio\_Rodera\_Toba1](https://discuss.elastic.co/u/Ignacio_Rodera_Toba1)\ **Replies:** 0\ **Last updated:** [June 18, 2024, 11:25am UTC](https://discuss.elastic.co/t/create-group-gcp-mapping-a-to-viewers-groups-in-kibana/361639 "2024-06-18T11:25:08Z")
Hi Community! I need to create only viewer group at elastic on GCP. I have one enviroment deployed in GCP. There, I created a Group named "namegroup@domain.com". Inside this group I put all users inside it, I configu… --- ## [Passing search\_after in URL as a query parameter](https://discuss.elastic.co/t/passing-search-after-in-url-as-a-query-parameter/361638)
**Author:** [@aziubin](https://discuss.elastic.co/u/aziubin)\ **Replies:** 0\ **Last updated:** [June 18, 2024, 11:22am UTC](https://discuss.elastic.co/t/passing-search-after-in-url-as-a-query-parameter/361638 "2024-06-18T11:22:52Z")
Hello! Is it possible to pass the search\_after parameter in URL of GET request somehow? Currently I am using URL like this with body below to paginate big resultset (more than 10000 entries) using search\_after paramete… --- ## [How Elasticsearch does verify JWT tokens?](https://discuss.elastic.co/t/how-elasticsearch-does-verify-jwt-tokens/361581)
**Author:** [@vnovotny98](https://discuss.elastic.co/u/vnovotny98)\ **Replies:** 13\ **Last updated:** [June 18, 2024, 11:16am UTC](https://discuss.elastic.co/t/how-elasticsearch-does-verify-jwt-tokens/361581 "2024-06-18T11:16:04Z")
Hello, I have 6 node Elasticsearch cluster in acceptance enviroment. I have 2 master, 2 hot and 2 warm nodes. I want to implement authentication via Keycloak. In elasticsearch.yml I configured. xpack.security.authc.t… --- ## [Alerting Rule with link to Discover](https://discuss.elastic.co/t/alerting-rule-with-link-to-discover/361628)
**Author:** [@\_Thomas](https://discuss.elastic.co/u/_Thomas)\ **Replies:** 6\ **Last updated:** [June 18, 2024, 11:11am UTC](https://discuss.elastic.co/t/alerting-rule-with-link-to-discover/361628 "2024-06-18T11:11:15Z")
Hi Guys, I'm trying to get my head around the following: Is it possible to have a Discover Link included in the E-Mail Alert? The Use-Case is as following: Whenever I receive an Alert over the Mail Connector, I'd lik… --- ## [Is there any way to store settings inside the server's memory, independently of individual indices?](https://discuss.elastic.co/t/is-there-any-way-to-store-settings-inside-the-servers-memory-independently-of-individual-indices/361637)
**Author:** [@mrodent](https://discuss.elastic.co/u/mrodent)\ **Replies:** 0\ **Last updated:** [June 18, 2024, 10:57am UTC](https://discuss.elastic.co/t/is-there-any-way-to-store-settings-inside-the-servers-memory-independently-of-individual-indices/361637 "2024-06-18T10:57:18Z")
The reason I ask this is because I'm working on a project to index some documents, which may be in a variety of languages. Choosing the default analysers is easy enough. But then I recently decided that I want to slight… --- ## [Auditbeat: Broken kibana dashboards – missing .keyword in the fields](https://discuss.elastic.co/t/auditbeat-broken-kibana-dashboards-missing-keyword-in-the-fields/361350)
**Author:** [@marcinhlybin](https://discuss.elastic.co/u/marcinhlybin)\ **Replies:** 5\ **Last updated:** [June 18, 2024, 10:19am UTC](https://discuss.elastic.co/t/auditbeat-broken-kibana-dashboards-missing-keyword-in-the-fields/361350 "2024-06-18T10:19:01Z")
Version: 8.14.0 Operating System: Ubuntu 22.04.4 LTS Steps to Reproduce: Load the dashboards as recommended in the documentation: auditbeat setup -e \\ -E output.logstash.enabled=false \\ -E output.elasticsearch.hos… --- ## [Roles and privileges](https://discuss.elastic.co/t/roles-and-privileges/361611)
**Author:** [@Anupama2262](https://discuss.elastic.co/u/Anupama2262)\ **Replies:** 2\ **Last updated:** [June 18, 2024, 9:17am UTC](https://discuss.elastic.co/t/roles-and-privileges/361611 "2024-06-18T09:17:43Z")
I have created a dashboard that I want to integrate into my application. My application already has its own roles and privileges system. I want to filter the data specific to the user ID once they log in to my applicatio… --- ## [Kibana Dashboard bringing up blurry visualizations](https://discuss.elastic.co/t/kibana-dashboard-bringing-up-blurry-visualizations/361525)
**Author:** [@SamuelSMendes](https://discuss.elastic.co/u/SamuelSMendes)\ **Replies:** 5\ **Last updated:** [June 18, 2024, 8:13am UTC](https://discuss.elastic.co/t/kibana-dashboard-bringing-up-blurry-visualizations/361525 "2024-06-18T08:13:55Z")
Whenever I try to make a chart by Lens it turns out very blurry. I also got a problem with the space occupied by the chart, it is oddly big when compared to the label. So I was wondering if I could customize the size … --- ## [Make aggregate filter to take only unique (first) message](https://discuss.elastic.co/t/make-aggregate-filter-to-take-only-unique-first-message/361143)
**Author:** [@Delvin](https://discuss.elastic.co/u/Delvin)\ **Replies:** 6\ **Last updated:** [June 18, 2024, 8:12am UTC](https://discuss.elastic.co/t/make-aggregate-filter-to-take-only-unique-first-message/361143 "2024-06-18T08:12:22Z")
Hi, everyone! The problem is that sometimes we get logs with same task\_id (instock.rf.screenId in our case) and message fields. It look like this: "\_source": { "@timestamp": "2024-05-28T05:43:34.769Z", "input": { "… --- ## [How can I combine in simple\_query\_string prefix search and phrase search (similar to match\_phrase\_prefix but with other features of simple\_query\_string)](https://discuss.elastic.co/t/how-can-i-combine-in-simple-query-string-prefix-search-and-phrase-search-similar-to-match-phrase-prefix-but-with-other-features-of-simple-query-string/360879)
**Author:** [@Leonid\_P](https://discuss.elastic.co/u/Leonid_P)\ **Replies:** 1\ **Last updated:** [June 18, 2024, 8:04am UTC](https://discuss.elastic.co/t/how-can-i-combine-in-simple-query-string-prefix-search-and-phrase-search-similar-to-match-phrase-prefix-but-with-other-features-of-simple-query-string/360879 "2024-06-18T08:04:31Z")
I would like to find documents containing search text with the last token (may be) uncompleted like "quick brown f\*" matching "quick brown fox" but not "quick and brave brown fox". It is similar to match\_phrase\_prefix, … --- ## [Elasticsearch .net v8 and operator](https://discuss.elastic.co/t/elasticsearch-net-v8-and-operator/361496)
**Author:** [@Odd\_Erik\_Gronberg](https://discuss.elastic.co/u/Odd_Erik_Gronberg)\ **Replies:** 4\ **Last updated:** [June 18, 2024, 7:44am UTC](https://discuss.elastic.co/t/elasticsearch-net-v8-and-operator/361496 "2024-06-18T07:44:17Z")
Hi, just started porting our ES facing code from NEST to the new V8 client. I am facing some issues that I would like to get some input on. In NEST I am able to use the AND operator to "join" multiple QueryContainers li… --- ## [Issue with unintentionally becoming non\_running in Logstash management](https://discuss.elastic.co/t/issue-with-unintentionally-becoming-non-running-in-logstash-management/361298)
**Author:** [@shibadog](https://discuss.elastic.co/u/shibadog)\ **Replies:** 7\ **Last updated:** [June 18, 2024, 7:29am UTC](https://discuss.elastic.co/t/issue-with-unintentionally-becoming-non-running-in-logstash-management/361298 "2024-06-18T07:29:10Z")
Using Logstash management, I was adding pipeline settings from Kibana. Although it was working fine before, after adding a pipeline, the newly added pipeline unintentionally became non-running. The environment is as fol… --- ## [Qualys integration error](https://discuss.elastic.co/t/qualys-integration-error/361461)
**Author:** [@Eljafopregunta](https://discuss.elastic.co/u/Eljafopregunta)\ **Replies:** 3\ **Last updated:** [June 18, 2024, 6:39am UTC](https://discuss.elastic.co/t/qualys-integration-error/361461 "2024-06-18T06:39:26Z")
Hello, Yesterday, I updated the Qualys integration, and now the integration has stopped working. I tried to read the request to the Qualys API in the "configs" tab of the integration, but it only shows this error: I… --- ## [After restoring the snapshot, the index is not associated with the data stream](https://discuss.elastic.co/t/after-restoring-the-snapshot-the-index-is-not-associated-with-the-data-stream/361561)
**Author:** [@dxygit1](https://discuss.elastic.co/u/dxygit1)\ **Replies:** 1\ **Last updated:** [June 18, 2024, 6:23am UTC](https://discuss.elastic.co/t/after-restoring-the-snapshot-the-index-is-not-associated-with-the-data-stream/361561 "2024-06-18T06:23:13Z")
Before deleting, the index was associated with a data stream. After restoring from the snapshot, the data stream was lost. curl -X POST "localhost:9200/\_snapshot/es-backup-log-analysis/log-analysis-2024.06.13-sflp5… --- ## [Unable to generate CSV when querying for just an IP address](https://discuss.elastic.co/t/unable-to-generate-csv-when-querying-for-just-an-ip-address/361620)
**Author:** [@hjazz6](https://discuss.elastic.co/u/hjazz6)\ **Replies:** 0\ **Last updated:** [June 18, 2024, 6:02am UTC](https://discuss.elastic.co/t/unable-to-generate-csv-when-querying-for-just-an-ip-address/361620 "2024-06-18T06:02:39Z")
Hi, I'm trying to search for an IP address in my data (ES v8.8.0). If I simply enter the IP in Kibana's Discovery's query bar, and I try to export the results into CSV, I get an empty file and the error Encountered an … --- ## [Junit for the elastic search ParsedFilter](https://discuss.elastic.co/t/junit-for-the-elastic-search-parsedfilter/361617)
**Author:** [@Bharathi\_ns](https://discuss.elastic.co/u/Bharathi_ns)\ **Replies:** 0\ **Last updated:** [June 18, 2024, 5:27am UTC](https://discuss.elastic.co/t/junit-for-the-elastic-search-parsedfilter/361617 "2024-06-18T05:27:48Z")
I am trying to cover Junit for Elasticsearch ParsedFilter. Code: private void returnDeviceColumnValues(List\ uniqueColumnValues, NativeSearchQuery searchQuery) { SearchHits\ searchHits = oper… --- ## [Replica allocation concurrent setting](https://discuss.elastic.co/t/replica-allocation-concurrent-setting/361313)
**Author:** [@chrwhy](https://discuss.elastic.co/u/chrwhy)\ **Replies:** 6\ **Last updated:** [June 18, 2024, 5:24am UTC](https://discuss.elastic.co/t/replica-allocation-concurrent-setting/361313 "2024-06-18T05:24:01Z")
Does anybody know what the replica concurrent setting is? I just set the number\_of\_replicas from 0 to 1 in a production environment with the below settings: cluster.routing.allocation.cluster\_concurrent\_rebalance": "10… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=217) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=219)