# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=22 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 23 --- ## [How to parse json from message field](https://discuss.elastic.co/t/how-to-parse-json-from-message-field/384560)
**Author:** [@k0i3n](https://discuss.elastic.co/u/k0i3n)\ **Replies:** 0\ **Last updated:** [January 15, 2026, 2:56pm UTC](https://discuss.elastic.co/t/how-to-parse-json-from-message-field/384560 "2026-01-15T14:56:01Z")
{ "headers": {}, "message": "�\\u0005Jan 15 15:54:00 10.104.65.41 date=2026-01-15 time=15:54:00 devname=\\"FW\_WAN\_01\\" devid=\\"FG201\\" eventtime=1768467240656260450 tz=\\"+0700\\" logid=\\"1059028704\\" type=\\"utm\\" subtyp… --- ## [Logstash - %{+YYYY} returns a year two years behind around year boundary – how is this possible?](https://discuss.elastic.co/t/logstash-yyyy-returns-a-year-two-years-behind-around-year-boundary-how-is-this-possible/384359)
**Author:** [@josh\_tran](https://discuss.elastic.co/u/josh_tran)\ **Replies:** 12\ **Last updated:** [January 15, 2026, 9:46am UTC](https://discuss.elastic.co/t/logstash-yyyy-returns-a-year-two-years-behind-around-year-boundary-how-is-this-possible/384359 "2026-01-15T09:46:00Z")
I have a Logstash pipeline where I build a timestamp string manually and then parse it into event.timestamp because we do not have a year value in the log message, there are just day and month in the file name. Environm… --- ## [Metricbeat 8 sql module leaks connections when using prepared statements](https://discuss.elastic.co/t/metricbeat-8-sql-module-leaks-connections-when-using-prepared-statements/377684)
**Author:** [@jay-dba](https://discuss.elastic.co/u/jay-dba)\ **Replies:** 2\ **Last updated:** [January 14, 2026, 10:16pm UTC](https://discuss.elastic.co/t/metricbeat-8-sql-module-leaks-connections-when-using-prepared-statements/377684 "2026-01-14T22:16:22Z")
We recently went from Metricbeat 7.14 to 8.14 We have found idle metricbeat connections piling up in mysql. Problem: We use the sql module to run queries on mysql. The queries use prepared statements. Since going to me… --- ## [Question about the implementation principle of post-filtering query for sparse vectors](https://discuss.elastic.co/t/question-about-the-implementation-principle-of-post-filtering-query-for-sparse-vectors/384540)
**Author:** [@Ningsir](https://discuss.elastic.co/u/Ningsir)\ **Replies:** 1\ **Last updated:** [January 14, 2026, 4:25pm UTC](https://discuss.elastic.co/t/question-about-the-implementation-principle-of-post-filtering-query-for-sparse-vectors/384540 "2026-01-14T16:25:21Z")
For the implementation of sparse vector post filtering, is it to query all results and then perform post filtering, or to query k results and then perform post filtering. { "query": { "bool": { "must": \[{"sp… --- ## [Kibana 8.19.9 – Multiple HIGH severity dependency vulnerabilities (npm & OS packages)](https://discuss.elastic.co/t/kibana-8-19-9-multiple-high-severity-dependency-vulnerabilities-npm-os-packages/384536)
**Author:** [@Shanmuga\_Sundaram\_Mu](https://discuss.elastic.co/u/Shanmuga_Sundaram_Mu)\ **Replies:** 1\ **Last updated:** [January 14, 2026, 10:13am UTC](https://discuss.elastic.co/t/kibana-8-19-9-multiple-high-severity-dependency-vulnerabilities-npm-os-packages/384536 "2026-01-14T10:13:21Z")
Product Details Product: Kibana Version: 8.19.9 Deployment: Self-managed / Community Build type: Official Elastic Docker / tar distribution Issue category: Third-party dependency vulnerabilities … --- ## [High CPU Usage on a few data nodes / Hotspotting of data](https://discuss.elastic.co/t/high-cpu-usage-on-a-few-data-nodes-hotspotting-of-data/383954)
**Author:** [@Lakshya\_Gupta](https://discuss.elastic.co/u/Lakshya_Gupta)\ **Replies:** 191\ **Last updated:** [January 14, 2026, 6:48am UTC](https://discuss.elastic.co/t/high-cpu-usage-on-a-few-data-nodes-hotspotting-of-data/383954 "2026-01-14T06:48:45Z")
Hi team, we have an Elastic Search Cluster with the following configurations ES Version 7.17.0 60 data nodes cluster 50 primary shards and 2 replica for each primary shards Here, we are using a particular custom routi… --- ## [Kibana 8.19.9 plugin build errors](https://discuss.elastic.co/t/kibana-8-19-9-plugin-build-errors/384516)
**Author:** [@kbujold\_wr](https://discuss.elastic.co/u/kbujold_wr)\ **Replies:** 0\ **Last updated:** [January 13, 2026, 5:18pm UTC](https://discuss.elastic.co/t/kibana-8-19-9-plugin-build-errors/384516 "2026-01-13T17:18:04Z")
Hi, how can I resolve this build issue with Kibana 8.19.9? yarn build yarn run v1.22.22 $ yarn plugin-helpers build --debug --verbose $ node ../../scripts/plugin\_helpers build --debug --verbose \[baseline-browser-mapping… --- ## [Schedule Report - kibana.configuration trouble](https://discuss.elastic.co/t/schedule-report-kibana-configuration-trouble/383080)
**Author:** [@Cristina\_Marletta\_Li](https://discuss.elastic.co/u/Cristina_Marletta_Li)\ **Replies:** 3\ **Last updated:** [January 13, 2026, 4:34pm UTC](https://discuss.elastic.co/t/schedule-report-kibana-configuration-trouble/383080 "2026-01-13T16:34:53Z")
Hi all, I have Elastic Stack version 8.19. Is it possible to schedule report sending without using watchers or URLs? We tried configuring this in kibana.yml: Kibana Email settings xpack.actions.preconfigured: my-emai… --- ## [How to measure daily log volume (count and size) in Elasticsearch?](https://discuss.elastic.co/t/how-to-measure-daily-log-volume-count-and-size-in-elasticsearch/384485)
**Author:** [@gueguet57](https://discuss.elastic.co/u/gueguet57)\ **Replies:** 3\ **Last updated:** [January 13, 2026, 3:30pm UTC](https://discuss.elastic.co/t/how-to-measure-daily-log-volume-count-and-size-in-elasticsearch/384485 "2026-01-13T15:30:00Z")
Hi Elastic community, I’m looking for a reliable way to track the amount of logs we are receiving in our Elasticsearch/ELK stack on a daily basis. Specifically, I’d like to know: The number of logs ingested per day. … --- ## [Request for Guidance on Resolving the ‘View in Context’ Issue in the Logs Stream Menu](https://discuss.elastic.co/t/request-for-guidance-on-resolving-the-view-in-context-issue-in-the-logs-stream-menu/384453)
**Author:** [@sjoh9163](https://discuss.elastic.co/u/sjoh9163)\ **Replies:** 6\ **Last updated:** [January 13, 2026, 11:03am UTC](https://discuss.elastic.co/t/request-for-guidance-on-resolving-the-view-in-context-issue-in-the-logs-stream-menu/384453 "2026-01-13T11:03:25Z")
Hello everyone, As part of applying security features to our ELK stack, we recently upgraded all components from version 8.14 to 8.19. During the upgrade, we initially encountered an issue where the Logs Stream menu wa… --- ## [Elastic Netflow integration (discrepancies with Nfsen)](https://discuss.elastic.co/t/elastic-netflow-integration-discrepancies-with-nfsen/384502)
**Author:** [@duckasylum](https://discuss.elastic.co/u/duckasylum)\ **Replies:** 0\ **Last updated:** [January 13, 2026, 10:59am UTC](https://discuss.elastic.co/t/elastic-netflow-integration-discrepancies-with-nfsen/384502 "2026-01-13T10:59:04Z")
I have a few Netflow collectors running pmacctd to collect netflow traffic. I send v9 to Nfsen and v10 (IPFIX) to an elastic agent with a configured netflow integration. My problem is that Nfsen shows close to 10 times m… --- ## [Create custom token filter](https://discuss.elastic.co/t/create-custom-token-filter/384497)
**Author:** [@sginer](https://discuss.elastic.co/u/sginer)\ **Replies:** 0\ **Last updated:** [January 13, 2026, 8:34am UTC](https://discuss.elastic.co/t/create-custom-token-filter/384497 "2026-01-13T08:34:08Z")
Elasticsearch version : 8.19.9 Elasticsearch version : 9.2.2 Hello, I try to create a custom TokenFilter who is able to cypher index content. I create the class who cypher tokens and extends TokenFilter class and I… --- ## [Bulk Read-only indexes on Upgrade Assistant from 8.19 to 9.1](https://discuss.elastic.co/t/bulk-read-only-indexes-on-upgrade-assistant-from-8-19-to-9-1/384490)
**Author:** [@agustin](https://discuss.elastic.co/u/agustin)\ **Replies:** 1\ **Last updated:** [January 12, 2026, 9:44pm UTC](https://discuss.elastic.co/t/bulk-read-only-indexes-on-upgrade-assistant-from-8-19-to-9-1/384490 "2026-01-12T21:44:48Z")
I am upgrading an 8.19 cluster to 9.1 using the Upgrade Assistant after spinning it up from our current 7.17 snapshot. I unfortunately have over 2k indices that require action, most of them deprecated but in the process … --- ## [Elasticsearch Java Client throws Exception when deserialize hotThreads response](https://discuss.elastic.co/t/elasticsearch-java-client-throws-exception-when-deserialize-hotthreads-response/365144)
**Author:** [@corojoon93](https://discuss.elastic.co/u/corojoon93)\ **Replies:** 5\ **Last updated:** [January 12, 2026, 2:13pm UTC](https://discuss.elastic.co/t/elasticsearch-java-client-throws-exception-when-deserialize-hotthreads-response/365144 "2026-01-12T14:13:16Z")
I used "co.elastic.clients:elasticsearch-java:8.15.0", "org.springframework.boot:3.2.7" And this is my Java code. @Service @RequiredArgsConstructor public class NodeHealthService { private final ElasticsearchClien… --- ## [failed to retrieve shard stats from node \[zxt4RAOiRZy9Lol9IdIGfg\]: \[node\_2\]\[10.202.152.18:9300\]\[indices:monitor/stats\[n\]\] request\_id \[77247 683\] timed out after \[15016ms\]](https://discuss.elastic.co/t/failed-to-retrieve-shard-stats-from-node-zxt4raoirzy9lol9idigfg-node-2-10-202-152-18-9300-indices-monitor-stats-n-request-id-77247-683-timed-out-after-15016ms/357076)
**Author:** [@zuomengjun](https://discuss.elastic.co/u/zuomengjun)\ **Replies:** 1\ **Last updated:** [January 12, 2026, 1:34pm UTC](https://discuss.elastic.co/t/failed-to-retrieve-shard-stats-from-node-zxt4raoirzy9lol9idigfg-node-2-10-202-152-18-9300-indices-monitor-stats-n-request-id-77247-683-timed-out-after-15016ms/357076 "2026-01-12T13:34:45Z")
ES total 3 nodes: 18, 10, 15 ES occasionally reports a timeout, help to see what might be the problem? And the cpu and RAM weren't high at the time This is the elasticsearch server log: \[2024-04-02T17:43:47,318\]\[WARN … --- ## [Failing to Start - License issue?](https://discuss.elastic.co/t/failing-to-start-license-issue/384468)
**Author:** [@aurora](https://discuss.elastic.co/u/aurora)\ **Replies:** 4\ **Last updated:** [January 11, 2026, 9:44pm UTC](https://discuss.elastic.co/t/failing-to-start-license-issue/384468 "2026-01-11T21:44:27Z")
I’m trying to start ES 9.0.2 as a service. Every time, the service fails with an error 143. One thing of note is that in the logs its telling me my license is not valid despite just using a basic license. I can start ela… --- ## [Filebeat Bug: journal remote directory unhandled](https://discuss.elastic.co/t/filebeat-bug-journal-remote-directory-unhandled/384467)
**Author:** [@log1](https://discuss.elastic.co/u/log1)\ **Replies:** 0\ **Last updated:** [January 11, 2026, 12:17am UTC](https://discuss.elastic.co/t/filebeat-bug-journal-remote-directory-unhandled/384467 "2026-01-11T00:17:48Z")
Filebeat version: 8.19.9 OS: Debian 13 Documentation here Journald input | Beats, states: For example, this configuration will ingest all journals and correctly handle the journald rotation: - type: journald id: jo… --- ## [RHEL 10 support for Elasticsearch 8 and 9](https://discuss.elastic.co/t/rhel-10-support-for-elasticsearch-8-and-9/384461)
**Author:** [@sblack](https://discuss.elastic.co/u/sblack)\ **Replies:** 3\ **Last updated:** [January 10, 2026, 11:34pm UTC](https://discuss.elastic.co/t/rhel-10-support-for-elasticsearch-8-and-9/384461 "2026-01-10T23:34:25Z")
Does Elasticsearch 8.18.X, 8.19.X and 9.X (plus Logstash, Kibana, Fleet and Beats) support RHEL 10? I am referring to the licensed version and not just the OSS version. A quick perusal indicates that there is no issues … --- ## [Linux System User Elasticsearch](https://discuss.elastic.co/t/linux-system-user-elasticsearch/384456)
**Author:** [@aurora](https://discuss.elastic.co/u/aurora)\ **Replies:** 2\ **Last updated:** [January 10, 2026, 11:39am UTC](https://discuss.elastic.co/t/linux-system-user-elasticsearch/384456 "2026-01-10T11:39:05Z")
I’m pretty sure I installed v9.0.2 from a tarball on an ubuntu fork, so I didn’t automatically get a no-login user created to run a systemd unit. Are there any elasticsearch specific things I need to know about creating … --- ## [Error during agent enrollment](https://discuss.elastic.co/t/error-during-agent-enrollment/384246)
**Author:** [@Viktor\_Movita](https://discuss.elastic.co/u/Viktor_Movita)\ **Replies:** 2\ **Last updated:** [January 9, 2026, 3:15pm UTC](https://discuss.elastic.co/t/error-during-agent-enrollment/384246 "2026-01-09T15:15:32Z")
Hello everyone, I am trying to install Elastic Agent version 8.16.2 on Windows servers. On some servers the installation succeeds, but on others it fails with the error: failed to create new agent info: could not get … --- ## [Looking for AI solutions that will be able to access our Private Elastic](https://discuss.elastic.co/t/looking-for-ai-solutions-that-will-be-able-to-access-our-private-elastic/384447)
**Author:** [@HaroldMelamed](https://discuss.elastic.co/u/HaroldMelamed)\ **Replies:** 0\ **Last updated:** [January 9, 2026, 1:12am UTC](https://discuss.elastic.co/t/looking-for-ai-solutions-that-will-be-able-to-access-our-private-elastic/384447 "2026-01-09T01:12:30Z")
Not sure what this would be under, but we have Elastic inhouse and are looking for an AI solution that would use our data housed in Elastic. I did see a demonstration offered on 1/13, but its in Europe and the time wo… --- ## [We see that "Filebeat - OSS-only distribution only includes features licensed under the Apache 2.0 license" but it includes elastic-agent-client which comes under elastic license](https://discuss.elastic.co/t/we-see-that-filebeat-oss-only-distribution-only-includes-features-licensed-under-the-apache-2-0-license-but-it-includes-elastic-agent-client-which-comes-under-elastic-license/382607)
**Author:** [@Jeya\_Pradeen1](https://discuss.elastic.co/u/Jeya_Pradeen1)\ **Replies:** 4\ **Last updated:** [January 8, 2026, 9:08pm UTC](https://discuss.elastic.co/t/we-see-that-filebeat-oss-only-distribution-only-includes-features-licensed-under-the-apache-2-0-license-but-it-includes-elastic-agent-client-which-comes-under-elastic-license/382607 "2026-01-08T21:08:20Z")
We see that "Filebeat - OSS-only distribution only includes features licensed under the Apache 2.0 license" but it includes elastic-agent-client which comes under elastic license. Blackduck scanning tools detect elastic… --- ## [Error when configuring Cloudflare LogPush integration for R2](https://discuss.elastic.co/t/error-when-configuring-cloudflare-logpush-integration-for-r2/380052)
**Author:** [@taprove](https://discuss.elastic.co/u/taprove)\ **Replies:** 4\ **Last updated:** [January 8, 2026, 3:18pm UTC](https://discuss.elastic.co/t/error-when-configuring-cloudflare-logpush-integration-for-r2/380052 "2026-01-08T15:18:54Z")
No matter what configurations I try with the Cloudflare Logpush integration, the following error shows in the log: \[elastic\_agent\]\[error\] Unit state changed aws-s3-default-aws-s3-cloudflare-xxxxxx-xxxx-xxx-xxx-xxxxxxxxx… --- ## [How I can get 2 fields values in Elastic Search](https://discuss.elastic.co/t/how-i-can-get-2-fields-values-in-elastic-search/384419)
**Author:** [@SivaK](https://discuss.elastic.co/u/SivaK)\ **Replies:** 7\ **Last updated:** [January 8, 2026, 2:59pm UTC](https://discuss.elastic.co/t/how-i-can-get-2-fields-values-in-elastic-search/384419 "2026-01-08T14:59:06Z")
I am trying as follows : Create visualization of custom field, which is addition of 2 available fields. How I can get this, so in my dashboard data updates automatically. --- ## [Does 31GB heap limit mean max 2TB disk per hot node with 1:30 ratio?](https://discuss.elastic.co/t/does-31gb-heap-limit-mean-max-2tb-disk-per-hot-node-with-1-30-ratio/384412)
**Author:** [@juan\_ma\_tejada](https://discuss.elastic.co/u/juan_ma_tejada)\ **Replies:** 5\ **Last updated:** [January 8, 2026, 2:47pm UTC](https://discuss.elastic.co/t/does-31gb-heap-limit-mean-max-2tb-disk-per-hot-node-with-1-30-ratio/384412 "2026-01-08T14:47:46Z")
Hi community,I'm confused about applying the 1:30 RAM:disk ratio for hot nodes with the JVM heap limit. My understanding:1:30 ratio means 1 GB RAM per 30 GB disk capacity for hot nodes For 2 TB (2000 GB) disk → need ~6… --- ## [ES|QL: How to count latest status per key without transform](https://discuss.elastic.co/t/es-ql-how-to-count-latest-status-per-key-without-transform/384430)
**Author:** [@Tortoise](https://discuss.elastic.co/u/Tortoise)\ **Replies:** 1\ **Last updated:** [January 8, 2026, 8:20am UTC](https://discuss.elastic.co/t/es-ql-how-to-count-latest-status-per-key-without-transform/384430 "2026-01-08T08:20:14Z")
Hello Team, I am trying to compute metrics based only on the latest record per key using ES|QL in 9.x version? I have a time-series index where each entity (e.g. trainnumber) emits multiple events over time and I want … --- ## [Is a Webhook Connector possible to use for Elastic Assistant](https://discuss.elastic.co/t/is-a-webhook-connector-possible-to-use-for-elastic-assistant/384428)
**Author:** [@robert.bonagura](https://discuss.elastic.co/u/robert.bonagura)\ **Replies:** 1\ **Last updated:** [January 7, 2026, 10:44pm UTC](https://discuss.elastic.co/t/is-a-webhook-connector-possible-to-use-for-elastic-assistant/384428 "2026-01-07T22:44:25Z")
My enterprise does not hand out direct access to LLM API endpoints, all LLM API access is proxied through an internal tool to govern and manage LLM API calls at scale. That being said, if I do not have direct access to … --- ## [Elastic Agent Logs Disk Usage and Shard Count](https://discuss.elastic.co/t/elastic-agent-logs-disk-usage-and-shard-count/384417)
**Author:** [@jnpetty](https://discuss.elastic.co/u/jnpetty)\ **Replies:** 4\ **Last updated:** [January 7, 2026, 9:44pm UTC](https://discuss.elastic.co/t/elastic-agent-logs-disk-usage-and-shard-count/384417 "2026-01-07T21:44:55Z")
I’m looking for some help on how to better handle log data generated by Elastic. For example, what looks to be Elastic Agent log data is consuming almost 4.5tb on our frozen tier, double the size of any other dataset on … --- ## [System logs not collected on some Elastic Agent policies](https://discuss.elastic.co/t/system-logs-not-collected-on-some-elastic-agent-policies/384426)
**Author:** [@nazok123](https://discuss.elastic.co/u/nazok123)\ **Replies:** 0\ **Last updated:** [January 7, 2026, 6:20pm UTC](https://discuss.elastic.co/t/system-logs-not-collected-on-some-elastic-agent-policies/384426 "2026-01-07T18:20:00Z")
Hi everyone, We use Elastic as a SIEM. I have several Elastic Agent policies, and the same agents are assigned to multiple policies. However, on some of the policies, system logs from the sources are not being collecte… --- ## [Logstash GROK](https://discuss.elastic.co/t/logstash-grok/384394)
**Author:** [@Elk\_huh](https://discuss.elastic.co/u/Elk_huh)\ **Replies:** 2\ **Last updated:** [January 7, 2026, 12:00pm UTC](https://discuss.elastic.co/t/logstash-grok/384394 "2026-01-07T12:00:00Z")
"\<190\>606524: 876342: Jan 6 2026 17:27:24.835 UTC: %SEC-6-IPACCESSLOGP: list BLOCK-Wifi denied udp 11.12.2.75(51811) -\> 111.22.13.60(5246), 2 packets " Grok Parser succeeds but i am getting grok error in Elastics… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=21) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=23)