# Elastic Stack

**URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=222

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 223

---

## [No histogram for filebeat logstream in Kibana 8? (Discover mode)](https://discuss.elastic.co/t/no-histogram-for-filebeat-logstream-in-kibana-8-discover-mode/361260)

<div class="topic-metadata">

**Author:** [@Romano](https://discuss.elastic.co/u/Romano)\
**Replies:** 2\
**Last updated:** [June 12, 2024, 11:21am UTC](https://discuss.elastic.co/t/no-histogram-for-filebeat-logstream-in-kibana-8-discover-mode/361260 "2024-06-12T11:21:45Z")

</div>

Hi. My previous stack was on version 7 - syslog-\>filebeat-\>elasticsearch, and in this setup I had two working bits: filebeat-\* log index in Discover mode I had a histogram and time range, so I was able to search by da…

---

## [The error message stack trace log is being printed in separate rows instead of a single row](https://discuss.elastic.co/t/the-error-message-stack-trace-log-is-being-printed-in-separate-rows-instead-of-a-single-row/358626)

<div class="topic-metadata">

**Author:** [@kasecen637](https://discuss.elastic.co/u/kasecen637)\
**Replies:** 4\
**Last updated:** [June 12, 2024, 10:53am UTC](https://discuss.elastic.co/t/the-error-message-stack-trace-log-is-being-printed-in-separate-rows-instead-of-a-single-row/358626 "2024-06-12T10:53:53Z")

</div>

Hi Elastic Discuss Community, In kibana when i seee the logs message when an error log messges comes it print every error messge in every different line i want that the error message whole stack trace log should get in …

---

## [Is there any tool outside that allows me to write JavaScript code as Scripts?](https://discuss.elastic.co/t/is-there-any-tool-outside-that-allows-me-to-write-javascript-code-as-scripts/361281)

<div class="topic-metadata">

**Author:** [@Edy\_Silva](https://discuss.elastic.co/u/Edy_Silva)\
**Replies:** 0\
**Last updated:** [June 11, 2024, 4:27pm UTC](https://discuss.elastic.co/t/is-there-any-tool-outside-that-allows-me-to-write-javascript-code-as-scripts/361281 "2024-06-11T16:27:47Z")

</div>

Painless is not quite painless. My team has been struggling with painless scripts due to a couple of reasons: (as far as I know) it's not possible to execute scripts locally - it would be great to write unit tests; pai…

---

## [Intermittent data loss in kinesis logstash input plugin](https://discuss.elastic.co/t/intermittent-data-loss-in-kinesis-logstash-input-plugin/361312)

<div class="topic-metadata">

**Author:** [@Amol\_Gaitonde1](https://discuss.elastic.co/u/Amol_Gaitonde1)\
**Replies:** 0\
**Last updated:** [June 12, 2024, 9:26am UTC](https://discuss.elastic.co/t/intermittent-data-loss-in-kinesis-logstash-input-plugin/361312 "2024-06-12T09:26:55Z")

</div>

We are using kinesis input plugin in logstash to fetch data from cloudwatch. Below is the configuration setting. The issue which we are facing is intermittent data loss without any errors. We are not able to find the r…

---

## [I cannot create a dynamic mapping](https://discuss.elastic.co/t/i-cannot-create-a-dynamic-mapping/361249)

<div class="topic-metadata">

**Author:** [@simeonch7](https://discuss.elastic.co/u/simeonch7)\
**Replies:** 2\
**Last updated:** [June 12, 2024, 9:26am UTC](https://discuss.elastic.co/t/i-cannot-create-a-dynamic-mapping/361249 "2024-06-12T09:26:45Z")

</div>

Hello everyone, I am trying to create two index templates via the UI - one of them has a dynamic mapping that would keep only text fields for all strings from an event, and one that would keep only keyword fields. I wa…

---

## [Elasticsearch Query for Exact Substring Matching with Spaces](https://discuss.elastic.co/t/elasticsearch-query-for-exact-substring-matching-with-spaces/361216)

<div class="topic-metadata">

**Author:** [@Umang\_Kamdar](https://discuss.elastic.co/u/Umang_Kamdar)\
**Replies:** 8\
**Last updated:** [June 12, 2024, 9:09am UTC](https://discuss.elastic.co/t/elasticsearch-query-for-exact-substring-matching-with-spaces/361216 "2024-06-12T09:09:07Z")

</div>

I'm trying to perform an exact substring match in Elasticsearch, including substrings that contain spaces. Here’s what I need: Search for an exact substring within a larger text field. The substring may contain spaces. …

---

## [Create Pie chart](https://discuss.elastic.co/t/create-pie-chart/361292)

<div class="topic-metadata">

**Author:** [@Anupama2262](https://discuss.elastic.co/u/Anupama2262)\
**Replies:** 2\
**Last updated:** [June 12, 2024, 7:32am UTC](https://discuss.elastic.co/t/create-pie-chart/361292 "2024-06-12T07:32:25Z")

</div>

I have two fields in my data 'type' field and 'count' field. I want to create pie chart without any of the aggregation. I want to create pie chart based on the type and count. How to do that in kibana lens?

---

## [TLS1.1 disable in Fleet Server](https://discuss.elastic.co/t/tls1-1-disable-in-fleet-server/361245)

<div class="topic-metadata">

**Author:** [@Thorsten\_82](https://discuss.elastic.co/u/Thorsten_82)\
**Replies:** 2\
**Last updated:** [June 12, 2024, 6:30am UTC](https://discuss.elastic.co/t/tls1-1-disable-in-fleet-server/361245 "2024-06-12T06:30:44Z")

</div>

Hello, I want do disable TLS1.1 support in Elastic Agent (Fleet Server). In Custom fleet-server configurations I tried to set the "ssl.supported\_protocols: \[TLSv1.2\]" but with no effect. With "elastic-agent inspect" I…

---

## [Data ingestion to elastic in near real time from mongo db](https://discuss.elastic.co/t/data-ingestion-to-elastic-in-near-real-time-from-mongo-db/361124)

<div class="topic-metadata">

**Author:** [@Moni\_Hazarika](https://discuss.elastic.co/u/Moni_Hazarika)\
**Replies:** 5\
**Last updated:** [June 12, 2024, 5:57am UTC](https://discuss.elastic.co/t/data-ingestion-to-elastic-in-near-real-time-from-mongo-db/361124 "2024-06-12T05:57:48Z")

</div>

Our csharp dotnet application uses MongoDB for ACID compliance and primarily as the main data storage. We are in the process of moving/mirroring some of the information from our key collections to Elastic. So the transac…

---

## [Login to Kibana instance with automatic user generation based on Proxy Header](https://discuss.elastic.co/t/login-to-kibana-instance-with-automatic-user-generation-based-on-proxy-header/361181)

<div class="topic-metadata">

**Author:** [@Songspore2](https://discuss.elastic.co/u/Songspore2)\
**Replies:** 1\
**Last updated:** [June 12, 2024, 5:55am UTC](https://discuss.elastic.co/t/login-to-kibana-instance-with-automatic-user-generation-based-on-proxy-header/361181 "2024-06-12T05:55:40Z")

</div>

I am looking for a method to login to my organizations Kibana using a Request Header rather than actually authenticating. My organization uses Cloudflare Access, which provides the header Cf-Access-Authenticated-User-Ema…

---

## [Increasing number of Alerts for Detection Rules](https://discuss.elastic.co/t/increasing-number-of-alerts-for-detection-rules/357064)

<div class="topic-metadata">

**Author:** [@uhxqc](https://discuss.elastic.co/u/uhxqc)\
**Replies:** 17\
**Last updated:** [June 12, 2024, 1:14am UTC](https://discuss.elastic.co/t/increasing-number-of-alerts-for-detection-rules/357064 "2024-06-12T01:14:38Z")

</div>

Hello, I am currently using the open source version of Elastic. I have created a couple of Detection Rules. But the number of alerts I can create per rule is limited to 100. If my understanding is correct, the number o…

---

## [Possible Bug with Links?](https://discuss.elastic.co/t/possible-bug-with-links/360991)

<div class="topic-metadata">

**Author:** [@erikg](https://discuss.elastic.co/u/erikg)\
**Replies:** 5\
**Last updated:** [June 11, 2024, 9:40pm UTC](https://discuss.elastic.co/t/possible-bug-with-links/360991 "2024-06-11T21:40:51Z")

</div>

Hello, Links can be saved to library. So any changes to the Links panel should reflect to all instances of Links. Current Issue: It seems like if you apply Links settings in one dashboard. And it doesn''t sync with L…

---

## [Troubleshooting Drill-Downs: Copying Kibana Dashboards Across Spaces in Elastic 8.13.3](https://discuss.elastic.co/t/troubleshooting-drill-downs-copying-kibana-dashboards-across-spaces-in-elastic-8-13-3/361000)

<div class="topic-metadata">

**Author:** [@Aamir1](https://discuss.elastic.co/u/Aamir1)\
**Replies:** 1\
**Last updated:** [June 11, 2024, 6:56pm UTC](https://discuss.elastic.co/t/troubleshooting-drill-downs-copying-kibana-dashboards-across-spaces-in-elastic-8-13-3/361000 "2024-06-11T18:56:11Z")

</div>

Hello experts! I hope you all are doing well. I need some help with a drill-down issue in the Kibana system dashboard visualizations. I am currently using Elastic 8.13.3, and the data is being sourced through the Fleet…

---

## [Why doesn't Observability have EQL Alerts?](https://discuss.elastic.co/t/why-doesnt-observability-have-eql-alerts/361285)

<div class="topic-metadata">

**Author:** [@erikg](https://discuss.elastic.co/u/erikg)\
**Replies:** 0\
**Last updated:** [June 11, 2024, 6:29pm UTC](https://discuss.elastic.co/t/why-doesnt-observability-have-eql-alerts/361285 "2024-06-11T18:29:10Z")

</div>

I noticed that EQL is used to find event correlations with different data sources. I understand why Elastic Security leverages but as a user on the Observability side, it would be so beneficial to use EQL?

---

## [Accidentally deleted http\_ca.crt. how to recover! urgent! please!](https://discuss.elastic.co/t/accidentally-deleted-http-ca-crt-how-to-recover-urgent-please/360965)

<div class="topic-metadata">

**Author:** [@evangelin](https://discuss.elastic.co/u/evangelin)\
**Replies:** 7\
**Last updated:** [June 11, 2024, 6:27pm UTC](https://discuss.elastic.co/t/accidentally-deleted-http-ca-crt-how-to-recover-urgent-please/360965 "2024-06-11T18:27:32Z")

</div>

hello, deleted ca.crt. I'm getting the below error in logstash \[2024-06-06T18:17:02,766\]\[WARN \]\[logstash.outputs.elasticsearch\]\[main\] Attempted to resurrect connection to dead ES instance, but got an error {:url=\>"http…

---

## [Which Elasticsearch versions work for the s390x architecture?](https://discuss.elastic.co/t/which-elasticsearch-versions-work-for-the-s390x-architecture/361262)

<div class="topic-metadata">

**Author:** [@musharaf](https://discuss.elastic.co/u/musharaf)\
**Replies:** 3\
**Last updated:** [June 11, 2024, 3:16pm UTC](https://discuss.elastic.co/t/which-elasticsearch-versions-work-for-the-s390x-architecture/361262 "2024-06-11T15:16:03Z")

</div>

Which Elasticsearch versions work for the s390x architecture?

---

## [Restricted Data Views](https://discuss.elastic.co/t/restricted-data-views/361265)

<div class="topic-metadata">

**Author:** [@matheuslimx](https://discuss.elastic.co/u/matheuslimx)\
**Replies:** 0\
**Last updated:** [June 11, 2024, 2:09pm UTC](https://discuss.elastic.co/t/restricted-data-views/361265 "2024-06-11T14:09:22Z")

</div>

Hi, Is there a way to restrict data views for different users within the same space, or the only way is creating spaces for every specific user ? thanks !

---

## [In Elastic Fleet Agent, how are IDs generated for agents and machines? Is there a way to customize or standardize the ID generation to avoid showing duplicate inactive machines with the same names?](https://discuss.elastic.co/t/in-elastic-fleet-agent-how-are-ids-generated-for-agents-and-machines-is-there-a-way-to-customize-or-standardize-the-id-generation-to-avoid-showing-duplicate-inactive-machines-with-the-same-names/361036)

<div class="topic-metadata">

**Author:** [@Danyal\_Danish](https://discuss.elastic.co/u/Danyal_Danish)\
**Replies:** 7\
**Last updated:** [June 11, 2024, 12:51pm UTC](https://discuss.elastic.co/t/in-elastic-fleet-agent-how-are-ids-generated-for-agents-and-machines-is-there-a-way-to-customize-or-standardize-the-id-generation-to-avoid-showing-duplicate-inactive-machines-with-the-same-names/361036 "2024-06-11T12:51:18Z")

</div>

Every day, new agents or machines are created and deleted in our Elastic Fleet environment. As shown in the attached image, some agents are active (healthy), while others are inactive (offline). The issue we're encounter…

---

## [How to change configuration file path?](https://discuss.elastic.co/t/how-to-change-configuration-file-path/361114)

<div class="topic-metadata">

**Author:** [@apashnin.work](https://discuss.elastic.co/u/apashnin.work)\
**Replies:** 2\
**Last updated:** [June 11, 2024, 12:24pm UTC](https://discuss.elastic.co/t/how-to-change-configuration-file-path/361114 "2024-06-11T12:24:10Z")

</div>

If I want to store /etc/elasticsearch/elasticsearch.yml file somewhere else how can I specify it to Elasticsearch service?

---

## [Intermittent Connection Timeouts and "No Living Connections" Issues with AWS OpenSearch](https://discuss.elastic.co/t/intermittent-connection-timeouts-and-no-living-connections-issues-with-aws-opensearch/361211)

<div class="topic-metadata">

**Author:** [@Ganapathi\_Subramania](https://discuss.elastic.co/u/Ganapathi_Subramania)\
**Replies:** 3\
**Last updated:** [June 11, 2024, 12:10pm UTC](https://discuss.elastic.co/t/intermittent-connection-timeouts-and-no-living-connections-issues-with-aws-opensearch/361211 "2024-06-11T12:10:25Z")

</div>

Hi everyone, We have hosted our Elasticsearch using AWS OpenSearch service with the following configuration: Instance type: m5.large.search EBS volume size: 150 GiB Provisioned IOPS: 3000 IOPS Provisioned Throughput: …

---

## [In-place Upgradation](https://discuss.elastic.co/t/in-place-upgradation/361182)

<div class="topic-metadata">

**Author:** [@Aditya\_Teltia](https://discuss.elastic.co/u/Aditya_Teltia)\
**Replies:** 3\
**Last updated:** [June 11, 2024, 11:52am UTC](https://discuss.elastic.co/t/in-place-upgradation/361182 "2024-06-11T11:52:33Z")

</div>

We are trying to in-place upgradation of our elasticsearch cluster. We operate on timesharded index so what we were thinking is currently the cluster is on ES-7.17.6 version. We will upgrade the cluster to ES-8.11.1 an…

---

## [Pre migration step "Migrate system indices" failed](https://discuss.elastic.co/t/pre-migration-step-migrate-system-indices-failed/360822)

<div class="topic-metadata">

**Author:** [@mansoorpn](https://discuss.elastic.co/u/mansoorpn)\
**Replies:** 3\
**Last updated:** [June 11, 2024, 11:32am UTC](https://discuss.elastic.co/t/pre-migration-step-migrate-system-indices-failed/360822 "2024-06-11T11:32:41Z")

</div>

Hello, We checked the pre-migration step before upgrading the cloud instance from 7.17.5 to 8. The "Migrate system indices" step failed with the error " System indices migration failed, An error occurred while migratin…

---

## [Java APM not sending events from kubernetes to Elastic Server](https://discuss.elastic.co/t/java-apm-not-sending-events-from-kubernetes-to-elastic-server/361110)

<div class="topic-metadata">

**Author:** [@ansuman04](https://discuss.elastic.co/u/ansuman04)\
**Replies:** 2\
**Last updated:** [June 11, 2024, 8:35am UTC](https://discuss.elastic.co/t/java-apm-not-sending-events-from-kubernetes-to-elastic-server/361110 "2024-06-11T08:35:58Z")

</div>

My Spring boot service is getting registered. But I am not able to see any metrices under Elastic APM for my Service. agent version is 1.50.0 server version is 8.12.2 micrometer version 1.2.4 Below is my elastic conf…

---

## [Multiple pipelines: StringIndexOutOfBoundsException: String index out of range: -1](https://discuss.elastic.co/t/multiple-pipelines-stringindexoutofboundsexception-string-index-out-of-range-1/360714)

<div class="topic-metadata">

**Author:** [@om-myc](https://discuss.elastic.co/u/om-myc)\
**Replies:** 2\
**Last updated:** [June 11, 2024, 8:14am UTC](https://discuss.elastic.co/t/multiple-pipelines-stringindexoutofboundsexception-string-index-out-of-range-1/360714 "2024-06-11T08:14:20Z")

</div>

Hello everybody, i recently set up an ELK stack and am running Logstash on a Windows host which processes input from log files and sends them to elasticsearch on another host. I use the "collector pattern" to process t…

---

## [Using proxy on datadog\_output\_logs plugin on logstash](https://discuss.elastic.co/t/using-proxy-on-datadog-output-logs-plugin-on-logstash/361219)

<div class="topic-metadata">

**Author:** [@Kalaivani\_C](https://discuss.elastic.co/u/Kalaivani_C)\
**Replies:** 1\
**Last updated:** [June 11, 2024, 7:00am UTC](https://discuss.elastic.co/t/using-proxy-on-datadog-output-logs-plugin-on-logstash/361219 "2024-06-11T07:00:14Z")

</div>

Hello Team, Problem Statement: Logstash events are not reaching datadog. HTTP connection to datadog starts but no payloads are sent. Can you confirm if the proxy parameter in the logstash pipeline is correct? Please re…

---

## [Filebeats shipping outdated logs or simply not working](https://discuss.elastic.co/t/filebeats-shipping-outdated-logs-or-simply-not-working/361204)

<div class="topic-metadata">

**Author:** [@aklenfan](https://discuss.elastic.co/u/aklenfan)\
**Replies:** 0\
**Last updated:** [June 11, 2024, 12:38am UTC](https://discuss.elastic.co/t/filebeats-shipping-outdated-logs-or-simply-not-working/361204 "2024-06-11T00:38:36Z")

</div>

Hey team, We're using Filebeats 7.11.1 (via a Graylog sidecar installation) to send logs from a Windows server to Graylog. However, our current configuration is shipping logs that are months or a year old, despite our s…

---

## [What are the actual benefits of Elastic Agent?](https://discuss.elastic.co/t/what-are-the-actual-benefits-of-elastic-agent/360675)

<div class="topic-metadata">

**Author:** [@jerrac](https://discuss.elastic.co/u/jerrac)\
**Replies:** 4\
**Last updated:** [June 10, 2024, 9:49pm UTC](https://discuss.elastic.co/t/what-are-the-actual-benefits-of-elastic-agent/360675 "2024-06-10T21:49:23Z")

</div>

I started writing this as a reply on this issue: Offer a lightweight Elastic Agent · Issue #3364 · elastic/elastic-agent · GitHub, but then it morphed into it's own thing and I decided it would be better off here. I rea…

---

## [Is circuit breaker config help to control Memory usage](https://discuss.elastic.co/t/is-circuit-breaker-config-help-to-control-memory-usage/361125)

<div class="topic-metadata">

**Author:** [@nchalise](https://discuss.elastic.co/u/nchalise)\
**Replies:** 3\
**Last updated:** [June 10, 2024, 9:45pm UTC](https://discuss.elastic.co/t/is-circuit-breaker-config-help-to-control-memory-usage/361125 "2024-06-10T21:45:04Z")

</div>

Is circuit breaker configuration help to control the Memory usage? By default it is 95% but I noticed that the memory reach to 99% in some of the nodes. Is there any other way to control the memory usage via configurati…

---

## [ERROR: Elasticsearch exited unexpectedly, with exit code 137](https://discuss.elastic.co/t/error-elasticsearch-exited-unexpectedly-with-exit-code-137/361047)

<div class="topic-metadata">

**Author:** [@optimuspur3](https://discuss.elastic.co/u/optimuspur3)\
**Replies:** 2\
**Last updated:** [June 10, 2024, 9:27pm UTC](https://discuss.elastic.co/t/error-elasticsearch-exited-unexpectedly-with-exit-code-137/361047 "2024-06-10T21:27:25Z")

</div>

I have been using this guide to setup an ELK. Current version of Ubuntu: 20.04 Elasticsearch version: 8.1 Hiding my IP address but when I start up Logstash after finishing configuring Logstash configuration, Elastics…

---

## [xpack.encryptedSavedObjects.encryptionKey value not working in Kibana](https://discuss.elastic.co/t/xpack-encryptedsavedobjects-encryptionkey-value-not-working-in-kibana/361079)

<div class="topic-metadata">

**Author:** [@fruitbat](https://discuss.elastic.co/u/fruitbat)\
**Replies:** 4\
**Last updated:** [June 10, 2024, 9:17pm UTC](https://discuss.elastic.co/t/xpack-encryptedsavedobjects-encryptionkey-value-not-working-in-kibana/361079 "2024-06-10T21:17:01Z")

</div>

Hello, I recently upgraded from 7.17 to 8.14 with both Elasticsearch and Kibana. One problem I'm experiencing is I am no longer able to access any of my rules and connectors which were previously notifying me of changes…

[Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=221)

[Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=223)
