# Elastic Stack

**URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=229

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 230

---

## [Snapshot repository-s3 registry failed in 7.17](https://discuss.elastic.co/t/snapshot-repository-s3-registry-failed-in-7-17/360422)

<div class="topic-metadata">

**Author:** [@dove-young](https://discuss.elastic.co/u/dove-young)\
**Replies:** 5\
**Last updated:** [May 30, 2024, 3:19am UTC](https://discuss.elastic.co/t/snapshot-repository-s3-registry-failed-in-7-17/360422 "2024-05-30T03:19:08Z")

</div>

I run elasticsearch docker container as described in quickstart Quick start | Elasticsearch Guide \[7.17\] | Elastic, then I installed repository-s3 plugin and restarted container. I have a local minio server act as S3 s…

---

## [How to migrate/upgrade Elastic Cloud v6.8.18 (Elasticsearch + Kibana) to 7.x version](https://discuss.elastic.co/t/how-to-migrate-upgrade-elastic-cloud-v6-8-18-elasticsearch-kibana-to-7-x-version/360518)

<div class="topic-metadata">

**Author:** [@mlogar](https://discuss.elastic.co/u/mlogar)\
**Replies:** 0\
**Last updated:** [May 29, 2024, 10:16pm UTC](https://discuss.elastic.co/t/how-to-migrate-upgrade-elastic-cloud-v6-8-18-elasticsearch-kibana-to-7-x-version/360518 "2024-05-29T22:16:25Z")

</div>

Hi, I'm new here. I'm looking for the (proper or best) way to upgrade/migrate AWS an Elastic Cloud v6.8.18 (Elasticsearch + Kibana) deployment to version 7.x. I have found suggestions related to restoring a snapshot fr…

---

## [Kibana error "kibana the content length is bigger than the maximum allowed string"](https://discuss.elastic.co/t/kibana-error-kibana-the-content-length-is-bigger-than-the-maximum-allowed-string/360511)

<div class="topic-metadata">

**Author:** [@amoghbarve](https://discuss.elastic.co/u/amoghbarve)\
**Replies:** 0\
**Last updated:** [May 29, 2024, 8:26pm UTC](https://discuss.elastic.co/t/kibana-error-kibana-the-content-length-is-bigger-than-the-maximum-allowed-string/360511 "2024-05-29T20:26:54Z")

</div>

Hi All I am getting error in kibana while accessing kindly suggest Error kibana the content length is bigger than the maximum allowed string

---

## [Import csv and match on column values](https://discuss.elastic.co/t/import-csv-and-match-on-column-values/360508)

<div class="topic-metadata">

**Author:** [@ACW606](https://discuss.elastic.co/u/ACW606)\
**Replies:** 0\
**Last updated:** [May 29, 2024, 8:13pm UTC](https://discuss.elastic.co/t/import-csv-and-match-on-column-values/360508 "2024-05-29T20:13:55Z")

</div>

We are using v8.11.3. I would like to import a csv with a long list of usernames. In my Kibana query of login logs, I'd like to match against values in the csv. Last, if a user login in my logs doesn't match a value in t…

---

## [Usage of Elastic APIs to get Kubernetes node and container metrics](https://discuss.elastic.co/t/usage-of-elastic-apis-to-get-kubernetes-node-and-container-metrics/360507)

<div class="topic-metadata">

**Author:** [@Raman\_SV](https://discuss.elastic.co/u/Raman_SV)\
**Replies:** 0\
**Last updated:** [May 29, 2024, 8:08pm UTC](https://discuss.elastic.co/t/usage-of-elastic-apis-to-get-kubernetes-node-and-container-metrics/360507 "2024-05-29T20:08:57Z")

</div>

Hi All, I am creating an automation script which will have metrics of all containers in kubernetes. Is there any Elastic API to get the data? Thanks, Raman

---

## [Load Balancer for elasticsearch](https://discuss.elastic.co/t/load-balancer-for-elasticsearch/360503)

<div class="topic-metadata">

**Author:** [@Suresh\_Ghatuwa](https://discuss.elastic.co/u/Suresh_Ghatuwa)\
**Replies:** 0\
**Last updated:** [May 29, 2024, 7:15pm UTC](https://discuss.elastic.co/t/load-balancer-for-elasticsearch/360503 "2024-05-29T19:15:00Z")

</div>

Hello, We had setup multi node elasticsearch cluster as mentioned below. Master Node: 3 Coordinating Node: 3 Data Node: 8 And Currently, we are using AWS Load Balancer for balancing multiple ES queries to multiple c…

---

## [Recommendations in ES](https://discuss.elastic.co/t/recommendations-in-es/360018)

<div class="topic-metadata">

**Author:** [@alexander.korkhov](https://discuss.elastic.co/u/alexander.korkhov)\
**Replies:** 2\
**Last updated:** [May 29, 2024, 7:13pm UTC](https://discuss.elastic.co/t/recommendations-in-es/360018 "2024-05-29T19:13:37Z")

</div>

There is a product database; the popularity value for products is periodically calculated. An index has been built in ES, there is sorting by popularity value. There is a task to screw up a recommendation system. The re…

---

## [Force to output before processing](https://discuss.elastic.co/t/force-to-output-before-processing/360491)

<div class="topic-metadata">

**Author:** [@Keldane](https://discuss.elastic.co/u/Keldane)\
**Replies:** 1\
**Last updated:** [May 29, 2024, 6:48pm UTC](https://discuss.elastic.co/t/force-to-output-before-processing/360491 "2024-05-29T18:48:58Z")

</div>

Hi! Since i face some problems with nested fields in kibana lens, i decided to re-enginieer the ruby code for my filter, here is a snippet of it ruby { code =\> ' require "nokogiri" xml\_doc = Nokogiri::XM…

---

## [I'm having trouble integrating Logstash with the official Helm chart](https://discuss.elastic.co/t/im-having-trouble-integrating-logstash-with-the-official-helm-chart/360495)

<div class="topic-metadata">

**Author:** [@MrXY](https://discuss.elastic.co/u/MrXY)\
**Replies:** 0\
**Last updated:** [May 29, 2024, 4:40pm UTC](https://discuss.elastic.co/t/im-having-trouble-integrating-logstash-with-the-official-helm-chart/360495 "2024-05-29T16:40:27Z")

</div>

I'm attempting to integrate Logstash between Beats and Elasticsearch in Kubernetes. I'm utilizing the official Helm Chart available at artifacthub. I followed the guide provided by Elastic at secure-logstash-connections …

---

## [Joining 2 datasets together with the filter plugin does not work](https://discuss.elastic.co/t/joining-2-datasets-together-with-the-filter-plugin-does-not-work/360492)

<div class="topic-metadata">

**Author:** [@Ma\_G](https://discuss.elastic.co/u/Ma_G)\
**Replies:** 0\
**Last updated:** [May 29, 2024, 4:13pm UTC](https://discuss.elastic.co/t/joining-2-datasets-together-with-the-filter-plugin-does-not-work/360492 "2024-05-29T16:13:59Z")

</div>

Dear Elastic community, I am trying to join data from 2 indices together and write it to a third one. However, despite a correct Logstash configuration (I think) I do not get the desired result. Maybe one of you can spo…

---

## [DeleteByQuery Performance Question](https://discuss.elastic.co/t/deletebyquery-performance-question/360490)

<div class="topic-metadata">

**Author:** [@dhubau](https://discuss.elastic.co/u/dhubau)\
**Replies:** 0\
**Last updated:** [May 29, 2024, 3:52pm UTC](https://discuss.elastic.co/t/deletebyquery-performance-question/360490 "2024-05-29T15:52:30Z")

</div>

Hello, Wondering how effficient a typical DeleteByQuery request is on an index alias backed by multiple indices (let's say 1 hot index and 30 daily warm indices of 30M documents each). Our actual query would only conta…

---

## [Please help me change the php code from pagination from + size to search\_after](https://discuss.elastic.co/t/please-help-me-change-the-php-code-from-pagination-from-size-to-search-after/360323)

<div class="topic-metadata">

**Author:** [@chongshengdz](https://discuss.elastic.co/u/chongshengdz)\
**Replies:** 8\
**Last updated:** [May 29, 2024, 3:26pm UTC](https://discuss.elastic.co/t/please-help-me-change-the-php-code-from-pagination-from-size-to-search-after/360323 "2024-05-29T15:26:41Z")

</div>

please help me change the php code from pagination from + size to search\_after, product\_id is the unique id for sorting. $start = ($params\['page'\] - 1) \* $params\['limit'\]; $body = \[ '\_source' =\> \['product\_id','name','ca…

---

## [How to handle key value pairs when keys and values are in different fields](https://discuss.elastic.co/t/how-to-handle-key-value-pairs-when-keys-and-values-are-in-different-fields/360460)

<div class="topic-metadata">

**Author:** [@bvoros](https://discuss.elastic.co/u/bvoros)\
**Replies:** 4\
**Last updated:** [May 29, 2024, 3:19pm UTC](https://discuss.elastic.co/t/how-to-handle-key-value-pairs-when-keys-and-values-are-in-different-fields/360460 "2024-05-29T15:19:35Z")

</div>

Hello, In the events that are being processed there are key value pairs where the keys and the values are in two fields. What is the best way to handle these? Example data: data.httpRequest.headers.name \[host, connect…

---

## [Using ILM with mutable data and multiple data tiers](https://discuss.elastic.co/t/using-ilm-with-mutable-data-and-multiple-data-tiers/360485)

<div class="topic-metadata">

**Author:** [@aevers](https://discuss.elastic.co/u/aevers)\
**Replies:** 0\
**Last updated:** [May 29, 2024, 2:59pm UTC](https://discuss.elastic.co/t/using-ilm-with-mutable-data-and-multiple-data-tiers/360485 "2024-05-29T14:59:29Z")

</div>

Hi, We are experiencing load and cost issues related to mutable data. This is our situation: Every day we receive 30 million documents we need to index 29.9 million of these documents are not queried often and can be…

---

## [Filebeat supported ciphersuits](https://discuss.elastic.co/t/filebeat-supported-ciphersuits/360484)

<div class="topic-metadata">

**Author:** [@teja\_tata](https://discuss.elastic.co/u/teja_tata)\
**Replies:** 0\
**Last updated:** [May 29, 2024, 2:56pm UTC](https://discuss.elastic.co/t/filebeat-supported-ciphersuits/360484 "2024-05-29T14:56:49Z")

</div>

Where I can find the default supported ciphersuites for filebeat

---

## [Watcher - Possible Bug](https://discuss.elastic.co/t/watcher-possible-bug/360482)

<div class="topic-metadata">

**Author:** [@erikg](https://discuss.elastic.co/u/erikg)\
**Replies:** 0\
**Last updated:** [May 29, 2024, 2:48pm UTC](https://discuss.elastic.co/t/watcher-possible-bug/360482 "2024-05-29T14:48:50Z")

</div>

Hello, I create a watcher and then proceeded to simulate the watcher by force execute. The screen just goes blank: There are no errors in the watcher body, so I am not sure why it's causing this error.

---

## [Different bulk helpers client behaviour in Java and JavaScript](https://discuss.elastic.co/t/different-bulk-helpers-client-behaviour-in-java-and-javascript/360468)

<div class="topic-metadata">

**Author:** [@spinscale](https://discuss.elastic.co/u/spinscale)\
**Replies:** 2\
**Last updated:** [May 29, 2024, 2:10pm UTC](https://discuss.elastic.co/t/different-bulk-helpers-client-behaviour-in-java-and-javascript/360468 "2024-05-29T14:10:20Z")

</div>

Hey, I checked out the node.js client lately and would like to confirm a different behaviour compared to the Java client for example. I have a use-case where a javascript app runs permanently and receives new data perm…

---

## [O365 Module and o365.audit.ModifiedProperties.\*.\*](https://discuss.elastic.co/t/o365-module-and-o365-audit-modifiedproperties/360478)

<div class="topic-metadata">

**Author:** [@mgotechlock](https://discuss.elastic.co/u/mgotechlock)\
**Replies:** 0\
**Last updated:** [May 29, 2024, 1:54pm UTC](https://discuss.elastic.co/t/o365-module-and-o365-audit-modifiedproperties/360478 "2024-05-29T13:54:59Z")

</div>

I have the o365 module largely working great, however, one particular fields that needs further parsing is being problematic. o365.audit.ModifiedProperties.\*.\* Filebeat is not finishing the parsing of all the values in…

---

## [Need help to indentify what needs to be done in order to seperate and injest in elasticsearch](https://discuss.elastic.co/t/need-help-to-indentify-what-needs-to-be-done-in-order-to-seperate-and-injest-in-elasticsearch/360475)

<div class="topic-metadata">

**Author:** [@kishorkumar](https://discuss.elastic.co/u/kishorkumar)\
**Replies:** 0\
**Last updated:** [May 29, 2024, 1:38pm UTC](https://discuss.elastic.co/t/need-help-to-indentify-what-needs-to-be-done-in-order-to-seperate-and-injest-in-elasticsearch/360475 "2024-05-29T13:38:45Z")

</div>

I am trying to generate the logic in order to track last value injested in the elasticsearch for http\_poller. till now for testing version what i have done is i am using elastic index to elastic index pipeline. first i…

---

## [Manage secrets in fleet managed elastic-agents](https://discuss.elastic.co/t/manage-secrets-in-fleet-managed-elastic-agents/358667)

<div class="topic-metadata">

**Author:** [@liquidkite](https://discuss.elastic.co/u/liquidkite)\
**Replies:** 3\
**Last updated:** [May 29, 2024, 1:41pm UTC](https://discuss.elastic.co/t/manage-secrets-in-fleet-managed-elastic-agents/358667 "2024-05-29T13:41:42Z")

</div>

Hello all, We currently use fleet managed elastic-agents to collect logs from a variety of data sources. We would like to store our secrets that we use for agent policies as a kubernetes secret and use the kubernetes\_se…

---

## [How to capture all entries that matches the same search pattern](https://discuss.elastic.co/t/how-to-capture-all-entries-that-matches-the-same-search-pattern/360473)

<div class="topic-metadata">

**Author:** [@thosch](https://discuss.elastic.co/u/thosch)\
**Replies:** 1\
**Last updated:** [May 29, 2024, 1:22pm UTC](https://discuss.elastic.co/t/how-to-capture-all-entries-that-matches-the-same-search-pattern/360473 "2024-05-29T13:22:47Z")

</div>

Hello, i am new at using logstash and its filters. I got log files looking like this: \</\> Started 'DB to PostgreSQL transfer' workflow at 2024.05.19 09:31:07 database v87\_orig\_rec\_8904\_03 ###########################…

---

## [Elastic VM Migration](https://discuss.elastic.co/t/elastic-vm-migration/360472)

<div class="topic-metadata">

**Author:** [@Shalinicts](https://discuss.elastic.co/u/Shalinicts)\
**Replies:** 0\
**Last updated:** [May 29, 2024, 1:14pm UTC](https://discuss.elastic.co/t/elastic-vm-migration/360472 "2024-05-29T13:14:58Z")

</div>

We are migrating DataCenter including ELK application. The IPs remain same post migration (network extension between source and target DC will be same) Do we need to change or do any prerequistes wrt ELK stack ?

---

## [Can Elasticsearch handle lots of updates and how it scales with concurrent inserts/updates](https://discuss.elastic.co/t/can-elasticsearch-handle-lots-of-updates-and-how-it-scales-with-concurrent-inserts-updates/360456)

<div class="topic-metadata">

**Author:** [@Moni\_Hazarika](https://discuss.elastic.co/u/Moni_Hazarika)\
**Replies:** 1\
**Last updated:** [May 29, 2024, 1:01pm UTC](https://discuss.elastic.co/t/can-elasticsearch-handle-lots-of-updates-and-how-it-scales-with-concurrent-inserts-updates/360456 "2024-05-29T13:01:15Z")

</div>

We are currently using MongoDB for both of our read write query patterns. However we are seeing a lot of performance issues(as expected) where customer runs full text searches in MongoDB or run complex aggregation querie…

---

## [Remote cluster status incorrect in Kibana](https://discuss.elastic.co/t/remote-cluster-status-incorrect-in-kibana/360464)

<div class="topic-metadata">

**Author:** [@fhegedus](https://discuss.elastic.co/u/fhegedus)\
**Replies:** 0\
**Last updated:** [May 29, 2024, 12:39pm UTC](https://discuss.elastic.co/t/remote-cluster-status-incorrect-in-kibana/360464 "2024-05-29T12:39:09Z")

</div>

Dear Community, I have a local cluster and three remote clusters, which I added using Kibana UI. Elasticsearch logs indicate that the connection is successful. In Kibana Dev Tools, the Remote Cluster Info API confirms…

---

## [Windows Agent reinstall issue](https://discuss.elastic.co/t/windows-agent-reinstall-issue/360462)

<div class="topic-metadata">

**Author:** [@Vladimir7172](https://discuss.elastic.co/u/Vladimir7172)\
**Replies:** 0\
**Last updated:** [May 29, 2024, 12:27pm UTC](https://discuss.elastic.co/t/windows-agent-reinstall-issue/360462 "2024-05-29T12:27:47Z")

</div>

Hello I have a problem with agent on Windows The very first time I deleted it, I received the error "Error: Yaml:Line 6: Didn't Find Expected Key". I didn’t bother to figure it out and decided to delete everything acco…

---

## [Inquiry about FIPS 140-2 Compliance for Elasticsearch on Amazon Opensearch Service](https://discuss.elastic.co/t/inquiry-about-fips-140-2-compliance-for-elasticsearch-on-amazon-opensearch-service/360448)

<div class="topic-metadata">

**Author:** [@yago82](https://discuss.elastic.co/u/yago82)\
**Replies:** 2\
**Last updated:** [May 29, 2024, 12:12pm UTC](https://discuss.elastic.co/t/inquiry-about-fips-140-2-compliance-for-elasticsearch-on-amazon-opensearch-service/360448 "2024-05-29T12:12:03Z")

</div>

Hello, I am trying to understand if the FIPS 140-2 compliant mode offered by Elasticsearch is applicable when Elasticsearch is used as an Amazon Opensearch service. In my specific case, Elasticsearch is not installed o…

---

## [ILM rollover when max\_docs reached](https://discuss.elastic.co/t/ilm-rollover-when-max-docs-reached/360455)

<div class="topic-metadata">

**Author:** [@vincent2mots](https://discuss.elastic.co/u/vincent2mots)\
**Replies:** 1\
**Last updated:** [May 29, 2024, 11:57am UTC](https://discuss.elastic.co/t/ilm-rollover-when-max-docs-reached/360455 "2024-05-29T11:57:54Z")

</div>

Hi experts! I'm exploring ILM capabilities of Elasticsearch and I run some tests which are not okay. I would like to create a ILM policy which would create a new index each time the previous one reached 30 documents. I…

---

## [How to drop the following documents?](https://discuss.elastic.co/t/how-to-drop-the-following-documents/360449)

<div class="topic-metadata">

**Author:** [@bvoros](https://discuss.elastic.co/u/bvoros)\
**Replies:** 3\
**Last updated:** [May 29, 2024, 11:55am UTC](https://discuss.elastic.co/t/how-to-drop-the-following-documents/360449 "2024-05-29T11:55:10Z")

</div>

Hello all, I would like to match and drop the following documents but my filter fails to match these. I am trying to match against the "message" field, could or should I match against the "event" field? Can someone exp…

---

## [Issue in implementing post filters](https://discuss.elastic.co/t/issue-in-implementing-post-filters/360441)

<div class="topic-metadata">

**Author:** [@Rahul\_Gajjar](https://discuss.elastic.co/u/Rahul_Gajjar)\
**Replies:** 1\
**Last updated:** [May 29, 2024, 11:20am UTC](https://discuss.elastic.co/t/issue-in-implementing-post-filters/360441 "2024-05-29T11:20:32Z")

</div>

I am implementing a post-filter in the search query. I am obtaining successful results when applying the filter to some fields, but not for one specific field. I have also checked the mapping, and everything appears to b…

---

## [Inline script search capability](https://discuss.elastic.co/t/inline-script-search-capability/360451)

<div class="topic-metadata">

**Author:** [@Hossein\_Bagherzadega](https://discuss.elastic.co/u/Hossein_Bagherzadega)\
**Replies:** 0\
**Last updated:** [May 29, 2024, 11:05am UTC](https://discuss.elastic.co/t/inline-script-search-capability/360451 "2024-05-29T11:05:49Z")

</div>

i need to search and index inside an inline script but could not find any docs or sample for it is the any chance that inline script support search on index something like this query": { "bool": { "must\_not":…

[Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=228)

[Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=230)
