# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=23 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 24 --- ## [Kibana “Managed API keys” can be hidden/misclassified by editing metadata.managed (UI + Dev Tools)](https://discuss.elastic.co/t/kibana-managed-api-keys-can-be-hidden-misclassified-by-editing-metadata-managed-ui-dev-tools/384407)
**Author:** [@Bolto](https://discuss.elastic.co/u/Bolto)\ **Replies:** 0\ **Last updated:** [January 7, 2026, 10:47am UTC](https://discuss.elastic.co/t/kibana-managed-api-keys-can-be-hidden-misclassified-by-editing-metadata-managed-ui-dev-tools/384407 "2026-01-07T10:47:20Z")
Hi Elastic team/community, While reviewing API Keys in Kibana, I noticed that the flag used to identify Managed API keys (created/used by Kibana background tasks) can be overwritten by a user by editing the API key meta… --- ## [Logstash PKI : Why does Logstash rely on optionnal metadata (Bag Attributes)?](https://discuss.elastic.co/t/logstash-pki-why-does-logstash-rely-on-optionnal-metadata-bag-attributes/384389)
**Author:** [@CitizenSteak](https://discuss.elastic.co/u/CitizenSteak)\ **Replies:** 1\ **Last updated:** [January 6, 2026, 2:03pm UTC](https://discuss.elastic.co/t/logstash-pki-why-does-logstash-rely-on-optionnal-metadata-bag-attributes/384389 "2026-01-06T14:03:03Z")
I renewed my Logstash PKI but when re-deploying all the client certificates to my Beats, they all encountered the following error : \`ERROR \[publisher\_pipeline\_output\] pipeline/output.go:154 Failed to connect to b… --- ## [Can We Temporarily Disable Filestream Integration for a Elastic Agent Policy to temporarily collect data instead of unenroll it?](https://discuss.elastic.co/t/can-we-temporarily-disable-filestream-integration-for-a-elastic-agent-policy-to-temporarily-collect-data-instead-of-unenroll-it/383969)
**Author:** [@josh\_tran](https://discuss.elastic.co/u/josh_tran)\ **Replies:** 4\ **Last updated:** [January 6, 2026, 12:48pm UTC](https://discuss.elastic.co/t/can-we-temporarily-disable-filestream-integration-for-a-elastic-agent-policy-to-temporarily-collect-data-instead-of-unenroll-it/383969 "2026-01-06T12:48:18Z")
Hi all, Currently, my system is collecting log data using Filestream (Custom Logs integration). The thousand agents are managed by policies in the Fleet server. The machines that have the Agents installed usually need … --- ## [Do Explicit Sort Fields Imply A Filter Context?](https://discuss.elastic.co/t/do-explicit-sort-fields-imply-a-filter-context/384377)
**Author:** [@vanschelven](https://discuss.elastic.co/u/vanschelven)\ **Replies:** 0\ **Last updated:** [January 5, 2026, 7:56pm UTC](https://discuss.elastic.co/t/do-explicit-sort-fields-imply-a-filter-context/384377 "2026-01-05T19:56:06Z")
\[A\] This page explains the differences between query and filtered context quite well: When there's no need for query context (e.g. because sorting on something else explicitly) filtered context has many advantages. \[… --- ## [Windows host.id not unique](https://discuss.elastic.co/t/windows-host-id-not-unique/373767)
**Author:** [@catn0b0t](https://discuss.elastic.co/u/catn0b0t)\ **Replies:** 2\ **Last updated:** [January 5, 2026, 3:15pm UTC](https://discuss.elastic.co/t/windows-host-id-not-unique/373767 "2026-01-05T15:15:01Z")
We are running +300 agents on Windows servers which have been setup using templated/automated installs. We now see that a lot of hosts share the same host.id value in our logging in Elastic which seems to be a problem wh… --- ## [Elastic Agent (Defender) – Public + On-Prem Deployment Question](https://discuss.elastic.co/t/elastic-agent-defender-public-on-prem-deployment-question/383515)
**Author:** [@Animate4498](https://discuss.elastic.co/u/Animate4498)\ **Replies:** 8\ **Last updated:** [January 5, 2026, 1:08pm UTC](https://discuss.elastic.co/t/elastic-agent-defender-public-on-prem-deployment-question/383515 "2026-01-05T13:08:11Z")
My goal is to deploy the Elastic Agent with the Defender integration as an XDR solution on our clients and forward all security alerts to our on-prem SIEM. Fleet and the rest of the Elastic components are reachable from … --- ## [Archive functionality and licensing](https://discuss.elastic.co/t/archive-functionality-and-licensing/384340)
**Author:** [@javierE](https://discuss.elastic.co/u/javierE)\ **Replies:** 2\ **Last updated:** [January 5, 2026, 12:36pm UTC](https://discuss.elastic.co/t/archive-functionality-and-licensing/384340 "2026-01-05T12:36:07Z")
Hi, I’m trying to clarify my understanding of the following paragraph from the documentation: The archive functionality provides slower read-only access to older Elasticsearch data, for compliance or regulatory reas… --- ## [Elasticsearch for TrueNAS indexing](https://discuss.elastic.co/t/elasticsearch-for-truenas-indexing/383894)
**Author:** [@chrislongros](https://discuss.elastic.co/u/chrislongros)\ **Replies:** 6\ **Last updated:** [January 5, 2026, 12:33pm UTC](https://discuss.elastic.co/t/elasticsearch-for-truenas-indexing/383894 "2026-01-05T12:33:19Z")
How can I use elasticsearch to index my TrueNAS? --- ## [Logs from elasticsearch agents](https://discuss.elastic.co/t/logs-from-elasticsearch-agents/384361)
**Author:** [@TheJ](https://discuss.elastic.co/u/TheJ)\ **Replies:** 0\ **Last updated:** [January 5, 2026, 11:29am UTC](https://discuss.elastic.co/t/logs-from-elasticsearch-agents/384361 "2026-01-05T11:29:19Z")
Hi, I have an Elasticsearch cluster that keeps logs from services within a year. I have also connected 30 elasticagents and logs from these agents exist on the cluster forever. During debug, I realize that data streams … --- ## [java.io.IOException: Unable to parse response body for Response](https://discuss.elastic.co/t/java-io-ioexception-unable-to-parse-response-body-for-response/384353)
**Author:** [@GQ\_YAN](https://discuss.elastic.co/u/GQ_YAN)\ **Replies:** 6\ **Last updated:** [January 5, 2026, 8:54am UTC](https://discuss.elastic.co/t/java-io-ioexception-unable-to-parse-response-body-for-response/384353 "2026-01-05T08:54:44Z")
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128) ~\[?:?\] at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628) ~\[?:?\] at java.lang.Thread.run(Thread.java:829)… --- ## [\_count vs track\_total\_hits](https://discuss.elastic.co/t/count-vs-track-total-hits/384346)
**Author:** [@maulik\_trapasiya](https://discuss.elastic.co/u/maulik_trapasiya)\ **Replies:** 3\ **Last updated:** [January 5, 2026, 8:33am UTC](https://discuss.elastic.co/t/count-vs-track-total-hits/384346 "2026-01-05T08:33:47Z")
in my Elasticsearch index there are around 10M document, pagination based query is happening on this, on UI need to show total count of document matching query along with some data in page-format, there are 2 approach fo… --- ## [Some Artifactory logs parsed by Logstash grok, others indexed but fields not visible in Kibana](https://discuss.elastic.co/t/some-artifactory-logs-parsed-by-logstash-grok-others-indexed-but-fields-not-visible-in-kibana/384341)
**Author:** [@Pratiksha\_Desai](https://discuss.elastic.co/u/Pratiksha_Desai)\ **Replies:** 9\ **Last updated:** [January 4, 2026, 5:43am UTC](https://discuss.elastic.co/t/some-artifactory-logs-parsed-by-logstash-grok-others-indexed-but-fields-not-visible-in-kibana/384341 "2026-01-04T05:43:40Z")
Hello Team, I am ingesting multiple Artifactory log types through Filebeat → Logstash → Elasticsearch, but I am facing an issue where only some log lines are parsed correctly, while others are indexed without parsed fie… --- ## [Help with Lens Bar (only show values)](https://discuss.elastic.co/t/help-with-lens-bar-only-show-values/384344)
**Author:** [@erikg](https://discuss.elastic.co/u/erikg)\ **Replies:** 6\ **Last updated:** [January 3, 2026, 2:51am UTC](https://discuss.elastic.co/t/help-with-lens-bar-only-show-values/384344 "2026-01-03T02:51:47Z")
Hello All, I was creating a visualization of process metrics using Elastic Agent System Integration. This is collecting top processes by CPU. I am wondering how do I show only data, if you see some values appear but th… --- ## [Ingesting logs from S3 bucket elastic-agent vs logstash](https://discuss.elastic.co/t/ingesting-logs-from-s3-bucket-elastic-agent-vs-logstash/384339)
**Author:** [@liquidkite](https://discuss.elastic.co/u/liquidkite)\ **Replies:** 2\ **Last updated:** [January 2, 2026, 4:46pm UTC](https://discuss.elastic.co/t/ingesting-logs-from-s3-bucket-elastic-agent-vs-logstash/384339 "2026-01-02T16:46:33Z")
Hello all, We are ingesting logs into an AWS S3 bucket and I’m exploring various ingestion mechanisms into elasticsearch. After some research, the options are elastic-agent using the S3/SQS and using Logstash S3 input.… --- ## [Is java client 7.17 compatible with elastic 8.18](https://discuss.elastic.co/t/is-java-client-7-17-compatible-with-elastic-8-18/384194)
**Author:** [@Elastic04](https://discuss.elastic.co/u/Elastic04)\ **Replies:** 8\ **Last updated:** [January 2, 2026, 7:40am UTC](https://discuss.elastic.co/t/is-java-client-7-17-compatible-with-elastic-8-18/384194 "2026-01-02T07:40:07Z")
We are using Elastic stack version 8.9 currently and Java api client 7.17. we want to upgrade to 9.x. From 8.9 we are migrating to 8.18 or 8.19, then from 8.19 version to 9.x. How should we upgrade java client? --- ## [API key does or does not rely on permissions from user that created it](https://discuss.elastic.co/t/api-key-does-or-does-not-rely-on-permissions-from-user-that-created-it/383663)
**Author:** [@qd-danh](https://discuss.elastic.co/u/qd-danh)\ **Replies:** 14\ **Last updated:** [December 31, 2025, 10:08pm UTC](https://discuss.elastic.co/t/api-key-does-or-does-not-rely-on-permissions-from-user-that-created-it/383663 "2025-12-31T22:08:43Z")
We had previously been creating API keys with our SSO user accounts. Then we found that after an SSO IdP provider change our users were effectively “different” such that we could no longer edit API keys (e.g. to add or r… --- ## [Weird recall trend with HNSW int8 quantization: Smaller indices show worse recall](https://discuss.elastic.co/t/weird-recall-trend-with-hnsw-int8-quantization-smaller-indices-show-worse-recall/384322)
**Author:** [@viperv](https://discuss.elastic.co/u/viperv)\ **Replies:** 1\ **Last updated:** [December 31, 2025, 4:03pm UTC](https://discuss.elastic.co/t/weird-recall-trend-with-hnsw-int8-quantization-smaller-indices-show-worse-recall/384322 "2025-12-31T16:03:59Z")
Hi, ​I am performing recall tests on indices containing CLIP vectors of varying sizes (ranging from 500,000 to 4,500,000 vectors). I am using HNSW (with the default parameters) with int8 quantization, and each index has… --- ## [Guidance on language analyzers for non-native languages](https://discuss.elastic.co/t/guidance-on-language-analyzers-for-non-native-languages/384168)
**Author:** [@sibasish.palo](https://discuss.elastic.co/u/sibasish.palo)\ **Replies:** 1\ **Last updated:** [December 31, 2025, 6:53am UTC](https://discuss.elastic.co/t/guidance-on-language-analyzers-for-non-native-languages/384168 "2025-12-31T06:53:02Z")
i am trying to add some new locale support and looking for guidance on language analyzers to be added for the locales. i have gone through lang-analyzer page to find the appropriate analyzers for the locales which i am t… --- ## [Question about using Elasticsearch for RAG](https://discuss.elastic.co/t/question-about-using-elasticsearch-for-rag/383993)
**Author:** [@bobwiller](https://discuss.elastic.co/u/bobwiller)\ **Replies:** 1\ **Last updated:** [December 31, 2025, 6:37am UTC](https://discuss.elastic.co/t/question-about-using-elasticsearch-for-rag/383993 "2025-12-31T06:37:28Z")
Just learned about the RAG Playground in Elastic, so I am hoping this is an opportunity to simplify my project: Here is my scenario / goal: We have an old rules-based app that parses store items like bikes, bike parts,… --- ## [Filebeat clients unable to publish events to logstash](https://discuss.elastic.co/t/filebeat-clients-unable-to-publish-events-to-logstash/378592)
**Author:** [@MajorNickle](https://discuss.elastic.co/u/MajorNickle)\ **Replies:** 31\ **Last updated:** [December 31, 2025, 2:42am UTC](https://discuss.elastic.co/t/filebeat-clients-unable-to-publish-events-to-logstash/378592 "2025-12-31T02:42:21Z")
Hi all, I had a filebeat to logstash setup running successfully for the past months where both services where running on the same host. I recently moved filebeat to it's own server in a different zone. I am able to hit … --- ## [Explanation about DiskBBQ parameters](https://discuss.elastic.co/t/explanation-about-diskbbq-parameters/384248)
**Author:** [@viperv](https://discuss.elastic.co/u/viperv)\ **Replies:** 2\ **Last updated:** [December 30, 2025, 5:09pm UTC](https://discuss.elastic.co/t/explanation-about-diskbbq-parameters/384248 "2025-12-30T17:09:43Z")
Hi, I am looking into using DiskBBQ. I’ve read this blog post, and I noticed there are multiple parameters that can be defined, but there isn’t a thorough explanation about them: cluster size - with a default value of … --- ## [Search\_after for pagination](https://discuss.elastic.co/t/search-after-for-pagination/384309)
**Author:** [@Elastic04](https://discuss.elastic.co/u/Elastic04)\ **Replies:** 4\ **Last updated:** [December 30, 2025, 4:38pm UTC](https://discuss.elastic.co/t/search-after-for-pagination/384309 "2025-12-30T16:38:37Z")
I want to implement pagination using search\_after instead of from, size. There are different sortings in our website like sort by relevancy or a-z or z-a or lowest to highest… How will the sort values for search\_after co… --- ## [Can not modify my fleet server and agent configuration on ECK](https://discuss.elastic.co/t/can-not-modify-my-fleet-server-and-agent-configuration-on-eck/384265)
**Author:** [@NiceAgent](https://discuss.elastic.co/u/NiceAgent)\ **Replies:** 12\ **Last updated:** [December 30, 2025, 3:42am UTC](https://discuss.elastic.co/t/can-not-modify-my-fleet-server-and-agent-configuration-on-eck/384265 "2025-12-30T03:42:12Z")
I deployed eck-operator on my microk8s system. Then I used eck-operator to deploy Elasticsearch and Kibana. Next, I wanted to deploy Fleet and its agent. I added the configuration to Kibana (as shown in Figure 1). A… --- ## [How to exclude already-swiped users when using Elasticsearch for a dating app?](https://discuss.elastic.co/t/how-to-exclude-already-swiped-users-when-using-elasticsearch-for-a-dating-app/384278)
**Author:** [@dmelendez](https://discuss.elastic.co/u/dmelendez)\ **Replies:** 3\ **Last updated:** [December 29, 2025, 2:05pm UTC](https://discuss.elastic.co/t/how-to-exclude-already-swiped-users-when-using-elasticsearch-for-a-dating-app/384278 "2025-12-29T14:05:02Z")
I’m using Elasticsearch as a matching engine for a dating app. Right now each user is indexed with: a geo\_point filters like age, gender, preferences, activity status With this I make queries like find users wi… --- ## [Understanding forcemerge with only\_expunge\_deletes](https://discuss.elastic.co/t/understanding-forcemerge-with-only-expunge-deletes/383924)
**Author:** [@ma\_br](https://discuss.elastic.co/u/ma_br)\ **Replies:** 2\ **Last updated:** [December 29, 2025, 2:28am UTC](https://discuss.elastic.co/t/understanding-forcemerge-with-only-expunge-deletes/383924 "2025-12-29T02:28:17Z")
My scenario is the following: i have a live index with a lot of updates that runs out of disk space at some time. The reason is that after some time i have a lot of max size segments (5gb) but the deleted document coun… --- ## [Lens color by value issue when using formula metrics](https://discuss.elastic.co/t/lens-color-by-value-issue-when-using-formula-metrics/384284)
**Author:** [@cgchamb](https://discuss.elastic.co/u/cgchamb)\ **Replies:** 3\ **Last updated:** [December 29, 2025, 12:17am UTC](https://discuss.elastic.co/t/lens-color-by-value-issue-when-using-formula-metrics/384284 "2025-12-29T00:17:07Z")
Elasticsearch: 8.19.5, Kibana: 8.19.5. I’m using the Sample Flight data set and I’ve created a Lens Table with “Rows: Top 5 values of Carrier” and Metric “Count of DestAirportID”. I set the metric to color by value (Cel… --- ## [Auditbeat Exclusion of Process](https://discuss.elastic.co/t/auditbeat-exclusion-of-process/384243)
**Author:** [@testtest](https://discuss.elastic.co/u/testtest)\ **Replies:** 2\ **Last updated:** [December 27, 2025, 1:31pm UTC](https://discuss.elastic.co/t/auditbeat-exclusion-of-process/384243 "2025-12-27T13:31:27Z")
Hi All, Could someone help me with exclude any process executable related to this path /usr/local/manageengine/uems\_agent/bin/\* (I can see a lot of incoming logs related to /usr/local/manageengine/uems\_agent/bin/dcpa… --- ## [How to handle duplicate records in datastreams using fingerprint](https://discuss.elastic.co/t/how-to-handle-duplicate-records-in-datastreams-using-fingerprint/384260)
**Author:** [@venkatkumar229](https://discuss.elastic.co/u/venkatkumar229)\ **Replies:** 2\ **Last updated:** [December 26, 2025, 11:34am UTC](https://discuss.elastic.co/t/how-to-handle-duplicate-records-in-datastreams-using-fingerprint/384260 "2025-12-26T11:34:00Z")
Hi Team, I am ingesting data from a Kafka topic into Elasticsearch using Logstash. The incoming data can contain duplicates, so I am using a fingerprint filter on a unique business field (seqId) and setting it as the d… --- ## [Agents not "upgradeable"](https://discuss.elastic.co/t/agents-not-upgradeable/383437)
**Author:** [@Balu](https://discuss.elastic.co/u/Balu)\ **Replies:** 7\ **Last updated:** [December 24, 2025, 5:52pm UTC](https://discuss.elastic.co/t/agents-not-upgradeable/383437 "2025-12-24T17:52:19Z")
Hello I have updated my cluster to 8.19.7, then upgraded Kibana to 8.19.7 (including a reboot) and manually updated the fleet servers to 8.19.7, because they were not shown as "upgradeable". Now two days later, still n… --- ## [Indexing of large nested object failed in ES 9.1.4](https://discuss.elastic.co/t/indexing-of-large-nested-object-failed-in-es-9-1-4/384239)
**Author:** [@nchalise](https://discuss.elastic.co/u/nchalise)\ **Replies:** 4\ **Last updated:** [December 24, 2025, 9:21am UTC](https://discuss.elastic.co/t/indexing-of-large-nested-object-failed-in-es-9-1-4/384239 "2025-12-24T09:21:16Z")
Hello All, When we perform indexing in ES 9.1.4 we have encounter issue. Indexing error occurred: method \[POST\], host \[ip:9200\], URI \[/\_bulk?timeout=4m\], status line \[HTTP/1.1 413 Request Entity Too Large\] errors = or… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=22) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=24)