# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=237 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 238 --- ## [Node Elastic APM agent not instrumenting PSQL database calls made in API (nest-js framework with drizzle ORM)](https://discuss.elastic.co/t/node-elastic-apm-agent-not-instrumenting-psql-database-calls-made-in-api-nest-js-framework-with-drizzle-orm/359857)
**Author:** [@hypernova](https://discuss.elastic.co/u/hypernova)\ **Replies:** 0\ **Last updated:** [May 20, 2024, 4:37pm UTC](https://discuss.elastic.co/t/node-elastic-apm-agent-not-instrumenting-psql-database-calls-made-in-api-nest-js-framework-with-drizzle-orm/359857 "2024-05-20T16:37:12Z")
Hi, I was recently experimenting with the elastic stack for my backend server monitoring. I am doing self managed setup with docker containers. I setup the elastic, kibana, metricbeat and fleet-server. It works well b… --- ## [How come RefreshResponse is missing in 8.13.0. Needed for RHLC compatibility with v8](https://discuss.elastic.co/t/how-come-refreshresponse-is-missing-in-8-13-0-needed-for-rhlc-compatibility-with-v8/359678)
**Author:** [@buitcj](https://discuss.elastic.co/u/buitcj)\ **Replies:** 8\ **Last updated:** [May 20, 2024, 2:41pm UTC](https://discuss.elastic.co/t/how-come-refreshresponse-is-missing-in-8-13-0-needed-for-rhlc-compatibility-with-v8/359678 "2024-05-20T14:41:31Z")
This file/class exists in 8.12.2 (elasticsearch/server/src/main/java/org/elasticsearch/action/admin/indices/refresh/RefreshResponse.java at v8.12.2 · elastic/elasticsearch · GitHub) but is gone starting in 8.13.0. I didn… --- ## [No data has been received from this module yet message (Module Suricata)](https://discuss.elastic.co/t/no-data-has-been-received-from-this-module-yet-message-module-suricata/359799)
**Author:** [@leaft2312](https://discuss.elastic.co/u/leaft2312)\ **Replies:** 1\ **Last updated:** [May 20, 2024, 2:37pm UTC](https://discuss.elastic.co/t/no-data-has-been-received-from-this-module-yet-message-module-suricata/359799 "2024-05-20T14:37:36Z")
I configured filebeat.yml, /modules.d/suricata.yml but i don't see data from suricata module filebeat.yml: #=========================== Filebeat inputs ============================= filebeat.inputs: # Each - is an… --- ## [Grok Lines for Windows Event Logs](https://discuss.elastic.co/t/grok-lines-for-windows-event-logs/359620)
**Author:** [@TheDude2741](https://discuss.elastic.co/u/TheDude2741)\ **Replies:** 1\ **Last updated:** [May 20, 2024, 1:54pm UTC](https://discuss.elastic.co/t/grok-lines-for-windows-event-logs/359620 "2024-05-20T13:54:35Z")
Good Evening, I'm getting syslog data (port 514) sent to Elastic, but it's not parsed. Does anyone have some Grok statements that manually parse the data I could use? Everything is stuck in the message field and not r… --- ## [Cache and disk rack filling](https://discuss.elastic.co/t/cache-and-disk-rack-filling/359837)
**Author:** [@ruslan12\_10](https://discuss.elastic.co/u/ruslan12_10)\ **Replies:** 0\ **Last updated:** [May 20, 2024, 1:50pm UTC](https://discuss.elastic.co/t/cache-and-disk-rack-filling/359837 "2024-05-20T13:50:08Z")
Hello everyone, I was updating the operating system and faced the problem that all the requests went not to the cache, but to the disk rack, which is why it loaded 100%. Could this have happened because of the update. Be… --- ## [How do I receive logs from a Cisco device?](https://discuss.elastic.co/t/how-do-i-receive-logs-from-a-cisco-device/359723)
**Author:** [@jreyes25](https://discuss.elastic.co/u/jreyes25)\ **Replies:** 2\ **Last updated:** [May 20, 2024, 12:58pm UTC](https://discuss.elastic.co/t/how-do-i-receive-logs-from-a-cisco-device/359723 "2024-05-20T12:58:22Z")
Hello, I'm trying to see how to configure elasticstack to receive logs from cisco devices. I see in the Integrations for 'Cisco Logs' and says to configure the output.elasticsearch section of the filebeat.yml file then … --- ## [Indexing buffer settings | Elasticsearch Guide \[8.13\] | Elastic](https://discuss.elastic.co/t/indexing-buffer-settings-elasticsearch-guide-8-13-elastic/359725)
**Author:** [@dfir](https://discuss.elastic.co/u/dfir)\ **Replies:** 1\ **Last updated:** [May 20, 2024, 12:49pm UTC](https://discuss.elastic.co/t/indexing-buffer-settings-elasticsearch-guide-8-13-elastic/359725 "2024-05-20T12:49:18Z")
in which part of the Elasticsearch.yml do I put the following settings: indices.memory.index\_buffer\_size: 20% indices.memory.index\_buffer\_size: 512mb Thanks --- ## [Unable to use apm-server dynamic kafka topic with elastic-agent-standalone](https://discuss.elastic.co/t/unable-to-use-apm-server-dynamic-kafka-topic-with-elastic-agent-standalone/359826)
**Author:** [@Garvit\_Jain](https://discuss.elastic.co/u/Garvit_Jain)\ **Replies:** 0\ **Last updated:** [May 20, 2024, 12:48pm UTC](https://discuss.elastic.co/t/unable-to-use-apm-server-dynamic-kafka-topic-with-elastic-agent-standalone/359826 "2024-05-20T12:48:29Z")
Using following config with elastic agent standalone mode kafka-output: type: kafka hosts: - 'kafka:9092' client\_id: kafka-output topic: '%{\[data\_stream.type\]}-%{\[data\_str… --- ## [\_geoip\_database\_unavailable\_GeoLite2-City.mmdb Error](https://discuss.elastic.co/t/geoip-database-unavailable-geolite2-city-mmdb-error/359439)
**Author:** [@shrikantgulia](https://discuss.elastic.co/u/shrikantgulia)\ **Replies:** 11\ **Last updated:** [May 20, 2024, 12:13pm UTC](https://discuss.elastic.co/t/geoip-database-unavailable-geolite2-city-mmdb-error/359439 "2024-05-20T12:13:33Z")
Dear Members, can someone please guide i am facing the below issues don't know unable to lookup my field with geo ip details \[2024-05-14T12:21:49,461\]\[ERROR\]\[o.e.i.g.GeoIpDownloader \] \[node1\] exception during geoip da… --- ## [Is there a way to speed up the average inference time?](https://discuss.elastic.co/t/is-there-a-way-to-speed-up-the-average-inference-time/359418)
**Author:** [@shwanlee](https://discuss.elastic.co/u/shwanlee)\ **Replies:** 12\ **Last updated:** [May 20, 2024, 11:27am UTC](https://discuss.elastic.co/t/is-there-a-way-to-speed-up-the-average-inference-time/359418 "2024-05-20T11:27:54Z")
Is there a way to speed up the average inference time in ML, as it is currently slow? I’m currently running version 8.13.2. The ML node currently has 32 vCPUs, and I've allocated 32 threads to the model. My goal is to ac… --- ## [Facing connection closer error while starting elasticsearch 8.5.1 instance on local machine](https://discuss.elastic.co/t/facing-connection-closer-error-while-starting-elasticsearch-8-5-1-instance-on-local-machine/359680)
**Author:** [@Sunil\_Jagtap](https://discuss.elastic.co/u/Sunil_Jagtap)\ **Replies:** 6\ **Last updated:** [May 20, 2024, 10:40am UTC](https://discuss.elastic.co/t/facing-connection-closer-error-while-starting-elasticsearch-8-5-1-instance-on-local-machine/359680 "2024-05-20T10:40:41Z")
Facing connection closer error while starting elasticsearch 8.5.1 instance on local machine after starting elasticsearch 8.5.1 (bin/elasticsearch) it is showing below message on terminal, 2024-05-16T22:36:33,888\]\[WARN … --- ## [NPE Initializing PluginsService in ES8](https://discuss.elastic.co/t/npe-initializing-pluginsservice-in-es8/359667)
**Author:** [@buitcj](https://discuss.elastic.co/u/buitcj)\ **Replies:** 4\ **Last updated:** [May 20, 2024, 9:54am UTC](https://discuss.elastic.co/t/npe-initializing-pluginsservice-in-es8/359667 "2024-05-20T09:54:16Z")
I am trying to create a Node, which was working in ES7 and now am trying to do the same thing in ES v8.11.3. The simple code is final Settings settings = Settings.builder() .put(ACTION\_AUTO\_CREATE\_INDEX, false) … --- ## [What query string can I supply to ensure no results?](https://discuss.elastic.co/t/what-query-string-can-i-supply-to-ensure-no-results/359774)
**Author:** [@catmanjan](https://discuss.elastic.co/u/catmanjan)\ **Replies:** 3\ **Last updated:** [May 20, 2024, 9:03am UTC](https://discuss.elastic.co/t/what-query-string-can-i-supply-to-ensure-no-results/359774 "2024-05-20T09:03:13Z")
Hello our application pipes things directly to elasticsearch query strings like so: "title:test and word:filter" But in some cases we want to pipe the filter in such a way that it never returns a hit, e.g. something li… --- ## [Elasticsearch and Kibana Quires](https://discuss.elastic.co/t/elasticsearch-and-kibana-quires/359806)
**Author:** [@Minz00](https://discuss.elastic.co/u/Minz00)\ **Replies:** 1\ **Last updated:** [May 20, 2024, 8:53am UTC](https://discuss.elastic.co/t/elasticsearch-and-kibana-quires/359806 "2024-05-20T08:53:18Z")
Hi, I would like to enquire some technical questions on security. Context: Elasticsearch and Kibana are running locally on host. Not connected to any cloud environments. The intent is to injest dataset into kibana dash… --- ## [Tracking the execution of Scroll API in Elasticsearch](https://discuss.elastic.co/t/tracking-the-execution-of-scroll-api-in-elasticsearch/359630)
**Author:** [@yago82](https://discuss.elastic.co/u/yago82)\ **Replies:** 3\ **Last updated:** [May 20, 2024, 8:17am UTC](https://discuss.elastic.co/t/tracking-the-execution-of-scroll-api-in-elasticsearch/359630 "2024-05-20T08:17:34Z")
Hi everyone, I'm currently working with Elasticsearch and I'm interested in tracking the execution of the Scroll API. Specifically, I want to audit the use of the Scroll API to keep track of when it is executed and by w… --- ## [Filebeat keeps increasing memory consumption until eventually restarts](https://discuss.elastic.co/t/filebeat-keeps-increasing-memory-consumption-until-eventually-restarts/359796)
**Author:** [@S\_Jec](https://discuss.elastic.co/u/S_Jec)\ **Replies:** 0\ **Last updated:** [May 20, 2024, 8:00am UTC](https://discuss.elastic.co/t/filebeat-keeps-increasing-memory-consumption-until-eventually-restarts/359796 "2024-05-20T08:00:17Z")
So our memory consumption keeps increasing until it eventually restarts we've read up on forums and suggestions but to no avail. We tried queue.mem and disk.mem. We've also considered increasing resources but it is still… --- ## [\>10K fields: is it a problem? Why exactly?](https://discuss.elastic.co/t/10k-fields-is-it-a-problem-why-exactly/359285)
**Author:** [@Mikhail\_Khludnev](https://discuss.elastic.co/u/Mikhail_Khludnev)\ **Replies:** 1\ **Last updated:** [May 20, 2024, 7:40am UTC](https://discuss.elastic.co/t/10k-fields-is-it-a-problem-why-exactly/359285 "2024-05-20T07:40:37Z")
Hello. I have shards about 20G size with 600K docs each. Response time is acceptable. After a shard receives about 200K updates, it ends up 20 segments, response time exceeds the reasonable value. In profile, I spott… --- ## [Paging issues when developing search capabilities using Elasticsearch and MySQL](https://discuss.elastic.co/t/paging-issues-when-developing-search-capabilities-using-elasticsearch-and-mysql/359777)
**Author:** [@jaden](https://discuss.elastic.co/u/jaden)\ **Replies:** 4\ **Last updated:** [May 20, 2024, 6:34am UTC](https://discuss.elastic.co/t/paging-issues-when-developing-search-capabilities-using-elasticsearch-and-mysql/359777 "2024-05-20T06:34:58Z")
We are developing a search function for space rental products using Elasticsearch and MySQL. \[Search form\] From DateTime To DateTime Min Price Max Price The search form is the same as above, and there is no problem w… --- ## [3 nodes(7.17) on a single server](https://discuss.elastic.co/t/3-nodes-7-17-on-a-single-server/359410)
**Author:** [@bfarr11](https://discuss.elastic.co/u/bfarr11)\ **Replies:** 8\ **Last updated:** [May 20, 2024, 1:47am UTC](https://discuss.elastic.co/t/3-nodes-7-17-on-a-single-server/359410 "2024-05-20T01:47:31Z")
I need help with the configuration to run 3 nodes on a single server. It has 32 core, 128GB RAM, 10T disk - so plenty of space. Please do not post with negative - you should not do this posts. I simply need help with th… --- ## [Integration Error - OpenCTI](https://discuss.elastic.co/t/integration-error-opencti/359767)
**Author:** [@Knight7](https://discuss.elastic.co/u/Knight7)\ **Replies:** 0\ **Last updated:** [May 19, 2024, 8:35pm UTC](https://discuss.elastic.co/t/integration-error-opencti/359767 "2024-05-19T20:35:29Z")
Hello, After installing Opencti in a docker environment, I want to get the threat indicators to Elasticsearch. For that, I used the Elastic Agent integration for OpenCTI. However, this integration always shows me this … --- ## [Setup rollover in index template](https://discuss.elastic.co/t/setup-rollover-in-index-template/359610)
**Author:** [@Frances\_Chu](https://discuss.elastic.co/u/Frances_Chu)\ **Replies:** 3\ **Last updated:** [May 19, 2024, 5:13pm UTC](https://discuss.elastic.co/t/setup-rollover-in-index-template/359610 "2024-05-19T17:13:28Z")
in order to setup rollover I have to setup ilm policy and enable rollover create index template and use the policy I created in step 1 I need to config the logstash pipeline output { elasticsearch { ilm\_rollover… --- ## [Why a custom pipeline doesn't run automatically on a Crawler index?](https://discuss.elastic.co/t/why-a-custom-pipeline-doesnt-run-automatically-on-a-crawler-index/358235)
**Author:** [@freddyrb](https://discuss.elastic.co/u/freddyrb)\ **Replies:** 3\ **Last updated:** [May 19, 2024, 4:09pm UTC](https://discuss.elastic.co/t/why-a-custom-pipeline-doesnt-run-automatically-on-a-crawler-index/358235 "2024-05-19T16:09:40Z")
The situation: I created a Crawler index using a domain. After is created I added via script the field "indexedContentType": PUT /search-testindex1/\_mapping { "properties": { "indexedContentType": { "type":… --- ## [How to rollover data stream during reindex](https://discuss.elastic.co/t/how-to-rollover-data-stream-during-reindex/359765)
**Author:** [@jacob.k](https://discuss.elastic.co/u/jacob.k)\ **Replies:** 1\ **Last updated:** [May 19, 2024, 3:42pm UTC](https://discuss.elastic.co/t/how-to-rollover-data-stream-during-reindex/359765 "2024-05-19T15:42:15Z")
I have an index with size 5gb. I would like to reindex it to a data stream with rollover policy of max size 1gb and 7 days. This is my policy PUT \_ilm/policy/jacob\_policy { "policy": { "phases": { "hot": {… --- ## [Using RabbitMq as broker between Beats and Logstash](https://discuss.elastic.co/t/using-rabbitmq-as-broker-between-beats-and-logstash/359302)
**Author:** [@NasrJBr](https://discuss.elastic.co/u/NasrJBr)\ **Replies:** 27\ **Last updated:** [May 19, 2024, 12:39pm UTC](https://discuss.elastic.co/t/using-rabbitmq-as-broker-between-beats-and-logstash/359302 "2024-05-19T12:39:03Z")
Hello, I’ve created an architecture for a SIEM using ELK. In this architecture, I’ve used a RabbitMQ broker between Beats and Logstash. Is it a good choice? My final target is to collect logs from at least 1000 Beats and… --- ## [TLS certificate monitoring without hostname verification](https://discuss.elastic.co/t/tls-certificate-monitoring-without-hostname-verification/359752)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 1\ **Last updated:** [May 18, 2024, 10:51pm UTC](https://discuss.elastic.co/t/tls-certificate-monitoring-without-hostname-verification/359752 "2024-05-18T22:51:04Z")
I have installed heartbeat-8.13 . Our Elasticsearch cluster is secured with TLS/SSL . I want to monitor our elastic nodes SSL certificate, heartbeat is installed on seperate node . In http.yml file i am mentioning hosts … --- ## [Byzantium OPNSense beats install](https://discuss.elastic.co/t/byzantium-opnsense-beats-install/358568)
**Author:** [@Ali\_A](https://discuss.elastic.co/u/Ali_A)\ **Replies:** 3\ **Last updated:** [May 18, 2024, 9:12pm UTC](https://discuss.elastic.co/t/byzantium-opnsense-beats-install/358568 "2024-05-18T21:12:10Z")
I am installing beats through the documentation on gitlab kali purple documentation wiki beats dependencies, everything is working well till the installation of filebeat, as mentioned in the documentation after the make … --- ## [Regarding clarification in ca](https://discuss.elastic.co/t/regarding-clarification-in-ca/359743)
**Author:** [@Yogesh\_AS](https://discuss.elastic.co/u/Yogesh_AS)\ **Replies:** 3\ **Last updated:** [May 18, 2024, 5:22pm UTC](https://discuss.elastic.co/t/regarding-clarification-in-ca/359743 "2024-05-18T17:22:49Z")
Hi Team, We are in the process of adding a self-signed certificate to our Elasticsearch or Kibana setup. I have a couple of questions: Without a CA, can I use only the elastic.crt and elastic.key files? If I have a ce… --- ## [Issue on my query](https://discuss.elastic.co/t/issue-on-my-query/359748)
**Author:** [@Claudio\_Clemente](https://discuss.elastic.co/u/Claudio_Clemente)\ **Replies:** 6\ **Last updated:** [May 18, 2024, 4:09pm UTC](https://discuss.elastic.co/t/issue-on-my-query/359748 "2024-05-18T16:09:57Z")
I would like to aggregate the result of the rows that have the error field with the same jobid { "query": { "match\_phrase": { "level": "ERROR" }, "exists": { "field": "metadata.CSBJobId" },… --- ## [When and how are logs transformed the elastic-agent collects](https://discuss.elastic.co/t/when-and-how-are-logs-transformed-the-elastic-agent-collects/359751)
**Author:** [@fbr](https://discuss.elastic.co/u/fbr)\ **Replies:** 0\ **Last updated:** [May 18, 2024, 2:16pm UTC](https://discuss.elastic.co/t/when-and-how-are-logs-transformed-the-elastic-agent-collects/359751 "2024-05-18T14:16:49Z")
Hi there, we are running multiple web-applications (symfony) distributed over multiple server. Now we want to have a centralized place for the logs. I've set up the ELK-Stack (OK, to be honest... i've registered an clo… --- ## [Error - Invalid or missing build flavor \[oss\] for ES server upgrade to 7.10](https://discuss.elastic.co/t/error-invalid-or-missing-build-flavor-oss-for-es-server-upgrade-to-7-10/359601)
**Author:** [@jdinla](https://discuss.elastic.co/u/jdinla)\ **Replies:** 5\ **Last updated:** [May 18, 2024, 7:28am UTC](https://discuss.elastic.co/t/error-invalid-or-missing-build-flavor-oss-for-es-server-upgrade-to-7-10/359601 "2024-05-18T07:28:02Z")
Hi, I upgraded ES server on AWS from 6.8 to 7.10 (this is the latest offered for now). Until now I have been using Restclient 7.17.x. After upgrading the server I started getting - Note: This works fine on docker local… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=236) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=238)