# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=24 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 25 --- ## [Seek Recommended Storage Type for Data Retention](https://discuss.elastic.co/t/seek-recommended-storage-type-for-data-retention/383945)
**Author:** [@houn\_thoeurt](https://discuss.elastic.co/u/houn_thoeurt)\ **Replies:** 3\ **Last updated:** [December 23, 2025, 7:24am UTC](https://discuss.elastic.co/t/seek-recommended-storage-type-for-data-retention/383945 "2025-12-23T07:24:14Z")
Dear Team, We would like to seek your recommendation on log data retention, as we are implementing the Elastic Stack on-premise. To align with regulatory requirements, we must store the data on NAS storage using the Hot… --- ## [I can't seem to connect to logstash for some reason?](https://discuss.elastic.co/t/i-cant-seem-to-connect-to-logstash-for-some-reason/384209)
**Author:** [@Miksos](https://discuss.elastic.co/u/Miksos)\ **Replies:** 5\ **Last updated:** [December 22, 2025, 11:00am UTC](https://discuss.elastic.co/t/i-cant-seem-to-connect-to-logstash-for-some-reason/384209 "2025-12-22T11:00:20Z")
Dec 20 17:46:32 ELK-Server logstash\[690\]: \[2025-12-20T17:46:32,609\]\[WARN \]\[logstash.outputs.elasticsearch\]\[main\] Attempted to resurrect connection to dead ES instance, but got an error {:url=\>"khttp://localhost:9200/", :… --- ## [Unable to completely restore the URL, be sure to use the share functionality](https://discuss.elastic.co/t/unable-to-completely-restore-the-url-be-sure-to-use-the-share-functionality/383960)
**Author:** [@Haris\_Ahmed](https://discuss.elastic.co/u/Haris_Ahmed)\ **Replies:** 5\ **Last updated:** [December 21, 2025, 11:39am UTC](https://discuss.elastic.co/t/unable-to-completely-restore-the-url-be-sure-to-use-the-share-functionality/383960 "2025-12-21T11:39:45Z")
Hi Team, We are currently using Elasticsearch and Kibana version 9.2.0 and have configured a drilldown with the "Go to dashboard" action. The drilldown has been created with the relevant options enabled. We are curr… --- ## [It is possible to autoratate datastream at Kibana?](https://discuss.elastic.co/t/it-is-possible-to-autoratate-datastream-at-kibana/384171)
**Author:** [@alastor](https://discuss.elastic.co/u/alastor)\ **Replies:** 2\ **Last updated:** [December 19, 2025, 3:30pm UTC](https://discuss.elastic.co/t/it-is-possible-to-autoratate-datastream-at-kibana/384171 "2025-12-19T15:30:22Z")
Hello, i would like to share this issue: i got a kibana and filebeat reported to elasticsearch inside K8s, but that by default creates a datastream called .ds-filebeat-8.5.1-2025.12.14-000001, it is possible to make a r… --- ## [Logstash not reading log files from Windows network share folder](https://discuss.elastic.co/t/logstash-not-reading-log-files-from-windows-network-share-folder/384144)
**Author:** [@dalal404](https://discuss.elastic.co/u/dalal404)\ **Replies:** 10\ **Last updated:** [December 19, 2025, 12:14pm UTC](https://discuss.elastic.co/t/logstash-not-reading-log-files-from-windows-network-share-folder/384144 "2025-12-19T12:14:47Z")
Hello, I am running Logstash 9.1.2 on Windows Server 2019, and i am trying to read logs from a network share folder - //MACHINE-1/folder$/somedir/star\*/some\*star.log ( read the “star” as star character ). But it doesnt… --- ## [Auditbeat javascript processor error with v9.2.3](https://discuss.elastic.co/t/auditbeat-javascript-processor-error-with-v9-2-3/384188)
**Author:** [@grants](https://discuss.elastic.co/u/grants)\ **Replies:** 2\ **Last updated:** [December 19, 2025, 12:48am UTC](https://discuss.elastic.co/t/auditbeat-javascript-processor-error-with-v9-2-3/384188 "2025-12-19T00:48:04Z")
Any idea what could be wrong with my processor? Version: 9.2.3 Operating System: ubuntu 22.04 LTS Steps to Reproduce: Processor listed below Setting up auditbeat on a new host encountered an error with a config I know… --- ## [Bearer Authorization in Custom API integration](https://discuss.elastic.co/t/bearer-authorization-in-custom-api-integration/375105)
**Author:** [@tsturg15](https://discuss.elastic.co/u/tsturg15)\ **Replies:** 4\ **Last updated:** [December 18, 2025, 6:57pm UTC](https://discuss.elastic.co/t/bearer-authorization-in-custom-api-integration/375105 "2025-12-18T18:57:48Z")
I am working with an API that only provides Bearer token's. Is it possible to create a custom API integration using this API if they only provide bearer authorization through the headers and not basic, digest, or Oauth2? … --- ## ['No operations allowed after connection closed' errors during Filter phase](https://discuss.elastic.co/t/no-operations-allowed-after-connection-closed-errors-during-filter-phase/384139)
**Author:** [@maldoror](https://discuss.elastic.co/u/maldoror)\ **Replies:** 4\ **Last updated:** [December 18, 2025, 11:44am UTC](https://discuss.elastic.co/t/no-operations-allowed-after-connection-closed-errors-during-filter-phase/384139 "2025-12-18T11:44:36Z")
Hello friends, We are facing a critical issue with our Logstash indexing pipeline during the filtering phase, which executes some very heavy queries on our application DB. Our business application is executing constant… --- ## [Upgrade from 8 to 9 resolve issues in bulk](https://discuss.elastic.co/t/upgrade-from-8-to-9-resolve-issues-in-bulk/384146)
**Author:** [@Peterro](https://discuss.elastic.co/u/Peterro)\ **Replies:** 8\ **Last updated:** [December 18, 2025, 10:17am UTC](https://discuss.elastic.co/t/upgrade-from-8-to-9-resolve-issues-in-bulk/384146 "2025-12-18T10:17:48Z")
On the path to version 9 from version 7 I am currently on 8.19. Upgrade assistant shows a lot of deprecation issues that needs to be solved first. Mostly older indexes with compatibility version \< 8.0. It is possible to … --- ## [Elastic agent is not sending data to elasticsearch cluster](https://discuss.elastic.co/t/elastic-agent-is-not-sending-data-to-elasticsearch-cluster/384080)
**Author:** [@kuldeep\_gupta](https://discuss.elastic.co/u/kuldeep_gupta)\ **Replies:** 1\ **Last updated:** [December 18, 2025, 7:59am UTC](https://discuss.elastic.co/t/elastic-agent-is-not-sending-data-to-elasticsearch-cluster/384080 "2025-12-18T07:59:50Z")
Hello All, I recently upgraded elasticsearch cluster from 8.12 \> 8.19. Subsequently i also upgraded elastic-agent (fleet-server) to 8.19 which is healthy. But when i try to enroll new agent into it, it is in updating s… --- ## [Hot/Warm Architecture with uniform hardware?](https://discuss.elastic.co/t/hot-warm-architecture-with-uniform-hardware/384152)
**Author:** [@algo](https://discuss.elastic.co/u/algo)\ **Replies:** 5\ **Last updated:** [December 18, 2025, 6:57am UTC](https://discuss.elastic.co/t/hot-warm-architecture-with-uniform-hardware/384152 "2025-12-18T06:57:16Z")
Is there any benefit to (or any problems with) data tiering if all nodes use the same type of storage media? In the past, I’ve seen suggestions to transition to a hot/warm/cold architecture for different storage media - … --- ## [Can we create a webform kind in the kibana dashboard](https://discuss.elastic.co/t/can-we-create-a-webform-kind-in-the-kibana-dashboard/357486)
**Author:** [@Lokesh\_s](https://discuss.elastic.co/u/Lokesh_s)\ **Replies:** 6\ **Last updated:** [December 17, 2025, 8:38pm UTC](https://discuss.elastic.co/t/can-we-create-a-webform-kind-in-the-kibana-dashboard/357486 "2025-12-17T20:38:51Z")
Hi, Is there a way to create a html form kind with input tags and submit page in the kibana dashboard. Once the form is submitted, the data needs to be pushed to the index. --- ## [Logs parsing for multiline logs](https://discuss.elastic.co/t/logs-parsing-for-multiline-logs/384151)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 1\ **Last updated:** [December 17, 2025, 6:33pm UTC](https://discuss.elastic.co/t/logs-parsing-for-multiline-logs/384151 "2025-12-17T18:33:35Z")
Hello Team, Below is the sample logs | 2025-06-24 07:47:24 |ERROR| request-worker-13 | com.orsyp.central.ldap.MD5Login | Authentication Exception javax.naming.AuthenticationException: \[LDAP: error code 49 - 8009030C: L… --- ## [Pinning and sorting in Kibana - volatile?](https://discuss.elastic.co/t/pinning-and-sorting-in-kibana-volatile/384051)
**Author:** [@smm](https://discuss.elastic.co/u/smm)\ **Replies:** 4\ **Last updated:** [December 17, 2025, 11:19am UTC](https://discuss.elastic.co/t/pinning-and-sorting-in-kibana-volatile/384051 "2025-12-17T11:19:07Z")
Dear community, my colleagues use in Kibana the feature to ping fields and sort columns. They tell me, it works well for a few days, but then the sorting and pinning gets lost. The wish is to do it once (it is quite so… --- ## [Elastic cluster is getting down after 2 - 3 hours](https://discuss.elastic.co/t/elastic-cluster-is-getting-down-after-2-3-hours/383971)
**Author:** [@sathish12](https://discuss.elastic.co/u/sathish12)\ **Replies:** 55\ **Last updated:** [December 17, 2025, 10:50am UTC](https://discuss.elastic.co/t/elastic-cluster-is-getting-down-after-2-3-hours/383971 "2025-12-17T10:50:55Z")
Hi Everyone. I am using elastic 8.13.4 and I have 3 machines with 30 gb of RAM and 1tb of hard disk for each machine. I am creating 2 nodes per each machine through elastic portable download ealsticsearch-8.13.4.tar.gz.… --- ## [When is an error definitely a permanent failure?](https://discuss.elastic.co/t/when-is-an-error-definitely-a-permanent-failure/384083)
**Author:** [@Mo\_B](https://discuss.elastic.co/u/Mo_B)\ **Replies:** 6\ **Last updated:** [December 17, 2025, 7:58am UTC](https://discuss.elastic.co/t/when-is-an-error-definitely-a-permanent-failure/384083 "2025-12-17T07:58:47Z")
I am using the .NET Elasticsearch client v 9.1.0. I want to check when a response represents a guaranteed permanent failure, i.e. a retry would be guaranteed to fail again (e.g. if the request is malformed, the document … --- ## [Kibana 8.18 search results slow "Loading results"](https://discuss.elastic.co/t/kibana-8-18-search-results-slow-loading-results/378703)
**Author:** [@Dave\_Houser](https://discuss.elastic.co/u/Dave_Houser)\ **Replies:** 6\ **Last updated:** [December 17, 2025, 7:57am UTC](https://discuss.elastic.co/t/kibana-8-18-search-results-slow-loading-results/378703 "2025-12-17T07:57:41Z")
We upgraded our ECK env to 8.18 + all clusters. I noticed that with Kibana 8.18, when I use the search bar, it's very slow, usually just hangs on "loading results". I used to be able to search for most anything in the s… --- ## [Kibana memory consumption growing linearly until it crashes](https://discuss.elastic.co/t/kibana-memory-consumption-growing-linearly-until-it-crashes/383618)
**Author:** [@Fabio\_Hecht](https://discuss.elastic.co/u/Fabio_Hecht)\ **Replies:** 14\ **Last updated:** [December 17, 2025, 7:23am UTC](https://discuss.elastic.co/t/kibana-memory-consumption-growing-linearly-until-it-crashes/383618 "2025-12-17T07:23:24Z")
Hi there! I have an issue with a simple Elastic / Kibana deployment on OpenShift. Even with no data being ingested in Elastic and virtually no users (just me testing), Kibana’s memory consumption grows linearly until the… --- ## [Kibana - API key search results broken](https://discuss.elastic.co/t/kibana-api-key-search-results-broken/384128)
**Author:** [@Dave\_Houser](https://discuss.elastic.co/u/Dave_Houser)\ **Replies:** 8\ **Last updated:** [December 16, 2025, 6:27pm UTC](https://discuss.elastic.co/t/kibana-api-key-search-results-broken/384128 "2025-12-16T18:27:35Z")
In Kibana go to Stack management \> Security \> API keys. Type into search some letters or a word for an API key name. Nothing is returned, even if the API key names include letters or words you typed. If you type the w… --- ## [You are using a deprecated config setting "truststore" set in http. Deprecated settings will continue to work, but are scheduled for removal from logstash in the future. Use \`ssl\_truststore\_path\` instead](https://discuss.elastic.co/t/you-are-using-a-deprecated-config-setting-truststore-set-in-http-deprecated-settings-will-continue-to-work-but-are-scheduled-for-removal-from-logstash-in-the-future-use-ssl-truststore-path-instead/384071)
**Author:** [@Prateek\_Garg](https://discuss.elastic.co/u/Prateek_Garg)\ **Replies:** 3\ **Last updated:** [December 16, 2025, 4:45pm UTC](https://discuss.elastic.co/t/you-are-using-a-deprecated-config-setting-truststore-set-in-http-deprecated-settings-will-continue-to-work-but-are-scheduled-for-removal-from-logstash-in-the-future-use-ssl-truststore-path-instead/384071 "2025-12-16T16:45:47Z")
You are using a deprecated config setting "truststore" set in http. Deprecated settings will continue to work, but are scheduled for removal from logstash in the future. Use ssl\_truststore\_path instead If you have any qu… --- ## [LENS and TSVB showing different result](https://discuss.elastic.co/t/lens-and-tsvb-showing-different-result/384110)
**Author:** [@Arshukla](https://discuss.elastic.co/u/Arshukla)\ **Replies:** 4\ **Last updated:** [December 16, 2025, 4:10pm UTC](https://discuss.elastic.co/t/lens-and-tsvb-showing-different-result/384110 "2025-12-16T16:10:15Z")
Hi team, Could you please help why TSVB is showing 0 values for same field and LENS is having values. Whereas in both scenarios aggregation is sum --- ## [After upgrading to 8.19.5(?)+, Elastic Agent no longer uses the configured proxy, resulting in a 'no such host' error when trying to download binaries.](https://discuss.elastic.co/t/after-upgrading-to-8-19-5-elastic-agent-no-longer-uses-the-configured-proxy-resulting-in-a-no-such-host-error-when-trying-to-download-binaries/384126)
**Author:** [@JPPereira](https://discuss.elastic.co/u/JPPereira)\ **Replies:** 0\ **Last updated:** [December 16, 2025, 3:58pm UTC](https://discuss.elastic.co/t/after-upgrading-to-8-19-5-elastic-agent-no-longer-uses-the-configured-proxy-resulting-in-a-no-such-host-error-when-trying-to-download-binaries/384126 "2025-12-16T15:58:42Z")
Summary of Issue: Elastic Agent Binary Download Failing with DNS Error Since 8.19.5+ Environment Details Component Cluster 1 (Prod) Cluster 2 (Dev) Kibana Nodes 1 1 Data Nodes 9 (3 Hot/3 Warm/3 Cold) 4 (2 Hot/1… --- ## [Customizable Form - Make Dashboards DO Things](https://discuss.elastic.co/t/customizable-form-make-dashboards-do-things/384124)
**Author:** [@Fabio-sama](https://discuss.elastic.co/u/Fabio-sama)\ **Replies:** 0\ **Last updated:** [December 16, 2025, 3:54pm UTC](https://discuss.elastic.co/t/customizable-form-make-dashboards-do-things/384124 "2025-12-16T15:54:30Z")
Hi everyone, I’ve published an open-source Kibana plugin that allows you to build custom, configurable forms as Kibana Visualizations and use them inside your Dashboards so you can basically trigger actions directly fro… --- ## [Windows and Linux Integration to collect inventory data for Defend coverage (and CMDB)](https://discuss.elastic.co/t/windows-and-linux-integration-to-collect-inventory-data-for-defend-coverage-and-cmdb/384117)
**Author:** [@pimthu](https://discuss.elastic.co/u/pimthu)\ **Replies:** 0\ **Last updated:** [December 16, 2025, 2:33pm UTC](https://discuss.elastic.co/t/windows-and-linux-integration-to-collect-inventory-data-for-defend-coverage-and-cmdb/384117 "2025-12-16T14:33:58Z")
We are an MSSP for many organisations and would like to produce Elastic Defend coverage figures. Currently, we need to collect through various cumbersome ways the AD or inventory data from Windows, Mac and Linux clients … --- ## [Case\_insensitive terms query on \_id field - Is this behavior a bug?](https://discuss.elastic.co/t/case-insensitive-terms-query-on-id-field-is-this-behavior-a-bug/384090)
**Author:** [@khatcher](https://discuss.elastic.co/u/khatcher)\ **Replies:** 1\ **Last updated:** [December 16, 2025, 1:04pm UTC](https://discuss.elastic.co/t/case-insensitive-terms-query-on-id-field-is-this-behavior-a-bug/384090 "2025-12-16T13:04:51Z")
I have an index with IDs that I manually set to product IDs from the database, and they get prefixed with AHC or CAT, depending on which catalog the products are from. In my general search, I include a terms query that l… --- ## [Optimal JVM Heap size?](https://discuss.elastic.co/t/optimal-jvm-heap-size/384106)
**Author:** [@Aditya\_M](https://discuss.elastic.co/u/Aditya_M)\ **Replies:** 1\ **Last updated:** [December 16, 2025, 11:26am UTC](https://discuss.elastic.co/t/optimal-jvm-heap-size/384106 "2025-12-16T11:26:59Z")
Hi All, I am looking for verification on the optimal JVM Heap size configuration for our production cluster. We are running on physical nodes with 500 GB of RAM each. I have read two conflicting pieces of advice regar… --- ## [Create a custom dashboard on elastic alerting data](https://discuss.elastic.co/t/create-a-custom-dashboard-on-elastic-alerting-data/384108)
**Author:** [@Maretti](https://discuss.elastic.co/u/Maretti)\ **Replies:** 2\ **Last updated:** [December 16, 2025, 11:15am UTC](https://discuss.elastic.co/t/create-a-custom-dashboard-on-elastic-alerting-data/384108 "2025-12-16T11:15:59Z")
Hi, I would like to create a dashboard with the data from elastic alerting. According to this documentation page the data is visible under .internal-alerts-\* indices I can see those in index management ex. .internal… --- ## [This cluster had issues returning data and results might be incomplete](https://discuss.elastic.co/t/this-cluster-had-issues-returning-data-and-results-might-be-incomplete/384101)
**Author:** [@Sriknth](https://discuss.elastic.co/u/Sriknth)\ **Replies:** 1\ **Last updated:** [December 16, 2025, 9:55am UTC](https://discuss.elastic.co/t/this-cluster-had-issues-returning-data-and-results-might-be-incomplete/384101 "2025-12-16T09:55:05Z")
This cluster had issues returning data and results might be incomplete. and showing “searchTimeout"what is solution for this. --- ## [Forming an Elasticsearch cluster](https://discuss.elastic.co/t/forming-an-elasticsearch-cluster/384041)
**Author:** [@SamehSaeed](https://discuss.elastic.co/u/SamehSaeed)\ **Replies:** 3\ **Last updated:** [December 16, 2025, 7:57am UTC](https://discuss.elastic.co/t/forming-an-elasticsearch-cluster/384041 "2025-12-16T07:57:43Z")
Hello, I’m trying to add a second node to my ES cluster but I’m facing issues with SSL handshake. \[2025-12-14T15:38:54,881\]\[WARN \]\[o.e.t.TcpTransport \] \[SCPRLUWS05\] exception caught on transport layer \[Netty4TcpC… --- ## [Severe Performance Degradation After Adding High-Cardinality Text Field to Large Index](https://discuss.elastic.co/t/severe-performance-degradation-after-adding-high-cardinality-text-field-to-large-index/378571)
**Author:** [@Dimitris\_Makris](https://discuss.elastic.co/u/Dimitris_Makris)\ **Replies:** 12\ **Last updated:** [December 15, 2025, 9:23pm UTC](https://discuss.elastic.co/t/severe-performance-degradation-after-adding-high-cardinality-text-field-to-large-index/378571 "2025-12-15T21:23:59Z")
I'm experiencing a significant performance issue after adding a new multi-valued text field to a large Elasticsearch index and would appreciate insights from anyone who has faced similar challenges. Setup: Elasticsear… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=23) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=25)