# Elastic Stack

**URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=242

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 243

---

## [LLM tag retrieval](https://discuss.elastic.co/t/llm-tag-retrieval/359353)

<div class="topic-metadata">

**Author:** [@BILI](https://discuss.elastic.co/u/BILI)\
**Replies:** 7\
**Last updated:** [May 13, 2024, 11:27am UTC](https://discuss.elastic.co/t/llm-tag-retrieval/359353 "2024-05-13T11:27:32Z")

</div>

using LLM to anticipate in hackers attacks/ bottle necks /performance picks of monitored products.

---

## [Modify default scoring convention for multi field knn search to omit null values](https://discuss.elastic.co/t/modify-default-scoring-convention-for-multi-field-knn-search-to-omit-null-values/359287)

<div class="topic-metadata">

**Author:** [@tlandelin](https://discuss.elastic.co/u/tlandelin)\
**Replies:** 1\
**Last updated:** [May 13, 2024, 11:19am UTC](https://discuss.elastic.co/t/modify-default-scoring-convention-for-multi-field-knn-search-to-omit-null-values/359287 "2024-05-13T11:19:53Z")

</div>

Hi, With multi field knn search, the score is calculated, e.g. score = match\_boost \* match\_score + field1\_boost \* field1\_score + field2\_boost \* field2\_score If a document is missing the vector value for a field, the…

---

## [Named query performance degradation after upgrading to 8.13.2 (from 8.7.1)](https://discuss.elastic.co/t/named-query-performance-degradation-after-upgrading-to-8-13-2-from-8-7-1/359189)

<div class="topic-metadata">

**Author:** [@shimpeko](https://discuss.elastic.co/u/shimpeko)\
**Replies:** 3\
**Last updated:** [May 13, 2024, 11:17am UTC](https://discuss.elastic.co/t/named-query-performance-degradation-after-upgrading-to-8-13-2-from-8-7-1/359189 "2024-05-13T11:17:36Z")

</div>

Hello, After upgrading from 8.7.1 to 8.13.2, some of our queries are about 2x slower (longer response time). After digging, I've identified that the named query is causing the problem. Queries with "\_name" get about 2x …

---

## [Self hosted Elastic search instance with Kibana- Trial license- SSO OIDC integration](https://discuss.elastic.co/t/self-hosted-elastic-search-instance-with-kibana-trial-license-sso-oidc-integration/358613)

<div class="topic-metadata">

**Author:** [@sunilg](https://discuss.elastic.co/u/sunilg)\
**Replies:** 8\
**Last updated:** [May 13, 2024, 11:03am UTC](https://discuss.elastic.co/t/self-hosted-elastic-search-instance-with-kibana-trial-license-sso-oidc-integration/358613 "2024-05-13T11:03:42Z")

</div>

Hi , I'm running the instance of Elastic search and Kibana on a host running under the trail license. The moment i make OIDC changes in Elasticsearch yml for SSO integration, the kibana is not able to read Elasticsearch …

---

## [The E5 multilingual optimized returns a python error. (self hosted?)](https://discuss.elastic.co/t/the-e5-multilingual-optimized-returns-a-python-error-self-hosted/356157)

<div class="topic-metadata">

**Author:** [@Chenko](https://discuss.elastic.co/u/Chenko)\
**Replies:** 3\
**Last updated:** [May 13, 2024, 11:03am UTC](https://discuss.elastic.co/t/the-e5-multilingual-optimized-returns-a-python-error-self-hosted/356157 "2024-05-13T11:03:31Z")

</div>

Hi, I am trying to run the E5 multilingual optimized model myself, as I feel this might be faster than running it through elastic that is in a docker container. I am running into the following issue: When loading in t…

---

## [Debug Logging In Elasticsearch](https://discuss.elastic.co/t/debug-logging-in-elasticsearch/359360)

<div class="topic-metadata">

**Author:** [@Debasis\_Mallick](https://discuss.elastic.co/u/Debasis_Mallick)\
**Replies:** 1\
**Last updated:** [May 13, 2024, 10:43am UTC](https://discuss.elastic.co/t/debug-logging-in-elasticsearch/359360 "2024-05-13T10:43:38Z")

</div>

Hi Team, We want to enable debugging or trace in Elasticsearch to capture client connection, capture the timings while user querying the indices. Is there anyway to possible these task. NOTE:- Here we are using NodeJS …

---

## [Getting number of indexed documents when there is a replica](https://discuss.elastic.co/t/getting-number-of-indexed-documents-when-there-is-a-replica/359333)

<div class="topic-metadata">

**Author:** [@hjazz6](https://discuss.elastic.co/u/hjazz6)\
**Replies:** 1\
**Last updated:** [May 13, 2024, 7:53am UTC](https://discuss.elastic.co/t/getting-number-of-indexed-documents-when-there-is-a-replica/359333 "2024-05-13T07:53:42Z")

</div>

Hi, I'm trying to calculate the indexing rate of my ES (version 8.8.0), and I've been using the API below to do that when I set replica = 0. GET \<index\_name\>/\_stats/indexing?filter\_path=indices.\*.total.indexing.index\_t…

---

## [Elasticsearch (ES), Filebeat, Logstash, and Kibana for backup and restore purposes](https://discuss.elastic.co/t/elasticsearch-es-filebeat-logstash-and-kibana-for-backup-and-restore-purposes/359346)

<div class="topic-metadata">

**Author:** [@Michael\_Mathan\_S](https://discuss.elastic.co/u/Michael_Mathan_S)\
**Replies:** 1\
**Last updated:** [May 13, 2024, 7:43am UTC](https://discuss.elastic.co/t/elasticsearch-es-filebeat-logstash-and-kibana-for-backup-and-restore-purposes/359346 "2024-05-13T07:43:53Z")

</div>

Could you clarify the following items for me? Could you please help me with this? We have been using Elasticsearch (ES), Filebeat, Logstash, and Kibana for backup and restore purposes. All components will run exclusive…

---

## [How to install File input plugin on Fedora core-os?](https://discuss.elastic.co/t/how-to-install-file-input-plugin-on-fedora-core-os/359347)

<div class="topic-metadata">

**Author:** [@yogeshk04](https://discuss.elastic.co/u/yogeshk04)\
**Replies:** 0\
**Last updated:** [May 13, 2024, 7:22am UTC](https://discuss.elastic.co/t/how-to-install-file-input-plugin-on-fedora-core-os/359347 "2024-05-13T07:22:09Z")

</div>

How to install File input plugin on Fedora core-os?

---

## [Inquiry about elastic agents](https://discuss.elastic.co/t/inquiry-about-elastic-agents/359298)

<div class="topic-metadata">

**Author:** [@wwwryuwww](https://discuss.elastic.co/u/wwwryuwww)\
**Replies:** 2\
**Last updated:** [May 13, 2024, 6:15am UTC](https://discuss.elastic.co/t/inquiry-about-elastic-agents/359298 "2024-05-13T06:15:22Z")

</div>

Hi, everybody. I am very new to elastic agent and I'm trying to get used to it. Once I install elastic agent to a server, I see many instances are running. Are the default instances always running statically regardle…

---

## [Sql span in .net framework application desktop](https://discuss.elastic.co/t/sql-span-in-net-framework-application-desktop/359327)

<div class="topic-metadata">

**Author:** [@Kirtash](https://discuss.elastic.co/u/Kirtash)\
**Replies:** 0\
**Last updated:** [May 12, 2024, 7:42pm UTC](https://discuss.elastic.co/t/sql-span-in-net-framework-application-desktop/359327 "2024-05-12T19:42:28Z")

</div>

Good morning, I have a desktop application in .net framework 4.8 and now I could create manual transactions with this configuration: Agent.Subscribe(New HttpDiagnosticsSubscriber()) Agent.Setup(New AgentComponents()) P…

---

## [Rescoring adds unexplained latency to queries](https://discuss.elastic.co/t/rescoring-adds-unexplained-latency-to-queries/359326)

<div class="topic-metadata">

**Author:** [@Nemphys](https://discuss.elastic.co/u/Nemphys)\
**Replies:** 0\
**Last updated:** [May 12, 2024, 6:57pm UTC](https://discuss.elastic.co/t/rescoring-adds-unexplained-latency-to-queries/359326 "2024-05-12T18:57:49Z")

</div>

I have created a custom rescorer, following the examples of QueryRescorer / ExampleRescorer. It works fine, but the latency added to the responses is much bigger than it seemingly should be. I am using a test query, wh…

---

## [Open AI Inference API specifying dimensions](https://discuss.elastic.co/t/open-ai-inference-api-specifying-dimensions/359324)

<div class="topic-metadata">

**Author:** [@Bartu\_Celasun](https://discuss.elastic.co/u/Bartu_Celasun)\
**Replies:** 0\
**Last updated:** [May 12, 2024, 2:49pm UTC](https://discuss.elastic.co/t/open-ai-inference-api-specifying-dimensions/359324 "2024-05-12T14:49:38Z")

</div>

So my question is about inference API's. Why there is no option to specify the dimensions. In my case I want to use text-embedding-large-3 with 1536 dimensions but when i try to create this. PUT \_inference/text\_embeddin…

---

## [Sending logs from ibm i to elsatic](https://discuss.elastic.co/t/sending-logs-from-ibm-i-to-elsatic/357854)

<div class="topic-metadata">

**Author:** [@itayber](https://discuss.elastic.co/u/itayber)\
**Replies:** 2\
**Last updated:** [May 12, 2024, 7:42am UTC](https://discuss.elastic.co/t/sending-logs-from-ibm-i-to-elsatic/357854 "2024-05-12T07:42:55Z")

</div>

hello guys, currently im sending logs of jobs from the ibm i system (as400) to elastic by converting the logs to txt files and using curl to send them, curl is part of pase environment witch is unix commands. as i h…

---

## [Update Elastic node license without API](https://discuss.elastic.co/t/update-elastic-node-license-without-api/359278)

<div class="topic-metadata">

**Author:** [@amirnegah](https://discuss.elastic.co/u/amirnegah)\
**Replies:** 1\
**Last updated:** [May 12, 2024, 7:18am UTC](https://discuss.elastic.co/t/update-elastic-node-license-without-api/359278 "2024-05-12T07:18:08Z")

</div>

Hi Everyone. I have an ES node which is 5.6.16 and the service is failed due that license expiring. I issued a new license but since the service is down, I can't update It through curl. Do you have any suggestion or o…

---

## [Problems indexing events into Elasticsearch](https://discuss.elastic.co/t/problems-indexing-events-into-elasticsearch/359148)

<div class="topic-metadata">

**Author:** [@Compte\_Personnel](https://discuss.elastic.co/u/Compte_Personnel)\
**Replies:** 6\
**Last updated:** [May 12, 2024, 4:16am UTC](https://discuss.elastic.co/t/problems-indexing-events-into-elasticsearch/359148 "2024-05-12T04:16:53Z")

</div>

Hello everyone, It seems there are issues with indexing events into Elasticsearch ● logstash.service - logstash Loaded: loaded (/lib/systemd/system/logstash.service; enabled; vendor preset: enabled) Active: a…

---

## [ElasticSearch 1.7.3 Download Link Broken](https://discuss.elastic.co/t/elasticsearch-1-7-3-download-link-broken/358956)

<div class="topic-metadata">

**Author:** [@netshade](https://discuss.elastic.co/u/netshade)\
**Replies:** 2\
**Last updated:** [May 11, 2024, 11:21am UTC](https://discuss.elastic.co/t/elasticsearch-1-7-3-download-link-broken/358956 "2024-05-11T11:21:55Z")

</div>

For the extremely old 1.7.3 release, the download link https://download.elastic.co/elasticsearch/elasticsearch/elasticsearch-1.7.3.zip now returns a 403. This breaks any workflows that depend on testing on older ES versi…

---

## [Some questions about xpack-ml?](https://discuss.elastic.co/t/some-questions-about-xpack-ml/359232)

<div class="topic-metadata">

**Author:** [@sheli00](https://discuss.elastic.co/u/sheli00)\
**Replies:** 2\
**Last updated:** [May 11, 2024, 12:55am UTC](https://discuss.elastic.co/t/some-questions-about-xpack-ml/359232 "2024-05-11T00:55:33Z")

</div>

I am using Elasticsearch as a developer. During the compilation process, I found that the download speed of ml-cpp-8.10.0-SNAPSHOT-deps.zip is very slow, and it is not managed by maven, so I cannot use mirror to download…

---

## [Elastic Search document fields and values statistics?](https://discuss.elastic.co/t/elastic-search-document-fields-and-values-statistics/359284)

<div class="topic-metadata">

**Author:** [@dennisk](https://discuss.elastic.co/u/dennisk)\
**Replies:** 0\
**Last updated:** [May 10, 2024, 9:45pm UTC](https://discuss.elastic.co/t/elastic-search-document-fields-and-values-statistics/359284 "2024-05-10T21:45:49Z")

</div>

I am working on a Python program that gives me statistics across all documents in a given Elastic Search index. Docs in our indexes have many fields that are not specifically mapped in the ES settings. They are just trea…

---

## [Is it possible to filter aggregation return result?](https://discuss.elastic.co/t/is-it-possible-to-filter-aggregation-return-result/359238)

<div class="topic-metadata">

**Author:** [@J\_Kit](https://discuss.elastic.co/u/J_Kit)\
**Replies:** 1\
**Last updated:** [May 10, 2024, 8:42pm UTC](https://discuss.elastic.co/t/is-it-possible-to-filter-aggregation-return-result/359238 "2024-05-10T20:42:33Z")

</div>

Hi, I got example 2 documents doc: 1 { ... author: \['mike', 'adam', 'julie'\] } doc: 2 { ... author: \['mike', 'mike stephen', 'apple'\] } in keyword search scenario, user will search "mike" with query below { "q…

---

## [Dev Tools - user-agent Header Missing](https://discuss.elastic.co/t/dev-tools-user-agent-header-missing/358516)

<div class="topic-metadata">

**Author:** [@nickkd](https://discuss.elastic.co/u/nickkd)\
**Replies:** 4\
**Last updated:** [May 10, 2024, 4:52pm UTC](https://discuss.elastic.co/t/dev-tools-user-agent-header-missing/358516 "2024-05-10T16:52:55Z")

</div>

Hey! Hopefully this isn't an entirely strange question - we're running into an issue when using the console in the dev-tools of Kibana 8.11 where it looks like when Kibana sends the query to Elasticsearch, the ALB isn't…

---

## [Filebeat can't connect to Elastic search](https://discuss.elastic.co/t/filebeat-cant-connect-to-elastic-search/358873)

<div class="topic-metadata">

**Author:** [@ddiabe](https://discuss.elastic.co/u/ddiabe)\
**Replies:** 25\
**Last updated:** [May 10, 2024, 4:41pm UTC](https://discuss.elastic.co/t/filebeat-cant-connect-to-elastic-search/358873 "2024-05-10T16:41:58Z")

</div>

Downloaded a filebeat to my host (which is a domain controller ), trying to use filebeat to ship identity logs from DC to ELK (logstash and Elasticsearch). having the following error everytime i run ./filebeat setup - e…

---

## [Filebeat 7.17, error "cannot access method/field \[size\] from a null def reference" while trying to download IOCs from MISP](https://discuss.elastic.co/t/filebeat-7-17-error-cannot-access-method-field-size-from-a-null-def-reference-while-trying-to-download-iocs-from-misp/359272)

<div class="topic-metadata">

**Author:** [@davekiny](https://discuss.elastic.co/u/davekiny)\
**Replies:** 0\
**Last updated:** [May 10, 2024, 3:52pm UTC](https://discuss.elastic.co/t/filebeat-7-17-error-cannot-access-method-field-size-from-a-null-def-reference-while-trying-to-download-iocs-from-misp/359272 "2024-05-10T15:52:45Z")

</div>

Hello Everyone, I'm trying to enable MISP integration, using the threatintel module. Seems that the agent s not able to download the IOCs and I can see only one document in Elastic, with this error message: cannot acc…

---

## [Elastic Agent horizontal scaling vs logs duplicates](https://discuss.elastic.co/t/elastic-agent-horizontal-scaling-vs-logs-duplicates/359254)

<div class="topic-metadata">

**Author:** [@djkprojects](https://discuss.elastic.co/u/djkprojects)\
**Replies:** 4\
**Last updated:** [May 10, 2024, 3:17pm UTC](https://discuss.elastic.co/t/elastic-agent-horizontal-scaling-vs-logs-duplicates/359254 "2024-05-10T15:17:35Z")

</div>

Hello, We have multiple Elastic Agents assigned to one policy and this is causing an issue with data collected by the integrations being duplicated. I understand that the policy and integrations get applied to each Age…

---

## [Node.js vulnerabilities](https://discuss.elastic.co/t/node-js-vulnerabilities/359102)

<div class="topic-metadata">

**Author:** [@jloas](https://discuss.elastic.co/u/jloas)\
**Replies:** 3\
**Last updated:** [May 10, 2024, 2:30pm UTC](https://discuss.elastic.co/t/node-js-vulnerabilities/359102 "2024-05-10T14:30:24Z")

</div>

We use Elasticsearch/Kibana and we continually have our scanners flagging node.js vulnerabilities b/c the version of node.js is present in our applications/on our nodes. The issue is Elastic has not called out any of the…

---

## [how to do deep linking for kibana dashboard](https://discuss.elastic.co/t/how-to-do-deep-linking-for-kibana-dashboard/359265)

<div class="topic-metadata">

**Author:** [@Arun\_Kumar\_V](https://discuss.elastic.co/u/Arun_Kumar_V)\
**Replies:** 2\
**Last updated:** [May 10, 2024, 3:09pm UTC](https://discuss.elastic.co/t/how-to-do-deep-linking-for-kibana-dashboard/359265 "2024-05-10T15:09:11Z")

</div>

I have a requirement, where i need to provide the Kibana dashboard URL to the user. i have created a control in the dashboard labeled Instance which has list of values example, aa, bb cc etc i need to format url dynami…

---

## [How can I filter by a specific field value when creating Multi-metric Anomaly Jobs in Elastic?](https://discuss.elastic.co/t/how-can-i-filter-by-a-specific-field-value-when-creating-multi-metric-anomaly-jobs-in-elastic/359268)

<div class="topic-metadata">

**Author:** [@ashna64](https://discuss.elastic.co/u/ashna64)\
**Replies:** 0\
**Last updated:** [May 10, 2024, 1:46pm UTC](https://discuss.elastic.co/t/how-can-i-filter-by-a-specific-field-value-when-creating-multi-metric-anomaly-jobs-in-elastic/359268 "2024-05-10T13:46:25Z")

</div>

Trying to filter by a specific field value in the "Split field" option when creating multi-metric anomaly detection jobs.

---

## [Enable Audit Logging IN Elasticsearch For a User](https://discuss.elastic.co/t/enable-audit-logging-in-elasticsearch-for-a-user/359227)

<div class="topic-metadata">

**Author:** [@Debasis\_Mallick](https://discuss.elastic.co/u/Debasis_Mallick)\
**Replies:** 7\
**Last updated:** [May 10, 2024, 1:16pm UTC](https://discuss.elastic.co/t/enable-audit-logging-in-elasticsearch-for-a-user/359227 "2024-05-10T13:16:19Z")

</div>

Hello Team, We require to enable an audit for a specific user, meaning that whenever the user logs in or performs any CRUD operations in Elasticsearch, it should be recorded. The user has reported intermittent connectiv…

---

## [Google pubsub plugin(input-output) not found](https://discuss.elastic.co/t/google-pubsub-plugin-input-output-not-found/359250)

<div class="topic-metadata">

**Author:** [@ISR\_FY](https://discuss.elastic.co/u/ISR_FY)\
**Replies:** 2\
**Last updated:** [May 10, 2024, 12:56pm UTC](https://discuss.elastic.co/t/google-pubsub-plugin-input-output-not-found/359250 "2024-05-10T12:56:55Z")

</div>

Good morning. Recently we migrated the instances from Centos to Rocky Linux. We are suffering this problem: When we install logstash and before start it We try to add the plugins for pubsub(input and output) but the ser…

---

## [Filebeat gets "stuck" while loading inputs from configured path](https://discuss.elastic.co/t/filebeat-gets-stuck-while-loading-inputs-from-configured-path/359261)

<div class="topic-metadata">

**Author:** [@blueish](https://discuss.elastic.co/u/blueish)\
**Replies:** 0\
**Last updated:** [May 10, 2024, 12:46pm UTC](https://discuss.elastic.co/t/filebeat-gets-stuck-while-loading-inputs-from-configured-path/359261 "2024-05-10T12:46:06Z")

</div>

Hi, I'm running containerized Filebeat instances on Openshift cluster. I have MapR volume mounted into the Filebeat pods and Filebeat is instructed to read from those volumes. I noticed that depending on the amount of …

[Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=241)

[Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=243)
