# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=25 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 26 --- ## [ML rules How to handle timezone (UTC GMT-3) and alert duration in notifications?](https://discuss.elastic.co/t/ml-rules-how-to-handle-timezone-utc-gmt-3-and-alert-duration-in-notifications/384089)
**Author:** [@sguerrero](https://discuss.elastic.co/u/sguerrero)\ **Replies:** 0\ **Last updated:** [December 15, 2025, 5:55pm UTC](https://discuss.elastic.co/t/ml-rules-how-to-handle-timezone-utc-gmt-3-and-alert-duration-in-notifications/384089 "2025-12-15T17:55:27Z")
Hello community, We are currently using kibana machine learning anomaly detection alerts (anomaly detection jobs) with email actions triggered “for each alert \> on status change”. We have two related requirements regar… --- ## [The transport thread cannot be executed by CPU for a long time due to node-level scheduling/resource contention in Elasticsearch cluster](https://discuss.elastic.co/t/the-transport-thread-cannot-be-executed-by-cpu-for-a-long-time-due-to-node-level-scheduling-resource-contention-in-elasticsearch-cluster/384060)
**Author:** [@arT1](https://discuss.elastic.co/u/arT1)\ **Replies:** 3\ **Last updated:** [December 15, 2025, 2:51pm UTC](https://discuss.elastic.co/t/the-transport-thread-cannot-be-executed-by-cpu-for-a-long-time-due-to-node-level-scheduling-resource-contention-in-elasticsearch-cluster/384060 "2025-12-15T14:51:55Z")
The transport thread cannot be executed by CPU for a long time due to node-level scheduling/resource contention in Elasticsearch cluster Environment: Elasticsearch version: v8.13.3 Deploy: tar.gz Service management: … --- ## [Impossible to build Elasticsearch 9.0 anymore](https://discuss.elastic.co/t/impossible-to-build-elasticsearch-9-0-anymore/383364)
**Author:** [@benjamingdocker](https://discuss.elastic.co/u/benjamingdocker)\ **Replies:** 7\ **Last updated:** [December 15, 2025, 2:00pm UTC](https://discuss.elastic.co/t/impossible-to-build-elasticsearch-9-0-anymore/383364 "2025-12-15T14:00:30Z")
Good morning :waving\_hand: I was trying to build ES 9.0.8 from sources but I am facing some issues. I am not a Java expert so please bear with me I probably do silly things here. However, I do need to build ES from sour… --- ## [New ELK 9.x cluster and Kibana HA](https://discuss.elastic.co/t/new-elk-9-x-cluster-and-kibana-ha/383780)
**Author:** [@d.silwon](https://discuss.elastic.co/u/d.silwon)\ **Replies:** 13\ **Last updated:** [December 15, 2025, 1:19pm UTC](https://discuss.elastic.co/t/new-elk-9-x-cluster-and-kibana-ha/383780 "2025-12-15T13:19:19Z")
Dears, I need your advice on installing a new ELK 9.x cluster. The cluster will be set up on VMs in the following configuration: 3 x MASTER node 8 x DATA node 2 x Kibana node 2 x Logstash node If I configure two se… --- ## [Params.\_interval in LENS](https://discuss.elastic.co/t/params-interval-in-lens/384065)
**Author:** [@Arshukla](https://discuss.elastic.co/u/Arshukla)\ **Replies:** 1\ **Last updated:** [December 15, 2025, 12:13pm UTC](https://discuss.elastic.co/t/params-interval-in-lens/384065 "2025-12-15T12:13:14Z")
Hi I am using params.\_interval in TSVB, and want to use the same interval thing in LENS. What is the way to do the same in LENS? As in denominator I want to use the interval in LENS, for preparing a tabular dashboard --- ## [Context group not visible in rule](https://discuss.elastic.co/t/context-group-not-visible-in-rule/384052)
**Author:** [@Dhruv\_Naik](https://discuss.elastic.co/u/Dhruv_Naik)\ **Replies:** 1\ **Last updated:** [December 15, 2025, 10:13am UTC](https://discuss.elastic.co/t/context-group-not-visible-in-rule/384052 "2025-12-15T10:13:52Z")
I’ve set a GROUP BY query which looks as follows under Rules: When I test the index connector via Dev Tools the context.group stays empty. My document is formatted as follows: { "alert\_type": "ERROR\_THRESHOLD\_BREA… --- ## [Configure High Availability setup for elastic stack](https://discuss.elastic.co/t/configure-high-availability-setup-for-elastic-stack/383819)
**Author:** [@Eshwar\_K](https://discuss.elastic.co/u/Eshwar_K)\ **Replies:** 3\ **Last updated:** [December 15, 2025, 7:35am UTC](https://discuss.elastic.co/t/configure-high-availability-setup-for-elastic-stack/383819 "2025-12-15T07:35:09Z")
Hi Elastic Experts, I would appreciate your inputs on the queries below. We have a requirement to configure high availability across two data centers (DC and DR) for Elasticsearch nodes, Logstash, and Kibana. The custo… --- ## [Master node does not allow updating](https://discuss.elastic.co/t/master-node-does-not-allow-updating/384028)
**Author:** [@juancamiloll](https://discuss.elastic.co/u/juancamiloll)\ **Replies:** 3\ **Last updated:** [December 12, 2025, 7:10pm UTC](https://discuss.elastic.co/t/master-node-does-not-allow-updating/384028 "2025-12-12T19:10:45Z")
I am currently upgrading from the highest available version, v 8.19.3, to v 8.19.8. I successfully completed the process on two of the three servers in the cluster, but now I am having problems with the one that acts as… --- ## [Facing Error while upgrading elasticsearch cluster to 8.19.8](https://discuss.elastic.co/t/facing-error-while-upgrading-elasticsearch-cluster-to-8-19-8/384017)
**Author:** [@Umang\_Pachaury](https://discuss.elastic.co/u/Umang_Pachaury)\ **Replies:** 2\ **Last updated:** [December 12, 2025, 2:49pm UTC](https://discuss.elastic.co/t/facing-error-while-upgrading-elasticsearch-cluster-to-8-19-8/384017 "2025-12-12T14:49:24Z")
Hey everyone, I am currently upgrading my elasticsearch version from 8.11.3 to 8.19.8 and I am facing an error. I am using docker containers to deploy elasticsearch nodes. I was able to upgrade my coordinator and hot no… --- ## [What is the best indexing strategy in Elasticsearch for many small shards?](https://discuss.elastic.co/t/what-is-the-best-indexing-strategy-in-elasticsearch-for-many-small-shards/384010)
**Author:** [@cilasmarques](https://discuss.elastic.co/u/cilasmarques)\ **Replies:** 3\ **Last updated:** [December 12, 2025, 2:48pm UTC](https://discuss.elastic.co/t/what-is-the-best-indexing-strategy-in-elasticsearch-for-many-small-shards/384010 "2025-12-12T14:48:27Z")
I'm new to Elasticsearch and I'm trying to understand the best practices to improve performance in my scenario. I currently have 18 indices, one for each environment and location, each index has 1 shard and is \< 1 GB in … --- ## [How do you replicate tagging in metricbeat/filebeat with the agent?](https://discuss.elastic.co/t/how-do-you-replicate-tagging-in-metricbeat-filebeat-with-the-agent/383937)
**Author:** [@rex656](https://discuss.elastic.co/u/rex656)\ **Replies:** 2\ **Last updated:** [December 12, 2025, 2:35pm UTC](https://discuss.elastic.co/t/how-do-you-replicate-tagging-in-metricbeat-filebeat-with-the-agent/383937 "2025-12-12T14:35:40Z")
I am in the process of migrating ~450 windows servers from using beats to the agent. All of these servers have metricbeat only and about 120 of those also have filebeat (doing some custom parsing that will be replicated … --- ## [Filebeat OOM (Out Of Memory) Error](https://discuss.elastic.co/t/filebeat-oom-out-of-memory-error/383768)
**Author:** [@Thirupathi](https://discuss.elastic.co/u/Thirupathi)\ **Replies:** 9\ **Last updated:** [December 12, 2025, 7:25am UTC](https://discuss.elastic.co/t/filebeat-oom-out-of-memory-error/383768 "2025-12-12T07:25:47Z")
harvester\_buffer\_size: 5368709120 message\_max\_bytes: 5368709120 multiline.max\_lines: 5368709120 i configured above configuration in filebet after am getting below issue mp":"2025-11-30T05:04:30.546-0500","log.logger":"… --- ## [My Status of Fleet Agent doesn't change from Updating to Heathy](https://discuss.elastic.co/t/my-status-of-fleet-agent-doesnt-change-from-updating-to-heathy/384003)
**Author:** [@duy270101](https://discuss.elastic.co/u/duy270101)\ **Replies:** 1\ **Last updated:** [December 12, 2025, 6:47am UTC](https://discuss.elastic.co/t/my-status-of-fleet-agent-doesnt-change-from-updating-to-heathy/384003 "2025-12-12T06:47:11Z")
My case. I set up for may lab. Please help me. Status don't change to Heathy. when install i added –insecure -f in the tail of command. --- ## [Elastic/kibana webserver .p12/.crt issues](https://discuss.elastic.co/t/elastic-kibana-webserver-p12-crt-issues/383903)
**Author:** [@HaydenB0101](https://discuss.elastic.co/u/HaydenB0101)\ **Replies:** 6\ **Last updated:** [December 12, 2025, 1:37am UTC](https://discuss.elastic.co/t/elastic-kibana-webserver-p12-crt-issues/383903 "2025-12-12T01:37:56Z")
My elastic setup is running into issues after I generated new certs for http encryption using elasticsearch-certutil for http and ca. I followed this documentation as well as documentation from other people Kibana is run… --- ## [AWS Integration - Logs from CloudWatch error STS: AssumeRole, exceeded maximum number of attempts](https://discuss.elastic.co/t/aws-integration-logs-from-cloudwatch-error-sts-assumerole-exceeded-maximum-number-of-attempts/383936)
**Author:** [@carellevbt](https://discuss.elastic.co/u/carellevbt)\ **Replies:** 1\ **Last updated:** [December 12, 2025, 1:35am UTC](https://discuss.elastic.co/t/aws-integration-logs-from-cloudwatch-error-sts-assumerole-exceeded-maximum-number-of-attempts/383936 "2025-12-12T01:35:36Z")
Hello, We started seeing the below error on the AWS integrations, precisely for the “Collect Logs from CloudWatch”. getLogEventsFromCloudWatch failed: error FilterLogEvents with Paginator: operation error CloudWatch Lo… --- ## [OTEL Traces not appearing in Observability-Services](https://discuss.elastic.co/t/otel-traces-not-appearing-in-observability-services/384004)
**Author:** [@Steve\_Foster](https://discuss.elastic.co/u/Steve_Foster)\ **Replies:** 1\ **Last updated:** [December 11, 2025, 10:29pm UTC](https://discuss.elastic.co/t/otel-traces-not-appearing-in-observability-services/384004 "2025-12-11T22:29:32Z")
Posted in Elastic Slack too.. I'm struggling to get OTEL traces from a python application, that are being send to a hosted elastic, to be displayed in observability-\>services.The application is running in AWS ECS and se… --- ## [Migration 5.x to 9.x](https://discuss.elastic.co/t/migration-5-x-to-9-x/383997)
**Author:** [@ppat](https://discuss.elastic.co/u/ppat)\ **Replies:** 1\ **Last updated:** [December 11, 2025, 8:36pm UTC](https://discuss.elastic.co/t/migration-5-x-to-9-x/383997 "2025-12-11T20:36:06Z")
I am migrating gtom 5.x to 9.x, match\_all returns all documents but ith query it does return no documents even though there is a match. same application code works for develop 9.x elastic but qa 9.x it doesnt. Checked th… --- ## [Are date indexes not allowed anymore?](https://discuss.elastic.co/t/are-date-indexes-not-allowed-anymore/383941)
**Author:** [@ethrbunny](https://discuss.elastic.co/u/ethrbunny)\ **Replies:** 10\ **Last updated:** [December 11, 2025, 6:31pm UTC](https://discuss.elastic.co/t/are-date-indexes-not-allowed-anymore/383941 "2025-12-11T18:31:56Z")
My indexes are created from a template as ‘name-year.month.date’. It seems that this isn’t acceptable for index-lifecycle-policies anymore. I get this error “index name \[name-2025.12.09\] does not match pattern '^.\*-\\d+$'… --- ## [Is Kibana Canvas in the process of being discontinued?](https://discuss.elastic.co/t/is-kibana-canvas-in-the-process-of-being-discontinued/369912)
**Author:** [@Kevin\_Alexsander1](https://discuss.elastic.co/u/Kevin_Alexsander1)\ **Replies:** 11\ **Last updated:** [December 11, 2025, 6:29pm UTC](https://discuss.elastic.co/t/is-kibana-canvas-in-the-process-of-being-discontinued/369912 "2025-12-11T18:29:10Z")
I saw that there are topics that report bugs regarding Canvas, and it has not received improvements since versions 7.xx. I offer and execute many screen proposals based on Canvas but I asked myself this today, is it wor… --- ## [Agent processor dissect question](https://discuss.elastic.co/t/agent-processor-dissect-question/383995)
**Author:** [@rugenl](https://discuss.elastic.co/u/rugenl)\ **Replies:** 1\ **Last updated:** [December 11, 2025, 5:25pm UTC](https://discuss.elastic.co/t/agent-processor-dissect-question/383995 "2025-12-11T17:25:19Z")
I have an integration using Custom Logs with a processor using this dissect: - dissect: tokenizer: "%{date} %{time} %{action} %{protocol} %{src-ip} %{dst-ip} %{src-port} %{dst-port} %{size} %{tcpflags} %{tcpsyn} %{tc… --- ## [Elasticsearch-reset-password on linux can't accept special characters](https://discuss.elastic.co/t/elasticsearch-reset-password-on-linux-cant-accept-special-characters/383050)
**Author:** [@Ryan\_Clark](https://discuss.elastic.co/u/Ryan_Clark)\ **Replies:** 20\ **Last updated:** [December 11, 2025, 4:50pm UTC](https://discuss.elastic.co/t/elasticsearch-reset-password-on-linux-cant-accept-special-characters/383050 "2025-12-11T16:50:32Z")
When using the elasticsearch password reset tool (elasticsearch-reset-password) in Linux, using a special character will pick up the shell interpretation and not the character itself. In particular, I’m having issues usi… --- ## [Resizing visualization on an existing dashboard after upgrade to 9.2.0 causes page to freeze](https://discuss.elastic.co/t/resizing-visualization-on-an-existing-dashboard-after-upgrade-to-9-2-0-causes-page-to-freeze/383338)
**Author:** [@rcowart](https://discuss.elastic.co/u/rcowart)\ **Replies:** 4\ **Last updated:** [December 11, 2025, 3:56pm UTC](https://discuss.elastic.co/t/resizing-visualization-on-an-existing-dashboard-after-upgrade-to-9-2-0-causes-page-to-freeze/383338 "2025-12-11T15:56:01Z")
After moving to Kibana 9.2.0, anytime we try to resize a visualization on an existing dashboard the page freezes. The tab then has to be closed. This basically means we can’t edit any previously existing dashboards. Has … --- ## [Trouble Running a Second Pipeline in Logstash 8.x (Multiple Pipelines Not Working)](https://discuss.elastic.co/t/trouble-running-a-second-pipeline-in-logstash-8-x-multiple-pipelines-not-working/383956)
**Author:** [@Grzegosz](https://discuss.elastic.co/u/Grzegosz)\ **Replies:** 5\ **Last updated:** [December 11, 2025, 3:36pm UTC](https://discuss.elastic.co/t/trouble-running-a-second-pipeline-in-logstash-8-x-multiple-pipelines-not-working/383956 "2025-12-11T15:36:17Z")
Hello. Please help me understand why the second pipeline in Logstash is not working. I have Logstash 8+ installed. I added a second pipeline path in the pipelines.yml file as follows: - pipeline.id: audit path.config… --- ## [Inquiry about billing for ELK serverless](https://discuss.elastic.co/t/inquiry-about-billing-for-elk-serverless/362993)
**Author:** [@rje287573](https://discuss.elastic.co/u/rje287573)\ **Replies:** 1\ **Last updated:** [December 11, 2025, 7:50am UTC](https://discuss.elastic.co/t/inquiry-about-billing-for-elk-serverless/362993 "2025-12-11T07:50:00Z")
I assumed that using serverless for my project would incur charges based on the time I used it, so I left it without sending any INSERT or SELECT requests. However, I was charged $700 unexpectedly. I completely don't un… --- ## [ILM vs routing for growing vector database with separate clients](https://discuss.elastic.co/t/ilm-vs-routing-for-growing-vector-database-with-separate-clients/383962)
**Author:** [@Pablito77](https://discuss.elastic.co/u/Pablito77)\ **Replies:** 5\ **Last updated:** [December 10, 2025, 5:56pm UTC](https://discuss.elastic.co/t/ilm-vs-routing-for-growing-vector-database-with-separate-clients/383962 "2025-12-10T17:56:39Z")
Hello, I use elasticsearch as a vector db for 1024 dim vectors. My initial setup would be around 20 million vectors, but it may increase to 100 milion vectors over time. However i always prefilter the vector search to a… --- ## [Very strange ingest pipeline problem](https://discuss.elastic.co/t/very-strange-ingest-pipeline-problem/383942)
**Author:** [@rugenl](https://discuss.elastic.co/u/rugenl)\ **Replies:** 5\ **Last updated:** [December 10, 2025, 5:52pm UTC](https://discuss.elastic.co/t/very-strange-ingest-pipeline-problem/383942 "2025-12-10T17:52:31Z")
I have a need to add an ingest pipeline to the elastic-cloud-logs-9 data stream in a cloud-hosted environment running 9.2. It’s not complicated logic, but it’s a little complicated extracting a field from message with 2… --- ## [Migrating from Elastic NEST v7 to .NET Elastic Client v9: Aggregation with Nested clause](https://discuss.elastic.co/t/migrating-from-elastic-nest-v7-to-net-elastic-client-v9-aggregation-with-nested-clause/383958)
**Author:** [@Vadym\_Romanenko](https://discuss.elastic.co/u/Vadym_Romanenko)\ **Replies:** 2\ **Last updated:** [December 10, 2025, 3:22pm UTC](https://discuss.elastic.co/t/migrating-from-elastic-nest-v7-to-net-elastic-client-v9-aggregation-with-nested-clause/383958 "2025-12-10T15:22:45Z")
I’m moving code from the NEST client to the Elasticsearch client v9.2. I’m trying to generate aggregation that contains a nested filter. Here is sample of the old code with NEST: AggregationContainerDescriptor\ ret; … --- ## [Unable to remove Default data view](https://discuss.elastic.co/t/unable-to-remove-default-data-view/383604)
**Author:** [@mittal\_rawal](https://discuss.elastic.co/u/mittal_rawal)\ **Replies:** 6\ **Last updated:** [December 10, 2025, 1:55pm UTC](https://discuss.elastic.co/t/unable-to-remove-default-data-view/383604 "2025-12-10T13:55:25Z")
“I have multiple data views for different dashboards, but the default data view keeps loading even for dashboards where it’s not used. I want to remove the default data view—how can I do that?” ELK stack version: 8.16.1 … --- ## [Will the HLRC client work with Elasticsearch version 9.x](https://discuss.elastic.co/t/will-the-hlrc-client-work-with-elasticsearch-version-9-x/383952)
**Author:** [@Umang\_Pachaury](https://discuss.elastic.co/u/Umang_Pachaury)\ **Replies:** 5\ **Last updated:** [December 10, 2025, 11:23am UTC](https://discuss.elastic.co/t/will-the-hlrc-client-work-with-elasticsearch-version-9-x/383952 "2025-12-10T11:23:33Z")
Hello everyone, We have a large java application which heavily relies on HLRC code. Our current ES version is 8.x As we know that the HLRC client was deprecated with 7.17.x, it currently works with our version 8.x my … --- ## [Inconsistency count observed for term aggregation operation](https://discuss.elastic.co/t/inconsistency-count-observed-for-term-aggregation-operation/383916)
**Author:** [@harshkoshta](https://discuss.elastic.co/u/harshkoshta)\ **Replies:** 7\ **Last updated:** [December 10, 2025, 10:20am UTC](https://discuss.elastic.co/t/inconsistency-count-observed-for-term-aggregation-operation/383916 "2025-12-10T10:20:17Z")
Describe the issue: Inconsistency count observed for term aggregation operation We are applying aggregation on keyword type field (non-nested) our mapping { "mappings": { "dynamic": "strict", "prope… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=24) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=26)