# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=26 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 27 --- ## [Open a point in time API error after Elastic Client upgrade](https://discuss.elastic.co/t/open-a-point-in-time-api-error-after-elastic-client-upgrade/383940)
**Author:** [@tcsbears](https://discuss.elastic.co/u/tcsbears)\ **Replies:** 2\ **Last updated:** [December 10, 2025, 9:48am UTC](https://discuss.elastic.co/t/open-a-point-in-time-api-error-after-elastic-client-upgrade/383940 "2025-12-10T09:48:49Z")
We are upgrading our application from Java 11 → 17 and Spring boot 2.x.x → 3.5.6. Before the upgrade, we used RestHighLevelClient 7.17 and Elasticsearch 7.17 on the server. We replaced RestHighLevelClient with Elastics… --- ## [How can we do elasticsearch and stack migration to new hardware, retaining all old data?](https://discuss.elastic.co/t/how-can-we-do-elasticsearch-and-stack-migration-to-new-hardware-retaining-all-old-data/383950)
**Author:** [@Aditya\_M](https://discuss.elastic.co/u/Aditya_M)\ **Replies:** 1\ **Last updated:** [December 10, 2025, 9:40am UTC](https://discuss.elastic.co/t/how-can-we-do-elasticsearch-and-stack-migration-to-new-hardware-retaining-all-old-data/383950 "2025-12-10T09:40:16Z")
We actually have single node cluster for now. Server is about to expire, so we have to shift this existing stack to new server. But now we dont want to rely on single node cluster, we have 3 new nodes, which will be our … --- ## [Filebeat registry not working for filestream input](https://discuss.elastic.co/t/filebeat-registry-not-working-for-filestream-input/383758)
**Author:** [@Ljapunov](https://discuss.elastic.co/u/Ljapunov)\ **Replies:** 1\ **Last updated:** [December 10, 2025, 8:35am UTC](https://discuss.elastic.co/t/filebeat-registry-not-working-for-filestream-input/383758 "2025-12-10T08:35:36Z")
I found some of the filebeat instances in our production environment resend logfiles and suspected the registry as the root cause. Trying to dig into it I got really confused about the registry, maybe someone can help m… --- ## [Kibana 9.1 Security Rule exception edit not possible](https://discuss.elastic.co/t/kibana-9-1-security-rule-exception-edit-not-possible/382710)
**Author:** [@stanley783](https://discuss.elastic.co/u/stanley783)\ **Replies:** 8\ **Last updated:** [December 10, 2025, 6:25am UTC](https://discuss.elastic.co/t/kibana-9-1-security-rule-exception-edit-not-possible/382710 "2025-12-10T06:25:01Z")
Hey there, since kibana 9.1.0 (i think, we upgraded from 8.17.X to 9.1.3), we are unable to edit exception made under SIEM rules. I cant even edit my own exception. Only possible if I have superuser role which is not des… --- ## [On what version of logstash has fix for issue AIKIDO-2024-10428](https://discuss.elastic.co/t/on-what-version-of-logstash-has-fix-for-issue-aikido-2024-10428/383875)
**Author:** [@Saikiran\_Pulijala](https://discuss.elastic.co/u/Saikiran_Pulijala)\ **Replies:** 2\ **Last updated:** [December 10, 2025, 5:47am UTC](https://discuss.elastic.co/t/on-what-version-of-logstash-has-fix-for-issue-aikido-2024-10428/383875 "2025-12-10T05:47:00Z")
Hello there, Our internal container image scanning tool has flagged a vulnerability related to JRuby’s StringIO library bundled with Logstash 8.19.7. Issue Details A vulnerability was reported in StringIO, where the me… --- ## [Logstash split one JSON document into multiple events](https://discuss.elastic.co/t/logstash-split-one-json-document-into-multiple-events/383935)
**Author:** [@eoszej](https://discuss.elastic.co/u/eoszej)\ **Replies:** 1\ **Last updated:** [December 9, 2025, 8:40pm UTC](https://discuss.elastic.co/t/logstash-split-one-json-document-into-multiple-events/383935 "2025-12-09T20:40:25Z")
Would you please help split a single JSON document being sent to Logstash into multiple events? There are some fields that are shared across the events but the fields that have a trailing number, such as "\_0001", are un… --- ## [TCP output codec json not working in Logstash (data not sending)](https://discuss.elastic.co/t/tcp-output-codec-json-not-working-in-logstash-data-not-sending/383927)
**Author:** [@powary1415](https://discuss.elastic.co/u/powary1415)\ **Replies:** 1\ **Last updated:** [December 9, 2025, 8:08pm UTC](https://discuss.elastic.co/t/tcp-output-codec-json-not-working-in-logstash-data-not-sending/383927 "2025-12-09T20:08:39Z")
Hello Team, I am using Logstash to forward events using the TCP output plugin. When I configure the output with JSON codec, data is not being sent to the receiver. output { tcp { host =\> "hostName" port =\> 1415 cod… --- ## [Filebeat filestream input has inconsistent tag output when using "take\_over"](https://discuss.elastic.co/t/filebeat-filestream-input-has-inconsistent-tag-output-when-using-take-over/383900)
**Author:** [@mike.guthrie](https://discuss.elastic.co/u/mike.guthrie)\ **Replies:** 2\ **Last updated:** [December 9, 2025, 6:17pm UTC](https://discuss.elastic.co/t/filebeat-filestream-input-has-inconsistent-tag-output-when-using-take-over/383900 "2025-12-09T18:17:36Z")
We recently upgraded from beats 7.x and moved to beats 8.x. When we moved from input type of log to filestream, all of our logstash routing broke because the tags are inconsistent in the events. We are using the take\_ove… --- ## [Hypothetical - ingest nodes vs data nodes](https://discuss.elastic.co/t/hypothetical-ingest-nodes-vs-data-nodes/383932)
**Author:** [@rugenl](https://discuss.elastic.co/u/rugenl)\ **Replies:** 3\ **Last updated:** [December 9, 2025, 5:50pm UTC](https://discuss.elastic.co/t/hypothetical-ingest-nodes-vs-data-nodes/383932 "2025-12-09T17:50:47Z")
I got into a design discussion: Is it better to use ingest nodes or direct to data (hot) nodes? One thing that I don’t think I’ve ever seen discussed is this, say we’re ingesting to data nodes, a bulk request will like… --- ## [Elastic 8.10.4](https://discuss.elastic.co/t/elastic-8-10-4/383848)
**Author:** [@jgomezf](https://discuss.elastic.co/u/jgomezf)\ **Replies:** 7\ **Last updated:** [December 9, 2025, 5:32pm UTC](https://discuss.elastic.co/t/elastic-8-10-4/383848 "2025-12-09T17:32:57Z")
Hello. We are working with elastic 8.4.x and the ecs-logstash was working correctly. We have updated the version 8.10..4 and the ecs-logstash and pattern is not found. It's possibility that the version is not available.… --- ## [Logstash elastic integration](https://discuss.elastic.co/t/logstash-elastic-integration/383926)
**Author:** [@CD9820](https://discuss.elastic.co/u/CD9820)\ **Replies:** 3\ **Last updated:** [December 9, 2025, 4:29pm UTC](https://discuss.elastic.co/t/logstash-elastic-integration/383926 "2025-12-09T16:29:54Z")
Hello, I make use of Elastic Fleet. I configured a logstash output for several integrations. The logstash pipeline contains the elastic\_integration filter, so elastic ingest pipelines are also executed by logstash. I a… --- ## [Elasticsearch Snapshots in a Dedicated S3 Bucket (Cross-Region, Multi-Deployment)](https://discuss.elastic.co/t/elasticsearch-snapshots-in-a-dedicated-s3-bucket-cross-region-multi-deployment/383928)
**Author:** [@dr\_sce](https://discuss.elastic.co/u/dr_sce)\ **Replies:** 4\ **Last updated:** [December 9, 2025, 3:52pm UTC](https://discuss.elastic.co/t/elasticsearch-snapshots-in-a-dedicated-s3-bucket-cross-region-multi-deployment/383928 "2025-12-09T15:52:43Z")
Hello I have a question about snapshots in Elasticsearch. We use Elastic Cloud via AWS and want to use a dedicated S3 bucket in another region for snapshots instead of found-snapshots so that we can set up our deployme… --- ## [Output in kibana not expected](https://discuss.elastic.co/t/output-in-kibana-not-expected/383888)
**Author:** [@DOkuwa](https://discuss.elastic.co/u/DOkuwa)\ **Replies:** 10\ **Last updated:** [December 9, 2025, 3:13pm UTC](https://discuss.elastic.co/t/output-in-kibana-not-expected/383888 "2025-12-09T15:13:39Z")
i use filebeat to parse a json file and the expected output is showing all the fields in the different lines and not as one document This the input file { "source": "10.200.10.1:57500", "subscription-name": "defau… --- ## [Filebeat occasionally loses logs: Dropping event: no topic could be selected (Kubernetes + Kafka)](https://discuss.elastic.co/t/filebeat-occasionally-loses-logs-dropping-event-no-topic-could-be-selected-kubernetes-kafka/383685)
**Author:** [@ruizengyang](https://discuss.elastic.co/u/ruizengyang)\ **Replies:** 9\ **Last updated:** [December 8, 2025, 4:01pm UTC](https://discuss.elastic.co/t/filebeat-occasionally-loses-logs-dropping-event-no-topic-could-be-selected-kubernetes-kafka/383685 "2025-12-08T16:01:51Z")
Hi everyone, I’ve been troubleshooting an issue for the last few days and would like to confirm whether this behavior is expected or if there is a workaround. Problem When Filebeat starts on a Kubernetes node (DaemonS… --- ## [Logstash 8.9.0: How to match messages containing words starting with "sap" (e.g., sapxxx) using a filter?](https://discuss.elastic.co/t/logstash-8-9-0-how-to-match-messages-containing-words-starting-with-sap-e-g-sapxxx-using-a-filter/383889)
**Author:** [@Pan\_Vad](https://discuss.elastic.co/u/Pan_Vad)\ **Replies:** 11\ **Last updated:** [December 8, 2025, 1:18pm UTC](https://discuss.elastic.co/t/logstash-8-9-0-how-to-match-messages-containing-words-starting-with-sap-e-g-sapxxx-using-a-filter/383889 "2025-12-08T13:18:45Z")
Could you please help me with a Logstash filter pipeline configuration that can catch messages of the following type: \<30\>Dec 5 15:01:05 saphcmdevdb systemd\[1\]: snapperd.service: Deactivated successfully. I need to d… --- ## [Can I sort a sematic query based on a field containing a value or not?](https://discuss.elastic.co/t/can-i-sort-a-sematic-query-based-on-a-field-containing-a-value-or-not/383906)
**Author:** [@bwagner](https://discuss.elastic.co/u/bwagner)\ **Replies:** 1\ **Last updated:** [December 6, 2025, 11:37am UTC](https://discuss.elastic.co/t/can-i-sort-a-sematic-query-based-on-a-field-containing-a-value-or-not/383906 "2025-12-06T11:37:19Z")
I am new to elastic an Elasticsearch and I guess this is a fairly simple, beginner type quesation. I have an index that contains information from websites and pdf documents. The index is used in a chat bot on an a websi… --- ## [Upgrade agent on Fleet server](https://discuss.elastic.co/t/upgrade-agent-on-fleet-server/383902)
**Author:** [@kernelpanic](https://discuss.elastic.co/u/kernelpanic)\ **Replies:** 1\ **Last updated:** [December 5, 2025, 6:55pm UTC](https://discuss.elastic.co/t/upgrade-agent-on-fleet-server/383902 "2025-12-05T18:55:19Z")
Hello, I’ve successfully updated most of the Elasticsearch stack to the latest version 9.2.2 I’m having difficulty understanding how I upgrade the agent on the Fleet server; I can’t update the agent from the Fleet secti… --- ## [Kafka output gets permanently stuck after temporary wrong port — pipeline-to-pipeline address unavailable & retrying\_send stall](https://discuss.elastic.co/t/kafka-output-gets-permanently-stuck-after-temporary-wrong-port-pipeline-to-pipeline-address-unavailable-retrying-send-stall/383877)
**Author:** [@Mahesh\_Kumar1](https://discuss.elastic.co/u/Mahesh_Kumar1)\ **Replies:** 5\ **Last updated:** [December 5, 2025, 5:32pm UTC](https://discuss.elastic.co/t/kafka-output-gets-permanently-stuck-after-temporary-wrong-port-pipeline-to-pipeline-address-unavailable-retrying-send-stall/383877 "2025-12-05T17:32:58Z")
Kafka output gets permanently stuck after temporary wrong port — pipeline-to-pipeline address unavailable & retrying\_send stall Hi, I am facing an issue with Logstash Kafka output when the Kafka broker becomes temporari… --- ## [How to add labels to sql span?](https://discuss.elastic.co/t/how-to-add-labels-to-sql-span/383901)
**Author:** [@VictoRK](https://discuss.elastic.co/u/VictoRK)\ **Replies:** 0\ **Last updated:** [December 5, 2025, 5:02pm UTC](https://discuss.elastic.co/t/how-to-add-labels-to-sql-span/383901 "2025-12-05T17:02:55Z")
I need to add labels to my autogenerated sql span details in my .NET Web Application. My agent is started in global.asax and i have the following code: Dim AgentComponents = ElasticApmModule.CreateAgentComponents() Ag… --- ## [Index pattern](https://discuss.elastic.co/t/index-pattern/383849)
**Author:** [@jgomezf](https://discuss.elastic.co/u/jgomezf)\ **Replies:** 4\ **Last updated:** [December 4, 2025, 11:11pm UTC](https://discuss.elastic.co/t/index-pattern/383849 "2025-12-04T23:11:16Z")
We have worked with the version elastic 8.4.10 and we cannot delete old index through curl delete https:localhost:9200/indices/ds.logsxxx{yesterday}\*. Do you have any idea as delete old index through scripts Thanks --- ## [Elastic Agent memory consumption](https://discuss.elastic.co/t/elastic-agent-memory-consumption/383034)
**Author:** [@mike123](https://discuss.elastic.co/u/mike123)\ **Replies:** 3\ **Last updated:** [December 4, 2025, 7:02pm UTC](https://discuss.elastic.co/t/elastic-agent-memory-consumption/383034 "2025-12-04T19:02:49Z")
Is there any ways to limit the memory used by elastic-agent. Elastic Agent and Endpoint are consuming around 2GB memory. This is too high for a tool like elastic agent. Any help/tips for reducing memory usage is highly a… --- ## [Kibana 9.1.4 on Windows fails to start due to Timelion plugin: Cannot find module '../series\_functions/undefined'](https://discuss.elastic.co/t/kibana-9-1-4-on-windows-fails-to-start-due-to-timelion-plugin-cannot-find-module-series-functions-undefined/382144)
**Author:** [@kevin\_wang2](https://discuss.elastic.co/u/kevin_wang2)\ **Replies:** 17\ **Last updated:** [December 4, 2025, 6:19pm UTC](https://discuss.elastic.co/t/kibana-9-1-4-on-windows-fails-to-start-due-to-timelion-plugin-cannot-find-module-series-functions-undefined/382144 "2025-12-04T18:19:37Z")
Hi team, I’m hitting a fatal startup crash on Kibana 9.1.4 (Windows x64) where the Timelion plugin fails while loading its server-side functions. The process reaches preboot, then shuts down with: \[2025-09-23T10:04:14.… --- ## [Debian 13 and Beats 8.x](https://discuss.elastic.co/t/debian-13-and-beats-8-x/383870)
**Author:** [@d3jolly](https://discuss.elastic.co/u/d3jolly)\ **Replies:** 1\ **Last updated:** [December 4, 2025, 5:50pm UTC](https://discuss.elastic.co/t/debian-13-and-beats-8-x/383870 "2025-12-04T17:50:40Z")
Hi, According to the Support Matrix, Beats on Debian 13 (at least Filebeat and Metricbeat, since e.g. Auditbeat doesn’t list anything past Debian 10) should be v9.2.x Potential issues when running unofficially supporte… --- ## [Pending tasks accumulating with ES 8.17.3](https://discuss.elastic.co/t/pending-tasks-accumulating-with-es-8-17-3/383850)
**Author:** [@Phil\_Budne](https://discuss.elastic.co/u/Phil_Budne)\ **Replies:** 1\ **Last updated:** [December 4, 2025, 1:27pm UTC](https://discuss.elastic.co/t/pending-tasks-accumulating-with-es-8-17-3/383850 "2025-12-04T13:27:41Z")
We’ve seen this before, and has cleared up after the master nodes (self?) restarted ES: $ curl http://es.newsscribe.angwin:9209/ { "name" : "es02.newsscribe.angwin", "cluster\_name" : "mc\_es\_cluster", "cluster\_uuid… --- ## [Elasticsearch Integration Dashboard Data not Loading](https://discuss.elastic.co/t/elasticsearch-integration-dashboard-data-not-loading/383747)
**Author:** [@YousefNein](https://discuss.elastic.co/u/YousefNein)\ **Replies:** 4\ **Last updated:** [December 4, 2025, 12:57pm UTC](https://discuss.elastic.co/t/elasticsearch-integration-dashboard-data-not-loading/383747 "2025-12-04T12:57:42Z")
I have the Elasticsearch integration in Fleet enabled with metrics and logs; however, the dashboard isn’t loading due to several errors related to some fields not being present --- ## [Is \_refresh the same as internal periodic refresh?](https://discuss.elastic.co/t/is-refresh-the-same-as-internal-periodic-refresh/383858)
**Author:** [@Mo\_B](https://discuss.elastic.co/u/Mo_B)\ **Replies:** 2\ **Last updated:** [December 4, 2025, 9:05am UTC](https://discuss.elastic.co/t/is-refresh-the-same-as-internal-periodic-refresh/383858 "2025-12-04T09:05:17Z")
The documentation says that \_refresh is resource-intensive. But does calling \_refresh on an index have the same impact and cost as the automatic periodic refresh that is configurable via index.refresh\_interval? Is it pe… --- ## [How to get kafka metadata from a confluent kafka topic](https://discuss.elastic.co/t/how-to-get-kafka-metadata-from-a-confluent-kafka-topic/383844)
**Author:** [@venkatkumar229](https://discuss.elastic.co/u/venkatkumar229)\ **Replies:** 2\ **Last updated:** [December 4, 2025, 5:35am UTC](https://discuss.elastic.co/t/how-to-get-kafka-metadata-from-a-confluent-kafka-topic/383844 "2025-12-04T05:35:20Z")
Hi, I am reading the data using logstash from a confluent kafka topic and I am trying to get the complete kafka metadata including header etc into my data. I have tried the below config but still i am unable to see the … --- ## [Supporting private channels and direct messages documents from slack](https://discuss.elastic.co/t/supporting-private-channels-and-direct-messages-documents-from-slack/383830)
**Author:** [@kenseii](https://discuss.elastic.co/u/kenseii)\ **Replies:** 2\ **Last updated:** [December 4, 2025, 12:59am UTC](https://discuss.elastic.co/t/supporting-private-channels-and-direct-messages-documents-from-slack/383830 "2025-12-04T00:59:03Z")
Hello, The current slack connector does not support reading documents from private channels and direct messages when crawling the data into elastic. Elastic Slack connector reference | Reference Is there a plan to prov… --- ## [Checking if updated documents are visible to search](https://discuss.elastic.co/t/checking-if-updated-documents-are-visible-to-search/383843)
**Author:** [@Mo\_B](https://discuss.elastic.co/u/Mo_B)\ **Replies:** 6\ **Last updated:** [December 3, 2025, 10:17pm UTC](https://discuss.elastic.co/t/checking-if-updated-documents-are-visible-to-search/383843 "2025-12-03T22:17:19Z")
Given a set of recently updated documents (indexed without waiting for refresh), is there a way to check if they have been refreshed, or to wait until they have been refreshed (without calling \_refresh)? Waiting for x … --- ## [Recall Stage vs LTR: am I duplicating logic or losing good results in Elasticsearch?](https://discuss.elastic.co/t/recall-stage-vs-ltr-am-i-duplicating-logic-or-losing-good-results-in-elasticsearch/383630)
**Author:** [@Shell\_Dias](https://discuss.elastic.co/u/Shell_Dias)\ **Replies:** 1\ **Last updated:** [December 3, 2025, 8:04pm UTC](https://discuss.elastic.co/t/recall-stage-vs-ltr-am-i-duplicating-logic-or-losing-good-results-in-elasticsearch/383630 "2025-12-03T20:04:40Z")
Hey folks, I’m building a search pipeline using Elasticsearch + Vector Search + LTR, and I’ve hit a conceptual conflict. Classic pipeline: Recall (BM25 / Vector / Hybrid) LTR (rerank top-K) Pagination All g… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=25) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=27)