# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=267 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 268 --- ## [No result found error on transaction logs, audit event and error logs](https://discuss.elastic.co/t/no-result-found-error-on-transaction-logs-audit-event-and-error-logs/357052)
**Author:** [@Gopikrishna\_Panduran](https://discuss.elastic.co/u/Gopikrishna_Panduran)\ **Replies:** 0\ **Last updated:** [April 9, 2024, 9:56am UTC](https://discuss.elastic.co/t/no-result-found-error-on-transaction-logs-audit-event-and-error-logs/357052 "2024-04-09T09:56:27Z")
i have integrated sql on elastic cloud but, no result found on transaction logs, audit event and error logs --- ## [Socket exception with connection reset on Elasticsearch Webhook to Microsoft Teams](https://discuss.elastic.co/t/socket-exception-with-connection-reset-on-elasticsearch-webhook-to-microsoft-teams/357051)
**Author:** [@Dragan\_Fazekas](https://discuss.elastic.co/u/Dragan_Fazekas)\ **Replies:** 0\ **Last updated:** [April 9, 2024, 9:56am UTC](https://discuss.elastic.co/t/socket-exception-with-connection-reset-on-elasticsearch-webhook-to-microsoft-teams/357051 "2024-04-09T09:56:16Z")
I'm seeking assistance regarding an issue I'm encountering with an Elasticsearch watcher webhooks action specifically the "TeamsPost". The problem occurs when my application attempts to send a webhook to Microsoft Teams … --- ## [Search query failed within the elasticsearch cluster](https://discuss.elastic.co/t/search-query-failed-within-the-elasticsearch-cluster/357044)
**Author:** [@wite](https://discuss.elastic.co/u/wite)\ **Replies:** 0\ **Last updated:** [April 9, 2024, 9:34am UTC](https://discuss.elastic.co/t/search-query-failed-within-the-elasticsearch-cluster/357044 "2024-04-09T09:34:22Z")
Hello, I had my elastic instance running fine in my security onion deployment but for some reason am getting the "search query failure within the elasticsearch cluster" and when i check GET /\_cat/health?v on the dev cons… --- ## [How to add new language to Kibana web interface?](https://discuss.elastic.co/t/how-to-add-new-language-to-kibana-web-interface/356713)
**Author:** [@belutak](https://discuss.elastic.co/u/belutak)\ **Replies:** 2\ **Last updated:** [April 9, 2024, 8:43am UTC](https://discuss.elastic.co/t/how-to-add-new-language-to-kibana-web-interface/356713 "2024-04-09T08:43:20Z")
I would like to change Kibana web user interface to be in language that does not exist(as default kibana option), i found by default cn and jp, but there is no en in there so i am wondering if anyone knows how could i fi… --- ## [Multi index search, with kNN on one index](https://discuss.elastic.co/t/multi-index-search-with-knn-on-one-index/357040)
**Author:** [@Nick\_Dart](https://discuss.elastic.co/u/Nick_Dart)\ **Replies:** 0\ **Last updated:** [April 9, 2024, 8:31am UTC](https://discuss.elastic.co/t/multi-index-search-with-knn-on-one-index/357040 "2024-04-09T08:31:26Z")
I have two indices, one with users and one with user posts. I want to search both indices simultaneously, and rank them. As part of this search, i want to do a kNN search as well as a standard text search. However, the k… --- ## [Even when async translog is enabled, can having replicas greater than or equal to 1 ensure that data is not lost?](https://discuss.elastic.co/t/even-when-async-translog-is-enabled-can-having-replicas-greater-than-or-equal-to-1-ensure-that-data-is-not-lost/356973)
**Author:** [@wangxr1985](https://discuss.elastic.co/u/wangxr1985)\ **Replies:** 3\ **Last updated:** [April 9, 2024, 8:25am UTC](https://discuss.elastic.co/t/even-when-async-translog-is-enabled-can-having-replicas-greater-than-or-equal-to-1-ensure-that-data-is-not-lost/356973 "2024-04-09T08:25:37Z")
My understanding is as follows: User requests are first sent to the primary shard, then synchronized to all replica shards. After all shards complete the write operation, Elasticsearch returns success to the user. If a… --- ## [Elasticsearch 8.5.2 SLM Exclude index and datastream does not work](https://discuss.elastic.co/t/elasticsearch-8-5-2-slm-exclude-index-and-datastream-does-not-work/357029)
**Author:** [@Gautier\_Franchini](https://discuss.elastic.co/u/Gautier_Franchini)\ **Replies:** 3\ **Last updated:** [April 9, 2024, 8:09am UTC](https://discuss.elastic.co/t/elasticsearch-8-5-2-slm-exclude-index-and-datastream-does-not-work/357029 "2024-04-09T08:09:01Z")
Dear community members, using SLM policy I would like to exclue some indices and datastream from y daily backup; using the policy below doesn't gives me any ERROR ; but it's NOT applied as expected; Because doing a 'GET … --- ## [Https://localhost:5601/api/status fails: fail to execute the HTTP GET request: Get \\"https://localhost:5601/api/status\\": x509: certificate signed by unknown authority (status=0)](https://discuss.elastic.co/t/https-localhost-5601-api-status-fails-fail-to-execute-the-http-get-request-get-https-localhost-5601-api-status-x509-certificate-signed-by-unknown-authority-status-0/357038)
**Author:** [@Frances\_Chu](https://discuss.elastic.co/u/Frances_Chu)\ **Replies:** 0\ **Last updated:** [April 9, 2024, 7:33am UTC](https://discuss.elastic.co/t/https-localhost-5601-api-status-fails-fail-to-execute-the-http-get-request-get-https-localhost-5601-api-status-x509-certificate-signed-by-unknown-authority-status-0/357038 "2024-04-09T07:33:20Z")
fail to start metricbeat with the error message https://localhost:5601/api/status fails: fail to execute the HTTP GET request: Get "https://localhost:5601/api/status\\": x509: certificate signed by unknown authority (sta… --- ## [TRACE Logs](https://discuss.elastic.co/t/trace-logs/357036)
**Author:** [@Abhishek\_Sinha](https://discuss.elastic.co/u/Abhishek_Sinha)\ **Replies:** 0\ **Last updated:** [April 9, 2024, 7:03am UTC](https://discuss.elastic.co/t/trace-logs/357036 "2024-04-09T07:03:48Z")
@dadoonet Getting the trace logs every time I hit any request internally inside my project. The issue came when I added solr dependency in my project : 'org.apache.solr', name: 'solr-solrj', version: '9.4.1' These are… --- ## [Vector Search in ElasticSearch + Filtering using other fields](https://discuss.elastic.co/t/vector-search-in-elasticsearch-filtering-using-other-fields/356032)
**Author:** [@anuj99](https://discuss.elastic.co/u/anuj99)\ **Replies:** 3\ **Last updated:** [April 9, 2024, 6:41am UTC](https://discuss.elastic.co/t/vector-search-in-elasticsearch-filtering-using-other-fields/356032 "2024-04-09T06:41:54Z")
Following is the use case: I am storing vectors and meta data for a document in a single index. However, if there is any change in the vector, I also need to fetch the meta data and then update the document in the index… --- ## [Using rally with a managed elastic deployment](https://discuss.elastic.co/t/using-rally-with-a-managed-elastic-deployment/356012)
**Author:** [@cvarano](https://discuss.elastic.co/u/cvarano)\ **Replies:** 2\ **Last updated:** [April 8, 2024, 9:29pm UTC](https://discuss.elastic.co/t/using-rally-with-a-managed-elastic-deployment/356012 "2024-04-08T21:29:42Z")
We have a deployment in Elastic cloud running Elasticsearch, but I don't see in the Rally docs how to point to or auth Elastic-managed deployments; I only see local ES setup and ES Serverless setup. Any guidance appreci… --- ## [How do you connect fleet server?](https://discuss.elastic.co/t/how-do-you-connect-fleet-server/356929)
**Author:** [@Firehaven](https://discuss.elastic.co/u/Firehaven)\ **Replies:** 1\ **Last updated:** [April 8, 2024, 3:58pm UTC](https://discuss.elastic.co/t/how-do-you-connect-fleet-server/356929 "2024-04-08T15:58:16Z")
I have tried everything under the sun and I have no more ideas. I have watched every YT video you can. I added XXXX to represent the hyper text transfer protocol because it thought I was posting links. The topology: 3… --- ## [Triggering Logstash Input](https://discuss.elastic.co/t/triggering-logstash-input/356889)
**Author:** [@erikg](https://discuss.elastic.co/u/erikg)\ **Replies:** 4\ **Last updated:** [April 8, 2024, 5:57pm UTC](https://discuss.elastic.co/t/triggering-logstash-input/356889 "2024-04-08T17:57:53Z")
Hello I am wondering, if there can be a way to allow Logstash input to be triggered by user? Like for example, I am polling SNMP or HTTP API, and the pollers are set up at their own schedule but if a user wants to inita… --- ## [Unable to start filebeat on server 2008 r2](https://discuss.elastic.co/t/unable-to-start-filebeat-on-server-2008-r2/357007)
**Author:** [@frank543](https://discuss.elastic.co/u/frank543)\ **Replies:** 0\ **Last updated:** [April 8, 2024, 5:53pm UTC](https://discuss.elastic.co/t/unable-to-start-filebeat-on-server-2008-r2/357007 "2024-04-08T17:53:54Z")
I am having trouble starting filebeat on my server 2008 r2. I have uninstalled and reinstalled filebeat to ensure a fresh and clean installation. When i try to start the service i get. Windows could not start the filebe… --- ## [What is an easy way to convert an index to an alias that gets rolled over by ILM?](https://discuss.elastic.co/t/what-is-an-easy-way-to-convert-an-index-to-an-alias-that-gets-rolled-over-by-ilm/356926)
**Author:** [@jerrac](https://discuss.elastic.co/u/jerrac)\ **Replies:** 2\ **Last updated:** [April 8, 2024, 5:39pm UTC](https://discuss.elastic.co/t/what-is-an-easy-way-to-convert-an-index-to-an-alias-that-gets-rolled-over-by-ilm/356926 "2024-04-08T17:39:39Z")
So, during maintenance Friday evening I found that one of my indexes is well over 300-400GB in size and is using up most of my disk space. I had messed up the configuration of the index/alias I have Filebeat pointed at.… --- ## [Time column it's different than @timestamp field in kibana](https://discuss.elastic.co/t/time-column-its-different-than-timestamp-field-in-kibana/356954)
**Author:** [@Fateme\_Alizade](https://discuss.elastic.co/u/Fateme_Alizade)\ **Replies:** 3\ **Last updated:** [April 8, 2024, 4:54pm UTC](https://discuss.elastic.co/t/time-column-its-different-than-timestamp-field-in-kibana/356954 "2024-04-08T16:54:51Z")
Hey guys! I have troubling with time stuff in kibana and logstash I have a filter pattern for my syslogs which its timestamp it's different than time column in kibana( My logs are shown in kibana 3 hours later ) he… --- ## [ElasticSearch billing in Azure](https://discuss.elastic.co/t/elasticsearch-billing-in-azure/356971)
**Author:** [@ShubhamSaxena8](https://discuss.elastic.co/u/ShubhamSaxena8)\ **Replies:** 1\ **Last updated:** [April 8, 2024, 3:16pm UTC](https://discuss.elastic.co/t/elasticsearch-billing-in-azure/356971 "2024-04-08T15:16:42Z")
Hello Team, Can anyone explain me how much will it cost monthly if I use Azure elasticsearch service? I want to use the basic license but I guess we need to atleast subscribe STANDARD version in that service. Our team… --- ## [Canvas - One time filter for all charts](https://discuss.elastic.co/t/canvas-one-time-filter-for-all-charts/356399)
**Author:** [@marcowiskhy](https://discuss.elastic.co/u/marcowiskhy)\ **Replies:** 1\ **Last updated:** [April 8, 2024, 3:47pm UTC](https://discuss.elastic.co/t/canvas-one-time-filter-for-all-charts/356399 "2024-04-08T15:47:35Z")
Hello everyone, I'm new to canvas and I would like to make a report with some indicators, but I have a question. I would need to have a one date/time filter that applies to all charts on the workpad, that is, if I change… --- ## [Passing parameters through markdown text](https://discuss.elastic.co/t/passing-parameters-through-markdown-text/356770)
**Author:** [@SamehSaeed](https://discuss.elastic.co/u/SamehSaeed)\ **Replies:** 1\ **Last updated:** [April 8, 2024, 3:15pm UTC](https://discuss.elastic.co/t/passing-parameters-through-markdown-text/356770 "2024-04-08T15:15:19Z")
Hello, I have 2 panels (saved search from discover) in 2 separate dashboards. I created a panel to navigate between the 2 dashboards, both panels have a column that holds mobile number but they are from 2 different data… --- ## [Error no pem block while enrolling the Fleet Server with encrypted private Key](https://discuss.elastic.co/t/error-no-pem-block-while-enrolling-the-fleet-server-with-encrypted-private-key/356988)
**Author:** [@madra](https://discuss.elastic.co/u/madra)\ **Replies:** 0\ **Last updated:** [April 8, 2024, 3:11pm UTC](https://discuss.elastic.co/t/error-no-pem-block-while-enrolling-the-fleet-server-with-encrypted-private-key/356988 "2024-04-08T15:11:47Z")
hello, We are getting the following error while enrolling the fleet Server: " "message":"Fleet Server - Error - 1 error: no PEM blocks" elastic-agent enroll --force \\ --fleet-server-es="https:elasticsearch\_node… --- ## [Processor working on global level but not on individual](https://discuss.elastic.co/t/processor-working-on-global-level-but-not-on-individual/356966)
**Author:** [@Alexander\_Chernov](https://discuss.elastic.co/u/Alexander_Chernov)\ **Replies:** 1\ **Last updated:** [April 8, 2024, 3:10pm UTC](https://discuss.elastic.co/t/processor-working-on-global-level-but-not-on-individual/356966 "2024-04-08T15:10:45Z")
Hi, I am trying to make the processor work on the individual input level, but it looks like it works only on condition that it's defined globally. Not working #https://github.com/kdryetyln/ELK-with-ECK-Operator/blob/m… --- ## [Do we have any direct api to create watchers in specific space?](https://discuss.elastic.co/t/do-we-have-any-direct-api-to-create-watchers-in-specific-space/356642)
**Author:** [@surya\_dadi\_dhamarake](https://discuss.elastic.co/u/surya_dadi_dhamarake)\ **Replies:** 1\ **Last updated:** [April 8, 2024, 3:06pm UTC](https://discuss.elastic.co/t/do-we-have-any-direct-api-to-create-watchers-in-specific-space/356642 "2024-04-08T15:06:38Z")
Hi Team, I am planning to create watcher automatically using APIs. We have multiple spaces for multiple teams so we don't want to create watchers in default space. Can any one please guide me how I can create watcher in… --- ## [Aggregation that includes non-matching items](https://discuss.elastic.co/t/aggregation-that-includes-non-matching-items/356986)
**Author:** [@mschoettl](https://discuss.elastic.co/u/mschoettl)\ **Replies:** 0\ **Last updated:** [April 8, 2024, 3:02pm UTC](https://discuss.elastic.co/t/aggregation-that-includes-non-matching-items/356986 "2024-04-08T15:02:06Z")
Hi, we use Elasticsearch to drive an ecommerce shop. The index consists of products, let's assume there are 100 products there is a field called "color". 50 products have the color red and 50 products have the color blu… --- ## [How to configure kafka with kraft with metricbeat 8.12](https://discuss.elastic.co/t/how-to-configure-kafka-with-kraft-with-metricbeat-8-12/356979)
**Author:** [@kriti\_dabas](https://discuss.elastic.co/u/kriti_dabas)\ **Replies:** 0\ **Last updated:** [April 8, 2024, 1:57pm UTC](https://discuss.elastic.co/t/how-to-configure-kafka-with-kraft-with-metricbeat-8-12/356979 "2024-04-08T13:57:43Z")
I have a cluster of three nodes for kafka with kraft with a running cluster of elasticsearch on others 7 nodes with 2 logstash and one kibana. I want to monitor the topics/partitions/replicas/consumergroups/brokers of … --- ## [Kubernetes dashbords are not showing any metrics](https://discuss.elastic.co/t/kubernetes-dashbords-are-not-showing-any-metrics/356799)
**Author:** [@sichi](https://discuss.elastic.co/u/sichi)\ **Replies:** 0\ **Last updated:** [April 4, 2024, 4:24pm UTC](https://discuss.elastic.co/t/kubernetes-dashbords-are-not-showing-any-metrics/356799 "2024-04-04T16:24:14Z")
Hello there' I'm a newbie to elasticsearch. I have a k8s cluster which I want to monitor through the fleet integration. I have the elk with fleet established. I have elastic-agent running on my nodes as linux agent and … --- ## [How to compile Kibana?](https://discuss.elastic.co/t/how-to-compile-kibana/356811)
**Author:** [@belutak](https://discuss.elastic.co/u/belutak)\ **Replies:** 1\ **Last updated:** [April 8, 2024, 1:55pm UTC](https://discuss.elastic.co/t/how-to-compile-kibana/356811 "2024-04-08T13:55:27Z")
I downloaded Kibana 7.16 from GitLab, but the old instructions that were supposed to compile it seem not to be working. The command "yarn kbn --bootstrap" just gives an error that kbn does not exist, and the rest of the … --- ## [Can interleaved distribution of index shards prevent high load on one index from affecting other indexes?](https://discuss.elastic.co/t/can-interleaved-distribution-of-index-shards-prevent-high-load-on-one-index-from-affecting-other-indexes/356978)
**Author:** [@wangxr1985](https://discuss.elastic.co/u/wangxr1985)\ **Replies:** 0\ **Last updated:** [April 8, 2024, 1:44pm UTC](https://discuss.elastic.co/t/can-interleaved-distribution-of-index-shards-prevent-high-load-on-one-index-from-affecting-other-indexes/356978 "2024-04-08T13:44:46Z")
Suppose I have three nodes A, B, C and three indexes index1, index2, index3, each with one primary shard and one replica shard. If I distribute the shards as follows: A index1,index2 B index2,index3 C index3,index1 I… --- ## [Documentation states that clean\_removed should be false when close\_removed = false. Why?](https://discuss.elastic.co/t/documentation-states-that-clean-removed-should-be-false-when-close-removed-false-why/356977)
**Author:** [@jeanpaul1977](https://discuss.elastic.co/u/jeanpaul1977)\ **Replies:** 0\ **Last updated:** [April 8, 2024, 1:43pm UTC](https://discuss.elastic.co/t/documentation-states-that-clean-removed-should-be-false-when-close-removed-false-why/356977 "2024-04-08T13:43:06Z")
In the documentation is stated that clean\_removed should be set to false when clean\_removed is set to false. See: Log input | Filebeat Reference \[8.13\] | Elastic. Can someone explain why this is needed? We have issues… --- ## [How can I use ILM with elasticsearch-oss:7.9.3?](https://discuss.elastic.co/t/how-can-i-use-ilm-with-elasticsearch-oss-7-9-3/356829)
**Author:** [@inguemom76](https://discuss.elastic.co/u/inguemom76)\ **Replies:** 3\ **Last updated:** [April 8, 2024, 11:53am UTC](https://discuss.elastic.co/t/how-can-i-use-ilm-with-elasticsearch-oss-7-9-3/356829 "2024-04-08T11:53:32Z")
Hello Team, I am using elasticsearch-oss:7.9.3. But I want to add ILM policy for delete policy but \_idm index is not found in DB so push command is failed. I just wanted to know, If I wanted to use idm policy in ELK… --- ## [Increasing load on indices without any change in the database records](https://discuss.elastic.co/t/increasing-load-on-indices-without-any-change-in-the-database-records/356960)
**Author:** [@abhinavtyagi](https://discuss.elastic.co/u/abhinavtyagi)\ **Replies:** 0\ **Last updated:** [April 8, 2024, 10:59am UTC](https://discuss.elastic.co/t/increasing-load-on-indices-without-any-change-in-the-database-records/356960 "2024-04-08T10:59:53Z")
Hello, I am a newbie and I tried syncing Elasticsearch with MySQL database (two tables from my database). Even they are synced I am facing some issues as described below: Code: base.conf: input { jdbc { jdbc\_dri… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=266) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=268)