# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=27 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 28 --- ## [How can I delay HNSW index construction until a segment reaches a target size?](https://discuss.elastic.co/t/how-can-i-delay-hnsw-index-construction-until-a-segment-reaches-a-target-size/383826)
**Author:** [@sfmqrb](https://discuss.elastic.co/u/sfmqrb)\ **Replies:** 1\ **Last updated:** [December 3, 2025, 7:38pm UTC](https://discuss.elastic.co/t/how-can-i-delay-hnsw-index-construction-until-a-segment-reaches-a-target-size/383826 "2025-12-03T19:38:50Z")
I’m trying to tune vector indexing behavior. Specifically, I want the first HNSW index for a segment to be built only after the segment reaches a certain size (e.g., X MB or Y vectors), instead of building small HNSW gra… --- ## [Collector \[cluster\_stats\] timed out when collecting data](https://discuss.elastic.co/t/collector-cluster-stats-timed-out-when-collecting-data/383847)
**Author:** [@zahojianxin](https://discuss.elastic.co/u/zahojianxin)\ **Replies:** 1\ **Last updated:** [December 3, 2025, 7:12pm UTC](https://discuss.elastic.co/t/collector-cluster-stats-timed-out-when-collecting-data/383847 "2025-12-03T19:12:28Z")
\[2025-12-03T12:21:35,854\]\[ERROR\]\[o.e.x.m.c.c.ClusterStatsCollector\] \[YZH-SC-ILMS-ES1\] collector \[cluster\_stats\] timed out when collecting data \[2025-12-03T12:21:57,037\]\[ERROR\]\[o.e.x.m.c.c.ClusterStatsCollector\] \[YZH-SC-… --- ## [Recommendations for LLM nodes sizing](https://discuss.elastic.co/t/recommendations-for-llm-nodes-sizing/383813)
**Author:** [@michael-a](https://discuss.elastic.co/u/michael-a)\ **Replies:** 6\ **Last updated:** [December 3, 2025, 2:04pm UTC](https://discuss.elastic.co/t/recommendations-for-llm-nodes-sizing/383813 "2025-12-03T14:04:50Z")
We’re about to implement our first LLM node (on Kubernetes) but haven’t been able to find current recommendations when it comes to sizing it. Are there any general rules we can apply based on number of events, log size e… --- ## [X509: certificate signed by unknown authority , elastic agent + Tenable SC](https://discuss.elastic.co/t/x509-certificate-signed-by-unknown-authority-elastic-agent-tenable-sc/383835)
**Author:** [@Alaeddine\_khadraoui](https://discuss.elastic.co/u/Alaeddine_khadraoui)\ **Replies:** 3\ **Last updated:** [December 3, 2025, 11:31am UTC](https://discuss.elastic.co/t/x509-certificate-signed-by-unknown-authority-elastic-agent-tenable-sc/383835 "2025-12-03T11:31:39Z")
dear elastic community Im working on integrating Tenable Security Center via elastic agent , and getting x509: certificate signed by unknown , can please advise what actions to check also if the certificate signed by u… --- ## [Filebeat 9.2.1multiline pattern not grouping MariaDB slow query logs](https://discuss.elastic.co/t/filebeat-9-2-1multiline-pattern-not-grouping-mariadb-slow-query-logs/383643)
**Author:** [@Amanuel\_Genetu](https://discuss.elastic.co/u/Amanuel_Genetu)\ **Replies:** 2\ **Last updated:** [December 3, 2025, 10:36am UTC](https://discuss.elastic.co/t/filebeat-9-2-1multiline-pattern-not-grouping-mariadb-slow-query-logs/383643 "2025-12-03T10:36:40Z")
I am trying to collect MariaDB slow query logs with Filebeat and group each query as a single event. My logs look like this: SET timestamp=1764062324; SELECT TABLE\_NAME FROM information\_schema.TABLES WHERE TABLE\_SCHE… --- ## [Migrating from beats to the agent - best approach?](https://discuss.elastic.co/t/migrating-from-beats-to-the-agent-best-approach/383822)
**Author:** [@rex656](https://discuss.elastic.co/u/rex656)\ **Replies:** 1\ **Last updated:** [December 2, 2025, 8:38pm UTC](https://discuss.elastic.co/t/migrating-from-beats-to-the-agent-best-approach/383822 "2025-12-02T20:38:27Z")
Greetings! I am somewhat new to Elasticsearch and have been tasked with migrating from beats to the Elastic agent. We just finished migrating to Elastic cloud so this is the next thing we want to tackle to modernize. Fo… --- ## [Elasticsearch indexing\_pressure.memory.limit](https://discuss.elastic.co/t/elasticsearch-indexing-pressure-memory-limit/383670)
**Author:** [@ee99](https://discuss.elastic.co/u/ee99)\ **Replies:** 15\ **Last updated:** [December 2, 2025, 2:04pm UTC](https://discuss.elastic.co/t/elasticsearch-indexing-pressure-memory-limit/383670 "2025-12-02T14:04:00Z")
When I try to index large log files through bulk\_index, I notice got logs missing. Suspecting it could be due to the memory issue of the elasticsearch nodes. I tried to change the indexing\_pressure.memory.limit to 40%. B… --- ## [Massive performance drop for certain queries in ES9 compared to ES8](https://discuss.elastic.co/t/massive-performance-drop-for-certain-queries-in-es9-compared-to-es8/383393)
**Author:** [@msh](https://discuss.elastic.co/u/msh)\ **Replies:** 16\ **Last updated:** [December 2, 2025, 12:49pm UTC](https://discuss.elastic.co/t/massive-performance-drop-for-certain-queries-in-es9-compared-to-es8/383393 "2025-12-02T12:49:32Z")
We discovered a massive performance drop after migration to ES 9 for certain queries with aggregations. Our mapping an be seen here: INGe/inge\_es\_connector/src/main/resources/es\_index\_items.json at spring6 · MPDL/INGe ·… --- ## [ELSER v2 model inference crashing](https://discuss.elastic.co/t/elser-v2-model-inference-crashing/375317)
**Author:** [@Bryan\_Warner](https://discuss.elastic.co/u/Bryan_Warner)\ **Replies:** 3\ **Last updated:** [December 2, 2025, 8:20am UTC](https://discuss.elastic.co/t/elser-v2-model-inference-crashing/375317 "2025-12-02T08:20:54Z")
Hi Team, Before filing an issue, I was wondering if I could get some assistance in trying to test inference on the ELSER v2 model in case I am missing something in the docs Elasticsearch version: 8.17.2 ML Nodes: 1 I… --- ## [Understanding how Elasticsearch segments, merges, and compacts its vector indexes](https://discuss.elastic.co/t/understanding-how-elasticsearch-segments-merges-and-compacts-its-vector-indexes/383796)
**Author:** [@sfmqrb](https://discuss.elastic.co/u/sfmqrb)\ **Replies:** 0\ **Last updated:** [December 2, 2025, 12:30am UTC](https://discuss.elastic.co/t/understanding-how-elasticsearch-segments-merges-and-compacts-its-vector-indexes/383796 "2025-12-02T00:30:01Z")
In Elasticsearch’s vector indexing pipeline, how exactly do segmenting and segment compaction work? Specifically, what compaction policy does Elasticsearch follow for segments and their vector indexes, and during compact… --- ## [ES 8.18.3 - ruby api: getting "\\>"](https://discuss.elastic.co/t/es-8-18-3-ruby-api-getting-elastic-net-readtimeout-with-tcpsocket-closed/383662)
**Author:** [@Russell\_Fulton](https://discuss.elastic.co/u/Russell_Fulton)\ **Replies:** 2\ **Last updated:** [December 1, 2025, 9:35pm UTC](https://discuss.elastic.co/t/es-8-18-3-ruby-api-getting-elastic-net-readtimeout-with-tcpsocket-closed/383662 "2025-12-01T21:35:37Z")
I have a ruby program that ingests data into ES (using bulk) I am seeing periodic failures on bulk uploads which raise exception \\> Thes… --- ## [Is second wave of Shai-Hulud attack impacting Elastic Stack?](https://discuss.elastic.co/t/is-second-wave-of-shai-hulud-attack-impacting-elastic-stack/383724)
**Author:** [@hkw2pg1](https://discuss.elastic.co/u/hkw2pg1)\ **Replies:** 1\ **Last updated:** [December 1, 2025, 5:00pm UTC](https://discuss.elastic.co/t/is-second-wave-of-shai-hulud-attack-impacting-elastic-stack/383724 "2025-12-01T17:00:18Z")
The Shai-Hulud attack came back again with approximately 800 npm packages impacted. To which extend is this article still stand? → Navigating the Shai-Hulud worm: Elastic's proactive defense against npm supply chain com… --- ## [Autodiscover with filters not working](https://discuss.elastic.co/t/autodiscover-with-filters-not-working/383716)
**Author:** [@kifkoman](https://discuss.elastic.co/u/kifkoman)\ **Replies:** 1\ **Last updated:** [December 1, 2025, 3:42pm UTC](https://discuss.elastic.co/t/autodiscover-with-filters-not-working/383716 "2025-12-01T15:42:40Z")
Hi, I am trying to set filebeat with autodiscover based on labels present in the pod. Below is my config \`\`yaml logging.level: debug logging.selectors: \["autodiscover", "kubernetes", "container"\] filebeat.autodiscov… --- ## [I want to use Elastic "Cloud Hosted" in Azure. Where infrastructure is hosted in Microsoft or Elastic Datacenter?](https://discuss.elastic.co/t/i-want-to-use-elastic-cloud-hosted-in-azure-where-infrastructure-is-hosted-in-microsoft-or-elastic-datacenter/383785)
**Author:** [@Karol\_Leszczynski](https://discuss.elastic.co/u/Karol_Leszczynski)\ **Replies:** 1\ **Last updated:** [December 1, 2025, 2:58pm UTC](https://discuss.elastic.co/t/i-want-to-use-elastic-cloud-hosted-in-azure-where-infrastructure-is-hosted-in-microsoft-or-elastic-datacenter/383785 "2025-12-01T14:58:31Z")
Hi, Sorry if this is a trivial question, but I can’t find a clear answer. My company wants to use Elasticsearch, and we have strict governance policies. If we choose the managed Elasticsearch offering from Azure, where … --- ## [Minecraft 1.21.124 Bedrock Edition Android Problemas de ingesta de logs S3 en Elasticsearch](https://discuss.elastic.co/t/minecraft-1-21-124-bedrock-edition-android-problemas-de-ingesta-de-logs-s3-en-elasticsearch/383786)
**Author:** [@padmakrishnadev](https://discuss.elastic.co/u/padmakrishnadev)\ **Replies:** 0\ **Last updated:** [December 1, 2025, 2:32pm UTC](https://discuss.elastic.co/t/minecraft-1-21-124-bedrock-edition-android-problemas-de-ingesta-de-logs-s3-en-elasticsearch/383786 "2025-12-01T14:32:40Z")
Hola comunidad, estoy trabajando en un proyecto de análisis de datos para una aplicación móvil específica y me he encontrado con un problema de latencia y permisos al intentar indexar los logs de acceso desde AWS CloudFr… --- ## [Logstash file output - pipeline stop working after flush error](https://discuss.elastic.co/t/logstash-file-output-pipeline-stop-working-after-flush-error/383505)
**Author:** [@Po-temkin](https://discuss.elastic.co/u/Po-temkin)\ **Replies:** 9\ **Last updated:** [December 1, 2025, 12:35pm UTC](https://discuss.elastic.co/t/logstash-file-output-pipeline-stop-working-after-flush-error/383505 "2025-12-01T12:35:21Z")
Have a nice day everyone. Not long ago, I started to notice missing syslog logs from random host groups. At first, I simply restarted our Logstash nodes that act as syslog forwarders, and the problem went away. But ov… --- ## [Problem with upgrading to 9.0.0, index compability](https://discuss.elastic.co/t/problem-with-upgrading-to-9-0-0-index-compability/377614)
**Author:** [@mbooh](https://discuss.elastic.co/u/mbooh)\ **Replies:** 13\ **Last updated:** [December 1, 2025, 10:22am UTC](https://discuss.elastic.co/t/problem-with-upgrading-to-9-0-0-index-compability/377614 "2025-12-01T10:22:57Z")
Hi! I'm trying to upgrade from 8.18 to 9.0 but I get a lot of these: \[2025-04-29T14:05:28,627\]\[ERROR\]\[o.e.b.Elasticsearch \] \[STHLM-KLARA-03\] fatal exception while booting Elasticsearch java.lang.IllegalStateExcept… --- ## [Does Logstash Kafka Plugin support Azure Managed Identity Authentication](https://discuss.elastic.co/t/does-logstash-kafka-plugin-support-azure-managed-identity-authentication/383776)
**Author:** [@dmj0013](https://discuss.elastic.co/u/dmj0013)\ **Replies:** 0\ **Last updated:** [December 1, 2025, 8:24am UTC](https://discuss.elastic.co/t/does-logstash-kafka-plugin-support-azure-managed-identity-authentication/383776 "2025-12-01T08:24:04Z")
Currently, does the Logstash Kafka Plugin support Azure Managed Identity Authentication for Event Hubs Kafka Endpoint? According to this article https://www.elastic.co/blog/ingest-data-azure-event-hub-entra-id?ref=dailyd… --- ## [Unexpected behavior when using match\_bool\_prefix with synonyms](https://discuss.elastic.co/t/unexpected-behavior-when-using-match-bool-prefix-with-synonyms/383755)
**Author:** [@gs\_elastic](https://discuss.elastic.co/u/gs_elastic)\ **Replies:** 2\ **Last updated:** [December 1, 2025, 7:15am UTC](https://discuss.elastic.co/t/unexpected-behavior-when-using-match-bool-prefix-with-synonyms/383755 "2025-12-01T07:15:25Z")
I'm experiencing unexpected behavior when using match\_bool\_prefix together with a synonym\_graph filter on the search analyzer. I found a similar topic previously asked: Prefix query not matching any documents — I used … --- ## [\[indices:admin/create\] is unauthorized for user Elastic Stack](https://discuss.elastic.co/t/indices-admin-create-is-unauthorized-for-user-elastic-stack/383767)
**Author:** [@frahmn](https://discuss.elastic.co/u/frahmn)\ **Replies:** 17\ **Last updated:** [November 30, 2025, 9:19pm UTC](https://discuss.elastic.co/t/indices-admin-create-is-unauthorized-for-user-elastic-stack/383767 "2025-11-30T21:19:30Z")
I have read through many articles and am not able to solve this issue for me. I’m trying to generate a new api key that has rights over creating indicies using filebeat. I have tried doing this through the superuser acco… --- ## [Filebeat is not able to read the message event if the attachment is more than 2 GBin the log file](https://discuss.elastic.co/t/filebeat-is-not-able-to-read-the-message-event-if-the-attachment-is-more-than-2-gbin-the-log-file/383765)
**Author:** [@Thirupathi](https://discuss.elastic.co/u/Thirupathi)\ **Replies:** 4\ **Last updated:** [November 30, 2025, 5:27pm UTC](https://discuss.elastic.co/t/filebeat-is-not-able-to-read-the-message-event-if-the-attachment-is-more-than-2-gbin-the-log-file/383765 "2025-11-30T17:27:51Z")
Filebeat is not able to read the message event if the attachment is more than 2 GB in in request contact the log file. --- ## [Windows Event Logs Showing as Filebeat — Expected Winlogbeat](https://discuss.elastic.co/t/windows-event-logs-showing-as-filebeat-expected-winlogbeat/383746)
**Author:** [@shalev\_aviram](https://discuss.elastic.co/u/shalev_aviram)\ **Replies:** 2\ **Last updated:** [November 30, 2025, 3:40pm UTC](https://discuss.elastic.co/t/windows-event-logs-showing-as-filebeat-expected-winlogbeat/383746 "2025-11-30T15:40:20Z")
Hi everyone, new here (: I have a question regarding Windows logs collected via Elastic Agent + Fleet. In some integrations (like windows - sysmon..) where I expect to see agent.type = winlogbeat, I instead see agent.t… --- ## [Migrate system indices failure](https://discuss.elastic.co/t/migrate-system-indices-failure/383756)
**Author:** [@kernelpanic](https://discuss.elastic.co/u/kernelpanic)\ **Replies:** 1\ **Last updated:** [November 28, 2025, 12:16pm UTC](https://discuss.elastic.co/t/migrate-system-indices-failure/383756 "2025-11-28T12:16:20Z")
Hello, I’m trying to migrate the system indices in preparation for upgrade from 8.19 to 9.x, however it is failing, any idea why? --- ## [Data Extraction Service (tika/openresty) crashes on second container start](https://discuss.elastic.co/t/data-extraction-service-tika-openresty-crashes-on-second-container-start/383519)
**Author:** [@SPRINGPEACHVINH](https://discuss.elastic.co/u/SPRINGPEACHVINH)\ **Replies:** 2\ **Last updated:** [November 28, 2025, 8:50am UTC](https://discuss.elastic.co/t/data-extraction-service-tika-openresty-crashes-on-second-container-start/383519 "2025-11-28T08:50:38Z")
Hi guys I’m encountering a repeatable issue with the data-extraction-service (0.3.5) when running it via Docker Compose. The service (tika + openresty inside the container) starts fine the first time I bring the stack … --- ## [Cluster will not start after upgrade from 8.x to 9.x](https://discuss.elastic.co/t/cluster-will-not-start-after-upgrade-from-8-x-to-9-x/383690)
**Author:** [@kernelpanic](https://discuss.elastic.co/u/kernelpanic)\ **Replies:** 19\ **Last updated:** [November 27, 2025, 5:03pm UTC](https://discuss.elastic.co/t/cluster-will-not-start-after-upgrade-from-8-x-to-9-x/383690 "2025-11-27T17:03:11Z")
Hello all, I’ve upgraded from Elasticsearch 8.19 to 9.2.1. Since doing so none of the cluster nodes will start, the error message in the cluster log: java.lang.IllegalStateException: The index \[.reporting-2021-12-12/E… --- ## [Best way to reliably forward logs from Elasticsearch to multiple destinations using Logstash](https://discuss.elastic.co/t/best-way-to-reliably-forward-logs-from-elasticsearch-to-multiple-destinations-using-logstash/383730)
**Author:** [@Mahesh\_Kumar1](https://discuss.elastic.co/u/Mahesh_Kumar1)\ **Replies:** 1\ **Last updated:** [November 27, 2025, 1:49pm UTC](https://discuss.elastic.co/t/best-way-to-reliably-forward-logs-from-elasticsearch-to-multiple-destinations-using-logstash/383730 "2025-11-27T13:49:52Z")
Hi all, I am collecting logs from multiple sources (Syslog, SNMP, Windows EventLog,) and storing them in Elasticsearch. Now I need to forward these stored logs from Elasticsearch to multiple external destinations using… --- ## [Histogram zoom-out status](https://discuss.elastic.co/t/histogram-zoom-out-status/383733)
**Author:** [@jkavalik](https://discuss.elastic.co/u/jkavalik)\ **Replies:** 0\ **Last updated:** [November 27, 2025, 12:39pm UTC](https://discuss.elastic.co/t/histogram-zoom-out-status/383733 "2025-11-27T12:39:23Z")
What is the current status of previous/next button zoom in/ zoom out for a more convenient data exploration · Issue #54103 · elastic/kibana · GitHub ? It is marked as “completed” for almost two years and I cannot see it… --- ## [Force synchronous refresh](https://discuss.elastic.co/t/force-synchronous-refresh/383535)
**Author:** [@Elastic04](https://discuss.elastic.co/u/Elastic04)\ **Replies:** 1\ **Last updated:** [November 27, 2025, 11:52am UTC](https://discuss.elastic.co/t/force-synchronous-refresh/383535 "2025-11-27T11:52:10Z")
We have this part of code in indexing job. turn off refresh\_interval before indexing. (set refresh\_interval to 0 or -1 through kibana) After indexing is done, we to do manual refresh so that indexed products will b… --- ## [Elastic Agent metric endpoint autodiscovery in Kubernetes](https://discuss.elastic.co/t/elastic-agent-metric-endpoint-autodiscovery-in-kubernetes/383640)
**Author:** [@ilyazh](https://discuss.elastic.co/u/ilyazh)\ **Replies:** 1\ **Last updated:** [November 27, 2025, 10:09am UTC](https://discuss.elastic.co/t/elastic-agent-metric-endpoint-autodiscovery-in-kubernetes/383640 "2025-11-27T10:09:45Z")
Hello everyone, we are looking into monitoring Kubernetes Clusters with Elastic Agents using the Kubernetes Integration. We are using Fleet to manage our Elastic Agents. We are able to collect metrics from kubelet api, … --- ## [Elastic Flush/fetch latency too high](https://discuss.elastic.co/t/elastic-flush-fetch-latency-too-high/383681)
**Author:** [@richard2](https://discuss.elastic.co/u/richard2)\ **Replies:** 8\ **Last updated:** [November 27, 2025, 8:57am UTC](https://discuss.elastic.co/t/elastic-flush-fetch-latency-too-high/383681 "2025-11-27T08:57:14Z")
Hello, from zabbix monitoring im getting a lot of notifications fetch/flush latency is too high. Are values within a margin or is it problem. In last 12 hours avg was 5000 ms max 34000ms Would changing durability to a… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=26) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=28)