# Elastic Stack

**URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=287

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 288

---

## [Is Elastic Search paid?](https://discuss.elastic.co/t/is-elastic-search-paid/355301)

<div class="topic-metadata">

**Author:** [@ShubhamSaxena8](https://discuss.elastic.co/u/ShubhamSaxena8)\
**Replies:** 4\
**Last updated:** [March 13, 2024, 11:08am UTC](https://discuss.elastic.co/t/is-elastic-search-paid/355301 "2024-03-13T11:08:42Z")

</div>

Hello Team, My team is setting up a centralized logging system for our .Net applications. We have decided to go with Elastic Search but I am still a bit confused on the pricing part. I am assuming that I will be using …

---

## [Clear ELK installation cant add Fleet server 8.12](https://discuss.elastic.co/t/clear-elk-installation-cant-add-fleet-server-8-12/354944)

<div class="topic-metadata">

**Author:** [@hitmany](https://discuss.elastic.co/u/hitmany)\
**Replies:** 2\
**Last updated:** [March 13, 2024, 10:18am UTC](https://discuss.elastic.co/t/clear-elk-installation-cant-add-fleet-server-8-12/354944 "2024-03-13T10:18:44Z")

</div>

Hi there, I am install Elasticsearch and Kibana. All services using self-signed certificates generated with elasticsearch-certutil. :grinning: In the Kibana Fleet GUI interface, I added a Fleet server and selected Advan…

---

## [Problem in downloading fleet server](https://discuss.elastic.co/t/problem-in-downloading-fleet-server/355079)

<div class="topic-metadata">

**Author:** [@Rupa123](https://discuss.elastic.co/u/Rupa123)\
**Replies:** 1\
**Last updated:** [March 13, 2024, 9:52am UTC](https://discuss.elastic.co/t/problem-in-downloading-fleet-server/355079 "2024-03-13T09:52:51Z")

</div>

Hey, I have an issue in downloading fleet server over https, we are running elasticsearch and kibana on docker with https on LINUX machine RHEL8.6 , when we are installing fleet and agent with this command it is gettin…

---

## [Fleet UI not displaying CPU and Memory stats for some agents](https://discuss.elastic.co/t/fleet-ui-not-displaying-cpu-and-memory-stats-for-some-agents/354468)

<div class="topic-metadata">

**Author:** [@elastic\_fan](https://discuss.elastic.co/u/elastic_fan)\
**Replies:** 3\
**Last updated:** [March 13, 2024, 9:47am UTC](https://discuss.elastic.co/t/fleet-ui-not-displaying-cpu-and-memory-stats-for-some-agents/354468 "2024-03-13T09:47:42Z")

</div>

Hello, I have some agents that are not showing their CPU and Memory usage on the fleet page, but do have the metric updating every few seconds on the agent details page. Elasticsearch version 8.8.2 Elastic agent versi…

---

## [Issues with setting up urltemplate in Kibana](https://discuss.elastic.co/t/issues-with-setting-up-urltemplate-in-kibana/355262)

<div class="topic-metadata">

**Author:** [@b2ron](https://discuss.elastic.co/u/b2ron)\
**Replies:** 1\
**Last updated:** [March 13, 2024, 8:58am UTC](https://discuss.elastic.co/t/issues-with-setting-up-urltemplate-in-kibana/355262 "2024-03-13T08:58:31Z")

</div>

Question 1: How to use fields from the document in urltemplate instead of {{value}}? While configuring urltemplate in Kibana, I've encountered an issue. I'm attempting to include another field from the document in the q…

---

## [Issues getting logs from specific pod](https://discuss.elastic.co/t/issues-getting-logs-from-specific-pod/355292)

<div class="topic-metadata">

**Author:** [@Dennis\_Christensen](https://discuss.elastic.co/u/Dennis_Christensen)\
**Replies:** 0\
**Last updated:** [March 13, 2024, 8:11am UTC](https://discuss.elastic.co/t/issues-getting-logs-from-specific-pod/355292 "2024-03-13T08:11:57Z")

</div>

I am using elastic version 8.10.0 on a kubernetes cluster, and is trying to setup logging from our nodejs services. I would like to only get logs from specific pods so have set hints.default\_config: false If I use the…

---

## [The tags field in the message conflicts with the built-in tags field in Logstash](https://discuss.elastic.co/t/the-tags-field-in-the-message-conflicts-with-the-built-in-tags-field-in-logstash/355290)

<div class="topic-metadata">

**Author:** [@uniquecats](https://discuss.elastic.co/u/uniquecats)\
**Replies:** 0\
**Last updated:** [March 13, 2024, 7:48am UTC](https://discuss.elastic.co/t/the-tags-field-in-the-message-conflicts-with-the-built-in-tags-field-in-logstash/355290 "2024-03-13T07:48:34Z")

</div>

The version: logstash:8.12.2 I have the following data structure in kafka. { "contents": { "content": "2024-03-13 12:17:18,614 \[aecd9c48e39fb9fe,aecd9c48e39fb9fe,,false\] INFO com.td.mc.gate.util...." }, "ta…

---

## [What does "bulk operation" mean exactly in custom track on es-rally?](https://discuss.elastic.co/t/what-does-bulk-operation-mean-exactly-in-custom-track-on-es-rally/355278)

<div class="topic-metadata">

**Author:** [@qksjdhi1212](https://discuss.elastic.co/u/qksjdhi1212)\
**Replies:** 1\
**Last updated:** [March 13, 2024, 6:46am UTC](https://discuss.elastic.co/t/what-does-bulk-operation-mean-exactly-in-custom-track-on-es-rally/355278 "2024-03-13T06:46:31Z")

</div>

I set the bulk operation with 5000 bulk-size and 5 clients { "version": 2, "description": "", "indices": \[ { "name": "indexing-1gb", "body": "index.json" } \], "corpora": \[ { "name…

---

## [Which one is the best to retrieve selected fields from a search: \`\_source\` or \`fields\`?](https://discuss.elastic.co/t/which-one-is-the-best-to-retrieve-selected-fields-from-a-search-source-or-fields/355270)

<div class="topic-metadata">

**Author:** [@deadlyn](https://discuss.elastic.co/u/deadlyn)\
**Replies:** 3\
**Last updated:** [March 13, 2024, 6:16am UTC](https://discuss.elastic.co/t/which-one-is-the-best-to-retrieve-selected-fields-from-a-search-source-or-fields/355270 "2024-03-13T06:16:57Z")

</div>

\_source vs fields: which is fastest to retrieve selected fields? The ES 8.10.x official doc mentioned that ES will load whole \_source object while using \_source and the doc preferred to use fields. You can use both o…

---

## [Running rally locally](https://discuss.elastic.co/t/running-rally-locally/354924)

<div class="topic-metadata">

**Author:** [@Qia](https://discuss.elastic.co/u/Qia)\
**Replies:** 15\
**Last updated:** [March 13, 2024, 5:56am UTC](https://discuss.elastic.co/t/running-rally-locally/354924 "2024-03-13T05:56:37Z")

</div>

After following Developing Rally - Rally 2.10.0.dev0 documentation I ran: (.venv) ➜ rally git:(master) python esrally/rally.py race --pipeline=benchmark-only --target-host=127.0.0.1:39200 --track=geonames --challenge=…

---

## [Elastic Agent FortiAnalyzer integration](https://discuss.elastic.co/t/elastic-agent-fortianalyzer-integration/354936)

<div class="topic-metadata">

**Author:** [@mwitsas](https://discuss.elastic.co/u/mwitsas)\
**Replies:** 0\
**Last updated:** [March 7, 2024, 10:20am UTC](https://discuss.elastic.co/t/elastic-agent-fortianalyzer-integration/354936 "2024-03-07T10:20:05Z")

</div>

"This integration has been tested against FortiManager & FortiAnalyzer 7.2.2. Versions above this are expected to work but have not been tested." We will be running version v7.0.10-build0561 231025 (GA) FortiAnalyzer …

---

## [Elastic serach going unresponsive](https://discuss.elastic.co/t/elastic-serach-going-unresponsive/354505)

<div class="topic-metadata">

**Author:** [@thenmozhi](https://discuss.elastic.co/u/thenmozhi)\
**Replies:** 12\
**Last updated:** [March 13, 2024, 4:45am UTC](https://discuss.elastic.co/t/elastic-serach-going-unresponsive/354505 "2024-03-13T04:45:57Z")

</div>

16GB RAM, 112 memory server with elastic 7.0.15 installed. when ever elastic running the website is going ideal

---

## [Unable to authenticate using custom realm example code security-example-spi-extension](https://discuss.elastic.co/t/unable-to-authenticate-using-custom-realm-example-code-security-example-spi-extension/355151)

<div class="topic-metadata">

**Author:** [@buitcj](https://discuss.elastic.co/u/buitcj)\
**Replies:** 4\
**Last updated:** [March 13, 2024, 1:25am UTC](https://discuss.elastic.co/t/unable-to-authenticate-using-custom-realm-example-code-security-example-spi-extension/355151 "2024-03-13T01:25:26Z")

</div>

I've installed the provided security-example-spi-extension plugin (elasticsearch/x-pack/qa/security-example-spi-extension at 8.12 · elastic/elasticsearch · GitHub) and when I attempt to authenticate, it goes through Cust…

---

## [Kibana 7 inline script wildcard on viz converts to incorrect filter query within dash](https://discuss.elastic.co/t/kibana-7-inline-script-wildcard-on-viz-converts-to-incorrect-filter-query-within-dash/355268)

<div class="topic-metadata">

**Author:** [@TimC](https://discuss.elastic.co/u/TimC)\
**Replies:** 0\
**Last updated:** [March 13, 2024, 1:07am UTC](https://discuss.elastic.co/t/kibana-7-inline-script-wildcard-on-viz-converts-to-incorrect-filter-query-within-dash/355268 "2024-03-13T01:07:17Z")

</div>

I was trying to come up with a way to store filters with a Dashboard since I had read that is not possible, and I found this bug where inline is not converting to query dsl correctly when used between a visualization and…

---

## [AWS clouldtrail user activity logs to elasticcloud](https://discuss.elastic.co/t/aws-clouldtrail-user-activity-logs-to-elasticcloud/355198)

<div class="topic-metadata">

**Author:** [@joshuskarki](https://discuss.elastic.co/u/joshuskarki)\
**Replies:** 3\
**Last updated:** [March 12, 2024, 11:13pm UTC](https://discuss.elastic.co/t/aws-clouldtrail-user-activity-logs-to-elasticcloud/355198 "2024-03-12T23:13:29Z")

</div>

Has anyone here successfully ingested AWS CloudTrail user activity logs into Elastic using CloudTrail integration and pulled data from SQS (CloudTrail -\> S3 -\> SQS with SNS enabled)? I am specifically wondering about th…

---

## [Logstash variable default value crashes logstash](https://discuss.elastic.co/t/logstash-variable-default-value-crashes-logstash/355265)

<div class="topic-metadata">

**Author:** [@learningelastic](https://discuss.elastic.co/u/learningelastic)\
**Replies:** 0\
**Last updated:** [March 12, 2024, 11:03pm UTC](https://discuss.elastic.co/t/logstash-variable-default-value-crashes-logstash/355265 "2024-03-12T23:03:52Z")

</div>

I have the following files which work perfectly and does exactly what I expect. My .env file: COMPOSE\_PROJECT\_NAME=wp LOGSTASH\_DEBUG\_SCHEDULE="\* \* \* \* \*" My docker-compose.yml: version: "3.8" networks: default: …

---

## [Points: when we plan to upgrade the ELK](https://discuss.elastic.co/t/points-when-we-plan-to-upgrade-the-elk/354771)

<div class="topic-metadata">

**Author:** [@Ravi\_Pattar](https://discuss.elastic.co/u/Ravi_Pattar)\
**Replies:** 4\
**Last updated:** [March 12, 2024, 8:34pm UTC](https://discuss.elastic.co/t/points-when-we-plan-to-upgrade-the-elk/354771 "2024-03-12T20:34:30Z")

</div>

Hello all, Need some clarifications. Kindly suggest with your inputs. If we plan to upgrade the full ELK stack to version 8.11 or the latest from version 7.17? Note: There’s a catch here as the main ELK server is run…

---

## [How to add created\_at and updated\_at fields](https://discuss.elastic.co/t/how-to-add-created-at-and-updated-at-fields/355178)

<div class="topic-metadata">

**Author:** [@Marco\_Solari](https://discuss.elastic.co/u/Marco_Solari)\
**Replies:** 18\
**Last updated:** [March 12, 2024, 7:46pm UTC](https://discuss.elastic.co/t/how-to-add-created-at-and-updated-at-fields/355178 "2024-03-12T19:46:20Z")

</div>

Hi. I'm quite new to Elasticsearch. I'm using the python client (v8.12.0). I'd like to add to my index the timestamp fields created\_at and updated\_at for every document. Reading various docs I think I have to use Ing…

---

## [Array search from Logstash elasticsearch plugin](https://discuss.elastic.co/t/array-search-from-logstash-elasticsearch-plugin/355258)

<div class="topic-metadata">

**Author:** [@RRGTHWAR1](https://discuss.elastic.co/u/RRGTHWAR1)\
**Replies:** 0\
**Last updated:** [March 12, 2024, 7:27pm UTC](https://discuss.elastic.co/t/array-search-from-logstash-elasticsearch-plugin/355258 "2024-03-12T19:27:42Z")

</div>

I'm bringing records from a SQL Server database into Elasticsearch using Logstash, and I need to convert a numerical field that could apply several times to each SQL Server record into one array field in the Elasticsearc…

---

## [How to fetch first value from Json Array](https://discuss.elastic.co/t/how-to-fetch-first-value-from-json-array/355214)

<div class="topic-metadata">

**Author:** [@upreddy](https://discuss.elastic.co/u/upreddy)\
**Replies:** 1\
**Last updated:** [March 12, 2024, 6:38pm UTC](https://discuss.elastic.co/t/how-to-fetch-first-value-from-json-array/355214 "2024-03-12T18:38:14Z")

</div>

Hi Team, I am sharing logline below. "independentFailureReport": { "failureReportEntries": \[ { "errorCode": abc, "additionalInfo": { "length": xyz, "result": "XXXXXXXXXXXXXXXXXXX" }, "execScheduleInfo": { "ena…

---

## [Fleet permissons](https://discuss.elastic.co/t/fleet-permissons/353465)

<div class="topic-metadata">

**Author:** [@Dilma\_David](https://discuss.elastic.co/u/Dilma_David)\
**Replies:** 1\
**Last updated:** [March 12, 2024, 4:44pm UTC](https://discuss.elastic.co/t/fleet-permissons/353465 "2024-03-12T16:44:08Z")

</div>

Hello, I am trying to use the Elastic search for the first time, I installed Elasticsearch and Kibana in an Ubunto Virtual Machine in VirtualBox. Now Im trying to configure the fleet and Elastic Agent, but I am havi…

---

## [Kibana - cant connect to self hosted elastic](https://discuss.elastic.co/t/kibana-cant-connect-to-self-hosted-elastic/355190)

<div class="topic-metadata">

**Author:** [@Nick\_Dart](https://discuss.elastic.co/u/Nick_Dart)\
**Replies:** 2\
**Last updated:** [March 12, 2024, 2:50pm UTC](https://discuss.elastic.co/t/kibana-cant-connect-to-self-hosted-elastic/355190 "2024-03-12T14:50:28Z")

</div>

Hi there, I recently launched my self hosted elastic service, but I can't get Kibana to connect to it. In my browser, I can access the instance i.e. health, license using a username + password. However, when launching …

---

## [Lookup in elasticsearch](https://discuss.elastic.co/t/lookup-in-elasticsearch/355229)

<div class="topic-metadata">

**Author:** [@hans\_hupe](https://discuss.elastic.co/u/hans_hupe)\
**Replies:** 5\
**Last updated:** [March 12, 2024, 2:48pm UTC](https://discuss.elastic.co/t/lookup-in-elasticsearch/355229 "2024-03-12T14:48:17Z")

</div>

In relational databases I am used to refer to descriptive fields by a key, and then make a lookup in order to retrieve the description. So updating the description doesn't have an impact on the query logic. How is this …

---

## [Issue with thread\_pool.write.queue\_size](https://discuss.elastic.co/t/issue-with-thread-pool-write-queue-size/354951)

<div class="topic-metadata">

**Author:** [@cesar.hernandez.a3se](https://discuss.elastic.co/u/cesar.hernandez.a3se)\
**Replies:** 12\
**Last updated:** [March 12, 2024, 2:39pm UTC](https://discuss.elastic.co/t/issue-with-thread-pool-write-queue-size/354951 "2024-03-12T14:39:43Z")

</div>

Hi He have been experiencing issues the last days on all nodes of our ES cluster, we see lots of these messages: \[2024-03-05T01:07:37,648\]\[WARN \]\[o.e.x.m.e.l.LocalExporter\] \[elastic-loggerpro05\] unexpected error while …

---

## [Prometheus Integration not scraping summary metrics](https://discuss.elastic.co/t/prometheus-integration-not-scraping-summary-metrics/352083)

<div class="topic-metadata">

**Author:** [@Alphayeeeet](https://discuss.elastic.co/u/Alphayeeeet)\
**Replies:** 5\
**Last updated:** [March 12, 2024, 2:32pm UTC](https://discuss.elastic.co/t/prometheus-integration-not-scraping-summary-metrics/352083 "2024-03-12T14:32:09Z")

</div>

I opened a Github issue (Add support for summary metrics, when collecting from Prometheus exporter · Issue #37376 · elastic/beats · GitHub), which didn't any responses, so I will repost here. I opened it as enhancement i…

---

## [Change log level of add\_cloud\_metadata processor](https://discuss.elastic.co/t/change-log-level-of-add-cloud-metadata-processor/352087)

<div class="topic-metadata">

**Author:** [@Alphayeeeet](https://discuss.elastic.co/u/Alphayeeeet)\
**Replies:** 6\
**Last updated:** [March 12, 2024, 2:08pm UTC](https://discuss.elastic.co/t/change-log-level-of-add-cloud-metadata-processor/352087 "2024-03-12T14:08:29Z")

</div>

Elastic Agent version: 8.11.3 The add\_cloud\_metadata processor is used in filebeat/metricbeat by default. When deploying non-cloud Elastic Agent on own premises, the processor tries to add the metadata and fails with er…

---

## [Rounding error in lens sum aggregation (8.12.1)](https://discuss.elastic.co/t/rounding-error-in-lens-sum-aggregation-8-12-1/355141)

<div class="topic-metadata">

**Author:** [@Jim\_Panzee](https://discuss.elastic.co/u/Jim_Panzee)\
**Replies:** 12\
**Last updated:** [March 12, 2024, 1:59pm UTC](https://discuss.elastic.co/t/rounding-error-in-lens-sum-aggregation-8-12-1/355141 "2024-03-12T13:59:38Z")

</div>

I have the same three values reoccurring every 10 seconds as shown in Discover: (Here was a picture, I couldn't post, because I'm a new user.) The sum should add up to 1.642. This also shows in lens in an area visualiz…

---

## [Is Update mapping API atomic?](https://discuss.elastic.co/t/is-update-mapping-api-atomic/354738)

<div class="topic-metadata">

**Author:** [@svtd](https://discuss.elastic.co/u/svtd)\
**Replies:** 2\
**Last updated:** [March 12, 2024, 1:17pm UTC](https://discuss.elastic.co/t/is-update-mapping-api-atomic/354738 "2024-03-12T13:17:41Z")

</div>

Hi! If I send Update mapping request targeting alias will that be executed atomically? Or can if happen that part of the indices are adjusted and others not (e.g. because of some failure)? Thank you, Svetlana

---

## [Problem elastic. uneven distribution of the data node](https://discuss.elastic.co/t/problem-elastic-uneven-distribution-of-the-data-node/352409)

<div class="topic-metadata">

**Author:** [@San9](https://discuss.elastic.co/u/San9)\
**Replies:** 13\
**Last updated:** [March 12, 2024, 1:03pm UTC](https://discuss.elastic.co/t/problem-elastic-uneven-distribution-of-the-data-node/352409 "2024-03-12T13:03:58Z")

</div>

Hi Team! I'm using the elastic version 8.11.1. Recently I began to notice an uneven distribution of indexes across data nodes. Alert: Node v-elk-ed02 is reporting disk usage of 90% at February 2, 2024 3:44 PM EET …

---

## [Add ssl certificate config parameters for AWS RDS MySQL connection for metricbeat](https://discuss.elastic.co/t/add-ssl-certificate-config-parameters-for-aws-rds-mysql-connection-for-metricbeat/355228)

<div class="topic-metadata">

**Author:** [@Chandrashekar](https://discuss.elastic.co/u/Chandrashekar)\
**Replies:** 0\
**Last updated:** [March 12, 2024, 12:56pm UTC](https://discuss.elastic.co/t/add-ssl-certificate-config-parameters-for-aws-rds-mysql-connection-for-metricbeat/355228 "2024-03-12T12:56:14Z")

</div>

Hi I am trying to configure the AWS RDS metric using metricbeat mysql module. I have enabled the require\_secure\_transport ON for aws rds parametergroup Below is the mysql.yml (/etc/metricbeat/modules.d/mysql.yml) mo…

[Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=286)

[Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=288)
