# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=29 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 30 --- ## [Rule Consumer explanation](https://discuss.elastic.co/t/rule-consumer-explanation/383264)
**Author:** [@lduvnjak](https://discuss.elastic.co/u/lduvnjak)\ **Replies:** 3\ **Last updated:** [November 21, 2025, 11:40am UTC](https://discuss.elastic.co/t/rule-consumer-explanation/383264 "2025-11-21T11:40:57Z")
Hi everyone, Can someone give me a rundown of what each consumer means and is tied to? Regarding the Rule APIs (Create/Update). There's an open Github issue for improving the documentation but it seems to be in one he… --- ## [Issue Upgrading from Elasticsearch 8.19.4 to 9.1.4 – Indices Not Read-Only Despite Settings](https://discuss.elastic.co/t/issue-upgrading-from-elasticsearch-8-19-4-to-9-1-4-indices-not-read-only-despite-settings/382398)
**Author:** [@RuiCosta78](https://discuss.elastic.co/u/RuiCosta78)\ **Replies:** 11\ **Last updated:** [November 21, 2025, 8:50am UTC](https://discuss.elastic.co/t/issue-upgrading-from-elasticsearch-8-19-4-to-9-1-4-indices-not-read-only-despite-settings/382398 "2025-11-21T08:50:39Z")
Hi everyone, We're in the process of upgrading our Elasticsearch cluster from version 8.12.0 to 9.1.4, following the recommended upgrade path. Here's what we've done so far: Upgraded from 8.12.0 → 8.19.4 (latest 8.x … --- ## [Issues with upgrade from 8.18.1 to 9.0.1](https://discuss.elastic.co/t/issues-with-upgrade-from-8-18-1-to-9-0-1/378753)
**Author:** [@dominbdg](https://discuss.elastic.co/u/dominbdg)\ **Replies:** 29\ **Last updated:** [November 21, 2025, 8:31am UTC](https://discuss.elastic.co/t/issues-with-upgrade-from-8-18-1-to-9-0-1/378753 "2025-11-21T08:31:43Z")
Hello, I'm trying to upgrade current 8.18.1 to 9.0.1 but facing a lot of issues, Most of them have compatibility issues preventing upgrade. For example everytime I'm receiving something like below: "error.stack\_trac… --- ## [Elastic Agent high CPU Usage](https://discuss.elastic.co/t/elastic-agent-high-cpu-usage/383578)
**Author:** [@hdrkhls](https://discuss.elastic.co/u/hdrkhls)\ **Replies:** 0\ **Last updated:** [November 21, 2025, 8:13am UTC](https://discuss.elastic.co/t/elastic-agent-high-cpu-usage/383578 "2025-11-21T08:13:56Z")
Hi there, Elastic Stack : 9.0.3 Elastic Agent: 9.04 Im already install elastic-agent standalone on my postgresql server using postgresql module integration on kibana, and there is high cpu usage, which is make my post… --- ## [Persistent Reindex Failure from Source-Only Snapshot: unexpected docvalues type NONE for field '\_ignored' error](https://discuss.elastic.co/t/persistent-reindex-failure-from-source-only-snapshot-unexpected-docvalues-type-none-for-field-ignored-error/383178)
**Author:** [@Rizaldi\_Sanjaya](https://discuss.elastic.co/u/Rizaldi_Sanjaya)\ **Replies:** 2\ **Last updated:** [November 21, 2025, 4:14am UTC](https://discuss.elastic.co/t/persistent-reindex-failure-from-source-only-snapshot-unexpected-docvalues-type-none-for-field-ignored-error/383178 "2025-11-21T04:14:38Z")
Hello, I am attempting to restore a data stream from a source-only snapshot and then reindex it into a new, functional data stream, as required by the source-only documentation. The restore operation completes successf… --- ## [Kibana Service Infrastructure tab displays some empty fields](https://discuss.elastic.co/t/kibana-service-infrastructure-tab-displays-some-empty-fields/383571)
**Author:** [@IvanovOleg](https://discuss.elastic.co/u/IvanovOleg)\ **Replies:** 1\ **Last updated:** [November 20, 2025, 9:26pm UTC](https://discuss.elastic.co/t/kibana-service-infrastructure-tab-displays-some-empty-fields/383571 "2025-11-20T21:26:15Z")
Observability → APM → Service Name → Infrastructure This tab in kibana displays some empty fields f.e # of CPU, Memory Total, Memory usage. Same fields in the Observability → Infrastructure → Infrastructure Inventory → … --- ## [Elasticsearch 8.12.2 Startup Failure: SIGILL Crash](https://discuss.elastic.co/t/elasticsearch-8-12-2-startup-failure-sigill-crash/383554)
**Author:** [@Pabendi](https://discuss.elastic.co/u/Pabendi)\ **Replies:** 3\ **Last updated:** [November 20, 2025, 7:14pm UTC](https://discuss.elastic.co/t/elasticsearch-8-12-2-startup-failure-sigill-crash/383554 "2025-11-20T19:14:52Z")
Hello everyone, thank you so much for taking the time to read this. I have a small problem with my Elastic server: My Elasticsearch 8.12.2 was running without issues for several months on multiple nodes in a Red Hat En… --- ## [Adding Fleet/Agent to existing ECK managed cluster](https://discuss.elastic.co/t/adding-fleet-agent-to-existing-eck-managed-cluster/383556)
**Author:** [@smashley](https://discuss.elastic.co/u/smashley)\ **Replies:** 1\ **Last updated:** [November 20, 2025, 5:45pm UTC](https://discuss.elastic.co/t/adding-fleet-agent-to-existing-eck-managed-cluster/383556 "2025-11-20T17:45:15Z")
I’m having trouble trying to add Fleet and Agent to one of our existing elastic clusters (EDIT: es, kibana, agent all 9.1.5, in ECK managed cluster in an AWS EKS cluster). I was successfully able to do this on a newly bu… --- ## [Elasticsearch not creating required output as expected with logstash and filebeat](https://discuss.elastic.co/t/elasticsearch-not-creating-required-output-as-expected-with-logstash-and-filebeat/383551)
**Author:** [@DOkuwa](https://discuss.elastic.co/u/DOkuwa)\ **Replies:** 7\ **Last updated:** [November 20, 2025, 4:53pm UTC](https://discuss.elastic.co/t/elasticsearch-not-creating-required-output-as-expected-with-logstash-and-filebeat/383551 "2025-11-20T16:53:04Z")
Good morning , I have installed filebeat , logstash,kibana and elasticsearch on the same server I want filebeat to push a particular json file to logstash and then appear in kibana i have configured the filebeat.yml … --- ## [Confused by --fleet-server-es-cert\* flags](https://discuss.elastic.co/t/confused-by-fleet-server-es-cert-flags/383546)
**Author:** [@learningelastic](https://discuss.elastic.co/u/learningelastic)\ **Replies:** 3\ **Last updated:** [November 20, 2025, 3:48pm UTC](https://discuss.elastic.co/t/confused-by-fleet-server-es-cert-flags/383546 "2025-11-20T15:48:10Z")
So can someone clarify for me how these flags are used: --fleet-server-es-cert\*, --fleet-server-es-ca, --fleet-server-client-auth ? For example, let’s say I ran this command on my linux server 192.168.0.2 to turn it int… --- ## [How to display case and single products together in search results](https://discuss.elastic.co/t/how-to-display-case-and-single-products-together-in-search-results/383549)
**Author:** [@Elastic04](https://discuss.elastic.co/u/Elastic04)\ **Replies:** 11\ **Last updated:** [November 20, 2025, 2:26pm UTC](https://discuss.elastic.co/t/how-to-display-case-and-single-products-together-in-search-results/383549 "2025-11-20T14:26:13Z")
We have a usecase to display case and single products next to each other in search results. How can I achieve this? --- ## [Disable AI Assistant in Kibana 9.2.1](https://discuss.elastic.co/t/disable-ai-assistant-in-kibana-9-2-1/383550)
**Author:** [@cisupport-zkb](https://discuss.elastic.co/u/cisupport-zkb)\ **Replies:** 4\ **Last updated:** [November 20, 2025, 1:46pm UTC](https://discuss.elastic.co/t/disable-ai-assistant-in-kibana-9-2-1/383550 "2025-11-20T13:46:05Z")
Hi Everyone, I want to disable the AI Assistent in Kibana 9.2.1, how to do that? I noticed on the documentation Manage access to AI features | Elastic Docs that can be done in GenAI Settings page, but I don’t find it (a… --- ## [Splitting an Elastic Enterprise License Across Multiple Clusters](https://discuss.elastic.co/t/splitting-an-elastic-enterprise-license-across-multiple-clusters/383543)
**Author:** [@gueguet57](https://discuss.elastic.co/u/gueguet57)\ **Replies:** 1\ **Last updated:** [November 20, 2025, 1:45am UTC](https://discuss.elastic.co/t/splitting-an-elastic-enterprise-license-across-multiple-clusters/383543 "2025-11-20T01:45:51Z")
Hello, I would like to know if it's possible to split an Enterprise license across multiple Elastic clusters. For example, my PROD cluster is consuming only 40 GB out of a 64 GB license. Is it possible to use the remai… --- ## [Issue enrolling into fleet](https://discuss.elastic.co/t/issue-enrolling-into-fleet/383470)
**Author:** [@f4n-1nh1b1t10n](https://discuss.elastic.co/u/f4n-1nh1b1t10n)\ **Replies:** 16\ **Last updated:** [November 19, 2025, 4:26pm UTC](https://discuss.elastic.co/t/issue-enrolling-into-fleet/383470 "2025-11-19T16:26:58Z")
Hello, I seem to stumble on the issue of enrolling my agent securely into fleet. i’ve tried the FAQ where they suggest to install the agent first, and then enroll it into fleet (upgrading the agent to a fleet server wi… --- ## [Using the frozen tier with Elastic Cloud and ILM policies](https://discuss.elastic.co/t/using-the-frozen-tier-with-elastic-cloud-and-ilm-policies/383342)
**Author:** [@javierE](https://discuss.elastic.co/u/javierE)\ **Replies:** 4\ **Last updated:** [November 19, 2025, 4:25pm UTC](https://discuss.elastic.co/t/using-the-frozen-tier-with-elastic-cloud-and-ilm-policies/383342 "2025-11-19T16:25:41Z")
Hi all, I’m evaluating the frozen tier functionality in Elastic Cloud deployment, aiming to keep around ten years of historical data available for occasional analysis and compliance purposes. Given that we plan to ret… --- ## [Filebeat running as non-root user to read docker container logs](https://discuss.elastic.co/t/filebeat-running-as-non-root-user-to-read-docker-container-logs/383540)
**Author:** [@MrHedgehog](https://discuss.elastic.co/u/MrHedgehog)\ **Replies:** 0\ **Last updated:** [November 19, 2025, 4:23pm UTC](https://discuss.elastic.co/t/filebeat-running-as-non-root-user-to-read-docker-container-logs/383540 "2025-11-19T16:23:22Z")
Environment: Rocky Linux 9.6. Filebeat 8.19.7 (tar.gz install). Docker version 29.0.2 (API 1.52). SELinux enabled (but no difference with it in permissive mode) With filebeat (tar.gz install) running as a non-root user … --- ## [How do I update advanced settings via Kibana API?](https://discuss.elastic.co/t/how-do-i-update-advanced-settings-via-kibana-api/383526)
**Author:** [@Dhruv\_Naik](https://discuss.elastic.co/u/Dhruv_Naik)\ **Replies:** 2\ **Last updated:** [November 19, 2025, 2:05pm UTC](https://discuss.elastic.co/t/how-do-i-update-advanced-settings-via-kibana-api/383526 "2025-11-19T14:05:25Z")
Hi, I want to know if there is a supported way to update Kibana Advanced Settings (specifically the defaultRoute attribute) using an API. I’m trying to automate this through Jenkins so that each Kibana space gets a cus… --- ## [Metricbeat system.process.memory.rss.bytes is inflated](https://discuss.elastic.co/t/metricbeat-system-process-memory-rss-bytes-is-inflated/383523)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 2\ **Last updated:** [November 18, 2025, 10:27pm UTC](https://discuss.elastic.co/t/metricbeat-system-process-memory-rss-bytes-is-inflated/383523 "2025-11-18T22:27:42Z")
Metricbeat 8.5.3 is reporting rss.bytes almost three time of system installed memory. why is that? is there explanation about it? for example exactly at same time - system.memory.total = 540,665,892,864 and system.… --- ## [Handle batching just like Persistent Queue using the In-Memory Queue](https://discuss.elastic.co/t/handle-batching-just-like-persistent-queue-using-the-in-memory-queue/383453)
**Author:** [@Oscar\_Moyeda](https://discuss.elastic.co/u/Oscar_Moyeda)\ **Replies:** 6\ **Last updated:** [November 18, 2025, 7:14pm UTC](https://discuss.elastic.co/t/handle-batching-just-like-persistent-queue-using-the-in-memory-queue/383453 "2025-11-18T19:14:27Z")
Hi everyone. I am using Logstash Version: 9.1.0 I was debugging my output plugin and I found out that when using the default In-memory queue, Logstash would batch the events into smaller chunks of events. I have script… --- ## [Slow cluster recovery after node system updates](https://discuss.elastic.co/t/slow-cluster-recovery-after-node-system-updates/383462)
**Author:** [@ecology5913](https://discuss.elastic.co/u/ecology5913)\ **Replies:** 9\ **Last updated:** [November 18, 2025, 6:34pm UTC](https://discuss.elastic.co/t/slow-cluster-recovery-after-node-system-updates/383462 "2025-11-18T18:34:20Z")
I’ve been doing lifecycle management for ES clusters recently, from clusters with indices without replicas to clusters with 1TB shards. While the problems with those examples are obvious, I recently got more ‘normal‘ cl… --- ## [ILMs in cluster not performing rollover when conditions are met](https://discuss.elastic.co/t/ilms-in-cluster-not-performing-rollover-when-conditions-are-met/383369)
**Author:** [@Natalia\_Mellino](https://discuss.elastic.co/u/Natalia_Mellino)\ **Replies:** 9\ **Last updated:** [November 18, 2025, 6:30pm UTC](https://discuss.elastic.co/t/ilms-in-cluster-not-performing-rollover-when-conditions-are-met/383369 "2025-11-18T18:30:29Z")
Hello! We have an Elasticsearch cluster running 8.19.3 version (master, hot, cold and coordinating nodes) and we’re seeing some issues regarding our ILM policies. We are using data streams so we’ve configured several IL… --- ## [How to Resolve Filebeat File Reading and Ingest Target Warning Issues](https://discuss.elastic.co/t/how-to-resolve-filebeat-file-reading-and-ingest-target-warning-issues/383506)
**Author:** [@siva0030](https://discuss.elastic.co/u/siva0030)\ **Replies:** 1\ **Last updated:** [November 18, 2025, 4:36pm UTC](https://discuss.elastic.co/t/how-to-resolve-filebeat-file-reading-and-ingest-target-warning-issues/383506 "2025-11-18T16:36:33Z")
Hello Team, I am currently using the Filebeat configuration shown below. Recently, Filebeat has started logging frequent warning messages such as “\[points to an already known ingest target\]”. I noticed that if I do not… --- ## [Kibana rule for detecting lost applicattions](https://discuss.elastic.co/t/kibana-rule-for-detecting-lost-applicattions/383475)
**Author:** [@juanmgarciaf](https://discuss.elastic.co/u/juanmgarciaf)\ **Replies:** 2\ **Last updated:** [November 18, 2025, 10:50am UTC](https://discuss.elastic.co/t/kibana-rule-for-detecting-lost-applicattions/383475 "2025-11-18T10:50:34Z")
Hello, I'm trying to create a rule in Kibana (v 8.18.7) to detect when an application has suddenly stop to inject documents in Kibana. My idea is to create a Kibana rule for that (without use transforms and Machine Lear… --- ## [Unable to create CSV report in kibana despite having superuser-like privileges](https://discuss.elastic.co/t/unable-to-create-csv-report-in-kibana-despite-having-superuser-like-privileges/383479)
**Author:** [@Brumi](https://discuss.elastic.co/u/Brumi)\ **Replies:** 2\ **Last updated:** [November 18, 2025, 8:49am UTC](https://discuss.elastic.co/t/unable-to-create-csv-report-in-kibana-despite-having-superuser-like-privileges/383479 "2025-11-18T08:49:15Z")
Hello, I have an Elasticsearch+Kibana cluster set up (version 8.17.2). Regular users (given the editor) role cannot create CSV reports from Discover, while I (having the superuser role) can. I have been trying to figur… --- ## [Can I Safely Use Aliases if My Application Requires a Single Fixed Index Name for All Operations?](https://discuss.elastic.co/t/can-i-safely-use-aliases-if-my-application-requires-a-single-fixed-index-name-for-all-operations/383496)
**Author:** [@mike\_wills](https://discuss.elastic.co/u/mike_wills)\ **Replies:** 4\ **Last updated:** [November 17, 2025, 9:05pm UTC](https://discuss.elastic.co/t/can-i-safely-use-aliases-if-my-application-requires-a-single-fixed-index-name-for-all-operations/383496 "2025-11-17T21:05:31Z")
Hello everyone, I’m looking for some guidance on an aliasing challenge I’m running into. We’re using an in-house Java-based application as the frontend to our Elasticsearch cluster. I’ve been exploring index aliases t… --- ## [Where is fleet-server CA?](https://discuss.elastic.co/t/where-is-fleet-server-ca/383491)
**Author:** [@Blason](https://discuss.elastic.co/u/Blason)\ **Replies:** 1\ **Last updated:** [November 17, 2025, 5:55pm UTC](https://discuss.elastic.co/t/where-is-fleet-server-ca/383491 "2025-11-17T17:55:42Z")
Hello, I am bit confused about fleet-server ca file? where is that stored? I mean I installed the elasticstack and then installed the fleet server on same server. Generated certificate using instances.yml instances: … --- ## [What happened to the logs explorer?](https://discuss.elastic.co/t/what-happened-to-the-logs-explorer/372165)
**Author:** [@catn0b0t](https://discuss.elastic.co/u/catn0b0t)\ **Replies:** 11\ **Last updated:** [November 17, 2025, 12:16pm UTC](https://discuss.elastic.co/t/what-happened-to-the-logs-explorer/372165 "2025-11-17T12:16:07Z")
So actually just recently discovered the "Logs explorer" beta feature and was super impressed by it: the way it tagged services and showed the agentname in the message was really user friendly. Now today we upgraded to 8… --- ## [Migrate data to a new cluster with minimal interruption](https://discuss.elastic.co/t/migrate-data-to-a-new-cluster-with-minimal-interruption/383294)
**Author:** [@Ror](https://discuss.elastic.co/u/Ror)\ **Replies:** 7\ **Last updated:** [November 17, 2025, 11:04am UTC](https://discuss.elastic.co/t/migrate-data-to-a-new-cluster-with-minimal-interruption/383294 "2025-11-17T11:04:55Z")
Hi, I need to migrate multiple TB of data to a new cluster. Since this is production data, I’d like to avoid interruption as much as possible which can be tricky based on the volume of data. I have a simple infrastructu… --- ## [Looking for a reliably stable Metricbeat version for Windows Server 2008 / 2008 R2](https://discuss.elastic.co/t/looking-for-a-reliably-stable-metricbeat-version-for-windows-server-2008-2008-r2/383457)
**Author:** [@yago82](https://discuss.elastic.co/u/yago82)\ **Replies:** 4\ **Last updated:** [November 16, 2025, 6:33pm UTC](https://discuss.elastic.co/t/looking-for-a-reliably-stable-metricbeat-version-for-windows-server-2008-2008-r2/383457 "2025-11-16T18:33:19Z")
Hi everyone, I’m looking for advice on which Metricbeat version is known to run reliably on Windows Server 2003, Windows server 2008 and Windows Server 2008 R2. I’m fully aware that these operating systems are EOL and … --- ## [We do not use Scroll Query or PIT, What caused our ElasticSearch Cluster big OpenContexts Spike](https://discuss.elastic.co/t/we-do-not-use-scroll-query-or-pit-what-caused-our-elasticsearch-cluster-big-opencontexts-spike/383467)
**Author:** [@Thomas59](https://discuss.elastic.co/u/Thomas59)\ **Replies:** 4\ **Last updated:** [November 16, 2025, 5:35pm UTC](https://discuss.elastic.co/t/we-do-not-use-scroll-query-or-pit-what-caused-our-elasticsearch-cluster-big-opencontexts-spike/383467 "2025-11-16T17:35:10Z")
We experienced OpenContexts spikes in our Elasticsearch 6.8 environment. Since we’re not using Scroll Queries or Point in Time (PIT), I’d like to understand: What could be causing these OpenContexts spikes? Note: We h… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=28) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=30)