# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=30 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 31 --- ## [TLS handshake failure between Logstash-LB and log drops in Logstash server](https://discuss.elastic.co/t/tls-handshake-failure-between-logstash-lb-and-log-drops-in-logstash-server/383469)
**Author:** [@Subhanwita\_Mullick](https://discuss.elastic.co/u/Subhanwita_Mullick)\ **Replies:** 0\ **Last updated:** [November 16, 2025, 5:24pm UTC](https://discuss.elastic.co/t/tls-handshake-failure-between-logstash-lb-and-log-drops-in-logstash-server/383469 "2025-11-16T17:24:26Z")
My architecture is Sources –\> Load balancer –\> Logstash server (8 CPU, 16 GB) –\> Azure Sentinel. For the store logs, we just did an extensive traffic analysis as well. In the connectivity between LB and Logstash cluster… --- ## [Edit Distance \> 2 - Is It Really Unconfigurable?](https://discuss.elastic.co/t/edit-distance-2-is-it-really-unconfigurable/383458)
**Author:** [@Ilia](https://discuss.elastic.co/u/Ilia)\ **Replies:** 4\ **Last updated:** [October 20, 2026, 11:35pm UTC](https://discuss.elastic.co/t/edit-distance-2-is-it-really-unconfigurable/383458 "2026-10-20T23:35:10Z")
I'm facing the same problem mentioned in this thread - I need to use an edit distance greater than 2 for fuzzy searches, but Elasticsearch doesn't seem to support this. I understand the performance concerns with higher … --- ## [Rechearch project: integration the llm in elasticsearch for semantic search](https://discuss.elastic.co/t/rechearch-project-integration-the-llm-in-elasticsearch-for-semantic-search/383387)
**Author:** [@Yemboaro](https://discuss.elastic.co/u/Yemboaro)\ **Replies:** 1\ **Last updated:** [November 16, 2025, 5:17am UTC](https://discuss.elastic.co/t/rechearch-project-integration-the-llm-in-elasticsearch-for-semantic-search/383387 "2025-11-16T05:17:23Z")
Hello, I have a Master's 2 academic research project. I would like to research the integration of LLMs into Elasticsearch for semantic search. My question is, I wanted to ask you for guidelines on the research project … --- ## [No line breaks in strings within Data Lens Table](https://discuss.elastic.co/t/no-line-breaks-in-strings-within-data-lens-table/383445)
**Author:** [@edgarcloud](https://discuss.elastic.co/u/edgarcloud)\ **Replies:** 2\ **Last updated:** [November 15, 2025, 9:46am UTC](https://discuss.elastic.co/t/no-line-breaks-in-strings-within-data-lens-table/383445 "2025-11-15T09:46:18Z")
Hello everyone, I have a problem with line breaks in strings. In the Discovery view, the line breaks are displayed correctly. Unfortunately, in the Lens Data Table, the line breaks are not displayed. Everything is writte… --- ## [Transform creation error - request body is required](https://discuss.elastic.co/t/transform-creation-error-request-body-is-required/383394)
**Author:** [@dot-mike](https://discuss.elastic.co/u/dot-mike)\ **Replies:** 5\ **Last updated:** [November 15, 2025, 7:46am UTC](https://discuss.elastic.co/t/transform-creation-error-request-body-is-required/383394 "2025-11-15T07:46:37Z")
Hi community, I was looking to create a transform to show count of documents aggregated over unique syslog hostnames. So I proceeded to create the transform through the Kibana GUI and encountered an error: Internal Serv… --- ## [Create a canvas page per document](https://discuss.elastic.co/t/create-a-canvas-page-per-document/383455)
**Author:** [@jfsardon](https://discuss.elastic.co/u/jfsardon)\ **Replies:** 0\ **Last updated:** [November 14, 2025, 10:02pm UTC](https://discuss.elastic.co/t/create-a-canvas-page-per-document/383455 "2025-11-14T22:02:21Z")
I would like to create a Canvas with one page (\< 50 pages per canvas ) for each row (1 row = 1 agent name) of my datastream, all pages being based on the same template with by example a filter based on the agent name . I… --- ## [Not able to delete indices which are in closed state using ILM](https://discuss.elastic.co/t/not-able-to-delete-indices-which-are-in-closed-state-using-ilm/383443)
**Author:** [@Elastic04](https://discuss.elastic.co/u/Elastic04)\ **Replies:** 7\ **Last updated:** [November 14, 2025, 3:51pm UTC](https://discuss.elastic.co/t/not-able-to-delete-indices-which-are-in-closed-state-using-ilm/383443 "2025-11-14T15:51:02Z")
I am not able to delete indices which are in closed state using ILM. Is there any other way to do it? --- ## [Upgrading (Critical Deprecations...)](https://discuss.elastic.co/t/upgrading-critical-deprecations/383424)
**Author:** [@Hannah\_J\_Swystun](https://discuss.elastic.co/u/Hannah_J_Swystun)\ **Replies:** 6\ **Last updated:** [November 14, 2025, 1:27pm UTC](https://discuss.elastic.co/t/upgrading-critical-deprecations/383424 "2025-11-14T13:27:13Z")
Hello everybody, I would like to upgrade from v.8.17.0 to 8.19.4 do this criticals deprecation issues will block my upgrade please ? --- ## [Regarding FileBeats Configuration Issues](https://discuss.elastic.co/t/regarding-filebeats-configuration-issues/383358)
**Author:** [@RainZ](https://discuss.elastic.co/u/RainZ)\ **Replies:** 3\ **Last updated:** [November 14, 2025, 12:17pm UTC](https://discuss.elastic.co/t/regarding-filebeats-configuration-issues/383358 "2025-11-14T12:17:55Z")
I have set up an ELK server currently in the testing phase. I deployed a Filebeats instance on a Windows Server to collect logs from Application, Security, System, and Windows PowerShell. However, my Logstash is only cap… --- ## [Error connecting with local Package registry](https://discuss.elastic.co/t/error-connecting-with-local-package-registry/383442)
**Author:** [@Vishnu\_J](https://discuss.elastic.co/u/Vishnu_J)\ **Replies:** 0\ **Last updated:** [November 14, 2025, 10:59am UTC](https://discuss.elastic.co/t/error-connecting-with-local-package-registry/383442 "2025-11-14T10:59:10Z")
I am not able to connect Kibana with my locally deployed Elastic Package registry in an air gapped environment. I am getting this error in the kibana logs error: RegistryConnectionError: Error connecting to package regi… --- ## [ELK SAAS Cluster turns red or yellow sometimes .. need to know the reason](https://discuss.elastic.co/t/elk-saas-cluster-turns-red-or-yellow-sometimes-need-to-know-the-reason/376916)
**Author:** [@AKAM14](https://discuss.elastic.co/u/AKAM14)\ **Replies:** 6\ **Last updated:** [November 14, 2025, 9:05am UTC](https://discuss.elastic.co/t/elk-saas-cluster-turns-red-or-yellow-sometimes-need-to-know-the-reason/376916 "2025-11-14T09:05:12Z")
My SAAS Cluster goes to red or yellow every often. After sometime it becomes ok. sometimes i get a message for Replica shards is missing . where can i get the error for cluster going to red or yellow. and how to solve i… --- ## [Mixing collapsable sections with saved searches makes dashboard corrupt](https://discuss.elastic.co/t/mixing-collapsable-sections-with-saved-searches-makes-dashboard-corrupt/382420)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 4\ **Last updated:** [November 13, 2025, 12:38pm UTC](https://discuss.elastic.co/t/mixing-collapsable-sections-with-saved-searches-makes-dashboard-corrupt/382420 "2025-11-13T12:38:11Z")
Hello, Elastic Security Serverless. Mixing collapsable sections with saved searches makes dashboard corrupt. Once I add the Saved Search, it it not possible to resize and when you try you end up with the above situ… --- ## [Suggested approach for avoiding stale access token with ApiProxyConnector?](https://discuss.elastic.co/t/suggested-approach-for-avoiding-stale-access-token-with-apiproxyconnector/383392)
**Author:** [@mansn](https://discuss.elastic.co/u/mansn)\ **Replies:** 0\ **Last updated:** [November 12, 2025, 12:36pm UTC](https://discuss.elastic.co/t/suggested-approach-for-avoiding-stale-access-token-with-apiproxyconnector/383392 "2025-11-12T12:36:49Z")
Hi, I’m using @elastic/search-ui-elasticsearch-connector/api-proxy to create a connector for my backend (and the backend implements the ElasticsearchAPIConnector). My backend endpoints requires an Bearer token to be pas… --- ## [Cluster.routing.allocation.balance.write\_load on free license](https://discuss.elastic.co/t/cluster-routing-allocation-balance-write-load-on-free-license/383390)
**Author:** [@Hieu\_Pham](https://discuss.elastic.co/u/Hieu_Pham)\ **Replies:** 1\ **Last updated:** [November 12, 2025, 12:31pm UTC](https://discuss.elastic.co/t/cluster-routing-allocation-balance-write-load-on-free-license/383390 "2025-11-12T12:31:40Z")
Hi team! Does cluster.routing.allocation.balance.write\_load take any effect on free x-pack license? According to this page: Subscriptions | Elastic Stack Products & Support | Elastic, only Advanced Cluster Balancing has… --- ## [How to correctly report VM hostname when Elastic Agent runs in a Podman container](https://discuss.elastic.co/t/how-to-correctly-report-vm-hostname-when-elastic-agent-runs-in-a-podman-container/383336)
**Author:** [@vasek](https://discuss.elastic.co/u/vasek)\ **Replies:** 1\ **Last updated:** [November 12, 2025, 11:56am UTC](https://discuss.elastic.co/t/how-to-correctly-report-vm-hostname-when-elastic-agent-runs-in-a-podman-container/383336 "2025-11-12T11:56:23Z")
Hi everyone, I’m trying to collect package installation/removal events using the system\_audit.package stream on Rocky Linux 9.6. I’m running Elastic Agent 9.1.3 (elastic-agent-complete) inside a Podman container, manag… --- ## [Can't generate reports - Error: Unable to grant an API Key, request does not contain an authorization header](https://discuss.elastic.co/t/cant-generate-reports-error-unable-to-grant-an-api-key-request-does-not-contain-an-authorization-header/383385)
**Author:** [@stmx38](https://discuss.elastic.co/u/stmx38)\ **Replies:** 1\ **Last updated:** [November 12, 2025, 11:31am UTC](https://discuss.elastic.co/t/cant-generate-reports-error-unable-to-grant-an-api-key-request-does-not-contain-an-authorization-header/383385 "2025-11-12T11:31:50Z")
Hello, We recently observed that we can’t generate reports in Kibana and get the following error Unable to create report Unable to grant an API Key, request does not contain an authorization header We are using… --- ## [Elasticsearch-rest5-client isn't deployed to maven central repository](https://discuss.elastic.co/t/elasticsearch-rest5-client-isnt-deployed-to-maven-central-repository/383384)
**Author:** [@Ahmed\_Ashour](https://discuss.elastic.co/u/Ahmed_Ashour)\ **Replies:** 1\ **Last updated:** [November 12, 2025, 10:07am UTC](https://discuss.elastic.co/t/elasticsearch-rest5-client-isnt-deployed-to-maven-central-repository/383384 "2025-11-12T10:07:29Z")
It seems that elasticsearch-rest5-client 9.2.1 isn’t deployed to the maven central repository, although it is referenced by elasticsearch-java 9.2.1. Thanks. --- ## [Logstash TCP input SSL connection failing without closing due reason](https://discuss.elastic.co/t/logstash-tcp-input-ssl-connection-failing-without-closing-due-reason/382927)
**Author:** [@ThorNicolai](https://discuss.elastic.co/u/ThorNicolai)\ **Replies:** 1\ **Last updated:** [November 12, 2025, 8:46am UTC](https://discuss.elastic.co/t/logstash-tcp-input-ssl-connection-failing-without-closing-due-reason/382927 "2025-11-12T08:46:27Z")
Dear members of the forum, I have been struggling to get a connection working regarding incoming TCP SSL data. We are running an Ubuntu server with Logstash, we have multiple pipelines running, but this specific one wo… --- ## [Visualizing Weekly Data Changes in Kibana](https://discuss.elastic.co/t/visualizing-weekly-data-changes-in-kibana/383038)
**Author:** [@MaximeBon](https://discuss.elastic.co/u/MaximeBon)\ **Replies:** 3\ **Last updated:** [November 12, 2025, 7:36am UTC](https://discuss.elastic.co/t/visualizing-weekly-data-changes-in-kibana/383038 "2025-11-12T07:36:38Z")
Hello everyone, I am a cybersecurity engineer utilizing Elasticsearch to analyze vulnerabilities detected within my systems. Every week, I import a list of newly detected vulnerabilities into my Elasticsearch index, inc… --- ## [Unable to extract the elasticsearch install tar file](https://discuss.elastic.co/t/unable-to-extract-the-elasticsearch-install-tar-file/383376)
**Author:** [@vikramaddagulla](https://discuss.elastic.co/u/vikramaddagulla)\ **Replies:** 3\ **Last updated:** [November 12, 2025, 6:14am UTC](https://discuss.elastic.co/t/unable-to-extract-the-elasticsearch-install-tar-file/383376 "2025-11-12T06:14:45Z")
Hello I downloaded the elasticsearch installer file from the location : wget https://artifacts.elastic.co/downloads/elasticsearch/elasticsearch-9.2.1-linux-x86\_64.tar.gz When I try to extract this on my unix machine, I… --- ## [Preventing date\_time\_parse\_exception in ingest pipeline](https://discuss.elastic.co/t/preventing-date-time-parse-exception-in-ingest-pipeline/382707)
**Author:** [@marekott](https://discuss.elastic.co/u/marekott)\ **Replies:** 6\ **Last updated:** [November 11, 2025, 9:05pm UTC](https://discuss.elastic.co/t/preventing-date-time-parse-exception-in-ingest-pipeline/382707 "2025-11-11T21:05:00Z")
Hi, I have encountered date parsing related problem in my ingest pipeline. Full details can be found here: \[Ingest pipeline\] Occasionally ends with \`date\_time\_parse\_exception\` when pipeline is trying to store time withou… --- ## [Issues Getting Node to Rejoin Cluster after Renewing Certificates](https://discuss.elastic.co/t/issues-getting-node-to-rejoin-cluster-after-renewing-certificates/383296)
**Author:** [@sourcreamnormanbates](https://discuss.elastic.co/u/sourcreamnormanbates)\ **Replies:** 4\ **Last updated:** [November 11, 2025, 2:58pm UTC](https://discuss.elastic.co/t/issues-getting-node-to-rejoin-cluster-after-renewing-certificates/383296 "2025-11-11T14:58:16Z")
I’ve been working through the challenges of renewing my http and transport certificates on one of my nodes. Both were renewed using the same CA that was used prior. Although the elasticsearch service is now starting su… --- ## [Elastic Agent 9.1.3 – system\_audit.package on Rocky Linux 9.6 – no DNF install/remove events](https://discuss.elastic.co/t/elastic-agent-9-1-3-system-audit-package-on-rocky-linux-9-6-no-dnf-install-remove-events/383289)
**Author:** [@vasek](https://discuss.elastic.co/u/vasek)\ **Replies:** 9\ **Last updated:** [November 11, 2025, 1:28pm UTC](https://discuss.elastic.co/t/elastic-agent-9-1-3-system-audit-package-on-rocky-linux-9-6-no-dnf-install-remove-events/383289 "2025-11-11T13:28:10Z")
Hi, I’m trying to collect package installation/removal events using the system\_audit.package stream on Rocky Linux 9.6. I’m running Elastic Agent 9.1.3 (elastic-agent-complete) in a Podman container. image: \`\`docker.e… --- ## [How could I change the "agent.name" in a Elastic Agent instance? 8.18](https://discuss.elastic.co/t/how-could-i-change-the-agent-name-in-a-elastic-agent-instance-8-18/383271)
**Author:** [@SamuelSMendes](https://discuss.elastic.co/u/SamuelSMendes)\ **Replies:** 4\ **Last updated:** [November 11, 2025, 1:09pm UTC](https://discuss.elastic.co/t/how-could-i-change-the-agent-name-in-a-elastic-agent-instance-8-18/383271 "2025-11-11T13:09:57Z")
Once I’ve used the version 8.5 and we could overide the “agent.name” as well as add some tags in the documents generated by the service by editing the “mtricbeat.yaml” file. But as of now the document no longer exists an… --- ## [How to define dynamic templates for geo\_point in a custom Integration (Fleet + elastic-package)?](https://discuss.elastic.co/t/how-to-define-dynamic-templates-for-geo-point-in-a-custom-integration-fleet-elastic-package/382524)
**Author:** [@B\_Grimm](https://discuss.elastic.co/u/B_Grimm)\ **Replies:** 2\ **Last updated:** [November 11, 2025, 12:39pm UTC](https://discuss.elastic.co/t/how-to-define-dynamic-templates-for-geo-point-in-a-custom-integration-fleet-elastic-package/382524 "2025-11-11T12:39:40Z")
How to define dynamic templates for geo\_point in a custom Integration (Fleet + elastic-package)? Context I’m building a custom Elastic Integration with elastic-package (Fleet-managed data streams). Some events contain … --- ## [Logstash and Elasticsearch v9 – Compatibility Issue and Windows Support Removal](https://discuss.elastic.co/t/logstash-and-elasticsearch-v9-compatibility-issue-and-windows-support-removal/383331)
**Author:** [@Mahesh\_Kumar1](https://discuss.elastic.co/u/Mahesh_Kumar1)\ **Replies:** 3\ **Last updated:** [November 11, 2025, 10:30am UTC](https://discuss.elastic.co/t/logstash-and-elasticsearch-v9-compatibility-issue-and-windows-support-removal/383331 "2025-11-11T10:30:00Z")
Why was Windows Server 2016/2019 support removed in Elastic v9 even though they’re still supported by Microsoft? Hello Elastic Team, I’m trying to understand the reasoning behind the removal of Windows Server 2016 and W… --- ## [EntitlementBootstrap failure preventing startup: AttachNotSupportedException: Unable to open socket file](https://discuss.elastic.co/t/entitlementbootstrap-failure-preventing-startup-attachnotsupportedexception-unable-to-open-socket-file/382452)
**Author:** [@buitcj](https://discuss.elastic.co/u/buitcj)\ **Replies:** 58\ **Last updated:** [November 11, 2025, 8:46am UTC](https://discuss.elastic.co/t/entitlementbootstrap-failure-preventing-startup-attachnotsupportedexception-unable-to-open-socket-file/382452 "2025-11-11T08:46:41Z")
Several of our customer instances are hitting the following issue. Any idea what this is? It’s only happening in particular environments. I am currently trying to narrow down what is special about the environments and ho… --- ## [How to connect to cassandra mTLS from logstash to source the data using keystore and truststore files?](https://discuss.elastic.co/t/how-to-connect-to-cassandra-mtls-from-logstash-to-source-the-data-using-keystore-and-truststore-files/383347)
**Author:** [@Venkata9](https://discuss.elastic.co/u/Venkata9)\ **Replies:** 2\ **Last updated:** [November 11, 2025, 7:24am UTC](https://discuss.elastic.co/t/how-to-connect-to-cassandra-mtls-from-logstash-to-source-the-data-using-keystore-and-truststore-files/383347 "2025-11-11T07:24:37Z")
Hi Team, Need help with connecting to Cassandra with mTLS connectivity using keystore and truststore certificates to source the data from Cassandra. --- ## [Kibana 9.x internal APIs blocked – how to support iframe SSO login from external app](https://discuss.elastic.co/t/kibana-9-x-internal-apis-blocked-how-to-support-iframe-sso-login-from-external-app/383276)
**Author:** [@Shivam\_Mahajan](https://discuss.elastic.co/u/Shivam_Mahajan)\ **Replies:** 2\ **Last updated:** [November 11, 2025, 3:26am UTC](https://discuss.elastic.co/t/kibana-9-x-internal-apis-blocked-how-to-support-iframe-sso-login-from-external-app/383276 "2025-11-11T03:26:35Z")
We upgraded from Kibana 8.9.0 to 9.2.0 and our previous integration stopped working. Earlier, our external application (Application A) used the /internal/security/login endpoint to authenticate users programmatically and… --- ## [How to update fields that are not opened in the source document without affecting them](https://discuss.elastic.co/t/how-to-update-fields-that-are-not-opened-in-the-source-document-without-affecting-them/383175)
**Author:** [@S-Dragon0302](https://discuss.elastic.co/u/S-Dragon0302)\ **Replies:** 14\ **Last updated:** [November 11, 2025, 1:48am UTC](https://discuss.elastic.co/t/how-to-update-fields-that-are-not-opened-in-the-source-document-without-affecting-them/383175 "2025-11-11T01:48:32Z")
My template { "mappings":{"dynamic": "false","\_source":{"includes":\["a","b"\]},"properties":{"a":{"type": "keyword"},"b":{"type": "keyword"},"c":{"type": "keyword"}}}} PUT /your\_index\_name/\_doc/1 {"a": "value\_a","b": "… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=29) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=31)