# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=32 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 33 --- ## ["precondition failed: EOF" error in apm-server logs on kubernetes](https://discuss.elastic.co/t/precondition-failed-eof-error-in-apm-server-logs-on-kubernetes/383196)
**Author:** [@amritansh](https://discuss.elastic.co/u/amritansh)\ **Replies:** 0\ **Last updated:** [November 4, 2025, 9:16am UTC](https://discuss.elastic.co/t/precondition-failed-eof-error-in-apm-server-logs-on-kubernetes/383196 "2025-11-04T09:16:57Z")
Hi I am facing a "precondition failed: EOF" error on my elastic setup on kubernetes while configuring elastic java apm agent. I checked the service connectivity and it seems to be fine. Attaching the apm-server logs … --- ## [Sql\_last\_value is updated only once](https://discuss.elastic.co/t/sql-last-value-is-updated-only-once/383194)
**Author:** [@chiel](https://discuss.elastic.co/u/chiel)\ **Replies:** 0\ **Last updated:** [November 4, 2025, 8:40am UTC](https://discuss.elastic.co/t/sql-last-value-is-updated-only-once/383194 "2025-11-04T08:40:29Z")
Hi, I’m using sql\_last\_value, last\_run\_metadata\_path, tracking\_column etc. for tracking the most recent value of a given column of my query. When I restart logstash, the value is updated correct in the tracking file (la… --- ## [How to reindex a data stream into another data stream?](https://discuss.elastic.co/t/how-to-reindex-a-data-stream-into-another-data-stream/383131)
**Author:** [@dot-mike](https://discuss.elastic.co/u/dot-mike)\ **Replies:** 2\ **Last updated:** [November 3, 2025, 2:02pm UTC](https://discuss.elastic.co/t/how-to-reindex-a-data-stream-into-another-data-stream/383131 "2025-11-03T14:02:06Z")
Hi community, I’m trying to reindex data from one data stream to another. Basically, I want data from this data stream logs-syslog.myproduct.logs to go into logs-syslog.myproduct\_logs-default The issue is that when th… --- ## [No sufficient capacity to run baai\_bge\_m3 model](https://discuss.elastic.co/t/no-sufficient-capacity-to-run-baai-bge-m3-model/382693)
**Author:** [@gueri](https://discuss.elastic.co/u/gueri)\ **Replies:** 4\ **Last updated:** [November 3, 2025, 1:37pm UTC](https://discuss.elastic.co/t/no-sufficient-capacity-to-run-baai-bge-m3-model/382693 "2025-11-03T13:37:30Z")
Hi, My ML configuration is 2 nodes with this configuration for each node : ml.allocated\_processors\_double 8.0 ml.machine\_memory 62.4GB ml.config\_version 12.0.0 ml.max\_jvm\_size 4GB ml.allocated\_processors 8 I alr… --- ## [Terms Aggregation vs Field Collapse for Search Suggestions at Scale (100K+ unique values)](https://discuss.elastic.co/t/terms-aggregation-vs-field-collapse-for-search-suggestions-at-scale-100k-unique-values/383182)
**Author:** [@Yousif\_Alneamy](https://discuss.elastic.co/u/Yousif_Alneamy)\ **Replies:** 0\ **Last updated:** [November 3, 2025, 11:54am UTC](https://discuss.elastic.co/t/terms-aggregation-vs-field-collapse-for-search-suggestions-at-scale-100k-unique-values/383182 "2025-11-03T11:54:55Z")
I'm building a search suggestion feature and need help choosing between terms aggregation and field collapse for my use case. My Dataset: 3 million items in the index 100,000+ unique product names (\`brandName\` in … --- ## [Cannot access Elasticsearch outside](https://discuss.elastic.co/t/cannot-access-elasticsearch-outside/383153)
**Author:** [@Peter\_Penzov](https://discuss.elastic.co/u/Peter_Penzov)\ **Replies:** 1\ **Last updated:** [November 2, 2025, 2:06am UTC](https://discuss.elastic.co/t/cannot-access-elasticsearch-outside/383153 "2025-11-02T02:06:35Z")
I have a Oracle Cloud(OCI) machine on which I installed ElastciSearch 9.2.0 but I can access it only internally. root@instance-20253022-1222:/var/log/elasticsearch# curl -k --user elastic:zzzzzzz -X GET "https://localho… --- ## [ElasticSearch IPv6](https://discuss.elastic.co/t/elasticsearch-ipv6/383150)
**Author:** [@Peter\_Penzov](https://discuss.elastic.co/u/Peter_Penzov)\ **Replies:** 1\ **Last updated:** [November 1, 2025, 5:22pm UTC](https://discuss.elastic.co/t/elasticsearch-ipv6/383150 "2025-11-01T17:22:55Z")
I installed Elasticsearch 9.2.0 on Ubuntu VN hosted on Oracle OCI cloud. But I cannot connect outside. After listening the listening ports on the VM I see this: sudo netstat -ntlp Active Internet connections (only serv… --- ## [How can I speed up tokenizing in elasticsearch?](https://discuss.elastic.co/t/how-can-i-speed-up-tokenizing-in-elasticsearch/383141)
**Author:** [@orlenkoda5](https://discuss.elastic.co/u/orlenkoda5)\ **Replies:** 2\ **Last updated:** [November 1, 2025, 10:01am UTC](https://discuss.elastic.co/t/how-can-i-speed-up-tokenizing-in-elasticsearch/383141 "2025-11-01T10:01:10Z")
I use elasticsearch in social network product to receive and search documents (posts) created by users but there is a problem with searching just created document, it appears in search results after a while (1-2 minutes)… --- ## [Default sort in template with json source](https://discuss.elastic.co/t/default-sort-in-template-with-json-source/374221)
**Author:** [@orlenkoda5](https://discuss.elastic.co/u/orlenkoda5)\ **Replies:** 2\ **Last updated:** [November 1, 2025, 8:55am UTC](https://discuss.elastic.co/t/default-sort-in-template-with-json-source/374221 "2025-11-01T08:55:58Z")
Hi everyone, I have a question with default sorting using template with json source query. Here it is: PUT \_scripts/multipurpose\_template { "script": { "lang": "mustache", "source": """{"sort": {{#toJson}}sort{{/toJ… --- ## [Convert UTC timestamp to local timezone](https://discuss.elastic.co/t/convert-utc-timestamp-to-local-timezone/383049)
**Author:** [@s.buksa](https://discuss.elastic.co/u/s.buksa)\ **Replies:** 1\ **Last updated:** [November 1, 2025, 5:30am UTC](https://discuss.elastic.co/t/convert-utc-timestamp-to-local-timezone/383049 "2025-11-01T05:30:16Z")
Hello, can someone help me to figure out how to convert UTC based timestamp in Kibana watcher to local timezone timestamp? When the watcher is executed, it has execution timestamp. It is very confusing as the timestamp… --- ## [Deleting users from elasticsearch but still appear on assignees](https://discuss.elastic.co/t/deleting-users-from-elasticsearch-but-still-appear-on-assignees/383116)
**Author:** [@naverlyn](https://discuss.elastic.co/u/naverlyn)\ **Replies:** 2\ **Last updated:** [November 1, 2025, 4:58am UTC](https://discuss.elastic.co/t/deleting-users-from-elasticsearch-but-still-appear-on-assignees/383116 "2025-11-01T04:58:00Z")
Hi, Is this intentional to delete users but still appear on assignees panel? For example, i have user named “hytam” on elasticsearch (I previously deleted already) but still appearing on assignees. In users page, there… --- ## [Adding registered\_domain processor on fortinet module - what's the best way to do this?](https://discuss.elastic.co/t/adding-registered-domain-processor-on-fortinet-module-whats-the-best-way-to-do-this/383130)
**Author:** [@artschooldropout](https://discuss.elastic.co/u/artschooldropout)\ **Replies:** 0\ **Last updated:** [October 31, 2025, 3:32pm UTC](https://discuss.elastic.co/t/adding-registered-domain-processor-on-fortinet-module-whats-the-best-way-to-do-this/383130 "2025-10-31T15:32:17Z")
I'm trying to add the registered\_domain processor to extract the registered domain from destination.address in my Fortinet firewall logs (e.g., extract d-zone.ca from ns2-firewall.d-zone.ca). Environment: Filebeat: 8… --- ## [Upgrade to 9.x](https://discuss.elastic.co/t/upgrade-to-9-x/383126)
**Author:** [@zen.xen](https://discuss.elastic.co/u/zen.xen)\ **Replies:** 6\ **Last updated:** [October 31, 2025, 2:21pm UTC](https://discuss.elastic.co/t/upgrade-to-9-x/383126 "2025-10-31T14:21:33Z")
Hello, I use ELK 8.8, 3-node cluster, I would like to upgrade to the newest version, is there an easy way to upgrade it? Perhaps there are 2 ways to upgrade but I don’t know which one will be better: a. build new clus… --- ## [Logstash output to Azure blobstorage](https://discuss.elastic.co/t/logstash-output-to-azure-blobstorage/383117)
**Author:** [@Kumar\_6](https://discuss.elastic.co/u/Kumar_6)\ **Replies:** 4\ **Last updated:** [October 31, 2025, 8:00am UTC](https://discuss.elastic.co/t/logstash-output-to-azure-blobstorage/383117 "2025-10-31T08:00:30Z")
Hi, everyone I have been looking over Internet in order to find a plugin for Logstash or FIlebeat in order to send data to azure blobstorage. i haven’t find it. as i see only s3 output is available. is azure blobstor… --- ## [ES|QL Basic Help](https://discuss.elastic.co/t/es-ql-basic-help/383107)
**Author:** [@erikg](https://discuss.elastic.co/u/erikg)\ **Replies:** 0\ **Last updated:** [October 30, 2025, 6:21pm UTC](https://discuss.elastic.co/t/es-ql-basic-help/383107 "2025-10-30T18:21:15Z")
Hello, I did a STATS count = COUNT\_DISTINCT(event.outcome) by host.name. And it works, the only issue I wish I could keep the metadata information about the host? Is there a way to do this?? --- ## [Elasticsearch snapshot to remote nas via nfs](https://discuss.elastic.co/t/elasticsearch-snapshot-to-remote-nas-via-nfs/382095)
**Author:** [@amine\_ghallab](https://discuss.elastic.co/u/amine_ghallab)\ **Replies:** 3\ **Last updated:** [October 30, 2025, 2:34pm UTC](https://discuss.elastic.co/t/elasticsearch-snapshot-to-remote-nas-via-nfs/382095 "2025-10-30T14:34:36Z")
Hello, I am running an Elasticsearch cluster on Kubernetes using the Elastic Cloud on Kubernetes (ECK) operator. Currently, my Elasticsearch data volume is reaching 80% usage, so I would like to configure a snapshot re… --- ## [Kibana Internal API's via Python Request](https://discuss.elastic.co/t/kibana-internal-apis-via-python-request/383073)
**Author:** [@6igwig](https://discuss.elastic.co/u/6igwig)\ **Replies:** 6\ **Last updated:** [October 30, 2025, 1:11pm UTC](https://discuss.elastic.co/t/kibana-internal-apis-via-python-request/383073 "2025-10-30T13:11:09Z")
Is it possible to interact with Kibana's internal API's via Python? Do I need to add something to the header of the request besides {'kbn-xsrf': 'true'} My specific use case is to be able to assign ML jobs to a specific… --- ## [Data view - how to delete](https://discuss.elastic.co/t/data-view-how-to-delete/383037)
**Author:** [@Marek\_Galbavy](https://discuss.elastic.co/u/Marek_Galbavy)\ **Replies:** 6\ **Last updated:** [October 30, 2025, 8:43am UTC](https://discuss.elastic.co/t/data-view-how-to-delete/383037 "2025-10-30T08:43:19Z")
Hi how can i delete data views which are created by elastic? eg Latest cloud…. etc if i delete data views which i dont want they are created again. thx --- ## [How to create a network utilization of inbound traffic and outbound like solarwind](https://discuss.elastic.co/t/how-to-create-a-network-utilization-of-inbound-traffic-and-outbound-like-solarwind/383078)
**Author:** [@Syed\_Yaseen\_Arham](https://discuss.elastic.co/u/Syed_Yaseen_Arham)\ **Replies:** 2\ **Last updated:** [October 30, 2025, 8:07am UTC](https://discuss.elastic.co/t/how-to-create-a-network-utilization-of-inbound-traffic-and-outbound-like-solarwind/383078 "2025-10-30T08:07:03Z")
we have field called ifInOctets which incremental field and its values in bytes. ifSpeed is in GBPs polling inverval 120 seconds My Formula ((counter\_rate(max(ifInOctets))\*8)/60)/average(ifSpeed) i tried to this but… --- ## [Fleet policy settings "Agent logging to files" & "Agent log level" does not work](https://discuss.elastic.co/t/fleet-policy-settings-agent-logging-to-files-agent-log-level-does-not-work/382982)
**Author:** [@SamehSaeed](https://discuss.elastic.co/u/SamehSaeed)\ **Replies:** 2\ **Last updated:** [October 30, 2025, 7:26am UTC](https://discuss.elastic.co/t/fleet-policy-settings-agent-logging-to-files-agent-log-level-does-not-work/382982 "2025-10-30T07:26:51Z")
Hello, I’m replacing Metricbeats with Elastic-Agent on multiple servers so i can manage them through UI, but I noticed that some options are not working like "Agent logging to files" & "Agent log level", you have to di… --- ## [Action\_request\_validation\_exception: \[action\_request\_validation\_exception\] Reason: Validation Failed: 1: id is missing](https://discuss.elastic.co/t/action-request-validation-exception-action-request-validation-exception-reason-validation-failed-1-id-is-missing/383039)
**Author:** [@junqiang\_ma](https://discuss.elastic.co/u/junqiang_ma)\ **Replies:** 4\ **Last updated:** [October 30, 2025, 12:57am UTC](https://discuss.elastic.co/t/action-request-validation-exception-action-request-validation-exception-reason-validation-failed-1-id-is-missing/383039 "2025-10-30T00:57:00Z")
We are using Elasticsearch 7.5.10 and indexing data into this cluster via a Node.js application (client version: "@elastic/elasticsearch": "7.17"). My index mapping is as follows: { "platform.fund.notices.test\_a": { … --- ## [Elastic elasticsearch-9.1.5-linux-x86\_64.tar.gz installation file issue](https://discuss.elastic.co/t/elastic-elasticsearch-9-1-5-linux-x86-64-tar-gz-installation-file-issue/382775)
**Author:** [@bodige.mahesh](https://discuss.elastic.co/u/bodige.mahesh)\ **Replies:** 5\ **Last updated:** [October 29, 2025, 10:35pm UTC](https://discuss.elastic.co/t/elastic-elasticsearch-9-1-5-linux-x86-64-tar-gz-installation-file-issue/382775 "2025-10-29T22:35:46Z")
HI Team, We are trying to install Elasticsearch 9.1.5 version on oel7 and jdk”21.0.7", while extracting the file, it is giving old date, could you please check and suggest if anything can be checked from ourend. tar: … --- ## [Is it possible to "warm up" indexes with low volume?](https://discuss.elastic.co/t/is-it-possible-to-warm-up-indexes-with-low-volume/382921)
**Author:** [@yeikel](https://discuss.elastic.co/u/yeikel)\ **Replies:** 8\ **Last updated:** [October 29, 2025, 10:19pm UTC](https://discuss.elastic.co/t/is-it-possible-to-warm-up-indexes-with-low-volume/382921 "2025-10-29T22:19:32Z")
I have an index with 9M documents, 1 shard and 1 replica that receives traffic very sporadically (less than 5 requests per hour). The ingestion rate of this index is less than 1/s A recurring pattern is that query respo… --- ## [Known Issue: Logstash 9.2.0 will not start with a Persistent Queue greater than 2GiB](https://discuss.elastic.co/t/known-issue-logstash-9-2-0-will-not-start-with-a-persistent-queue-greater-than-2gib/383079)
**Author:** [@RobBavey](https://discuss.elastic.co/u/RobBavey)\ **Replies:** 0\ **Last updated:** [October 29, 2025, 4:57pm UTC](https://discuss.elastic.co/t/known-issue-logstash-9-2-0-will-not-start-with-a-persistent-queue-greater-than-2gib/383079 "2025-10-29T16:57:59Z")
Logstash 9.2.0 has a known issue where Logstash will not start if a Persistent Queue has been defined with a size greater than 2 GiB. If you attempt to start Logstash 9.2.0 with any PQs where queue.max\_bytes has been se… --- ## [Is this a bug at DateHistogram aggregation?](https://discuss.elastic.co/t/is-this-a-bug-at-datehistogram-aggregation/383069)
**Author:** [@vicety](https://discuss.elastic.co/u/vicety)\ **Replies:** 0\ **Last updated:** [October 29, 2025, 10:20am UTC](https://discuss.elastic.co/t/is-this-a-bug-at-datehistogram-aggregation/383069 "2025-10-29T10:20:46Z")
I was reading the source code of histogram aggregation and found this. // server/src/main/java/org/elasticsearch/search/aggregations/bucket/histogram/InternalDateHistogram.java // (line 358) private void addEmptyB… --- ## [No logs in discovery](https://discuss.elastic.co/t/no-logs-in-discovery/383044)
**Author:** [@NeedHelp](https://discuss.elastic.co/u/NeedHelp)\ **Replies:** 1\ **Last updated:** [October 29, 2025, 4:39am UTC](https://discuss.elastic.co/t/no-logs-in-discovery/383044 "2025-10-29T04:39:09Z")
Hello, I have installed the following on three VMs: Elasticsearch: 192.168.101.9 Kibana: 192.168.101.7 OPNsense: 192.168.101.8 Next, I started the Fleet Server and installed it on Kibana (192.168.101.7). I t… --- ## [Problem using chain within httpjson input](https://discuss.elastic.co/t/problem-using-chain-within-httpjson-input/362893)
**Author:** [@nidworkx](https://discuss.elastic.co/u/nidworkx)\ **Replies:** 2\ **Last updated:** [October 29, 2025, 2:19am UTC](https://discuss.elastic.co/t/problem-using-chain-within-httpjson-input/362893 "2025-10-29T02:19:17Z")
Dear community, as soon as we configure a chain task within the httpjson input we receive the following error {"function":"github.com/elastic/beats/v7/x-pack/filebeat/input/httpjson.run.func1","file.name":"httpjson/inp… --- ## [Integrating fortigate firewall to elastic](https://discuss.elastic.co/t/integrating-fortigate-firewall-to-elastic/382949)
**Author:** [@phumlani](https://discuss.elastic.co/u/phumlani)\ **Replies:** 2\ **Last updated:** [October 28, 2025, 8:49pm UTC](https://discuss.elastic.co/t/integrating-fortigate-firewall-to-elastic/382949 "2025-10-28T20:49:52Z")
I am required to pull logs from the firewall(fortigate), and Office365. I have registered the application on microsoft AZURE for office365 and assigned permissions(Office365 management API(ActivityFeed.Read, ActivityFeed… --- ## [Running XGBoost Re-Rank Models in Elasticsearch Ingest Pipelines](https://discuss.elastic.co/t/running-xgboost-re-rank-models-in-elasticsearch-ingest-pipelines/383054)
**Author:** [@Shell\_Dias](https://discuss.elastic.co/u/Shell_Dias)\ **Replies:** 0\ **Last updated:** [October 28, 2025, 5:59pm UTC](https://discuss.elastic.co/t/running-xgboost-re-rank-models-in-elasticsearch-ingest-pipelines/383054 "2025-10-28T17:59:11Z")
How can I run re-ranking models within ingest pipelines to create a custom field containing the classification result? For example: I have an XGBoost model that uses the predict method. I’d like to apply it to each doc… --- ## [ECK Filebeat, ID duplicate for containers in the same namespace as Filebeat](https://discuss.elastic.co/t/eck-filebeat-id-duplicate-for-containers-in-the-same-namespace-as-filebeat/383016)
**Author:** [@kee8veiN](https://discuss.elastic.co/u/kee8veiN)\ **Replies:** 3\ **Last updated:** [October 28, 2025, 4:36pm UTC](https://discuss.elastic.co/t/eck-filebeat-id-duplicate-for-containers-in-the-same-namespace-as-filebeat/383016 "2025-10-28T16:36:11Z")
Hello team. I encountered a problem (ECK installation) with Beats/Filebeat (autodiscover Kubernetes mode), {"log.level":"error","@timestamp":"2025-10-27T11:34:59.854Z","log.logger":"input","log.origin":{"function":"git… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=31) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=33)