# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=33 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 34 --- ## [ES|QL date histogram?](https://discuss.elastic.co/t/es-ql-date-histogram/383029)
**Author:** [@kmp](https://discuss.elastic.co/u/kmp)\ **Replies:** 4\ **Last updated:** [October 28, 2025, 3:32pm UTC](https://discuss.elastic.co/t/es-ql-date-histogram/383029 "2025-10-28T15:32:44Z")
I’m really trying to start to use ES|QL… About six months ago, I generated some queries (saved search sessions) and was wondering why (unlike the Classic search) there was no date histogram displayed. I was playing aro… --- ## [Remove corrupted shard](https://discuss.elastic.co/t/remove-corrupted-shard/383026)
**Author:** [@ALIT](https://discuss.elastic.co/u/ALIT)\ **Replies:** 3\ **Last updated:** [October 28, 2025, 2:04pm UTC](https://discuss.elastic.co/t/remove-corrupted-shard/383026 "2025-10-28T14:04:05Z")
Hi, we are using ES 8.19.2 on 30 data nodes with ~100TB data. We don’t have any snapshots. Shards per index is 30. Someone accidentally deleted some indices from filesystem of some of the nodes. (/data/indices/XYZ). Ye… --- ## [Which architecture is better for the Elasticsearch structure?](https://discuss.elastic.co/t/which-architecture-is-better-for-the-elasticsearch-structure/383008)
**Author:** [@celikbaris61](https://discuss.elastic.co/u/celikbaris61)\ **Replies:** 12\ **Last updated:** [October 28, 2025, 11:49am UTC](https://discuss.elastic.co/t/which-architecture-is-better-for-the-elasticsearch-structure/383008 "2025-10-28T11:49:10Z")
Hello everyone,I'm going to set up a cluster for Elasticsearch. My data size is approximately 50 TB and will continue to grow. I will primarily use it for search and cross-queries. My question is:I will be using virtual … --- ## [SASL\_PLAINTEXT AND SASL\_SSL ISSUE](https://discuss.elastic.co/t/sasl-plaintext-and-sasl-ssl-issue/383043)
**Author:** [@Thirupathi](https://discuss.elastic.co/u/Thirupathi)\ **Replies:** 0\ **Last updated:** [October 28, 2025, 10:32am UTC](https://discuss.elastic.co/t/sasl-plaintext-and-sasl-ssl-issue/383043 "2025-10-28T10:32:16Z")
Kafka Output Configuration (unified for both sources) output.kafka: hosts: \["xxxxxxx:19094"\] # Updated to use the SSL-enabled broker topic: 'npc-raw-msg' key: '%{\[UUID\]}' codec.format: string: '%{\[message\]}' parti… --- ## [Add 'process.args\_count' to Windows Security ingest pipeline](https://discuss.elastic.co/t/add-process-args-count-to-windows-security-ingest-pipeline/382903)
**Author:** [@elkn00b](https://discuss.elastic.co/u/elkn00b)\ **Replies:** 1\ **Last updated:** [October 28, 2025, 12:26am UTC](https://discuss.elastic.co/t/add-process-args-count-to-windows-security-ingest-pipeline/382903 "2025-10-28T00:26:45Z")
Hello All, We’ve had this fix in place for a while, but I noticed when checking open issues that an enhancement request existed to add process.args\_count to the Elastic Agent integrations. I’ve reviewed the code for bo… --- ## [Clear out old alerts](https://discuss.elastic.co/t/clear-out-old-alerts/383019)
**Author:** [@dot-mike](https://discuss.elastic.co/u/dot-mike)\ **Replies:** 2\ **Last updated:** [October 27, 2025, 3:54pm UTC](https://discuss.elastic.co/t/clear-out-old-alerts/383019 "2025-10-27T15:54:35Z")
Hi community, is it safe to remove the indicies .internal.alerts-observability.logs.alerts-default-\ or .internal.alerts-observability.metrics.alerts-default-\ to clear out old alerts? I want to start from scratc… --- ## [User access privilege on specific dashboard](https://discuss.elastic.co/t/user-access-privilege-on-specific-dashboard/383007)
**Author:** [@Kumar\_6](https://discuss.elastic.co/u/Kumar_6)\ **Replies:** 3\ **Last updated:** [October 27, 2025, 10:04am UTC](https://discuss.elastic.co/t/user-access-privilege-on-specific-dashboard/383007 "2025-10-27T10:04:38Z")
Hi Team, I would like to know if this feature is available in Elastic Kibana. I have four dashboards within a single space and want to provide access to different users. For example, one user should have access only to … --- ## [Could not pack/validate JSON response](https://discuss.elastic.co/t/could-not-pack-validate-json-response/382538)
**Author:** [@mahesh.hemke24](https://discuss.elastic.co/u/mahesh.hemke24)\ **Replies:** 3\ **Last updated:** [October 27, 2025, 7:19am UTC](https://discuss.elastic.co/t/could-not-pack-validate-json-response/382538 "2025-10-27T07:19:58Z")
Hi Team, Hope you are doing well.. I am getting below error in fluentbit.log for some indexes these logs/indexes are getting from application servers and we are managing this on our elasticsearch servers which consist … --- ## [Popular fields are not persistent or shared across users in Kibana (popularity count resets after reload)](https://discuss.elastic.co/t/popular-fields-are-not-persistent-or-shared-across-users-in-kibana-popularity-count-resets-after-reload/382677)
**Author:** [@shojiiii](https://discuss.elastic.co/u/shojiiii)\ **Replies:** 2\ **Last updated:** [October 27, 2025, 12:44am UTC](https://discuss.elastic.co/t/popular-fields-are-not-persistent-or-shared-across-users-in-kibana-popularity-count-resets-after-reload/382677 "2025-10-27T00:44:34Z")
Hello Elasticsearch community, I'm currently facing an issue where "popular fields" in Kibana are not persistent or consistent across users. When I reload the Discover view or log in as a different user, the popularity… --- ## [Extending Tomcat integration to collect additional JMX metrics (e.g., java\_lang\_OperatingSystem, oracle\_ucp\_admin)](https://discuss.elastic.co/t/extending-tomcat-integration-to-collect-additional-jmx-metrics-e-g-java-lang-operatingsystem-oracle-ucp-admin/382984)
**Author:** [@DIPTOPOL](https://discuss.elastic.co/u/DIPTOPOL)\ **Replies:** 0\ **Last updated:** [October 26, 2025, 3:07pm UTC](https://discuss.elastic.co/t/extending-tomcat-integration-to-collect-additional-jmx-metrics-e-g-java-lang-operatingsystem-oracle-ucp-admin/382984 "2025-10-26T15:07:28Z")
I am currently exploring the Tomcat integration using the Elastic Agent. From my observations, the default metrics collected through the JMX Prometheus exporter do not include all available data. For example, metric sets… --- ## [Agentic AI](https://discuss.elastic.co/t/agentic-ai/382945)
**Author:** [@Ankita\_Pachauri](https://discuss.elastic.co/u/Ankita_Pachauri)\ **Replies:** 1\ **Last updated:** [October 26, 2025, 1:12am UTC](https://discuss.elastic.co/t/agentic-ai/382945 "2025-10-26T01:12:43Z")
Hi Team, How can i leverage Agentic AI in elk stack? //Ankita --- ## [Kibana pod won't start with fleet enabled in hyphenated namespace](https://discuss.elastic.co/t/kibana-pod-wont-start-with-fleet-enabled-in-hyphenated-namespace/382863)
**Author:** [@smashley](https://discuss.elastic.co/u/smashley)\ **Replies:** 3\ **Last updated:** [October 25, 2025, 2:02am UTC](https://discuss.elastic.co/t/kibana-pod-wont-start-with-fleet-enabled-in-hyphenated-namespace/382863 "2025-10-25T02:02:12Z")
I have an existing ES cluster for logging/SIEM and wish to enable fleet/agent. The cluster is deployed via ECK on kubernetes in namespace ‘elasticsearch-enterprise’ to differentiate it from our basic licensed clusters. T… --- ## [Can ELSER generate Elasticsearch aggregation queries from natural-language input?](https://discuss.elastic.co/t/can-elser-generate-elasticsearch-aggregation-queries-from-natural-language-input/382962)
**Author:** [@Mohan\_Kumar\_Reddy\_Ak](https://discuss.elastic.co/u/Mohan_Kumar_Reddy_Ak)\ **Replies:** 0\ **Last updated:** [October 24, 2025, 6:10pm UTC](https://discuss.elastic.co/t/can-elser-generate-elasticsearch-aggregation-queries-from-natural-language-input/382962 "2025-10-24T18:10:53Z")
Hi team, I’m exploring a hybrid setup where LLMs (like GPT-4 or GPT-5) convert natural-language questions into Elasticsearch DSL queries — including aggregations such as avg, terms, and date\_histogram. However, I’m fac… --- ## [Ingest pipeline disable](https://discuss.elastic.co/t/ingest-pipeline-disable/379095)
**Author:** [@dot-mike](https://discuss.elastic.co/u/dot-mike)\ **Replies:** 2\ **Last updated:** [October 24, 2025, 11:58am UTC](https://discuss.elastic.co/t/ingest-pipeline-disable/379095 "2025-10-24T11:58:54Z")
Is there any possibility to temporarily disable an ingest pipeline during development? I.e for testing purposes. Thanks! --- ## [Kibana Visualization date\_histogram weekly start day: Sunday (Start of Week) in Dashboard](https://discuss.elastic.co/t/kibana-visualization-date-histogram-weekly-start-day-sunday-start-of-week-in-dashboard/382877)
**Author:** [@josh\_tran](https://discuss.elastic.co/u/josh_tran)\ **Replies:** 2\ **Last updated:** [October 24, 2025, 10:15am UTC](https://discuss.elastic.co/t/kibana-visualization-date-histogram-weekly-start-day-sunday-start-of-week-in-dashboard/382877 "2025-10-24T10:15:01Z")
I want weekly date\_histogram function to start on Sunday in Kibana dashboards, but they currently start on Monday (ISO week). I’m using Kibana Lens with Elasticsearch 9.0.4. I’ve tried adjusting dateFormat:dow settings t… --- ## [Problems with displaying the map in the dashboard](https://discuss.elastic.co/t/problems-with-displaying-the-map-in-the-dashboard/382771)
**Author:** [@Alberto\_Russo](https://discuss.elastic.co/u/Alberto_Russo)\ **Replies:** 11\ **Last updated:** [October 24, 2025, 3:06am UTC](https://discuss.elastic.co/t/problems-with-displaying-the-map-in-the-dashboard/382771 "2025-10-24T03:06:38Z")
I installed the official Elastic integration to collect 365 logs. Using the dashboard that provides the integration, I see nothing in the map section (see image). Has anyone encountered this issue? Or does anyone know ho… --- ## [Elastic Agent offline caching of events](https://discuss.elastic.co/t/elastic-agent-offline-caching-of-events/382925)
**Author:** [@craigothy](https://discuss.elastic.co/u/craigothy)\ **Replies:** 6\ **Last updated:** [October 23, 2025, 7:03pm UTC](https://discuss.elastic.co/t/elastic-agent-offline-caching-of-events/382925 "2025-10-23T19:03:31Z")
If we have a fleet agent installed and then that agent goes offline with no “line of sight” to the elasticsearch/fleet server, how are events handled that are captured through integrations. Say you had an ubuntu host wit… --- ## [Logstash - Translate Use custom MIBS (OEM - Oracle Enterprise Manager)](https://discuss.elastic.co/t/logstash-translate-use-custom-mibs-oem-oracle-enterprise-manager/382915)
**Author:** [@Tal1](https://discuss.elastic.co/u/Tal1)\ **Replies:** 8\ **Last updated:** [October 23, 2025, 4:18pm UTC](https://discuss.elastic.co/t/logstash-translate-use-custom-mibs-oem-oracle-enterprise-manager/382915 "2025-10-23T16:18:41Z")
Greetings Experts, I hope someone will be able to help me with that issue. I’ve installed Logstash version 9.1.4 on linux redhat machine (version 9.5). logstash is up and running on port 162 receiving snmp trap v3 - e… --- ## [Exporting logs from Azure storage account to Logstash using Filebeat in Kubernetes](https://discuss.elastic.co/t/exporting-logs-from-azure-storage-account-to-logstash-using-filebeat-in-kubernetes/382926)
**Author:** [@ramakoteswar](https://discuss.elastic.co/u/ramakoteswar)\ **Replies:** 0\ **Last updated:** [October 23, 2025, 2:45pm UTC](https://discuss.elastic.co/t/exporting-logs-from-azure-storage-account-to-logstash-using-filebeat-in-kubernetes/382926 "2025-10-23T14:45:20Z")
I wan to export the logs from Azure storage account to a Logstash. Seems like ELK doesn’t provide any plugin to export data from storage account to Logstash directly. They provide only Filebeat plugin. Because filebeat r… --- ## [Fatal error on Kibana startup - 8.19.5 - Windows Server 2025 - Error: Cannot find module '../series\_functions/undefined'](https://discuss.elastic.co/t/fatal-error-on-kibana-startup-8-19-5-windows-server-2025-error-cannot-find-module-series-functions-undefined/382920)
**Author:** [@markus](https://discuss.elastic.co/u/markus)\ **Replies:** 3\ **Last updated:** [October 23, 2025, 2:36pm UTC](https://discuss.elastic.co/t/fatal-error-on-kibana-startup-8-19-5-windows-server-2025-error-cannot-find-module-series-functions-undefined/382920 "2025-10-23T14:36:16Z")
I’m currently trying to upgrade my ELK Stack from 8.17.8 to 8.19.5. OS is Windows Server 2025 When starting Kibana it fails with the following error log: \[2025-10-23T15:19:48.349+02:00\]\[FATAL\]\[root\] Reason: Cannot fin… --- ## [\[search\_phase\_execution\_exception\] without a root reason](https://discuss.elastic.co/t/search-phase-execution-exception-without-a-root-reason/382922)
**Author:** [@al123od](https://discuss.elastic.co/u/al123od)\ **Replies:** 10\ **Last updated:** [October 23, 2025, 2:20pm UTC](https://discuss.elastic.co/t/search-phase-execution-exception-without-a-root-reason/382922 "2025-10-23T14:20:37Z")
Hello. I’m using Elasticsearch 9.1.3, access with java client (no security, almost all setting but cluster name are default). If to execute query\_string query with wrong syntax like GET test/\_search { "query": {… --- ## [Generate PDF puts timing in light grey](https://discuss.elastic.co/t/generate-pdf-puts-timing-in-light-grey/382887)
**Author:** [@jorism-ict](https://discuss.elastic.co/u/jorism-ict)\ **Replies:** 1\ **Last updated:** [October 23, 2025, 10:10am UTC](https://discuss.elastic.co/t/generate-pdf-puts-timing-in-light-grey/382887 "2025-10-23T10:10:54Z")
When creating a PDF Report from a dashboard, using “Generate PDF”, the PDF is generated, but the title of the report, including the selected timeframe (top -center of the generated pdf) is printed in light grey. We had c… --- ## [Dynamic dropdown not changing](https://discuss.elastic.co/t/dynamic-dropdown-not-changing/382735)
**Author:** [@Sanderb](https://discuss.elastic.co/u/Sanderb)\ **Replies:** 2\ **Last updated:** [October 23, 2025, 9:39am UTC](https://discuss.elastic.co/t/dynamic-dropdown-not-changing/382735 "2025-10-23T09:39:02Z")
Hi all, For my Kibana dashboard I want to have 2 dropdowns (of type ES|QL control), one with the API’s and another one with the endpoint corresponding to the API selected in the first dropdown. So for example, if API ==… --- ## [ERROR Connection marked as failed because the onConnect callback failed: could not connect to a compatible version of Elasticsearch: 404 Not Found:](https://discuss.elastic.co/t/error-connection-marked-as-failed-because-the-onconnect-callback-failed-could-not-connect-to-a-compatible-version-of-elasticsearch-404-not-found/382888)
**Author:** [@Rovsen\_Agayev](https://discuss.elastic.co/u/Rovsen_Agayev)\ **Replies:** 6\ **Last updated:** [October 23, 2025, 6:23am UTC](https://discuss.elastic.co/t/error-connection-marked-as-failed-because-the-onconnect-callback-failed-could-not-connect-to-a-compatible-version-of-elasticsearch-404-not-found/382888 "2025-10-23T06:23:26Z")
Filebeat 9.1.5 → Elasticsearch 9.1.5: /\_license?human=false returns 404 {}, Filebeat fails with “onConnect callback failed: 404 {}” Environment Elasticsearch: 9.1.5 (Deb package, build\_flavor: default) Kibana: 9.1.5 … --- ## [Compatibility of Elasticsearch 8.17.0 with Amazon Corretto 17 / 21](https://discuss.elastic.co/t/compatibility-of-elasticsearch-8-17-0-with-amazon-corretto-17-21/382858)
**Author:** [@babudurairaji](https://discuss.elastic.co/u/babudurairaji)\ **Replies:** 4\ **Last updated:** [October 23, 2025, 4:35am UTC](https://discuss.elastic.co/t/compatibility-of-elasticsearch-8-17-0-with-amazon-corretto-17-21/382858 "2025-10-23T04:35:28Z")
Hi, We are currently using Elasticsearch version 8.17.0 for data auditing purposes. We would like to know whether this version is compatible with Amazon Corretto 17 or 21, instead of using Oracle JDK 17. Could anyone p… --- ## [Peer Recovery does not respect indices.recovery.use\_snapshots=false or use\_for\_peer\_recovery=false - misleading documentation? (ES 8.13.4)](https://discuss.elastic.co/t/peer-recovery-does-not-respect-indices-recovery-use-snapshots-false-or-use-for-peer-recovery-false-misleading-documentation-es-8-13-4/382879)
**Author:** [@doitMLU](https://discuss.elastic.co/u/doitMLU)\ **Replies:** 5\ **Last updated:** [October 22, 2025, 4:18pm UTC](https://discuss.elastic.co/t/peer-recovery-does-not-respect-indices-recovery-use-snapshots-false-or-use-for-peer-recovery-false-misleading-documentation-es-8-13-4/382879 "2025-10-22T16:18:41Z")
Hi everyone, We recently had a big spike in S3 transfers and subsequently costs, which let me to troubleshoot the configuration of our elastic stack. I’ve found the cluster setting indices.recovery.use\_snapshots which d… --- ## [BUG: Ignore unmapped is not working in geo polygon query (ES 8.15.5)](https://discuss.elastic.co/t/bug-ignore-unmapped-is-not-working-in-geo-polygon-query-es-8-15-5/382878)
**Author:** [@ma\_br](https://discuss.elastic.co/u/ma_br)\ **Replies:** 3\ **Last updated:** [October 22, 2025, 3:27pm UTC](https://discuss.elastic.co/t/bug-ignore-unmapped-is-not-working-in-geo-polygon-query-es-8-15-5/382878 "2025-10-22T15:27:08Z")
my goal is to replace some deprecated geo\_polygon queries with geo\_shape queries. And because some of the geo shape can get big, i want to use indexed shapes old query: GET /entity\_\*/\_search { "query": { "nested"… --- ## [Configuring Elastic Agent to trust Fleet Server's certificate (eck-stack Helm Chart)](https://discuss.elastic.co/t/configuring-elastic-agent-to-trust-fleet-servers-certificate-eck-stack-helm-chart/382893)
**Author:** [@CitizenSteak](https://discuss.elastic.co/u/CitizenSteak)\ **Replies:** 0\ **Last updated:** [October 22, 2025, 2:55pm UTC](https://discuss.elastic.co/t/configuring-elastic-agent-to-trust-fleet-servers-certificate-eck-stack-helm-chart/382893 "2025-10-22T14:55:44Z")
I deployed eck-operator and I’m deploying eck-stack via the helm chart eck-stack-0.16.0 I’m getting an error in Elastic Agent logs : {"log.level":"error","@timestamp":"2025-10-22T13:11:03.233Z","log.origin":{"function"… --- ## [Elastic Agent to Logstash - how to access pipeline metadata](https://discuss.elastic.co/t/elastic-agent-to-logstash-how-to-access-pipeline-metadata/382874)
**Author:** [@username456](https://discuss.elastic.co/u/username456)\ **Replies:** 1\ **Last updated:** [October 22, 2025, 12:27pm UTC](https://discuss.elastic.co/t/elastic-agent-to-logstash-how-to-access-pipeline-metadata/382874 "2025-10-22T12:27:50Z")
We’re setting up an Elastic Agent → Logstash → Elasticsearch architecture to leverage Logstash’s buffering capabilities, which ingest nodes don’t provide. Our goal is to route all Elastic Agent traffic through Logstash. … --- ## [PagerDuty connector action breaks on \\n present in any data inserted with Mustache in custom\_details section](https://discuss.elastic.co/t/pagerduty-connector-action-breaks-on-n-present-in-any-data-inserted-with-mustache-in-custom-details-section/382806)
**Author:** [@tofijak](https://discuss.elastic.co/u/tofijak)\ **Replies:** 2\ **Last updated:** [October 21, 2025, 1:27pm UTC](https://discuss.elastic.co/t/pagerduty-connector-action-breaks-on-n-present-in-any-data-inserted-with-mustache-in-custom-details-section/382806 "2025-10-21T13:27:06Z")
Hi, We are using the PagerDuty connector and have a rule that triggers on any error logs. We want to be able to pass the errors messages in the custom\_details attribute, which is required to valid JSON. This is what we… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=32) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=34)