# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=34 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 35 --- ## [Kibana: Cannot update rule](https://discuss.elastic.co/t/kibana-cannot-update-rule/382845)
**Author:** [@Cristian\_Pereyra](https://discuss.elastic.co/u/Cristian_Pereyra)\ **Replies:** 2\ **Last updated:** [October 21, 2025, 11:54am UTC](https://discuss.elastic.co/t/kibana-cannot-update-rule/382845 "2025-10-21T11:54:55Z")
Hello everyone, I hope you're doing well. I'm creating a rule of type "Elasticsearch query" that uses a connector to a Python microservice, which then sends an email. The rule works fine. However, when I try to update … --- ## [Wrong process contacted by Metricbeat inside Docker container](https://discuss.elastic.co/t/wrong-process-contacted-by-metricbeat-inside-docker-container/382855)
**Author:** [@lucaCigarini](https://discuss.elastic.co/u/lucaCigarini)\ **Replies:** 0\ **Last updated:** [October 21, 2025, 7:29am UTC](https://discuss.elastic.co/t/wrong-process-contacted-by-metricbeat-inside-docker-container/382855 "2025-10-21T07:29:25Z")
Hello, recently I've upgraded a containerized version of Metricbeat from 9.1.3 to 9.1.5. Since then, unfortunately, I am experiencing errors while using the system module to fetch the host CPU usage.This is the docker-co… --- ## [Not able to access Lab in Strigo](https://discuss.elastic.co/t/not-able-to-access-lab-in-strigo/382835)
**Author:** [@Deepthi.KS](https://discuss.elastic.co/u/Deepthi.KS)\ **Replies:** 1\ **Last updated:** [October 21, 2025, 4:04am UTC](https://discuss.elastic.co/t/not-able-to-access-lab-in-strigo/382835 "2025-10-21T04:04:50Z")
I am not able to access lab in Elastic learning portal as the Strigo says I am logged in but not able to access. I need access as soon as possible as I dont have much time. HELP --- ## [Kibana download relevant files](https://discuss.elastic.co/t/kibana-download-relevant-files/382843)
**Author:** [@kucerp21](https://discuss.elastic.co/u/kucerp21)\ **Replies:** 8\ **Last updated:** [October 20, 2025, 10:07pm UTC](https://discuss.elastic.co/t/kibana-download-relevant-files/382843 "2025-10-20T22:07:01Z")
We use Kibana as a UI for searching and analyzing some data that we store in Elasticsearch. The individual data entries in Elasticsearch have S3 identifiers stored with them for relevant files. We need to enable our user… --- ## [Should filters be used for fields with high cardinality?](https://discuss.elastic.co/t/should-filters-be-used-for-fields-with-high-cardinality/382773)
**Author:** [@yeikel](https://discuss.elastic.co/u/yeikel)\ **Replies:** 1\ **Last updated:** [October 20, 2025, 8:34pm UTC](https://discuss.elastic.co/t/should-filters-be-used-for-fields-with-high-cardinality/382773 "2025-10-20T20:34:44Z")
Hi all, Should Elasticsearch query filters be applied to fields with high cardinality? From what I understand, filters are not scored, and they are cached. However, I’m wondering if it’s better to cache only filters o… --- ## [Predict Full Disk Usage Date](https://discuss.elastic.co/t/predict-full-disk-usage-date/382847)
**Author:** [@erikg](https://discuss.elastic.co/u/erikg)\ **Replies:** 0\ **Last updated:** [October 20, 2025, 8:32pm UTC](https://discuss.elastic.co/t/predict-full-disk-usage-date/382847 "2025-10-20T20:32:45Z")
Hello, How can I predict the date the disk will be full like this: I tried Elastic ML and used it to forecast, but I am not sure how to produce a date that can be added to a dashboard? --- ## [Elastic Agent 9.1.5 Fingerprint Processor Inconsistency - Breaks Log Integrity](https://discuss.elastic.co/t/elastic-agent-9-1-5-fingerprint-processor-inconsistency-breaks-log-integrity/382837)
**Author:** [@blakester205](https://discuss.elastic.co/u/blakester205)\ **Replies:** 2\ **Last updated:** [October 20, 2025, 5:09pm UTC](https://discuss.elastic.co/t/elastic-agent-9-1-5-fingerprint-processor-inconsistency-breaks-log-integrity/382837 "2025-10-20T17:09:44Z")
Elastic Agent 9.1.5 Fingerprint Processor Bug - Different Hashes for Identical Data Hey everyone, I've run into a pretty serious issue with the fingerprint processor in Elastic Agent 9.1.5 that I wanted to share with th… --- ## [ES|QL RLIKE](https://discuss.elastic.co/t/es-ql-rlike/382831)
**Author:** [@Balu](https://discuss.elastic.co/u/Balu)\ **Replies:** 2\ **Last updated:** [October 20, 2025, 1:24pm UTC](https://discuss.elastic.co/t/es-ql-rlike/382831 "2025-10-20T13:24:18Z")
We are a little confused here, playing with ES|QL and RLIKE in Discover:. This one works and returns paths like \\\\?\\C:\\Windows\\CSC\\v2.0.6\\namespace\\example.com\\DFS\\Homes\\User\\Downloads\\evil.exe | WHERE file.path RLIKE … --- ## [How to properly detect and handle transport errors in Elasticsearch logging (latest versions)](https://discuss.elastic.co/t/how-to-properly-detect-and-handle-transport-errors-in-elasticsearch-logging-latest-versions/382790)
**Author:** [@Guido\_hernan\_Gagliar](https://discuss.elastic.co/u/Guido_hernan_Gagliar)\ **Replies:** 2\ **Last updated:** [October 20, 2025, 11:28am UTC](https://discuss.elastic.co/t/how-to-properly-detect-and-handle-transport-errors-in-elasticsearch-logging-latest-versions/382790 "2025-10-20T11:28:49Z")
Hi everyone! :waving\_hand: I'm new to Elasticsearch and still learning, so I’d really appreciate some guidance. I’m trying to understand the best way to detect and handle transport errors when sending logs to Elasticse… --- ## [K8s Integration custom configuration](https://discuss.elastic.co/t/k8s-integration-custom-configuration/382832)
**Author:** [@M311ow](https://discuss.elastic.co/u/M311ow)\ **Replies:** 0\ **Last updated:** [October 20, 2025, 9:58am UTC](https://discuss.elastic.co/t/k8s-integration-custom-configuration/382832 "2025-10-20T09:58:51Z")
Hi All, How do I custom a configuration for Integration to support a old Filebeat configuration? Ex. - id: kube-logs-logstash-multiline data\_stream: dataset: kubernetes.container\_logs condition: … --- ## [Issue Enable SASL Authentication for Kafka Output in Filebeat Configuration](https://discuss.elastic.co/t/issue-enable-sasl-authentication-for-kafka-output-in-filebeat-configuration/382827)
**Author:** [@Thirupathi](https://discuss.elastic.co/u/Thirupathi)\ **Replies:** 1\ **Last updated:** [October 20, 2025, 7:00am UTC](https://discuss.elastic.co/t/issue-enable-sasl-authentication-for-kafka-output-in-filebeat-configuration/382827 "2025-10-20T07:00:06Z")
output.kafka: hosts: \["10.42.41.55:19094"\] topic: 'npc-raw-msg' key: '%{\[UUID\]}' codec.format: string: '%{\[message\]}' partition.round\_robin: reachable\_only: false required\_acks: 1 compression: gzip max\_message\_… --- ## [Error: rejected execution of coordinating operation \[coordinating\_and\_primary\_bytes=0, replica\_bytes=0, all\_bytes=0, coordinating\_operation\_bytes=130953165, max\_coordinating\_bytes=107374182\]"](https://discuss.elastic.co/t/error-rejected-execution-of-coordinating-operation-coordinating-and-primary-bytes-0-replica-bytes-0-all-bytes-0-coordinating-operation-bytes-130953165-max-coordinating-bytes-107374182/382813)
**Author:** [@Peng\_Dong](https://discuss.elastic.co/u/Peng_Dong)\ **Replies:** 0\ **Last updated:** [October 18, 2025, 9:14pm UTC](https://discuss.elastic.co/t/error-rejected-execution-of-coordinating-operation-coordinating-and-primary-bytes-0-replica-bytes-0-all-bytes-0-coordinating-operation-bytes-130953165-max-coordinating-bytes-107374182/382813 "2025-10-18T21:14:00Z")
Hi, was trying to re-index in elastic. Using the command below: POST \_reindex?wait\_for\_completion=false&requests\_per\_second=50 { "source": { "index": "prod-application-2025", "size": 200 }, "dest": { … --- ## [Problem with quotes in csv filter](https://discuss.elastic.co/t/problem-with-quotes-in-csv-filter/382802)
**Author:** [@parosio](https://discuss.elastic.co/u/parosio)\ **Replies:** 6\ **Last updated:** [October 18, 2025, 3:39pm UTC](https://discuss.elastic.co/t/problem-with-quotes-in-csv-filter/382802 "2025-10-18T15:39:46Z")
Hello, I'm having a problem with the csv plugin (seems the same problem as in this old (2018) article) Quoted strings within fields that do not contain the field separator are interpreted as fields, and this provokes a… --- ## [Elastic Agent: UDP package processing limits](https://discuss.elastic.co/t/elastic-agent-udp-package-processing-limits/382711)
**Author:** [@Phoenix2](https://discuss.elastic.co/u/Phoenix2)\ **Replies:** 5\ **Last updated:** [October 18, 2025, 1:55pm UTC](https://discuss.elastic.co/t/elastic-agent-udp-package-processing-limits/382711 "2025-10-18T13:55:53Z")
I am using the Elastic Agent with CEF integration, which receives and processes UDP data on a port. In the metrics for the cef integration, I see the value file-beat\_input.system\_packet\_drops . The integration discards … --- ## [ELK Stack upgrade to version 9.1.5](https://discuss.elastic.co/t/elk-stack-upgrade-to-version-9-1-5/382734)
**Author:** [@M311ow](https://discuss.elastic.co/u/M311ow)\ **Replies:** 5\ **Last updated:** [October 18, 2025, 8:09am UTC](https://discuss.elastic.co/t/elk-stack-upgrade-to-version-9-1-5/382734 "2025-10-18T08:09:06Z")
Hi All, We planned to upgrade the ELK Stack to the latest version (9.1.5) and encountered an issue where logs disappeared. After upgrading Elasticsearch and Kibana to version 9.1.5, the system continued to function. Ho… --- ## [Kubernetes Integration Policy Parser Configuration](https://discuss.elastic.co/t/kubernetes-integration-policy-parser-configuration/382766)
**Author:** [@M311ow](https://discuss.elastic.co/u/M311ow)\ **Replies:** 1\ **Last updated:** [October 18, 2025, 8:05am UTC](https://discuss.elastic.co/t/kubernetes-integration-policy-parser-configuration/382766 "2025-10-18T08:05:50Z")
Hello All, Regarding the Parser configuration of integration policy, if I have too many multiline pattern for each name. Let say, I have this below for each log | Agent Policy | Multiline Pattern | Targ… --- ## [Error while join a node, no subject alternative names](https://discuss.elastic.co/t/error-while-join-a-node-no-subject-alternative-names/382590)
**Author:** [@gbschenkel](https://discuss.elastic.co/u/gbschenkel)\ **Replies:** 4\ **Last updated:** [October 17, 2025, 3:38pm UTC](https://discuss.elastic.co/t/error-while-join-a-node-no-subject-alternative-names/382590 "2025-10-17T15:38:28Z")
I have a 6 node cluster, 3 masters, 3 data, and I am trying to add 4 more data nodes. The cluster was created using version 8.18.x and I have upgrade it to 9.1.5. It was installed using .RPM, but since I got liberation… --- ## [Strange/inaccurate deprecated role/index privilege error?](https://discuss.elastic.co/t/strange-inaccurate-deprecated-role-index-privilege-error/382807)
**Author:** [@delfuego](https://discuss.elastic.co/u/delfuego)\ **Replies:** 0\ **Last updated:** [October 17, 2025, 2:24pm UTC](https://discuss.elastic.co/t/strange-inaccurate-deprecated-role-index-privilege-error/382807 "2025-10-17T14:24:59Z")
I’m getting an error in my Elasticsearch logs telling me that one of my roles has index privileges covering an alias that don’t cover some of the pointed-to indices… but it doesn’t make a lot of sense, given that the con… --- ## [Delete\_by\_query vs client managed batches send to be deleted](https://discuss.elastic.co/t/delete-by-query-vs-client-managed-batches-send-to-be-deleted/382747)
**Author:** [@marekott](https://discuss.elastic.co/u/marekott)\ **Replies:** 4\ **Last updated:** [October 17, 2025, 10:46am UTC](https://discuss.elastic.co/t/delete-by-query-vs-client-managed-batches-send-to-be-deleted/382747 "2025-10-17T10:46:24Z")
Hi, first lets make some assumptions. We have an index containing 90 000 000 documents. Due to application logic we need to delete 30 000 000 docs (30% of data). Now I know that the best solution in terms of performance … --- ## [Best practice: Using Winston vs. native Elasticsearch client for logging?](https://discuss.elastic.co/t/best-practice-using-winston-vs-native-elasticsearch-client-for-logging/382788)
**Author:** [@Guido\_hernan\_Gagliar](https://discuss.elastic.co/u/Guido_hernan_Gagliar)\ **Replies:** 2\ **Last updated:** [October 30, 2025, 2:22pm UTC](https://discuss.elastic.co/t/best-practice-using-winston-vs-native-elasticsearch-client-for-logging/382788 "2025-10-30T14:22:10Z")
Hello everyone! Good morning, I'm new to Elasticsearch and still learning the basics. I have a question — I’ve been reading that maybe the best way to send logs to Elasticsearch is by using the native Elasticsearch cli… --- ## [Logstash pod failing to create pipeline due to error loading a ruby script](https://discuss.elastic.co/t/logstash-pod-failing-to-create-pipeline-due-to-error-loading-a-ruby-script/382757)
**Author:** [@lester\_slee](https://discuss.elastic.co/u/lester_slee)\ **Replies:** 7\ **Last updated:** [October 17, 2025, 1:47am UTC](https://discuss.elastic.co/t/logstash-pod-failing-to-create-pipeline-due-to-error-loading-a-ruby-script/382757 "2025-10-17T01:47:48Z")
I am seeing the below error in the logstash log when deploying an eck-logstash pod using Helm. The ruby script is added via a configMap and I have checked that the script has been mounted in the correct directory and has… --- ## [Alternatives or making search filtering more efficient](https://discuss.elastic.co/t/alternatives-or-making-search-filtering-more-efficient/382796)
**Author:** [@daveoap](https://discuss.elastic.co/u/daveoap)\ **Replies:** 1\ **Last updated:** [October 17, 2025, 1:44am UTC](https://discuss.elastic.co/t/alternatives-or-making-search-filtering-more-efficient/382796 "2025-10-17T01:44:10Z")
Hi, I have a query which uses function score and filters to modify the weight of the results so i can order the results based on which filter the doc matches. The issue is that in these filters i need to use a terms\_set… --- ## [Sum the sub buckets returned results in transform](https://discuss.elastic.co/t/sum-the-sub-buckets-returned-results-in-transform/382769)
**Author:** [@Hamza\_Rajput](https://discuss.elastic.co/u/Hamza_Rajput)\ **Replies:** 1\ **Last updated:** [October 16, 2025, 4:24pm UTC](https://discuss.elastic.co/t/sum-the-sub-buckets-returned-results-in-transform/382769 "2025-10-16T16:24:45Z")
Here is my transform preview: POST \_transform/\_preview { "source": { "index": ".ds-metrics-ap.clients-default-\*", "query": { "range": { "@timestamp": { "gte": "now/d", "lt": "… --- ## [MS Defender for Endpoint integration](https://discuss.elastic.co/t/ms-defender-for-endpoint-integration/381572)
**Author:** [@bbreer](https://discuss.elastic.co/u/bbreer)\ **Replies:** 2\ **Last updated:** [October 16, 2025, 3:17pm UTC](https://discuss.elastic.co/t/ms-defender-for-endpoint-integration/381572 "2025-10-16T15:17:38Z")
After upgrading to 8.19.2, the MS Defender for Endpoint integration said Reauthorization required. It worked fine before the upgrade. When I click on that integration and then click on the Assets tab, it says the ins… --- ## [From XML to an index](https://discuss.elastic.co/t/from-xml-to-an-index/382770)
**Author:** [@Cristina\_Marletta\_Li](https://discuss.elastic.co/u/Cristina_Marletta_Li)\ **Replies:** 1\ **Last updated:** [October 16, 2025, 11:34am UTC](https://discuss.elastic.co/t/from-xml-to-an-index/382770 "2025-10-16T11:34:46Z")
Hi all, what is the simplest and most automatic way to load an index from an XML file containing many entries? The file looks like this: \ \ **Author:** [@Elk\_huh](https://discuss.elastic.co/u/Elk_huh)\ **Replies:** 11\ **Last updated:** [October 16, 2025, 10:59am UTC](https://discuss.elastic.co/t/logtssh-grok-for-cisco-ise/382057 "2025-10-16T10:59:32Z") I have this Filter and its not parsing correctly , filter { match =\> { "message" =\> "\<%{INT:syslog\_pri}\>%{SYSLOGTIMESTAMP:syslog\_ts} %{HOSTNAME:host} %{WORD:module} %{INT:session\_id} %{INT:severity} %{INT:msg\_i… --- ## [Trouble with privileges about Kibana Actions](https://discuss.elastic.co/t/trouble-with-privileges-about-kibana-actions/382340)
**Author:** [@Alberto\_Russo](https://discuss.elastic.co/u/Alberto_Russo)\ **Replies:** 2\ **Last updated:** [October 16, 2025, 9:34am UTC](https://discuss.elastic.co/t/trouble-with-privileges-about-kibana-actions/382340 "2025-10-16T09:34:37Z")
I had install Security Onion in standalone mode, and I tryed to create a new rule in Kibana. But if I want to assign an action to this rule he said “Cannot create rule actions. You do not have “Read” permissions for the … --- ## [Elastic Fleet Agent stops processing TCP ingest, UDP continues](https://discuss.elastic.co/t/elastic-fleet-agent-stops-processing-tcp-ingest-udp-continues/382756)
**Author:** [@essinghigh](https://discuss.elastic.co/u/essinghigh)\ **Replies:** 3\ **Last updated:** [October 16, 2025, 7:02am UTC](https://discuss.elastic.co/t/elastic-fleet-agent-stops-processing-tcp-ingest-udp-continues/382756 "2025-10-16T07:02:01Z")
Hi All, I’m running an Elastic Agent (8.19.3) configuration with multiple Generic TCP and UDP inputs. Deployed onto Ubuntu Server. I’ve noticed that yesterday at around 10:30 (Oct 14th), the TCP ingest has stopped comp… --- ## [ES 8.19.5 encountered a NotEntitledException when attach to the ES process using Arthas](https://discuss.elastic.co/t/es-8-19-5-encountered-a-notentitledexception-when-attach-to-the-es-process-using-arthas/382742)
**Author:** [@ZLEternity](https://discuss.elastic.co/u/ZLEternity)\ **Replies:** 1\ **Last updated:** [October 15, 2025, 11:31pm UTC](https://discuss.elastic.co/t/es-8-19-5-encountered-a-notentitledexception-when-attach-to-the-es-process-using-arthas/382742 "2025-10-15T23:31:29Z")
elasticsearch8.19.5 use Entitlements module，Arthas fails to attach. Entitlement Policy Configuration (arthas-entitlement-policy.yaml): versions: 8.19.5 policy: ALL-UNNAMED: file: read: paths: … --- ## [Anomaly Detection - Can' Forecast on Influencer](https://discuss.elastic.co/t/anomaly-detection-can-forecast-on-influencer/382754)
**Author:** [@erikg](https://discuss.elastic.co/u/erikg)\ **Replies:** 1\ **Last updated:** [October 15, 2025, 9:58pm UTC](https://discuss.elastic.co/t/anomaly-detection-can-forecast-on-influencer/382754 "2025-10-15T21:58:19Z")
Hello, I created a anomaly detection job on memory utilization. I am using host.name as an influencer I see the forecast but when I run it doesn’t allow me to focus on an influencer? My goal: I am trying to predict… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=33) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=35)