# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=35 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 36 --- ## [Best option for bulk refresh: alias blue/green vs single-index + version filter](https://discuss.elastic.co/t/best-option-for-bulk-refresh-alias-blue-green-vs-single-index-version-filter/382441)
**Author:** [@alper](https://discuss.elastic.co/u/alper)\ **Replies:** 2\ **Last updated:** [October 15, 2025, 4:20pm UTC](https://discuss.elastic.co/t/best-option-for-bulk-refresh-alias-blue-green-vs-single-index-version-filter/382441 "2025-10-15T16:20:37Z")
Hi everyone, We develop an e-commerce search on Elasticsearch 8.x (Java client). Three indices: product, category, brand. ~50k products/day arrive via API (multiple times/day). We want to add/update docs; remove produc… --- ## [Kibana DevTools stuck on autocomplete when typing a simple GET](https://discuss.elastic.co/t/kibana-devtools-stuck-on-autocomplete-when-typing-a-simple-get/382631)
**Author:** [@PeterDK](https://discuss.elastic.co/u/PeterDK)\ **Replies:** 2\ **Last updated:** [October 15, 2025, 2:00pm UTC](https://discuss.elastic.co/t/kibana-devtools-stuck-on-autocomplete-when-typing-a-simple-get/382631 "2025-10-15T14:00:51Z")
Kibana version: 8.19.4 Tested on different browsers both in normal and private mode When you have already a lot of queries in dev tools (let’s say 10000 lines) and want to add another by simply typing GET the browser i… --- ## [504 ERROR when using utf-16le](https://discuss.elastic.co/t/504-error-when-using-utf-16le/382745)
**Author:** [@SIEMdeJong](https://discuss.elastic.co/u/SIEMdeJong)\ **Replies:** 0\ **Last updated:** [October 15, 2025, 12:51pm UTC](https://discuss.elastic.co/t/504-error-when-using-utf-16le/382745 "2025-10-15T12:51:10Z")
Hello, We use Elastic 9.1.4. We want to monitor deadlocks in Elastic. The method that consistently works for us is to enable DBCC TRACEON(1222, -1); on MSSQL. This causes the deadlocks to be written to the ERRORLOG. A… --- ## [Comparison of data between two indices](https://discuss.elastic.co/t/comparison-of-data-between-two-indices/382719)
**Author:** [@s.buksa](https://discuss.elastic.co/u/s.buksa)\ **Replies:** 3\ **Last updated:** [October 15, 2025, 11:22am UTC](https://discuss.elastic.co/t/comparison-of-data-between-two-indices/382719 "2025-10-15T11:22:14Z")
Hello, I'm looking for suggestions. I have two indices, for example: index-a-2025 index-b-2025 Both indices contain Beat host names on which they are deployed. I want to compare both indices to identify any missing … --- ## [Granting read access to ingest pipelines in Kibana](https://discuss.elastic.co/t/granting-read-access-to-ingest-pipelines-in-kibana/373065)
**Author:** [@cekay](https://discuss.elastic.co/u/cekay)\ **Replies:** 3\ **Last updated:** [October 15, 2025, 10:28am UTC](https://discuss.elastic.co/t/granting-read-access-to-ingest-pipelines-in-kibana/373065 "2025-10-15T10:28:13Z")
Hi, We have users that we want to be able to access the information about the configured ingest pipelines in Kibana. I gave them the cluster privilege read\_pipeline, but that does not help with seeing the pipelines in Ki… --- ## [Migrate Filebeat to use Elastic Agent as a log conllector](https://discuss.elastic.co/t/migrate-filebeat-to-use-elastic-agent-as-a-log-conllector/382473)
**Author:** [@M311ow](https://discuss.elastic.co/u/M311ow)\ **Replies:** 1\ **Last updated:** [October 15, 2025, 9:38am UTC](https://discuss.elastic.co/t/migrate-filebeat-to-use-elastic-agent-as-a-log-conllector/382473 "2025-10-15T09:38:19Z")
Hi All, We currently have Filebeat running on our cluster via Helm, and we plan to migrate to Elastic Agent as our log collector. Our goal is to decommission Filebeat once Elastic Agent can fully replicate its log colle… --- ## [Logs ingestion](https://discuss.elastic.co/t/logs-ingestion/382715)
**Author:** [@eirc](https://discuss.elastic.co/u/eirc)\ **Replies:** 1\ **Last updated:** [October 15, 2025, 6:55am UTC](https://discuss.elastic.co/t/logs-ingestion/382715 "2025-10-15T06:55:51Z")
I’m trying to setup logs ingestion for multiple systems. I have installed filebeat on all hosts and pushed all system logs with journald and container logs with a filestream for \`/var/lib/docker/containers/\*/\*.log\`. Ever… --- ## [Share URL long or short depending on role?](https://discuss.elastic.co/t/share-url-long-or-short-depending-on-role/382697)
**Author:** [@Balu](https://discuss.elastic.co/u/Balu)\ **Replies:** 1\ **Last updated:** [October 15, 2025, 6:38am UTC](https://discuss.elastic.co/t/share-url-long-or-short-depending-on-role/382697 "2025-10-15T06:38:35Z")
Hey, our users noticed that the URLs you can get using the share feature (in Discover for example) are short for some users and long for others This seems to depend on the assigned roles of the users. Our superusers w… --- ## [I need to monitor bigfix relay and display as a block green if running and red is stopped or not running](https://discuss.elastic.co/t/i-need-to-monitor-bigfix-relay-and-display-as-a-block-green-if-running-and-red-is-stopped-or-not-running/382706)
**Author:** [@Prashant\_Kadam](https://discuss.elastic.co/u/Prashant_Kadam)\ **Replies:** 1\ **Last updated:** [October 15, 2025, 6:02am UTC](https://discuss.elastic.co/t/i-need-to-monitor-bigfix-relay-and-display-as-a-block-green-if-running-and-red-is-stopped-or-not-running/382706 "2025-10-15T06:02:44Z")
I need to monitor bigfix relay and display as a block green if running and red is stopped or not running --- ## [Azure - Entra ID - SIgnin Logs Stopped](https://discuss.elastic.co/t/azure-entra-id-signin-logs-stopped/382718)
**Author:** [@yachee](https://discuss.elastic.co/u/yachee)\ **Replies:** 0\ **Last updated:** [October 14, 2025, 6:41pm UTC](https://discuss.elastic.co/t/azure-entra-id-signin-logs-stopped/382718 "2025-10-14T18:41:03Z")
Hi, Our sign-in logs from Azure suddenly stopped 3 months ago. We did it twice by deleting and resetting the integration, but it could bring it back for 2 days, then it would stop again. We are still receiving the audit… --- ## [Elastic Logging - How to Trace a Request Across Multiple Remote Clusters (v8.10.2)](https://discuss.elastic.co/t/elastic-logging-how-to-trace-a-request-across-multiple-remote-clusters-v8-10-2/382634)
**Author:** [@sakshijain](https://discuss.elastic.co/u/sakshijain)\ **Replies:** 1\ **Last updated:** [October 14, 2025, 2:10pm UTC](https://discuss.elastic.co/t/elastic-logging-how-to-trace-a-request-across-multiple-remote-clusters-v8-10-2/382634 "2025-10-14T14:10:28Z")
We have a cross-cluster setup with the following components: 2 coordinator clusters Multiple remote (data) clusters We’ve enabled slow logs on the remote clusters to capture details such as: Search execution … --- ## [What version of elasticsearch-hadoop should I be using with spark 4.0.1](https://discuss.elastic.co/t/what-version-of-elasticsearch-hadoop-should-i-be-using-with-spark-4-0-1/382679)
**Author:** [@Thomas\_Butterfield](https://discuss.elastic.co/u/Thomas_Butterfield)\ **Replies:** 1\ **Last updated:** [October 14, 2025, 1:13pm UTC](https://discuss.elastic.co/t/what-version-of-elasticsearch-hadoop-should-i-be-using-with-spark-4-0-1/382679 "2025-10-14T13:13:53Z")
Using Scala version 2.13.16 (OpenJDK 64-Bit Server VM, Java 17.0.16) I'm getting this error when writing to an ES 8.19.3 cluster: java.lang.NoSuchMethodError: 'org.apache.spark.sql.SQLContext org.apache.spark.sql.Datase… --- ## [Alert: Oracle JRE 25 (jrt-fs.jar) Detected in Official Elasticsearch 8.19.5 Docker Image](https://discuss.elastic.co/t/alert-oracle-jre-25-jrt-fs-jar-detected-in-official-elasticsearch-8-19-5-docker-image/382691)
**Author:** [@Elex\_Edward](https://discuss.elastic.co/u/Elex_Edward)\ **Replies:** 2\ **Last updated:** [October 14, 2025, 12:57pm UTC](https://discuss.elastic.co/t/alert-oracle-jre-25-jrt-fs-jar-detected-in-official-elasticsearch-8-19-5-docker-image/382691 "2025-10-14T12:57:46Z")
After a recent internal security review, we received an alert regarding the official Elasticsearch 8.19.5 Docker image. The report indicates the presence of a vulnerable component — Oracle JRE 25 (jrt-fs.jar). Here are … --- ## [\[9.1.4\] Elastic-agent doesn't gather tls info with synthetics integration](https://discuss.elastic.co/t/9-1-4-elastic-agent-doesnt-gather-tls-info-with-synthetics-integration/382699)
**Author:** [@Dth\_Revan](https://discuss.elastic.co/u/Dth_Revan)\ **Replies:** 0\ **Last updated:** [October 14, 2025, 11:29am UTC](https://discuss.elastic.co/t/9-1-4-elastic-agent-doesnt-gather-tls-info-with-synthetics-integration/382699 "2025-10-14T11:29:31Z")
Hello! Recently I updated my cluster and all of the Elastic-agents from 8.17.4 - - → 8.19.4 - - → 9.1.4 (and then updated a couple of agents to version 9.1.5 just for test) and it appeared that they stopped gathering (a… --- ## [Unable to view any data in Kibana maps](https://discuss.elastic.co/t/unable-to-view-any-data-in-kibana-maps/382642)
**Author:** [@ramenon](https://discuss.elastic.co/u/ramenon)\ **Replies:** 2\ **Last updated:** [October 14, 2025, 8:05am UTC](https://discuss.elastic.co/t/unable-to-view-any-data-in-kibana-maps/382642 "2025-10-14T08:05:14Z")
Hello , I am unable to view any datapoints in Kibana maps from my index : - I see from the mappings that it is marked as Geopoint "clientgeoip": { "properties": { "geo": { "prope… --- ## [Fleet-server FAILED Error - x509 : certificate signed by unknown authority](https://discuss.elastic.co/t/fleet-server-failed-error-x509-certificate-signed-by-unknown-authority/382673)
**Author:** [@Mauro\_929292](https://discuss.elastic.co/u/Mauro_929292)\ **Replies:** 0\ **Last updated:** [October 14, 2025, 7:49am UTC](https://discuss.elastic.co/t/fleet-server-failed-error-x509-certificate-signed-by-unknown-authority/382673 "2025-10-14T07:49:09Z")
I'm having a problem with fleet-server on elastic-agent. My certificate has expired, but I can't figure out where to update the new certificates I created, which are trusted by a domain CA. Can you help me?? --- ## [APM for third party Apps](https://discuss.elastic.co/t/apm-for-third-party-apps/382622)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 3\ **Last updated:** [October 14, 2025, 6:25am UTC](https://discuss.elastic.co/t/apm-for-third-party-apps/382622 "2025-10-14T06:25:28Z")
Hello Everyone, I would like to ask that APM is feasible for COTS(Commercial Off-The-Shelf)applications like Microsoft Office, customer relationship management (CRM) platforms such as Salesforce, design software like A… --- ## [Accurate and relevant user-defined sorting](https://discuss.elastic.co/t/accurate-and-relevant-user-defined-sorting/382611)
**Author:** [@GalacticHypernova](https://discuss.elastic.co/u/GalacticHypernova)\ **Replies:** 1\ **Last updated:** [October 13, 2025, 8:20pm UTC](https://discuss.elastic.co/t/accurate-and-relevant-user-defined-sorting/382611 "2025-10-13T20:20:19Z")
Hey guys, quite new to ES. I have an app that supports user-provided queries, user-provided filters, and user-provided sorts. The query is fine in multi\_match, and filters are good in the filter query. My main issue is … --- ## [MISP → Filebeat → Elasticsearch (9210) : Data not visible in Kibana](https://discuss.elastic.co/t/misp-filebeat-elasticsearch-9210-data-not-visible-in-kibana/382646)
**Author:** [@omar\_embarak](https://discuss.elastic.co/u/omar_embarak)\ **Replies:** 0\ **Last updated:** [October 13, 2025, 4:27pm UTC](https://discuss.elastic.co/t/misp-filebeat-elasticsearch-9210-data-not-visible-in-kibana/382646 "2025-10-13T16:27:54Z")
Hi everyone, I'm currently integrating MISP with the Elastic Stack (ELK 8.17.3) and need some help figuring out why data isn't showing up in Kibana. Setup overview: MISP server running Filebeat. Filebeat sends data d… --- ## [Elastic Agent plugin Logs PANW (SYSLOG) reports wrong traffic direction](https://discuss.elastic.co/t/elastic-agent-plugin-logs-panw-syslog-reports-wrong-traffic-direction/382637)
**Author:** [@dmgeurts-mm](https://discuss.elastic.co/u/dmgeurts-mm)\ **Replies:** 2\ **Last updated:** [October 13, 2025, 3:18pm UTC](https://discuss.elastic.co/t/elastic-agent-plugin-logs-panw-syslog-reports-wrong-traffic-direction/382637 "2025-10-13T15:18:06Z")
network.direction is logged wrong despite configuring the zones under advanced settings in the Agent Policy. In fact the direction appears random as I can find traffic logged with a source zone of WAN and a target zone o… --- ## [Phrase query, using shingles(index\_phrases) results in inconsistent results with the default query method](https://discuss.elastic.co/t/phrase-query-using-shingles-index-phrases-results-in-inconsistent-results-with-the-default-query-method/382625)
**Author:** [@fangqingsong](https://discuss.elastic.co/u/fangqingsong)\ **Replies:** 1\ **Last updated:** [October 13, 2025, 12:49pm UTC](https://discuss.elastic.co/t/phrase-query-using-shingles-index-phrases-results-in-inconsistent-results-with-the-default-query-method/382625 "2025-10-13T12:49:02Z")
ES 9.1.3, geonames datasets, index name is “field-name-index-phrase-geonames” health status index uuid pri rep docs.count docs.deleted store.size pri.store.size dataset.size … --- ## [LogsDB optimized routing](https://discuss.elastic.co/t/logsdb-optimized-routing/382278)
**Author:** [@lduvnjak](https://discuss.elastic.co/u/lduvnjak)\ **Replies:** 8\ **Last updated:** [October 13, 2025, 12:36pm UTC](https://discuss.elastic.co/t/logsdb-optimized-routing/382278 "2025-10-13T12:36:42Z")
Hi Everyone, I have a couple of questions regarding LogsDB, and more specifically optimized routing. It is generally recommended to use low cardinality fields for LogsDB index sorting, but there are no pointers on what… --- ## [Unable to start metricbeat](https://discuss.elastic.co/t/unable-to-start-metricbeat/382633)
**Author:** [@vikramaddagulla](https://discuss.elastic.co/u/vikramaddagulla)\ **Replies:** 0\ **Last updated:** [October 13, 2025, 12:21pm UTC](https://discuss.elastic.co/t/unable-to-start-metricbeat/382633 "2025-10-13T12:21:09Z")
I am trying to start up metricbeat and I see the below error "log.level":"debug","@timestamptimestamp":"2025-10-10T08:00:01.260-0400","log.logger":"system.process","log.origin":{"function":"\`\`github.com/elastic/elastic-… --- ## [Filebeat with SASL authentication](https://discuss.elastic.co/t/filebeat-with-sasl-authentication/382616)
**Author:** [@Thirupathi](https://discuss.elastic.co/u/Thirupathi)\ **Replies:** 1\ **Last updated:** [October 13, 2025, 11:06am UTC](https://discuss.elastic.co/t/filebeat-with-sasl-authentication/382616 "2025-10-13T11:06:22Z")
{"log.level":"debug","@timestamptimestamp":"2025-10-09T05:53:58.464-0400","log.logger":"registrar","log.origin":{"function":"github.com/elastic/beats/v7/filebeat/registrar.(\*Registrar).commitStateUpdates","file.name":"re… --- ## [Dense\_vector slow in ES 9.1.3](https://discuss.elastic.co/t/dense-vector-slow-in-es-9-1-3/381855)
**Author:** [@glund0](https://discuss.elastic.co/u/glund0)\ **Replies:** 16\ **Last updated:** [October 13, 2025, 10:42am UTC](https://discuss.elastic.co/t/dense-vector-slow-in-es-9-1-3/381855 "2025-10-13T10:42:49Z")
We’ve been using ES 8.9.0 and are looking to upgrade, so I started testing performance with 9.1.3 and found it to be very slow. So, I went back to 8.19.3 and found that it’s performance is fine. But we’d like to not be… --- ## [/etc/elasticsearch/trust.yml is mandatory and optional. I am using it On-Premises](https://discuss.elastic.co/t/etc-elasticsearch-trust-yml-is-mandatory-and-optional-i-am-using-it-on-premises/382591)
**Author:** [@Varinder](https://discuss.elastic.co/u/Varinder)\ **Replies:** 6\ **Last updated:** [October 11, 2025, 7:04pm UTC](https://discuss.elastic.co/t/etc-elasticsearch-trust-yml-is-mandatory-and-optional-i-am-using-it-on-premises/382591 "2025-10-11T19:04:50Z")
Hi Folks, Thanks to all members for their help and support. I need opinion for both Single Node and Cluster in Elasticsearch. “Is not using the /etc/elasticsearch/trust.yml file in /etc/elasticsearch/elasticsearch.yml … --- ## [Nagios & Elastic Stack Project Student](https://discuss.elastic.co/t/nagios-elastic-stack-project-student/382596)
**Author:** [@Isy212](https://discuss.elastic.co/u/Isy212)\ **Replies:** 2\ **Last updated:** [October 11, 2025, 4:27pm UTC](https://discuss.elastic.co/t/nagios-elastic-stack-project-student/382596 "2025-10-11T16:27:44Z")
Hi there! Hope you are all well, I need some advice and information regarding a project I am working on trying to bridge both Nagios and Elastic Stack. I am quite new to elastic stack and was wondering if there is a way … --- ## [Do we really need these cipher settings in elasticsearch.yml file according to ES official documentaion i version 8.19.3](https://discuss.elastic.co/t/do-we-really-need-these-cipher-settings-in-elasticsearch-yml-file-according-to-es-official-documentaion-i-version-8-19-3/382549)
**Author:** [@Varinder](https://discuss.elastic.co/u/Varinder)\ **Replies:** 2\ **Last updated:** [October 10, 2025, 5:31pm UTC](https://discuss.elastic.co/t/do-we-really-need-these-cipher-settings-in-elasticsearch-yml-file-according-to-es-official-documentaion-i-version-8-19-3/382549 "2025-10-10T17:31:23Z")
set\_yaml "${elasticsearch\_conf}" "\[xpack.security.transport.ssl.cipher\_suites\].\[0\]" "TLS\_ECDHE\_RSA\_WITH\_AES\_256\_GCM\_SHA384" && set\_yaml "${elasticsearch\_conf}" "\[xpack.security.transport.ssl.cipher\_suites\].\[1\]" "TLS\_ECD… --- ## [Using fluent lambda expressions with a scroll search request](https://discuss.elastic.co/t/using-fluent-lambda-expressions-with-a-scroll-search-request/382562)
**Author:** [@TSlump](https://discuss.elastic.co/u/TSlump)\ **Replies:** 2\ **Last updated:** [October 10, 2025, 3:31pm UTC](https://discuss.elastic.co/t/using-fluent-lambda-expressions-with-a-scroll-search-request/382562 "2025-10-10T15:31:07Z")
I’ve been unable to use fluent lambda expressions when searching with a scroll. I have the code working using direct creations of the request objects: public async Task\\> GetAllElasticIds() { var ids = new L… --- ## [Booting up logstash for the first time](https://discuss.elastic.co/t/booting-up-logstash-for-the-first-time/382581)
**Author:** [@hayatve](https://discuss.elastic.co/u/hayatve)\ **Replies:** 3\ **Last updated:** [October 10, 2025, 2:30pm UTC](https://discuss.elastic.co/t/booting-up-logstash-for-the-first-time/382581 "2025-10-10T14:30:50Z")
Hello, I’m trying to setup the ELK-Stack on my laptop. Elasticsearch and Kibana is running through the browser. I can’t figure out to setup logstash properly tho.I run into the same error, which is: "Using bundled JDK: … [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=34) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=36)