# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=36 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 37 --- ## [How to 'empty' a big index?](https://discuss.elastic.co/t/how-to-empty-a-big-index/382586)
**Author:** [@smm](https://discuss.elastic.co/u/smm)\ **Replies:** 1\ **Last updated:** [October 10, 2025, 2:09pm UTC](https://discuss.elastic.co/t/how-to-empty-a-big-index/382586 "2025-10-10T14:09:52Z")
Hi there, I am in the situation to have a regular index (not a time-series index & not a data stream). This index got really big - about 13GB. Because of its nature I cannot use ILM. What can I do instead to have an e… --- ## [API \[GET /api/streams/\_status\] is unauthorized for user](https://discuss.elastic.co/t/api-get-api-streams-status-is-unauthorized-for-user/382578)
**Author:** [@fuphil](https://discuss.elastic.co/u/fuphil)\ **Replies:** 0\ **Last updated:** [October 10, 2025, 8:26am UTC](https://discuss.elastic.co/t/api-get-api-streams-status-is-unauthorized-for-user/382578 "2025-10-10T08:26:37Z")
Hey, after the upgrade from 8.15.5 to 8.18.6 I found lots of the following errors in the Kibana logs. During investigation I found out, that this is related to the user permissions. It always occurs if a user opens a … --- ## [Entity content is too long \[111285333\] for the configured buffer limit \[104857600\]](https://discuss.elastic.co/t/entity-content-is-too-long-111285333-for-the-configured-buffer-limit-104857600/382577)
**Author:** [@ajaya\_panda](https://discuss.elastic.co/u/ajaya_panda)\ **Replies:** 0\ **Last updated:** [October 10, 2025, 8:00am UTC](https://discuss.elastic.co/t/entity-content-is-too-long-111285333-for-the-configured-buffer-limit-104857600/382577 "2025-10-10T08:00:51Z")
while fetching the documents from elasticsearch we are getting below error: entity content is too long \[111285333\] for the configured buffer limit \[104857600\] we are fetching the records using scroll. Why this is faili… --- ## [Data too large, data for \[\\] would be \[4238960092/3.9gb\], which is larger than the limit of \[3006477107/2.7gb\], real usage: \[4238959160/3.9gb\], new bytes reserved: \[932/932b\], usages \[request=0/0b, inflight\_requests=932/932b, model\_inference=](https://discuss.elastic.co/t/data-too-large-data-for-http-request-would-be-4238960092-3-9gb-which-is-larger-than-the-limit-of-3006477107-2-7gb-real-usage-4238959160-3-9gb-new-bytes-reserved-932-932b-usages-request-0-0b-inflight-requests-932-932b-model-inference/382547)
**Author:** [@Pallavi\_K\_V](https://discuss.elastic.co/u/Pallavi_K_V)\ **Replies:** 1\ **Last updated:** [October 10, 2025, 7:13am UTC](https://discuss.elastic.co/t/data-too-large-data-for-http-request-would-be-4238960092-3-9gb-which-is-larger-than-the-limit-of-3006477107-2-7gb-real-usage-4238959160-3-9gb-new-bytes-reserved-932-932b-usages-request-0-0b-inflight-requests-932-932b-model-inference/382547 "2025-10-10T07:13:40Z")
Because of which Elastic search is going down aand restarting by itself what could be the issue --- ## [Enable SASL Authentication for Kafka Output in Filebeat Configuration](https://discuss.elastic.co/t/enable-sasl-authentication-for-kafka-output-in-filebeat-configuration/382533)
**Author:** [@Thirupathi](https://discuss.elastic.co/u/Thirupathi)\ **Replies:** 2\ **Last updated:** [October 10, 2025, 6:27am UTC](https://discuss.elastic.co/t/enable-sasl-authentication-for-kafka-output-in-filebeat-configuration/382533 "2025-10-10T06:27:35Z")
hosts: \["10.42.41.55:19094"\] topic: 'npc-raw-msg' key: '%{\[UUID\]}' codec.format: string: '%{\[message\]}' partition.round\_robin: reachable\_only: false required\_acks: 1 compression: gzip max\_message\_bytes: 1000000 … --- ## [Logstash s3-input using a VPC accesspoint](https://discuss.elastic.co/t/logstash-s3-input-using-a-vpc-accesspoint/382555)
**Author:** [@dazoakley](https://discuss.elastic.co/u/dazoakley)\ **Replies:** 0\ **Last updated:** [October 9, 2025, 1:16pm UTC](https://discuss.elastic.co/t/logstash-s3-input-using-a-vpc-accesspoint/382555 "2025-10-09T13:16:17Z")
Hi folks, I’m trying to configure logstash to watch some files in an S3 bucket, but the restriction I have is that we’re only allowed access via VPC AccessPoints. Is there a way to configure logstash to do this? I’ve t… --- ## [Wrong prefix for SQL Server integration fields](https://discuss.elastic.co/t/wrong-prefix-for-sql-server-integration-fields/382388)
**Author:** [@hermlam](https://discuss.elastic.co/u/hermlam)\ **Replies:** 3\ **Last updated:** [October 9, 2025, 12:32pm UTC](https://discuss.elastic.co/t/wrong-prefix-for-sql-server-integration-fields/382388 "2025-10-09T12:32:52Z")
I am using the elastic agent SQL Server integration. And the performance index and dashboard. The dashboard expects fields with a prefix: ‘mssql’. And according to the templates this prefix should be ‘mssql.’ But in my d… --- ## [Kibana audit log](https://discuss.elastic.co/t/kibana-audit-log/382542)
**Author:** [@vijay117](https://discuss.elastic.co/u/vijay117)\ **Replies:** 0\ **Last updated:** [October 9, 2025, 10:06am UTC](https://discuss.elastic.co/t/kibana-audit-log/382542 "2025-10-09T10:06:15Z")
how to store user email id in user meta data, which will go into kibana audit log? I want to see the user email in kibana audit log. just mapping this elasticsearch.yml is sufficent ? xpack.security.authc.realms.nativ… --- ## [Metricbeat get panic during collect system/process "interface conversion: cgroup.CGStats is nil"](https://discuss.elastic.co/t/metricbeat-get-panic-during-collect-system-process-interface-conversion-cgroup-cgstats-is-nil/361591)
**Author:** [@majuca](https://discuss.elastic.co/u/majuca)\ **Replies:** 1\ **Last updated:** [October 9, 2025, 7:24am UTC](https://discuss.elastic.co/t/metricbeat-get-panic-during-collect-system-process-interface-conversion-cgroup-cgstats-is-nil/361591 "2025-10-09T07:24:05Z")
metricbeat version: 7.17.20 Metricbeat stopped sending process information 2 min after the restart. After that, it stops sending 'system/process' events and shows the following error message in the log file: {"level":"… --- ## [Getting a eror to maintain the log order](https://discuss.elastic.co/t/getting-a-eror-to-maintain-the-log-order/382536)
**Author:** [@Waris\_Amir](https://discuss.elastic.co/u/Waris_Amir)\ **Replies:** 0\ **Last updated:** [October 9, 2025, 5:50am UTC](https://discuss.elastic.co/t/getting-a-eror-to-maintain-the-log-order/382536 "2025-10-09T05:50:33Z")
I’m trying to ingest the logs in the filebeat , by Default it support millisecond precision so I try to add another field in my logs then explicity passing it into filebeats At the server, i m having the logstash which … --- ## [Data Retention for a Data Stream showing 'Disabled' - Why?](https://discuss.elastic.co/t/data-retention-for-a-data-stream-showing-disabled-why/382520)
**Author:** [@smm](https://discuss.elastic.co/u/smm)\ **Replies:** 2\ **Last updated:** [October 9, 2025, 4:46am UTC](https://discuss.elastic.co/t/data-retention-for-a-data-stream-showing-disabled-why/382520 "2025-10-09T04:46:48Z")
Hi there, I was wonderig that the manual says this: A value in the data retention column indicates that the data stream is managed by a data stream lifecycle policy. This value is the time period for which your data i… --- ## [Getting Connection timed out error in logstash](https://discuss.elastic.co/t/getting-connection-timed-out-error-in-logstash/382218)
**Author:** [@upreddy253](https://discuss.elastic.co/u/upreddy253)\ **Replies:** 4\ **Last updated:** [October 9, 2025, 4:03am UTC](https://discuss.elastic.co/t/getting-connection-timed-out-error-in-logstash/382218 "2025-10-09T04:03:06Z")
Hi All, I have created one logstash pipeline using rabbitmq input plugin. But i am getting below error. \[ERROR\] 2025-09-25 09:35:08.167 \[\[prabbitmq\]\ **Author:** [@searchwithme](https://discuss.elastic.co/u/searchwithme)\ **Replies:** 1\ **Last updated:** [October 8, 2025, 11:15pm UTC](https://discuss.elastic.co/t/anomaly-detection/382487 "2025-10-08T23:15:37Z") I got metrics ingested into elastic for each process. Some metrics are \>95%. I have created a ML job on max(cpu). You can see in the image how the spikes are for cpu. but I see no anomalies are found. why so? Please help… --- ## [Trying to understand Filebeat, Kubernetes logrotation and missing logs](https://discuss.elastic.co/t/trying-to-understand-filebeat-kubernetes-logrotation-and-missing-logs/363165)
**Author:** [@javadevmtl](https://discuss.elastic.co/u/javadevmtl)\ **Replies:** 1\ **Last updated:** [October 8, 2025, 10:40pm UTC](https://discuss.elastic.co/t/trying-to-understand-filebeat-kubernetes-logrotation-and-missing-logs/363165 "2025-10-08T22:40:03Z")
Hi we are running Filbeat 8.9.2 as a Daemonset in Kubernetes. Filebeat is configure to insert Kafka. Here is the config: filebeat.inputs: - type: container paths: - /var/log/containers/\*.log processors: - ad… --- ## [Accessing Default agent](https://discuss.elastic.co/t/accessing-default-agent/382527)
**Author:** [@Sivaprakash\_Shanmuga](https://discuss.elastic.co/u/Sivaprakash_Shanmuga)\ **Replies:** 0\ **Last updated:** [October 8, 2025, 5:40pm UTC](https://discuss.elastic.co/t/accessing-default-agent/382527 "2025-10-08T17:40:14Z")
Hello Im following I'm trying to access the Elastic AI Agent Builder via Kibana, but I'm getting a 404 error when visiting this POST kbn://api/agent\_builder/converse { "input": "what is our top portfolio account… --- ## [System Integration Windows Security Logs no Log Enhancements after v. 8.19](https://discuss.elastic.co/t/system-integration-windows-security-logs-no-log-enhancements-after-v-8-19/381943)
**Author:** [@Joshua\_H](https://discuss.elastic.co/u/Joshua_H)\ **Replies:** 3\ **Last updated:** [October 8, 2025, 3:15pm UTC](https://discuss.elastic.co/t/system-integration-windows-security-logs-no-log-enhancements-after-v-8-19/381943 "2025-10-08T15:15:39Z")
Hello all, I have been running into the issue, that after updating my On-Prem Elastic-Stack (Single-node cluster) from v. 8.18 to 8.19 and the system integration for fleet as well, that the Windows security logs are mis… --- ## [Memory leak on kubernetes nodes](https://discuss.elastic.co/t/memory-leak-on-kubernetes-nodes/372389)
**Author:** [@dimaz](https://discuss.elastic.co/u/dimaz)\ **Replies:** 17\ **Last updated:** [October 8, 2025, 11:25am UTC](https://discuss.elastic.co/t/memory-leak-on-kubernetes-nodes/372389 "2025-10-08T11:25:15Z")
Hi, I see memory issue when i'm using Auditbeat on kubernetes nodes. I am trying with Auditbeat 8.12 and 8.13. Here is the config I'm running: auditbeat.modules: - module: auditd processors: - add\_session\_metad… --- ## [File.hash.sha256 encoded as UTF‑16LE](https://discuss.elastic.co/t/file-hash-sha256-encoded-as-utf-16le/382196)
**Author:** [@dynamicint](https://discuss.elastic.co/u/dynamicint)\ **Replies:** 1\ **Last updated:** [October 8, 2025, 10:31am UTC](https://discuss.elastic.co/t/file-hash-sha256-encoded-as-utf-16le/382196 "2025-10-08T10:31:00Z")
The following field: file.hash.sha256 Which is (now) the same as: winlog.user\_data.FileHash Has an encoding problem in Elastic 9.1.4. It's encoded with UTF‑16LE, which means that the first bytes with the proper sha25… --- ## [Getting rabbitmq connection error](https://discuss.elastic.co/t/getting-rabbitmq-connection-error/382517)
**Author:** [@upreddy253](https://discuss.elastic.co/u/upreddy253)\ **Replies:** 1\ **Last updated:** [October 8, 2025, 10:05am UTC](https://discuss.elastic.co/t/getting-rabbitmq-connection-error/382517 "2025-10-08T10:05:06Z")
Hi, We are using logstash version 9.1.2 and we are trying to connect with rabbitmq server using rabbitmq logstash input plugin but we are getting below error in logstash. \[ERROR\] 2025-10-07 06:20:57.286 \[\[prabbitmq\]\ **Author:** [@Simriti\_Bundhoo](https://discuss.elastic.co/u/Simriti_Bundhoo)\ **Replies:** 1\ **Last updated:** [October 8, 2025, 4:05am UTC](https://discuss.elastic.co/t/watcher-error-using-terms-query-with-metadata-array-input/382513 "2025-10-08T04:05:14Z") Hi everyone, I'm trying to use an array from the watch metadata in a terms query for one of my watchers. I want to use a Mustache search template-style query as described here: :link: https://www.elastic.co/docs/soluti… --- ## [Kibana Install](https://discuss.elastic.co/t/kibana-install/382231)
**Author:** [@Edward\_Weller](https://discuss.elastic.co/u/Edward_Weller)\ **Replies:** 3\ **Last updated:** [October 7, 2025, 9:50pm UTC](https://discuss.elastic.co/t/kibana-install/382231 "2025-10-07T21:50:29Z")
I have been trying to upgrade our local service to 8.19.4 so that I may update to 9.0. I have not had an issue with elasticsearch, but kibana is giving me an issue. I have tried multiple downloads, and multiple install… --- ## [Regarding client and server version alignment](https://discuss.elastic.co/t/regarding-client-and-server-version-alignment/382486)
**Author:** [@yeikel](https://discuss.elastic.co/u/yeikel)\ **Replies:** 3\ **Last updated:** [October 7, 2025, 5:39pm UTC](https://discuss.elastic.co/t/regarding-client-and-server-version-alignment/382486 "2025-10-07T17:39:27Z")
We discovered through MissingRequiredPropertyException in PIT query · Issue #921 · elastic/elasticsearch-java · GitHub that even minor version mismatches between the Elasticsearch server and client can lead to issues. B… --- ## [Sending logs from SAP HANA to logstash using JJDBC](https://discuss.elastic.co/t/sending-logs-from-sap-hana-to-logstash-using-jjdbc/382475)
**Author:** [@Saad\_khattak](https://discuss.elastic.co/u/Saad_khattak)\ **Replies:** 1\ **Last updated:** [October 7, 2025, 3:01pm UTC](https://discuss.elastic.co/t/sending-logs-from-sap-hana-to-logstash-using-jjdbc/382475 "2025-10-07T15:01:22Z")
So i want to get security logs from SAP HANA database for that as of my research i am going to use JDBC with logstach the jdbc will query the HANA database and store logs in the logstash from logstash it will be sent to … --- ## [Kibana missing credentials ver 9.0.3](https://discuss.elastic.co/t/kibana-missing-credentials-ver-9-0-3/382032)
**Author:** [@Karol\_Niema](https://discuss.elastic.co/u/Karol_Niema)\ **Replies:** 4\ **Last updated:** [October 7, 2025, 2:46pm UTC](https://discuss.elastic.co/t/kibana-missing-credentials-ver-9-0-3/382032 "2025-10-07T14:46:34Z")
Hello, I receive errors in kibana logs {"@timestamp":"2025-09-17T17:57:36.157Z","event":{"provider":"alerting","action":"execute","kind":"alert","category":\\\["monitoring"\\\],"start":"2025-09-17T17:57:36.121Z","outcome":… --- ## [Open Telemetry - flush failed (502)](https://discuss.elastic.co/t/open-telemetry-flush-failed-502/382442)
**Author:** [@Karol\_Niema](https://discuss.elastic.co/u/Karol_Niema)\ **Replies:** 1\ **Last updated:** [October 7, 2025, 2:38pm UTC](https://discuss.elastic.co/t/open-telemetry-flush-failed-502/382442 "2025-10-07T14:38:55Z")
Hello, I am trying to use Elastic Agent in Open Telemetry collector mode, after configure and started I receive error 2025-10-06T15:18:04.190+0300 error elasticsearchexporter@v0.121.0/bulkindexer.go:346 bu… --- ## [Elastic won't start after upgrade to 8.19.4](https://discuss.elastic.co/t/elastic-wont-start-after-upgrade-to-8-19-4/382328)
**Author:** [@artschooldropout](https://discuss.elastic.co/u/artschooldropout)\ **Replies:** 22\ **Last updated:** [October 7, 2025, 1:36pm UTC](https://discuss.elastic.co/t/elastic-wont-start-after-upgrade-to-8-19-4/382328 "2025-10-07T13:36:00Z")
We recently attempted to upgrade our cluster from 8.17.4 to 8.19.4 using apt. After the upgrade, the service won’t start and we see this line in the logs: java.lang.IllegalStateException: Failed to parse mappings for in… --- ## [Regarding Logstash file output settings](https://discuss.elastic.co/t/regarding-logstash-file-output-settings/382428)
**Author:** [@sysrq\_1231](https://discuss.elastic.co/u/sysrq_1231)\ **Replies:** 5\ **Last updated:** [October 7, 2025, 9:20am UTC](https://discuss.elastic.co/t/regarding-logstash-file-output-settings/382428 "2025-10-07T09:20:16Z")
Hi Can you tell me about file archiving settings in Logstash? I'm creating a pipeline configuration file as shown below. With this configuration, no file (~.log) is output. What could be the cause? Also, what should … --- ## [Why does this simple search in Kibana work?](https://discuss.elastic.co/t/why-does-this-simple-search-in-kibana-work/382435)
**Author:** [@smm](https://discuss.elastic.co/u/smm)\ **Replies:** 3\ **Last updated:** [October 7, 2025, 6:56am UTC](https://discuss.elastic.co/t/why-does-this-simple-search-in-kibana-work/382435 "2025-10-07T06:56:58Z")
Hi there, I defined this simple test document: POST /logs-stefano/\_doc?pipeline=syslog\_deduplication { "@timestamp": "2025-10-06T09:00:00Z", "host": "SERVER-A", "message": "date=2025-05-02 time=10:38:00 devname=SER… --- ## [Dense Vector Field Extremely Large](https://discuss.elastic.co/t/dense-vector-field-extremely-large/382380)
**Author:** [@nicky](https://discuss.elastic.co/u/nicky)\ **Replies:** 12\ **Last updated:** [October 6, 2025, 11:57pm UTC](https://discuss.elastic.co/t/dense-vector-field-extremely-large/382380 "2025-10-06T23:57:16Z")
Hi all, Have been experimenting with applying both forms of compression to our dense vectors and doing performance comparisons, but while bbq\_hnsw has been performing relatively well at 1-3s per query average, int8 has … --- ## [Getting no data with custom integration](https://discuss.elastic.co/t/getting-no-data-with-custom-integration/382457)
**Author:** [@sfoster](https://discuss.elastic.co/u/sfoster)\ **Replies:** 0\ **Last updated:** [October 6, 2025, 5:15pm UTC](https://discuss.elastic.co/t/getting-no-data-with-custom-integration/382457 "2025-10-06T17:15:18Z")
I am building and integration I can install and it seems to run with no issues but I am not getting any data. I am not sure where I am going wrong. This is running on version 8.19.4. I see this in the messages. "mess… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=35) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=37)