# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=37 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 38 --- ## [IIS Integration - metrics datasets (app pools and websites)](https://discuss.elastic.co/t/iis-integration-metrics-datasets-app-pools-and-websites/382464)
**Author:** [@erikg](https://discuss.elastic.co/u/erikg)\ **Replies:** 0\ **Last updated:** [October 6, 2025, 6:20pm UTC](https://discuss.elastic.co/t/iis-integration-metrics-datasets-app-pools-and-websites/382464 "2025-10-06T18:20:54Z")
Hello, We have an IIS server hosting several app pools. The IIS dataset retrieves websites, web servers, and application pools. I was wondering how I can correlate the website with its associated app pool to provide a b… --- ## [Watcher: Support for Keystore Variables in Watch Definitions](https://discuss.elastic.co/t/watcher-support-for-keystore-variables-in-watch-definitions/382362)
**Author:** [@console\_fulcrum](https://discuss.elastic.co/u/console_fulcrum)\ **Replies:** 5\ **Last updated:** [October 6, 2025, 2:33pm UTC](https://discuss.elastic.co/t/watcher-support-for-keystore-variables-in-watch-definitions/382362 "2025-10-06T14:33:53Z")
Currently working on Elasticsearch 8.17.1 with Watcher + DataDog integration. While xpack.watcher.encrypt\_sensitive\_data=true encrypts stored watches, the initial watch definition still requires plaintext credentials. C… --- ## [How to avoid initializing\_shards during restarts](https://discuss.elastic.co/t/how-to-avoid-initializing-shards-during-restarts/382152)
**Author:** [@sukur55](https://discuss.elastic.co/u/sukur55)\ **Replies:** 14\ **Last updated:** [October 6, 2025, 11:34am UTC](https://discuss.elastic.co/t/how-to-avoid-initializing-shards-during-restarts/382152 "2025-10-06T11:34:27Z")
Hi Folks, so we have 3 node ElastichSearch cluster, when we do rollout restart we see a case like there are shards which was primary on restarted node A and now the replica on other node B promoted as primary and we see … --- ## [Logstash Question - Change snmp trap default port (1062 -\> 162)](https://discuss.elastic.co/t/logstash-question-change-snmp-trap-default-port-1062-162/382423)
**Author:** [@Tal1](https://discuss.elastic.co/u/Tal1)\ **Replies:** 4\ **Last updated:** [October 5, 2025, 10:06pm UTC](https://discuss.elastic.co/t/logstash-question-change-snmp-trap-default-port-1062-162/382423 "2025-10-05T22:06:17Z")
Hello, I’m new here, and i hope the solution will come from here :slight\_smile: I’ve installed logstash 9.1.4 on my linux server (redhat 9.5) and i’m trying to change the logstash snmptrap listener from 1062 to 162 (wh… --- ## [Rollover errors for .kibana-reporting datastream indexes](https://discuss.elastic.co/t/rollover-errors-for-kibana-reporting-datastream-indexes/382425)
**Author:** [@Russell\_Fulton](https://discuss.elastic.co/u/Russell_Fulton)\ **Replies:** 0\ **Last updated:** [October 5, 2025, 7:59pm UTC](https://discuss.elastic.co/t/rollover-errors-for-kibana-reporting-datastream-indexes/382425 "2025-10-05T19:59:58Z")
8.18.3 indexes going back over a year for .kibana-reporting datastream have rollover errors: "setting \[index.lifecycle.rollover\_alias\] for index \[.reporting-2024-04-07\] is empty or not defined" { "policy": "kibana-r… --- ## [I need help the map is not working properly](https://discuss.elastic.co/t/i-need-help-the-map-is-not-working-properly/382416)
**Author:** [@meilin\_mart](https://discuss.elastic.co/u/meilin_mart)\ **Replies:** 1\ **Last updated:** [October 4, 2025, 8:46pm UTC](https://discuss.elastic.co/t/i-need-help-the-map-is-not-working-properly/382416 "2025-10-04T20:46:09Z")
so long story shor i have try almost everything but the map is not showing any thing, the map is there but is not showing any data on it, im able to see all my logs on discovery but the map is not doing anything. i need … --- ## [How to best handle large Elastic indexes](https://discuss.elastic.co/t/how-to-best-handle-large-elastic-indexes/382412)
**Author:** [@Moni\_Hazarika](https://discuss.elastic.co/u/Moni_Hazarika)\ **Replies:** 3\ **Last updated:** [October 4, 2025, 12:34pm UTC](https://discuss.elastic.co/t/how-to-best-handle-large-elastic-indexes/382412 "2025-10-04T12:34:27Z")
Hi Team, We are on Elasticsearch version 8.x and we have this index which for data isolation, security etc reasons we kept as 1 index per tenant. On the index creation since we don’t specify the number of shards, we get… --- ## [Problem with "Result window is too large, from + size must be less than or equal to"](https://discuss.elastic.co/t/problem-with-result-window-is-too-large-from-size-must-be-less-than-or-equal-to/382411)
**Author:** [@Mario\_22](https://discuss.elastic.co/u/Mario_22)\ **Replies:** 0\ **Last updated:** [October 4, 2025, 9:40am UTC](https://discuss.elastic.co/t/problem-with-result-window-is-too-large-from-size-must-be-less-than-or-equal-to/382411 "2025-10-04T09:40:51Z")
Hi, I need help. After upgrading Elastic Stack from 8.18.2 to 9.1.4, I got an error while monitoring Elastic. Specifically, the built-in rules: CCR read exceptions Cluster health CPU usage Elasticsearch version mis… --- ## [Log Anomaly Doesn't Work?](https://discuss.elastic.co/t/log-anomaly-doesnt-work/382329)
**Author:** [@erikg](https://discuss.elastic.co/u/erikg)\ **Replies:** 1\ **Last updated:** [October 4, 2025, 3:30am UTC](https://discuss.elastic.co/t/log-anomaly-doesnt-work/382329 "2025-10-04T03:30:18Z")
ES/Kibana 9.1.3 I get this error: --- ## [Reading files from ZIP folder using logstash](https://discuss.elastic.co/t/reading-files-from-zip-folder-using-logstash/382345)
**Author:** [@venkatkumar229](https://discuss.elastic.co/u/venkatkumar229)\ **Replies:** 5\ **Last updated:** [October 3, 2025, 12:23pm UTC](https://discuss.elastic.co/t/reading-files-from-zip-folder-using-logstash/382345 "2025-10-03T12:23:30Z")
Hi Team, I wanted to read the files from a zipped folder on the server is it possible to read them using logstash. If yes could you please let me know the procedure. Logstash version: 8.18.1 --- ## [Heatmap visualization with ES|QL ignores/randomizes sorting on 2nd dimension](https://discuss.elastic.co/t/heatmap-visualization-with-es-ql-ignores-randomizes-sorting-on-2nd-dimension/382271)
**Author:** [@spinscale](https://discuss.elastic.co/u/spinscale)\ **Replies:** 2\ **Last updated:** [October 3, 2025, 12:12pm UTC](https://discuss.elastic.co/t/heatmap-visualization-with-es-ql-ignores-randomizes-sorting-on-2nd-dimension/382271 "2025-10-03T12:12:20Z")
Hey, I have an ESQL query like this: FROM data | EVAL month\_of\_year = DATE\_EXTRACT("month\_of\_year", date), hour\_of\_day = DATE\_EXTRACT("HOUR\_OF\_DAY", date) | STATS AVG(value) BY month\_of\_year, hour\_of\_day | SORT h… --- ## [Deploying a Persistent Fleet Server on the Same Docker Network as Elasticsearch and Kibana Containers](https://discuss.elastic.co/t/deploying-a-persistent-fleet-server-on-the-same-docker-network-as-elasticsearch-and-kibana-containers/382387)
**Author:** [@Simriti\_Bundhoo](https://discuss.elastic.co/u/Simriti_Bundhoo)\ **Replies:** 0\ **Last updated:** [October 3, 2025, 3:56am UTC](https://discuss.elastic.co/t/deploying-a-persistent-fleet-server-on-the-same-docker-network-as-elasticsearch-and-kibana-containers/382387 "2025-10-03T03:56:33Z")
Hi everyone, I’m trying to deploy a persistent Fleet Server in Docker, ensuring it runs on the same Docker network as my Elasticsearch and Kibana containers. Both Elasticsearch and Kibana are already up and running in s… --- ## [Repeating the Same Directive inside mutate](https://discuss.elastic.co/t/repeating-the-same-directive-inside-mutate/382385)
**Author:** [@Evan2](https://discuss.elastic.co/u/Evan2)\ **Replies:** 1\ **Last updated:** [October 3, 2025, 12:37am UTC](https://discuss.elastic.co/t/repeating-the-same-directive-inside-mutate/382385 "2025-10-03T00:37:57Z")
I’ve been given the below advice from our Copilot instance. Can you please confirm its authenticity? I have a few Logstash pipelines using multiple remove\_field directives and need to know if I should instead be using m… --- ## [Filebeat: connection to Elasticsearch OK but no documents indexed](https://discuss.elastic.co/t/filebeat-connection-to-elasticsearch-ok-but-no-documents-indexed/382285)
**Author:** [@decibel83](https://discuss.elastic.co/u/decibel83)\ **Replies:** 9\ **Last updated:** [October 2, 2025, 2:57pm UTC](https://discuss.elastic.co/t/filebeat-connection-to-elasticsearch-ok-but-no-documents-indexed/382285 "2025-10-02T14:57:11Z")
Hi everyone, I’m facing an issue with Filebeat 8.19.3 on Debian 12 (Bookworm). Symptoms Filebeat starts without errors and connects successfully to Elasticsearch: Connection to backoff(elasticsearch(https://\… --- ## [Windows Logs via Elastic Agent](https://discuss.elastic.co/t/windows-logs-via-elastic-agent/382350)
**Author:** [@Sam11](https://discuss.elastic.co/u/Sam11)\ **Replies:** 7\ **Last updated:** [October 2, 2025, 2:18pm UTC](https://discuss.elastic.co/t/windows-logs-via-elastic-agent/382350 "2025-10-02T14:18:19Z")
Hello, I am facing an issue with Windows logs when using Elastic Agent: the logs are not being sent to Kibana. However, Winlogbeat works correctly and is able to send the logs. This is my elastic-agent configuration a… --- ## [Using custom script engine in Elasticclient 8](https://discuss.elastic.co/t/using-custom-script-engine-in-elasticclient-8/382197)
**Author:** [@priyankaMS](https://discuss.elastic.co/u/priyankaMS)\ **Replies:** 2\ **Last updated:** [October 2, 2025, 12:36pm UTC](https://discuss.elastic.co/t/using-custom-script-engine-in-elasticclient-8/382197 "2025-10-02T12:36:08Z")
Hello We are updating our code from NEST to elastic client. We have a custom written script engine in Java for indexing documents to elasticsearch. But we realised in elasticclient there is no way to pass script names w… --- ## [Metricbeat vs elastic agent](https://discuss.elastic.co/t/metricbeat-vs-elastic-agent/376663)
**Author:** [@Dth\_Revan](https://discuss.elastic.co/u/Dth_Revan)\ **Replies:** 2\ **Last updated:** [October 2, 2025, 7:56am UTC](https://discuss.elastic.co/t/metricbeat-vs-elastic-agent/376663 "2025-10-02T07:56:26Z")
Hello, everyone! Not so long ago i decided to try elastic agent+system integration instead of metricbeat with system module (which i have used for a very long time). the problem i faced is i can't make SOME graphs in gr… --- ## [Elasticsearch upgrade admission webhook error elastic-es-validation-v1.k8s.elastic.co](https://discuss.elastic.co/t/elasticsearch-upgrade-admission-webhook-error-elastic-es-validation-v1-k8s-elastic-co/382367)
**Author:** [@astingengo](https://discuss.elastic.co/u/astingengo)\ **Replies:** 0\ **Last updated:** [October 2, 2025, 6:56am UTC](https://discuss.elastic.co/t/elasticsearch-upgrade-admission-webhook-error-elastic-es-validation-v1-k8s-elastic-co/382367 "2025-10-02T06:56:27Z")
Hi there, I’m having elasticsearch deployed inside Kubernetes (v1.32.7) Operator version was 2.16.1 and stack version 0.4.0 Upgraded them to 3.1.0 and 0.14.1 and now having below error on operator and ES not deployed … --- ## [Cannot install elastic agent on window server](https://discuss.elastic.co/t/cannot-install-elastic-agent-on-window-server/382364)
**Author:** [@Hoai\_Thanh\_Do](https://discuss.elastic.co/u/Hoai_Thanh_Do)\ **Replies:** 0\ **Last updated:** [October 2, 2025, 12:38am UTC](https://discuss.elastic.co/t/cannot-install-elastic-agent-on-window-server/382364 "2025-10-02T00:38:09Z")
Hi All, I'm new to Elastic and recently attempted to install Elastic Agent on my Azure VMs. Unfortunately, the installation failed. One strange thing I noticed is that although the result indicates failure, the Elastic … --- ## [CSV Processor (Ingest pipelines): Tab Separator](https://discuss.elastic.co/t/csv-processor-ingest-pipelines-tab-separator/382361)
**Author:** [@erikg](https://discuss.elastic.co/u/erikg)\ **Replies:** 4\ **Last updated:** [October 1, 2025, 8:23pm UTC](https://discuss.elastic.co/t/csv-processor-ingest-pipelines-tab-separator/382361 "2025-10-01T20:23:43Z")
Is there a way for CSV processor to accept TSV? --- ## [Elastic Agent not sending kubernetes.pod.name field](https://discuss.elastic.co/t/elastic-agent-not-sending-kubernetes-pod-name-field/382351)
**Author:** [@babban](https://discuss.elastic.co/u/babban)\ **Replies:** 0\ **Last updated:** [October 1, 2025, 12:09pm UTC](https://discuss.elastic.co/t/elastic-agent-not-sending-kubernetes-pod-name-field/382351 "2025-10-01T12:09:45Z")
Hi, We have elastic agent APM server configured on application. Since the last upgrade the fields “kubernetes.pod.name”/”host.name”/”host.hostname”, none of these fields are being produced. We have the flow where, the … --- ## [Dealing with nested fields from aggregations](https://discuss.elastic.co/t/dealing-with-nested-fields-from-aggregations/382346)
**Author:** [@Sam\_Moss](https://discuss.elastic.co/u/Sam_Moss)\ **Replies:** 0\ **Last updated:** [October 1, 2025, 9:54am UTC](https://discuss.elastic.co/t/dealing-with-nested-fields-from-aggregations/382346 "2025-10-01T09:54:34Z")
I am trying to build a central inventory index pulling data from a variety of different places, this means that there are a few aggregations on the way to the final index, which leads to lovely field names such as “wmi.w… --- ## [How to check Elasticsearch license history or past activations (Platinum/Enterprise)?](https://discuss.elastic.co/t/how-to-check-elasticsearch-license-history-or-past-activations-platinum-enterprise/382323)
**Author:** [@Musab\_Dogan](https://discuss.elastic.co/u/Musab_Dogan)\ **Replies:** 2\ **Last updated:** [October 1, 2025, 4:54am UTC](https://discuss.elastic.co/t/how-to-check-elasticsearch-license-history-or-past-activations-platinum-enterprise/382323 "2025-10-01T04:54:11Z")
Five years ago, one of my customers purchased an Elastic license. The renewal date has now arrived, and they asked me to verify the current license status of their clusters. When I checked, all clusters with GET /\_licens… --- ## [\[BUG\] A replica shard in POST\_RECOVERY state, when promoted to primary, will be stuck](https://discuss.elastic.co/t/bug-a-replica-shard-in-post-recovery-state-when-promoted-to-primary-will-be-stuck/382333)
**Author:** [@Govind\_Balaji\_S](https://discuss.elastic.co/u/Govind_Balaji_S)\ **Replies:** 1\ **Last updated:** [September 30, 2025, 9:16pm UTC](https://discuss.elastic.co/t/bug-a-replica-shard-in-post-recovery-state-when-promoted-to-primary-will-be-stuck/382333 "2025-09-30T21:16:17Z")
EDIT: I think I mixed up ShardRoutingState and IndexShardState. I think this introduced a bug - A replica can be promoted and started in one cluster state update by bleskes · Pull Request #32042 · elastic/elasticsearch … --- ## [Help with upgrade assistant api command](https://discuss.elastic.co/t/help-with-upgrade-assistant-api-command/382331)
**Author:** [@dominbdg](https://discuss.elastic.co/u/dominbdg)\ **Replies:** 1\ **Last updated:** [September 30, 2025, 8:13pm UTC](https://discuss.elastic.co/t/help-with-upgrade-assistant-api-command/382331 "2025-09-30T20:13:47Z")
Hello, I have issue, from curl I need to go to upgrade assistant api, from documentation it is: /api/upgrade\_assistant/status my command for that from curl is: curl -XGET -k -uelastic:"$(bin/elasticsearch-keystore… --- ## [SQL\_input lack of documentation and non working integration (version 9.1.4)](https://discuss.elastic.co/t/sql-input-lack-of-documentation-and-non-working-integration-version-9-1-4/382326)
**Author:** [@dao](https://discuss.elastic.co/u/dao)\ **Replies:** 0\ **Last updated:** [September 30, 2025, 3:11pm UTC](https://discuss.elastic.co/t/sql-input-lack-of-documentation-and-non-working-integration-version-9-1-4/382326 "2025-09-30T15:11:47Z")
I am trying to log all the new lines coming from a postgres database. I want to use the SQL\_input integration, but I cannot achieve what I want. The documentation is not complete, so that I cannot figure out how to do. H… --- ## [Aggregated sorted search with top hits and paging - items missing](https://discuss.elastic.co/t/aggregated-sorted-search-with-top-hits-and-paging-items-missing/382225)
**Author:** [@irkallacz](https://discuss.elastic.co/u/irkallacz)\ **Replies:** 6\ **Last updated:** [September 30, 2025, 2:34pm UTC](https://discuss.elastic.co/t/aggregated-sorted-search-with-top-hits-and-paging-items-missing/382225 "2025-09-30T14:34:11Z")
My intend is to have paged list of all categories presented by cheapest product, sorted by price. I have search terms aggregation by product category, sorted by min aggregation on price: "aggs": { "count":{"car… --- ## [No rollover with data stream lifecycle](https://discuss.elastic.co/t/no-rollover-with-data-stream-lifecycle/382165)
**Author:** [@mikehaertl](https://discuss.elastic.co/u/mikehaertl)\ **Replies:** 12\ **Last updated:** [September 30, 2025, 1:51pm UTC](https://discuss.elastic.co/t/no-rollover-with-data-stream-lifecycle/382165 "2025-09-30T13:51:56Z")
For testing purposes I’ve configured a lifecycle on a data stream with a retention time of 1h. But the backing index does not get rolled over. According to this doc Data stream lifecycle settings in Elasticsearch | Refe… --- ## [Understanding time\_in\_millis for ingest pipeline running embeddings](https://discuss.elastic.co/t/understanding-time-in-millis-for-ingest-pipeline-running-embeddings/382249)
**Author:** [@gueri](https://discuss.elastic.co/u/gueri)\ **Replies:** 2\ **Last updated:** [September 30, 2025, 1:32pm UTC](https://discuss.elastic.co/t/understanding-time-in-millis-for-ingest-pipeline-running-embeddings/382249 "2025-09-30T13:32:32Z")
Hi, I try to figured out the meaning of time\_in\_millis field about my ingest pipelines running embeddings. time\_in\_millis (integer) Total time, in milliseconds, spent preprocessing documents in the ingest pipeline. I… --- ## [Best practices for preprocessing data and monitoring resource usage in predefined ML jobs (security:host)](https://discuss.elastic.co/t/best-practices-for-preprocessing-data-and-monitoring-resource-usage-in-predefined-ml-jobs-security-host/382320)
**Author:** [@ilyes](https://discuss.elastic.co/u/ilyes)\ **Replies:** 0\ **Last updated:** [September 30, 2025, 1:31pm UTC](https://discuss.elastic.co/t/best-practices-for-preprocessing-data-and-monitoring-resource-usage-in-predefined-ml-jobs-security-host/382320 "2025-09-30T13:31:32Z")
Question 1: I am planning to use the predefined ML job from the security:host module. To avoid overloading the ML model with too much data, what would be the best approach in terms of data preprocessing? Should I fir… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=36) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=38)