# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=38 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 39 --- ## [Dasboards and dataviews](https://discuss.elastic.co/t/dasboards-and-dataviews/382274)
**Author:** [@Buzz](https://discuss.elastic.co/u/Buzz)\ **Replies:** 2\ **Last updated:** [September 30, 2025, 1:26pm UTC](https://discuss.elastic.co/t/dasboards-and-dataviews/382274 "2025-09-30T13:26:45Z")
Hello, i have a question about dashboards delivered with Windows integration. I have created multiple new indexes and assign separate policies. example: agent-security-logs-yyyy.mm.dd - retention 365days agent-applic… --- ## [After renewing certificates, Kibana shows multiple expiry dates (2028 vs 2125)](https://discuss.elastic.co/t/after-renewing-certificates-kibana-shows-multiple-expiry-dates-2028-vs-2125/382306)
**Author:** [@LimSuyun](https://discuss.elastic.co/u/LimSuyun)\ **Replies:** 1\ **Last updated:** [September 30, 2025, 1:25pm UTC](https://discuss.elastic.co/t/after-renewing-certificates-kibana-shows-multiple-expiry-dates-2028-vs-2125/382306 "2025-09-30T13:25:43Z")
We have currently set up 3 Elasticsearch clusters with master nodes on 1.1.1.10, 1.1.1.11, and 1.1.1.12. Since the certificates had expired, we generated new ones. On the master node (1.1.1.10), we created http.p12, tra… --- ## [Custom File stream Integration - Network Shares](https://discuss.elastic.co/t/custom-file-stream-integration-network-shares/382288)
**Author:** [@erikg](https://discuss.elastic.co/u/erikg)\ **Replies:** 1\ **Last updated:** [September 29, 2025, 5:49pm UTC](https://discuss.elastic.co/t/custom-file-stream-integration-network-shares/382288 "2025-09-29T17:49:18Z")
Hello, I am using v1.2.0 of the Custom Logs (Filestream). Normally this integration works for collecting from a local folder, but I can’t seem to grab the logs from a network share. My first assumption is that perhaps … --- ## [How to track if {{server}} changes {{geo.location}}](https://discuss.elastic.co/t/how-to-track-if-server-changes-geo-location/382127)
**Author:** [@Elk\_huh](https://discuss.elastic.co/u/Elk_huh)\ **Replies:** 3\ **Last updated:** [September 29, 2025, 2:42pm UTC](https://discuss.elastic.co/t/how-to-track-if-server-changes-geo-location/382127 "2025-09-29T14:42:39Z")
Is there a functionality to track server / geolocation . I need an alert to go off if the geolocation changes, not sure what functionality will achieve this --- ## [Highlighting on ES8 much slower than ES7](https://discuss.elastic.co/t/highlighting-on-es8-much-slower-than-es7/375355)
**Author:** [@Bartosz\_Krakowiak](https://discuss.elastic.co/u/Bartosz_Krakowiak)\ **Replies:** 5\ **Last updated:** [September 29, 2025, 2:12pm UTC](https://discuss.elastic.co/t/highlighting-on-es8-much-slower-than-es7/375355 "2025-09-29T14:12:07Z")
Hi, I've updated my cluster from Elasticsearch 7.17.16 to 8.16.3 and noticed that Kibana is working way slower in ES 8, because most of the query time is spent in HighlightingPhase. The difference is even bigger when us… --- ## [Override pipeline on modules not working](https://discuss.elastic.co/t/override-pipeline-on-modules-not-working/382233)
**Author:** [@R\_V](https://discuss.elastic.co/u/R_V)\ **Replies:** 1\ **Last updated:** [September 29, 2025, 9:48am UTC](https://discuss.elastic.co/t/override-pipeline-on-modules-not-working/382233 "2025-09-29T09:48:14Z")
Hello I've got the following flow GCP PubSub =\> Filebeat (9.1.3) =\> Elasticsearch In the filebeat source, i'm sending postgresql module to GCP pubsub. The flow is working fine i'm ingesting logs in elasticsearch, but… --- ## [Sorting on a scripted terms aggregation is lexically instead of numerically](https://discuss.elastic.co/t/sorting-on-a-scripted-terms-aggregation-is-lexically-instead-of-numerically/382256)
**Author:** [@spinscale](https://discuss.elastic.co/u/spinscale)\ **Replies:** 3\ **Last updated:** [September 28, 2025, 10:10am UTC](https://discuss.elastic.co/t/sorting-on-a-scripted-terms-aggregation-is-lexically-instead-of-numerically/382256 "2025-09-28T10:10:25Z")
Hey, maybe this is intended behaviour but I would like to verify. If I am using a terms aggregation with a script and specify sorting by key, it does not take into account when the script is returning an integer value. … --- ## [Dynamic Template usage for nested fields](https://discuss.elastic.co/t/dynamic-template-usage-for-nested-fields/382229)
**Author:** [@Shweta\_Chadha](https://discuss.elastic.co/u/Shweta_Chadha)\ **Replies:** 3\ **Last updated:** [September 26, 2025, 8:21pm UTC](https://discuss.elastic.co/t/dynamic-template-usage-for-nested-fields/382229 "2025-09-26T20:21:48Z")
Hi folks! We are on Elastic version 8.17 and have an existing ES index that we are now introducing a dynamic attribute using dynamic template to. The dynamic fields would be added within an existing nested field. Our br… --- ## [Some Agent Do Not Send Data Custom Logs (Filestream)](https://discuss.elastic.co/t/some-agent-do-not-send-data-custom-logs-filestream/382112)
**Author:** [@lomar](https://discuss.elastic.co/u/lomar)\ **Replies:** 16\ **Last updated:** [September 26, 2025, 3:19pm UTC](https://discuss.elastic.co/t/some-agent-do-not-send-data-custom-logs-filestream/382112 "2025-09-26T15:19:32Z")
I've created a cronjob that runs a script and outputs ndjson to a file. Then I've created a integration policy that reads the log file using Custom Logs Filestream integration and add it to agent policies. Some of the a… --- ## [How to reference another column value in metricFont expression?](https://discuss.elastic.co/t/how-to-reference-another-column-value-in-metricfont-expression/382077)
**Author:** [@JensHaglof](https://discuss.elastic.co/u/JensHaglof)\ **Replies:** 4\ **Last updated:** [September 26, 2025, 2:14pm UTC](https://discuss.elastic.co/t/how-to-reference-another-column-value-in-metricfont-expression/382077 "2025-09-26T14:14:25Z")
Hi, I have a table that returns only one row with two columns: carrier and sum\_orders. I'm currently displaying sum\_orders in a metric element. I would like to change the font color of the number based on the value in … --- ## [Fortinet module \`sentdelta\` and \`rcvddelta\` field type is not number](https://discuss.elastic.co/t/fortinet-module-sentdelta-and-rcvddelta-field-type-is-not-number/382240)
**Author:** [@hylowaker](https://discuss.elastic.co/u/hylowaker)\ **Replies:** 1\ **Last updated:** [September 26, 2025, 1:31pm UTC](https://discuss.elastic.co/t/fortinet-module-sentdelta-and-rcvddelta-field-type-is-not-number/382240 "2025-09-26T13:31:56Z")
In the Filebeat fortinet module, the fields fortinet.firewall.sentdelta and fortinet.firewall.rcvddelta are set as Keyword type. I am not sure if it is intended or not, but I think these fields should be Long type to su… --- ## [What is the Setup Guides in Kibana privileges?](https://discuss.elastic.co/t/what-is-the-setup-guides-in-kibana-privileges/381948)
**Author:** [@josh\_tran](https://discuss.elastic.co/u/josh_tran)\ **Replies:** 7\ **Last updated:** [September 26, 2025, 8:54am UTC](https://discuss.elastic.co/t/what-is-the-setup-guides-in-kibana-privileges/381948 "2025-09-26T08:54:02Z")
Hi all, I am setting up the RBAC for users in my self-managed Elastic stack. I see there is an option in Kibana Privileges - Management, that is Setup Guides. I am unable to find the document explaining it. What is … --- ## [Learn Expression syntax and tiny math, where?](https://discuss.elastic.co/t/learn-expression-syntax-and-tiny-math-where/381953)
**Author:** [@JensHaglof](https://discuss.elastic.co/u/JensHaglof)\ **Replies:** 5\ **Last updated:** [September 25, 2025, 5:48pm UTC](https://discuss.elastic.co/t/learn-expression-syntax-and-tiny-math-where/381953 "2025-09-25T17:48:41Z")
Hi! Is there an online course that teaches this? I struggle to understand the syntax and how to use it to change things in the Canvas. The expression syntax, is that unique to Kibana, or is it a “real” language used ou… --- ## [Tilte Style plugin in v9.0.2](https://discuss.elastic.co/t/tilte-style-plugin-in-v9-0-2/381973)
**Author:** [@Mayuri\_Jaiswal](https://discuss.elastic.co/u/Mayuri_Jaiswal)\ **Replies:** 6\ **Last updated:** [September 25, 2025, 4:43pm UTC](https://discuss.elastic.co/t/tilte-style-plugin-in-v9-0-2/381973 "2025-09-25T16:43:00Z")
As generated plugin which is for styling title of visualisation suppose table or any other visual having title so have to customise setting like title font size,its colour its background colour alignment etc just like MS… --- ## [Increased Read IOPS usage after upgrade from 8.19.3 to 9.1.3](https://discuss.elastic.co/t/increased-read-iops-usage-after-upgrade-from-8-19-3-to-9-1-3/382156)
**Author:** [@Paulo\_Guedes](https://discuss.elastic.co/u/Paulo_Guedes)\ **Replies:** 3\ **Last updated:** [September 25, 2025, 1:37pm UTC](https://discuss.elastic.co/t/increased-read-iops-usage-after-upgrade-from-8-19-3-to-9-1-3/382156 "2025-09-25T13:37:31Z")
Hi all, since upgrading from 8.19.3 to 9.1.3 i'm seeing a massive increase of read IOPS on the Hot node disks. I couldn't see anything obvious in the release notes that would lead to this outside of the new JDK version … --- ## [Microsfot dynamics to elastic](https://discuss.elastic.co/t/microsfot-dynamics-to-elastic/382215)
**Author:** [@searchwithme](https://discuss.elastic.co/u/searchwithme)\ **Replies:** 0\ **Last updated:** [September 25, 2025, 9:04am UTC](https://discuss.elastic.co/t/microsfot-dynamics-to-elastic/382215 "2025-09-25T09:04:56Z")
Hi I checked the supported integrations and I do not see microsoft dynamics available. How to get my logs from microsoft dynamics to elastic? Please help --- ## [Updating records or check if exist and not write](https://discuss.elastic.co/t/updating-records-or-check-if-exist-and-not-write/382201)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 0\ **Last updated:** [September 24, 2025, 8:32pm UTC](https://discuss.elastic.co/t/updating-records-or-check-if-exist-and-not-write/382201 "2025-09-24T20:32:51Z")
I have case where I am trying to do following. job#:123, status:running, user:elastic → goes to job\_index in index \_id = job# case1: check if \_id:123 exist and status=running in job\_index and if is then don’t do anyt… --- ## [Windows Based Kubernetes](https://discuss.elastic.co/t/windows-based-kubernetes/382199)
**Author:** [@Jesselastic](https://discuss.elastic.co/u/Jesselastic)\ **Replies:** 0\ **Last updated:** [September 24, 2025, 2:58pm UTC](https://discuss.elastic.co/t/windows-based-kubernetes/382199 "2025-09-24T14:58:29Z")
Since I didn’t see it documented anywhere else, one way to get the Elastic Fleet integration to work with Windows OCS (Kubernetes) and successfully capture the logs in ECS is to install the agent at the node level, then … --- ## [CEF codec unable to set dynamic fields](https://discuss.elastic.co/t/cef-codec-unable-to-set-dynamic-fields/382182)
**Author:** [@wanglin](https://discuss.elastic.co/u/wanglin)\ **Replies:** 1\ **Last updated:** [September 24, 2025, 2:00pm UTC](https://discuss.elastic.co/t/cef-codec-unable-to-set-dynamic-fields/382182 "2025-09-24T14:00:51Z")
I am using the Logstash CEF Output plugin and wish to add fields dyanmically. Below is my sample code: output { udp { port =\> 514 codec =\> cef { ... fields =\> \["cef\_fields"\] } } } I populate… --- ## [Running Fleet Server on localhost](https://discuss.elastic.co/t/running-fleet-server-on-localhost/382174)
**Author:** [@primote](https://discuss.elastic.co/u/primote)\ **Replies:** 1\ **Last updated:** [September 24, 2025, 9:36am UTC](https://discuss.elastic.co/t/running-fleet-server-on-localhost/382174 "2025-09-24T09:36:02Z")
Is it possible to run a Fleet Server on the same host as Elastic and Kibana? I\`m using basic Elasticsearch and Kibana on my VM and I would like to setup Fleet and Agents for use with Elastic Security How can i configur… --- ## [Logstash error after upgrade (of ElasticSearch, Kibana and Logstash) from 7.16.3 to 7.17.29](https://discuss.elastic.co/t/logstash-error-after-upgrade-of-elasticsearch-kibana-and-logstash-from-7-16-3-to-7-17-29/382158)
**Author:** [@milligal\_capita](https://discuss.elastic.co/u/milligal_capita)\ **Replies:** 3\ **Last updated:** [September 24, 2025, 9:29am UTC](https://discuss.elastic.co/t/logstash-error-after-upgrade-of-elasticsearch-kibana-and-logstash-from-7-16-3-to-7-17-29/382158 "2025-09-24T09:29:00Z")
No log ingestion. Logstash wont stay up. Error in logs: \[ERROR\]\[logstash.javapipeline \]\[main\] Pipeline error {:pipeline\_id=\>"main", :exception=\>#\, … --- ## [How to mock ElasticsearchServerError?](https://discuss.elastic.co/t/how-to-mock-elasticsearchservererror/382193)
**Author:** [@vedavathy](https://discuss.elastic.co/u/vedavathy)\ **Replies:** 0\ **Last updated:** [September 24, 2025, 9:23am UTC](https://discuss.elastic.co/t/how-to-mock-elasticsearchservererror/382193 "2025-09-24T09:23:21Z")
Hello, I am using .NET 8 and "Elastic.Clients.Elasticsearch" Version="8.13.2" Trying to mock test data for ElasticsearchServerError. As its a sealed class we can’t use Moq and dont want to create wrapper class. Do we h… --- ## [Adding new field to an existing index/dataview](https://discuss.elastic.co/t/adding-new-field-to-an-existing-index-dataview/382142)
**Author:** [@Russell\_Fulton](https://discuss.elastic.co/u/Russell_Fulton)\ **Replies:** 4\ **Last updated:** [September 23, 2025, 11:37pm UTC](https://discuss.elastic.co/t/adding-new-field-to-an-existing-index-dataview/382142 "2025-09-23T23:37:29Z")
version 8.18.3 I found a field in one datastream where the name in the index template did not match the one that was used in the ingested data. I have added the ‘used’ name into the index template and rotated the data… --- ## [Enrich Indices have unassigned shards](https://discuss.elastic.co/t/enrich-indices-have-unassigned-shards/382137)
**Author:** [@erikg](https://discuss.elastic.co/u/erikg)\ **Replies:** 3\ **Last updated:** [September 23, 2025, 6:19pm UTC](https://discuss.elastic.co/t/enrich-indices-have-unassigned-shards/382137 "2025-09-23T18:19:59Z")
Hello, I understand why Elastic manages the primary and replica shards of enrich indices. I get that the whole point is parallelism, but the end user should be able to manage the shard settings. It is causing an imbalan… --- ## [Index sorting on low cardinality fields](https://discuss.elastic.co/t/index-sorting-on-low-cardinality-fields/382047)
**Author:** [@spinscale](https://discuss.elastic.co/u/spinscale)\ **Replies:** 7\ **Last updated:** [September 23, 2025, 1:46pm UTC](https://discuss.elastic.co/t/index-sorting-on-low-cardinality-fields/382047 "2025-09-23T13:46:12Z")
Hey, I have been playing around with index sorting and cannot make sense of my results. Basically I have a keyword field named is\_existing that is either true or false as possible values, or may not be set at all. Basic… --- ## [Requesting feedback on benchmark results: Hot vs Frozen(Cache) vs Frozen(No-Cache)](https://discuss.elastic.co/t/requesting-feedback-on-benchmark-results-hot-vs-frozen-cache-vs-frozen-no-cache/382169)
**Author:** [@dipayans](https://discuss.elastic.co/u/dipayans)\ **Replies:** 0\ **Last updated:** [September 23, 2025, 1:34pm UTC](https://discuss.elastic.co/t/requesting-feedback-on-benchmark-results-hot-vs-frozen-cache-vs-frozen-no-cache/382169 "2025-09-23T13:34:38Z")
Hi everyone, I recently ran a set of benchmark tests to evaluate performance across Hot tier and Frozen tier searchable snapshots (with and without cache). I’d really appreciate feedback from the community to understand… --- ## [Importing data without a timezone is not UTC](https://discuss.elastic.co/t/importing-data-without-a-timezone-is-not-utc/382076)
**Author:** [@spinscale](https://discuss.elastic.co/u/spinscale)\ **Replies:** 2\ **Last updated:** [September 23, 2025, 9:57am UTC](https://discuss.elastic.co/t/importing-data-without-a-timezone-is-not-utc/382076 "2025-09-23T09:57:38Z")
Hey, I am using the CSV upload to import a data file with roughly 300k entries. Import works fine, but I have some questions about time zones. I have a field looking like this 2022-11-04 00:09:09 that does not contain … --- ## [Apache Access logs not appearing in Elasticsearch/Kibana](https://discuss.elastic.co/t/apache-access-logs-not-appearing-in-elasticsearch-kibana/382089)
**Author:** [@mcairney](https://discuss.elastic.co/u/mcairney)\ **Replies:** 7\ **Last updated:** [September 23, 2025, 9:30am UTC](https://discuss.elastic.co/t/apache-access-logs-not-appearing-in-elasticsearch-kibana/382089 "2025-09-23T09:30:20Z")
Hi, We’ve been successfully ingesting our Apache logs however as of around 2 weeks ago the access logs have stopped appearing however the error logs are still showing up in ES/Kibana. We did upgrade from 8.19.2 to 8.19.… --- ## [Creating an API Key for KIBANA](https://discuss.elastic.co/t/creating-an-api-key-for-kibana/381931)
**Author:** [@Viktor\_Movita](https://discuss.elastic.co/u/Viktor_Movita)\ **Replies:** 1\ **Last updated:** [September 23, 2025, 8:31am UTC](https://discuss.elastic.co/t/creating-an-api-key-for-kibana/381931 "2025-09-23T08:31:16Z")
Hello everyone, I am trying to create an API key that has permissions to query the /api/fleet/agents endpoint. It is important for me to minimize its permissions as much as possible. Which permissions do I need to pro… --- ## [Filebeat warning log "Cannot index event"](https://discuss.elastic.co/t/filebeat-warning-log-cannot-index-event/368808)
**Author:** [@rodolk](https://discuss.elastic.co/u/rodolk)\ **Replies:** 7\ **Last updated:** [September 23, 2025, 8:26am UTC](https://discuss.elastic.co/t/filebeat-warning-log-cannot-index-event/368808 "2025-09-23T08:26:58Z")
When sending logs from Filebeat to Elasticsearch, when there is an indexing error, Filebeat will log the message Cannot index event (status=400): dropping event! Look at the event log to view the event and cause." The … [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=37) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=39)