# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=39 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 40 --- ## [Filter index by max field value](https://discuss.elastic.co/t/filter-index-by-max-field-value/381636)
**Author:** [@PMF](https://discuss.elastic.co/u/PMF)\ **Replies:** 7\ **Last updated:** [September 23, 2025, 6:18am UTC](https://discuss.elastic.co/t/filter-index-by-max-field-value/381636 "2025-09-23T06:18:58Z")
Ok, this seems easy from a relational perspective, but I'm becoming unable to achieve it on ES: I have an index where, among others, there is a numeric field called year. I want to filter my index data, retrieving only … --- ## [Elasticsearch - Track new Geolocation an IP shows up in](https://discuss.elastic.co/t/elasticsearch-track-new-geolocation-an-ip-shows-up-in/382130)
**Author:** [@Elk\_huh](https://discuss.elastic.co/u/Elk_huh)\ **Replies:** 1\ **Last updated:** [September 23, 2025, 6:02am UTC](https://discuss.elastic.co/t/elasticsearch-track-new-geolocation-an-ip-shows-up-in/382130 "2025-09-23T06:02:46Z")
What function in Elasticsearch / kibana can we use to track if any IP shows up in a new GEOlocation Or a new IP Address shows up that isnt already there --- ## [Upgrade thoughts](https://discuss.elastic.co/t/upgrade-thoughts/382118)
**Author:** [@arcsons](https://discuss.elastic.co/u/arcsons)\ **Replies:** 2\ **Last updated:** [September 23, 2025, 2:57am UTC](https://discuss.elastic.co/t/upgrade-thoughts/382118 "2025-09-23T02:57:09Z")
Hi, I’ve never upgraded an Elastic Stack before, and it seems quite challenging! Is it just me who thinks that? I guess there’s room for improvement. I’m currently running version 8.15 and considering an upgrade to 8.… --- ## [Elasticsearch enrich policy not reflecting updated source after \_execute (v9.1.3)](https://discuss.elastic.co/t/elasticsearch-enrich-policy-not-reflecting-updated-source-after-execute-v9-1-3/382141)
**Author:** [@Daniel\_Santos1](https://discuss.elastic.co/u/Daniel_Santos1)\ **Replies:** 2\ **Last updated:** [September 23, 2025, 12:01am UTC](https://discuss.elastic.co/t/elasticsearch-enrich-policy-not-reflecting-updated-source-after-execute-v9-1-3/382141 "2025-09-23T00:01:25Z")
Hi, I’m running into an issue with enrich policies in Elasticsearch v9.1.3. When I update the source index used by an enrich policy and then re-execute the policy, the enrich simulation still returns stale data. The upd… --- ## [Unable to authenticate user \[\](https://discuss.elastic.co/t/unable-to-authenticate-user-unauthenticated-saml-user/382124)
**Author:** [@madhavsankarg](https://discuss.elastic.co/u/madhavsankarg)\ **Replies:** 1\ **Last updated:** [September 22, 2025, 2:22pm UTC](https://discuss.elastic.co/t/unable-to-authenticate-user-unauthenticated-saml-user/382124 "2025-09-22T14:22:23Z")
Hi All, I have Updated the Elasticstack from 8.14.1 to 8.18.1. Currently encountering error of SAML login. In our setup we are using SSO of Azure to login to Kibana. Error I am getting in kibana logs {"event":{"acti… --- ## [Java API client - single metric aggregation zero or null deserializer](https://discuss.elastic.co/t/java-api-client-single-metric-aggregation-zero-or-null-deserializer/356207)
**Author:** [@Almog\_Oz](https://discuss.elastic.co/u/Almog_Oz)\ **Replies:** 2\ **Last updated:** [September 22, 2025, 1:44pm UTC](https://discuss.elastic.co/t/java-api-client-single-metric-aggregation-zero-or-null-deserializer/356207 "2025-09-22T13:44:39Z")
I am using elasticsearch-java api client (8.10.3) and facing a small issue and I hope someone has already encountered this issue before. I am trying to perform a min aggregation on documents that may not contain the fie… --- ## [Track ingest rate of data\_streams by size](https://discuss.elastic.co/t/track-ingest-rate-of-data-streams-by-size/382080)
**Author:** [@djkprojects](https://discuss.elastic.co/u/djkprojects)\ **Replies:** 1\ **Last updated:** [September 22, 2025, 10:26am UTC](https://discuss.elastic.co/t/track-ingest-rate-of-data-streams-by-size/382080 "2025-09-22T10:26:41Z")
Hello, We want to track ingest rate of data streams and other indices in our stack by volume (how much data in GB each data stream received e.g. daily). We are aware of various APIs that give certain information about i… --- ## [Passing Values From Links to Controls](https://discuss.elastic.co/t/passing-values-from-links-to-controls/372169)
**Author:** [@msavitski](https://discuss.elastic.co/u/msavitski)\ **Replies:** 1\ **Last updated:** [September 22, 2025, 8:06am UTC](https://discuss.elastic.co/t/passing-values-from-links-to-controls/372169 "2025-09-22T08:06:15Z")
Hi there! I have a question related to the link panel. Thanks for functionality, I have successfully integrated it into the dashboard. On the first dashboard, I have controls, and when I navigate to another dashboard, … --- ## [Logstash is failing with syntax error](https://discuss.elastic.co/t/logstash-is-failing-with-syntax-error/382073)
**Author:** [@piyush\_hn](https://discuss.elastic.co/u/piyush_hn)\ **Replies:** 3\ **Last updated:** [September 19, 2025, 5:18pm UTC](https://discuss.elastic.co/t/logstash-is-failing-with-syntax-error/382073 "2025-09-19T17:18:36Z")
Hi All, Please advise on the below error, w.r.t the .conf file. \[2025-09-19T07:11:21,135\]\[ERROR\]\[logstash.agent \] Failed to execute action {:action=\>LogStash::PipelineAction::Create/pipeline\_id:main, :except… --- ## [Elasticsearch v5.5.3 to v7.17.7](https://discuss.elastic.co/t/elasticsearch-v5-5-3-to-v7-17-7/382028)
**Author:** [@Gord1](https://discuss.elastic.co/u/Gord1)\ **Replies:** 2\ **Last updated:** [September 19, 2025, 3:04pm UTC](https://discuss.elastic.co/t/elasticsearch-v5-5-3-to-v7-17-7/382028 "2025-09-19T15:04:19Z")
Hello, I am new to Elasticsearch and need to perform an upgrade from v5.5.3 to v7.17.7. I want to upgrade directly from v5.5.3 to v7.17.7 in a windows cluster. Another team in out environment were not able to do the r… --- ## [Kibana 8.13.4 Fails to Authenticate to Elasticsearch 8.13.4 with Service Account Token (security\_exception)](https://discuss.elastic.co/t/kibana-8-13-4-fails-to-authenticate-to-elasticsearch-8-13-4-with-service-account-token-security-exception/382086)
**Author:** [@Himanshu\_Sharma1](https://discuss.elastic.co/u/Himanshu_Sharma1)\ **Replies:** 1\ **Last updated:** [September 19, 2025, 2:55pm UTC](https://discuss.elastic.co/t/kibana-8-13-4-fails-to-authenticate-to-elasticsearch-8-13-4-with-service-account-token-security-exception/382086 "2025-09-19T14:55:45Z")
Description: I am running Elasticsearch and Kibana, both version 8.13.4, on Kubernetes. Kibana is configured to use a service account token (generated for elastic/kibana) mounted as a file and referenced in kibana.yml. … --- ## [Syslog filters](https://discuss.elastic.co/t/syslog-filters/382067)
**Author:** [@Contact](https://discuss.elastic.co/u/Contact)\ **Replies:** 2\ **Last updated:** [September 19, 2025, 2:22pm UTC](https://discuss.elastic.co/t/syslog-filters/382067 "2025-09-19T14:22:45Z")
Hi there, I want to capture Server: IPv4 information for log corellation. I’m receiving syslog messages from(cisco) in the below format: @timestamp: "2025-09-18T00:49:35.275360534Z" dataSource: "89.115.123.60" dataType… --- ## [Serialisation into SearchResponse takes a lot of time](https://discuss.elastic.co/t/serialisation-into-searchresponse-takes-a-lot-of-time/382083)
**Author:** [@karuna\_kukreja](https://discuss.elastic.co/u/karuna_kukreja)\ **Replies:** 2\ **Last updated:** [September 19, 2025, 1:55pm UTC](https://discuss.elastic.co/t/serialisation-into-searchresponse-takes-a-lot-of-time/382083 "2025-09-19T13:55:29Z")
I am using Elastic Search Java client to search for documents in elasticsearch. The search request itself on ES takes (took) 165ms, however the ovreall time taken to convert the same into SearchResponse takes about 121… --- ## [The Elasticsearch trial ends when I add an ML node after 10 minutes](https://discuss.elastic.co/t/the-elasticsearch-trial-ends-when-i-add-an-ml-node-after-10-minutes/381997)
**Author:** [@kheabrosec](https://discuss.elastic.co/u/kheabrosec)\ **Replies:** 5\ **Last updated:** [September 19, 2025, 1:15pm UTC](https://discuss.elastic.co/t/the-elasticsearch-trial-ends-when-i-add-an-ml-node-after-10-minutes/381997 "2025-09-19T13:15:22Z")
I'm playing around a bit with Elastic Cloud on K8s, and I decided to activate the trial. Ten minutes later, I decided to add a node with ML and Transform roles so I could run some jobs and do some testing. It's a test … --- ## [Null characters in org.opencontainers.image.title lable in image manifest](https://discuss.elastic.co/t/null-characters-in-org-opencontainers-image-title-lable-in-image-manifest/382071)
**Author:** [@erilor](https://discuss.elastic.co/u/erilor)\ **Replies:** 2\ **Last updated:** [September 19, 2025, 7:58am UTC](https://discuss.elastic.co/t/null-characters-in-org-opencontainers-image-title-lable-in-image-manifest/382071 "2025-09-19T07:58:49Z")
Some of the labels of the arm image of filebeat:9.1.4 contains Null characters (\\u0000). This stops us from uploading it to Artifactory (some labels removed for brevity): "Labels": { "architecture": "aarch64", … --- ## [Running into "Request rate too high 503" S3 error during snapshots](https://discuss.elastic.co/t/running-into-request-rate-too-high-503-s3-error-during-snapshots/382062)
**Author:** [@indu\_s](https://discuss.elastic.co/u/indu_s)\ **Replies:** 1\ **Last updated:** [September 19, 2025, 7:22am UTC](https://discuss.elastic.co/t/running-into-request-rate-too-high-503-s3-error-during-snapshots/382062 "2025-09-19T07:22:28Z")
I’m running Elastic v8.8.2 on Kubernetes and sometimes, snapshots only partially succeed with error message AmazonS3Exception\\\[Please reduce your request rate. (Service: Amazon S3; Status Code: 503; Error Code: SlowDown;.… --- ## [Kibana 8.9.14 build fails](https://discuss.elastic.co/t/kibana-8-9-14-build-fails/382066)
**Author:** [@Amit\_Kaplan](https://discuss.elastic.co/u/Amit_Kaplan)\ **Replies:** 0\ **Last updated:** [September 18, 2025, 6:03pm UTC](https://discuss.elastic.co/t/kibana-8-9-14-build-fails/382066 "2025-09-18T18:03:40Z")
I’m trying to build kibana 8.9.14 using the same build instructions that I used to build 8.9.13 but it fails with an error related to moon usage It fails on “yarn kbn bootstrap --offline --allow-root” any help? --- ## [Interleaving search results in ElasticSearch](https://discuss.elastic.co/t/interleaving-search-results-in-elasticsearch/382063)
**Author:** [@malaranjo](https://discuss.elastic.co/u/malaranjo)\ **Replies:** 0\ **Last updated:** [September 18, 2025, 4:40pm UTC](https://discuss.elastic.co/t/interleaving-search-results-in-elasticsearch/382063 "2025-09-18T16:40:50Z")
Hi Elasticsearch community, I’m implementing a search feature where items belong to groups, and some groups are marked as premium. I want search results to: Show all items from premium groups first, then non-premium … --- ## [How to pass the dynamic date in the body section of http input in the Watcher config](https://discuss.elastic.co/t/how-to-pass-the-dynamic-date-in-the-body-section-of-http-input-in-the-watcher-config/382024)
**Author:** [@Ria\_Shah](https://discuss.elastic.co/u/Ria_Shah)\ **Replies:** 1\ **Last updated:** [September 18, 2025, 11:08am UTC](https://discuss.elastic.co/t/how-to-pass-the-dynamic-date-in-the-body-section-of-http-input-in-the-watcher-config/382024 "2025-09-18T11:08:18Z")
The below is my watcher config and I want to pass the dynamic date in the body part so that it can take the current date in MM-dd-yyyy format to call the REST aPI endpoint: { "trigger": { "schedule": { "inte… --- ## [Facing this error "illegal\_argument\_exception: Fielddata is disabled"](https://discuss.elastic.co/t/facing-this-error-illegal-argument-exception-fielddata-is-disabled/382044)
**Author:** [@Mihir\_Mistry](https://discuss.elastic.co/u/Mihir_Mistry)\ **Replies:** 1\ **Last updated:** [September 18, 2025, 10:54am UTC](https://discuss.elastic.co/t/facing-this-error-illegal-argument-exception-fielddata-is-disabled/382044 "2025-09-18T10:54:15Z")
I am working on a website that uses Elasticsearch for searching functionality, and the project has been working fine, but I am facing this error. You can see the error in the attached screenshot. I just want to know if … --- ## [Elasticsearch Keystore error: Device or Resource Busy while upgrading](https://discuss.elastic.co/t/elasticsearch-keystore-error-device-or-resource-busy-while-upgrading/362884)
**Author:** [@Umang\_Pachaury](https://discuss.elastic.co/u/Umang_Pachaury)\ **Replies:** 4\ **Last updated:** [September 18, 2025, 7:35am UTC](https://discuss.elastic.co/t/elasticsearch-keystore-error-device-or-resource-busy-while-upgrading/362884 "2025-09-18T07:35:00Z")
Hello, I have a multi node Elasticsearch cluster running on version 8.13.4. The cluster needed Slack Integration and AD/LDAP integration so it also has elasticsearch.keystore file bind mount to it. The cluster is set u… --- ## [Can ES support the modification of the shard role for the ilm history index?](https://discuss.elastic.co/t/can-es-support-the-modification-of-the-shard-role-for-the-ilm-history-index/381951)
**Author:** [@EricTowns](https://discuss.elastic.co/u/EricTowns)\ **Replies:** 8\ **Last updated:** [September 18, 2025, 4:06am UTC](https://discuss.elastic.co/t/can-es-support-the-modification-of-the-shard-role-for-the-ilm-history-index/381951 "2025-09-18T04:06:00Z")
My ES cluster is currently running out of disk space. The new disks are still being purchased. I want to try my best to preserve my data, so I'm using the method of deleting replicas to cope with the current situation. T… --- ## [Custom plugin of title styling in v9.0.2](https://discuss.elastic.co/t/custom-plugin-of-title-styling-in-v9-0-2/381974)
**Author:** [@Mayuri\_Jaiswal](https://discuss.elastic.co/u/Mayuri_Jaiswal)\ **Replies:** 1\ **Last updated:** [September 18, 2025, 12:02am UTC](https://discuss.elastic.co/t/custom-plugin-of-title-styling-in-v9-0-2/381974 "2025-09-18T00:02:49Z")
As generated plugin which is for styling title of visualisation suppose table or any other visual having title so have to customise setting like title font size,its colour its background colour alignment etc just like MS… --- ## [Can I restrict some fleet users to a subset of agents?](https://discuss.elastic.co/t/can-i-restrict-some-fleet-users-to-a-subset-of-agents/382034)
**Author:** [@rugenl](https://discuss.elastic.co/u/rugenl)\ **Replies:** 1\ **Last updated:** [September 17, 2025, 10:26pm UTC](https://discuss.elastic.co/t/can-i-restrict-some-fleet-users-to-a-subset-of-agents/382034 "2025-09-17T22:26:58Z")
I have been asked to allow some server admins access to fleet. I only want to allow them to break their subset of agents, not all. Is this possible? It’s a cloud hosted, latest version stack. Thanks --- ## [Need to Know SSL information like common name/serial number of the certificate used by client to connect to elasticsearch?](https://discuss.elastic.co/t/need-to-know-ssl-information-like-common-name-serial-number-of-the-certificate-used-by-client-to-connect-to-elasticsearch/382001)
**Author:** [@gangaeswari](https://discuss.elastic.co/u/gangaeswari)\ **Replies:** 0\ **Last updated:** [September 17, 2025, 6:39am UTC](https://discuss.elastic.co/t/need-to-know-ssl-information-like-common-name-serial-number-of-the-certificate-used-by-client-to-connect-to-elasticsearch/382001 "2025-09-17T06:39:43Z")
Need to Know SSL information like common name/serial number of the certificate used by client to connect to elasticsearch? Is this possible? Elastic log this information in any system indices? --- ## [Adding new Elastic Node to Cluster: Node stays undiscovered](https://discuss.elastic.co/t/adding-new-elastic-node-to-cluster-node-stays-undiscovered/382007)
**Author:** [@ElasticUser\_NextDoor](https://discuss.elastic.co/u/ElasticUser_NextDoor)\ **Replies:** 2\ **Last updated:** [September 17, 2025, 1:24pm UTC](https://discuss.elastic.co/t/adding-new-elastic-node-to-cluster-node-stays-undiscovered/382007 "2025-09-17T13:24:13Z")
Hi, I am trying to add a new node to an already existing cluster but it seems the discovery won’t do its job. Even after restarting the master node the discovery process won’t start or at least not detect the new node. … --- ## [Dashboard variables set dynamically from a query](https://discuss.elastic.co/t/dashboard-variables-set-dynamically-from-a-query/379507)
**Author:** [@tallakh](https://discuss.elastic.co/u/tallakh)\ **Replies:** 14\ **Last updated:** [September 17, 2025, 10:13am UTC](https://discuss.elastic.co/t/dashboard-variables-set-dynamically-from-a-query/379507 "2025-09-17T10:13:39Z")
Hi! I'm looking for a feature that I don't think is possible to do now, but I hope it will come in the future. We are using Kibana dashboards to get insights into our sales performance. I want to be able set a variable … --- ## [Systemd missing from filebeat in version 8.19.3](https://discuss.elastic.co/t/systemd-missing-from-filebeat-in-version-8-19-3/381952)
**Author:** [@bbailey](https://discuss.elastic.co/u/bbailey)\ **Replies:** 2\ **Last updated:** [September 17, 2025, 7:44am UTC](https://discuss.elastic.co/t/systemd-missing-from-filebeat-in-version-8-19-3/381952 "2025-09-17T07:44:26Z")
It appears that support for journald input has been broken in release 8.19.3 This was previously fixed in version 8.18.3 (see Add systemd to Ubuntu based images by belimawr · Pull Request #44295 · elastic/beats · GitHub)… --- ## [Logstash initialization failed](https://discuss.elastic.co/t/logstash-initialization-failed/381933)
**Author:** [@piyush\_hn](https://discuss.elastic.co/u/piyush_hn)\ **Replies:** 2\ **Last updated:** [September 17, 2025, 5:05am UTC](https://discuss.elastic.co/t/logstash-initialization-failed/381933 "2025-09-17T05:05:53Z")
Anyone knows what the below error means please ? \[2025-09-14T16:24:11,750\]\[ERROR\]\[logstash.outputs.elasticsearch\]\[main\] Failed to install template {:message=\>"Failed to load default template for Elasticsearch v9 with E… --- ## [Elastic Agent MSI – Is INSTALLDIR supported for custom installation directory?](https://discuss.elastic.co/t/elastic-agent-msi-is-installdir-supported-for-custom-installation-directory/381998)
**Author:** [@josh\_tran](https://discuss.elastic.co/u/josh_tran)\ **Replies:** 0\ **Last updated:** [September 17, 2025, 4:10am UTC](https://discuss.elastic.co/t/elastic-agent-msi-is-installdir-supported-for-custom-installation-directory/381998 "2025-09-17T04:10:00Z")
Hi all, I am installing Elastic Agent 9.0.4 using the MSI package and I would like to place it in a custom directory. According to the official elastic documentation, it seems possible to specify a custom installation … [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=38) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=40)