# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=4 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 5 --- ## [Installing es-kb-stack via helm overriding nodeSelector](https://discuss.elastic.co/t/installing-es-kb-stack-via-helm-overriding-nodeselector/389620)
**Author:** [@lesio999](https://discuss.elastic.co/u/lesio999)\ **Replies:** 0\ **Last updated:** [August 14, 2026, 12:26pm UTC](https://discuss.elastic.co/t/installing-es-kb-stack-via-helm-overriding-nodeselector/389620 "2026-08-14T12:26:01Z")
Hi, I'm fighting installation es-kb-stack installation via helm in cluster when I have Windows and Linux node. I can fix post installation by adding nodeSelector on running statefulset and deployment but could not get i… --- ## [Alert rule using an ES QL query with fork branches and email action on conditional fork1 result](https://discuss.elastic.co/t/alert-rule-using-an-es-ql-query-with-fork-branches-and-email-action-on-conditional-fork1-result/389616)
**Author:** [@mape](https://discuss.elastic.co/u/mape)\ **Replies:** 0\ **Last updated:** [August 14, 2026, 11:11am UTC](https://discuss.elastic.co/t/alert-rule-using-an-es-ql-query-with-fork-branches-and-email-action-on-conditional-fork1-result/389616 "2026-08-14T11:11:46Z")
Hi. I want to create an Alert Rule using the elasticsearch query which contains an ES QL query with 4 fork branches, each fork running a different query and collecting STATS on different fields. This works all well. N… --- ## [AI chat history retention](https://discuss.elastic.co/t/ai-chat-history-retention/389614)
**Author:** [@venkatkumar229](https://discuss.elastic.co/u/venkatkumar229)\ **Replies:** 2\ **Last updated:** [August 14, 2026, 11:03am UTC](https://discuss.elastic.co/t/ai-chat-history-retention/389614 "2026-08-14T11:03:30Z")
Hi Team, Could you please confirm how long the Elastic AI Assistant / Agent Builder chat history is retained by default? Is there any default retention period (e.g., 30/60/90 days), and can this retention period be con… --- ## [Advanced Tab is missing in Streams Page in 9.5.0](https://discuss.elastic.co/t/advanced-tab-is-missing-in-streams-page-in-9-5-0/389476)
**Author:** [@Suren\_R](https://discuss.elastic.co/u/Suren_R)\ **Replies:** 2\ **Last updated:** [August 13, 2026, 3:10pm UTC](https://discuss.elastic.co/t/advanced-tab-is-missing-in-streams-page-in-9-5-0/389476 "2026-08-13T15:10:16Z")
After upgrading to 9.5.1, I can no longer see Advanced Tab in Streams page. This section allowed to easily configure the number of shards and refresh interval of backing indices without having to edit JSON settings in in… --- ## [Security Update Cadence Concern - Too Frequent for Enterprise Upgrade Cycles and Recurring Fleet Vulnerabilities](https://discuss.elastic.co/t/security-update-cadence-concern-too-frequent-for-enterprise-upgrade-cycles-and-recurring-fleet-vulnerabilities/386569)
**Author:** [@Tortoise](https://discuss.elastic.co/u/Tortoise)\ **Replies:** 4\ **Last updated:** [August 13, 2026, 12:37pm UTC](https://discuss.elastic.co/t/security-update-cadence-concern-too-frequent-for-enterprise-upgrade-cycles-and-recurring-fleet-vulnerabilities/386569 "2026-08-13T12:37:55Z")
Hi Elastic team and community, I want to raise a concern around the frequency of security updates and the recurring nature of vulnerabilities in the Fleet plugin specifically. Looking at the Security Announcements foru… --- ## [/app/fleet/agents shows no agents in Kibana, but API does](https://discuss.elastic.co/t/app-fleet-agents-shows-no-agents-in-kibana-but-api-does/388372)
**Author:** [@leprovokateur](https://discuss.elastic.co/u/leprovokateur)\ **Replies:** 7\ **Last updated:** [August 13, 2026, 11:48am UTC](https://discuss.elastic.co/t/app-fleet-agents-shows-no-agents-in-kibana-but-api-does/388372 "2026-08-13T11:48:22Z")
Hi, I use elastic stack in version 9.4.3. I have one fleet instance running, but it's not visible in the Kibana UI: An API call via curl shows otherwise: { "items": \[ { "id": "3b28b7af-6b94-4a08-8105-5ba0b25afd… --- ## [Truncate a Mustache variable in an Alerting rule action (e.g. limit a long text field to N words)?](https://discuss.elastic.co/t/truncate-a-mustache-variable-in-an-alerting-rule-action-e-g-limit-a-long-text-field-to-n-words/389290)
**Author:** [@Tortoise](https://discuss.elastic.co/u/Tortoise)\ **Replies:** 2\ **Last updated:** [August 13, 2026, 5:23am UTC](https://discuss.elastic.co/t/truncate-a-mustache-variable-in-an-alerting-rule-action-e-g-limit-a-long-text-field-to-n-words/389290 "2026-08-13T05:23:43Z")
Hello Team, Kibana version: 9.x We have a rule (Elasticsearch query rule type) that runs every few minutes against an index of banking transaction logs. When it matches, the action is an Index connector that writes a s… --- ## [Logstash elastic\_agent input: connection resets](https://discuss.elastic.co/t/logstash-elastic-agent-input-connection-resets/388898)
**Author:** [@CD9820](https://discuss.elastic.co/u/CD9820)\ **Replies:** 1\ **Last updated:** [August 13, 2026, 4:57am UTC](https://discuss.elastic.co/t/logstash-elastic-agent-input-connection-resets/388898 "2026-08-13T04:57:55Z")
I notice a lot of java.net.SocketException: Connection reset warnings in my Logstash logs. It seems this is related to the elastic\_agent input and is noticeably higher in combination with Defend. It also occurs on device… --- ## [Self-managed and air-gapped cluster: How to bypass self-signed certificate validation or configure custom endpoints in kibana.yml?](https://discuss.elastic.co/t/self-managed-and-air-gapped-cluster-how-to-bypass-self-signed-certificate-validation-or-configure-custom-endpoints-in-kibana-yml/389266)
**Author:** [@Osmel\_Pillot\_Leyva](https://discuss.elastic.co/u/Osmel_Pillot_Leyva)\ **Replies:** 2\ **Last updated:** [August 12, 2026, 7:55pm UTC](https://discuss.elastic.co/t/self-managed-and-air-gapped-cluster-how-to-bypass-self-signed-certificate-validation-or-configure-custom-endpoints-in-kibana-yml/389266 "2026-08-12T19:55:01Z")
Hi everyone, I manage a self-managed, completely air-gapped Elastic cluster in an isolated network environment with no internet access. In our corporate infrastructure, we have an internal ERP and EMS running with self… --- ## [Indices Stack Monitoring - Cannot expand \`inner\_hits\` for collapse field \`index\_stats.index\`](https://discuss.elastic.co/t/indices-stack-monitoring-cannot-expand-inner-hits-for-collapse-field-index-stats-index/386205)
**Author:** [@adminunix](https://discuss.elastic.co/u/adminunix)\ **Replies:** 3\ **Last updated:** [August 12, 2026, 3:53pm UTC](https://discuss.elastic.co/t/indices-stack-monitoring-cannot-expand-inner-hits-for-collapse-field-index-stats-index/386205 "2026-08-12T15:53:42Z")
Hello, We have updated to Elasticsearch 9.4.0, Kibana 9.4.0, Elastic Agent 9.4.0 and Elasticsearch monitoring integration 1.20.2. Since then, the Stack Monitong Indices tab is broken and does not load the dashboard: … --- ## [Kibana dashboard elements initially not rendering the contents](https://discuss.elastic.co/t/kibana-dashboard-elements-initially-not-rendering-the-contents/389415)
**Author:** [@TheNewGuy123](https://discuss.elastic.co/u/TheNewGuy123)\ **Replies:** 3\ **Last updated:** [August 12, 2026, 1:40pm UTC](https://discuss.elastic.co/t/kibana-dashboard-elements-initially-not-rendering-the-contents/389415 "2026-08-12T13:40:29Z")
I have cloud hosted Elasticsearch solution. After updating from 9.2.8 to 9.4.3 I have issues when loading the data into Kibana dashboard. Before updating all dashboards loaded the data and rendered the visualisation with… --- ## [Error occurred during the signature verification](https://discuss.elastic.co/t/error-occurred-during-the-signature-verification/389364)
**Author:** [@yoitsdope](https://discuss.elastic.co/u/yoitsdope)\ **Replies:** 2\ **Last updated:** [August 12, 2026, 1:25pm UTC](https://discuss.elastic.co/t/error-occurred-during-the-signature-verification/389364 "2026-08-12T13:25:50Z")
on my kali linux system every time i run apt upgrade i get this error Warning: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. OpenPGP sign… --- ## [Elastic Agent/Fleet - Winlog input missing security events](https://discuss.elastic.co/t/elastic-agent-fleet-winlog-input-missing-security-events/389452)
**Author:** [@Stephen\_P](https://discuss.elastic.co/u/Stephen_P)\ **Replies:** 1\ **Last updated:** [August 12, 2026, 12:47pm UTC](https://discuss.elastic.co/t/elastic-agent-fleet-winlog-input-missing-security-events/389452 "2026-08-12T12:47:07Z")
Hey all I'm working on deploying a Elastic stac POC but have hit a strange issue with collecting windows security event logs Environment Elasticsearch/Kibana/Fleet Server: 9.5.1 Tested Elastic Agent: 9.5.1 and 9.… --- ## [Log Source Stopped Working](https://discuss.elastic.co/t/log-source-stopped-working/389423)
**Author:** [@tortnike.e](https://discuss.elastic.co/u/tortnike.e)\ **Replies:** 1\ **Last updated:** [August 11, 2026, 11:35am UTC](https://discuss.elastic.co/t/log-source-stopped-working/389423 "2026-08-11T11:35:49Z")
Hello Guys, How do you monitor log sources? I need to monitor some of Data Streams, when they are not sending logs, I need to be alerted. What do you suggest? I have created esql rule but sometimes it is not woking: F… --- ## [Elasticsearch Search Results on My Website Become Increasingly Slow After the Index Runs for Several Days](https://discuss.elastic.co/t/elasticsearch-search-results-on-my-website-become-increasingly-slow-after-the-index-runs-for-several-days/389392)
**Author:** [@joeroot](https://discuss.elastic.co/u/joeroot)\ **Replies:** 1\ **Last updated:** [August 11, 2026, 7:53am UTC](https://discuss.elastic.co/t/elasticsearch-search-results-on-my-website-become-increasingly-slow-after-the-index-runs-for-several-days/389392 "2026-08-11T07:53:21Z")
Hello Elastic Community, I am currently facing one persistent performance issue with the search functionality on my website, which uses Elasticsearch to index and retrieve website content. The core problem is that searc… --- ## [Snapshot repository](https://discuss.elastic.co/t/snapshot-repository/389276)
**Author:** [@Shahar\_Argov](https://discuss.elastic.co/u/Shahar_Argov)\ **Replies:** 6\ **Last updated:** [August 9, 2026, 8:03am UTC](https://discuss.elastic.co/t/snapshot-repository/389276 "2026-08-09T08:03:24Z")
hi again, i have a problem with my snapshot repository I'm using the data tiers in the elastic (the data from my winbeats is going from my winlogbeats to the logstash and from there to the elastic hot node, warm node a… --- ## [How to handle ILM for managed system data streams (logs, metrics)](https://discuss.elastic.co/t/how-to-handle-ilm-for-managed-system-data-streams-logs-metrics/389330)
**Author:** [@rex656](https://discuss.elastic.co/u/rex656)\ **Replies:** 1\ **Last updated:** [August 8, 2026, 8:07pm UTC](https://discuss.elastic.co/t/how-to-handle-ilm-for-managed-system-data-streams-logs-metrics/389330 "2026-08-08T20:07:41Z")
I recently migrated from beats to fleet managed agents (about 500 servers total, mostly windows) and am wondering what best practice is for managing the system managed data streams for logs and metrics (logs-system\*, met… --- ## [Logstash ILM rollover alias unexpectedly treated as Data Stream after backing index deletion](https://discuss.elastic.co/t/logstash-ilm-rollover-alias-unexpectedly-treated-as-data-stream-after-backing-index-deletion/389295)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 2\ **Last updated:** [August 8, 2026, 7:21pm UTC](https://discuss.elastic.co/t/logstash-ilm-rollover-alias-unexpectedly-treated-as-data-stream-after-backing-index-deletion/389295 "2026-08-08T19:21:42Z")
Hello Folks, I am using Elastic Cloud v8.16. I am sending some data to Elasticsearch using Logstash.Below is the logstash configuration (output to elastic) elasticsearch { hosts =\> '${ELASTIC\_URL}' user =\> "${ELASTIC… --- ## [Change grpc port to 6788 on fleet controled agent](https://discuss.elastic.co/t/change-grpc-port-to-6788-on-fleet-controled-agent/388416)
**Author:** [@GKre](https://discuss.elastic.co/u/GKre)\ **Replies:** 12\ **Last updated:** [August 8, 2026, 4:44am UTC](https://discuss.elastic.co/t/change-grpc-port-to-6788-on-fleet-controled-agent/388416 "2026-08-08T04:44:56Z")
Hello, i want to install UniFi OS Server on my windows server. Unfortunately the elastic agent is using port 6789. I wonder if i can change this with a dedicated policy for this server? seems like agent.grpc.port: 67… --- ## [Add the Valkey keys\_with\_volatile\_items keyspace metric](https://discuss.elastic.co/t/add-the-valkey-keys-with-volatile-items-keyspace-metric/389280)
**Author:** [@aglowienka](https://discuss.elastic.co/u/aglowienka)\ **Replies:** 2\ **Last updated:** [August 6, 2026, 3:05pm UTC](https://discuss.elastic.co/t/add-the-valkey-keys-with-volatile-items-keyspace-metric/389280 "2026-08-06T15:05:17Z")
Valkey ≥ 9.0 reports a per-database keys\_with\_volatile\_items counter in INFO keyspace that Metricbeat's redis.keyspace metricset does not collect. Please add it as redis.keyspace.keys\_with\_volatile\_items (long), alongs… --- ## [Assigning an Index Template to an ILM Policy Gets Periodically Removed](https://discuss.elastic.co/t/assigning-an-index-template-to-an-ilm-policy-gets-periodically-removed/389274)
**Author:** [@YousefNein](https://discuss.elastic.co/u/YousefNein)\ **Replies:** 8\ **Last updated:** [August 6, 2026, 2:30pm UTC](https://discuss.elastic.co/t/assigning-an-index-template-to-an-ilm-policy-gets-periodically-removed/389274 "2026-08-06T14:30:17Z")
As the title suggests, I keep assigning the index template that I want to be linked with a certain ILM, then after some time I go check it and find that they went back to the previous one. This happened to me numerou… --- ## [Winlogbeat 9.4.3 parsing fields wrong unless include\_xml is supplied](https://discuss.elastic.co/t/winlogbeat-9-4-3-parsing-fields-wrong-unless-include-xml-is-supplied/388680)
**Author:** [@tt-ah](https://discuss.elastic.co/u/tt-ah)\ **Replies:** 2\ **Last updated:** [August 6, 2026, 1:50pm UTC](https://discuss.elastic.co/t/winlogbeat-9-4-3-parsing-fields-wrong-unless-include-xml-is-supplied/388680 "2026-08-06T13:50:15Z")
Hello everyone! I noticed at least one field being processed incorrectly after updating our Elasticsearch and Winlogbeats to 9.4.3 (from 8.x.x). I do not have other findings yet, but I doubt this is the only case. Appl… --- ## [Does doing a POST query via the devtools update index-pattern?](https://discuss.elastic.co/t/does-doing-a-post-query-via-the-devtools-update-index-pattern/389264)
**Author:** [@Whoami1980](https://discuss.elastic.co/u/Whoami1980)\ **Replies:** 1\ **Last updated:** [August 5, 2026, 4:03pm UTC](https://discuss.elastic.co/t/does-doing-a-post-query-via-the-devtools-update-index-pattern/389264 "2026-08-05T16:03:54Z")
Does doing a POST query likes these via the devtools update index-pattern? If the answer is yes. Does it impact the data in Elasticsearch? Or its purely visualization? POST /\_query?format=txt { "query": """ FROM … --- ## [Ubuntu 26.04 LTS Support Timeline — Open Source Elasticsearch 8.19.19](https://discuss.elastic.co/t/ubuntu-26-04-lts-support-timeline-open-source-elasticsearch-8-19-19/388964)
**Author:** [@Rex\_Rajat](https://discuss.elastic.co/u/Rex_Rajat)\ **Replies:** 2\ **Last updated:** [August 5, 2026, 7:25am UTC](https://discuss.elastic.co/t/ubuntu-26-04-lts-support-timeline-open-source-elasticsearch-8-19-19/388964 "2026-08-05T07:25:25Z")
Hi Elastic team, We run open-source Elasticsearch (self-managed) on Ubuntu 24.04 LTS and are evaluating a move to Ubuntu 26.04 LTS. The official Support Matrix doesn't yet list 26.04. Could you share: Expected timelin… --- ## [HELP: Disable "Help Us Improve Elastic" Pop-Up on Kibana Visualizations](https://discuss.elastic.co/t/help-disable-help-us-improve-elastic-pop-up-on-kibana-visualizations/388990)
**Author:** [@dan\_walker](https://discuss.elastic.co/u/dan_walker)\ **Replies:** 1\ **Last updated:** [August 4, 2026, 5:58pm UTC](https://discuss.elastic.co/t/help-disable-help-us-improve-elastic-pop-up-on-kibana-visualizations/388990 "2026-08-04T17:58:41Z")
Is there a way to disable these "Help Us Improve Elastic" pop-ups in Kibana? We embed these views in reports which makes the pop-up un-clickable by end-users. They block vital information in the chart. --- ## [Inquiry About Quarantined Kibana Task Manager Index File](https://discuss.elastic.co/t/inquiry-about-quarantined-kibana-task-manager-index-file/388947)
**Author:** [@Frances\_Chu](https://discuss.elastic.co/u/Frances_Chu)\ **Replies:** 1\ **Last updated:** [August 3, 2026, 9:04am UTC](https://discuss.elastic.co/t/inquiry-about-quarantined-kibana-task-manager-index-file/388947 "2026-08-03T09:04:25Z")
We would like to raise a case regarding a quarantined file related to one of our Elasticsearch/Kibana indices. While checking the index UUID, we found that it appears to be related to the following Kibana index ".kiban… --- ## [Merging Deployments](https://discuss.elastic.co/t/merging-deployments/388830)
**Author:** [@Tortoise](https://discuss.elastic.co/u/Tortoise)\ **Replies:** 4\ **Last updated:** [August 1, 2026, 12:42pm UTC](https://discuss.elastic.co/t/merging-deployments/388830 "2026-08-01T12:42:28Z")
Hello Folks , Say on Cloud i have a deployment ABC & XYZ. I now want to merge these 2 deployments say XYZ to ABC instead of managing both the deployments separately . Could someone share pointers or high level steps , … --- ## [ES Java Client 9.2.4 -\> 9.4.4 performance regression. HttpComponents 5.4.4 -\> 5.6 to blame?](https://discuss.elastic.co/t/es-java-client-9-2-4-9-4-4-performance-regression-httpcomponents-5-4-4-5-6-to-blame/388868)
**Author:** [@peedeeboy](https://discuss.elastic.co/u/peedeeboy)\ **Replies:** 2\ **Last updated:** [July 31, 2026, 4:22pm UTC](https://discuss.elastic.co/t/es-java-client-9-2-4-9-4-4-performance-regression-httpcomponents-5-4-4-5-6-to-blame/388868 "2026-07-31T16:22:33Z")
Hey friends :waving\_hand: We just upgraded all our ES clusters from 9.2.4 -\> 9.4.4. Server upgrade was buttery smooth, as always! :flexed\_biceps: However, upgrading the ES Java client from 9.2.4 to 9.4.4 we noticed a … --- ## [The select time range does not include the entire bucket it may contain partial data](https://discuss.elastic.co/t/the-select-time-range-does-not-include-the-entire-bucket-it-may-contain-partial-data/388927)
**Author:** [@Ricardo\_Alves](https://discuss.elastic.co/u/Ricardo_Alves)\ **Replies:** 0\ **Last updated:** [July 31, 2026, 2:28pm UTC](https://discuss.elastic.co/t/the-select-time-range-does-not-include-the-entire-bucket-it-may-contain-partial-data/388927 "2026-07-31T14:28:56Z")
I want the graph to show just one day, and it shows me 2 days, with this message "The select time range does not include the entire bucket it may contain partial data". In attached I will send you the graph and the adva… --- ## [Removing empty indices](https://discuss.elastic.co/t/removing-empty-indices/388901)
**Author:** [@bbreer](https://discuss.elastic.co/u/bbreer)\ **Replies:** 3\ **Last updated:** [July 31, 2026, 12:43pm UTC](https://discuss.elastic.co/t/removing-empty-indices/388901 "2026-07-31T12:43:19Z")
I would like to remove these empty indices because I need to free up the shards. I know this is a restricted data stream which may be why no matter what privileges i add to the role, I still can't delete them. Any on… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=3) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=5)