# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=40 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 41 --- ## [How do you backup up a subset of system indices?](https://discuss.elastic.co/t/how-do-you-backup-up-a-subset-of-system-indices/381995)
**Author:** [@garethhumphriesgkc](https://discuss.elastic.co/u/garethhumphriesgkc)\ **Replies:** 0\ **Last updated:** [September 16, 2025, 8:58pm UTC](https://discuss.elastic.co/t/how-do-you-backup-up-a-subset-of-system-indices/381995 "2025-09-16T20:58:24Z")
Per (elastic/elasticsearch#134769) There are bunch of old indices lying around I’d like clear out - for example .reporting-2023-07-23 and .kibana\_7.15.1\_001. Having looked at the aliases I’m pretty sure these are unuse… --- ## [Constant read timeout errors while indexing; non-master nodes are idle; shard sizes are mismatched?](https://discuss.elastic.co/t/constant-read-timeout-errors-while-indexing-non-master-nodes-are-idle-shard-sizes-are-mismatched/381994)
**Author:** [@dpitchford](https://discuss.elastic.co/u/dpitchford)\ **Replies:** 0\ **Last updated:** [September 16, 2025, 8:54pm UTC](https://discuss.elastic.co/t/constant-read-timeout-errors-while-indexing-non-master-nodes-are-idle-shard-sizes-are-mismatched/381994 "2025-09-16T20:54:28Z")
We are running an Elasticsearch 9.1.2 cluster with four nodes that is displaying some erratic behavior when under indexing load. Initially when we started indexing data, all four nodes (each a separate Kubernetes pod) we… --- ## [Build issue](https://discuss.elastic.co/t/build-issue/381992)
**Author:** [@Pedro\_Pacheco](https://discuss.elastic.co/u/Pedro_Pacheco)\ **Replies:** 0\ **Last updated:** [September 16, 2025, 6:57pm UTC](https://discuss.elastic.co/t/build-issue/381992 "2025-09-16T18:57:18Z")
Hello - I am trying to build elastic from source. I clone the repo, and as I am running ./gradlew clean build, it fails here: WARNING: module-info.class ignored in patch: /Users/pedropacheco/Projects/elasticsearch/libs/… --- ## [High-Speed Log Events Not Fully Captured by Logstash File Input](https://discuss.elastic.co/t/high-speed-log-events-not-fully-captured-by-logstash-file-input/381987)
**Author:** [@jeanpierremq](https://discuss.elastic.co/u/jeanpierremq)\ **Replies:** 1\ **Last updated:** [September 16, 2025, 4:18pm UTC](https://discuss.elastic.co/t/high-speed-log-events-not-fully-captured-by-logstash-file-input/381987 "2025-09-16T16:18:44Z")
file { path =\> "/mnt/efs-logstash/application-logs/log\_workers/production\_\*.log" start\_position =\> "beginning" sincedb\_path =\> "/var/lib/logstash/sincedb\_logger" type =\> "json" stat\_interval =\> "200… --- ## [Change Elasticsearch password](https://discuss.elastic.co/t/change-elasticsearch-password/381983)
**Author:** [@juancamiloll](https://discuss.elastic.co/u/juancamiloll)\ **Replies:** 6\ **Last updated:** [September 16, 2025, 3:40pm UTC](https://discuss.elastic.co/t/change-elasticsearch-password/381983 "2025-09-16T15:40:45Z")
Hi Understanding that Logstash uses .conf files to authenticate against Elasticsearch, I am here today to ask for your help in changing the current password I have configured in the .conf files from Logstash. elasticse… --- ## [Logstash.yml file shows syntax error](https://discuss.elastic.co/t/logstash-yml-file-shows-syntax-error/381971)
**Author:** [@piyush\_hn](https://discuss.elastic.co/u/piyush_hn)\ **Replies:** 2\ **Last updated:** [September 16, 2025, 1:34pm UTC](https://discuss.elastic.co/t/logstash-yml-file-shows-syntax-error/381971 "2025-09-16T13:34:09Z")
Hi All, I am trying to setup logstash in a container but getting an error like below, can someone please help what is wrong here ?. Older version of logstash was not having any issues for “http.host”, something changed … --- ## [Blank in Kibana Tables](https://discuss.elastic.co/t/blank-in-kibana-tables/381901)
**Author:** [@elk-user-0001](https://discuss.elastic.co/u/elk-user-0001)\ **Replies:** 3\ **Last updated:** [September 16, 2025, 1:08pm UTC](https://discuss.elastic.co/t/blank-in-kibana-tables/381901 "2025-09-16T13:08:18Z")
Hello, colleagues! A client has asked me to remove the hyphens (-) from the tables and leave a blank space. Does anyone know if this is feasible without affecting the fact that it is a numeric field used for averages? … --- ## [Custom Threat Intelligence Error](https://discuss.elastic.co/t/custom-threat-intelligence-error/381975)
**Author:** [@kulisiber](https://discuss.elastic.co/u/kulisiber)\ **Replies:** 0\ **Last updated:** [September 16, 2025, 10:19am UTC](https://discuss.elastic.co/t/custom-threat-intelligence-error/381975 "2025-09-16T10:19:31Z")
Hi Elastic Community, I have testing a new integration Custom Threat Intelligence into elastic and I found some error like below: I have configure the column of SSL Configuration like below: certificate: - | ----… --- ## [Issue with Custom Plugin Causing "Elastic did not load properly"](https://discuss.elastic.co/t/issue-with-custom-plugin-causing-elastic-did-not-load-properly/361714)
**Author:** [@Antim\_K](https://discuss.elastic.co/u/Antim_K)\ **Replies:** 7\ **Last updated:** [September 16, 2025, 10:15am UTC](https://discuss.elastic.co/t/issue-with-custom-plugin-causing-elastic-did-not-load-properly/361714 "2025-09-16T10:15:31Z")
Issue with Custom Plugin Causing "Elastic did not load properly" Error in Kibana 8.14.0 Hi everyone, Greetings of the day! I have successfully cloned the Kibana repository and set up everything for local development. … --- ## [Filebeat trying to access pvc even when no data is being written](https://discuss.elastic.co/t/filebeat-trying-to-access-pvc-even-when-no-data-is-being-written/381482)
**Author:** [@Tejaswi43](https://discuss.elastic.co/u/Tejaswi43)\ **Replies:** 3\ **Last updated:** [September 16, 2025, 8:39am UTC](https://discuss.elastic.co/t/filebeat-trying-to-access-pvc-even-when-no-data-is-being-written/381482 "2025-09-16T08:39:36Z")
Hi, I was facing some issue with filebeat when it was trying access pvc of some other pod in k8s env. The owner of the pvc is stuck due the pvc was not being able to unmount as filebeat is holding. I didn’t get any con… --- ## [Dark Mode Color Scheme is not good in 9.x](https://discuss.elastic.co/t/dark-mode-color-scheme-is-not-good-in-9-x/381965)
**Author:** [@6igwig](https://discuss.elastic.co/u/6igwig)\ **Replies:** 0\ **Last updated:** [September 15, 2025, 9:05pm UTC](https://discuss.elastic.co/t/dark-mode-color-scheme-is-not-good-in-9-x/381965 "2025-09-15T21:05:04Z")
I guess I just want to know why someone has ruined dark mode’s color palette. These new colors are 0/10, an immediate reversal would be greatly appreciated. Before After P.S. Instead of playing with colors pleas… --- ## [CVE-2025-58057 Netty Security Issue](https://discuss.elastic.co/t/cve-2025-58057-netty-security-issue/381815)
**Author:** [@sfarooqui](https://discuss.elastic.co/u/sfarooqui)\ **Replies:** 2\ **Last updated:** [September 15, 2025, 8:14pm UTC](https://discuss.elastic.co/t/cve-2025-58057-netty-security-issue/381815 "2025-09-15T20:14:16Z")
Hello! I hope you are well. My team recently ran AWS ECR Inspector on our elasticsearch docker image and Inspector stated our image contains this vulnerability: CVE-2025-58057 (can’t link to the host, but it is an issue … --- ## [Postgresql timezone and error message provided grok expressions do not match field value](https://discuss.elastic.co/t/postgresql-timezone-and-error-message-provided-grok-expressions-do-not-match-field-value/381946)
**Author:** [@VillsEK](https://discuss.elastic.co/u/VillsEK)\ **Replies:** 1\ **Last updated:** [September 15, 2025, 5:03pm UTC](https://discuss.elastic.co/t/postgresql-timezone-and-error-message-provided-grok-expressions-do-not-match-field-value/381946 "2025-09-15T17:03:02Z")
Helloy there, im new in elk. can someone tell me how to fix the error "error message provided grok expressions do not match field value". I found out that when the time zone is specified as an abbreviation in the postgr… --- ## [Elastic Search Web Crawler API question](https://discuss.elastic.co/t/elastic-search-web-crawler-api-question/381963)
**Author:** [@paul1000](https://discuss.elastic.co/u/paul1000)\ **Replies:** 0\ **Last updated:** [September 15, 2025, 4:51pm UTC](https://discuss.elastic.co/t/elastic-search-web-crawler-api-question/381963 "2025-09-15T16:51:29Z")
Hi, I have set up Elastic (Enterprise) Web Crawler indexes and would like to manage these via APIs. I am aware that the App Search Web Crawler can be managed via an API and also that open web crawler can be as well how… --- ## [Distance feature query that weights null values lower](https://discuss.elastic.co/t/distance-feature-query-that-weights-null-values-lower/381956)
**Author:** [@jorgenfu](https://discuss.elastic.co/u/jorgenfu)\ **Replies:** 0\ **Last updated:** [September 15, 2025, 2:18pm UTC](https://discuss.elastic.co/t/distance-feature-query-that-weights-null-values-lower/381956 "2025-09-15T14:18:57Z")
I’m looking for a way to weights documents higher based on a date field called publicationDate, but where the weight is lowest if the date field is null, instead of highest. The full query is a bool query with several s… --- ## [How to prevent default header parameter from being passed with webhook action in Watcher](https://discuss.elastic.co/t/how-to-prevent-default-header-parameter-from-being-passed-with-webhook-action-in-watcher/381544)
**Author:** [@adityabk](https://discuss.elastic.co/u/adityabk)\ **Replies:** 3\ **Last updated:** [September 15, 2025, 1:51pm UTC](https://discuss.elastic.co/t/how-to-prevent-default-header-parameter-from-being-passed-with-webhook-action-in-watcher/381544 "2025-09-15T13:51:00Z")
I have a Watcher watch that uses webhook action to send HTTPS request to a Mule API. It looks like this: \ ”webhook”: { ”scheme”: “XXXX“ ”host”: “XXXXX“ ”port”: 443 ”method”: “post“ ”path”: “xxx/yyy/zzz” ”param… --- ## [Sentinelone parsing Issue](https://discuss.elastic.co/t/sentinelone-parsing-issue/381897)
**Author:** [@Mahesh\_Loke](https://discuss.elastic.co/u/Mahesh_Loke)\ **Replies:** 2\ **Last updated:** [September 15, 2025, 12:20pm UTC](https://discuss.elastic.co/t/sentinelone-parsing-issue/381897 "2025-09-15T12:20:02Z")
I have integrated sentinelone with elk via logstash, logs are coming but unparsed --- ## [How to capture the actual Elasticsearch query statements generated by esrally?](https://discuss.elastic.co/t/how-to-capture-the-actual-elasticsearch-query-statements-generated-by-esrally/381942)
**Author:** [@fan\_of\_holmes](https://discuss.elastic.co/u/fan_of_holmes)\ **Replies:** 0\ **Last updated:** [September 15, 2025, 7:36am UTC](https://discuss.elastic.co/t/how-to-capture-the-actual-elasticsearch-query-statements-generated-by-esrally/381942 "2025-09-15T07:36:09Z")
I'm running Elasticsearch Rally (esrally) benchmark tests and need to capture the actual Elasticsearch query statements generated during the test execution. Specifically, I'm targeting the bm25-search-with-filter operati… --- ## [What are the best servers for storing Elasticsearch data?](https://discuss.elastic.co/t/what-are-the-best-servers-for-storing-elasticsearch-data/381754)
**Author:** [@Ella\_conan](https://discuss.elastic.co/u/Ella_conan)\ **Replies:** 17\ **Last updated:** [September 15, 2025, 6:09am UTC](https://discuss.elastic.co/t/what-are-the-best-servers-for-storing-elasticsearch-data/381754 "2025-09-15T06:09:13Z")
Hi I am storing events from devices in Elasticsearch, and the size of these events is very large. Therefore, I decided to purchase high-performance servers to make search as fast as possible, ideally around 1 second. I… --- ## [The incoming data is intermittent](https://discuss.elastic.co/t/the-incoming-data-is-intermittent/381898)
**Author:** [@zerratriani](https://discuss.elastic.co/u/zerratriani)\ **Replies:** 4\ **Last updated:** [September 14, 2025, 2:38pm UTC](https://discuss.elastic.co/t/the-incoming-data-is-intermittent/381898 "2025-09-14T14:38:22Z")
I have a Logstash setup with 4 nodes that collects logs from several OpenShift (OCP) clusters. However, all of the logs from these OCP clusters use the same pipeline. Lately, the logs have been coming in intermittently (… --- ## [Influence master selection in elasticsearch](https://discuss.elastic.co/t/influence-master-selection-in-elasticsearch/381925)
**Author:** [@Phoenix2](https://discuss.elastic.co/u/Phoenix2)\ **Replies:** 5\ **Last updated:** [September 14, 2025, 11:07am UTC](https://discuss.elastic.co/t/influence-master-selection-in-elasticsearch/381925 "2025-09-14T11:07:07Z")
How can I influence the master selection, or how does Elasticsearch select the next master node? As far as I have discovered, it is not possible to influence this, but: Currently, it is always data node 01 for me, but … --- ## [Nginx module in filebeat configuration](https://discuss.elastic.co/t/nginx-module-in-filebeat-configuration/363563)
**Author:** [@tsboris](https://discuss.elastic.co/u/tsboris)\ **Replies:** 2\ **Last updated:** [September 14, 2025, 7:37am UTC](https://discuss.elastic.co/t/nginx-module-in-filebeat-configuration/363563 "2025-09-14T07:37:54Z")
Hello, Following this thread: Filebeat nginx module I tried to configure my Beat CRD to use the NGINX module as part of the ECK deployment in a Kubernetes cluster. I compare the logs results in Kibana before and after… --- ## [Elasticsearch configuration](https://discuss.elastic.co/t/elasticsearch-configuration/381927)
**Author:** [@piyush\_hn](https://discuss.elastic.co/u/piyush_hn)\ **Replies:** 1\ **Last updated:** [September 14, 2025, 3:52am UTC](https://discuss.elastic.co/t/elasticsearch-configuration/381927 "2025-09-14T03:52:48Z")
Hi, Trying to run elasticsearch inside a docker container but getting below error. {"@timestamp":"2025-09-14T02:18:15.072Z", "log.level":"ERROR", "message":"node validation exception\\n\[2\] bootstrap checks failed. You … --- ## [Elasticsearch issue with migrate to 9.0.6](https://discuss.elastic.co/t/elasticsearch-issue-with-migrate-to-9-0-6/381926)
**Author:** [@dominbdg](https://discuss.elastic.co/u/dominbdg)\ **Replies:** 1\ **Last updated:** [September 14, 2025, 2:58am UTC](https://discuss.elastic.co/t/elasticsearch-issue-with-migrate-to-9-0-6/381926 "2025-09-14T02:58:02Z")
Hello, I have issue with migrate from version 8.19.2 to 9.0.6 On version 8.19.2 from Stack Management/Upgrade assistant I migrated system indices Next I founded some critical old indexes - deleted them, And during u… --- ## [Index template settings disappear](https://discuss.elastic.co/t/index-template-settings-disappear/381914)
**Author:** [@juancamiloll](https://discuss.elastic.co/u/juancamiloll)\ **Replies:** 3\ **Last updated:** [September 13, 2025, 1:36pm UTC](https://discuss.elastic.co/t/index-template-settings-disappear/381914 "2025-09-13T13:36:06Z")
Hello, When I monitor the status of the datastream configuration, I have sometimes noticed that the configuration I have assigned (3 shards and 1 replica) disappears, and I have to add this index template again. I don'… --- ## [Logstash unable to reach Elasticsearch](https://discuss.elastic.co/t/logstash-unable-to-reach-elasticsearch/381852)
**Author:** [@piyush\_hn](https://discuss.elastic.co/u/piyush_hn)\ **Replies:** 5\ **Last updated:** [September 13, 2025, 5:35pm UTC](https://discuss.elastic.co/t/logstash-unable-to-reach-elasticsearch/381852 "2025-09-13T17:35:56Z")
Hi All, I am new to elastic stack and set it up on two instances on AWS. My main objective of this demonstration is to show that we can forward the application/machine logs to kibana dashboard. One EC2 instance is ru… --- ## [Elastic Agent version not updating in Windows Apps & Features](https://discuss.elastic.co/t/elastic-agent-version-not-updating-in-windows-apps-features/381871)
**Author:** [@etrevino-lumificyber](https://discuss.elastic.co/u/etrevino-lumificyber)\ **Replies:** 1\ **Last updated:** [September 13, 2025, 4:01am UTC](https://discuss.elastic.co/t/elastic-agent-version-not-updating-in-windows-apps-features/381871 "2025-09-13T04:01:07Z")
Hey everyone, I’m running into an issue where Windows Installed Apps is not reporting the actual version of the installed elastic agent. This is problematic because from a compliance baseline perspective, what appears i… --- ## [Best way to identify input error for multi\_match?](https://discuss.elastic.co/t/best-way-to-identify-input-error-for-multi-match/381889)
**Author:** [@nonword](https://discuss.elastic.co/u/nonword)\ **Replies:** 1\ **Last updated:** [September 13, 2025, 12:57am UTC](https://discuss.elastic.co/t/best-way-to-identify-input-error-for-multi-match/381889 "2025-09-13T00:57:51Z")
We’re passing user input into a multi\_match with minimal escaping. If the user searches ”something (unbalanced quotes), ES responds with a 400: { root\_cause: \[ { type: 'token\_mgr\_error', reason: 'token… --- ## [How to balance search relevance with lots of images in Elasticsearch?](https://discuss.elastic.co/t/how-to-balance-search-relevance-with-lots-of-images-in-elasticsearch/381905)
**Author:** [@jessicakaren907](https://discuss.elastic.co/u/jessicakaren907)\ **Replies:** 1\ **Last updated:** [September 13, 2025, 12:28am UTC](https://discuss.elastic.co/t/how-to-balance-search-relevance-with-lots-of-images-in-elasticsearch/381905 "2025-09-13T00:28:04Z")
Quick question for the community: has anyone here tried indexing pages that are heavy on visuals? I’ve seen cases where full-text search works fine for pure articles, but when the page has lots of images + short descrip… --- ## [How to find out the visulizations/dashboards/canvas which uses a specific index](https://discuss.elastic.co/t/how-to-find-out-the-visulizations-dashboards-canvas-which-uses-a-specific-index/381762)
**Author:** [@vijay117](https://discuss.elastic.co/u/vijay117)\ **Replies:** 3\ **Last updated:** [September 12, 2025, 12:12pm UTC](https://discuss.elastic.co/t/how-to-find-out-the-visulizations-dashboards-canvas-which-uses-a-specific-index/381762 "2025-09-12T12:12:28Z")
We use same index in multiple dashboards and canvas. Is there any way to find out the dashboards and canvas uses a specific index ? [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=39) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=41)