# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=41 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 42 --- ## [Elasticsearch documents getting deleted](https://discuss.elastic.co/t/elasticsearch-documents-getting-deleted/381854)
**Author:** [@ItsHoney](https://discuss.elastic.co/u/ItsHoney)\ **Replies:** 5\ **Last updated:** [September 11, 2025, 6:12pm UTC](https://discuss.elastic.co/t/elasticsearch-documents-getting-deleted/381854 "2025-09-11T18:12:05Z")
We’ve been experiencing an issue where certain documents in our Media index go missing. What’s unusual is that it’s often the same documents that disappear each time. Here’s what we’ve observed: We have a process tha… --- ## [Elastic Agent and Endpoint](https://discuss.elastic.co/t/elastic-agent-and-endpoint/381879)
**Author:** [@Staff\_Integral](https://discuss.elastic.co/u/Staff_Integral)\ **Replies:** 1\ **Last updated:** [September 11, 2025, 4:57pm UTC](https://discuss.elastic.co/t/elastic-agent-and-endpoint/381879 "2025-09-11T16:57:32Z")
Hola, una disculpa no dejar el comentario en ingles. Espero hacerme entender; en la empresa donde actual se instalaron lo servicios, hasta hace poco se desinstalaron, y tenemos problemas con varios equipos ya que estos … --- ## [Metricbeat Dashboard for Elasticsearch module](https://discuss.elastic.co/t/metricbeat-dashboard-for-elasticsearch-module/381861)
**Author:** [@chethan\_m](https://discuss.elastic.co/u/chethan_m)\ **Replies:** 2\ **Last updated:** [September 11, 2025, 1:15pm UTC](https://discuss.elastic.co/t/metricbeat-dashboard-for-elasticsearch-module/381861 "2025-09-11T13:15:19Z")
Hi, Can anyone please guide me how do I get the prebuilt dashboard for Elasticsearch module in Metribeat ? There are lof prebuilt dashborad loaded like \[Metricbeat AWS\], \[Metricbeat Kubernetes\], \[Metricbeat Enterprise … --- ## [Summary index transform reference](https://discuss.elastic.co/t/summary-index-transform-reference/381800)
**Author:** [@bigsby](https://discuss.elastic.co/u/bigsby)\ **Replies:** 1\ **Last updated:** [September 11, 2025, 12:45pm UTC](https://discuss.elastic.co/t/summary-index-transform-reference/381800 "2025-09-11T12:45:54Z")
I have a bunch of indices I’d like merge into a single summary index. From what I read, "Transforming data | Elastic Docs" is the way to go but I’m not find the way to do this. Here it goes. The indices I have are somet… --- ## [Filebeat stops crawler when run as linux service](https://discuss.elastic.co/t/filebeat-stops-crawler-when-run-as-linux-service/381836)
**Author:** [@WERTYASDFGH](https://discuss.elastic.co/u/WERTYASDFGH)\ **Replies:** 1\ **Last updated:** [September 11, 2025, 12:28pm UTC](https://discuss.elastic.co/t/filebeat-stops-crawler-when-run-as-linux-service/381836 "2025-09-11T12:28:28Z")
I’m using filebeat 8.18.3.When I run filebeat as linux service it doesn’t sends any logs to elasticsearch and logs constantly prints:Non zero metric found in last 30s. etc.At the beggining after loading configuration the… --- ## [Threatintel.misp attribute duplication](https://discuss.elastic.co/t/threatintel-misp-attribute-duplication/381860)
**Author:** [@parosio](https://discuss.elastic.co/u/parosio)\ **Replies:** 0\ **Last updated:** [September 11, 2025, 8:26am UTC](https://discuss.elastic.co/t/threatintel-misp-attribute-duplication/381860 "2025-09-11T08:26:07Z")
Hello, I'm having a problem with the threatintel misp module of filebeat (v7.19.29): when a MISP event contains one or more objects, the number of documents in elasticsearch is the product of the number of simple attri… --- ## [Keep attribute value in threatintel.misp.attribute](https://discuss.elastic.co/t/keep-attribute-value-in-threatintel-misp-attribute/381809)
**Author:** [@parosio](https://discuss.elastic.co/u/parosio)\ **Replies:** 2\ **Last updated:** [September 10, 2025, 5:58pm UTC](https://discuss.elastic.co/t/keep-attribute-value-in-threatintel-misp-attribute/381809 "2025-09-10T17:58:30Z")
Hello, I’m trying to modify the threatintel/misp/ingest/pipeline.yml of filebeat \[7.17\] to avoid the removal of threatintel.misp.attribute.value field, but to no effect so far… The pipeline is full of rename processors… --- ## [Unable to initialize fleet](https://discuss.elastic.co/t/unable-to-initialize-fleet/381838)
**Author:** [@Thom.cr](https://discuss.elastic.co/u/Thom.cr)\ **Replies:** 2\ **Last updated:** [September 10, 2025, 2:24pm UTC](https://discuss.elastic.co/t/unable-to-initialize-fleet/381838 "2025-09-10T14:24:33Z")
Hi, i just installed kibana and elasticsearch (last stable version) but everytime i try to go to fleet i get an error : Thanks for your help --- ## [Set more than 10000 number of values in data tables](https://discuss.elastic.co/t/set-more-than-10000-number-of-values-in-data-tables/375766)
**Author:** [@Ruben\_Mendez](https://discuss.elastic.co/u/Ruben_Mendez)\ **Replies:** 3\ **Last updated:** [September 10, 2025, 11:15am UTC](https://discuss.elastic.co/t/set-more-than-10000-number-of-values-in-data-tables/375766 "2025-09-10T11:15:59Z")
Hi, I'm trying to fetch more than 10000 number of values in my kibana data table visualization. I get the error above, I edited index.max\_result\_window in all my elasticSearch indexes. But I get the same error I can… --- ## [Issue with Node.js Vulnerabilities (CVE-2025) in Kibana 8.18.0](https://discuss.elastic.co/t/issue-with-node-js-vulnerabilities-cve-2025-in-kibana-8-18-0/378905)
**Author:** [@debbbuu](https://discuss.elastic.co/u/debbbuu)\ **Replies:** 3\ **Last updated:** [September 10, 2025, 8:49am UTC](https://discuss.elastic.co/t/issue-with-node-js-vulnerabilities-cve-2025-in-kibana-8-18-0/378905 "2025-09-10T08:49:09Z")
Hi, As part of the vulnerability assessment (VA) scan on our ELK servers, we identified that the Node.js version is affected by multiple vulnerabilities. We are using a self-managed cluster. Current Kibana Version: 8.1… --- ## [Conditional Color in Bars Graph](https://discuss.elastic.co/t/conditional-color-in-bars-graph/381810)
**Author:** [@Mauro\_Campos](https://discuss.elastic.co/u/Mauro_Campos)\ **Replies:** 1\ **Last updated:** [September 10, 2025, 3:49am UTC](https://discuss.elastic.co/t/conditional-color-in-bars-graph/381810 "2025-09-10T03:49:41Z")
Hello, good morning. Its possible to change the bar color based in the record input? Example: If Records \> 100 Color = Red Elif Records \<= 100 Color = Yellow Elif Records \<= 50 Color = Green --- ## [Search query in a list of texts](https://discuss.elastic.co/t/search-query-in-a-list-of-texts/381625)
**Author:** [@epistola](https://discuss.elastic.co/u/epistola)\ **Replies:** 7\ **Last updated:** [September 9, 2025, 5:34pm UTC](https://discuss.elastic.co/t/search-query-in-a-list-of-texts/381625 "2025-09-09T17:34:54Z")
Hello everyone, I have a search problem in ES. In the index i have a field that is a list of texts like the following: list\_field = \[text1, text2, text3, …\] I want to search for a number of terms that all belong to th… --- ## [Adding instance context to alerts for Teams Connector](https://discuss.elastic.co/t/adding-instance-context-to-alerts-for-teams-connector/380900)
**Author:** [@Chickpea](https://discuss.elastic.co/u/Chickpea)\ **Replies:** 2\ **Last updated:** [September 9, 2025, 1:46pm UTC](https://discuss.elastic.co/t/adding-instance-context-to-alerts-for-teams-connector/380900 "2025-09-09T13:46:21Z")
Hello, I manage multiple isolated Elastic instances, on each I configured a Teams connector. Now by default alerts in our Teams channel are pretty generic, for instance “Rule Spike in Logon Events from a Source IP gene… --- ## [Index template "logs-microsoft\_exchange\_server.httpproxy " Issue](https://discuss.elastic.co/t/index-template-logs-microsoft-exchange-server-httpproxy-issue/381790)
**Author:** [@aniskh](https://discuss.elastic.co/u/aniskh)\ **Replies:** 1\ **Last updated:** [September 9, 2025, 1:41pm UTC](https://discuss.elastic.co/t/index-template-logs-microsoft-exchange-server-httpproxy-issue/381790 "2025-09-09T13:41:29Z")
hello, i lost my index template “logs-microsoft\_exchange\_server.httpproxy logs-microsoft\_exchange\_server.httpproxy “ is theire any solution de restore it ? --- ## [Filebeat logs reaching Logstash but failing to create visible indices in Kibana](https://discuss.elastic.co/t/filebeat-logs-reaching-logstash-but-failing-to-create-visible-indices-in-kibana/381801)
**Author:** [@Jasser\_Hach](https://discuss.elastic.co/u/Jasser_Hach)\ **Replies:** 0\ **Last updated:** [September 9, 2025, 1:30pm UTC](https://discuss.elastic.co/t/filebeat-logs-reaching-logstash-but-failing-to-create-visible-indices-in-kibana/381801 "2025-09-09T13:30:47Z")
Logstash successfully receives logs from Filebeat. However, no index is visible in Kibana when using the custom index + pipeline block. If I remove this block: index =\> "%{\[@metadata\]\[beat\]}-%{\[@metadata\]\[version\]}-%{+… --- ## [Why doesn’t dense\_vector field show up in Spark schema when using Elasticsearch-Hadoop?](https://discuss.elastic.co/t/why-doesn-t-dense-vector-field-show-up-in-spark-schema-when-using-elasticsearch-hadoop/381715)
**Author:** [@dany\_fard](https://discuss.elastic.co/u/dany_fard)\ **Replies:** 2\ **Last updated:** [September 9, 2025, 1:03pm UTC](https://discuss.elastic.co/t/why-doesn-t-dense-vector-field-show-up-in-spark-schema-when-using-elasticsearch-hadoop/381715 "2025-09-09T13:03:46Z")
Hi everyone, I created an Elasticsearch index with a dense\_vector field, along with some text fields. The mapping looks like this (simplified): {"mappings": {"properties": {"embedding": {"type": "dense\_vector","dims": … --- ## [SSL issue when connecting MCP with elastic search for ibm cloud](https://discuss.elastic.co/t/ssl-issue-when-connecting-mcp-with-elastic-search-for-ibm-cloud/381794)
**Author:** [@ravitejavemula333](https://discuss.elastic.co/u/ravitejavemula333)\ **Replies:** 0\ **Last updated:** [September 9, 2025, 11:34am UTC](https://discuss.elastic.co/t/ssl-issue-when-connecting-mcp-with-elastic-search-for-ibm-cloud/381794 "2025-09-09T11:34:15Z")
Hi team, I am following below link to setup mcp server for Elasticsearch I use Databases for Elasticsearch from IBm cloud. i have given below code : client = AsyncElasticsearch( \[MCP\_ELASTIC\_URL\], ca\_cert… --- ## [Warning in Logstash log after fresh start](https://discuss.elastic.co/t/warning-in-logstash-log-after-fresh-start/381764)
**Author:** [@LHozzan](https://discuss.elastic.co/u/LHozzan)\ **Replies:** 2\ **Last updated:** [September 9, 2025, 9:28am UTC](https://discuss.elastic.co/t/warning-in-logstash-log-after-fresh-start/381764 "2025-09-09T09:28:27Z")
Hi there. I working on upgrade to newer Logstash version (9.1.3) from oldest used one (8.9.0). It seems, that now it is working correctly, but I am struggling with some warning messages: \[2025-09-08T13:33:55,354\]\[WARN … --- ## [3 Column Comparison Table Across 3 Datastreams](https://discuss.elastic.co/t/3-column-comparison-table-across-3-datastreams/381530)
**Author:** [@erikg](https://discuss.elastic.co/u/erikg)\ **Replies:** 1\ **Last updated:** [September 9, 2025, 6:59am UTC](https://discuss.elastic.co/t/3-column-comparison-table-across-3-datastreams/381530 "2025-09-09T06:59:42Z")
Hello, I think I might know the answer but let me know if I am wrong. I have 3 datastream datasets. They contain similar fields and I want to build a table that will compare all 3 based on certain criteria. Like this: … --- ## [ES|QL Drill Down in Kibana](https://discuss.elastic.co/t/es-ql-drill-down-in-kibana/376008)
**Author:** [@sai\_ravi\_shankar](https://discuss.elastic.co/u/sai_ravi_shankar)\ **Replies:** 2\ **Last updated:** [September 9, 2025, 6:28am UTC](https://discuss.elastic.co/t/es-ql-drill-down-in-kibana/376008 "2025-09-09T06:28:08Z")
Hi Team, I Have created a drill down url for a field under the data view in Kibana, When I create a table visualization using ES|QL. The field value is not showing as hyper link whereas if created the table visualizati… --- ## [Logstash Kafka output - Event Hub Namespace limit results in "UNKNOWN\_TOPIC\_OR\_PARTITION" errors](https://discuss.elastic.co/t/logstash-kafka-output-event-hub-namespace-limit-results-in-unknown-topic-or-partition-errors/381562)
**Author:** [@ncallens](https://discuss.elastic.co/u/ncallens)\ **Replies:** 4\ **Last updated:** [September 8, 2025, 1:31pm UTC](https://discuss.elastic.co/t/logstash-kafka-output-event-hub-namespace-limit-results-in-unknown-topic-or-partition-errors/381562 "2025-09-08T13:31:06Z")
Dear Logstash enthousiasts, I run a cluster of 4 Logstash servers (v8.14) with about 10 Logstash pipelines per node. I use keepalived as VIP failover method. So all 4 nodes have the same 10 Logstash pipelines configured… --- ## [Elasticsearch cannot access keys although they are available](https://discuss.elastic.co/t/elasticsearch-cannot-access-keys-although-they-are-available/381476)
**Author:** [@Salvatore\_Milano](https://discuss.elastic.co/u/Salvatore_Milano)\ **Replies:** 10\ **Last updated:** [September 8, 2025, 11:07am UTC](https://discuss.elastic.co/t/elasticsearch-cannot-access-keys-although-they-are-available/381476 "2025-09-08T11:07:51Z")
Hello, recently I have been running into an issue with elastic. I have a single node Elasticsearch-Container running in Docker. Sometimes it seems that Elasticsearch is not running as it should so I have tried to debu… --- ## [Having issue to re run the snapshot](https://discuss.elastic.co/t/having-issue-to-re-run-the-snapshot/381723)
**Author:** [@Amirul\_Ento](https://discuss.elastic.co/u/Amirul_Ento)\ **Replies:** 1\ **Last updated:** [September 8, 2025, 9:09am UTC](https://discuss.elastic.co/t/having-issue-to-re-run-the-snapshot/381723 "2025-09-08T09:09:40Z")
Hi guys, I’m new to ELK. I got this issue recently. It actually is my mistake. I’m running a snapshot using elasticsearch curator where snapshot date based on range. Everything look normal since February until July. I… --- ## [io.netty.handler.codec.DecoderException: java.io.StreamCorruptedException](https://discuss.elastic.co/t/io-netty-handler-codec-decoderexception-java-io-streamcorruptedexception/381603)
**Author:** [@rajathgubbi](https://discuss.elastic.co/u/rajathgubbi)\ **Replies:** 3\ **Last updated:** [September 8, 2025, 7:19am UTC](https://discuss.elastic.co/t/io-netty-handler-codec-decoderexception-java-io-streamcorruptedexception/381603 "2025-09-08T07:19:11Z")
We are encountering the below exception in our environment, where we are running Elasticsearch version 6.8.12 with two Elasticsearch nodes communicating over stunnel. Please let me know the probable reason for below exc… --- ## [Parsing multiple similar exceptions to a single document in elasticsearch](https://discuss.elastic.co/t/parsing-multiple-similar-exceptions-to-a-single-document-in-elasticsearch/381748)
**Author:** [@radha16](https://discuss.elastic.co/u/radha16)\ **Replies:** 1\ **Last updated:** [September 8, 2025, 6:53am UTC](https://discuss.elastic.co/t/parsing-multiple-similar-exceptions-to-a-single-document-in-elasticsearch/381748 "2025-09-08T06:53:26Z")
Hi Team, I would like to customise the ES documents by passing the similar multiple exceptions from a log file to a single index instead of multiple indexes. If any good approach to test this, please let me know. Thanks… --- ## [I need some help to parse the attached xml in Logstash using a ruby filter](https://discuss.elastic.co/t/i-need-some-help-to-parse-the-attached-xml-in-logstash-using-a-ruby-filter/381620)
**Author:** [@lester\_slee](https://discuss.elastic.co/u/lester_slee)\ **Replies:** 2\ **Last updated:** [September 8, 2025, 2:51am UTC](https://discuss.elastic.co/t/i-need-some-help-to-parse-the-attached-xml-in-logstash-using-a-ruby-filter/381620 "2025-09-08T02:51:34Z")
I have xml being received in to logstash via an http input and the message can contain one or more documents that need to be indexed separately which is ok. The part I need help with is the within each document there are… --- ## [Standalone Elastic Agent Winlog System Input](https://discuss.elastic.co/t/standalone-elastic-agent-winlog-system-input/381693)
**Author:** [@s.buksa](https://discuss.elastic.co/u/s.buksa)\ **Replies:** 11\ **Last updated:** [September 7, 2025, 11:10pm UTC](https://discuss.elastic.co/t/standalone-elastic-agent-winlog-system-input/381693 "2025-09-07T23:10:38Z")
I am trying to collect System logs from Windows Servers with Standalone Elastic Agent. While necessary System logs are being correctly picked up and indexed into Elasticsearch with Winlogbeat, Elastic Agent causes some i… --- ## [Elasticsearch Cluster node migration from Old VM to New VM](https://discuss.elastic.co/t/elasticsearch-cluster-node-migration-from-old-vm-to-new-vm/381141)
**Author:** [@King\_storm](https://discuss.elastic.co/u/King_storm)\ **Replies:** 2\ **Last updated:** [September 7, 2025, 5:21am UTC](https://discuss.elastic.co/t/elasticsearch-cluster-node-migration-from-old-vm-to-new-vm/381141 "2025-09-07T05:21:25Z")
I currently run a 3-node Elasticsearch cluster (v8.17.0) and need to migrate to a new set of VMs with larger partitions. My goal is to move nodes one by one (lift-and-shift) without downtime. Here’s the migration approac… --- ## [Kibana snapshot policy from 5 days and indexes from one year](https://discuss.elastic.co/t/kibana-snapshot-policy-from-5-days-and-indexes-from-one-year/381705)
**Author:** [@dominbdg](https://discuss.elastic.co/u/dominbdg)\ **Replies:** 1\ **Last updated:** [September 7, 2025, 3:03am UTC](https://discuss.elastic.co/t/kibana-snapshot-policy-from-5-days-and-indexes-from-one-year/381705 "2025-09-07T03:03:55Z")
Hello, I defined snapshot policy (for test purposes) to create snapshots from 5 days but I would like to have also indexes from last 5 days. Instead of that I have indexes there from one year. How can I define snapshot… --- ## [Readiness check issue with the eck-stack charts](https://discuss.elastic.co/t/readiness-check-issue-with-the-eck-stack-charts/381676)
**Author:** [@zlzzk](https://discuss.elastic.co/u/zlzzk)\ **Replies:** 0\ **Last updated:** [September 6, 2025, 4:16am UTC](https://discuss.elastic.co/t/readiness-check-issue-with-the-eck-stack-charts/381676 "2025-09-06T04:16:37Z")
I deployed eck-stack charts v0.16.0 but found the pod readiness check never succeed. I see it uses this command bash -c /mnt/elastic-internal/scripts/readiness-port-script.sh I tried inside the pod got Elasticsearch is… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=40) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=42)