# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=43 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 44 --- ## [Timelion visualization not working after upgrading from ES 7 to 8](https://discuss.elastic.co/t/timelion-visualization-not-working-after-upgrading-from-es-7-to-8/380513)
**Author:** [@oskrdt](https://discuss.elastic.co/u/oskrdt)\ **Replies:** 8\ **Last updated:** [September 2, 2025, 7:14pm UTC](https://discuss.elastic.co/t/timelion-visualization-not-working-after-upgrading-from-es-7-to-8/380513 "2025-09-02T19:14:56Z")
After upgrading my elasticsearch and kibana instance from 7 to 8.18.4 my Timelion visualizations that where previously working are getting the following error: Unable to load visualization Error: \[timelion\_vis\] \> Timeli… --- ## [Formatting PDF Export for Large Dashboards/Reports](https://discuss.elastic.co/t/formatting-pdf-export-for-large-dashboards-reports/381351)
**Author:** [@Dan\_Parker](https://discuss.elastic.co/u/Dan_Parker)\ **Replies:** 3\ **Last updated:** [September 2, 2025, 3:12pm UTC](https://discuss.elastic.co/t/formatting-pdf-export-for-large-dashboards-reports/381351 "2025-09-02T15:12:08Z")
Hi, We have a really large dashboard with around 100 visualisations that a client wants to be able to print out. Currently, the export PDF either results in a) 1 really large page that you can not print b) when selec… --- ## [Apply different ILM per namespace](https://discuss.elastic.co/t/apply-different-ilm-per-namespace/381523)
**Author:** [@djkprojects](https://discuss.elastic.co/u/djkprojects)\ **Replies:** 0\ **Last updated:** [September 2, 2025, 2:50pm UTC](https://discuss.elastic.co/t/apply-different-ilm-per-namespace/381523 "2025-09-02T14:50:01Z")
Hello, We have many Fleet policies (different data\_stream namespaces) with System integration which are currently using the default metrics ILM. We now want to tailor each policy and define dedicated ILM for each names… --- ## [Fleet server went offline](https://discuss.elastic.co/t/fleet-server-went-offline/380343)
**Author:** [@sreya\_14](https://discuss.elastic.co/u/sreya_14)\ **Replies:** 1\ **Last updated:** [September 2, 2025, 2:06pm UTC](https://discuss.elastic.co/t/fleet-server-went-offline/380343 "2025-09-02T14:06:52Z")
Fleet agent went offline after adding elasticsearch ,kibana integration to the fleet server policy. But while trying to add server after uninstalling the agent but it is not uninstalling and giving error 2025-07-19T… --- ## [Search in all attributes except one](https://discuss.elastic.co/t/search-in-all-attributes-except-one/381518)
**Author:** [@MatthiasKuehne](https://discuss.elastic.co/u/MatthiasKuehne)\ **Replies:** 0\ **Last updated:** [September 2, 2025, 12:25pm UTC](https://discuss.elastic.co/t/search-in-all-attributes-except-one/381518 "2025-09-02T12:25:45Z")
Hello lovely people, is there some way for a query\_string - Query to search in ALL attributes EXCEPT one? Or can I use another type of query to search for documents matching a search term in all attributes except one? I… --- ## [Fingerprint b64 not URL-friendly on pipelines](https://discuss.elastic.co/t/fingerprint-b64-not-url-friendly-on-pipelines/381515)
**Author:** [@Victor\_Monteagudo](https://discuss.elastic.co/u/Victor_Monteagudo)\ **Replies:** 0\ **Last updated:** [September 2, 2025, 10:48am UTC](https://discuss.elastic.co/t/fingerprint-b64-not-url-friendly-on-pipelines/381515 "2025-09-02T10:48:31Z")
Hello! In our ingestion pipeline, we use a field fingerprint as an ID. This ID is used in API paths for searches, such as /host/{id}. We are having problems with B64 due to Elastic transforming the fingerprint to B64 b… --- ## [Array field doesn't get split](https://discuss.elastic.co/t/array-field-doesnt-get-split/381332)
**Author:** [@yuswanul](https://discuss.elastic.co/u/yuswanul)\ **Replies:** 3\ **Last updated:** [September 2, 2025, 7:19am UTC](https://discuss.elastic.co/t/array-field-doesnt-get-split/381332 "2025-09-02T07:19:08Z")
hi there, i’m facing a strange issue right now. In my Logstash pipeline, I applied a Grok filter to the raw message and generated a field named responseBody from it. the second filter, I use a JSON filter to parse resp… --- ## [After reading contributing guide, but still confused!](https://discuss.elastic.co/t/after-reading-contributing-guide-but-still-confused/381467)
**Author:** [@kush1](https://discuss.elastic.co/u/kush1)\ **Replies:** 2\ **Last updated:** [September 1, 2025, 5:30pm UTC](https://discuss.elastic.co/t/after-reading-contributing-guide-but-still-confused/381467 "2025-09-01T17:30:17Z")
Hi everyone I’m Kush, a recent graduate now working at a startup. In my free time I want to contribute meaningfully to Elasticsearch. I’ve read the contribution guide but still feel lost on where to begin — the ELK stac… --- ## [\`.tasks\` index maintenance](https://discuss.elastic.co/t/tasks-index-maintenance/381487)
**Author:** [@taskstask](https://discuss.elastic.co/u/taskstask)\ **Replies:** 0\ **Last updated:** [September 1, 2025, 1:14pm UTC](https://discuss.elastic.co/t/tasks-index-maintenance/381487 "2025-09-01T13:14:59Z")
Our .tasks index grows quite large (about 250GB a month), and I’m seeking an alternative to us manually deleting it once in a while. I have two questions: Is it still true that it’s always safe to delete this index? (… --- ## [NET-Client 8.19: Serialisation of QueryDescriptor\](https://discuss.elastic.co/t/net-client-8-19-serialisation-of-querydescriptor-t/381456)
**Author:** [@JanSearch](https://discuss.elastic.co/u/JanSearch)\ **Replies:** 2\ **Last updated:** [September 1, 2025, 10:46am UTC](https://discuss.elastic.co/t/net-client-8-19-serialisation-of-querydescriptor-t/381456 "2025-09-01T10:46:58Z")
Hi there, I have another question regarding serialisation. After updating to version 8.19.4, serialisation of QueryDescriptor does not work as before. “Serialization in version 9.0 has been completely overhauled” which… --- ## [Elasticsearch9 compatible es\_client version](https://discuss.elastic.co/t/elasticsearch9-compatible-es-client-version/381479)
**Author:** [@schoekek](https://discuss.elastic.co/u/schoekek)\ **Replies:** 0\ **Last updated:** [September 1, 2025, 9:35am UTC](https://discuss.elastic.co/t/elasticsearch9-compatible-es-client-version/381479 "2025-09-01T09:35:02Z")
Hi, is untergeek (Aaron Mildenstein) · GitHub still active in the Elastic environment? He always responded very quickly to issues, but unfortunately, he hasn't responded for months... When will there be an elasticsear… --- ## [Issues regarding status code 429](https://discuss.elastic.co/t/issues-regarding-status-code-429/381440)
**Author:** [@Dipesh\_Manwani](https://discuss.elastic.co/u/Dipesh_Manwani)\ **Replies:** 4\ **Last updated:** [September 1, 2025, 6:46am UTC](https://discuss.elastic.co/t/issues-regarding-status-code-429/381440 "2025-09-01T06:46:44Z")
hey everyone i am facing an problem with the elastic serach service i am facing the problem that i am getting the data -1 ,but whenever i am trying it fetching it for 3 time or more than does anyone know help inform --- ## [Memory leak when creating snapshot with frequent repository change](https://discuss.elastic.co/t/memory-leak-when-creating-snapshot-with-frequent-repository-change/381429)
**Author:** [@lno](https://discuss.elastic.co/u/lno)\ **Replies:** 5\ **Last updated:** [September 1, 2025, 6:40am UTC](https://discuss.elastic.co/t/memory-leak-when-creating-snapshot-with-frequent-repository-change/381429 "2025-09-01T06:40:26Z")
Hi, When using the snapshot feature and creating many repositories, we can see that files are mapped in memory but never removed. For example, adding a repository, doing a snapshot and removing it multiple times result… --- ## [Connection to the internet with proxy](https://discuss.elastic.co/t/connection-to-the-internet-with-proxy/381457)
**Author:** [@GiorgioS13](https://discuss.elastic.co/u/GiorgioS13)\ **Replies:** 0\ **Last updated:** [August 29, 2025, 8:45pm UTC](https://discuss.elastic.co/t/connection-to-the-internet-with-proxy/381457 "2025-08-29T20:45:40Z")
Hello, I have a proxy server and I want all outbound internet traffic (required by Elastic for updates such as Fleet, Agent updates, etc.) to go through this proxy. The documentation on this is somewhat unclear. In the K… --- ## [Thousands of filebeat ingest pipelines / cleanup](https://discuss.elastic.co/t/thousands-of-filebeat-ingest-pipelines-cleanup/381421)
**Author:** [@idl0r](https://discuss.elastic.co/u/idl0r)\ **Replies:** 4\ **Last updated:** [August 29, 2025, 1:38pm UTC](https://discuss.elastic.co/t/thousands-of-filebeat-ingest-pipelines-cleanup/381421 "2025-08-29T13:38:52Z")
Hey, I’m not very familiar yet with ELK/SIEM and I‘m also not sure about the proper category here. So we have like thousands of filebeat ingest pipelines. I assume they’re auto created during updates. Is it safe to del… --- ## [Python: ImportError: cannot import name 'E' from 'elasticsearch.esql'](https://discuss.elastic.co/t/python-importerror-cannot-import-name-e-from-elasticsearch-esql/381204)
**Author:** [@peter9](https://discuss.elastic.co/u/peter9)\ **Replies:** 3\ **Last updated:** [August 29, 2025, 1:02pm UTC](https://discuss.elastic.co/t/python-importerror-cannot-import-name-e-from-elasticsearch-esql/381204 "2025-08-29T13:02:01Z")
I am reading the docs at ES|QL Query Builder | Python There are examples that start with: from elasticsearch.esql import ESQL, E When I try these, I get: ImportError: cannot import name 'E' from 'elasticsearch.esql' … --- ## [Strange ElasticAgent config path bug](https://discuss.elastic.co/t/strange-elasticagent-config-path-bug/381443)
**Author:** [@dot-mike](https://discuss.elastic.co/u/dot-mike)\ **Replies:** 2\ **Last updated:** [August 29, 2025, 11:40am UTC](https://discuss.elastic.co/t/strange-elasticagent-config-path-bug/381443 "2025-08-29T11:40:55Z")
Hi community, I observed a strang bug with the fleet managed elasticagent install on one of my servers. The agent would not start and would always spit out the error below. Note that the agent had been running for over … --- ## [JA4 on Packetbeat?](https://discuss.elastic.co/t/ja4-on-packetbeat/381444)
**Author:** [@Victor\_Monteagudo](https://discuss.elastic.co/u/Victor_Monteagudo)\ **Replies:** 0\ **Last updated:** [August 29, 2025, 10:01am UTC](https://discuss.elastic.co/t/ja4-on-packetbeat/381444 "2025-08-29T10:01:40Z")
Hello, Are there any plans to implement hashes JA4, JA4+ on the decoder TLS of Packetbeat? Thank you --- ## [No such indices in ElasticSearch](https://discuss.elastic.co/t/no-such-indices-in-elasticsearch/381434)
**Author:** [@levi19](https://discuss.elastic.co/u/levi19)\ **Replies:** 0\ **Last updated:** [August 29, 2025, 4:01am UTC](https://discuss.elastic.co/t/no-such-indices-in-elasticsearch/381434 "2025-08-29T04:01:31Z")
We are currently running an Elasticsearch & Kibana (8.14.3) cluster with: 3 master nodes and 6 data nodes Also, we are using Metricbeat ver 8.14.3 for monitoring the cluster ( we are enabled xpack.monitoring featur… --- ## [Integrate Keycloak OIDC authentication with Elasticsearch and Kibana](https://discuss.elastic.co/t/integrate-keycloak-oidc-authentication-with-elasticsearch-and-kibana/381370)
**Author:** [@M311ow](https://discuss.elastic.co/u/M311ow)\ **Replies:** 1\ **Last updated:** [August 29, 2025, 1:37am UTC](https://discuss.elastic.co/t/integrate-keycloak-oidc-authentication-with-elasticsearch-and-kibana/381370 "2025-08-29T01:37:38Z")
Hi, I’m trying to integrate Keycloak OIDC with Elasticsearch and Kibana. From what I understand, Elasticsearch has three types of nodes Master node Data node Ingest node If we want to set up Keycloak, on which node s… --- ## [Installing additional packages in filebeat 9.X docker](https://discuss.elastic.co/t/installing-additional-packages-in-filebeat-9-x-docker/381415)
**Author:** [@dangbert](https://discuss.elastic.co/u/dangbert)\ **Replies:** 4\ **Last updated:** [August 28, 2025, 4:38pm UTC](https://discuss.elastic.co/t/installing-additional-packages-in-filebeat-9-x-docker/381415 "2025-08-28T16:38:32Z")
I understand Filebeat’s Docker image switched in version 9.0.0 from an Ubuntu base to redhat/ubi9-minimal The tree command thus no longer works inside the docker image, how can I install it? It doesn’t work with microdn… --- ## [Read logfile once, insert two events to elastic](https://discuss.elastic.co/t/read-logfile-once-insert-two-events-to-elastic/381158)
**Author:** [@nilsen](https://discuss.elastic.co/u/nilsen)\ **Replies:** 7\ **Last updated:** [August 28, 2025, 2:39pm UTC](https://discuss.elastic.co/t/read-logfile-once-insert-two-events-to-elastic/381158 "2025-08-28T14:39:08Z")
Hello, I have a scenario where I read a log file and want to insert two entries to elastic. Basic example: ▶ Dummy log ▶ Example events created I created two Logstash .conf files reading the same log file. But am I corre… --- ## [Monitoring shars count by watchers](https://discuss.elastic.co/t/monitoring-shars-count-by-watchers/381050)
**Author:** [@Cristina\_Marletta\_Li](https://discuss.elastic.co/u/Cristina_Marletta_Li)\ **Replies:** 7\ **Last updated:** [August 28, 2025, 12:22pm UTC](https://discuss.elastic.co/t/monitoring-shars-count-by-watchers/381050 "2025-08-28T12:22:57Z")
Hi all, Is it possible to monitor the number of shards per node using watchers? I would like to be able to trigger an alert when the result of the GET \_cat/allocation?v&h=node,shards returns, for at least one node, a v… --- ## [Split grok-pattern into multiple lines](https://discuss.elastic.co/t/split-grok-pattern-into-multiple-lines/381366)
**Author:** [@sthorn](https://discuss.elastic.co/u/sthorn)\ **Replies:** 11\ **Last updated:** [August 28, 2025, 12:47pm UTC](https://discuss.elastic.co/t/split-grok-pattern-into-multiple-lines/381366 "2025-08-28T12:47:18Z")
Hi, Is it possible to split a grok-pattern into multiple lines instead of have one big? grok { pattern\_definitions =\> { "CM" =\> "\[/.\\-\\w\\s\]\*" } match =\> {"syslog\_message" =\> "%{CM:unknown\_id} %{IP:this\_ip},%{… --- ## [Closing connection Netty4HttpChannel Error](https://discuss.elastic.co/t/closing-connection-netty4httpchannel-error/381108)
**Author:** [@NikoCosmico01](https://discuss.elastic.co/u/NikoCosmico01)\ **Replies:** 2\ **Last updated:** [August 28, 2025, 12:41pm UTC](https://discuss.elastic.co/t/closing-connection-netty4httpchannel-error/381108 "2025-08-28T12:41:03Z")
Hi, I have an ELK on-premise setup deployed with docker (x3 nodes, x1 Kibana, 1x fleet-server). Recently, I decided to generate self-signed certificated to ensure SSL and HTTPS communications. The only certificate sign… --- ## [Kibana Kubernetes Dashboard can't see CPU/RAM usage per pod](https://discuss.elastic.co/t/kibana-kubernetes-dashboard-cant-see-cpu-ram-usage-per-pod/380759)
**Author:** [@rara01](https://discuss.elastic.co/u/rara01)\ **Replies:** 3\ **Last updated:** [August 28, 2025, 11:19am UTC](https://discuss.elastic.co/t/kibana-kubernetes-dashboard-cant-see-cpu-ram-usage-per-pod/380759 "2025-08-28T11:19:03Z")
Hi, From my previous post, i was able to enable Kibana dashboards for kubernetes monitoring with elatic agent. Agent is installed via manifest provided by elastic, just changed node\_name to node\_ip and changed namespace… --- ## [Difficulties with creating Kibana dashboard](https://discuss.elastic.co/t/difficulties-with-creating-kibana-dashboard/381341)
**Author:** [@cow\_on\_lsd](https://discuss.elastic.co/u/cow_on_lsd)\ **Replies:** 5\ **Last updated:** [August 28, 2025, 9:53am UTC](https://discuss.elastic.co/t/difficulties-with-creating-kibana-dashboard/381341 "2025-08-28T09:53:30Z")
I am collecting SNMP data from my switch. A sample of the data that I am getting looks like this: here the pastebin Every interface is generating its own document. I want to display for each interface its descriptio… --- ## [ESA-2025-12 Detail Questions](https://discuss.elastic.co/t/esa-2025-12-detail-questions/381320)
**Author:** [@mgotechlock](https://discuss.elastic.co/u/mgotechlock)\ **Replies:** 1\ **Last updated:** [August 28, 2025, 9:49am UTC](https://discuss.elastic.co/t/esa-2025-12-detail-questions/381320 "2025-08-28T09:49:40Z")
Per Beats (Windows Installer) 8.18.6, 8.19.3, 9.0.6, & 9.1.0 Security Update (ESA-2025-12) , Affected Configurations: The issue only affects Beats when installed through the install-service script for Windows. Example w… --- ## [Possibility to load data in the dashboard only after clicking a button \[or other solution\]](https://discuss.elastic.co/t/possibility-to-load-data-in-the-dashboard-only-after-clicking-a-button-or-other-solution/381358)
**Author:** [@Zuzanna](https://discuss.elastic.co/u/Zuzanna)\ **Replies:** 3\ **Last updated:** [August 28, 2025, 6:33am UTC](https://discuss.elastic.co/t/possibility-to-load-data-in-the-dashboard-only-after-clicking-a-button-or-other-solution/381358 "2025-08-28T06:33:32Z")
Hi, I'm looking for a way to prevent dashboard data from reloading each time the page is refreshed. I've seen it possible to set the displayed time to 0 minutes, but this setting confuses my users and makes them think th… --- ## [Adding volumeAttributesClassName is forbidden](https://discuss.elastic.co/t/adding-volumeattributesclassname-is-forbidden/381124)
**Author:** [@jackchi](https://discuss.elastic.co/u/jackchi)\ **Replies:** 1\ **Last updated:** [August 28, 2025, 12:02am UTC](https://discuss.elastic.co/t/adding-volumeattributesclassname-is-forbidden/381124 "2025-08-28T00:02:25Z")
After the cluster’s nodeSets are created. I want to specific a volumeAttributesClassName however, the eck operator’s admission webhook is preventing me. Failed to save resource: (Forbidden) admission webhook "elastic-e… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=42) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=44)