# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=44 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 45 --- ## [Kibana Discover highligth fragment size](https://discuss.elastic.co/t/kibana-discover-highligth-fragment-size/381309)
**Author:** [@rodrigopaulodecastro](https://discuss.elastic.co/u/rodrigopaulodecastro)\ **Replies:** 2\ **Last updated:** [August 27, 2025, 11:47pm UTC](https://discuss.elastic.co/t/kibana-discover-highligth-fragment-size/381309 "2025-08-27T23:47:56Z")
Hi there, when using Elasticsearch API it is possible to define de highlight fragment size to have a better visualization of the highlight portion, example: { "query": { "match": { "text\_field": "search ter… --- ## [Serverless project APIs returning 401's](https://discuss.elastic.co/t/serverless-project-apis-returning-401s/381402)
**Author:** [@danN](https://discuss.elastic.co/u/danN)\ **Replies:** 1\ **Last updated:** [August 27, 2025, 8:14pm UTC](https://discuss.elastic.co/t/serverless-project-apis-returning-401s/381402 "2025-08-27T20:14:59Z")
Hello, I created a serverless project in elastic the other day as I wanted to run some API queries. I then clicked on the ? icon in the top right of my portal and selected “Connection Details”, copied the elasticsearch … --- ## [Accessing raw object fields in VEGA-Lite](https://discuss.elastic.co/t/accessing-raw-object-fields-in-vega-lite/381324)
**Author:** [@DOH-moodys](https://discuss.elastic.co/u/DOH-moodys)\ **Replies:** 3\ **Last updated:** [August 27, 2025, 6:51pm UTC](https://discuss.elastic.co/t/accessing-raw-object-fields-in-vega-lite/381324 "2025-08-27T18:51:14Z")
As the title suggests, I’m having a difficult time accessing data from object fields stored in arrays of objects. They can be queried as objectField.id.keyword and objectField.count for example. Here is my mapping "map… --- ## [Application Insights Integration No Data](https://discuss.elastic.co/t/application-insights-integration-no-data/381383)
**Author:** [@Kick\_Buur](https://discuss.elastic.co/u/Kick_Buur)\ **Replies:** 1\ **Last updated:** [August 27, 2025, 4:07pm UTC](https://discuss.elastic.co/t/application-insights-integration-no-data/381383 "2025-08-27T16:07:35Z")
Hey there, Recently I have set up an ELK stack on my server and having a great time with some integrations. Now the company I work for is using application insights in azure and I saw that there was an integration for t… --- ## [Issue with kibana/es after update to 9.1.0](https://discuss.elastic.co/t/issue-with-kibana-es-after-update-to-9-1-0/381265)
**Author:** [@kim.ae](https://discuss.elastic.co/u/kim.ae)\ **Replies:** 4\ **Last updated:** [August 27, 2025, 3:48pm UTC](https://discuss.elastic.co/t/issue-with-kibana-es-after-update-to-9-1-0/381265 "2025-08-27T15:48:48Z")
Hello Community and Elastic team, We are using the ECK community version Installed in a AKS with k8s version 1.32.6. We just updated the installation to 9.1.0 from 8.15.x. No we are unable to create index templates, it… --- ## [Trouble transforming \_source field in VEGA for hits.hits formatted data](https://discuss.elastic.co/t/trouble-transforming-source-field-in-vega-for-hits-hits-formatted-data/381377)
**Author:** [@DOH-moodys](https://discuss.elastic.co/u/DOH-moodys)\ **Replies:** 0\ **Last updated:** [August 27, 2025, 2:32pm UTC](https://discuss.elastic.co/t/trouble-transforming-source-field-in-vega-for-hits-hits-formatted-data/381377 "2025-08-27T14:32:03Z")
This seems to be a common problem. Is there documentation or an example someone could point me to? My VEGA schema contains a format for non-aggregate query results data: { url: { index: myIndex "body"… --- ## [Deprecated index lifecycle policies](https://discuss.elastic.co/t/deprecated-index-lifecycle-policies/381373)
**Author:** [@sszabo](https://discuss.elastic.co/u/sszabo)\ **Replies:** 2\ **Last updated:** [August 27, 2025, 2:01pm UTC](https://discuss.elastic.co/t/deprecated-index-lifecycle-policies/381373 "2025-08-27T14:01:41Z")
I’m using the elastic agent to load pod logs from kubernetes: - id: container-log-${kubernetes.pod.name}-${kubernetes.container.id} type: filestream use\_output: default meta: package: … --- ## [400-Bad request](https://discuss.elastic.co/t/400-bad-request/381344)
**Author:** [@tarun-ghcp](https://discuss.elastic.co/u/tarun-ghcp)\ **Replies:** 2\ **Last updated:** [August 27, 2025, 9:35am UTC](https://discuss.elastic.co/t/400-bad-request/381344 "2025-08-27T09:35:03Z")
Below is my payload but it works only when query\_body is empty. I couldn’t figure out whats wrong inside it. I have a Docker container for the MCP server and it throws Bad Request every time. payload = { "jsonrpc": "2.… --- ## [Using the same snapshot repository for SLM and Frozen Tier](https://discuss.elastic.co/t/using-the-same-snapshot-repository-for-slm-and-frozen-tier/381345)
**Author:** [@gueguet57](https://discuss.elastic.co/u/gueguet57)\ **Replies:** 1\ **Last updated:** [August 27, 2025, 7:55am UTC](https://discuss.elastic.co/t/using-the-same-snapshot-repository-for-slm-and-frozen-tier/381345 "2025-08-27T07:55:30Z")
Hello all, In my Elastic setup (ECK), I’ve already created a snapshot repository that I use for the Frozen data tier and searchable snapshots. Now, I’d like to configure Snapshot Lifecycle Management (SLM) to automatic… --- ## [pyspark.sql.Observation.get blocking on pyspark.sql.Dataframe.writer.save()](https://discuss.elastic.co/t/pyspark-sql-observation-get-blocking-on-pyspark-sql-dataframe-writer-save/381362)
**Author:** [@DaveLiddy](https://discuss.elastic.co/u/DaveLiddy)\ **Replies:** 0\ **Last updated:** [August 27, 2025, 4:43am UTC](https://discuss.elastic.co/t/pyspark-sql-observation-get-blocking-on-pyspark-sql-dataframe-writer-save/381362 "2025-08-27T04:43:26Z")
I’m trying to add some metrics to a pyspark pipeline feeding an index. I’ve found that the get operation blocks on the write, which I can workaround by adding in another request on the dataframe, such as the count below.… --- ## [400 Bad request](https://discuss.elastic.co/t/400-bad-request/381357)
**Author:** [@tarun-ghcp](https://discuss.elastic.co/u/tarun-ghcp)\ **Replies:** 1\ **Last updated:** [August 27, 2025, 3:31am UTC](https://discuss.elastic.co/t/400-bad-request/381357 "2025-08-27T03:31:14Z")
I am using Docker container for MCP server. When running my Python script to do a knn search, the server throws 400 Bad request. But when request is sent without anything inside query\_body, it gives me the result. I coul… --- ## [Resource\_already\_exists\_exception error on kibana](https://discuss.elastic.co/t/resource-already-exists-exception-error-on-kibana/381076)
**Author:** [@mahesh.hemke24](https://discuss.elastic.co/u/mahesh.hemke24)\ **Replies:** 8\ **Last updated:** [August 26, 2025, 9:16pm UTC](https://discuss.elastic.co/t/resource-already-exists-exception-error-on-kibana/381076 "2025-08-26T21:16:28Z")
{"service":{"node":{"roles":\["background\_tasks","ui"\]}},"ecs":{"version":"8.11.0"},"@timestamp":"2025-08-13T10:55:50.016+02:00","message":"\[.kibana\_analytics\] CREATE\_NEW\_TARGET -\> CHECK\_VERSION\_INDEX\_READY\_ACTIONS. took:… --- ## [Custom Filestream Integration - Adding mappings](https://discuss.elastic.co/t/custom-filestream-integration-adding-mappings/381316)
**Author:** [@erikg](https://discuss.elastic.co/u/erikg)\ **Replies:** 5\ **Last updated:** [August 26, 2025, 5:17pm UTC](https://discuss.elastic.co/t/custom-filestream-integration-adding-mappings/381316 "2025-08-26T17:17:16Z")
Hello, I am having trouble with adding custom mapping to my data stream built from custom filestream input. It appears that once the data comes in and build the data stream, the data stream is “managed”. It doesn’t al… --- ## [LogicMonitor to Elastic](https://discuss.elastic.co/t/logicmonitor-to-elastic/381327)
**Author:** [@danN](https://discuss.elastic.co/u/danN)\ **Replies:** 5\ **Last updated:** [August 26, 2025, 12:50pm UTC](https://discuss.elastic.co/t/logicmonitor-to-elastic/381327 "2025-08-26T12:50:18Z")
Hello, I am currently working on sending alert data from our LogicMonitor tenant to Elastic but i’m running into a few issues that I could use help with. To start, I selected the “Custom HTTP Endpoint Logs” integration o… --- ## [(solved) IP anonymization (hasing) in Ingest Pipeline](https://discuss.elastic.co/t/solved-ip-anonymization-hasing-in-ingest-pipeline/381329)
**Author:** [@dot-mike](https://discuss.elastic.co/u/dot-mike)\ **Replies:** 2\ **Last updated:** [August 26, 2025, 11:50am UTC](https://discuss.elastic.co/t/solved-ip-anonymization-hasing-in-ingest-pipeline/381329 "2025-08-26T11:50:15Z")
Hi community, I'm wondering what are the possibilities of IP anonymization with Ingest Pipeline in Kibana? I'm asking because for my use case I should be able to anonymize IP address and be able to decrypt it with speci… --- ## [Kibana top toolbar](https://discuss.elastic.co/t/kibana-top-toolbar/381338)
**Author:** [@Viktor\_Movita](https://discuss.elastic.co/u/Viktor_Movita)\ **Replies:** 1\ **Last updated:** [August 26, 2025, 11:24am UTC](https://discuss.elastic.co/t/kibana-top-toolbar/381338 "2025-08-26T11:24:29Z")
Hello everyone, I’m using Kibana version 8. In the top toolbar, there’s a help icon (a life ring symbol) that provides access to the documentation. Is it possible to customize it for on-prem, connect it to an internal… --- ## [How to have the last timestamp field in Kibana Alerts](https://discuss.elastic.co/t/how-to-have-the-last-timestamp-field-in-kibana-alerts/381334)
**Author:** [@mosaadshaikh1998](https://discuss.elastic.co/u/mosaadshaikh1998)\ **Replies:** 3\ **Last updated:** [August 26, 2025, 9:57am UTC](https://discuss.elastic.co/t/how-to-have-the-last-timestamp-field-in-kibana-alerts/381334 "2025-08-26T09:57:39Z")
Hi, I have a use case in which Kibana alerting sends the alert when no documents are present in last 10 minutes. How can i add the timestamp of when the last document was found in message body? --- ## ["unknown field \[pivot\]" error](https://discuss.elastic.co/t/unknown-field-pivot-error/381330)
**Author:** [@meatwad](https://discuss.elastic.co/u/meatwad)\ **Replies:** 1\ **Last updated:** [August 26, 2025, 6:13am UTC](https://discuss.elastic.co/t/unknown-field-pivot-error/381330 "2025-08-26T06:13:34Z")
Hi there, I’m trying to follow along with this post to try and enrich FortiGate logs: But when I do the initial POST \_transform/fortivpntunnels/\_update, I get the following error: { "error": { "root\_cause": \[ … --- ## [Ingest Pipeline Parsing](https://discuss.elastic.co/t/ingest-pipeline-parsing/381238)
**Author:** [@Ankita\_Pachauri](https://discuss.elastic.co/u/Ankita_Pachauri)\ **Replies:** 7\ **Last updated:** [August 26, 2025, 3:59am UTC](https://discuss.elastic.co/t/ingest-pipeline-parsing/381238 "2025-08-26T03:59:23Z")
Hi Folks, Can someone help me parsing the below logs using ingest pipeline? //Ankita --- ## [Ingest Pipeline KV Processor](https://discuss.elastic.co/t/ingest-pipeline-kv-processor/367252)
**Author:** [@Ankita\_Pachauri](https://discuss.elastic.co/u/Ankita_Pachauri)\ **Replies:** 9\ **Last updated:** [August 26, 2025, 1:38am UTC](https://discuss.elastic.co/t/ingest-pipeline-kv-processor/367252 "2025-08-26T01:38:26Z")
Hi Team, I am using custom logs integration to receive data via an elastic agent(ELK Version 8.13.4). The data looks something like this. "message": " URL : https://www.google.com\\n Action Type … --- ## [Auto-scaling the number of replicas](https://discuss.elastic.co/t/auto-scaling-the-number-of-replicas/381318)
**Author:** [@Travis\_Andelin](https://discuss.elastic.co/u/Travis_Andelin)\ **Replies:** 4\ **Last updated:** [August 25, 2025, 8:02pm UTC](https://discuss.elastic.co/t/auto-scaling-the-number-of-replicas/381318 "2025-08-25T20:02:45Z")
We typically provision our elasticsearch clusters with a lot of indices, and one replica. The search traffic can vary based on the index. Sometimes we get a burst of search traffic on one index (usually a node gets CPU … --- ## [How to delete old system indices?](https://discuss.elastic.co/t/how-to-delete-old-system-indices/381146)
**Author:** [@garethhumphriesgkc](https://discuss.elastic.co/u/garethhumphriesgkc)\ **Replies:** 2\ **Last updated:** [August 25, 2025, 9:04pm UTC](https://discuss.elastic.co/t/how-to-delete-old-system-indices/381146 "2025-08-25T21:04:51Z")
I have a bunch of old indices from old versions I’d like to get rid of to free up disk and shards, e.g.: .kibana\_task\_manager\_7.15.2\_001 .kibana\_task\_manager\_7.17.5\_001 .kibana\_task\_manager\_8.3.3\_001 .kibana\_task\_manag… --- ## [Logstash 8.15.2 Imap Input plugin SSL Error](https://discuss.elastic.co/t/logstash-8-15-2-imap-input-plugin-ssl-error/381315)
**Author:** [@carellevbt](https://discuss.elastic.co/u/carellevbt)\ **Replies:** 3\ **Last updated:** [August 25, 2025, 3:50pm UTC](https://discuss.elastic.co/t/logstash-8-15-2-imap-input-plugin-ssl-error/381315 "2025-08-25T15:50:11Z")
Hello, I’m running logstash 8.15.2 and running into the below IMAP input plugin error. Encountered error Java::JavaLang::NullPointerException {:message=\>"Cannot invoke "org.jruby.ext.openssl.SSLContext$InternalContext… --- ## [Imap plugin not loading](https://discuss.elastic.co/t/imap-plugin-not-loading/375572)
**Author:** [@nkknkk](https://discuss.elastic.co/u/nkknkk)\ **Replies:** 1\ **Last updated:** [August 25, 2025, 2:51pm UTC](https://discuss.elastic.co/t/imap-plugin-not-loading/375572 "2025-08-25T14:51:29Z")
I installed the imap plugin. logstash-plugin list --verbose | grep imap logstash-input-imap (3.2.1) this is my logstash config file input { imap { host =\> "imap.gmail.com" user =\> "nkknkk@gmail.com" pass… --- ## [Upgraded to a new PC and now cant see indicies version 9 - Windows](https://discuss.elastic.co/t/upgraded-to-a-new-pc-and-now-cant-see-indicies-version-9-windows/381296)
**Author:** [@Nate9872](https://discuss.elastic.co/u/Nate9872)\ **Replies:** 1\ **Last updated:** [August 25, 2025, 8:12am UTC](https://discuss.elastic.co/t/upgraded-to-a-new-pc-and-now-cant-see-indicies-version-9-windows/381296 "2025-08-25T08:12:02Z")
Hello, As the title suggests, I copied over my entire data folder (9TB) along with my elasticsearch and kibana folders to a new machine. Nothing else changed, all drive letters and folders are still the same, however, n… --- ## [Dynamic Color mapping by trend](https://discuss.elastic.co/t/dynamic-color-mapping-by-trend/381113)
**Author:** [@Le\_Philosophe](https://discuss.elastic.co/u/Le_Philosophe)\ **Replies:** 2\ **Last updated:** [August 25, 2025, 8:03am UTC](https://discuss.elastic.co/t/dynamic-color-mapping-by-trend/381113 "2025-08-25T08:03:15Z")
Hello, I have a simple dashboard where I display a metric (no of files collected).Now I have a filter by the type of feed and I want each time I select a feed the color mapping adjust automatically refering to the trend … --- ## [Log4j2 won't send logs to external log server after upgrade to 8.18 (Java 24)](https://discuss.elastic.co/t/log4j2-wont-send-logs-to-external-log-server-after-upgrade-to-8-18-java-24/381300)
**Author:** [@baneinc](https://discuss.elastic.co/u/baneinc)\ **Replies:** 0\ **Last updated:** [August 25, 2025, 7:18am UTC](https://discuss.elastic.co/t/log4j2-wont-send-logs-to-external-log-server-after-upgrade-to-8-18-java-24/381300 "2025-08-25T07:18:39Z")
Hi Folks, for Elasticsearch logging we use log4j2, which is configured to send logs to log server. We had issues, that we fixed implementing .java.policy file (as decribed in this topic: Log4j framework can no longer r… --- ## [Thread Pool stats show queued items despite not being full](https://discuss.elastic.co/t/thread-pool-stats-show-queued-items-despite-not-being-full/381298)
**Author:** [@spinscale](https://discuss.elastic.co/u/spinscale)\ **Replies:** 0\ **Last updated:** [August 25, 2025, 6:39am UTC](https://discuss.elastic.co/t/thread-pool-stats-show-queued-items-despite-not-being-full/381298 "2025-08-25T06:39:47Z")
Good day, in our monitoring data I can see that one cluster with search load (dozens of queries per second) shows slightly confusing thread pool stats. I can regularly see searches being queued while the thread pool si… --- ## [Run Kibana as a windows service](https://discuss.elastic.co/t/run-kibana-as-a-windows-service/381297)
**Author:** [@StefanC](https://discuss.elastic.co/u/StefanC)\ **Replies:** 1\ **Last updated:** [August 25, 2025, 6:38am UTC](https://discuss.elastic.co/t/run-kibana-as-a-windows-service/381297 "2025-08-25T06:38:08Z")
We want to install the ELK stack 3 node elasticserach and kibana as a service on windows. So far Elasticserach runs as a service with the provides procedures and tools . Kibana starts with sc.exe as explained in previou… --- ## [Sizing for ElasticStack in on-Prem environment](https://discuss.elastic.co/t/sizing-for-elasticstack-in-on-prem-environment/381269)
**Author:** [@Eshwar\_K](https://discuss.elastic.co/u/Eshwar_K)\ **Replies:** 13\ **Last updated:** [August 25, 2025, 5:14am UTC](https://discuss.elastic.co/t/sizing-for-elasticstack-in-on-prem-environment/381269 "2025-08-25T05:14:23Z")
Hi Elastic Community, I am in a preparation of hardware sizing for one of my customer for log analysis for below requirement: Current Data size: 400GB Daily data ingestion: 20GB Retention Period: 30days So, as per t… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=43) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=45)