# Elastic Stack

**URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=451

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 452

---

## [ILM policies based on the age of records in an index](https://discuss.elastic.co/t/ilm-policies-based-on-the-age-of-records-in-an-index/340814)

<div class="topic-metadata">

**Author:** [@Zips6203](https://discuss.elastic.co/u/Zips6203)\
**Replies:** 1\
**Last updated:** [August 15, 2023, 7:34am UTC](https://discuss.elastic.co/t/ilm-policies-based-on-the-age-of-records-in-an-index/340814 "2023-08-15T07:34:01Z")

</div>

Hello everyone, I wanted to discuss the possibility of an implementation with the help of ILM policies. I am currently storing application metrices (flat JSON) into an Elasticsearch index. Only the records that have be…

---

## [Issues connecting to JIRA account after source configuration](https://discuss.elastic.co/t/issues-connecting-to-jira-account-after-source-configuration/340808)

<div class="topic-metadata">

**Author:** [@gggra](https://discuss.elastic.co/u/gggra)\
**Replies:** 0\
**Last updated:** [August 15, 2023, 6:20am UTC](https://discuss.elastic.co/t/issues-connecting-to-jira-account-after-source-configuration/340808 "2023-08-15T06:20:58Z")

</div>

I am facing the setup issue in workplace search setup. JIRA is not letting log in when selecting "Connect JIRA". It always display the page "Hmm... We're having trouble logging you in." Can anyone advise ? Thanks.

---

## [Remove obsolete fleet Server policies on the same host](https://discuss.elastic.co/t/remove-obsolete-fleet-server-policies-on-the-same-host/340804)

<div class="topic-metadata">

**Author:** [@GKre](https://discuss.elastic.co/u/GKre)\
**Replies:** 0\
**Last updated:** [August 15, 2023, 4:11am UTC](https://discuss.elastic.co/t/remove-obsolete-fleet-server-policies-on-the-same-host/340804 "2023-08-15T04:11:51Z")

</div>

Hi, guess as i am still a new user my question might be "stupid". But give it a try. I have 3 entries in "fleet" for "fleet server policy" on the same host. Guessthis is due some problems setting it up. only one of th…

---

## [How to know where the Elastic Search Hits are coming from](https://discuss.elastic.co/t/how-to-know-where-the-elastic-search-hits-are-coming-from/340800)

<div class="topic-metadata">

**Author:** [@es2learn](https://discuss.elastic.co/u/es2learn)\
**Replies:** 0\
**Last updated:** [August 15, 2023, 3:41am UTC](https://discuss.elastic.co/t/how-to-know-where-the-elastic-search-hits-are-coming-from/340800 "2023-08-15T03:41:16Z")

</div>

Is there any way to configure the Elasticsearch so that we get to know that the requests are coming from a service or kibana or external sources, API calls etc.,

---

## [Error pulling image configuration: download failed after attempts=6: net/http: TLS handshake timeout](https://discuss.elastic.co/t/error-pulling-image-configuration-download-failed-after-attempts-6-net-http-tls-handshake-timeout/339341)

<div class="topic-metadata">

**Author:** [@ppafford](https://discuss.elastic.co/u/ppafford)\
**Replies:** 5\
**Last updated:** [August 15, 2023, 2:01am UTC](https://discuss.elastic.co/t/error-pulling-image-configuration-download-failed-after-attempts-6-net-http-tls-handshake-timeout/339341 "2023-08-15T02:01:25Z")

</div>

Running docker pull logstash:8.8.1 works but running docker pull docker.elastic.co/logstash/logstash:8.8.1 does not Is there a redirect on Elastic side that I'm missing, I've whitelisted a few but feel like I'm still mi…

---

## [Kibana - Security Pop Up](https://discuss.elastic.co/t/kibana-security-pop-up/340593)

<div class="topic-metadata">

**Author:** [@Kumar\_Abhinav](https://discuss.elastic.co/u/Kumar_Abhinav)\
**Replies:** 3\
**Last updated:** [August 15, 2023, 12:41am UTC](https://discuss.elastic.co/t/kibana-security-pop-up/340593 "2023-08-15T00:41:53Z")

</div>

Hey Elastic Community team, I hope this message finds you well. I've been facing a recurring issue with the Kibana UI, specifically related to the persistent pop-up stating "Your data is not secure." Despite clicking th…

---

## [Elastic Cloud APM - agent configuration](https://discuss.elastic.co/t/elastic-cloud-apm-agent-configuration/340792)

<div class="topic-metadata">

**Author:** [@SaEd](https://discuss.elastic.co/u/SaEd)\
**Replies:** 0\
**Last updated:** [August 15, 2023, 12:38am UTC](https://discuss.elastic.co/t/elastic-cloud-apm-agent-configuration/340792 "2023-08-15T00:38:45Z")

</div>

Hello, I'm trying to debug an issue we see in production where the server the elastic agent is running on seem to freeze. During this period all windows services stop responding and admins lose the ability to login forc…

---

## [Kibana URL Drilldown {{rison context.panel.filters}}](https://discuss.elastic.co/t/kibana-url-drilldown-rison-context-panel-filters/340787)

<div class="topic-metadata">

**Author:** [@Dallas\_Toth](https://discuss.elastic.co/u/Dallas_Toth)\
**Replies:** 0\
**Last updated:** [August 14, 2023, 10:42pm UTC](https://discuss.elastic.co/t/kibana-url-drilldown-rison-context-panel-filters/340787 "2023-08-14T22:42:08Z")

</div>

My experience with the Go To Dashboard has worked flawlessly. But now I need to venture into Go to URL so I can pass in additional variables into the URL like embed=true & auth\_provider\_hint=anonymous1 My issue is with …

---

## [Password reset require for elasticsearch 7.17.7](https://discuss.elastic.co/t/password-reset-require-for-elasticsearch-7-17-7/340780)

<div class="topic-metadata">

**Author:** [@sohag](https://discuss.elastic.co/u/sohag)\
**Replies:** 1\
**Last updated:** [August 14, 2023, 10:19pm UTC](https://discuss.elastic.co/t/password-reset-require-for-elasticsearch-7-17-7/340780 "2023-08-14T22:19:39Z")

</div>

Hi Please help me to resolve the below issue. I lost my Elasticsearch password of user elastic . Now i am trying to reset the password but error is like below- curl -XPOST "http://localhost:9200/\_security/user/ela…

---

## [Inconsistent Autocomplete Suggestions in Kibana Dashboard Filter/Control](https://discuss.elastic.co/t/inconsistent-autocomplete-suggestions-in-kibana-dashboard-filter-control/340781)

<div class="topic-metadata">

**Author:** [@Kumar\_Abhinav](https://discuss.elastic.co/u/Kumar_Abhinav)\
**Replies:** 1\
**Last updated:** [August 14, 2023, 9:28pm UTC](https://discuss.elastic.co/t/inconsistent-autocomplete-suggestions-in-kibana-dashboard-filter-control/340781 "2023-08-14T21:28:58Z")

</div>

Hello Elastic Community Team, I'm currently working on a Kibana dashboard and have encountered an issue with the autocomplete suggestions in one of the dashboard's filter/controls. The problem is that while selecting t…

---

## [Painless Script runtime error: dynamic method \[java.util.ArrayList, entrySet/0\] not found](https://discuss.elastic.co/t/painless-script-runtime-error-dynamic-method-java-util-arraylist-entryset-0-not-found/340775)

<div class="topic-metadata">

**Author:** [@Anni](https://discuss.elastic.co/u/Anni)\
**Replies:** 1\
**Last updated:** [August 14, 2023, 7:26pm UTC](https://discuss.elastic.co/t/painless-script-runtime-error-dynamic-method-java-util-arraylist-entryset-0-not-found/340775 "2023-08-14T19:26:45Z")

</div>

I am getting "dynamic method \[java.util.ArrayList, entrySet/0\] not found" error while running the painless script in watchers. Here is the simplified version of the code. I tried to recreate the issue in dev tools but I…

---

## [Help with visualizations, multiple indexes, and a common field](https://discuss.elastic.co/t/help-with-visualizations-multiple-indexes-and-a-common-field/340753)

<div class="topic-metadata">

**Author:** [@icsy7867](https://discuss.elastic.co/u/icsy7867)\
**Replies:** 6\
**Last updated:** [August 14, 2023, 5:58pm UTC](https://discuss.elastic.co/t/help-with-visualizations-multiple-indexes-and-a-common-field/340753 "2023-08-14T17:58:58Z")

</div>

I am having some confusion on how to properly do this. Most of my "database" experience comes from relational databases. So my mind immediately goes to inner/outer joins, which I know is not applicable here. I have re…

---

## [Using NGINX as a Load Balancer](https://discuss.elastic.co/t/using-nginx-as-a-load-balancer/340773)

<div class="topic-metadata">

**Author:** [@TomTom](https://discuss.elastic.co/u/TomTom)\
**Replies:** 0\
**Last updated:** [August 14, 2023, 4:33pm UTC](https://discuss.elastic.co/t/using-nginx-as-a-load-balancer/340773 "2023-08-14T16:33:03Z")

</div>

I created an Elasticsearch Cluster with 3 Elasticsearch nodes. All nodes are of type master. They are configured to maintain high availability, one node receives data and replicates it to the other two. For load balanc…

---

## [Kibana map point-to-point connection](https://discuss.elastic.co/t/kibana-map-point-to-point-connection/340772)

<div class="topic-metadata">

**Author:** [@Hannah\_Zhang](https://discuss.elastic.co/u/Hannah_Zhang)\
**Replies:** 0\
**Last updated:** [August 14, 2023, 4:30pm UTC](https://discuss.elastic.co/t/kibana-map-point-to-point-connection/340772 "2023-08-14T16:30:04Z")

</div>

Kibana guide states that "A point-to-point connection plots aggregated data paths between the source and the destination. Thicker, darker lines symbolize more connections between a source and destination, and thinner, li…

---

## [Rollup vs Transform](https://discuss.elastic.co/t/rollup-vs-transform/340537)

<div class="topic-metadata">

**Author:** [@ajitesh](https://discuss.elastic.co/u/ajitesh)\
**Replies:** 1\
**Last updated:** [August 14, 2023, 3:23pm UTC](https://discuss.elastic.co/t/rollup-vs-transform/340537 "2023-08-14T15:23:09Z")

</div>

I have a use case where I have a nested aggregation query, now I want to ingest the data for all the aggregation results into a new index. I was going through the Elasticsearch documents and found out that Aggregation do…

---

## [Stability issues when uploading Databricks tables to Elasticsearch indices (circuit\_breaking\_exception)](https://discuss.elastic.co/t/stability-issues-when-uploading-databricks-tables-to-elasticsearch-indices-circuit-breaking-exception/340637)

<div class="topic-metadata">

**Author:** [@landlord\_matt](https://discuss.elastic.co/u/landlord_matt)\
**Replies:** 6\
**Last updated:** [August 14, 2023, 3:00pm UTC](https://discuss.elastic.co/t/stability-issues-when-uploading-databricks-tables-to-elasticsearch-indices-circuit-breaking-exception/340637 "2023-08-14T15:00:11Z")

</div>

Hi! We recently got switched from a large (8 node, 21 GB JVM heap memory) cluster to a smaller (3 node, 9 GB JVM heap memory) cluster and now we getting errors while trying to reupload our Elasticsearch indices. It occa…

---

## [Multi\_search with fuzziness](https://discuss.elastic.co/t/multi-search-with-fuzziness/340765)

<div class="topic-metadata">

**Author:** [@LUCAS\_CARVALHO\_GOMES](https://discuss.elastic.co/u/LUCAS_CARVALHO_GOMES)\
**Replies:** 0\
**Last updated:** [August 14, 2023, 2:54pm UTC](https://discuss.elastic.co/t/multi-search-with-fuzziness/340765 "2023-08-14T14:54:31Z")

</div>

Hi guys. I'm new to Elastic, so my question may sound dull, but here we go. I'm trying to make a query that searches for a phrase in different fields. I'm aware that the fuzziness param doesn't work for phrases (test p…

---

## [Is it possible to add multiple clusters for elastic agents?](https://discuss.elastic.co/t/is-it-possible-to-add-multiple-clusters-for-elastic-agents/340762)

<div class="topic-metadata">

**Author:** [@burhankaraman](https://discuss.elastic.co/u/burhankaraman)\
**Replies:** 0\
**Last updated:** [August 14, 2023, 2:26pm UTC](https://discuss.elastic.co/t/is-it-possible-to-add-multiple-clusters-for-elastic-agents/340762 "2023-08-14T14:26:45Z")

</div>

We have 2 elasticsearch clusters 3 elasticsearch nodes each. Both clusters have bi-directional cross-cluster replication with each other. If the first cluster goes down is there a way for elastic agent to automatically s…

---

## [Create Helmcharts for Metricbeats](https://discuss.elastic.co/t/create-helmcharts-for-metricbeats/340761)

<div class="topic-metadata">

**Author:** [@jhmcd2](https://discuss.elastic.co/u/jhmcd2)\
**Replies:** 0\
**Last updated:** [August 14, 2023, 2:21pm UTC](https://discuss.elastic.co/t/create-helmcharts-for-metricbeats/340761 "2023-08-14T14:21:55Z")

</div>

Hello. I have a bit of a problem. I need to be able to create a set of Helm charts for Metricbeat and Packetbeat. Now, that is easy, I am mainly using Kompose to convert the docker-compose.yml file over. However, in b…

---

## [Unable to create Runtime field \[ conflict at fetch\]](https://discuss.elastic.co/t/unable-to-create-runtime-field-conflict-at-fetch/340686)

<div class="topic-metadata">

**Author:** [@shiktec](https://discuss.elastic.co/u/shiktec)\
**Replies:** 1\
**Last updated:** [August 14, 2023, 12:02pm UTC](https://discuss.elastic.co/t/unable-to-create-runtime-field-conflict-at-fetch/340686 "2023-08-14T12:02:10Z")

</div>

I am trying to set up Airflow observability via Statsd and Elastic. I wanted to create a runtime field. the Scripts checks out well , but when i try to save the runtime fields it shows below error the Entire conf…

---

## [Aliases are lost after Elasticsearch Docker container recreate](https://discuss.elastic.co/t/aliases-are-lost-after-elasticsearch-docker-container-recreate/340743)

<div class="topic-metadata">

**Author:** [@Maxim\_Dubrovin](https://discuss.elastic.co/u/Maxim_Dubrovin)\
**Replies:** 0\
**Last updated:** [August 14, 2023, 10:43am UTC](https://discuss.elastic.co/t/aliases-are-lost-after-elasticsearch-docker-container-recreate/340743 "2023-08-14T10:43:56Z")

</div>

Hello. Our project have Elasticsearch and Logstash running as Docker containers. Both started with one "docker-compose up" command. Containers config in "docker-compose.yaml" file. Elasticsearch successfully persists dat…

---

## [I want to Use Logstash Input Plugin for capturing the audit log of Elasticsearch. But not understood which one should be suitable for this](https://discuss.elastic.co/t/i-want-to-use-logstash-input-plugin-for-capturing-the-audit-log-of-elasticsearch-but-not-understood-which-one-should-be-suitable-for-this/340745)

<div class="topic-metadata">

**Author:** [@Subrato1](https://discuss.elastic.co/u/Subrato1)\
**Replies:** 0\
**Last updated:** [August 14, 2023, 10:49am UTC](https://discuss.elastic.co/t/i-want-to-use-logstash-input-plugin-for-capturing-the-audit-log-of-elasticsearch-but-not-understood-which-one-should-be-suitable-for-this/340745 "2023-08-14T10:49:54Z")

</div>

I am trying to capture audit logs for all the executed query in Elasticsearch. i.e. DSL, EQL, SQL.

---

## [Creating an Index with .NET client](https://discuss.elastic.co/t/creating-an-index-with-net-client/340744)

<div class="topic-metadata">

**Author:** [@NekoNova](https://discuss.elastic.co/u/NekoNova)\
**Replies:** 0\
**Last updated:** [August 14, 2023, 10:44am UTC](https://discuss.elastic.co/t/creating-an-index-with-net-client/340744 "2023-08-14T10:44:18Z")

</div>

Hello, I am currently working on a project in C#.NET and we gave created Poco objects for our documents. Can I do something same for creating the Index? We have an exported index in JSON that we want to represent in c…

---

## [Embed Kibana Dashboard With Auto Authentication](https://discuss.elastic.co/t/embed-kibana-dashboard-with-auto-authentication/339278)

<div class="topic-metadata">

**Author:** [@nilaksha](https://discuss.elastic.co/u/nilaksha)\
**Replies:** 1\
**Last updated:** [August 14, 2023, 10:39am UTC](https://discuss.elastic.co/t/embed-kibana-dashboard-with-auto-authentication/339278 "2023-08-14T10:39:24Z")

</div>

hello, I use an embed dashboard to share dashboard to our application users. so when embed screen loading there is kibana basic authentication menu prompt. but I don't need to show another screen to users to login becau…

---

## [JSON serialization differences from HLRC to new Java API Client](https://discuss.elastic.co/t/json-serialization-differences-from-hlrc-to-new-java-api-client/340651)

<div class="topic-metadata">

**Author:** [@toddcarv](https://discuss.elastic.co/u/toddcarv)\
**Replies:** 1\
**Last updated:** [August 14, 2023, 10:20am UTC](https://discuss.elastic.co/t/json-serialization-differences-from-hlrc-to-new-java-api-client/340651 "2023-08-14T10:20:40Z")

</div>

With the HLRC, the timestamp field below is serialized as "2023-08-10T18:59:59.143Z". However, with the new Java API Client it is serialized as a long time. This is with the new BulkIngester. Is there a way to customize …

---

## [Filebeat cannot connect with Elasticsearch (ELK Stack setup for Suricata)](https://discuss.elastic.co/t/filebeat-cannot-connect-with-elasticsearch-elk-stack-setup-for-suricata/340728)

<div class="topic-metadata">

**Author:** [@jstnolmeme](https://discuss.elastic.co/u/jstnolmeme)\
**Replies:** 1\
**Last updated:** [August 14, 2023, 10:15am UTC](https://discuss.elastic.co/t/filebeat-cannot-connect-with-elasticsearch-elk-stack-setup-for-suricata/340728 "2023-08-14T10:15:18Z")

</div>

I'm new to Elastic, so please go easy on me :)). I am working on a project that requires ELK stack to monitor and display dashboards, based on logs collected from the IDS, Suricata. I am running a Droplet instance on D…

---

## [Kibana authentication through script- saved object install and authenticate](https://discuss.elastic.co/t/kibana-authentication-through-script-saved-object-install-and-authenticate/340620)

<div class="topic-metadata">

**Author:** [@PRASHANT\_MEHTA](https://discuss.elastic.co/u/PRASHANT_MEHTA)\
**Replies:** 1\
**Last updated:** [August 14, 2023, 10:02am UTC](https://discuss.elastic.co/t/kibana-authentication-through-script-saved-object-install-and-authenticate/340620 "2023-08-14T10:02:40Z")

</div>

Hello All, -- Question is in context of automatic (through script) installation of kibana software. -- We have enabled basic authentication for kibana and also enabled anonymous. -- and we need to import SavedObjects …

---

## [Doc Size Limits](https://discuss.elastic.co/t/doc-size-limits/340737)

<div class="topic-metadata">

**Author:** [@dawiro](https://discuss.elastic.co/u/dawiro)\
**Replies:** 0\
**Last updated:** [August 14, 2023, 9:58am UTC](https://discuss.elastic.co/t/doc-size-limits/340737 "2023-08-14T09:58:53Z")

</div>

Hi, Can I ask, does fb impose any default doc size limits? We're getting occasional reports of the beginning of message fields being truncated even though we're using combine\_partial on the docker input. The version of …

---

## [Illegal\_argument\_exception: rollover target \[log-alias\] does not point to a write index](https://discuss.elastic.co/t/illegal-argument-exception-rollover-target-log-alias-does-not-point-to-a-write-index/340735)

<div class="topic-metadata">

**Author:** [@Srijitha](https://discuss.elastic.co/u/Srijitha)\
**Replies:** 0\
**Last updated:** [August 14, 2023, 9:47am UTC](https://discuss.elastic.co/t/illegal-argument-exception-rollover-target-log-alias-does-not-point-to-a-write-index/340735 "2023-08-14T09:47:13Z")

</div>

I have EFK stack in Kubernetes, fluentd is responsible for sending application logs to elasticsearch and the index is in this format \[ logstash-%Y-%m-%d \] so it creates a new index every day. I have created Index lifecyc…

---

## [Object mapping for ... tried to parse field \[content\_range\] as object, but found a concrete value](https://discuss.elastic.co/t/object-mapping-for-tried-to-parse-field-content-range-as-object-but-found-a-concrete-value/340726)

<div class="topic-metadata">

**Author:** [@bohm](https://discuss.elastic.co/u/bohm)\
**Replies:** 0\
**Last updated:** [August 14, 2023, 9:08am UTC](https://discuss.elastic.co/t/object-mapping-for-tried-to-parse-field-content-range-as-object-but-found-a-concrete-value/340726 "2023-08-14T09:08:23Z")

</div>

Hello, Found some informative posts already, but guess I misintepreted some info. This is logstash logging: :response=\>{"index"=\>{"\_index"=\>"logstash-http-2023.08.14", "\_type"=\>"\_doc", "\_id"=\>"BobW8okBwOC2FKopPOGW", "…

[Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=450)

[Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=452)
