# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=46 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 47 --- ## [Implementing Elastic Agent on Multiple Endpoints](https://discuss.elastic.co/t/implementing-elastic-agent-on-multiple-endpoints/381163)
**Author:** [@Zhaojing\_Yuan](https://discuss.elastic.co/u/Zhaojing_Yuan)\ **Replies:** 2\ **Last updated:** [August 20, 2025, 12:35pm UTC](https://discuss.elastic.co/t/implementing-elastic-agent-on-multiple-endpoints/381163 "2025-08-20T12:35:04Z")
I’m sorry, I’ve really run out of ideas on how to implement Elastic Agents on multiple endpoints and send the monitoring logs to the Elastic Stack. The architecture of my experimental environment consists of three Ubunt… --- ## [Logstash file input does not deduct the new file after log rotation](https://discuss.elastic.co/t/logstash-file-input-does-not-deduct-the-new-file-after-log-rotation/378543)
**Author:** [@guru\_dev](https://discuss.elastic.co/u/guru_dev)\ **Replies:** 3\ **Last updated:** [August 20, 2025, 7:47am UTC](https://discuss.elastic.co/t/logstash-file-input-does-not-deduct-the-new-file-after-log-rotation/378543 "2025-08-20T07:47:36Z")
parser\_\*.log once this file is 10mb this gets renamed to parser\_appserver\_backup.log and then creates a new file called parser\_appserver.log.later parser\_appserver\_backup.log is deleted logstash completely reads parser… --- ## [Character encoding problem in output](https://discuss.elastic.co/t/character-encoding-problem-in-output/381072)
**Author:** [@elainesoucy](https://discuss.elastic.co/u/elainesoucy)\ **Replies:** 3\ **Last updated:** [August 19, 2025, 8:05pm UTC](https://discuss.elastic.co/t/character-encoding-problem-in-output/381072 "2025-08-19T20:05:20Z")
Hello, I'm having a character encoding problem. I have a .ndjson file in UTF-8 encoding. For some reason I can't understand, even though I explicitly specify UTF-8 encoding in the input file, the output contains misinte… --- ## [Result from ES|QL differs from result of regular search](https://discuss.elastic.co/t/result-from-es-ql-differs-from-result-of-regular-search/381123)
**Author:** [@peter9](https://discuss.elastic.co/u/peter9)\ **Replies:** 8\ **Last updated:** [August 19, 2025, 6:27pm UTC](https://discuss.elastic.co/t/result-from-es-ql-differs-from-result-of-regular-search/381123 "2025-08-19T18:27:53Z")
This regular query: GET /twitter20230601-times/\_search { "\_source": \["counts"\] } results: { "took": 0, "timed\_out": false, "\_shards": { "total": 1, "successful": 1, "skipped": 0, "failed": 0 … --- ## [Index fields became unmapped](https://discuss.elastic.co/t/index-fields-became-unmapped/381120)
**Author:** [@zaeemmasood](https://discuss.elastic.co/u/zaeemmasood)\ **Replies:** 4\ **Last updated:** [August 19, 2025, 2:43pm UTC](https://discuss.elastic.co/t/index-fields-became-unmapped/381120 "2025-08-19T14:43:15Z")
Hi All, All fields except @timestamp became “Unmapped” (unavailable for Analysis). Please see below and help: This was working fine earlier. Please help --- ## [Winlogbeat isn't dropping event](https://discuss.elastic.co/t/winlogbeat-isnt-dropping-event/380975)
**Author:** [@Paulo\_Isaias](https://discuss.elastic.co/u/Paulo_Isaias)\ **Replies:** 7\ **Last updated:** [August 19, 2025, 1:19pm UTC](https://discuss.elastic.co/t/winlogbeat-isnt-dropping-event/380975 "2025-08-19T13:19:09Z")
Hey guys, cheers, i really need help to drop some events at my active directory, it’s eating my disk space, xD, I have issue with filtering system logons which occur in events 4624 and 4634, i only want to filter real lo… --- ## [Interaction Between discovery.zen.ping.unicast.hosts and discovery-gce in Elasticsearch 6.5.3](https://discuss.elastic.co/t/interaction-between-discovery-zen-ping-unicast-hosts-and-discovery-gce-in-elasticsearch-6-5-3/381021)
**Author:** [@sisindri](https://discuss.elastic.co/u/sisindri)\ **Replies:** 3\ **Last updated:** [August 19, 2025, 10:58am UTC](https://discuss.elastic.co/t/interaction-between-discovery-zen-ping-unicast-hosts-and-discovery-gce-in-elasticsearch-6-5-3/381021 "2025-08-19T10:58:27Z")
We are running Elasticsearch 6.5.3 on GCP with the discovery-gce plugin enabled. All master nodes have both: discovery.zen.ping.unicast.hosts: \["ip1:9300", "ip2:9300", "ip3:9300"\] discovery.gce.project: "my-project" d… --- ## [Can you exclude subfolder from being crawled completely in filebeat?](https://discuss.elastic.co/t/can-you-exclude-subfolder-from-being-crawled-completely-in-filebeat/381127)
**Author:** [@WERTYASDFGH](https://discuss.elastic.co/u/WERTYASDFGH)\ **Replies:** 2\ **Last updated:** [August 19, 2025, 10:52am UTC](https://discuss.elastic.co/t/can-you-exclude-subfolder-from-being-crawled-completely-in-filebeat/381127 "2025-08-19T10:52:56Z")
Hello, I’m trying to collect logs from certain folder using filebeat 8.18.3. All the logs are in subfolders of this folder. However in the same directory as logs there 2 folders that contains few millions of xml files th… --- ## [How to Completely Disable Telemetry in Elastic Stack 8.18.4?](https://discuss.elastic.co/t/how-to-completely-disable-telemetry-in-elastic-stack-8-18-4/381102)
**Author:** [@xqaiviwjxzw](https://discuss.elastic.co/u/xqaiviwjxzw)\ **Replies:** 2\ **Last updated:** [August 19, 2025, 7:19am UTC](https://discuss.elastic.co/t/how-to-completely-disable-telemetry-in-elastic-stack-8-18-4/381102 "2025-08-19T07:19:27Z")
For compliance reasons, we must ensure that Kibana, Fleet, Elastic Agent, and other components do not send any telemetry or usage data to external domains. --- ## [Questions about Filebeat 7.x to 8.x upgrade regarding data streams](https://discuss.elastic.co/t/questions-about-filebeat-7-x-to-8-x-upgrade-regarding-data-streams/380736)
**Author:** [@NominaSumpta](https://discuss.elastic.co/u/NominaSumpta)\ **Replies:** 4\ **Last updated:** [August 18, 2025, 10:25pm UTC](https://discuss.elastic.co/t/questions-about-filebeat-7-x-to-8-x-upgrade-regarding-data-streams/380736 "2025-08-18T22:25:35Z")
Hi, I have a couple questions regarding the 7.x to 8.x upgrade for Beats/Filebeat. In Beats/Filebeat 8.x, data streams are used instead of indexes when ingesting data to Elasticsearch. Question: does this apply onl… --- ## [Kibana CSV Export – Large Stacktraces Splitting into Multiple Records](https://discuss.elastic.co/t/kibana-csv-export-large-stacktraces-splitting-into-multiple-records/380978)
**Author:** [@nkf\_123](https://discuss.elastic.co/u/nkf_123)\ **Replies:** 7\ **Last updated:** [August 18, 2025, 10:19am UTC](https://discuss.elastic.co/t/kibana-csv-export-large-stacktraces-splitting-into-multiple-records/380978 "2025-08-18T10:19:35Z")
I’m facing an issue while exporting records from Kibana (v8.8.2) via CSV. I have a field, os.log.message, that contains large stacktraces — sometimes over 1,000 words, including new lines, spaces, etc. In some cases, th… --- ## [High memory usage](https://discuss.elastic.co/t/high-memory-usage/381101)
**Author:** [@Dev\_AI](https://discuss.elastic.co/u/Dev_AI)\ **Replies:** 5\ **Last updated:** [August 18, 2025, 9:26am UTC](https://discuss.elastic.co/t/high-memory-usage/381101 "2025-08-18T09:26:04Z")
Hello, I'm new to the ElasticStacks universe and would like to ask a question. Below is a screenshot of the resources being used by my nodes. You can see that memory usage is high. Is this normal? Should I be conc… --- ## [Node js vul. detedted in kibana](https://discuss.elastic.co/t/node-js-vul-detedted-in-kibana/381039)
**Author:** [@Ekta](https://discuss.elastic.co/u/Ekta)\ **Replies:** 3\ **Last updated:** [August 18, 2025, 9:21am UTC](https://discuss.elastic.co/t/node-js-vul-detedted-in-kibana/381039 "2025-08-18T09:21:32Z")
Hi we have installed kibana - 8.18.4 and nodejs version 20.19.2in ubuntu - 22.04 but still it vulnerable with Risk fector high below is the CVE CVE: CVE-2025-27209, CVE-2025-27210 Can you please let us know when nod… --- ## [Change in aws.cloudwatch\_logs.log\_group Field Behavior in Elastic Agent 8.19](https://discuss.elastic.co/t/change-in-aws-cloudwatch-logs-log-group-field-behavior-in-elastic-agent-8-19/381063)
**Author:** [@vini.melo](https://discuss.elastic.co/u/vini.melo)\ **Replies:** 2\ **Last updated:** [August 18, 2025, 8:39am UTC](https://discuss.elastic.co/t/change-in-aws-cloudwatch-logs-log-group-field-behavior-in-elastic-agent-8-19/381063 "2025-08-18T08:39:26Z")
Impacted Component: Elastic Agent – AWS Integration (CloudWatch Logs) Issue Description: After upgrading the Elastic Agent from version 8.15 to 8.19, we observed a change in how the output field aws.cloudwatch\_logs.log… --- ## [Elasticsearch on BareMetal, not Virtual Server](https://discuss.elastic.co/t/elasticsearch-on-baremetal-not-virtual-server/381065)
**Author:** [@api\_developer](https://discuss.elastic.co/u/api_developer)\ **Replies:** 3\ **Last updated:** [August 17, 2025, 8:27pm UTC](https://discuss.elastic.co/t/elasticsearch-on-baremetal-not-virtual-server/381065 "2025-08-17T20:27:03Z")
Hi everyone, Does anyone have experience building Elastic Stack on BareMetal? Its depends on the price of SAN, which is expensive. If anyone has done it, could you share with me how you did it and the pros & cons? Tha… --- ## [Opster availability](https://discuss.elastic.co/t/opster-availability/368511)
**Author:** [@agonzalez](https://discuss.elastic.co/u/agonzalez)\ **Replies:** 9\ **Last updated:** [August 17, 2025, 8:21pm UTC](https://discuss.elastic.co/t/opster-availability/368511 "2025-08-17T20:21:44Z")
Elastic acquired opster 1 year ago, why is not available to new users yet or integrated? we need a solution like that to optimize clusters, now is very hard. I am testing Pulse that is an alternative but we would like t… --- ## [What is the best way to distribute nodes and shards in Elasticsearch to achieve fast search while storing recent data on SSD and older data on HDD?](https://discuss.elastic.co/t/what-is-the-best-way-to-distribute-nodes-and-shards-in-elasticsearch-to-achieve-fast-search-while-storing-recent-data-on-ssd-and-older-data-on-hdd/380988)
**Author:** [@Ella\_conan](https://discuss.elastic.co/u/Ella_conan)\ **Replies:** 27\ **Last updated:** [August 17, 2025, 7:52pm UTC](https://discuss.elastic.co/t/what-is-the-best-way-to-distribute-nodes-and-shards-in-elasticsearch-to-achieve-fast-search-while-storing-recent-data-on-ssd-and-older-data-on-hdd/380988 "2025-08-17T19:52:12Z")
Hello, I am storing events from different sources, and the data is continuous and reaches huge sizes. I want to implement an effective strategy for data retention. I want to keep the last 14 days of data on SSD storage… --- ## [ESQL beginner grouping question](https://discuss.elastic.co/t/esql-beginner-grouping-question/381054)
**Author:** [@spinscale](https://discuss.elastic.co/u/spinscale)\ **Replies:** 4\ **Last updated:** [August 15, 2025, 4:40pm UTC](https://discuss.elastic.co/t/esql-beginner-grouping-question/381054 "2025-08-15T16:40:11Z")
Hey, I am currently trying to convert a lengthy query DSL query with terms, top hits and max aggregations into a ESQL query, but I am failing at a basic requirement. Imagine the following three documents: PUT alr-test/… --- ## [NodeClosedException error](https://discuss.elastic.co/t/nodeclosedexception-error/381015)
**Author:** [@mahesh.hemke24](https://discuss.elastic.co/u/mahesh.hemke24)\ **Replies:** 2\ **Last updated:** [August 15, 2025, 3:33pm UTC](https://discuss.elastic.co/t/nodeclosedexception-error/381015 "2025-08-15T15:33:29Z")
{"@timestamp":"2025-08-13T08:41:40.021Z", "log.level": "INFO", "message":"stopping ...", "ecs.version": "1.2.0","service.name":"ES\_ECS","event.dataset":"elasticsearch.server","process.thread.name":"elasticsearch-shutdow… --- ## [Missing repodata/filelists.xml in yum repo causes repo sync to fail](https://discuss.elastic.co/t/missing-repodata-filelists-xml-in-yum-repo-causes-repo-sync-to-fail/374168)
**Author:** [@sobjerke](https://discuss.elastic.co/u/sobjerke)\ **Replies:** 35\ **Last updated:** [August 15, 2025, 7:47am UTC](https://discuss.elastic.co/t/missing-repodata-filelists-xml-in-yum-repo-causes-repo-sync-to-fail/374168 "2025-08-15T07:47:56Z")
We are using Red Hat Satellite server to distribute rpm packages to our servers. It synchronizes the Elasticsearch 8.x yum repository (https://artifacts.elastic.co/packages/8.x/yum) only downloading repository metadata a… --- ## [Filebeat OSS 9.1.2 crashes with segmentation fault #46016](https://discuss.elastic.co/t/filebeat-oss-9-1-2-crashes-with-segmentation-fault-46016/381056)
**Author:** [@nimayz](https://discuss.elastic.co/u/nimayz)\ **Replies:** 6\ **Last updated:** [August 14, 2025, 9:29pm UTC](https://discuss.elastic.co/t/filebeat-oss-9-1-2-crashes-with-segmentation-fault-46016/381056 "2025-08-14T21:29:18Z")
Filebeat 9.1.2 crashes when running in a docker container. I’m running this on an M1 Mac. $ docker run --rm -ti --entrypoint bash docker.elastic.co/beats/filebeat-oss:9.1.2 $ ./filebeat Segmentation fault Cannot repro… --- ## [How to filter of parsed json?](https://discuss.elastic.co/t/how-to-filter-of-parsed-json/381043)
**Author:** [@Albert\_Aleksandrov](https://discuss.elastic.co/u/Albert_Aleksandrov)\ **Replies:** 1\ **Last updated:** [August 14, 2025, 4:46pm UTC](https://discuss.elastic.co/t/how-to-filter-of-parsed-json/381043 "2025-08-14T16:46:57Z")
Hi all! I have a log like that: { "\_index": "index1", "\_type": "\_doc", "\_id": "sdvsdv", "\_version": 1, "\_score": null, "\_source": { "@metadata": { "beat": "filebeat", "type": "\_doc", "… --- ## [Fleet server Elasticsearch output settings connection errors](https://discuss.elastic.co/t/fleet-server-elasticsearch-output-settings-connection-errors/381005)
**Author:** [@f4n-1nh1b1t10n](https://discuss.elastic.co/u/f4n-1nh1b1t10n)\ **Replies:** 2\ **Last updated:** [August 14, 2025, 1:42pm UTC](https://discuss.elastic.co/t/fleet-server-elasticsearch-output-settings-connection-errors/381005 "2025-08-14T13:42:38Z")
Hello, this is the issue i’m currently pondering over: Situation an agent with fleet server integration, running in a VM, together with other elements of the stack (ES, KIB) agents running on Windows hosts ES is publi… --- ## [Copy ES snapshot to another ES](https://discuss.elastic.co/t/copy-es-snapshot-to-another-es/381045)
**Author:** [@Shahram](https://discuss.elastic.co/u/Shahram)\ **Replies:** 0\ **Last updated:** [August 14, 2025, 1:12pm UTC](https://discuss.elastic.co/t/copy-es-snapshot-to-another-es/381045 "2025-08-14T13:12:13Z")
Hello, I have 2 ES9.0.4 with exactily the same configuration and setup. In ES1: I created one index and put some dummy data as: get test/\_search { "took": 0, "timed\_out": false, "\_shards": { "total": 1, "successful"… --- ## [Include\_lines for pubsub input isn't working: no filtering](https://discuss.elastic.co/t/include-lines-for-pubsub-input-isnt-working-no-filtering/381036)
**Author:** [@blankoworld](https://discuss.elastic.co/u/blankoworld)\ **Replies:** 1\ **Last updated:** [August 14, 2025, 11:17am UTC](https://discuss.elastic.co/t/include-lines-for-pubsub-input-isnt-working-no-filtering/381036 "2025-08-14T11:17:24Z")
Hi everyone, Today I’m encounting some problems using Filebeat with the Pubsub input. I want to fetch data from a PubSub (from GCP) and then push it in Kafka. All is OK for that. Nevertheless I need to filter lines to… --- ## [Cannot change APM indicies in Kibana](https://discuss.elastic.co/t/cannot-change-apm-indicies-in-kibana/379997)
**Author:** [@querqueq](https://discuss.elastic.co/u/querqueq)\ **Replies:** 1\ **Last updated:** [August 14, 2025, 9:36am UTC](https://discuss.elastic.co/t/cannot-change-apm-indicies-in-kibana/379997 "2025-08-14T09:36:32Z")
Hello! I'm logged in as the elastic user and I cannot change the indicies for the APM view in Kibana. I believe I set them some time ago to test something and now I cannot change them. The greyed out button tells me "Yo… --- ## [Modules.d vs inputs.d vs filebeat.yml](https://discuss.elastic.co/t/modules-d-vs-inputs-d-vs-filebeat-yml/380754)
**Author:** [@Just\_Two\_Cat\_In\_ABox](https://discuss.elastic.co/u/Just_Two_Cat_In_ABox)\ **Replies:** 1\ **Last updated:** [August 14, 2025, 8:23am UTC](https://discuss.elastic.co/t/modules-d-vs-inputs-d-vs-filebeat-yml/380754 "2025-08-14T08:23:39Z")
Hello, I'm a newbie with filebeat. (not sure my topic is at the right place) My question is simple : How to organize by project my filebeat configuration ? For what I understand there is 3 places to configure stuff … --- ## [Stack monitoring not showing replica index rate](https://discuss.elastic.co/t/stack-monitoring-not-showing-replica-index-rate/381017)
**Author:** [@twilson](https://discuss.elastic.co/u/twilson)\ **Replies:** 1\ **Last updated:** [August 14, 2025, 5:53am UTC](https://discuss.elastic.co/t/stack-monitoring-not-showing-replica-index-rate/381017 "2025-08-14T05:53:48Z")
After upgrading to 8.18.1 the stack monitoring in Kibana is not showing the index rate for replica shards. This behavior exists even after upgrading to 8.19.2. Checking the statistics through the \_stats API call sho… --- ## [Monitor events in an alert](https://discuss.elastic.co/t/monitor-events-in-an-alert/381023)
**Author:** [@Lev2](https://discuss.elastic.co/u/Lev2)\ **Replies:** 1\ **Last updated:** [August 14, 2025, 4:49am UTC](https://discuss.elastic.co/t/monitor-events-in-an-alert/381023 "2025-08-14T04:49:50Z")
I want to monitor the amount of events for a period with a treshold. How can I set this in an alert rule? --- ## [Logstash nested JSON Array, split and parse on nested JSON without using Ruby code](https://discuss.elastic.co/t/logstash-nested-json-array-split-and-parse-on-nested-json-without-using-ruby-code/380985)
**Author:** [@yelinaung](https://discuss.elastic.co/u/yelinaung)\ **Replies:** 2\ **Last updated:** [August 14, 2025, 2:36am UTC](https://discuss.elastic.co/t/logstash-nested-json-array-split-and-parse-on-nested-json-without-using-ruby-code/380985 "2025-08-14T02:36:14Z")
How to split separate field on nested JSON Array. Can someone kindly help with this? Thank you. Below is the nested JSON array Sample JSON Code "http": { "request": { "headers": \[ { "Name": "Host", … [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=45) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=47)