# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=49 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 50 --- ## [Different Cluster Behavior When Two Master-Eligible Nodes Are Stopped](https://discuss.elastic.co/t/different-cluster-behavior-when-two-master-eligible-nodes-are-stopped/380752)
**Author:** [@Farhad\_Salehi](https://discuss.elastic.co/u/Farhad_Salehi)\ **Replies:** 10\ **Last updated:** [August 5, 2025, 2:32pm UTC](https://discuss.elastic.co/t/different-cluster-behavior-when-two-master-eligible-nodes-are-stopped/380752 "2025-08-05T14:32:12Z")
I’m working with two different Elasticsearch clusters (version 8.17.5) and noticed different behavior when stopping master-eligible nodes. Here's the setup for both clusters: Cluster A: 3 dedicated master nodes 3 dedi… --- ## [Filebeat sends no Logs to ELK](https://discuss.elastic.co/t/filebeat-sends-no-logs-to-elk/380725)
**Author:** [@Elasticisti](https://discuss.elastic.co/u/Elasticisti)\ **Replies:** 11\ **Last updated:** [August 5, 2025, 2:31pm UTC](https://discuss.elastic.co/t/filebeat-sends-no-logs-to-elk/380725 "2025-08-05T14:31:20Z")
Hello, ELK Version: 9.1.0 Elastic Agent 9.1.0 Filebeat Version 9.1.0 I have installed filebeat and runs: I have configured it on this way to send the atlassian Logs to ELK: Only output.elasticsearch is activa… --- ## [Migrating from Elasticsearch helmchart to ECK](https://discuss.elastic.co/t/migrating-from-elasticsearch-helmchart-to-eck/380757)
**Author:** [@andrew-pickin-epi](https://discuss.elastic.co/u/andrew-pickin-epi)\ **Replies:** 0\ **Last updated:** [August 5, 2025, 12:04pm UTC](https://discuss.elastic.co/t/migrating-from-elasticsearch-helmchart-to-eck/380757 "2025-08-05T12:04:32Z")
Is there a documented migration plan to go from the now abandoned ES 8.5.1 helm charts at GitHub - elastic/helm-charts: You know, for Kubernetes to ECK Helm? I have several clusters in production and I can not find any … --- ## [Store json object in a field in logstash](https://discuss.elastic.co/t/store-json-object-in-a-field-in-logstash/380748)
**Author:** [@alex\_petrov](https://discuss.elastic.co/u/alex_petrov)\ **Replies:** 1\ **Last updated:** [August 5, 2025, 10:03am UTC](https://discuss.elastic.co/t/store-json-object-in-a-field-in-logstash/380748 "2025-08-05T10:03:12Z")
consider this log : { "timestamp": "2025-08-04T12:32:50.9698972+03:30", "body": { "instanceId": "abc123", "variable": "testVar", "testInt": 42, "testBool": true, "data": { "ex… --- ## [Problems reading file by logstash input plugin (permissions)](https://discuss.elastic.co/t/problems-reading-file-by-logstash-input-plugin-permissions/380593)
**Author:** [@DetlefG](https://discuss.elastic.co/u/DetlefG)\ **Replies:** 4\ **Last updated:** [August 5, 2025, 8:53am UTC](https://discuss.elastic.co/t/problems-reading-file-by-logstash-input-plugin-permissions/380593 "2025-08-05T08:53:43Z")
Which permissions has to be set for a file read by input plugin of logstash ? Following situation: Logstash is running as service with user/group logstash/logstash. Input plugin of logstash should read the file /home/… --- ## [Semantic Search Demo Fails on Some Machines But Not Others](https://discuss.elastic.co/t/semantic-search-demo-fails-on-some-machines-but-not-others/380743)
**Author:** [@learningelastic](https://discuss.elastic.co/u/learningelastic)\ **Replies:** 0\ **Last updated:** [August 5, 2025, 4:08am UTC](https://discuss.elastic.co/t/semantic-search-demo-fails-on-some-machines-but-not-others/380743 "2025-08-05T04:08:18Z")
I am trying out this guide on semantic search: My first attempt was a success (hooray!). I did it on a VM provider called linode.com, and I used a VM with 16GB memory, 6 CPUs, ubuntu 24.04 and elasticsearch 9.1. Then… --- ## [Elastic Stack ES|QL Alert Not Passing Fields to TheHive Webhook](https://discuss.elastic.co/t/elastic-stack-es-ql-alert-not-passing-fields-to-thehive-webhook/380730)
**Author:** [@aymane](https://discuss.elastic.co/u/aymane)\ **Replies:** 1\ **Last updated:** [August 5, 2025, 4:11am UTC](https://discuss.elastic.co/t/elastic-stack-es-ql-alert-not-passing-fields-to-thehive-webhook/380730 "2025-08-05T04:11:20Z")
Hi community, I'm currently using Elastic Stack 8.x and TheHive 5 (Docker deployment). I'm trying to create an ES|QL-based detection rule for SSH brute-force attempts and send alerts to TheHive using a webhook. The ale… --- ## [Check Point Harmony Endpoint Integration Fails on Log Retrieval (404) Despite Successful Manual API Tests](https://discuss.elastic.co/t/check-point-harmony-endpoint-integration-fails-on-log-retrieval-404-despite-successful-manual-api-tests/379962)
**Author:** [@Gustavo\_Colla](https://discuss.elastic.co/u/Gustavo_Colla)\ **Replies:** 2\ **Last updated:** [August 4, 2025, 7:06pm UTC](https://discuss.elastic.co/t/check-point-harmony-endpoint-integration-fails-on-log-retrieval-404-despite-successful-manual-api-tests/379962 "2025-08-04T19:06:41Z")
Hello everyone, I'm facing a persistent issue with the Check Point Harmony Endpoint Anti-Malware integration and would appreciate any insights the community might have. The integration consistently fails to retrieve lo… --- ## [Issue Encountered during Microsoft 365 integration with Elastic cloud](https://discuss.elastic.co/t/issue-encountered-during-microsoft-365-integration-with-elastic-cloud/380738)
**Author:** [@Shre1](https://discuss.elastic.co/u/Shre1)\ **Replies:** 0\ **Last updated:** [August 4, 2025, 6:42pm UTC](https://discuss.elastic.co/t/issue-encountered-during-microsoft-365-integration-with-elastic-cloud/380738 "2025-08-04T18:42:10Z")
We are currently working on integrating Elastic Cloud with one of our cloud-hosted Microsoft 365 mailboxes (hosted on Azure). We have completed the following steps: • Created a new Azure AD App and gathered all require… --- ## [Elasticsearch cluster name in yml file](https://discuss.elastic.co/t/elasticsearch-cluster-name-in-yml-file/380643)
**Author:** [@King\_storm](https://discuss.elastic.co/u/King_storm)\ **Replies:** 7\ **Last updated:** [August 4, 2025, 3:21pm UTC](https://discuss.elastic.co/t/elasticsearch-cluster-name-in-yml-file/380643 "2025-08-04T15:21:42Z")
I have created a 3 node cluster. I have not mentioned cluster name or node name . It's using the default cluster name elasticsearch and node name of the Linux system. Initially I formed the cluster using the enrollment t… --- ## [Best Practices for Combining Fleet, Elastic Agent, Logstash, and Redis?](https://discuss.elastic.co/t/best-practices-for-combining-fleet-elastic-agent-logstash-and-redis/380419)
**Author:** [@vasek](https://discuss.elastic.co/u/vasek)\ **Replies:** 6\ **Last updated:** [August 4, 2025, 1:20pm UTC](https://discuss.elastic.co/t/best-practices-for-combining-fleet-elastic-agent-logstash-and-redis/380419 "2025-08-04T13:20:42Z")
Hi everyone, I’ve been working with the Elastic Stack for several years and recently started exploring Fleet Server and Elastic Agent. While I appreciate the modern approach and prebuilt integrations, I’m struggling wit… --- ## [Barracuda CloudGen Integration - Agent listens on port 5044 but no data in Kibana](https://discuss.elastic.co/t/barracuda-cloudgen-integration-agent-listens-on-port-5044-but-no-data-in-kibana/380668)
**Author:** [@cow\_on\_lsd](https://discuss.elastic.co/u/cow_on_lsd)\ **Replies:** 1\ **Last updated:** [August 4, 2025, 12:37pm UTC](https://discuss.elastic.co/t/barracuda-cloudgen-integration-agent-listens-on-port-5044-but-no-data-in-kibana/380668 "2025-08-04T12:37:52Z")
Hello Everyone, I am in the process of setting up the ELK stack. I have already successfully integrated some windows server machines (through agents), some linux hosts and our switches. I am running the latest version o… --- ## [NET Client: Serialisation of descriptor objects (e.g. QueryDescriptor)](https://discuss.elastic.co/t/net-client-serialisation-of-descriptor-objects-e-g-querydescriptor/380257)
**Author:** [@JanSearch](https://discuss.elastic.co/u/JanSearch)\ **Replies:** 3\ **Last updated:** [August 4, 2025, 9:21am UTC](https://discuss.elastic.co/t/net-client-serialisation-of-descriptor-objects-e-g-querydescriptor/380257 "2025-08-04T09:21:50Z")
Dear Elastic forum, we used NEST so far and are going to switch to the new client. In NEST it is possible to serialise the descriptor objects, e.g. QueryContainerDescriptor or CreateIndexDescriptor. In the new NET cli… --- ## [\`include\_matches.match\` has no effect with journal fields (config included)](https://discuss.elastic.co/t/include-matches-match-has-no-effect-with-journal-fields-config-included/380701)
**Author:** [@NominaSumpta](https://discuss.elastic.co/u/NominaSumpta)\ **Replies:** 2\ **Last updated:** [August 4, 2025, 8:26am UTC](https://discuss.elastic.co/t/include-matches-match-has-no-effect-with-journal-fields-config-included/380701 "2025-08-04T08:26:42Z")
Is this a documentation bug, or a Filebeat bug? This is an example from the Filebeat documentation: filebeat.inputs: - type: journald id: service-vault include\_matches.match: - \_SYSTEMD\_UNIT=vault.service Appl… --- ## [Microsoft DNS Server integration - remove dot at domainn name's end](https://discuss.elastic.co/t/microsoft-dns-server-integration-remove-dot-at-domainn-names-end/380457)
**Author:** [@Zer0-cyber-web](https://discuss.elastic.co/u/Zer0-cyber-web)\ **Replies:** 8\ **Last updated:** [August 4, 2025, 6:15am UTC](https://discuss.elastic.co/t/microsoft-dns-server-integration-remove-dot-at-domainn-names-end/380457 "2025-08-04T06:15:55Z")
Hi! Could someone point me where to look: in Microsoft DNS Server index, there is a field with requested domain name - dns.question.name. It contains domain name that was requested by client. The only problem is that af… --- ## [How to monitor deleted document information](https://discuss.elastic.co/t/how-to-monitor-deleted-document-information/380241)
**Author:** [@double-7](https://discuss.elastic.co/u/double-7)\ **Replies:** 2\ **Last updated:** [August 4, 2025, 1:09am UTC](https://discuss.elastic.co/t/how-to-monitor-deleted-document-information/380241 "2025-08-04T01:09:11Z")
hello . I need everyone's help. Currently, I want to perform document monitoring on the ES server. I can accomplish this by using the \_seq\_no attribute to monitor the addition and modification of documents. However, whe… --- ## [Cant get Search to work with .NET 9 Client](https://discuss.elastic.co/t/cant-get-search-to-work-with-net-9-client/380688)
**Author:** [@c77m](https://discuss.elastic.co/u/c77m)\ **Replies:** 2\ **Last updated:** [August 3, 2025, 6:02pm UTC](https://discuss.elastic.co/t/cant-get-search-to-work-with-net-9-client/380688 "2025-08-03T18:02:48Z")
Hi, new to Elastic Search so I'm a bit stuck, I have indexed som documents and I can see mappings are created for all properties for my document. (might not be optimal right now but just testing this out right now) S… --- ## [Tabular form or report based on logs](https://discuss.elastic.co/t/tabular-form-or-report-based-on-logs/380684)
**Author:** [@dsrini-open](https://discuss.elastic.co/u/dsrini-open)\ **Replies:** 2\ **Last updated:** [August 3, 2025, 1:24am UTC](https://discuss.elastic.co/t/tabular-form-or-report-based-on-logs/380684 "2025-08-03T01:24:40Z")
I have the following logs - 20:00:00 Started processing 20:05:00 Successfully finished 20:05:03 Output file - /temp/file2 20:05:03 Started processing 20:10:10 Successfully finished 20:10:14 Output file - /temp/fil… --- ## [Version 9 Frozen Indices](https://discuss.elastic.co/t/version-9-frozen-indices/380691)
**Author:** [@Tal\_Hayun](https://discuss.elastic.co/u/Tal_Hayun)\ **Replies:** 2\ **Last updated:** [August 2, 2025, 1:54pm UTC](https://discuss.elastic.co/t/version-9-frozen-indices/380691 "2025-08-02T13:54:22Z")
In version 9.0 release notes it says - "Remove the ability to read frozen indices" Does that include indices in frozen ILM phase? --- ## [Blue Theme not matching on Alerts Overview](https://discuss.elastic.co/t/blue-theme-not-matching-on-alerts-overview/380676)
**Author:** [@erikg](https://discuss.elastic.co/u/erikg)\ **Replies:** 1\ **Last updated:** [August 2, 2025, 4:19am UTC](https://discuss.elastic.co/t/blue-theme-not-matching-on-alerts-overview/380676 "2025-08-02T04:19:24Z")
In 9.1.0, it appears there's a visual bug with alerts overview on the overview page, noticed this since 9.0.0 lol I guess it's still not fixed --- ## [Activate "Fleet" and deploy agents - is a Fleet Server necessary?](https://discuss.elastic.co/t/activate-fleet-and-deploy-agents-is-a-fleet-server-necessary/380672)
**Author:** [@Elasticisti](https://discuss.elastic.co/u/Elasticisti)\ **Replies:** 1\ **Last updated:** [August 1, 2025, 9:16pm UTC](https://discuss.elastic.co/t/activate-fleet-and-deploy-agents-is-a-fleet-server-necessary/380672 "2025-08-01T21:16:59Z")
Hi there, I am new to ELK. It runs now in a small VM in our Testnetwork. Just for fun, I would like to ingest some jira logs to ELK as I see I should use "Fleet" to deploy the agents. As I have only one testnode, … --- ## [Kibana Upgrade 9.1.0 Issues](https://discuss.elastic.co/t/kibana-upgrade-9-1-0-issues/380675)
**Author:** [@erikg](https://discuss.elastic.co/u/erikg)\ **Replies:** 1\ **Last updated:** [August 1, 2025, 4:25pm UTC](https://discuss.elastic.co/t/kibana-upgrade-9-1-0-issues/380675 "2025-08-01T16:25:01Z")
Hello, Recently upgraded from 9.0.3 to 9.1.0: Looks like these errors keep popping up in the kibana logs: illegal\_argument\_exception: Result window is too large, from + size must be less than or equal to: … --- ## [A dashboard for the indices has been under construction for a long time](https://discuss.elastic.co/t/a-dashboard-for-the-indices-has-been-under-construction-for-a-long-time/380673)
**Author:** [@RShyp](https://discuss.elastic.co/u/RShyp)\ **Replies:** 0\ **Last updated:** [August 1, 2025, 2:59pm UTC](https://discuss.elastic.co/t/a-dashboard-for-the-indices-has-been-under-construction-for-a-long-time/380673 "2025-08-01T14:59:38Z")
We have an Oracle Linux Server 9.2 with ELK Stack version 8.18.3 deployed. In Elasticsearch, we store information about web resource activity (each resource is a separate daily index, with approximately 45 indices and a… --- ## [Unable to Load Page After Upgrade](https://discuss.elastic.co/t/unable-to-load-page-after-upgrade/380638)
**Author:** [@Jadorin](https://discuss.elastic.co/u/Jadorin)\ **Replies:** 3\ **Last updated:** [August 1, 2025, 1:44pm UTC](https://discuss.elastic.co/t/unable-to-load-page-after-upgrade/380638 "2025-08-01T13:44:27Z")
I recently upgraded our ELK stack from v8.4.3 to v8.18.4 (single node for each product). The only issue we seem to have is that we're unable to open the Stack Management -\> API keys page. We get an error stating "Unable … --- ## [Deploy ELK on AlmaLinux 9.2 elasticsearch-create-enrollment-token Command not found](https://discuss.elastic.co/t/deploy-elk-on-almalinux-9-2-elasticsearch-create-enrollment-token-command-not-found/380664)
**Author:** [@Elasticisti](https://discuss.elastic.co/u/Elasticisti)\ **Replies:** 2\ **Last updated:** [August 1, 2025, 2:36pm UTC](https://discuss.elastic.co/t/deploy-elk-on-almalinux-9-2-elasticsearch-create-enrollment-token-command-not-found/380664 "2025-08-01T14:36:49Z")
Hi, I have an AlmaLinux Vm mit 4CPU und 4GB RAM where ELK should be deployed. I have used this tutorial to achieve this: "www.hostmycode.in/tutorials/install-and-configure-elk-stack-on-almalinux" I got to the point, … --- ## [Is it possible to delaying shrink and forcemerge lifecycle steps in hot tier](https://discuss.elastic.co/t/is-it-possible-to-delaying-shrink-and-forcemerge-lifecycle-steps-in-hot-tier/380634)
**Author:** [@Vivek\_Shinde](https://discuss.elastic.co/u/Vivek_Shinde)\ **Replies:** 3\ **Last updated:** [August 1, 2025, 12:32pm UTC](https://discuss.elastic.co/t/is-it-possible-to-delaying-shrink-and-forcemerge-lifecycle-steps-in-hot-tier/380634 "2025-08-01T12:32:01Z")
Hi All, Need some information about setting up ILM policy like below for time series data stream. "hot": { "min\_age": "0ms", "actions": { "rollover": { "max\_age": "10d", … --- ## [Openshift pod count into elastic](https://discuss.elastic.co/t/openshift-pod-count-into-elastic/380658)
**Author:** [@tractor\_boy](https://discuss.elastic.co/u/tractor_boy)\ **Replies:** 0\ **Last updated:** [August 1, 2025, 12:01pm UTC](https://discuss.elastic.co/t/openshift-pod-count-into-elastic/380658 "2025-08-01T12:01:06Z")
I have a number of projects in openshift, and each project can have multiple pods running. I'd like to visualise that data in kibana, but need it stored in elastic first. how do I get elastic to gather that data? It w… --- ## [Dashboards can't find the data view](https://discuss.elastic.co/t/dashboards-cant-find-the-data-view/380599)
**Author:** [@rara01](https://discuss.elastic.co/u/rara01)\ **Replies:** 5\ **Last updated:** [August 1, 2025, 10:03am UTC](https://discuss.elastic.co/t/dashboards-cant-find-the-data-view/380599 "2025-08-01T10:03:37Z")
Hi, I would say majority of automatically generated dashboards from elastic agents, it's integrations , and other dashboards like "Metric System Overview", are in part or overall broken. All of them are pointing to metr… --- ## [Unable to sync only documents that match connector include rules](https://discuss.elastic.co/t/unable-to-sync-only-documents-that-match-connector-include-rules/374418)
**Author:** [@anielo](https://discuss.elastic.co/u/anielo)\ **Replies:** 5\ **Last updated:** [August 1, 2025, 9:37am UTC](https://discuss.elastic.co/t/unable-to-sync-only-documents-that-match-connector-include-rules/374418 "2025-08-01T09:37:26Z")
Hi there, I am setting up a MySQL connector to synchronise a table with Elasticsearch. My use case is to synchronise only rows that have a field matching a given value (and exclude all the others). I created one includ… --- ## [Ingest pipeline creation problem](https://discuss.elastic.co/t/ingest-pipeline-creation-problem/380538)
**Author:** [@bbreer](https://discuss.elastic.co/u/bbreer)\ **Replies:** 5\ **Last updated:** [August 1, 2025, 9:31am UTC](https://discuss.elastic.co/t/ingest-pipeline-creation-problem/380538 "2025-08-01T09:31:48Z")
I'm trying to create an ingest pipeline using a grok porcessor to strip the syslog header and a json processor to extract the json portion of the message. Here's the structure of the messages I need to ingest: 2025-07-… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=48) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=50)