# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=5 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 6 --- ## [Should Master nodes only receive the traffic in an ES cluster?](https://discuss.elastic.co/t/should-master-nodes-only-receive-the-traffic-in-an-es-cluster/388916)
**Author:** [@Aditya\_Sugandhi](https://discuss.elastic.co/u/Aditya_Sugandhi)\ **Replies:** 3\ **Last updated:** [July 30, 2026, 9:19pm UTC](https://discuss.elastic.co/t/should-master-nodes-only-receive-the-traffic-in-an-es-cluster/388916 "2026-07-30T21:19:01Z")
Currently, I have 16 nodes (5 master + 11 data nodes) in my cluster and via Haproxy I am sending the requests to only the master nodes. Recently, due to some issue one of the master node was flapping and latency spiked … --- ## [Discover fails with "content length bigger than max allowed string" on index with large text field](https://discuss.elastic.co/t/discover-fails-with-content-length-bigger-than-max-allowed-string-on-index-with-large-text-field/388911)
**Author:** [@Mouly\_Infy](https://discuss.elastic.co/u/Mouly_Infy)\ **Replies:** 1\ **Last updated:** [July 30, 2026, 5:23pm UTC](https://discuss.elastic.co/t/discover-fails-with-content-length-bigger-than-max-allowed-string-on-index-with-large-text-field/388911 "2026-07-30T17:23:27Z")
Hello Connections, We're facing an issue when trying to retrieve documents in Discover, and wanted to get community input on the best long-term fix. Environment: Elastic Stack version: \[8.19.3\] Deployment: self-manag… --- ## [AWS integration 7.1 fleet agent bug or UI glitch](https://discuss.elastic.co/t/aws-integration-7-1-fleet-agent-bug-or-ui-glitch/388899)
**Author:** [@stanley783](https://discuss.elastic.co/u/stanley783)\ **Replies:** 10\ **Last updated:** [July 30, 2026, 3:01pm UTC](https://discuss.elastic.co/t/aws-integration-7-1-fleet-agent-bug-or-ui-glitch/388899 "2026-07-30T15:01:48Z")
Recently upgraded ELK cluster from 9.3.2 to 9.4.4. On older version had AWS integration of version 6.20, on new cluster upgraded it to 7.1 latest. Prior to upgrade, we had 1 Elastic agent with this integration 6.2 (agent… --- ## [Elastic Serverless Forwarder - Millions of API calls causing excess costs](https://discuss.elastic.co/t/elastic-serverless-forwarder-millions-of-api-calls-causing-excess-costs/388327)
**Author:** [@Watsong](https://discuss.elastic.co/u/Watsong)\ **Replies:** 2\ **Last updated:** [July 30, 2026, 10:17am UTC](https://discuss.elastic.co/t/elastic-serverless-forwarder-millions-of-api-calls-causing-excess-costs/388327 "2026-07-30T10:17:37Z")
The Elastic Serverless Forwarder AWS Lambda function accesses two credential values: ESF-CLOUD-ID, ESF-API-KEY The Lambda function does not cache the credentials. It retrieves them on every invocation of the Lambda func… --- ## [Fleet Server Enroll failure](https://discuss.elastic.co/t/fleet-server-enroll-failure/388685)
**Author:** [@Zaryab\_Shaikh](https://discuss.elastic.co/u/Zaryab_Shaikh)\ **Replies:** 4\ **Last updated:** [July 30, 2026, 7:11am UTC](https://discuss.elastic.co/t/fleet-server-enroll-failure/388685 "2026-07-30T07:11:51Z")
Title: Fleet Server on External Ubuntu VM Fails to Bootstrap with ECK Deployment Dear Community, I hope you are doing well. I am trying to deploy a standalone Fleet Server on an Ubuntu VM and connect it to my Elastic … --- ## [High Filebeat Disk I/O After Reboot With Ubuntu 24.04](https://discuss.elastic.co/t/high-filebeat-disk-i-o-after-reboot-with-ubuntu-24-04/388881)
**Author:** [@harrelst](https://discuss.elastic.co/u/harrelst)\ **Replies:** 0\ **Last updated:** [July 30, 2026, 3:32am UTC](https://discuss.elastic.co/t/high-filebeat-disk-i-o-after-reboot-with-ubuntu-24-04/388881 "2026-07-30T03:32:40Z")
We use a Filebeat DaemonSet to collect container logs from nodes in our Kubernetes cluster. I recently added some Ubuntu 24.04 nodes to the cluster, and when Filebeat restarts after a reboot generates around 150 MB/s of … --- ## [Readiness check for Elasticsearch coordinator nodes behind a load balancer?](https://discuss.elastic.co/t/readiness-check-for-elasticsearch-coordinator-nodes-behind-a-load-balancer/386690)
**Author:** [@sagar\_cenation](https://discuss.elastic.co/u/sagar_cenation)\ **Replies:** 33\ **Last updated:** [July 29, 2026, 10:54am UTC](https://discuss.elastic.co/t/readiness-check-for-elasticsearch-coordinator-nodes-behind-a-load-balancer/386690 "2026-07-29T10:54:03Z")
Hello, I am trying to choose the right readiness check for Elasticsearch coordinator nodes behind a load balancer / proxy. We are on Elasticsearch 8.8.2. The coorinator nodes serve search traffic behind a load balancer… --- ## [Search highlights a non-matched field if query contains a nested query](https://discuss.elastic.co/t/search-highlights-a-non-matched-field-if-query-contains-a-nested-query/388844)
**Author:** [@Mehis](https://discuss.elastic.co/u/Mehis)\ **Replies:** 1\ **Last updated:** [July 28, 2026, 1:35pm UTC](https://discuss.elastic.co/t/search-highlights-a-non-matched-field-if-query-contains-a-nested-query/388844 "2026-07-28T13:35:54Z")
Hello, I am having trouble with the highlight-feature highlighting fields that should not be. This problem only occurs if the search contains a nested query. I have set require\_field\_match to true in my search and my ES… --- ## ["AlreadyClosedException" with "Too Many Open Files" - breaking indexing](https://discuss.elastic.co/t/alreadyclosedexception-with-too-many-open-files-breaking-indexing/388808)
**Author:** [@astrodi](https://discuss.elastic.co/u/astrodi)\ **Replies:** 6\ **Last updated:** [July 27, 2026, 5:17pm UTC](https://discuss.elastic.co/t/alreadyclosedexception-with-too-many-open-files-breaking-indexing/388808 "2026-07-27T17:17:09Z")
Hello there :waving\_hand: I'm experiencing allocation issues on cluster with 22 data nodes (K8S cluster, each node holds 29-41 shards). In total, there is 122M documents, 13TB of storage consumed and 456 pri. shards + … --- ## [Cant close alerts using the api](https://discuss.elastic.co/t/cant-close-alerts-using-the-api/388605)
**Author:** [@Shahar\_Argov](https://discuss.elastic.co/u/Shahar_Argov)\ **Replies:** 1\ **Last updated:** [July 26, 2026, 4:22am UTC](https://discuss.elastic.co/t/cant-close-alerts-using-the-api/388605 "2026-07-26T04:22:09Z")
hi there, we are using kibana security alerts and came by an error. we were trying to use the kibana api to close security alerts using workflow automation. about 10 seconds after the run is started, we get the follow… --- ## [Elastic for MSSP: What is the impact of a new space on kibana?](https://discuss.elastic.co/t/elastic-for-mssp-what-is-the-impact-of-a-new-space-on-kibana/388732)
**Author:** [@ArgoAdvisory](https://discuss.elastic.co/u/ArgoAdvisory)\ **Replies:** 4\ **Last updated:** [July 24, 2026, 4:39pm UTC](https://discuss.elastic.co/t/elastic-for-mssp-what-is-the-impact-of-a-new-space-on-kibana/388732 "2026-07-24T16:39:53Z")
Hello! Our main goal: As an MSSP, we want to create a multi-tenant subdivision for our customers. Each customer has an internal IT team who wants access to their Elastic Security Space. Useful information: Elastic … --- ## [Optimizing wildcard and regex query performance on large indices in Elasticsearch](https://discuss.elastic.co/t/optimizing-wildcard-and-regex-query-performance-on-large-indices-in-elasticsearch/388642)
**Author:** [@Maaz](https://discuss.elastic.co/u/Maaz)\ **Replies:** 4\ **Last updated:** [July 24, 2026, 7:56am UTC](https://discuss.elastic.co/t/optimizing-wildcard-and-regex-query-performance-on-large-indices-in-elasticsearch/388642 "2026-07-24T07:56:06Z")
Hi everyone, I am working on tuning a search query pipeline in Elasticsearch and running into a performance bottleneck when executing high-frequency wildcard and regular expression searches against a rapidly growing ind… --- ## [.geoip\_database index created in es7 prevents es9 upgrade](https://discuss.elastic.co/t/geoip-database-index-created-in-es7-prevents-es9-upgrade/388618)
**Author:** [@manick02](https://discuss.elastic.co/u/manick02)\ **Replies:** 14\ **Last updated:** [July 24, 2026, 6:22am UTC](https://discuss.elastic.co/t/geoip-database-index-created-in-es7-prevents-es9-upgrade/388618 "2026-07-24T06:22:49Z")
We follow an es upgrade approach where we reindex the index on every major version upgrade. We noticed during our es9 upgrade from es8, there is a system index .geoip\_database which was created in es7 is not allowing es… --- ## [Where is Elasticsearch storing unmapped field](https://discuss.elastic.co/t/where-is-elasticsearch-storing-unmapped-field/388701)
**Author:** [@ddoroshenko](https://discuss.elastic.co/u/ddoroshenko)\ **Replies:** 7\ **Last updated:** [July 24, 2026, 5:51am UTC](https://discuss.elastic.co/t/where-is-elasticsearch-storing-unmapped-field/388701 "2026-07-24T05:51:26Z")
I have an index created with index.mode=logsdb and index.mapping.source.mode=synthetic. The mapping also has dynamic: false. If I index a document containing an unmapped field, for example: { "@timestamp": "2026-07-2… --- ## [Elasticsearch S3 Snapshot Repository - Is s3:DeleteObject Mandatory for S3 Repository and SLM?](https://discuss.elastic.co/t/elasticsearch-s3-snapshot-repository-is-s3-deleteobject-mandatory-for-s3-repository-and-slm/388588)
**Author:** [@Shubham\_Khodpe](https://discuss.elastic.co/u/Shubham_Khodpe)\ **Replies:** 5\ **Last updated:** [July 22, 2026, 3:18pm UTC](https://discuss.elastic.co/t/elasticsearch-s3-snapshot-repository-is-s3-deleteobject-mandatory-for-s3-repository-and-slm/388588 "2026-07-22T15:18:44Z")
Hi Team, We are configuring Elasticsearch 9.1.3 snapshots to an AWS S3 bucket using the repository-s3 plugin and would like to clarify whether s3:DeleteObject permission is mandatory. Environment Elasticsearch Version… --- ## [Problems matching synonyms after stemming](https://discuss.elastic.co/t/problems-matching-synonyms-after-stemming/388548)
**Author:** [@hmpalmeida](https://discuss.elastic.co/u/hmpalmeida)\ **Replies:** 0\ **Last updated:** [July 21, 2026, 5:09pm UTC](https://discuss.elastic.co/t/problems-matching-synonyms-after-stemming/388548 "2026-07-21T17:09:09Z")
Hello! I'm currently having some problems trying to use a synonym\_graph filter after applying a stemmer. My problem can be replicated with the following "\_analyze" request: \`\`\` { "tokenizer": "whitespace", "filter"… --- ## [Urgent Help Needed Elastic Shutting down ingestion & All the write load is being transferred to one of the hot nodes](https://discuss.elastic.co/t/urgent-help-needed-elastic-shutting-down-ingestion-all-the-write-load-is-being-transferred-to-one-of-the-hot-nodes/388083)
**Author:** [@kkumar123](https://discuss.elastic.co/u/kkumar123)\ **Replies:** 30\ **Last updated:** [July 21, 2026, 2:48pm UTC](https://discuss.elastic.co/t/urgent-help-needed-elastic-shutting-down-ingestion-all-the-write-load-is-being-transferred-to-one-of-the-hot-nodes/388083 "2026-07-21T14:48:33Z")
I have issue with cluster all the time i can see is queue on one of the hot nodes at a time. node\_name name active queue rejected elastic-frozen2 write 0 0 0 elastic-hot… --- ## [Relationship missing between dashboard and visualization](https://discuss.elastic.co/t/relationship-missing-between-dashboard-and-visualization/388389)
**Author:** [@PeterDK](https://discuss.elastic.co/u/PeterDK)\ **Replies:** 1\ **Last updated:** [July 20, 2026, 5:39am UTC](https://discuss.elastic.co/t/relationship-missing-between-dashboard-and-visualization/388389 "2026-07-20T05:39:44Z")
Hello, I discovered something what seems to be a bug when creating a new dashboard from a visualization. Steps to reproduce: Start from a Saved Discovery Session and click on the "Edit Visualization" on the chart abo… --- ## [Changing global setting "Autocomplete value suggestion method" not working](https://discuss.elastic.co/t/changing-global-setting-autocomplete-value-suggestion-method-not-working/388394)
**Author:** [@PeterDK](https://discuss.elastic.co/u/PeterDK)\ **Replies:** 0\ **Last updated:** [July 17, 2026, 12:23pm UTC](https://discuss.elastic.co/t/changing-global-setting-autocomplete-value-suggestion-method-not-working/388394 "2026-07-17T12:23:13Z")
Hello, There is a global Kibana setting called "Autocomplete value suggestion method" (autocomplete:valueSuggestionMethod) which defaults to "terms\_enum and with the following remark: The method used for querying sugge… --- ## [Dropdown suggestions not showing up for Filters in Kibana Dashboard](https://discuss.elastic.co/t/dropdown-suggestions-not-showing-up-for-filters-in-kibana-dashboard/383811)
**Author:** [@Lakshay\_Choube](https://discuss.elastic.co/u/Lakshay_Choube)\ **Replies:** 6\ **Last updated:** [July 17, 2026, 9:41am UTC](https://discuss.elastic.co/t/dropdown-suggestions-not-showing-up-for-filters-in-kibana-dashboard/383811 "2026-07-17T09:41:49Z")
How can we have auto-suggestions and options to show in filters for say Program Names - with account\_id restriction on the documents the user can see. Basically my account has all granted fields access but when an accou… --- ## [Elastic stack \> Monitoring \> Indices Not Showing the indices](https://discuss.elastic.co/t/elastic-stack-monitoring-indices-not-showing-the-indices/387608)
**Author:** [@kkumar123](https://discuss.elastic.co/u/kkumar123)\ **Replies:** 3\ **Last updated:** [July 15, 2026, 8:39pm UTC](https://discuss.elastic.co/t/elastic-stack-monitoring-indices-not-showing-the-indices/387608 "2026-07-15T20:39:37Z")
Kibana Stack monitoring \> Indices not showing indices i have monitoring enabled via elastic agent and currently i see other monitoring stats but this one tab is not showing any indices stats Elastic Stack \> Kibana ela… --- ## [Kibana 9.4.3 high RAM consumption](https://discuss.elastic.co/t/kibana-9-4-3-high-ram-consumption/388326)
**Author:** [@SamehSaeed](https://discuss.elastic.co/u/SamehSaeed)\ **Replies:** 2\ **Last updated:** [July 15, 2026, 5:31pm UTC](https://discuss.elastic.co/t/kibana-9-4-3-high-ram-consumption/388326 "2026-07-15T17:31:44Z")
Hello, I have a problem that Kibana is taking too much RAM after upgrading to version 9.4.3 consumption in previous versions (from stack monitoring) 8.17.0 & 8.19.0 : consumption doubled after upgrade (9.4.3): A… --- ## [Security update ESA-2026-08](https://discuss.elastic.co/t/security-update-esa-2026-08/388361)
**Author:** [@Peter\_Misovic](https://discuss.elastic.co/u/Peter_Misovic)\ **Replies:** 1\ **Last updated:** [July 15, 2026, 12:36pm UTC](https://discuss.elastic.co/t/security-update-esa-2026-08/388361 "2026-07-15T12:36:46Z")
Hello, please, I currently have ELK v 9.2.2, Kibana 8.19.10, 9.1.10, 9.2.4 Security Update (ESA-2026-08) says "The issue is resolved in version 8.19.10, 9.1.10, 9.2.4.", please, what about 9.4.2 or 9.4.3? Shall I upgra… --- ## [Elasticsearch Migration from Windows to Linux – Swap Enabled and SELinux Enforcing](https://discuss.elastic.co/t/elasticsearch-migration-from-windows-to-linux-swap-enabled-and-selinux-enforcing/388113)
**Author:** [@Shubham\_Khodpe](https://discuss.elastic.co/u/Shubham_Khodpe)\ **Replies:** 5\ **Last updated:** [July 15, 2026, 9:58am UTC](https://discuss.elastic.co/t/elasticsearch-migration-from-windows-to-linux-swap-enabled-and-selinux-enforcing/388113 "2026-07-15T09:58:57Z")
Hi Team, We are migrating our Elasticsearch 9.1.3 cluster from Windows Server to RHEL Linux (9.8). The environment consists of 2 dedicated master nodes, 4 data nodes, nodes, and 2 Logstash nodes. As part of the Linux p… --- ## [Elastic agent / kibana http requests to 169.254.169.254 on startup](https://discuss.elastic.co/t/elastic-agent-kibana-http-requests-to-169-254-169-254-on-startup/388325)
**Author:** [@username456](https://discuss.elastic.co/u/username456)\ **Replies:** 3\ **Last updated:** [July 15, 2026, 7:41am UTC](https://discuss.elastic.co/t/elastic-agent-kibana-http-requests-to-169-254-169-254-on-startup/388325 "2026-07-15T07:41:44Z")
We've noticed that restarting the Elastic Agent or Kibana service results in outgoing requests to 169.254.169.254 on ports 80 and 443. Does anyone know why these requests are made and whether this behavior can be disabl… --- ## [How to break down (terms aggregation) in Kibana Lens by a sub-key of a flattened field (other than a runtime field)](https://discuss.elastic.co/t/how-to-break-down-terms-aggregation-in-kibana-lens-by-a-sub-key-of-a-flattened-field-other-than-a-runtime-field/388352)
**Author:** [@shojiiii](https://discuss.elastic.co/u/shojiiii)\ **Replies:** 0\ **Last updated:** [July 15, 2026, 4:43am UTC](https://discuss.elastic.co/t/how-to-break-down-terms-aggregation-in-kibana-lens-by-a-sub-key-of-a-flattened-field-other-than-a-runtime-field/388352 "2026-07-15T04:43:38Z")
Environment Elasticsearch / Kibana: 8.14.0 ~several million to ~10 million documents per index (daily indices) What I want to do In Kibana Lens, I want to break down (Top values / terms aggregation) by the value of a… --- ## [Elastic Agent Go update to v0.52.0](https://discuss.elastic.co/t/elastic-agent-go-update-to-v0-52-0/388334)
**Author:** [@rdmorris1914](https://discuss.elastic.co/u/rdmorris1914)\ **Replies:** 0\ **Last updated:** [July 14, 2026, 2:59pm UTC](https://discuss.elastic.co/t/elastic-agent-go-update-to-v0-52-0/388334 "2026-07-14T14:59:05Z")
There are several CVE's covered in the May 22 release of Go v0.52.0 which are not covered in the latest agent. When will Go be updated? The following CVEs are all present in the Linux Agent 9.4.3: CVE-2026-46595 CVE-20… --- ## [Elasticsearch data encryption](https://discuss.elastic.co/t/elasticsearch-data-encryption/388100)
**Author:** [@Kesavan](https://discuss.elastic.co/u/Kesavan)\ **Replies:** 10\ **Last updated:** [July 13, 2026, 10:17am UTC](https://discuss.elastic.co/t/elasticsearch-data-encryption/388100 "2026-07-13T10:17:42Z")
HI Everyone, Currently i am using elastic 7.17.5 along with spring boot. Index creation and data save and retrieval is happening via Java only. Below is my requirement, I need to have a data saved in the Elasticsearch… --- ## [Use master/data or cordinating node for search?](https://discuss.elastic.co/t/use-master-data-or-cordinating-node-for-search/388127)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 7\ **Last updated:** [July 11, 2026, 11:00pm UTC](https://discuss.elastic.co/t/use-master-data-or-cordinating-node-for-search/388127 "2026-07-11T23:00:52Z")
I have six data node, three master and two coordinating (which is also kibana) I am setting up proxy in front. for elk:5601 is easy as it is just kibana. for elk:9200 should I use coordinating nodes or master node or … --- ## [Basic license site is broken - register.elastic.co/registration](https://discuss.elastic.co/t/basic-license-site-is-broken-register-elastic-co-registration/387710)
**Author:** [@Adrian\_Beloqui](https://discuss.elastic.co/u/Adrian_Beloqui)\ **Replies:** 2\ **Last updated:** [July 11, 2026, 5:11am UTC](https://discuss.elastic.co/t/basic-license-site-is-broken-register-elastic-co-registration/387710 "2026-07-11T05:11:59Z")
I am trying to get a new Basic license for our hosted ELK stack with elastic version 6.2.4 but the website Register | Elastic seems to have an issue with the reCAPTHA and doesn't allow me to submit the form. Can you ple… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=4) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=6)