# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=51 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 52 --- ## [Rename field after transform with processor / pipeline does not work](https://discuss.elastic.co/t/rename-field-after-transform-with-processor-pipeline-does-not-work/380502)
**Author:** [@StevenGR](https://discuss.elastic.co/u/StevenGR)\ **Replies:** 3\ **Last updated:** [July 29, 2025, 2:06pm UTC](https://discuss.elastic.co/t/rename-field-after-transform-with-processor-pipeline-does-not-work/380502 "2025-07-29T14:06:48Z")
Hello everybody I have a transform job that writes the following fields from one index into a new index like so: Group By: ap.mac\_address\_normalized Aggregated fields: ap.hostname -\> raw1.ap.hostname ap.mac\_address… --- ## [Elastic Detection Rule Creation](https://discuss.elastic.co/t/elastic-detection-rule-creation/379471)
**Author:** [@Elk\_huh](https://discuss.elastic.co/u/Elk_huh)\ **Replies:** 1\ **Last updated:** [July 29, 2025, 1:58pm UTC](https://discuss.elastic.co/t/elastic-detection-rule-creation/379471 "2025-07-29T13:58:48Z")
How do i pull variables from .source or the following required Fields defined in the SIEM alert so i can use it in EMAIL action body --- ## [Elastic Stack Monitoring in a container-only environment](https://discuss.elastic.co/t/elastic-stack-monitoring-in-a-container-only-environment/380537)
**Author:** [@gruens](https://discuss.elastic.co/u/gruens)\ **Replies:** 0\ **Last updated:** [July 29, 2025, 11:55am UTC](https://discuss.elastic.co/t/elastic-stack-monitoring-in-a-container-only-environment/380537 "2025-07-29T11:55:00Z")
Hello, we're currently running an Elasticsearch cluster consisting of 5 nodes, all operating on RHEL 9. Our installation of Elasticsearch is containerized using Podman. So far is everything fine. We now want to care ab… --- ## [Elasticsearch G1 GC: “To-space Exhausted” and Eden Not Cleared Leading to Potential OOM](https://discuss.elastic.co/t/elasticsearch-g1-gc-to-space-exhausted-and-eden-not-cleared-leading-to-potential-oom/380432)
**Author:** [@VietBui](https://discuss.elastic.co/u/VietBui)\ **Replies:** 10\ **Last updated:** [July 29, 2025, 11:25am UTC](https://discuss.elastic.co/t/elasticsearch-g1-gc-to-space-exhausted-and-eden-not-cleared-leading-to-potential-oom/380432 "2025-07-29T11:25:30Z")
Hi Elasticsearch Community, I’m running Elasticsearch in a Docker container (version 6.8.22), 3 nodes, each node with a 14GB heap using the G1 garbage collector. My GC logs show issues with “To-space exhausted” and Eden… --- ## [Elastic Agent Manager generates large core dump files that fill up disk space — how to resolve this?](https://discuss.elastic.co/t/elastic-agent-manager-generates-large-core-dump-files-that-fill-up-disk-space-how-to-resolve-this/380527)
**Author:** [@Aya1](https://discuss.elastic.co/u/Aya1)\ **Replies:** 0\ **Last updated:** [July 29, 2025, 9:41am UTC](https://discuss.elastic.co/t/elastic-agent-manager-generates-large-core-dump-files-that-fill-up-disk-space-how-to-resolve-this/380527 "2025-07-29T09:41:45Z")
Hello, We are using Elastic Agent Manager for centralized agent management. We have noticed that large core dump files are frequently generated on some machines, eventually filling up the disk and causing service disrup… --- ## [Performance Impact of Index Sorting by Routing Key with Custom Sharding](https://discuss.elastic.co/t/performance-impact-of-index-sorting-by-routing-key-with-custom-sharding/380524)
**Author:** [@Dimitris\_Makris](https://discuss.elastic.co/u/Dimitris_Makris)\ **Replies:** 0\ **Last updated:** [July 29, 2025, 8:57am UTC](https://discuss.elastic.co/t/performance-impact-of-index-sorting-by-routing-key-with-custom-sharding/380524 "2025-07-29T08:57:43Z")
We have an Elasticsearch index where each document represents an employee, and each employee has an account\_id field identifying the account they belong to. Our index uses 18 shards, and we’ve implemented custom routing … --- ## [Long searching time and Yellow Status in Elastic Search](https://discuss.elastic.co/t/long-searching-time-and-yellow-status-in-elastic-search/380521)
**Author:** [@Test123000](https://discuss.elastic.co/u/Test123000)\ **Replies:** 1\ **Last updated:** [July 29, 2025, 8:31am UTC](https://discuss.elastic.co/t/long-searching-time-and-yellow-status-in-elastic-search/380521 "2025-07-29T08:31:45Z")
Hi team, I was using Elastic Search version 7.14.1. Recently it is found that the searching time increased and when I looked into the health of the Elasticsearch, the status is yellow. If there is any ways to resume t… --- ## [How to filter dashboard by field maximum value](https://discuss.elastic.co/t/how-to-filter-dashboard-by-field-maximum-value/380129)
**Author:** [@PMF](https://discuss.elastic.co/u/PMF)\ **Replies:** 13\ **Last updated:** [July 29, 2025, 7:00am UTC](https://discuss.elastic.co/t/how-to-filter-dashboard-by-field-maximum-value/380129 "2025-07-29T07:00:41Z")
Hi all. This seems easy enough, but I'm being unable to achieve it, and don't find an answer on internet. In our use case, we've built a dashboard with several lens graphs. Users reach that dashboard through a shared l… --- ## ["file being used by another process" error during server backup](https://discuss.elastic.co/t/file-being-used-by-another-process-error-during-server-backup/380508)
**Author:** [@StephenTissot](https://discuss.elastic.co/u/StephenTissot)\ **Replies:** 1\ **Last updated:** [July 28, 2025, 2:57pm UTC](https://discuss.elastic.co/t/file-being-used-by-another-process-error-during-server-backup/380508 "2025-07-28T14:57:34Z")
Hello. In one of our elasticsearch 8.14 database instance, we have an issue when the automatic backup is running: \[WARN \]\[o.e.i.e.Engine \] \[WIN-MYSERVER\] \[00000001\_ts\_202506\]\[0\] failed engine \[lucene commit f… --- ## [Elastic Stable Release](https://discuss.elastic.co/t/elastic-stable-release/380515)
**Author:** [@Muhammadh\_Zakir\_Huss](https://discuss.elastic.co/u/Muhammadh_Zakir_Huss)\ **Replies:** 1\ **Last updated:** [July 29, 2025, 4:20am UTC](https://discuss.elastic.co/t/elastic-stable-release/380515 "2025-07-29T04:20:30Z")
What is the latest stable release of Elastic Stack? for self-managed deployment --- ## [Last month time filter](https://discuss.elastic.co/t/last-month-time-filter/380512)
**Author:** [@Amphagory](https://discuss.elastic.co/u/Amphagory)\ **Replies:** 1\ **Last updated:** [July 29, 2025, 3:36am UTC](https://discuss.elastic.co/t/last-month-time-filter/380512 "2025-07-29T03:36:15Z")
Hello, I was hoping someone could help me on how to create a time filter that would contain all the data for the preivous month. For example, if it was the 1st of January, I would want this time filter to return all th… --- ## [Filebeat 9.0.4 failing to connect to elasticsearch on local machine](https://discuss.elastic.co/t/filebeat-9-0-4-failing-to-connect-to-elasticsearch-on-local-machine/380514)
**Author:** [@sematic](https://discuss.elastic.co/u/sematic)\ **Replies:** 0\ **Last updated:** [July 29, 2025, 1:21am UTC](https://discuss.elastic.co/t/filebeat-9-0-4-failing-to-connect-to-elasticsearch-on-local-machine/380514 "2025-07-29T01:21:37Z")
Hi There, I followed below documentation for setting up filebeat- 9.0.4 on local machine (Ubuntu 24.04.2 LTS) Filebeat quick start: installation and configuration | Beats (self-managed tab) I used below command to gen… --- ## [Filebeat only partly updates documents](https://discuss.elastic.co/t/filebeat-only-partly-updates-documents/380510)
**Author:** [@Rick\_V](https://discuss.elastic.co/u/Rick_V)\ **Replies:** 2\ **Last updated:** [July 28, 2025, 5:53pm UTC](https://discuss.elastic.co/t/filebeat-only-partly-updates-documents/380510 "2025-07-28T17:53:16Z")
Hi all, Using Elastic I want to create a single source of thruth. In an index I would want to store a single record of an entity and update that record when its status changes. The status of a entity gets shared via a … --- ## [What is the optimal shard size?](https://discuss.elastic.co/t/what-is-the-optimal-shard-size/380498)
**Author:** [@Ella\_conan](https://discuss.elastic.co/u/Ella_conan)\ **Replies:** 7\ **Last updated:** [July 28, 2025, 5:46pm UTC](https://discuss.elastic.co/t/what-is-the-optimal-shard-size/380498 "2025-07-28T17:46:46Z")
Hello, I have an index that contains 1 terabyte of events. The index currently has 1 shard and 1 replica. I want to change the index settings and increase both the number of shards and replicas, but I don't know the op… --- ## [ES|QL Query Controls](https://discuss.elastic.co/t/es-ql-query-controls/380444)
**Author:** [@erikg](https://discuss.elastic.co/u/erikg)\ **Replies:** 2\ **Last updated:** [July 28, 2025, 4:24pm UTC](https://discuss.elastic.co/t/es-ql-query-controls/380444 "2025-07-28T16:24:49Z")
Hello, Currently you can build a control through a ES|QL visualization The above is showing when you do the dynamic, building the control based off es|ql query. Is there plans to be able to create a control just ba… --- ## [Aggregating 2 log fields](https://discuss.elastic.co/t/aggregating-2-log-fields/380506)
**Author:** [@basavesh](https://discuss.elastic.co/u/basavesh)\ **Replies:** 0\ **Last updated:** [July 28, 2025, 2:24pm UTC](https://discuss.elastic.co/t/aggregating-2-log-fields/380506 "2025-07-28T14:24:42Z")
I have a log file which contains header (printed once per file) & body (multiple log blocks) as shown below. Server name = abcdefgh123 Time = 07/09/24 12:23:22 AM Country = IN Total = 50 Status = Green Country = UK … --- ## [Elasticsearch 8.18.4 has uncontrolled recursion CVE](https://discuss.elastic.co/t/elasticsearch-8-18-4-has-uncontrolled-recursion-cve/380477)
**Author:** [@Doc\_Kaos](https://discuss.elastic.co/u/Doc_Kaos)\ **Replies:** 1\ **Last updated:** [July 28, 2025, 2:07pm UTC](https://discuss.elastic.co/t/elasticsearch-8-18-4-has-uncontrolled-recursion-cve/380477 "2025-07-28T14:07:28Z")
Hey team, we're looking at ES 8.18.4 and getting an issues with an uncontrolled recursion vulnerability from Snyk. Can anyone tell me if this is already in the works, or a ticket I can link to for my team? Testing docke… --- ## [Calculate sum of piecewise linear aggregations on y axis](https://discuss.elastic.co/t/calculate-sum-of-piecewise-linear-aggregations-on-y-axis/380105)
**Author:** [@MagnesiumReroll](https://discuss.elastic.co/u/MagnesiumReroll)\ **Replies:** 2\ **Last updated:** [July 28, 2025, 2:04pm UTC](https://discuss.elastic.co/t/calculate-sum-of-piecewise-linear-aggregations-on-y-axis/380105 "2025-07-28T14:04:53Z")
Is there a way to represent/calculate the following for y axis : count\_1 = count(rows where condition=1) count\_2 = count(rows where condition=2) ... sum\_1 = 100 if count\_1\<100 else count\_1 sum\_2 = 100 if count\_2\<100… --- ## [Color coding bar metric](https://discuss.elastic.co/t/color-coding-bar-metric/380489)
**Author:** [@Simon\_Thies](https://discuss.elastic.co/u/Simon_Thies)\ **Replies:** 4\ **Last updated:** [July 28, 2025, 1:52pm UTC](https://discuss.elastic.co/t/color-coding-bar-metric/380489 "2025-07-28T13:52:23Z")
Hey there. I am currently setting up a dashboard with some bar diagrams. It is possible to set different colors for entries. But is it also possible to have a wildcard in the selection? For example, having anything… --- ## [Pie Chart not showing Bytes](https://discuss.elastic.co/t/pie-chart-not-showing-bytes/380114)
**Author:** [@erikg](https://discuss.elastic.co/u/erikg)\ **Replies:** 6\ **Last updated:** [July 28, 2025, 1:41pm UTC](https://discuss.elastic.co/t/pie-chart-not-showing-bytes/380114 "2025-07-28T13:41:22Z")
Hello, Is this a bug? I have a field with the values as bytes: But I want to display the data on the pie chart as bytes but I only get two options: --- ## [Esrally setup for a day with custom logs & ingest-pipeline for benchmarking the cluster](https://discuss.elastic.co/t/esrally-setup-for-a-day-with-custom-logs-ingest-pipeline-for-benchmarking-the-cluster/380460)
**Author:** [@Abhi\_Abhishek](https://discuss.elastic.co/u/Abhi_Abhishek)\ **Replies:** 3\ **Last updated:** [July 28, 2025, 8:37am UTC](https://discuss.elastic.co/t/esrally-setup-for-a-day-with-custom-logs-ingest-pipeline-for-benchmarking-the-cluster/380460 "2025-07-28T08:37:24Z")
Hi All, I am new to ESRALLY setup, as of now I am able to create track & run the race for custom logs & ingest-pipeline, but i need to run the rally for a day on the cluster that is getting an almost 1.6billion records … --- ## [System requirement for ELK Stack](https://discuss.elastic.co/t/system-requirement-for-elk-stack/380484)
**Author:** [@Anugrah\_Igo\_Aldi\_Wib](https://discuss.elastic.co/u/Anugrah_Igo_Aldi_Wib)\ **Replies:** 2\ **Last updated:** [July 28, 2025, 7:26am UTC](https://discuss.elastic.co/t/system-requirement-for-elk-stack/380484 "2025-07-28T07:26:06Z")
Hi everyone i'm new in this whole elaticstack world, i just need to know something about hardware and software requirement for elk (elasticsearch, logstash, kibana, and beats) installation using on-premise environment. C… --- ## [Csv reports timing out despite size of the report being too small](https://discuss.elastic.co/t/csv-reports-timing-out-despite-size-of-the-report-being-too-small/380384)
**Author:** [@Ananth\_Balasubramani](https://discuss.elastic.co/u/Ananth_Balasubramani)\ **Replies:** 2\ **Last updated:** [July 26, 2025, 1:09am UTC](https://discuss.elastic.co/t/csv-reports-timing-out-despite-size-of-the-report-being-too-small/380384 "2025-07-26T01:09:39Z")
Reporting job status doesn't seem to get updated with status as completed and times out with maximum of 3 attempts despite Kibana generating logs: finished generating, total size in bytes: , CSV: Worker completed: \ **Author:** [@spinscale](https://discuss.elastic.co/u/spinscale)\ **Replies:** 1\ **Last updated:** [July 25, 2025, 7:39pm UTC](https://discuss.elastic.co/t/terms-set-query-does-not-work-as-expected-within-nested-context/380430 "2025-07-25T19:39:29Z") Hey, I am testing a use-case for a terms\_set query, because I need minimum\_should\_match in this context. I noticed that it does not work as expected in combination within a nested scope, and just want to verify. Take th… --- ## [Best Way to Link Error Logs with Recommendations in Kibana?](https://discuss.elastic.co/t/best-way-to-link-error-logs-with-recommendations-in-kibana/380472)
**Author:** [@Amit\_Yaari](https://discuss.elastic.co/u/Amit_Yaari)\ **Replies:** 2\ **Last updated:** [July 25, 2025, 6:40pm UTC](https://discuss.elastic.co/t/best-way-to-link-error-logs-with-recommendations-in-kibana/380472 "2025-07-25T18:40:28Z")
Hi all, We’re planning a setup in Kibana where we want to link logs with relevant recommendations. Goal: When an error log is generated (e.g., "connection refused", "disk full", etc.), we want to show a matching recomm… --- ## [Question about Optimized Scalar Quantization](https://discuss.elastic.co/t/question-about-optimized-scalar-quantization/379969)
**Author:** [@yli](https://discuss.elastic.co/u/yli)\ **Replies:** 22\ **Last updated:** [July 25, 2025, 1:45pm UTC](https://discuss.elastic.co/t/question-about-optimized-scalar-quantization/379969 "2025-07-25T13:45:58Z")
Hi, Good day, We are planning to use Elasticsearch for vector search in our application, and we have a need to check the feasibility to remove the storage of original floating point vectors from Lucene which Elasticsear… --- ## [Why is the "Alert Delay of 5 Consecutive Matches" Not Being Met?](https://discuss.elastic.co/t/why-is-the-alert-delay-of-5-consecutive-matches-not-being-met/380439)
**Author:** [@Diego\_Ramirez](https://discuss.elastic.co/u/Diego_Ramirez)\ **Replies:** 1\ **Last updated:** [July 25, 2025, 12:59pm UTC](https://discuss.elastic.co/t/why-is-the-alert-delay-of-5-consecutive-matches-not-being-met/380439 "2025-07-25T12:59:50Z")
Here's the English paragraph with "CUSTOM\_ENTIDAD.keyword : "Redipro" and" removed from the query filter: Thread Title: Why is the "Alert Delay of 5 Consecutive Matches" Not Being Met for My Kibana Threshold Rule? Hel… --- ## [BadRequestError: BadRequestError(400, 'media\_type\_header\_exception', 'Invalid media-type value on headers \[Accept, Content-Type\]')](https://discuss.elastic.co/t/badrequesterror-badrequesterror-400-media-type-header-exception-invalid-media-type-value-on-headers-accept-content-type/378116)
**Author:** [@drake\_boob](https://discuss.elastic.co/u/drake_boob)\ **Replies:** 1\ **Last updated:** [July 25, 2025, 10:05am UTC](https://discuss.elastic.co/t/badrequesterror-badrequesterror-400-media-type-header-exception-invalid-media-type-value-on-headers-accept-content-type/378116 "2025-07-25T10:05:51Z")
In data bricks , I have been elastic 9.0 for year now , but recently i got this error \[BadRequestError: BadRequestError(400, 'media\_type\_header\_exception', 'Invalid media-type value on headers \[Accept, Content-Type\]') \] … --- ## [Should Elasticsearch Query DSL Be Constructed on the Frontend?](https://discuss.elastic.co/t/should-elasticsearch-query-dsl-be-constructed-on-the-frontend/380375)
**Author:** [@Hesam\_Se](https://discuss.elastic.co/u/Hesam_Se)\ **Replies:** 2\ **Last updated:** [July 25, 2025, 9:53am UTC](https://discuss.elastic.co/t/should-elasticsearch-query-dsl-be-constructed-on-the-frontend/380375 "2025-07-25T09:53:38Z")
Hi everyone, I'm developing a frontend UI for an application that uses Elasticsearch as its search engine. We're currently designing the API contracts with our backend team, and one of the key topics we're debating is w… --- ## [Kibana warning enabling TLS and using HTTP/2 while using NGINX](https://discuss.elastic.co/t/kibana-warning-enabling-tls-and-using-http-2-while-using-nginx/379432)
**Author:** [@cisupport-zkb](https://discuss.elastic.co/u/cisupport-zkb)\ **Replies:** 7\ **Last updated:** [July 25, 2025, 7:44am UTC](https://discuss.elastic.co/t/kibana-warning-enabling-tls-and-using-http-2-while-using-nginx/379432 "2025-07-25T07:44:45Z")
Hi everyone, I'm using NGINX in my ELK Stack 9.0.1 self-managed instance and the Kibana (version 9.0.1) warns me about considering of enably TLS and using HTTP/2: Following the "Learn more" link, I should insert ins… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=50) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=52)