# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=52 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 53 --- ## [Custom log path for kibana service](https://discuss.elastic.co/t/custom-log-path-for-kibana-service/380397)
**Author:** [@venkat\_tammi](https://discuss.elastic.co/u/venkat_tammi)\ **Replies:** 3\ **Last updated:** [July 25, 2025, 3:45am UTC](https://discuss.elastic.co/t/custom-log-path-for-kibana-service/380397 "2025-07-25T03:45:30Z")
I do not see log path details in kibana.yml file, however, I added a value (logging.dest: /var/../log/kibana.log) and restarted the kibana service. Unfortunately, this kibana service didn't come up. I had to comment for … --- ## [Storing Very Large Text Field in Elasticsearch](https://discuss.elastic.co/t/storing-very-large-text-field-in-elasticsearch/380428)
**Author:** [@kdwolf](https://discuss.elastic.co/u/kdwolf)\ **Replies:** 3\ **Last updated:** [July 24, 2025, 9:50pm UTC](https://discuss.elastic.co/t/storing-very-large-text-field-in-elasticsearch/380428 "2025-07-24T21:50:31Z")
Hello all, I’d appreciate your input on the following, please: The business has a requirement to extract a lengthy string (text) from an external object — for example, a MOBI file — and store it in an Elasticsearch ind… --- ## [Customized Logstash configuration for the existing LS service but process still showing the default path /etc/logstash, also, getting Warning: no jvm.options file found and WARNING: Could not find logstash.yml which is typically located in $LS\_HOME/confi](https://discuss.elastic.co/t/customized-logstash-configuration-for-the-existing-ls-service-but-process-still-showing-the-default-path-etc-logstash-also-getting-warning-no-jvm-options-file-found-and-warning-could-not-find-logstash-yml-which-is-typically-located-in-ls-home-confi/380396)
**Author:** [@venkat\_tammi](https://discuss.elastic.co/u/venkat_tammi)\ **Replies:** 2\ **Last updated:** [July 24, 2025, 7:25pm UTC](https://discuss.elastic.co/t/customized-logstash-configuration-for-the-existing-ls-service-but-process-still-showing-the-default-path-etc-logstash-also-getting-warning-no-jvm-options-file-found-and-warning-could-not-find-logstash-yml-which-is-typically-located-in-ls-home-confi/380396 "2025-07-24T19:25:36Z")
Friends, I did modify logstash configuration and setting files to my desired path, then, I am able to run logstash service up and running. However, I can see default path /etc/logstash in the output of "ps -ef | grep log… --- ## [Expecting 'EOF', got 'OPEN\_ENDBLOCK' when attempting to to set up APM in Fleet](https://discuss.elastic.co/t/expecting-eof-got-open-endblock-when-attempting-to-to-set-up-apm-in-fleet/380422)
**Author:** [@garetharmstrong](https://discuss.elastic.co/u/garetharmstrong)\ **Replies:** 1\ **Last updated:** [July 24, 2025, 7:01pm UTC](https://discuss.elastic.co/t/expecting-eof-got-open-endblock-when-attempting-to-to-set-up-apm-in-fleet/380422 "2025-07-24T19:01:42Z")
I'm trying to set up an APM Integration to work with my Fleet servers, and when I set up the Agent Policy as per the instructions, when I save, I get this error Error while compiling agent template: Parse error on line … --- ## [Getting mapper\_parsing\_exception error and field name cannot be an empty string in logstash](https://discuss.elastic.co/t/getting-mapper-parsing-exception-error-and-field-name-cannot-be-an-empty-string-in-logstash/380380)
**Author:** [@upreddy253](https://discuss.elastic.co/u/upreddy253)\ **Replies:** 3\ **Last updated:** [July 24, 2025, 12:37pm UTC](https://discuss.elastic.co/t/getting-mapper-parsing-exception-error-and-field-name-cannot-be-an-empty-string-in-logstash/380380 "2025-07-24T12:37:29Z")
Hi, We are trying to onboard new logs into elasticsearch but logs are not indexing into elasticsearch.Logs are apperar in Logstash deadletter queue with "status"=\>400, "error"=\>{"type"=\>"mapper\_parsing\_exception", "reas… --- ## [ES security entitlements v8.18 onwards](https://discuss.elastic.co/t/es-security-entitlements-v8-18-onwards/380418)
**Author:** [@a2dahiya](https://discuss.elastic.co/u/a2dahiya)\ **Replies:** 0\ **Last updated:** [July 24, 2025, 9:09am UTC](https://discuss.elastic.co/t/es-security-entitlements-v8-18-onwards/380418 "2025-07-24T09:09:24Z")
I'm a developer for a observability tool and we are able to monitor upto es v8.17.1. There have been some new security entitlements added for version 8.18+ which are causing problems for our agent to attach to the jvm to… --- ## [Proper handling query with same words](https://discuss.elastic.co/t/proper-handling-query-with-same-words/378935)
**Author:** [@marc21](https://discuss.elastic.co/u/marc21)\ **Replies:** 3\ **Last updated:** [July 24, 2025, 8:25am UTC](https://discuss.elastic.co/t/proper-handling-query-with-same-words/378935 "2025-07-24T08:25:25Z")
Hello guys, what’s the best way to handle a use case where a query should return documents that contain at least N instances of the specified words? For example, suppose my database contains the following phrases: "to… --- ## [Filebeat reloader is not working](https://discuss.elastic.co/t/filebeat-reloader-is-not-working/380410)
**Author:** [@Rahul\_teja](https://discuss.elastic.co/u/Rahul_teja)\ **Replies:** 0\ **Last updated:** [July 24, 2025, 5:24am UTC](https://discuss.elastic.co/t/filebeat-reloader-is-not-working/380410 "2025-07-24T05:24:29Z")
I was trying to use filebeat reloader with config.inputs filebeat.config.inputs: enabled: true path: /etc/filebeat/conf.d/\*.yml reload.enabled: true reload.period: 10s and then mounted input file and tried for live… --- ## [Issue with connecting to local llm from 8.18.0 ESv](https://discuss.elastic.co/t/issue-with-connecting-to-local-llm-from-8-18-0-esv/380086)
**Author:** [@Abhi\_Abhishek](https://discuss.elastic.co/u/Abhi_Abhishek)\ **Replies:** 11\ **Last updated:** [July 24, 2025, 4:19am UTC](https://discuss.elastic.co/t/issue-with-connecting-to-local-llm-from-8-18-0-esv/380086 "2025-07-24T04:19:14Z")
Hello Team, We are facing issues with connecting to our local LLM from Elasticsearch cluster of 8.18.0 version. While we are able to connect the same model Llama 3.2 3B Instruct to the 8.15.1 Elasticsearch. Getting the… --- ## [S3 input plugin sincedb not wprk](https://discuss.elastic.co/t/s3-input-plugin-sincedb-not-wprk/380406)
**Author:** [@Lich](https://discuss.elastic.co/u/Lich)\ **Replies:** 1\ **Last updated:** [July 24, 2025, 3:20am UTC](https://discuss.elastic.co/t/s3-input-plugin-sincedb-not-wprk/380406 "2025-07-24T03:20:23Z")
My conf: /etc/logstash/conf.d/test.conf input { s3 { access\_key\_id =\> "" secret\_access\_key =\> "" endpoint =\> "" bucket =\> "" prefix =\> "" region =\> "" codec … --- ## [Use a static keystore in ansible for elsaticsarch deployment](https://discuss.elastic.co/t/use-a-static-keystore-in-ansible-for-elsaticsarch-deployment/380362)
**Author:** [@huanghaiqing1](https://discuss.elastic.co/u/huanghaiqing1)\ **Replies:** 1\ **Last updated:** [July 24, 2025, 3:16am UTC](https://discuss.elastic.co/t/use-a-static-keystore-in-ansible-for-elsaticsarch-deployment/380362 "2025-07-24T03:16:00Z")
Hello, here we want to deploy elasticsearch by ansible. We know there is a folder certs/\*, where stores key-pairs for nodes info transporation or access from kibana/logstash. My question is whether there is a way to prep… --- ## [Streaming logs with csv issue](https://discuss.elastic.co/t/streaming-logs-with-csv-issue/380360)
**Author:** [@Idan\_Klatza](https://discuss.elastic.co/u/Idan_Klatza)\ **Replies:** 3\ **Last updated:** [July 23, 2025, 9:27pm UTC](https://discuss.elastic.co/t/streaming-logs-with-csv-issue/380360 "2025-07-23T21:27:39Z")
Hi, I want to stream logs from Postgres to elk but it doesn't parse the log properly. Logstash.conf file: input { file { path =\> "/path/to/log.csv" start\_position =\> "beginning" sincedb\_path =\> "/dev/null" } }… --- ## [Elastic cant find simple text](https://discuss.elastic.co/t/elastic-cant-find-simple-text/380347)
**Author:** [@nutmix](https://discuss.elastic.co/u/nutmix)\ **Replies:** 3\ **Last updated:** [July 23, 2025, 9:09pm UTC](https://discuss.elastic.co/t/elastic-cant-find-simple-text/380347 "2025-07-23T21:09:18Z")
if I search for "KCC", it doesnt find it, even though I'm looking right at entries with KCC in them. If we search with no search term specified, we see all our log lines, e.g. this one: 2025-07-22T13:38:33,460Z INFO ht… --- ## [Communication to and from elasticagent](https://discuss.elastic.co/t/communication-to-and-from-elasticagent/380382)
**Author:** [@mike123](https://discuss.elastic.co/u/mike123)\ **Replies:** 2\ **Last updated:** [July 23, 2025, 4:49pm UTC](https://discuss.elastic.co/t/communication-to-and-from-elasticagent/380382 "2025-07-23T16:49:59Z")
does elastic agent pull policies changes from fleet or fleet pushes policies to elastic agent? At any point does fleet server initiates communication with elastic agent? If yes how does fleet server authenticate that it… --- ## [Elastic Agent Fortinet Module 12 Hours Delay Log](https://discuss.elastic.co/t/elastic-agent-fortinet-module-12-hours-delay-log/380377)
**Author:** [@adilraad2001](https://discuss.elastic.co/u/adilraad2001)\ **Replies:** 1\ **Last updated:** [July 23, 2025, 3:08pm UTC](https://discuss.elastic.co/t/elastic-agent-fortinet-module-12-hours-delay-log/380377 "2025-07-23T15:08:19Z")
Hello, I've installed the Fleet Server, Elastic Agent, and Fortinet module with TCP (im using fortianalyzer that send logs of all my fortigate) integration in the fleet server machine. But the log from FortiGate to elast… --- ## [Would int8\_hnsw slower than hnsw for vector search](https://discuss.elastic.co/t/would-int8-hnsw-slower-than-hnsw-for-vector-search/380290)
**Author:** [@wangbing993](https://discuss.elastic.co/u/wangbing993)\ **Replies:** 5\ **Last updated:** [July 23, 2025, 2:57pm UTC](https://discuss.elastic.co/t/would-int8-hnsw-slower-than-hnsw-for-vector-search/380290 "2025-07-23T14:57:53Z")
Data result by VectorDBBench: Elastic Search Version: 8.14.3 mappings config: {'\_source': {'excludes': \['vector'\]}, 'properties': {'id': {'type': 'integer', 'store': True}, 'vector': {'dims': 1024, 'type': 'dense\_ve… --- ## [Problem rendering large log field due to performance reasons](https://discuss.elastic.co/t/problem-rendering-large-log-field-due-to-performance-reasons/380386)
**Author:** [@LukasGomez](https://discuss.elastic.co/u/LukasGomez)\ **Replies:** 0\ **Last updated:** [July 23, 2025, 1:41pm UTC](https://discuss.elastic.co/t/problem-rendering-large-log-field-due-to-performance-reasons/380386 "2025-07-23T13:41:19Z")
Hi! We're watching in Kibana some logs related with an exception of our service that show this "warning" when we try to check the message field of the log: "Rendering paused for long line for performance reasons. This ca… --- ## [Kibana,back button implementation process](https://discuss.elastic.co/t/kibana-back-button-implementation-process/380370)
**Author:** [@Mayuri\_Jaiswal](https://discuss.elastic.co/u/Mayuri_Jaiswal)\ **Replies:** 2\ **Last updated:** [July 23, 2025, 9:53am UTC](https://discuss.elastic.co/t/kibana-back-button-implementation-process/380370 "2025-07-23T09:53:46Z")
Hello,I am very new to kibana I want to make a back button in kibana dashboard. As i make many tables fields are filterable so if multiple filters are open so instead of crossing the filter that button when we click it,… --- ## [Filebeat not Capturing Fortifate CGNAT logs](https://discuss.elastic.co/t/filebeat-not-capturing-fortifate-cgnat-logs/360737)
**Author:** [@abounhidja](https://discuss.elastic.co/u/abounhidja)\ **Replies:** 1\ **Last updated:** [June 4, 2024, 12:36am UTC](https://discuss.elastic.co/t/filebeat-not-capturing-fortifate-cgnat-logs/360737 "2024-06-04T00:36:35Z")
Hi all, I am having trouble integrating Fortigate firewall logs into Elastic using Filebeat. I have set everything up correctly, but Filebeat is unable to capture the logs. I am certain the Fortigate firewall is sending… --- ## [Adding a new field in logstash](https://discuss.elastic.co/t/adding-a-new-field-in-logstash/380333)
**Author:** [@DOkuwa](https://discuss.elastic.co/u/DOkuwa)\ **Replies:** 4\ **Last updated:** [July 23, 2025, 7:01am UTC](https://discuss.elastic.co/t/adding-a-new-field-in-logstash/380333 "2025-07-23T07:01:04Z")
Hi, I have this input file sending data to logstash and want to add a new field name as seen below I dont want to use filter { mutate { add\_field =\> { "new\_field\_name" =\> "new\_field\_value" } } } such as add\_fiel… --- ## [Prod instance: Comms failing from remote and on-site- Error invoking remote method 'send-http-request': Error: connect ETIMEDOUT](https://discuss.elastic.co/t/prod-instance-comms-failing-from-remote-and-on-site-error-invoking-remote-method-send-http-request-error-connect-etimedout/380239)
**Author:** [@harryDHL](https://discuss.elastic.co/u/harryDHL)\ **Replies:** 6\ **Last updated:** [July 23, 2025, 12:13am UTC](https://discuss.elastic.co/t/prod-instance-comms-failing-from-remote-and-on-site-error-invoking-remote-method-send-http-request-error-connect-etimedout/380239 "2025-07-23T00:13:27Z")
Hi all, I wanted to reach out to see if anyone could help me with the following error I am getting while attempting to establish connection to Elastic PROD DB server. Error invoking remote method 'send-http-request': E… --- ## [Generate UUID in input plugin](https://discuss.elastic.co/t/generate-uuid-in-input-plugin/380356)
**Author:** [@Francesco\_Esposito](https://discuss.elastic.co/u/Francesco_Esposito)\ **Replies:** 1\ **Last updated:** [July 22, 2025, 7:26pm UTC](https://discuss.elastic.co/t/generate-uuid-in-input-plugin/380356 "2025-07-22T19:26:48Z")
Hello everyone, I am trying to execute a query thru jdbc input plugin and I need to generate a unique ID to pass in my stored procedure to identify my "flight", my single execution. Is it possible? --- ## [Seperate index for windows](https://discuss.elastic.co/t/seperate-index-for-windows/380351)
**Author:** [@GiorgioS13](https://discuss.elastic.co/u/GiorgioS13)\ **Replies:** 1\ **Last updated:** [July 22, 2025, 3:58pm UTC](https://discuss.elastic.co/t/seperate-index-for-windows/380351 "2025-07-22T15:58:57Z")
Hello, I installed the Elastic Agent on a Windows machine using the integration packages. Currently, logs are being sent to the default apm--transaction,auditbeat-,endgame-,filebeat-,logs-,packetbeat-,traces-apm,winlog… --- ## [Duplicate Data Views, Recreate Discover Session](https://discuss.elastic.co/t/duplicate-data-views-recreate-discover-session/380313)
**Author:** [@erikg](https://discuss.elastic.co/u/erikg)\ **Replies:** 3\ **Last updated:** [July 22, 2025, 3:28pm UTC](https://discuss.elastic.co/t/duplicate-data-views-recreate-discover-session/380313 "2025-07-22T15:28:11Z")
Hello, I am working on shrinking spaces into one space in Elastic. I been able to move dashboards from different spaces into one space, the issue is that I have now duplicate data views. For example: So the simple … --- ## [High network usage by master node](https://discuss.elastic.co/t/high-network-usage-by-master-node/380102)
**Author:** [@rara01](https://discuss.elastic.co/u/rara01)\ **Replies:** 9\ **Last updated:** [July 22, 2025, 1:40pm UTC](https://discuss.elastic.co/t/high-network-usage-by-master-node/380102 "2025-07-22T13:40:19Z")
Hello, We have self-hosted Elasticsearch, used primarily for logs. Cluster is made of 3 nodes + one is only fleet-server. We have encountered very high network usage, now download is over 1 GiB/s, upload nearing tha… --- ## [Filebeat 7.17.26: copytrunace filestream missings logs during rotation](https://discuss.elastic.co/t/filebeat-7-17-26-copytrunace-filestream-missings-logs-during-rotation/379865)
**Author:** [@carlosmg1](https://discuss.elastic.co/u/carlosmg1)\ **Replies:** 1\ **Last updated:** [July 22, 2025, 12:51pm UTC](https://discuss.elastic.co/t/filebeat-7-17-26-copytrunace-filestream-missings-logs-during-rotation/379865 "2025-07-22T12:51:35Z")
Hi, we've been testing copytruncate strategy to implement in our servers, but we found out missing logs during the rotation that are in the rotated files but not processed by logstash/not seeing in ES. here is the exam… --- ## [Message field in logstash pipeline](https://discuss.elastic.co/t/message-field-in-logstash-pipeline/380304)
**Author:** [@TheJ](https://discuss.elastic.co/u/TheJ)\ **Replies:** 3\ **Last updated:** [July 22, 2025, 12:09pm UTC](https://discuss.elastic.co/t/message-field-in-logstash-pipeline/380304 "2025-07-22T12:09:35Z")
Hi, is this possible in logstash to change message match field to other name ? I mean I have input and filter section in logstash pipeline as follow: input { udp { host =\> "0.0.0.0" port =\> 895 } } filte… --- ## [Air Gapped EPR Size](https://discuss.elastic.co/t/air-gapped-epr-size/380294)
**Author:** [@Stuart\_M](https://discuss.elastic.co/u/Stuart_M)\ **Replies:** 1\ **Last updated:** [July 22, 2025, 11:12am UTC](https://discuss.elastic.co/t/air-gapped-epr-size/380294 "2025-07-22T11:12:39Z")
I'm deploying Elastic into an air gapped environment where we host the Elastic Package Registry (EPR) locally. We currently pull down the latest one on a monthly basis, but it is starting to get pretty large (25GB+). Loo… --- ## [Viewing progress( sample :1 out of 7, 2 out of 7)of a test execution using the logs pushed via logstash to Kibana](https://discuss.elastic.co/t/viewing-progress-sample-1-out-of-7-2-out-of-7-of-a-test-execution-using-the-logs-pushed-via-logstash-to-kibana/380273)
**Author:** [@MahaQA](https://discuss.elastic.co/u/MahaQA)\ **Replies:** 4\ **Last updated:** [July 22, 2025, 8:54am UTC](https://discuss.elastic.co/t/viewing-progress-sample-1-out-of-7-2-out-of-7-of-a-test-execution-using-the-logs-pushed-via-logstash-to-kibana/380273 "2025-07-22T08:54:07Z")
I have a requirement to view the status of my automation suite(eg in real time, I want to view 2 of 7 completed, 3 of 7 completed etc), and alerts if any failed test case failed. following logs I am pushing to Kibana. … --- ## [Trouble Installing Fleet with Self-managed Certificates](https://discuss.elastic.co/t/trouble-installing-fleet-with-self-managed-certificates/380091)
**Author:** [@mohammad\_syaugi](https://discuss.elastic.co/u/mohammad_syaugi)\ **Replies:** 2\ **Last updated:** [July 22, 2025, 7:21am UTC](https://discuss.elastic.co/t/trouble-installing-fleet-with-self-managed-certificates/380091 "2025-07-22T07:21:46Z")
Hello guys, I've been installing fleet with self-managed SSL Certificates following this docs: Configure SSL/TLS for self-managed Fleet Servers | Fleet and Elastic Agent Guide \[8.14\] | Elastic But i find my fleet alway… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=51) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=53)