# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=53 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 54 --- ## [Elastic Extract](https://discuss.elastic.co/t/elastic-extract/380284)
**Author:** [@harryDHL](https://discuss.elastic.co/u/harryDHL)\ **Replies:** 3\ **Last updated:** [July 22, 2025, 5:43am UTC](https://discuss.elastic.co/t/elastic-extract/380284 "2025-07-22T05:43:35Z")
Hello all, I am trying to understand the ideal timeout setting to be configured for data exports from Elastic. Currently, the limit is set to 240 seconds, and is timing out when extracting 128,035 records from Elastic. … --- ## [Elasticsearch re-index not working correctly on Podman](https://discuss.elastic.co/t/elasticsearch-re-index-not-working-correctly-on-podman/380319)
**Author:** [@doomshallot](https://discuss.elastic.co/u/doomshallot)\ **Replies:** 0\ **Last updated:** [July 22, 2025, 2:19am UTC](https://discuss.elastic.co/t/elasticsearch-re-index-not-working-correctly-on-podman/380319 "2025-07-22T02:19:21Z")
We migrated from RHEL 7 Linux servers to RHEL 8 Linux servers, which also forced us from using Docker to Podman. Everything else (as far as we can tell) is the exact same. We use postgresql on a separate Linux server (a… --- ## [When Elasticseach auto configs security, is there any way to inject SANs of my own choosing into the http\_ca.crt?](https://discuss.elastic.co/t/when-elasticseach-auto-configs-security-is-there-any-way-to-inject-sans-of-my-own-choosing-into-the-http-ca-crt/380176)
**Author:** [@chad.carson](https://discuss.elastic.co/u/chad.carson)\ **Replies:** 4\ **Last updated:** [July 22, 2025, 12:25am UTC](https://discuss.elastic.co/t/when-elasticseach-auto-configs-security-is-there-any-way-to-inject-sans-of-my-own-choosing-into-the-http-ca-crt/380176 "2025-07-22T00:25:51Z")
Hello, I am running Elasticsearch in Kubernetes, and everything is up and running well, but if I make any connections from other applications internally across Kubernetes to the exposed service on 9200, it fails the "hos… --- ## [Adjusting Search Filters for Swiftype](https://discuss.elastic.co/t/adjusting-search-filters-for-swiftype/379864)
**Author:** [@Yevhen\_Marynych](https://discuss.elastic.co/u/Yevhen_Marynych)\ **Replies:** 2\ **Last updated:** [July 21, 2025, 3:47pm UTC](https://discuss.elastic.co/t/adjusting-search-filters-for-swiftype/379864 "2025-07-21T15:47:29Z")
Hi! We're using Swiftype to search through our websites and I have several questions. Is there a way to adjust Weights in order to show recent pages on the site? Right now when you search (for Swarm, as an example), th… --- ## [Error after migration Elastic "Fleet Server - Error - failed version compatibility check with elasticsearch: x509: certificate signed by unknown authority"](https://discuss.elastic.co/t/error-after-migration-elastic-fleet-server-error-failed-version-compatibility-check-with-elasticsearch-x509-certificate-signed-by-unknown-authority/380288)
**Author:** [@neofall](https://discuss.elastic.co/u/neofall)\ **Replies:** 2\ **Last updated:** [July 21, 2025, 11:01am UTC](https://discuss.elastic.co/t/error-after-migration-elastic-fleet-server-error-failed-version-compatibility-check-with-elasticsearch-x509-certificate-signed-by-unknown-authority/380288 "2025-07-21T11:01:56Z")
Previously, I encountered an issue related to x509: certificate signed by unknown authority, as discussed in this Elastic forum thread. Currently, I am performing a migration involving a change in the server IP addresses… --- ## [Elasticsearch JDK version VA closure](https://discuss.elastic.co/t/elasticsearch-jdk-version-va-closure/380090)
**Author:** [@amjad](https://discuss.elastic.co/u/amjad)\ **Replies:** 3\ **Last updated:** [July 21, 2025, 9:05am UTC](https://discuss.elastic.co/t/elasticsearch-jdk-version-va-closure/380090 "2025-07-21T09:05:01Z")
Hi elastic community. Hope everyone is doing well. we are using Elasticsearch 7.11.1 version in which we are having jdk Installed version: 15.0.1 now we have received a security VA and suggested to Upgrade to a version… --- ## [Validating Incoming Http requests](https://discuss.elastic.co/t/validating-incoming-http-requests/380287)
**Author:** [@amjad](https://discuss.elastic.co/u/amjad)\ **Replies:** 1\ **Last updated:** [July 21, 2025, 8:08am UTC](https://discuss.elastic.co/t/validating-incoming-http-requests/380287 "2025-07-21T08:08:57Z")
Hi Elastic community, Hope everyone is doing well, and thank you for your support so far. We’ve encountered a vulnerability related to incoming HTTP requests. We're currently using cURL APIs to create users in Elastics… --- ## [Elasticsearch Pagination: Scroll API](https://discuss.elastic.co/t/elasticsearch-pagination-scroll-api/379852)
**Author:** [@sundar.s](https://discuss.elastic.co/u/sundar.s)\ **Replies:** 4\ **Last updated:** [July 21, 2025, 6:44am UTC](https://discuss.elastic.co/t/elasticsearch-pagination-scroll-api/379852 "2025-07-21T06:44:31Z")
Hi, Noticed, that the following note has been added for Scroll Pagination. We no longer recommend using the scroll API for deep pagination. If you need to preserve the index state while paging through more than 10,000… --- ## [Inquiry Regarding CVE-2025-2135 Impact in License-Free Kibana Environments](https://discuss.elastic.co/t/inquiry-regarding-cve-2025-2135-impact-in-license-free-kibana-environments/380285)
**Author:** [@Wei\_Li](https://discuss.elastic.co/u/Wei_Li)\ **Replies:** 0\ **Last updated:** [July 21, 2025, 5:54am UTC](https://discuss.elastic.co/t/inquiry-regarding-cve-2025-2135-impact-in-license-free-kibana-environments/380285 "2025-07-21T05:54:19Z")
Hi, We are currently running an ELK stack with version 8.13.4. We do not have a license, so PDF and PNG reporting features are not available in our environment. However, we are using the CSV reporting functionality. I w… --- ## [Kibana creating graphs from data in discover](https://discuss.elastic.co/t/kibana-creating-graphs-from-data-in-discover/380217)
**Author:** [@DOkuwa](https://discuss.elastic.co/u/DOkuwa)\ **Replies:** 1\ **Last updated:** [July 21, 2025, 4:39am UTC](https://discuss.elastic.co/t/kibana-creating-graphs-from-data-in-discover/380217 "2025-07-21T04:39:25Z")
Hi, I want to create graphs from my discover in kibana from graph below using in-octets as a parameters --- ## [How to softly exclude ambiguous words?](https://discuss.elastic.co/t/how-to-softly-exclude-ambiguous-words/380249)
**Author:** [@S-Dragon0302](https://discuss.elastic.co/u/S-Dragon0302)\ **Replies:** 3\ **Last updated:** [July 20, 2025, 8:47am UTC](https://discuss.elastic.co/t/how-to-softly-exclude-ambiguous-words/380249 "2025-07-20T08:47:13Z")
Because "apple" is hit, not just "apple care".How to implement this query\_string? --- ## [Filebeat High CPU usage - IIS Logs (Multiple Virtual Host)](https://discuss.elastic.co/t/filebeat-high-cpu-usage-iis-logs-multiple-virtual-host/380113)
**Author:** [@porigromus](https://discuss.elastic.co/u/porigromus)\ **Replies:** 2\ **Last updated:** [July 19, 2025, 9:11pm UTC](https://discuss.elastic.co/t/filebeat-high-cpu-usage-iis-logs-multiple-virtual-host/380113 "2025-07-19T21:11:23Z")
I have been trying to tune filebeat on an IIS server where it's peaking at 50-65% of the CPU every few seconds. This is on a Windows Server 2016 Datacenter, filebeat is managed by sidecar, feature IIS, with 47 virtual ho… --- ## [Persistent keystore errors - guidance for new install please](https://discuss.elastic.co/t/persistent-keystore-errors-guidance-for-new-install-please/378620)
**Author:** [@GuyMark](https://discuss.elastic.co/u/GuyMark)\ **Replies:** 18\ **Last updated:** [July 19, 2025, 5:18pm UTC](https://discuss.elastic.co/t/persistent-keystore-errors-guidance-for-new-install-please/378620 "2025-07-19T17:18:12Z")
I am trying to install elasticsearch both to learn how to use it - and as I need to try to make a working system too. I first tried installing with notes from here over a year ago, but right from the start I had issues … --- ## [Connection between Elastic Agent (on local machine) and Elasticsearch (on GCP)](https://discuss.elastic.co/t/connection-between-elastic-agent-on-local-machine-and-elasticsearch-on-gcp/380187)
**Author:** [@Nghia\_Vu](https://discuss.elastic.co/u/Nghia_Vu)\ **Replies:** 7\ **Last updated:** [July 19, 2025, 2:25pm UTC](https://discuss.elastic.co/t/connection-between-elastic-agent-on-local-machine-and-elasticsearch-on-gcp/380187 "2025-07-19T14:25:59Z")
I am working on a study project to collect log from many machines. I have 2 VMs on GCP, one is for a Elasticsearch/Kibana server, one is for a fleet server. Both are in the same VPC. I have one Windows Server VM on my lo… --- ## [org.apache.spark.SparkClassNotFoundException: \[DATA\_SOURCE\_NOT\_FOUND\] Failed to find the data source: org.elasticsearch.spark.sql. Make sure the provider name is correct and the package is properly registered and compatible with your Spark version](https://discuss.elastic.co/t/org-apache-spark-sparkclassnotfoundexception-data-source-not-found-failed-to-find-the-data-source-org-elasticsearch-spark-sql-make-sure-the-provider-name-is-correct-and-the-package-is-properly-registered-and-compatible-with-your-spark-version/380271)
**Author:** [@vsam](https://discuss.elastic.co/u/vsam)\ **Replies:** 0\ **Last updated:** [July 19, 2025, 1:06am UTC](https://discuss.elastic.co/t/org-apache-spark-sparkclassnotfoundexception-data-source-not-found-failed-to-find-the-data-source-org-elasticsearch-spark-sql-make-sure-the-provider-name-is-correct-and-the-package-is-properly-registered-and-compatible-with-your-spark-version/380271 "2025-07-19T01:06:01Z")
Hi Everyone, Currently I want to write pyspark dataframe to Elasticcloud index Below is the code, however pyspark is unable to find the org.elasticsearch.spark.sql. Environment - Databricks Databricks Run time - 1… --- ## [2 agents on a host with dual boot?](https://discuss.elastic.co/t/2-agents-on-a-host-with-dual-boot/380149)
**Author:** [@vector\_vulture](https://discuss.elastic.co/u/vector_vulture)\ **Replies:** 3\ **Last updated:** [July 18, 2025, 9:55pm UTC](https://discuss.elastic.co/t/2-agents-on-a-host-with-dual-boot/380149 "2025-07-18T21:55:32Z")
I read that you cannot run 2 elastic agents on 1 system, but I am assuming this is referring to 2 agent's on a single running operating system.. What about the situation where a desktop PC has 2 drives, one Windows and … --- ## [Adding additional aggregation causes 15x performance degradation despite small result set](https://discuss.elastic.co/t/adding-additional-aggregation-causes-15x-performance-degradation-despite-small-result-set/380132)
**Author:** [@mmiliauskas](https://discuss.elastic.co/u/mmiliauskas)\ **Replies:** 3\ **Last updated:** [July 18, 2025, 2:30pm UTC](https://discuss.elastic.co/t/adding-additional-aggregation-causes-15x-performance-degradation-despite-small-result-set/380132 "2025-07-18T14:30:37Z")
I have an Elasticsearch query that returns only 107 documents but takes 1.5 seconds to execute. When I remove one specific aggregation (values\_brand), the same query completes in 100ms. The brand field only contains 8 un… --- ## [Scaling tips for ElasticAgent - Elasticsearch - Kibana setup](https://discuss.elastic.co/t/scaling-tips-for-elasticagent-elasticsearch-kibana-setup/380172)
**Author:** [@mike123](https://discuss.elastic.co/u/mike123)\ **Replies:** 13\ **Last updated:** [July 18, 2025, 1:35pm UTC](https://discuss.elastic.co/t/scaling-tips-for-elasticagent-elasticsearch-kibana-setup/380172 "2025-07-18T13:35:59Z")
I am having a trouble scaling Elasticsearch setup. The setup consist of over 2500 elastic agents forwarding logs to elasticsearch cluster. All elastic agents are managed by a single fleet server and is assigned to a sing… --- ## [Process decoded data in more readable format](https://discuss.elastic.co/t/process-decoded-data-in-more-readable-format/380213)
**Author:** [@dashelastic](https://discuss.elastic.co/u/dashelastic)\ **Replies:** 7\ **Last updated:** [July 18, 2025, 11:51am UTC](https://discuss.elastic.co/t/process-decoded-data-in-more-readable-format/380213 "2025-07-18T11:51:32Z")
the decoded data from data streaming is coming into logstash. "decoded": \[ "{\\"headers\\":{\\"eventType\\":\\"com.data.globalIdentity.verb\\",\\"operation\\":\\"UPDATE\\",\\"messageType\\":\\"IDENTITY\\",\\"eventTime\\":\\"2025-07-… --- ## [Query regarding "cluster.initial\_master\_nodes"](https://discuss.elastic.co/t/query-regarding-cluster-initial-master-nodes/379318)
**Author:** [@mike123](https://discuss.elastic.co/u/mike123)\ **Replies:** 9\ **Last updated:** [July 18, 2025, 11:27am UTC](https://discuss.elastic.co/t/query-regarding-cluster-initial-master-nodes/379318 "2025-07-18T11:27:17Z")
i am having a cluster in which i have configured master node IPs in "cluster.initial\_master\_nodes" (ex: cluster.initial\_master\_nodes:\["172.12.12.2:9300","172.12.12.3:9300","172.12.12.4:9300"\]) and it worked perfectly. no… --- ## [Api key authentication on ElasticSearch 7.10.02 OSS](https://discuss.elastic.co/t/api-key-authentication-on-elasticsearch-7-10-02-oss/380164)
**Author:** [@qasidmubashir](https://discuss.elastic.co/u/qasidmubashir)\ **Replies:** 2\ **Last updated:** [July 18, 2025, 9:36am UTC](https://discuss.elastic.co/t/api-key-authentication-on-elasticsearch-7-10-02-oss/380164 "2025-07-18T09:36:53Z")
We are using Elasticsearch 7.10.02 OSS hosted on OpenSearch service on AWS Currently we are connecting our .net project to Elk using BasicAuthentication (Username Password), we are trying to switch to using apikey Nee… --- ## [Filebeat does not collect all logs after close.on\_state\_change.inactive time have passed](https://discuss.elastic.co/t/filebeat-does-not-collect-all-logs-after-close-on-state-change-inactive-time-have-passed/380178)
**Author:** [@cubba](https://discuss.elastic.co/u/cubba)\ **Replies:** 1\ **Last updated:** [July 18, 2025, 9:21am UTC](https://discuss.elastic.co/t/filebeat-does-not-collect-all-logs-after-close-on-state-change-inactive-time-have-passed/380178 "2025-07-18T09:21:22Z")
Hello, Our filebeat (9.0.3) is configured on kubernetes cluster as daemonset to collect logs from applications and to send it to logstash and we have a following configuration: filebeat.config: modules: path: ${p… --- ## [Regarding pipeline.buffer.type](https://discuss.elastic.co/t/regarding-pipeline-buffer-type/379798)
**Author:** [@dawiro](https://discuss.elastic.co/u/dawiro)\ **Replies:** 7\ **Last updated:** [July 18, 2025, 8:49am UTC](https://discuss.elastic.co/t/regarding-pipeline-buffer-type/379798 "2025-07-18T08:49:12Z")
Hi, Recently we've been enabling heap based processing of the beats input as you can see here: pipeline.workers: 2 pipeline.batch.size: 100 pipeline.buffer.type: heap However, we still see errors for some sites which … --- ## [Error when installing Elastic Agent on the labs](https://discuss.elastic.co/t/error-when-installing-elastic-agent-on-the-labs/380095)
**Author:** [@Simriti\_Bundhoo](https://discuss.elastic.co/u/Simriti_Bundhoo)\ **Replies:** 2\ **Last updated:** [July 18, 2025, 7:01am UTC](https://discuss.elastic.co/t/error-when-installing-elastic-agent-on-the-labs/380095 "2025-07-18T07:01:07Z")
While installing Elastic Agent on the Course: Elastic Observability Engineer (On-Demand), Module 2.1, after following the steps properly on the terminal (), I accidentally Ctrl + C and stopped the installation. When I tr… --- ## [How to make username case insensitive? (The default Basic Authentication via Internal Native Realm)](https://discuss.elastic.co/t/how-to-make-username-case-insensitive-the-default-basic-authentication-via-internal-native-realm/380175)
**Author:** [@chouben](https://discuss.elastic.co/u/chouben)\ **Replies:** 2\ **Last updated:** [July 18, 2025, 5:49am UTC](https://discuss.elastic.co/t/how-to-make-username-case-insensitive-the-default-basic-authentication-via-internal-native-realm/380175 "2025-07-18T05:49:34Z")
Hi I would like to make my usernames case insensitive, but can't seem to find the config to achieve it. E.g. "Christof" is working, but "christof" is not (Difference: capital C) I found the documentation about authent… --- ## [Forward logs in CEF format to another host](https://discuss.elastic.co/t/forward-logs-in-cef-format-to-another-host/380226)
**Author:** [@juancamiloll](https://discuss.elastic.co/u/juancamiloll)\ **Replies:** 0\ **Last updated:** [July 17, 2025, 8:16pm UTC](https://discuss.elastic.co/t/forward-logs-in-cef-format-to-another-host/380226 "2025-07-17T20:16:06Z")
Hello, I am currently receiving the logs from fortinet through the integration “Fortinet FortiGate Firewall Logs” which works without problem. If I log into logstash and run a tcpdump I can see the logs being received. … --- ## [TSVB or Lens visualization for monthly maximum of daily sum of a field value](https://discuss.elastic.co/t/tsvb-or-lens-visualization-for-monthly-maximum-of-daily-sum-of-a-field-value/380221)
**Author:** [@smondal](https://discuss.elastic.co/u/smondal)\ **Replies:** 3\ **Last updated:** [July 17, 2025, 6:01pm UTC](https://discuss.elastic.co/t/tsvb-or-lens-visualization-for-monthly-maximum-of-daily-sum-of-a-field-value/380221 "2025-07-17T18:01:17Z")
I have an index called global\_gpu-\* with @timestamp and "gpu\_gflops" field among others. It simple enough to get the daily sum of "gpu\_glops" using "formula" option in lens as follows: sum(gpu\_gflops)/1000/1000 I get t… --- ## [Index sorting on boolean fields](https://discuss.elastic.co/t/index-sorting-on-boolean-fields/380181)
**Author:** [@spinscale](https://discuss.elastic.co/u/spinscale)\ **Replies:** 1\ **Last updated:** [July 16, 2025, 8:38pm UTC](https://discuss.elastic.co/t/index-sorting-on-boolean-fields/380181 "2025-07-16T20:38:56Z")
Hey, quick question about index sorting on boolean fields. Basically we have an is\_active field in our data, and most of customer facing our queries have an is\_active: true filter applied. Am I right to assume that ind… --- ## [Kibana: Kibana's memory limit won't change. Even to default](https://discuss.elastic.co/t/kibana-kibanas-memory-limit-wont-change-even-to-default/270197)
**Author:** [@ade.syseng](https://discuss.elastic.co/u/ade.syseng)\ **Replies:** 7\ **Last updated:** [July 17, 2025, 2:17pm UTC](https://discuss.elastic.co/t/kibana-kibanas-memory-limit-wont-change-even-to-default/270197 "2025-07-17T14:17:44Z")
Hi, I'm just upgraded Kibana to 7.12. And I noticed Kibana's memory limit configured at 4GB according to Stack Monitoring. So then I set the memory limit to 2GB, it was a success. Sometime later, due to web server l… --- ## [How to add labels in standalone Elastic Agent synthetics input configuration](https://discuss.elastic.co/t/how-to-add-labels-in-standalone-elastic-agent-synthetics-input-configuration/379663)
**Author:** [@sbisschop](https://discuss.elastic.co/u/sbisschop)\ **Replies:** 1\ **Last updated:** [July 17, 2025, 1:56pm UTC](https://discuss.elastic.co/t/how-to-add-labels-in-standalone-elastic-agent-synthetics-input-configuration/379663 "2025-07-17T13:56:23Z")
I want to add labels to a standalone elastic agent input configuration. This works with a regular system/metrics input, but doesn't seem to work for a synthetics/monitor configuration. Already read about some difference… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=52) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=54)