# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=54 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 55 --- ## [Need help with master nodes issue and UUID's](https://discuss.elastic.co/t/need-help-with-master-nodes-issue-and-uuids/380042)
**Author:** [@Alex\_Palacios](https://discuss.elastic.co/u/Alex_Palacios)\ **Replies:** 3\ **Last updated:** [July 17, 2025, 12:32pm UTC](https://discuss.elastic.co/t/need-help-with-master-nodes-issue-and-uuids/380042 "2025-07-17T12:32:43Z")
hi, We have a cluster with two master nodes and two data nodes, we had an issue where master pods show "master not discovered exception", so we deleted the PVC of master-1 and the master-1 pod, and re-created it, now ma… --- ## [Problem with 1 cluster](https://discuss.elastic.co/t/problem-with-1-cluster/380211)
**Author:** [@Usman\_Moavia](https://discuss.elastic.co/u/Usman_Moavia)\ **Replies:** 1\ **Last updated:** [July 17, 2025, 10:50am UTC](https://discuss.elastic.co/t/problem-with-1-cluster/380211 "2025-07-17T10:50:51Z")
When i try to search logs in "Discover" window i am seeing a warning against cluster, i think data might be not visible fully. when i open the warning it says 4 shards failed, failure type is " no\_shard\_available\_action… --- ## [Grok and parsing of logstash data](https://discuss.elastic.co/t/grok-and-parsing-of-logstash-data/379408)
**Author:** [@DOkuwa](https://discuss.elastic.co/u/DOkuwa)\ **Replies:** 15\ **Last updated:** [July 17, 2025, 10:43am UTC](https://discuss.elastic.co/t/grok-and-parsing-of-logstash-data/379408 "2025-07-17T10:43:26Z")
Good morning I am integrating data from an application called telegraf into logstash here is my telegraf conf file # Global Agent Configuration \[agent\] hostname = "" flush\_interval = "15s" interval = "1500s" … --- ## [Interested in Integrating with Elastic Stack](https://discuss.elastic.co/t/interested-in-integrating-with-elastic-stack/380201)
**Author:** [@naher64547](https://discuss.elastic.co/u/naher64547)\ **Replies:** 0\ **Last updated:** [July 17, 2025, 7:26am UTC](https://discuss.elastic.co/t/interested-in-integrating-with-elastic-stack/380201 "2025-07-17T07:26:08Z")
Hey guys... :waving\_hand: I recently completed my Spotfire course from igmGuru with some of the best trainers, and I’m eager to explore how Elastic Stack can complement my data visualization and analytics skills. Can a… --- ## [New Custom Logs (Filestream) integration does not create a dataset specific index template](https://discuss.elastic.co/t/new-custom-logs-filestream-integration-does-not-create-a-dataset-specific-index-template/380179)
**Author:** [@allatrue](https://discuss.elastic.co/u/allatrue)\ **Replies:** 2\ **Last updated:** [July 17, 2025, 6:57am UTC](https://discuss.elastic.co/t/new-custom-logs-filestream-integration-does-not-create-a-dataset-specific-index-template/380179 "2025-07-17T06:57:10Z")
Hello Everyone, due to deprecation of old Custom Logs integration I'm now configuring the new Custom Logs (Filestream) integration, and I'm wondering why this integration does not create a managed dataset specific index… --- ## [Read files from SharePoint using logstash](https://discuss.elastic.co/t/read-files-from-sharepoint-using-logstash/380196)
**Author:** [@venkatkumar229](https://discuss.elastic.co/u/venkatkumar229)\ **Replies:** 0\ **Last updated:** [July 17, 2025, 4:43am UTC](https://discuss.elastic.co/t/read-files-from-sharepoint-using-logstash/380196 "2025-07-17T04:43:21Z")
Hi Team, Could you please let me know if there is a way to read the files from SharePoint using logstash. Thankyou in advance. --- ## [Elastic Cloud upgrade assistance from 7.0 to 8.0](https://discuss.elastic.co/t/elastic-cloud-upgrade-assistance-from-7-0-to-8-0/380073)
**Author:** [@wasim780](https://discuss.elastic.co/u/wasim780)\ **Replies:** 3\ **Last updated:** [July 16, 2025, 11:19pm UTC](https://discuss.elastic.co/t/elastic-cloud-upgrade-assistance-from-7-0-to-8-0/380073 "2025-07-16T23:19:15Z")
we are going to upgrade the elastic cloud and kibana from 7.0 to 8.0. need your assistance to assist us step by step prerequisites and upgrade assistance. --- ## [Vector search large dense vectors performance issues](https://discuss.elastic.co/t/vector-search-large-dense-vectors-performance-issues/380141)
**Author:** [@Pablo\_Delgado](https://discuss.elastic.co/u/Pablo_Delgado)\ **Replies:** 3\ **Last updated:** [July 16, 2025, 1:42pm UTC](https://discuss.elastic.co/t/vector-search-large-dense-vectors-performance-issues/380141 "2025-07-16T13:42:45Z")
I experience inconsistent (slow and fast results) on vector search. I currently have 50 million documents in an index, the vectors are stored in a filed with the current mapping: "large\_1536\_embedding": { "type": "de… --- ## [How to pull data from Elasticsearch to Splunk without data duplication?](https://discuss.elastic.co/t/how-to-pull-data-from-elasticsearch-to-splunk-without-data-duplication/380000)
**Author:** [@Ella\_conan](https://discuss.elastic.co/u/Ella_conan)\ **Replies:** 16\ **Last updated:** [July 16, 2025, 12:59pm UTC](https://discuss.elastic.co/t/how-to-pull-data-from-elasticsearch-to-splunk-without-data-duplication/380000 "2025-07-16T12:59:22Z")
Hello, I have data in Elasticsearch that I’ve stored across 3 indices. I want to copy the data to Splunk — I want only the data from the last minute, and I want to store the data from each Elasticsearch index into a se… --- ## [Metricbeat + Istio 1.26: Missing Data on Dashboard and No Fields in Discover](https://discuss.elastic.co/t/metricbeat-istio-1-26-missing-data-on-dashboard-and-no-fields-in-discover/380093)
**Author:** [@Kevin\_Rizki](https://discuss.elastic.co/u/Kevin_Rizki)\ **Replies:** 2\ **Last updated:** [July 16, 2025, 9:40am UTC](https://discuss.elastic.co/t/metricbeat-istio-1-26-missing-data-on-dashboard-and-no-fields-in-discover/380093 "2025-07-16T09:40:59Z")
Hi all, I'm currently setting up Metricbeat to collect telemetry data from Istio 1.26 running in a Kubernetes cluster, and I'm encountering issues where the default dashboards show no data, and the expected Istio fields… --- ## [Elasticsearch Performance Issue After Adding Second Node](https://discuss.elastic.co/t/elasticsearch-performance-issue-after-adding-second-node/380138)
**Author:** [@SalehEska](https://discuss.elastic.co/u/SalehEska)\ **Replies:** 3\ **Last updated:** [July 16, 2025, 9:07am UTC](https://discuss.elastic.co/t/elasticsearch-performance-issue-after-adding-second-node/380138 "2025-07-16T09:07:38Z")
Hello everyone, I’m currently experiencing a performance issue with my Elasticsearch cluster. Previously, I was using a single-node setup, and all queries—especially \_count—were working quickly and reliably. Recently, … --- ## [Error Mimecast integration with api v2](https://discuss.elastic.co/t/error-mimecast-integration-with-api-v2/379993)
**Author:** [@Haidar](https://discuss.elastic.co/u/Haidar)\ **Replies:** 0\ **Last updated:** [July 10, 2025, 10:32am UTC](https://discuss.elastic.co/t/error-mimecast-integration-with-api-v2/379993 "2025-07-10T10:32:03Z")
Hi, i have integration to mimecast with apiv2 this is my env used: Elastic stack : 9.0.0v OS: Ubuntu Elastic agent : 9.0.2v I got error an error in several data\_stream.dataset wich is in: mimecast.cloud\_integrated… --- ## [Mimecasta integration with api v2](https://discuss.elastic.co/t/mimecasta-integration-with-api-v2/380157)
**Author:** [@Haidar](https://discuss.elastic.co/u/Haidar)\ **Replies:** 0\ **Last updated:** [July 16, 2025, 3:35am UTC](https://discuss.elastic.co/t/mimecasta-integration-with-api-v2/380157 "2025-07-16T03:35:52Z")
Hi, i have integration to mimecast with apiv2 this is my env used: Elastic stack : 9.0.0v OS: Ubuntu Elastic agent : 9.0.2v I got error an error in several data\_stream.dataset wich is in: mimecast.cloud\_integrated… --- ## [Elasticsearch container as rootless Podman](https://discuss.elastic.co/t/elasticsearch-container-as-rootless-podman/380151)
**Author:** [@bbmcgee](https://discuss.elastic.co/u/bbmcgee)\ **Replies:** 0\ **Last updated:** [July 16, 2025, 1:51am UTC](https://discuss.elastic.co/t/elasticsearch-container-as-rootless-podman/380151 "2025-07-16T01:51:01Z")
I am using the elasticsearch 8.16.1 image, and get permissions error "java.nio.file.AccessDeniedException: /usr/share/elasticsearch/data" when I try to run it rootless with the command below with the mapped host volume /… --- ## [Identity-based authentication for automated pipeline deployments of Elastic Hosted and Serverless](https://discuss.elastic.co/t/identity-based-authentication-for-automated-pipeline-deployments-of-elastic-hosted-and-serverless/380148)
**Author:** [@alexyuwenaveva](https://discuss.elastic.co/u/alexyuwenaveva)\ **Replies:** 0\ **Last updated:** [July 15, 2025, 8:41pm UTC](https://discuss.elastic.co/t/identity-based-authentication-for-automated-pipeline-deployments-of-elastic-hosted-and-serverless/380148 "2025-07-15T20:41:17Z")
I would like to: set up automated pipeline deployments of both Elastic Hosted and Serverless avoid the inherent riskiness and fragility of API keys instead, use something like service principal or managed identity My … --- ## [Run Logstash as service on RedHat](https://discuss.elastic.co/t/run-logstash-as-service-on-redhat/380134)
**Author:** [@andp](https://discuss.elastic.co/u/andp)\ **Replies:** 5\ **Last updated:** [July 15, 2025, 12:41pm UTC](https://discuss.elastic.co/t/run-logstash-as-service-on-redhat/380134 "2025-07-15T12:41:53Z")
Hi, I have unpack (as application user that will run it) logstash 7.16 to my applications folder on RedHat server. I made changes in logstash.conf file and to try I started logstash in command line like this: /applica… --- ## [Elk upgradation from 8.16.1 to 8.18.8 on docker](https://discuss.elastic.co/t/elk-upgradation-from-8-16-1-to-8-18-8-on-docker/380127)
**Author:** [@Sachin\_Chourasiya](https://discuss.elastic.co/u/Sachin_Chourasiya)\ **Replies:** 0\ **Last updated:** [July 15, 2025, 7:19am UTC](https://discuss.elastic.co/t/elk-upgradation-from-8-16-1-to-8-18-8-on-docker/380127 "2025-07-15T07:19:32Z")
Hi Team, Currently we are using 8.16.1 version of elk 3 node cluster on docker having components Elasticsearch, Kibana and fleet. we need to upgrade it to 8.18.8 version, so we have below queries: How to utilize upgra… --- ## [Watcher Email Output Not Preserving HTML Cell Colors](https://discuss.elastic.co/t/watcher-email-output-not-preserving-html-cell-colors/379939)
**Author:** [@Tortoise](https://discuss.elastic.co/u/Tortoise)\ **Replies:** 6\ **Last updated:** [July 15, 2025, 3:21am UTC](https://discuss.elastic.co/t/watcher-email-output-not-preserving-html-cell-colors/379939 "2025-07-15T03:21:00Z")
Hello Team, Could you please share if it is possible to have color coding while sending email via Watcher? Like if OK = the cell should be Green in the table which is sent via Watcher & for NOT OK = Red. I tried but i… --- ## [Retrying http request, will sleep for X seconds](https://discuss.elastic.co/t/retrying-http-request-will-sleep-for-x-seconds/380085)
**Author:** [@Venality](https://discuss.elastic.co/u/Venality)\ **Replies:** 5\ **Last updated:** [July 15, 2025, 1:20am UTC](https://discuss.elastic.co/t/retrying-http-request-will-sleep-for-x-seconds/380085 "2025-07-15T01:20:34Z")
I configured my logstash.conf file properly in terms of URL and Authorization token however It's still not sending logs and giving me an http request failure like it's not able to communicate. I came to the conclusion th… --- ## [Lens Visualizations Breaking?](https://discuss.elastic.co/t/lens-visualizations-breaking/379970)
**Author:** [@erikg](https://discuss.elastic.co/u/erikg)\ **Replies:** 2\ **Last updated:** [July 14, 2025, 9:45pm UTC](https://discuss.elastic.co/t/lens-visualizations-breaking/379970 "2025-07-14T21:45:42Z")
Hello, I am not sure how to reproduce this but I created some lens visualizations on a dashboard containing several different data views. There is some legacy visualizations on the same dashboard but not sure how relev… --- ## [Set up Discover to mimic the look of journal](https://discuss.elastic.co/t/set-up-discover-to-mimic-the-look-of-journal/379944)
**Author:** [@sasser](https://discuss.elastic.co/u/sasser)\ **Replies:** 4\ **Last updated:** [July 14, 2025, 8:17pm UTC](https://discuss.elastic.co/t/set-up-discover-to-mimic-the-look-of-journal/379944 "2025-07-14T20:17:39Z")
Hi guys. Is it possible to set Kibana up in a way that resembles the way journalctl displays logs? So rather than showing the latest ones at the top, it shows them at the bottom? Also, is it possible to make the "boxes" … --- ## [ELK 8.19.0](https://discuss.elastic.co/t/elk-8-19-0/380115)
**Author:** [@kbujold\_wr](https://discuss.elastic.co/u/kbujold_wr)\ **Replies:** 1\ **Last updated:** [July 14, 2025, 6:51pm UTC](https://discuss.elastic.co/t/elk-8-19-0/380115 "2025-07-14T18:51:47Z")
Any news when ELK 8.19.0 may come out? --- ## [Logstash filter doesn't appear to be functioning](https://discuss.elastic.co/t/logstash-filter-doesnt-appear-to-be-functioning/380108)
**Author:** [@bmf614zzz](https://discuss.elastic.co/u/bmf614zzz)\ **Replies:** 2\ **Last updated:** [July 14, 2025, 4:59pm UTC](https://discuss.elastic.co/t/logstash-filter-doesnt-appear-to-be-functioning/380108 "2025-07-14T16:59:54Z")
Hello, Logstash version: 6.8.23 data message: cmd\_logger\_api.c(260) 10987641 %% INFO \[CLI:backupguy:10.0.1.254\] User has logged out type: rsyslog Logstash filter: filter { if "backupguy" in \[message\] { drop {} } … --- ## [Standard grok patterns consisting of only a group](https://discuss.elastic.co/t/standard-grok-patterns-consisting-of-only-a-group/380106)
**Author:** [@frans-wtax](https://discuss.elastic.co/u/frans-wtax)\ **Replies:** 1\ **Last updated:** [July 14, 2025, 4:28pm UTC](https://discuss.elastic.co/t/standard-grok-patterns-consisting-of-only-a-group/380106 "2025-07-14T16:28:24Z")
The documentation for the Grok filter states that to add a pattern to a custom patterns file, you: write the pattern you need as the pattern name, a space, then the regexp for that pattern. For example, doing the pos… --- ## [Sysmon for Linux Integration not sending to data\_stream.dataset: "sysmon\_linux.log"](https://discuss.elastic.co/t/sysmon-for-linux-integration-not-sending-to-data-stream-dataset-sysmon-linux-log/380077)
**Author:** [@vector\_vulture](https://discuss.elastic.co/u/vector_vulture)\ **Replies:** 6\ **Last updated:** [July 14, 2025, 4:19pm UTC](https://discuss.elastic.co/t/sysmon-for-linux-integration-not-sending-to-data-stream-dataset-sysmon-linux-log/380077 "2025-07-14T16:19:07Z")
Hi. I am new to ELK stack, and I cannot find this problem online, so I am posting here. I have a self hosted ELK stack the newest version with the agents version 9.0.3. I also have 1 agent deployed as a fleet server via … --- ## [BulkProcessor insertions not happening in our environment](https://discuss.elastic.co/t/bulkprocessor-insertions-not-happening-in-our-environment/380028)
**Author:** [@rajathgubbi](https://discuss.elastic.co/u/rajathgubbi)\ **Replies:** 3\ **Last updated:** [July 14, 2025, 2:01pm UTC](https://discuss.elastic.co/t/bulkprocessor-insertions-not-happening-in-our-environment/380028 "2025-07-14T14:01:46Z")
We are creating the BulkProcessor object as shown below. While some upserts are processed successfully, subsequent upserts are not being completed. This issue is occurring in a high-scale environment where the upserts re… --- ## [Missing required property on Elastic Cluster Health check](https://discuss.elastic.co/t/missing-required-property-on-elastic-cluster-health-check/371458)
**Author:** [@p4paul](https://discuss.elastic.co/u/p4paul)\ **Replies:** 5\ **Last updated:** [July 14, 2025, 9:21am UTC](https://discuss.elastic.co/t/missing-required-property-on-elastic-cluster-health-check/371458 "2025-07-14T09:21:00Z")
Very similar to Error: using Java API calling ElasticsearchClient method healthReport() Updating the Java client (from 8.15.3) to elasticsearch-java:8.16.1 and calling... HealthResponse healthModel = getEsClient().clus… --- ## [Several questions about Elastic Agent standalone mode](https://discuss.elastic.co/t/several-questions-about-elastic-agent-standalone-mode/380092)
**Author:** [@Incauto](https://discuss.elastic.co/u/Incauto)\ **Replies:** 0\ **Last updated:** [July 14, 2025, 8:03am UTC](https://discuss.elastic.co/t/several-questions-about-elastic-agent-standalone-mode/380092 "2025-07-14T08:03:05Z")
Why does the documentation suggest downloading the ZIP instead of using the MSI installer? If I need to add another integration to the agent, is it enough to simply modify the elastic-agent.yml file and restart the agen… --- ## [Kibana Short URL API failing with external host error after upgrading to 8.18.3](https://discuss.elastic.co/t/kibana-short-url-api-failing-with-external-host-error-after-upgrading-to-8-18-3/379990)
**Author:** [@verma\_s](https://discuss.elastic.co/u/verma_s)\ **Replies:** 1\ **Last updated:** [July 14, 2025, 6:26am UTC](https://discuss.elastic.co/t/kibana-short-url-api-failing-with-external-host-error-after-upgrading-to-8-18-3/379990 "2025-07-14T06:26:35Z")
Hello All, We use ELK stack(Basic License) for reporting in one of our applications. Recently, we upgraded our ELK stack from 8.15.0 to 8.18.3, even though the upgrade completed successfully, we started facing issue wit… --- ## [Your settings are invalid. Reason: Setting "" doesn't exist. Please check if you haven't made a typo](https://discuss.elastic.co/t/your-settings-are-invalid-reason-setting-doesnt-exist-please-check-if-you-havent-made-a-typo/380079)
**Author:** [@Venality](https://discuss.elastic.co/u/Venality)\ **Replies:** 2\ **Last updated:** [July 13, 2025, 10:54pm UTC](https://discuss.elastic.co/t/your-settings-are-invalid-reason-setting-doesnt-exist-please-check-if-you-havent-made-a-typo/380079 "2025-07-13T22:54:19Z")
Hi guys, I'm trying to write the config file for logstash to communicate with splunk and I keep getting this error. Not sure what I'm doing wrong and could use some input. This is my first time using it so here's the co… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=53) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=55)