# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=57 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 58 --- ## [Can't add integrations to fleet agent policies](https://discuss.elastic.co/t/cant-add-integrations-to-fleet-agent-policies/379750)
**Author:** [@pierro78](https://discuss.elastic.co/u/pierro78)\ **Replies:** 3\ **Last updated:** [July 4, 2025, 3:15pm UTC](https://discuss.elastic.co/t/cant-add-integrations-to-fleet-agent-policies/379750 "2025-07-04T15:15:24Z")
Hey there Did an airgapped installation of Elastic Package Registry Created a new docker instance of kibana with xpack.fleet.registryUrl set to my EPR url (already installed fleet server from a docker-compose instance … --- ## [How to Handle Selective Masking and Reversible Encryption for PII in Elasticsearch Ingestion](https://discuss.elastic.co/t/how-to-handle-selective-masking-and-reversible-encryption-for-pii-in-elasticsearch-ingestion/379807)
**Author:** [@Souvik\_Das](https://discuss.elastic.co/u/Souvik_Das)\ **Replies:** 1\ **Last updated:** [July 4, 2025, 2:18pm UTC](https://discuss.elastic.co/t/how-to-handle-selective-masking-and-reversible-encryption-for-pii-in-elasticsearch-ingestion/379807 "2025-07-04T14:18:47Z")
Hi Folks, I’m working on a use case where we ingest API response payloads into the Elastic Stack (Logstash → Elasticsearch). The payload contains JSON data with a mix of important application-level information (like res… --- ## [Environment Variable as Custom Field - Fleet Policy](https://discuss.elastic.co/t/environment-variable-as-custom-field-fleet-policy/379568)
**Author:** [@karnamonkster](https://discuss.elastic.co/u/karnamonkster)\ **Replies:** 7\ **Last updated:** [July 4, 2025, 1:17pm UTC](https://discuss.elastic.co/t/environment-variable-as-custom-field-fleet-policy/379568 "2025-07-04T13:17:56Z")
Hi, We are trying to fetch an environment variable to be added as a field for every log message coming in from the server where elastic agent is deployed. Similar to this issue link The Elastic agent deployments are fl… --- ## [ELSER v2 model (version 12.0.0) inference fail for elasticsearch 9.0.3](https://discuss.elastic.co/t/elser-v2-model-version-12-0-0-inference-fail-for-elasticsearch-9-0-3/379776)
**Author:** [@chenlizhao](https://discuss.elastic.co/u/chenlizhao)\ **Replies:** 2\ **Last updated:** [July 4, 2025, 8:41am UTC](https://discuss.elastic.co/t/elser-v2-model-version-12-0-0-inference-fail-for-elasticsearch-9-0-3/379776 "2025-07-04T08:41:53Z")
I installed elasticsearch 9.0.3 with docker compose file, running on centos7, x86\_64 platform, when I call inference api with: POST \_inference/.elser-2-elasticsearch { "input": "What is Elastic?" } the elasticsearch … --- ## [Add field to filebeat Panos module](https://discuss.elastic.co/t/add-field-to-filebeat-panos-module/379803)
**Author:** [@Lero](https://discuss.elastic.co/u/Lero)\ **Replies:** 0\ **Last updated:** [July 4, 2025, 8:23am UTC](https://discuss.elastic.co/t/add-field-to-filebeat-panos-module/379803 "2025-07-04T08:23:40Z")
Hi, Using the Panos module for filebeat: the field "threat category" (eg dns-proxy) isn't currently parsed into a dedicated field but is dropped and part of the event.original field. This could be a valuable field for … --- ## [Out of Memory at Beats Input](https://discuss.elastic.co/t/out-of-memory-at-beats-input/376135)
**Author:** [@dawiro](https://discuss.elastic.co/u/dawiro)\ **Replies:** 4\ **Last updated:** [July 4, 2025, 7:54am UTC](https://discuss.elastic.co/t/out-of-memory-at-beats-input/376135 "2025-07-04T07:54:49Z")
Hi, From time to time we get this error with our logstashes: 2025-03-19T16:13:36,640\]\[INFO \]\[org.logstash.beats.BeatsHandler\]\[beats-input\] \[local: 192.168.16.76:6044, remote: 192.168.15.127:52442\] Handling exception:ja… --- ## [Starting Point to Tune Logstash](https://discuss.elastic.co/t/starting-point-to-tune-logstash/379301)
**Author:** [@yuswanul](https://discuss.elastic.co/u/yuswanul)\ **Replies:** 9\ **Last updated:** [July 4, 2025, 7:10am UTC](https://discuss.elastic.co/t/starting-point-to-tune-logstash/379301 "2025-07-04T07:10:25Z")
Hi there i have a dedicated logstash machine with 16 cores and 32 Gb RAM and multiple pipelines inside it. There are 3 heavy pipelines(complex filters and high event rate). what is a good starting point to make a globa… --- ## [Logstash stops inputs after update](https://discuss.elastic.co/t/logstash-stops-inputs-after-update/379757)
**Author:** [@Ljapunov](https://discuss.elastic.co/u/Ljapunov)\ **Replies:** 3\ **Last updated:** [July 4, 2025, 7:03am UTC](https://discuss.elastic.co/t/logstash-stops-inputs-after-update/379757 "2025-07-04T07:03:08Z")
We currently try to update our logstash servers from 8.2.0 to 8.18.x (and later 9.x). In Version 8.18.x we face an issue with logstash. I tried to find the exact version which is failing and found that with 8.11.4 every… --- ## [ECK 8.17.3 can't set replication factor on system indices](https://discuss.elastic.co/t/eck-8-17-3-cant-set-replication-factor-on-system-indices/379697)
**Author:** [@DanielR1](https://discuss.elastic.co/u/DanielR1)\ **Replies:** 1\ **Last updated:** [July 4, 2025, 6:52am UTC](https://discuss.elastic.co/t/eck-8-17-3-cant-set-replication-factor-on-system-indices/379697 "2025-07-04T06:52:44Z")
Hello! I have deployed a cluster v 8.17.3 using the eck operator, I see all the indices have a replication factor of 0 by default. I have tried to change that using the PUT /.internal.alerts-default.alerts-default-0000… --- ## [Alerting when data stops coming in from variety of sources](https://discuss.elastic.co/t/alerting-when-data-stops-coming-in-from-variety-of-sources/379787)
**Author:** [@erikg](https://discuss.elastic.co/u/erikg)\ **Replies:** 2\ **Last updated:** [July 3, 2025, 9:42pm UTC](https://discuss.elastic.co/t/alerting-when-data-stops-coming-in-from-variety-of-sources/379787 "2025-07-03T21:42:46Z")
Hello, For a specific use case/dashboard, not all data comes from the same data source. I have a use case where there are at least 4 different data sources. The data can come from logs-\* where it must be filtered by fie… --- ## [Raspberry Pi 5 default page size results in uninstall and integration errors due to jemalloc unsupported page size](https://discuss.elastic.co/t/raspberry-pi-5-default-page-size-results-in-uninstall-and-integration-errors-due-to-jemalloc-unsupported-page-size/379781)
**Author:** [@gorhack](https://discuss.elastic.co/u/gorhack)\ **Replies:** 0\ **Last updated:** [July 3, 2025, 4:12pm UTC](https://discuss.elastic.co/t/raspberry-pi-5-default-page-size-results-in-uninstall-and-integration-errors-due-to-jemalloc-unsupported-page-size/379781 "2025-07-03T16:12:20Z")
Due to the default page size in the Raspberry Pi 5's kernel (16kb) the elastic agent cannot initialize the Elastic Defend integration nor uninstall successfully. Elastic Agent Version information: Binary: 9.0.3 (build:… --- ## [The necessity of translog in the writing process of elasticSearch](https://discuss.elastic.co/t/the-necessity-of-translog-in-the-writing-process-of-elasticsearch/379769)
**Author:** [@ka\_ka](https://discuss.elastic.co/u/ka_ka)\ **Replies:** 1\ **Last updated:** [July 3, 2025, 2:11pm UTC](https://discuss.elastic.co/t/the-necessity-of-translog-in-the-writing-process-of-elasticsearch/379769 "2025-07-03T14:11:59Z")
What are the advantages of using the translog compared to simply setting a very low flush interval? If I set the flush interval to be very low, wouldn't that also achieve persistence? (I realize this might be a bit of a … --- ## [Time-based Phrase Search Without Doubling Transcript field storage – Any Better Way?](https://discuss.elastic.co/t/time-based-phrase-search-without-doubling-transcript-field-storage-any-better-way/379753)
**Author:** [@Andrii\_Tapuzov](https://discuss.elastic.co/u/Andrii_Tapuzov)\ **Replies:** 0\ **Last updated:** [July 3, 2025, 10:05am UTC](https://discuss.elastic.co/t/time-based-phrase-search-without-doubling-transcript-field-storage-any-better-way/379753 "2025-07-03T10:05:14Z")
Hi, We’re building a solution that allows time-based phrase search over audio transcripts in Elasticsearch. The goal is to find exact phrases that occur at a certain point in time, e.g., "may i help you" within the firs… --- ## [Scoring issue using "minmax" Normalizer in Linear Retriever](https://discuss.elastic.co/t/scoring-issue-using-minmax-normalizer-in-linear-retriever/379744)
**Author:** [@Saad\_Iqbal](https://discuss.elastic.co/u/Saad_Iqbal)\ **Replies:** 0\ **Last updated:** [July 3, 2025, 8:52am UTC](https://discuss.elastic.co/t/scoring-issue-using-minmax-normalizer-in-linear-retriever/379744 "2025-07-03T08:52:20Z")
If I have a keyword search query and I get 2 documents one with score 90 and other with 91 (and assuming that the best match we can get on the currently indexed data for any query is 100), using minmax normalizer gives t… --- ## [Convert data from UTC to localtime "Europe/Warsaw"](https://discuss.elastic.co/t/convert-data-from-utc-to-localtime-europe-warsaw/379664)
**Author:** [@Nevov21](https://discuss.elastic.co/u/Nevov21)\ **Replies:** 2\ **Last updated:** [July 3, 2025, 7:44am UTC](https://discuss.elastic.co/t/convert-data-from-utc-to-localtime-europe-warsaw/379664 "2025-07-03T07:44:28Z")
Hello, I'm trying to convert UTC time to my timezone "Europe/Warsaw" in logstash pipeline but it didnt work. This is my filter in pipeline: filter { date { match =\> \["\[fields\]\[timestamp\]", "ISO8601", "UNIX\_MS"\] … --- ## [Deployment down because of an ml job](https://discuss.elastic.co/t/deployment-down-because-of-an-ml-job/379712)
**Author:** [@vmesis](https://discuss.elastic.co/u/vmesis)\ **Replies:** 4\ **Last updated:** [July 2, 2025, 8:37pm UTC](https://discuss.elastic.co/t/deployment-down-because-of-an-ml-job/379712 "2025-07-02T20:37:11Z")
Hello everyone, Recently, I had an issue with my deployment. I create an outliner detection jobs and it run out of memory. However, before I could stop it or reconfigure it the deployment went down. I already tried to … --- ## [Kibana has\_historical\_agent\_data timeout](https://discuss.elastic.co/t/kibana-has-historical-agent-data-timeout/379723)
**Author:** [@davjl](https://discuss.elastic.co/u/davjl)\ **Replies:** 0\ **Last updated:** [July 2, 2025, 8:06pm UTC](https://discuss.elastic.co/t/kibana-has-historical-agent-data-timeout/379723 "2025-07-02T20:06:14Z")
Hello team. I'm experiencing an issue with applications observability (APM). When I select this section with a filter for the last 15 minutes , in some cases, it only displays the following error. I turned on Inspec… --- ## [File Upload - Overwrite Index by new Upload](https://discuss.elastic.co/t/file-upload-overwrite-index-by-new-upload/379720)
**Author:** [@erikg](https://discuss.elastic.co/u/erikg)\ **Replies:** 1\ **Last updated:** [July 2, 2025, 6:37pm UTC](https://discuss.elastic.co/t/file-upload-overwrite-index-by-new-upload/379720 "2025-07-02T18:37:59Z")
Hello, My use case is wanting to leverage a csv file that will get update once in a while. This csv file contains metadata information that will be later used for an enriching data with Elastic. The File Upload featur… --- ## [Unable to create new rule](https://discuss.elastic.co/t/unable-to-create-new-rule/379709)
**Author:** [@Devanshu-soni](https://discuss.elastic.co/u/Devanshu-soni)\ **Replies:** 3\ **Last updated:** [July 2, 2025, 5:29pm UTC](https://discuss.elastic.co/t/unable-to-create-new-rule/379709 "2025-07-02T17:29:38Z")
Hello, I'm trying to create a rule using 'Search threshold rule' bases alerting option in Discover. Could anybody point out what additional user role is required to create new rule and alert. Currently my account h… --- ## [Elasticsearch Snapshot](https://discuss.elastic.co/t/elasticsearch-snapshot/379323)
**Author:** [@Debasis\_Mallick](https://discuss.elastic.co/u/Debasis_Mallick)\ **Replies:** 26\ **Last updated:** [July 2, 2025, 12:43pm UTC](https://discuss.elastic.co/t/elasticsearch-snapshot/379323 "2025-07-02T12:43:36Z")
Hi Team, We are using Elasticsearch for the first time and are preparing to back up a cluster that is approximately 600 GB in size. Before we proceed with configuring the backup, we need to perform some calculations to … --- ## [How to use filmstrip report in elastic-cloud](https://discuss.elastic.co/t/how-to-use-filmstrip-report-in-elastic-cloud/379715)
**Author:** [@Nikita\_Epshtein](https://discuss.elastic.co/u/Nikita_Epshtein)\ **Replies:** 0\ **Last updated:** [July 2, 2025, 3:06pm UTC](https://discuss.elastic.co/t/how-to-use-filmstrip-report-in-elastic-cloud/379715 "2025-07-02T15:06:21Z")
Hi! I've encountered the code related to Playwright filmstrip capturing in @elastic/synthetics package, but I couldn't find any way to get to the filmstrip from Kibana's Monitor UI. Is this feature used anywhere? --- ## [ No Observable Difference Between BBQ and Default Configurations in Elasticsearch – Help with Index Size Comparison](https://discuss.elastic.co/t/no-observable-difference-between-bbq-and-default-configurations-in-elasticsearch-help-with-index-size-comparison/377817)
**Author:** [@mohab\_ghobashy](https://discuss.elastic.co/u/mohab_ghobashy)\ **Replies:** 15\ **Last updated:** [July 2, 2025, 3:03pm UTC](https://discuss.elastic.co/t/no-observable-difference-between-bbq-and-default-configurations-in-elasticsearch-help-with-index-size-comparison/377817 "2025-07-02T15:03:15Z")
I've been running some tests on Better Binary Quantization (BBQ) in Elasticsearch and comparing it with the default configuration for dense vectors, but I'm not observing the expected differences in disk size or search p… --- ## [Drill Down using go to Dashboard is not working in 8.17.2](https://discuss.elastic.co/t/drill-down-using-go-to-dashboard-is-not-working-in-8-17-2/379706)
**Author:** [@Pavan\_Bapireddy](https://discuss.elastic.co/u/Pavan_Bapireddy)\ **Replies:** 2\ **Last updated:** [July 2, 2025, 1:00pm UTC](https://discuss.elastic.co/t/drill-down-using-go-to-dashboard-is-not-working-in-8-17-2/379706 "2025-07-02T13:00:07Z")
Hi Team, Recently we have observed an issue where we are not able to create drilldown using go to dashboard option,but using go to url option we are able to create a drilldown. We are using 8.17.2 version. Seems like th… --- ## [Is recommended able integration LDAP - Elastic with basic license mode? this integration could present issues? many thanks](https://discuss.elastic.co/t/is-recommended-able-integration-ldap-elastic-with-basic-license-mode-this-integration-could-present-issues-many-thanks/379686)
**Author:** [@carbon](https://discuss.elastic.co/u/carbon)\ **Replies:** 1\ **Last updated:** [July 2, 2025, 12:28pm UTC](https://discuss.elastic.co/t/is-recommended-able-integration-ldap-elastic-with-basic-license-mode-this-integration-could-present-issues-many-thanks/379686 "2025-07-02T12:28:34Z")
Is recommended able integration LDAP - Elastic with basic license mode ? --- ## [Can't get licence trial extension and can't pay for subscription](https://discuss.elastic.co/t/cant-get-licence-trial-extension-and-cant-pay-for-subscription/369264)
**Author:** [@kingsley.ohia](https://discuss.elastic.co/u/kingsley.ohia)\ **Replies:** 10\ **Last updated:** [July 2, 2025, 12:21pm UTC](https://discuss.elastic.co/t/cant-get-licence-trial-extension-and-cant-pay-for-subscription/369264 "2025-07-02T12:21:59Z")
Hello everyone. I need some assistance with my licence, please. We are currently trialling the Platinum licence, which is due to expire in one hour. I have been trying to contact Elastic since last Thursday to request an… --- ## [Kubernetes.deployment.name missing after metricbeat upgrade](https://discuss.elastic.co/t/kubernetes-deployment-name-missing-after-metricbeat-upgrade/379565)
**Author:** [@Erik\_Finnman](https://discuss.elastic.co/u/Erik_Finnman)\ **Replies:** 1\ **Last updated:** [July 2, 2025, 12:00pm UTC](https://discuss.elastic.co/t/kubernetes-deployment-name-missing-after-metricbeat-upgrade/379565 "2025-07-02T12:00:29Z")
Hi, we recently updated our Kubernetes version to 1.30.10 (running in AKS) and noticed that metricbeat was starting to get authentication issues after 1 hour. I found this issue metricbeat runs happily for a while and … --- ## [Heap sudenly full on all voting-only master nodes (7.17.28)](https://discuss.elastic.co/t/heap-sudenly-full-on-all-voting-only-master-nodes-7-17-28/379485)
**Author:** [@nisow95612](https://discuss.elastic.co/u/nisow95612)\ **Replies:** 19\ **Last updated:** [July 2, 2025, 11:50am UTC](https://discuss.elastic.co/t/heap-sudenly-full-on-all-voting-only-master-nodes-7-17-28/379485 "2025-07-02T11:50:23Z")
I have no idea what happened. No clue in node logs. These nodes are data\_cold,master,voting\_only and they are very idle, GC happening like every three hours. Suddenly heap on both nodes filled and they crashed. ▶ 2025-… --- ## [How to make Curator not exclude system indices?](https://discuss.elastic.co/t/how-to-make-curator-not-exclude-system-indices/379679)
**Author:** [@mikewillis](https://discuss.elastic.co/u/mikewillis)\ **Replies:** 0\ **Last updated:** [July 1, 2025, 4:12pm UTC](https://discuss.elastic.co/t/how-to-make-curator-not-exclude-system-indices/379679 "2025-07-01T16:12:30Z")
I have an action kibana-snapshot: action: snapshot description: Backup the Kibana indicies, where all those lovely visualisations and index pattern settings and other good things are stored. options: … --- ## [Managing Multiple Elastic Cloud Organizations with a Single User](https://discuss.elastic.co/t/managing-multiple-elastic-cloud-organizations-with-a-single-user/367057)
**Author:** [@loml](https://discuss.elastic.co/u/loml)\ **Replies:** 1\ **Last updated:** [July 2, 2025, 4:52am UTC](https://discuss.elastic.co/t/managing-multiple-elastic-cloud-organizations-with-a-single-user/367057 "2025-07-02T04:52:03Z")
I understand that a user can only belong to one organization at a time based from this documentation. Is there a workaround for this limitation, or is it a current feature restriction? --- ## [Performance Issue During Ingestion](https://discuss.elastic.co/t/performance-issue-during-ingestion/379572)
**Author:** [@echan23](https://discuss.elastic.co/u/echan23)\ **Replies:** 2\ **Last updated:** [July 2, 2025, 4:22am UTC](https://discuss.elastic.co/t/performance-issue-during-ingestion/379572 "2025-07-02T04:22:52Z")
I currently ingest data into my Elasticsearch cluster from four sources in the first 15 minutes of each hour. During these 15 minutes, queries are slower and performance is impacted. Are there any alternatives that coul… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=56) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=58)