# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=58 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 59 --- ## [Best practice for adding additional fields to transform](https://discuss.elastic.co/t/best-practice-for-adding-additional-fields-to-transform/379665)
**Author:** [@dot-mike](https://discuss.elastic.co/u/dot-mike)\ **Replies:** 2\ **Last updated:** [July 1, 2025, 9:37pm UTC](https://discuss.elastic.co/t/best-practice-for-adding-additional-fields-to-transform/379665 "2025-07-01T21:37:53Z")
Hi community, I've created a custom transform job to extract Fortigate VPN events into custom index to get start / stop time. Sharing it below for reference. This is extracting data from fortigate integration so we alre… --- ## [Too Many Transforms Automatically Recreated](https://discuss.elastic.co/t/too-many-transforms-automatically-recreated/372899)
**Author:** [@Behnam.R](https://discuss.elastic.co/u/Behnam.R)\ **Replies:** 1\ **Last updated:** [July 1, 2025, 8:03pm UTC](https://discuss.elastic.co/t/too-many-transforms-automatically-recreated/372899 "2025-07-01T20:03:39Z")
Elasticsearch cluster (version 8.17.0) I see numerous transforms are being created automatically. Even when I delete these transforms, they are recreated immediately. The transforms follow a naming pattern like: en… --- ## [Why can't i connect kibana with Elasticsearch?](https://discuss.elastic.co/t/why-cant-i-connect-kibana-with-elasticsearch/379574)
**Author:** [@cherokeexxx](https://discuss.elastic.co/u/cherokeexxx)\ **Replies:** 26\ **Last updated:** [July 1, 2025, 7:34pm UTC](https://discuss.elastic.co/t/why-cant-i-connect-kibana-with-elasticsearch/379574 "2025-07-01T19:34:43Z")
Hi there, Currently i trying hard to connect kibana with ES, by using Docker, through a docker-compose.yml. Here my docker-compose.yml services: elastic: container\_name: elastic image: docker.elastic.co/elast… --- ## [Search nested fields](https://discuss.elastic.co/t/search-nested-fields/379672)
**Author:** [@sa.moskalenko](https://discuss.elastic.co/u/sa.moskalenko)\ **Replies:** 3\ **Last updated:** [July 1, 2025, 2:32pm UTC](https://discuss.elastic.co/t/search-nested-fields/379672 "2025-07-01T14:32:50Z")
I create index with nested field { "chat": { "aliases": {}, "mappings": { "properties": { "dataset\_id": { "type": "text", "fields":… --- ## [Conditional colouring using kibana dashboard](https://discuss.elastic.co/t/conditional-colouring-using-kibana-dashboard/379662)
**Author:** [@Dariia\_Hrebenichenko](https://discuss.elastic.co/u/Dariia_Hrebenichenko)\ **Replies:** 10\ **Last updated:** [July 1, 2025, 1:11pm UTC](https://discuss.elastic.co/t/conditional-colouring-using-kibana-dashboard/379662 "2025-07-01T13:11:32Z")
Hello everyone! I have one dashboard to showing uptime monitor. It shows all ports for 2 different nodes. So 2 panels with name 'node 1' and 'node 2' and 2 tables for each (same but with filters for dedicated nodes). Ta… --- ## [Logstash Kafka Input Plugin Fails to Load OAUTHBEARER strimzi CallbackHandler Class](https://discuss.elastic.co/t/logstash-kafka-input-plugin-fails-to-load-oauthbearer-strimzi-callbackhandler-class/379464)
**Author:** [@niveditakathal](https://discuss.elastic.co/u/niveditakathal)\ **Replies:** 1\ **Last updated:** [July 1, 2025, 12:16pm UTC](https://discuss.elastic.co/t/logstash-kafka-input-plugin-fails-to-load-oauthbearer-strimzi-callbackhandler-class/379464 "2025-07-01T12:16:53Z")
Hi Experts, I'm encountering a Kafka OAuth setup issue in Logstash where it fails to load the JaasClientOauthLoginCallbackHandler class from the Strimzi libraries. Error Message: ConfigException: Invalid value io.stri… --- ## [One month shift in url in kibana](https://discuss.elastic.co/t/one-month-shift-in-url-in-kibana/379625)
**Author:** [@test\_ops](https://discuss.elastic.co/u/test_ops)\ **Replies:** 5\ **Last updated:** [July 1, 2025, 11:09am UTC](https://discuss.elastic.co/t/one-month-shift-in-url-in-kibana/379625 "2025-07-01T11:09:55Z")
Hi, when i try to paste: http://ip:port/app/kibana#/discover?\_g=(filters:!(),refreshInterval:(pause:!t,value:0),time:(from:'2025-05-01T00:00:00.000Z',to:'2025-05-31T23:59:59.000Z')) in firefox browser, it automatically… --- ## [Understanding ES812Postings Codec Vs Lucene99 Codec](https://discuss.elastic.co/t/understanding-es812postings-codec-vs-lucene99-codec/379659)
**Author:** [@Aditya\_Teltia](https://discuss.elastic.co/u/Aditya_Teltia)\ **Replies:** 0\ **Last updated:** [July 1, 2025, 9:09am UTC](https://discuss.elastic.co/t/understanding-es812postings-codec-vs-lucene99-codec/379659 "2025-07-01T09:09:19Z")
Hi Everyone, I was going through the changes made in elasticsearch to tackle lucene's new posting format that uses FOR instead of PFOR and got to know that elasticsearch made its own PFOR codec ES812Postings. My doubt … --- ## [How to merge parent and child documents in Elasticsearch into a single enriched record?](https://discuss.elastic.co/t/how-to-merge-parent-and-child-documents-in-elasticsearch-into-a-single-enriched-record/378963)
**Author:** [@verza](https://discuss.elastic.co/u/verza)\ **Replies:** 7\ **Last updated:** [July 1, 2025, 8:59am UTC](https://discuss.elastic.co/t/how-to-merge-parent-and-child-documents-in-elasticsearch-into-a-single-enriched-record/378963 "2025-07-01T08:59:36Z")
Hi everyone, I’m working with an Elasticsearch index that stores HTTP request logs. Each request is represented by two documents: A parent document with a unique ID field. A child document that contains a parentID fie… --- ## [Reindex error from strict mapping to dynamic on sub-field](https://discuss.elastic.co/t/reindex-error-from-strict-mapping-to-dynamic-on-sub-field/379536)
**Author:** [@ugur-kurnaz](https://discuss.elastic.co/u/ugur-kurnaz)\ **Replies:** 2\ **Last updated:** [July 1, 2025, 8:08am UTC](https://discuss.elastic.co/t/reindex-error-from-strict-mapping-to-dynamic-on-sub-field/379536 "2025-07-01T08:08:24Z")
Hello Elastic Community, I'm struggling with a mapping evolution on an index used to backend messages dropped in DLQ in rabbitmq. We have until now a strict and restricted mapping (as the properties and properties.head… --- ## [SearchRequest.toString() is truncated because of exceed the MAX\_LENGTH 10000](https://discuss.elastic.co/t/searchrequest-tostring-is-truncated-because-of-exceed-the-max-length-10000/379656)
**Author:** [@ChatLee](https://discuss.elastic.co/u/ChatLee)\ **Replies:** 0\ **Last updated:** [July 1, 2025, 5:17am UTC](https://discuss.elastic.co/t/searchrequest-tostring-is-truncated-because-of-exceed-the-max-length-10000/379656 "2025-07-01T05:17:31Z")
Hi teams, We use the elasticsearch=8.13.2 in our code, when we try to log the query before the requests send to ES, we suffer the incomplete log be printed when we use searchRequest.toString() method, we found that if t… --- ## [Filebeat - High CPU usage with kubernetes autodiscovery](https://discuss.elastic.co/t/filebeat-high-cpu-usage-with-kubernetes-autodiscovery/379605)
**Author:** [@lorenzo\_milicia](https://discuss.elastic.co/u/lorenzo_milicia)\ **Replies:** 2\ **Last updated:** [July 1, 2025, 5:02am UTC](https://discuss.elastic.co/t/filebeat-high-cpu-usage-with-kubernetes-autodiscovery/379605 "2025-07-01T05:02:10Z")
Hello, Over the last few days I've been trying to investigate an issue I was having in our logging system running in a production environment. The system is a pretty straight forward Filebeat -\> Logstash -\> Elasticsear… --- ## [Highlighter is using unified or fvh, fields are configured with term\_vector:with\_positions\_offsets](https://discuss.elastic.co/t/highlighter-is-using-unified-or-fvh-fields-are-configured-with-term-vector-with-positions-offsets/379653)
**Author:** [@min\_liu](https://discuss.elastic.co/u/min_liu)\ **Replies:** 0\ **Last updated:** [July 1, 2025, 3:07am UTC](https://discuss.elastic.co/t/highlighter-is-using-unified-or-fvh-fields-are-configured-with-term-vector-with-positions-offsets/379653 "2025-07-01T03:07:08Z")
My version is 7.10, before highlighter use default value, there will be the following problem: index has exceeded \[1000000\] - maximum allowed to be analyzed for highlighting. This maximum can be set by changing the \[ind… --- ## [Movie Example SearchUI Not Working](https://discuss.elastic.co/t/movie-example-searchui-not-working/379643)
**Author:** [@xef](https://discuss.elastic.co/u/xef)\ **Replies:** 0\ **Last updated:** [June 30, 2025, 6:24pm UTC](https://discuss.elastic.co/t/movie-example-searchui-not-working/379643 "2025-06-30T18:24:48Z")
The Movie Search Example in the Demos does not work. It keeps giving messages of downloading this and that (we waited for 20 minutes) and still is processing. Is this normal? --- ## [Warning: Connection refused on port 9304](https://discuss.elastic.co/t/warning-connection-refused-on-port-9304/379644)
**Author:** [@HarimbolaSantatra](https://discuss.elastic.co/u/HarimbolaSantatra)\ **Replies:** 0\ **Last updated:** [June 30, 2025, 7:25pm UTC](https://discuss.elastic.co/t/warning-connection-refused-on-port-9304/379644 "2025-06-30T19:25:04Z")
I am running ES on a local computer. I am encountering this error: \[2025-06-30T15:06:05,304\]\[WARN \]\[o.e.d.PeerFinder \] \[localhost.localdomain\] address \[\[::1\]:9304\], node \[unknown\] discovery result: \[\]\[\[::1\]:9304… --- ## [High RAM usage on kubernetes pod after migration from type container to filestream](https://discuss.elastic.co/t/high-ram-usage-on-kubernetes-pod-after-migration-from-type-container-to-filestream/379438)
**Author:** [@cubba](https://discuss.elastic.co/u/cubba)\ **Replies:** 4\ **Last updated:** [June 30, 2025, 1:33pm UTC](https://discuss.elastic.co/t/high-ram-usage-on-kubernetes-pod-after-migration-from-type-container-to-filestream/379438 "2025-06-30T13:33:10Z")
Hello, we are in a progress of migration from input: container to filestream. Filebeat is configured as daemonset on kubernetes and each filebeat pod collects logs from all applications deployed on corresponding kuber… --- ## [Logstash-output-elasticsearch Connection reset while trying to send bulk request to elasticsearch](https://discuss.elastic.co/t/logstash-output-elasticsearch-connection-reset-while-trying-to-send-bulk-request-to-elasticsearch/379398)
**Author:** [@Advay](https://discuss.elastic.co/u/Advay)\ **Replies:** 21\ **Last updated:** [June 30, 2025, 12:46pm UTC](https://discuss.elastic.co/t/logstash-output-elasticsearch-connection-reset-while-trying-to-send-bulk-request-to-elasticsearch/379398 "2025-06-30T12:46:14Z")
We are encountering an issue in our Logstash cluster and would appreciate your assistance in investigating and resolving it. Upon starting the Logstash cluster, we are consistently observing the following warning messag… --- ## [Request to Externalize Hardcoded Credentials from filebeat.yml](https://discuss.elastic.co/t/request-to-externalize-hardcoded-credentials-from-filebeat-yml/379282)
**Author:** [@Thirupathi](https://discuss.elastic.co/u/Thirupathi)\ **Replies:** 2\ **Last updated:** [June 30, 2025, 12:42pm UTC](https://discuss.elastic.co/t/request-to-externalize-hardcoded-credentials-from-filebeat-yml/379282 "2025-06-30T12:42:08Z")
Currently, the Filebeat configuration (filebeat.yml) includes hardcoded values for the Elasticsearch and kafka host IP, username, and password. This poses a potential security risk and makes configuration changes non-sc… --- ## [Universal Profiling agent is not starting, failing with pid '71891' exited with code '1'](https://discuss.elastic.co/t/universal-profiling-agent-is-not-starting-failing-with-pid-71891-exited-with-code-1/373220)
**Author:** [@Pooja\_Gajaram](https://discuss.elastic.co/u/Pooja_Gajaram)\ **Replies:** 2\ **Last updated:** [June 30, 2025, 10:57am UTC](https://discuss.elastic.co/t/universal-profiling-agent-is-not-starting-failing-with-pid-71891-exited-with-code-1/373220 "2025-06-30T10:57:55Z")
Elastic is deployed on the default cloud provided by elastic cluster \[AWS\] Universal Profiling agent is not starting, failing with pid '71891' exited with code '1' Below is the log file : --- ## [After upgrade to latest version some of watchers missing](https://discuss.elastic.co/t/after-upgrade-to-latest-version-some-of-watchers-missing/378198)
**Author:** [@dominbdg](https://discuss.elastic.co/u/dominbdg)\ **Replies:** 7\ **Last updated:** [June 30, 2025, 7:57am UTC](https://discuss.elastic.co/t/after-upgrade-to-latest-version-some-of-watchers-missing/378198 "2025-06-30T07:57:30Z")
Hello I have issue that after upgrade to latest elasticsearch version some of watchers in ELK are missing but working. Is it possible somehow to import them to be visible in Kibana ? --- ## [How to use ssl\_certificate\_authorities in Logstash?](https://discuss.elastic.co/t/how-to-use-ssl-certificate-authorities-in-logstash/379517)
**Author:** [@HarimbolaSantatra](https://discuss.elastic.co/u/HarimbolaSantatra)\ **Replies:** 6\ **Last updated:** [June 30, 2025, 6:56am UTC](https://discuss.elastic.co/t/how-to-use-ssl-certificate-authorities-in-logstash/379517 "2025-06-30T06:56:47Z")
I have the same issue discussed in this question. The error log is: sept. 12 14:57:47 local logstash\[45016\]: # File does not exist or cannot be opened /etc/logstash/certs/http\_ca.crt sept. 12 14:57:47 local logsta… --- ## [Elastic defend - network events - icmp traffic](https://discuss.elastic.co/t/elastic-defend-network-events-icmp-traffic/379599)
**Author:** [@Snow](https://discuss.elastic.co/u/Snow)\ **Replies:** 0\ **Last updated:** [June 30, 2025, 5:43am UTC](https://discuss.elastic.co/t/elastic-defend-network-events-icmp-traffic/379599 "2025-06-30T05:43:44Z")
Hi, I have installed only elastic defend. i similated few requests, under network events i could see logs ( connection attempted, connection accepted, disconnect received) but for icmp simulation like ping execution,… --- ## [Historical (Past) Data Ingestion in Time Series Data Stream](https://discuss.elastic.co/t/historical-past-data-ingestion-in-time-series-data-stream/379584)
**Author:** [@rubayetahmed314](https://discuss.elastic.co/u/rubayetahmed314)\ **Replies:** 14\ **Last updated:** [June 29, 2025, 6:04pm UTC](https://discuss.elastic.co/t/historical-past-data-ingestion-in-time-series-data-stream/379584 "2025-06-29T18:04:34Z")
Is it possible to insert historical (past) data into a Time Series Data Stream (TSDS) of Elasticsearch? To be more clear, suppose, I want to ingest NYC Taxi Trip Data from Year 2009 to 2024 in a time-series data stream. … --- ## [Seeking Acknowledgement on Multiple Vulnerability Reports](https://discuss.elastic.co/t/seeking-acknowledgement-on-multiple-vulnerability-reports/379590)
**Author:** [@skraft9](https://discuss.elastic.co/u/skraft9)\ **Replies:** 2\ **Last updated:** [June 28, 2025, 7:19pm UTC](https://discuss.elastic.co/t/seeking-acknowledgement-on-multiple-vulnerability-reports/379590 "2025-06-28T19:19:31Z")
I submitted multiple security vulnerability reports affecting Elastic software in April 2025. As of today, I have not received any acknowledgment from Elastic regarding the submissions. For internal reference, the Serv… --- ## [Containerized Fleet Server not maintaining persistence](https://discuss.elastic.co/t/containerized-fleet-server-not-maintaining-persistence/379586)
**Author:** [@Michael\_Preissner](https://discuss.elastic.co/u/Michael_Preissner)\ **Replies:** 2\ **Last updated:** [June 28, 2025, 2:47pm UTC](https://discuss.elastic.co/t/containerized-fleet-server-not-maintaining-persistence/379586 "2025-06-28T14:47:54Z")
I'm running elastic-agent-complete:9.0.2 with podman, mounting a /data directory to /usr/share/elastic-agent/data within the container. However, every time the container is restarted, it registers a new fleet server age… --- ## [Spring Boot 3.4.5 with jdk 21, Elastic APM agent 1.54 is not working during startup](https://discuss.elastic.co/t/spring-boot-3-4-5-with-jdk-21-elastic-apm-agent-1-54-is-not-working-during-startup/379580)
**Author:** [@Sameer\_Hindurao](https://discuss.elastic.co/u/Sameer_Hindurao)\ **Replies:** 0\ **Last updated:** [June 28, 2025, 7:38am UTC](https://discuss.elastic.co/t/spring-boot-3-4-5-with-jdk-21-elastic-apm-agent-1-54-is-not-working-during-startup/379580 "2025-06-28T07:38:00Z")
We are Migrating SpringBoot 3.0.1 to SprintBoot 3.4.5 jdk 17 to jdk 21 APM agent 1.54 and we are getting below error during start up of application, Application is working fine but were are not able to push APM details… --- ## [How to Access S3 bucket and list the files using logstash?](https://discuss.elastic.co/t/how-to-access-s3-bucket-and-list-the-files-using-logstash/379562)
**Author:** [@vijay117](https://discuss.elastic.co/u/vijay117)\ **Replies:** 1\ **Last updated:** [June 27, 2025, 6:52pm UTC](https://discuss.elastic.co/t/how-to-access-s3-bucket-and-list-the-files-using-logstash/379562 "2025-06-27T18:52:45Z")
How to Access S3 bucket and list the files using logstash --- ## [Filebeat output to Kafka GSLB](https://discuss.elastic.co/t/filebeat-output-to-kafka-gslb/379550)
**Author:** [@rehanpfmr](https://discuss.elastic.co/u/rehanpfmr)\ **Replies:** 4\ **Last updated:** [June 27, 2025, 3:48pm UTC](https://discuss.elastic.co/t/filebeat-output-to-kafka-gslb/379550 "2025-06-27T15:48:47Z")
We are trying to solve a problem here with filebeat agent, we want to introduce an GSLB infront of Kafka clusters. Basically we have 2 kafka clusters in 2 different zones, we want filebeat to output to kafka based on rea… --- ## [Debug elasticsearch without basic auth (xpack.security.enabled=false)](https://discuss.elastic.co/t/debug-elasticsearch-without-basic-auth-xpack-security-enabled-false/379566)
**Author:** [@softwaredoug](https://discuss.elastic.co/u/softwaredoug)\ **Replies:** 2\ **Last updated:** [June 27, 2025, 2:27pm UTC](https://discuss.elastic.co/t/debug-elasticsearch-without-basic-auth-xpack-security-enabled-false/379566 "2025-06-27T14:27:34Z")
Hi! I'm trying to startup Elasticsearch in a debugger via: ./gradlew run --debug-jvm I'm trying to also pass -Dxpack.security.enabled=false and I've tried a few things, including: export ES\_JAVA\_OPTS="-Dxpack.securi… --- ## [Http client did not trust this server's certificate, closing connection Netty4HttpChannel](https://discuss.elastic.co/t/http-client-did-not-trust-this-servers-certificate-closing-connection-netty4httpchannel/379418)
**Author:** [@zaeemmasood](https://discuss.elastic.co/u/zaeemmasood)\ **Replies:** 4\ **Last updated:** [June 27, 2025, 2:01pm UTC](https://discuss.elastic.co/t/http-client-did-not-trust-this-servers-certificate-closing-connection-netty4httpchannel/379418 "2025-06-27T14:01:27Z")
Hi All, Suddenly I was unable to execute any GET command via DevTools as I started getting 502 Bad gateway error as follows: GET /\_ssl/certificates { "statusCode": 502, "error": "Bad Gateway", "message": "certifi… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=57) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=59)