# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=59 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 60 --- ## [Kibana shows older version despite new docker image](https://discuss.elastic.co/t/kibana-shows-older-version-despite-new-docker-image/379157)
**Author:** [@garetharmstrong](https://discuss.elastic.co/u/garetharmstrong)\ **Replies:** 11\ **Last updated:** [June 27, 2025, 1:42pm UTC](https://discuss.elastic.co/t/kibana-shows-older-version-despite-new-docker-image/379157 "2025-06-27T13:42:59Z")
Hey guys. I've got an Elasticsearch cluster (not in docker) that is currently running at version 8.18.2. I've upgraded that through apt, and the standard curl check confirms the version is above. However, my Kibana is ru… --- ## [Deprecated Index Lifecycle Policies](https://discuss.elastic.co/t/deprecated-index-lifecycle-policies/379563)
**Author:** [@garetharmstrong](https://discuss.elastic.co/u/garetharmstrong)\ **Replies:** 0\ **Last updated:** [June 27, 2025, 12:42pm UTC](https://discuss.elastic.co/t/deprecated-index-lifecycle-policies/379563 "2025-06-27T12:42:51Z")
Hi guys, I recently upgraded my ES/Kibana to 8.18.2 and I've noticed that some of the lifecycle policies are showing that they are deprecated. A couple, "metrics" and "logs" both have a lot of indexes applied to them. I… --- ## [Pannel visualization with ESQL doesn't support drilldown?](https://discuss.elastic.co/t/pannel-visualization-with-esql-doesnt-support-drilldown/379520)
**Author:** [@richard2025](https://discuss.elastic.co/u/richard2025)\ **Replies:** 1\ **Last updated:** [June 27, 2025, 9:06am UTC](https://discuss.elastic.co/t/pannel-visualization-with-esql-doesnt-support-drilldown/379520 "2025-06-27T09:06:00Z")
pannel visualization with ESQL doesn't support drilldown? --- ## [File system repository returning error](https://discuss.elastic.co/t/file-system-repository-returning-error/379330)
**Author:** [@JSElasticDiscuss](https://discuss.elastic.co/u/JSElasticDiscuss)\ **Replies:** 3\ **Last updated:** [June 27, 2025, 8:57am UTC](https://discuss.elastic.co/t/file-system-repository-returning-error/379330 "2025-06-27T08:57:42Z")
Hello, I have confirmed a valid path in my path.repo setting, but now when I do a 'verify repository' it gives me an error: { "name": "ResponseError", "message": "repository\_verification\_exception\\n\\tCaused by:\\n\\t… --- ## [Mapping conflict with alias field for IP](https://discuss.elastic.co/t/mapping-conflict-with-alias-field-for-ip/379534)
**Author:** [@dklenke1](https://discuss.elastic.co/u/dklenke1)\ **Replies:** 3\ **Last updated:** [June 27, 2025, 7:09am UTC](https://discuss.elastic.co/t/mapping-conflict-with-alias-field-for-ip/379534 "2025-06-27T07:09:13Z")
Hi, I am collecting access logs from different web proxies in elasticsearch. Depending on the software running they come with different fields. For example the http response code returned to the user is in the "code" fie… --- ## [Enrich Logs Without Breaking ECS or Overriding Default Pipelines](https://discuss.elastic.co/t/enrich-logs-without-breaking-ecs-or-overriding-default-pipelines/379523)
**Author:** [@khaled7](https://discuss.elastic.co/u/khaled7)\ **Replies:** 1\ **Last updated:** [June 27, 2025, 4:15am UTC](https://discuss.elastic.co/t/enrich-logs-without-breaking-ecs-or-overriding-default-pipelines/379523 "2025-06-27T04:15:42Z")
Hi everyone, I'm using the free version tier Elastic Stack v9.0.1 with the following setup: Kibana v9.0.1 - Elastic Agent (enrolled via Fleet) - Sysmon integration - Managed data streams like logs-windows.sysmon\_operati… --- ## [DocumentSubsetReader is holding on to large number of objects](https://discuss.elastic.co/t/documentsubsetreader-is-holding-on-to-large-number-of-objects/379455)
**Author:** [@vjgorla](https://discuss.elastic.co/u/vjgorla)\ **Replies:** 3\ **Last updated:** [June 27, 2025, 3:11am UTC](https://discuss.elastic.co/t/documentsubsetreader-is-holding-on-to-large-number-of-objects/379455 "2025-06-27T03:11:16Z")
On one of our nodes, NUM\_DOCS\_CACHE in elasticsearch/x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/security/authz/accesscontrol/DocumentSubsetReader.java at v8.11.1 · elastic/elasticsearch is holding on … --- ## [Range based join between two indices?](https://discuss.elastic.co/t/range-based-join-between-two-indices/379545)
**Author:** [@echan23](https://discuss.elastic.co/u/echan23)\ **Replies:** 1\ **Last updated:** [June 26, 2025, 6:11pm UTC](https://discuss.elastic.co/t/range-based-join-between-two-indices/379545 "2025-06-26T18:11:35Z")
I have two indices: IndexA with field Date\_time Index B with fields MoveInDateTime and MoveOutDateTime I want to join them on MoveInDateTime \<= Date\_time \<= MoveOutDateTime. Is this possible in Elasticsearch? If not,… --- ## [1 pipline not working](https://discuss.elastic.co/t/1-pipline-not-working/379542)
**Author:** [@Himanshu\_Yadav1](https://discuss.elastic.co/u/Himanshu_Yadav1)\ **Replies:** 1\ **Last updated:** [June 26, 2025, 5:18pm UTC](https://discuss.elastic.co/t/1-pipline-not-working/379542 "2025-06-26T17:18:04Z")
Hi Team, ELK version : I have setup one pipeline in logstash . In input i am using 4 file input for different files ingestion and in output same 4 i am pointing to elasticsearch . In kibana i am getting 4 different in… --- ## [Unable to deploy Metricbeat container as a non-root user, file permissions problem](https://discuss.elastic.co/t/unable-to-deploy-metricbeat-container-as-a-non-root-user-file-permissions-problem/379451)
**Author:** [@Dave\_Houser](https://discuss.elastic.co/u/Dave_Houser)\ **Replies:** 2\ **Last updated:** [June 26, 2025, 3:22pm UTC](https://discuss.elastic.co/t/unable-to-deploy-metricbeat-container-as-a-non-root-user-file-permissions-problem/379451 "2025-06-26T15:22:57Z")
I keep getting this error when trying to deploy metricbeat as a non-root user {"log.level":"info","@timestamp":"2025-06-24T19:31:08.770Z","log.origin":{"function":"github.com/elastic/beats/v7/libbeat/cmd/instance.(\*Beat… --- ## [Elastisearch query alert - recovering action does not contain context.hits](https://discuss.elastic.co/t/elastisearch-query-alert-recovering-action-does-not-contain-context-hits/379535)
**Author:** [@tdvo1996](https://discuss.elastic.co/u/tdvo1996)\ **Replies:** 0\ **Last updated:** [June 26, 2025, 2:56pm UTC](https://discuss.elastic.co/t/elastisearch-query-alert-recovering-action-does-not-contain-context-hits/379535 "2025-06-26T14:56:15Z")
Hi, If you have an Elasticsearch query, with GROUPED OVER top 20 container.name, and you specify a recovery action. Doesnt seem like the recovery action is able to fetch the context.hits object. Doesn't that kind of def… --- ## [Es Rejected Exception \[es\_rejected\_execution\_exception\]](https://discuss.elastic.co/t/es-rejected-exception-es-rejected-execution-exception/379530)
**Author:** [@Sathya\_R](https://discuss.elastic.co/u/Sathya_R)\ **Replies:** 2\ **Last updated:** [June 26, 2025, 1:28pm UTC](https://discuss.elastic.co/t/es-rejected-exception-es-rejected-execution-exception/379530 "2025-06-26T13:28:15Z")
I am getting Es rejected Exception. I am having Elasticsearch setup in a server of 188GB RAM,32 GB is assigned to JVM heap of Elastic search.Remaing is off heap memory. I am having ~1TB data space.and i am querying on … --- ## [How to display Kubernetes metadata (namespace, pod name) in Elastic APM UI for microservices?](https://discuss.elastic.co/t/how-to-display-kubernetes-metadata-namespace-pod-name-in-elastic-apm-ui-for-microservices/379450)
**Author:** [@Hadj\_Hassine\_Younes](https://discuss.elastic.co/u/Hadj_Hassine_Younes)\ **Replies:** 0\ **Last updated:** [June 24, 2025, 7:18pm UTC](https://discuss.elastic.co/t/how-to-display-kubernetes-metadata-namespace-pod-name-in-elastic-apm-ui-for-microservices/379450 "2025-06-24T19:18:26Z")
Hi everyone, Eck-stack version: 8.14.3 I'm using Elastic APM with OpenTelemetry to monitor microservices deployed in Kubernetes. I have the OpenTelemetry Collector configured with the k8sattributes processor to enrich … --- ## [Filebeats (Beats) and Logstash Best Practices Deployment Architecture](https://discuss.elastic.co/t/filebeats-beats-and-logstash-best-practices-deployment-architecture/379511)
**Author:** [@Matthew1](https://discuss.elastic.co/u/Matthew1)\ **Replies:** 0\ **Last updated:** [June 26, 2025, 8:49am UTC](https://discuss.elastic.co/t/filebeats-beats-and-logstash-best-practices-deployment-architecture/379511 "2025-06-26T08:49:53Z")
Hi Elastics Forum, I am trying to Forward Network Device logs in CEF via syslog into 2 different logstash for HA (High Availabilty) and load balancing. I have check that It can use Filebeats with logstash ouput and load… --- ## [Params.\_source is always null in script query](https://discuss.elastic.co/t/params-source-is-always-null-in-script-query/379484)
**Author:** [@ACoder](https://discuss.elastic.co/u/ACoder)\ **Replies:** 1\ **Last updated:** [June 26, 2025, 5:31am UTC](https://discuss.elastic.co/t/params-source-is-always-null-in-script-query/379484 "2025-06-26T05:31:44Z")
The following two queries should return the same results: GET iam-api-accounts/\_search { "query": { "bool": { "filter": { "script": { "script": """ return params.\_source?.roles?… --- ## [Elastic agent is not sending logs to Elastic search](https://discuss.elastic.co/t/elastic-agent-is-not-sending-logs-to-elastic-search/379500)
**Author:** [@Sudhir\_Takale](https://discuss.elastic.co/u/Sudhir_Takale)\ **Replies:** 0\ **Last updated:** [June 26, 2025, 5:06am UTC](https://discuss.elastic.co/t/elastic-agent-is-not-sending-logs-to-elastic-search/379500 "2025-06-26T05:06:53Z")
Hello everyone, I have springboot application & elastic agent running on same container in aws ECS farget service. I am getting APM traces, through APM java agent jar file. But I am not getting application logs . My a… --- ## [Cold tier node shows in overview, but not listed in cluster stats. Is it partially attached?](https://discuss.elastic.co/t/cold-tier-node-shows-in-overview-but-not-listed-in-cluster-stats-is-it-partially-attached/379453)
**Author:** [@qd-danh](https://discuss.elastic.co/u/qd-danh)\ **Replies:** 5\ **Last updated:** [June 26, 2025, 12:07am UTC](https://discuss.elastic.co/t/cold-tier-node-shows-in-overview-but-not-listed-in-cluster-stats-is-it-partially-attached/379453 "2025-06-26T00:07:11Z")
I'm thinking I have a node in my cold tier that is "hung" or in a bad state (hereafter referred to as instance 15, see screenshots). Like it's in the cluster but it's not fully in the cluster. Long story on how we got in… --- ## [Unable to run Kibana/Elasticsearch Windows Server](https://discuss.elastic.co/t/unable-to-run-kibana-elasticsearch-windows-server/379433)
**Author:** [@rrsearcher](https://discuss.elastic.co/u/rrsearcher)\ **Replies:** 4\ **Last updated:** [June 25, 2025, 8:17pm UTC](https://discuss.elastic.co/t/unable-to-run-kibana-elasticsearch-windows-server/379433 "2025-06-25T20:17:08Z")
I'm had tried to install Elasticsearch on a Windows server about 8 times but I am only experiencing problems. (On a single server (for a start) to for testing.) Steps: A) Downloaded the software (Elasticsearch and Kiba… --- ## ["\[s3-repository\] path is not accessible on master node" error in v9](https://discuss.elastic.co/t/s3-repository-path-is-not-accessible-on-master-node-error-in-v9/379476)
**Author:** [@ali.gunay](https://discuss.elastic.co/u/ali.gunay)\ **Replies:** 0\ **Last updated:** [June 25, 2025, 2:42pm UTC](https://discuss.elastic.co/t/s3-repository-path-is-not-accessible-on-master-node-error-in-v9/379476 "2025-06-25T14:42:14Z")
Hello, I could create a S3 repository and take snapshot in v8.18 but after updated elaticsearch version to v9 while we were trying to create a s3 repository we got above error. { "error": { "root\_cause": \[ … --- ## [Self-hosted ES startup fails after upgrading 8.18.0 -\> 8.18.2 due to changes in entitlements](https://discuss.elastic.co/t/self-hosted-es-startup-fails-after-upgrading-8-18-0-8-18-2-due-to-changes-in-entitlements/379440)
**Author:** [@fheinonen](https://discuss.elastic.co/u/fheinonen)\ **Replies:** 3\ **Last updated:** [June 25, 2025, 10:22am UTC](https://discuss.elastic.co/t/self-hosted-es-startup-fails-after-upgrading-8-18-0-8-18-2-due-to-changes-in-entitlements/379440 "2025-06-25T10:22:15Z")
In our self-hosted hardened RHEL 8 installed via RPM Elasticsearch 8.18.2 a node failed to start due to changes made here. What would be a sustainable way to fix this error? Just remove this addition from entitlement-pol… --- ## [Need help in automating to check if Kibana dashboard panels are populating](https://discuss.elastic.co/t/need-help-in-automating-to-check-if-kibana-dashboard-panels-are-populating/379458)
**Author:** [@Cindered](https://discuss.elastic.co/u/Cindered)\ **Replies:** 3\ **Last updated:** [June 25, 2025, 6:14am UTC](https://discuss.elastic.co/t/need-help-in-automating-to-check-if-kibana-dashboard-panels-are-populating/379458 "2025-06-25T06:14:17Z")
Hello! I am new to Kibana and Elastic Search. I am trying to automate the process of checking whether the panels on the Kibana dashboard are populating data or not. In particular, I want to identify if they show "No Res… --- ## [Logstash TLS enabled](https://discuss.elastic.co/t/logstash-tls-enabled/379213)
**Author:** [@devops\_training](https://discuss.elastic.co/u/devops_training)\ **Replies:** 3\ **Last updated:** [June 25, 2025, 6:01am UTC](https://discuss.elastic.co/t/logstash-tls-enabled/379213 "2025-06-25T06:01:33Z")
I have enabled TLS using the below config. output { if \[type\] == "dba" { elasticsearch { ecs\_compatibility =\> disabled hosts =\> \["https://${\*\*\*\*\*\*\*\*\*\*\*\*\*\*}:443"\] ssl =\> true cacert =\> "${ES… --- ## [Ingest pipeline pattern matching - much help needed](https://discuss.elastic.co/t/ingest-pipeline-pattern-matching-much-help-needed/379207)
**Author:** [@SteveParker](https://discuss.elastic.co/u/SteveParker)\ **Replies:** 12\ **Last updated:** [June 24, 2025, 1:13pm UTC](https://discuss.elastic.co/t/ingest-pipeline-pattern-matching-much-help-needed/379207 "2025-06-24T13:13:43Z")
Hi all I am using the following ES|QL to pattern match a substring in a field from a filebeat index - FROM filebeat-\* | WHERE url.original LIKE "q=" It would make a lot of sense to drop any incoming documents that do… --- ## [Changing weekly aggregations to start on Sundays in TSVB visuals](https://discuss.elastic.co/t/changing-weekly-aggregations-to-start-on-sundays-in-tsvb-visuals/379015)
**Author:** [@tflowers94](https://discuss.elastic.co/u/tflowers94)\ **Replies:** 1\ **Last updated:** [June 24, 2025, 1:07pm UTC](https://discuss.elastic.co/t/changing-weekly-aggregations-to-start-on-sundays-in-tsvb-visuals/379015 "2025-06-24T13:07:11Z")
Hello, We're using the TSVB visualization in Kibana to display calculated rates over time using the Filter Ratio aggregation within a time series. We prefer to analyze our data on a weekly basis (sun–sat). However, whe… --- ## [Need to upload Files as gz on to S3](https://discuss.elastic.co/t/need-to-upload-files-as-gz-on-to-s3/379436)
**Author:** [@suhassalavathsa782](https://discuss.elastic.co/u/suhassalavathsa782)\ **Replies:** 1\ **Last updated:** [June 24, 2025, 1:06pm UTC](https://discuss.elastic.co/t/need-to-upload-files-as-gz-on-to-s3/379436 "2025-06-24T13:06:39Z")
Hi, I am working on a functionality with logstash where it reads logs from AWS MSK Kafka and sends it to S3. I use the S3 output plugin and it sends in its default format as a .txt file. My requirement was to send logs b… --- ## [Filestream multiple file reading issue](https://discuss.elastic.co/t/filestream-multiple-file-reading-issue/378847)
**Author:** [@BnB](https://discuss.elastic.co/u/BnB)\ **Replies:** 15\ **Last updated:** [June 24, 2025, 12:39pm UTC](https://discuss.elastic.co/t/filestream-multiple-file-reading-issue/378847 "2025-06-24T12:39:59Z")
So here's my case: Im using Custom Logs (Filestream) integration on Elasticsearch. The way the files I want it to read is as follows: There are already multiple files that fit the "Paths" config, so it looks like this … --- ## [Drop user IP from logs after x days](https://discuss.elastic.co/t/drop-user-ip-from-logs-after-x-days/379253)
**Author:** [@dklenke1](https://discuss.elastic.co/u/dklenke1)\ **Replies:** 6\ **Last updated:** [June 24, 2025, 12:37pm UTC](https://discuss.elastic.co/t/drop-user-ip-from-logs-after-x-days/379253 "2025-06-24T12:37:00Z")
Hi, I'm new to elasticsearch and running version 9.0.2 deployed with the elastic operator 3.0.0 to my kubernetes cluster. I ingest access logs from multiple web proxies into elasticsearch. These logs contain the IP of t… --- ## [Elastic search v8.18.2 fails to boot up in FIPS mode because of MD5 invocation in ESQL plugin](https://discuss.elastic.co/t/elastic-search-v8-18-2-fails-to-boot-up-in-fips-mode-because-of-md5-invocation-in-esql-plugin/379118)
**Author:** [@k.rajendran](https://discuss.elastic.co/u/k.rajendran)\ **Replies:** 3\ **Last updated:** [June 24, 2025, 2:42am UTC](https://discuss.elastic.co/t/elastic-search-v8-18-2-fails-to-boot-up-in-fips-mode-because-of-md5-invocation-in-esql-plugin/379118 "2025-06-24T02:42:22Z")
I am trying to upgrade our Elasticsearch FIPS enabled cluster from v8.17.4 to 8.18.2. When I tried doing this the initialization failed with this error: \[2025-06-09T20:46:40,119\]\[ERROR\]\[o.e.b.Elasticsearch \]\[elasticsear… --- ## [Optimizing Elasticsearch Indexing for Real-Time IoT Sensor Data Streams](https://discuss.elastic.co/t/optimizing-elasticsearch-indexing-for-real-time-iot-sensor-data-streams/379421)
**Author:** [@aria\_234](https://discuss.elastic.co/u/aria_234)\ **Replies:** 1\ **Last updated:** [June 24, 2025, 2:27am UTC](https://discuss.elastic.co/t/optimizing-elasticsearch-indexing-for-real-time-iot-sensor-data-streams/379421 "2025-06-24T02:27:33Z")
Hi all, I'm currently setting up Elasticsearch to handle continuous, real-time IoT sensor data (temperature, humidity, motion, etc.). Essentially, multiple devices send small packets of data every few seconds, and I aim … --- ## [Wrong result by big index](https://discuss.elastic.co/t/wrong-result-by-big-index/378214)
**Author:** [@Alex\_Dgero](https://discuss.elastic.co/u/Alex_Dgero)\ **Replies:** 8\ **Last updated:** [June 23, 2025, 9:37pm UTC](https://discuss.elastic.co/t/wrong-result-by-big-index/378214 "2025-06-23T21:37:49Z")
Hello. I use elasticsearch v8.17.2. I need to do simple search by very big index 40M+ docs. But i works unexpected. My index have default analyzer without tokenization. So I can use only "phrase\_prefix" for search by sta… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=58) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=60)