# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=60 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 61 --- ## [Elasticsearch Machine Learning Architecture and Requirements](https://discuss.elastic.co/t/elasticsearch-machine-learning-architecture-and-requirements/379358)
**Author:** [@Wei\_Li](https://discuss.elastic.co/u/Wei_Li)\ **Replies:** 1\ **Last updated:** [June 23, 2025, 6:47pm UTC](https://discuss.elastic.co/t/elasticsearch-machine-learning-architecture-and-requirements/379358 "2025-06-23T18:47:10Z")
Hi, I'm looking into integrating machine learning capabilities with Elasticsearch and have a few questions regarding architectural considerations and prerequisites for ML features. 1.Architectural Placement of ML Compo… --- ## [Hyphen (dash) tokenizing](https://discuss.elastic.co/t/hyphen-dash-tokenizing/358226)
**Author:** [@ryans](https://discuss.elastic.co/u/ryans)\ **Replies:** 1\ **Last updated:** [June 23, 2025, 3:22pm UTC](https://discuss.elastic.co/t/hyphen-dash-tokenizing/358226 "2025-06-23T15:22:21Z")
Hello. I'm trying to make it so queries for "Tiger's-Eye" and "Tiger's Eye" and "Tiger Eye" and "Tiger-Eye" (without quotes) all return the same results WITHOUT USING SYNONYMS. I can do this part with my tokenizer and … --- ## [키바나에서 검색 한 내용을 CSV로 내보낼대 문제](https://discuss.elastic.co/t/csv/379343)
**Author:** [@Resso\_J](https://discuss.elastic.co/u/Resso_J)\ **Replies:** 3\ **Last updated:** [June 23, 2025, 9:57am UTC](https://discuss.elastic.co/t/csv/379343 "2025-06-23T09:57:58Z")
키바나에서 검색 결과를 CSV로 익스포트 해보니 text 필드와 동일한 keyword 필드가 같이 생성되고 있는데요. (ex. csv 익스포트시 abcd 라는 text필드와 abcd 라는 keyword 필드가 같이 익스포트 됨) keyword 필드와 text 필드가 중복으로 익스포트 되지 않게 하는 옵션 설정이 있을까요? --- ## [Use date range in DSL/KQL query](https://discuss.elastic.co/t/use-date-range-in-dsl-kql-query/379405)
**Author:** [@remco\_zwaan](https://discuss.elastic.co/u/remco_zwaan)\ **Replies:** 1\ **Last updated:** [June 23, 2025, 9:27am UTC](https://discuss.elastic.co/t/use-date-range-in-dsl-kql-query/379405 "2025-06-23T09:27:54Z")
We have a availability\_updated\_at field (date) which is automaticly updated when our partners update the availability. I want to filter out wich accos or NOT update NOT presentation : "as\_parent" and NOT availability\_… --- ## [Custom Plugin Visualization Panel Lagging Due to Long and Complex Formula](https://discuss.elastic.co/t/custom-plugin-visualization-panel-lagging-due-to-long-and-complex-formula/379391)
**Author:** [@sanicosoftware](https://discuss.elastic.co/u/sanicosoftware)\ **Replies:** 1\ **Last updated:** [June 23, 2025, 8:02am UTC](https://discuss.elastic.co/t/custom-plugin-visualization-panel-lagging-due-to-long-and-complex-formula/379391 "2025-06-23T08:02:50Z")
Hi Elastic Team, For a client of mine we have successfully created several custom visualizations for our Kibana Dashboard but whenever we attempt to add a long and complex custom Formula as the method for an accessor it… --- ## [Why the tooltip is not visible for Vertical Facet (vega-lite)?](https://discuss.elastic.co/t/why-the-tooltip-is-not-visible-for-vertical-facet-vega-lite/379362)
**Author:** [@Supriya1](https://discuss.elastic.co/u/Supriya1)\ **Replies:** 3\ **Last updated:** [June 23, 2025, 7:57am UTC](https://discuss.elastic.co/t/why-the-tooltip-is-not-visible-for-vertical-facet-vega-lite/379362 "2025-06-23T07:57:07Z")
Hi Team, I'm facing issue related to tooltip visibility for multiple vertical facets in vega-lite code of kibana dashboards, I am unable to see the tooltips for below facets charts since tooltips for the lower facet cha… --- ## [Unable to Analyze Invalid Beats Protocol Frame](https://discuss.elastic.co/t/unable-to-analyze-invalid-beats-protocol-frame/379399)
**Author:** [@Advay](https://discuss.elastic.co/u/Advay)\ **Replies:** 2\ **Last updated:** [June 22, 2025, 8:26pm UTC](https://discuss.elastic.co/t/unable-to-analyze-invalid-beats-protocol-frame/379399 "2025-06-22T20:26:08Z")
Dears, I’m currently troubleshooting an issue with my Logstash cluster and would appreciate some guidance. I’m consistently seeing the following warning in the Logstash logs: org.logstash.beats.InvalidFrameProtocolExc… --- ## [Kibana access control via front door or nginx](https://discuss.elastic.co/t/kibana-access-control-via-front-door-or-nginx/379395)
**Author:** [@Magister-Machinis](https://discuss.elastic.co/u/Magister-Machinis)\ **Replies:** 0\ **Last updated:** [June 22, 2025, 1:55pm UTC](https://discuss.elastic.co/t/kibana-access-control-via-front-door-or-nginx/379395 "2025-06-22T13:55:53Z")
Hello all, I see some related posts to this, but not quite the issue I have in mind so I'm hoping someone smarter than I can suggest a solution or two. For background, I'm just about done setting up an eck cluster in a… --- ## [Logstash not sends all data to ES](https://discuss.elastic.co/t/logstash-not-sends-all-data-to-es/379380)
**Author:** [@Mercato\_Dev](https://discuss.elastic.co/u/Mercato_Dev)\ **Replies:** 1\ **Last updated:** [June 21, 2025, 11:33am UTC](https://discuss.elastic.co/t/logstash-not-sends-all-data-to-es/379380 "2025-06-21T11:33:45Z")
I have 262K item in DB but logstash send only 228K to ES this is the logstash query input { jdbc { jdbc\_default\_timezone =\> "UTC" jdbc\_driver\_class =\> "org.postgresql.Driver" jdbc\_driver\_library =\> "/usr/share/logs… --- ## [Ingest Processor for array object data using script](https://discuss.elastic.co/t/ingest-processor-for-array-object-data-using-script/379375)
**Author:** [@adude946](https://discuss.elastic.co/u/adude946)\ **Replies:** 2\ **Last updated:** [June 20, 2025, 7:14pm UTC](https://discuss.elastic.co/t/ingest-processor-for-array-object-data-using-script/379375 "2025-06-20T19:14:23Z")
Need assist to get the Ingest pipeline processors to work correctly for my sample data. Its an array of objects, trying to create individual objects from each array object using a value data + prefix names based on these… --- ## [Depreciated Legacy visualization](https://discuss.elastic.co/t/depreciated-legacy-visualization/379325)
**Author:** [@hofrichterovak](https://discuss.elastic.co/u/hofrichterovak)\ **Replies:** 1\ **Last updated:** [June 20, 2025, 12:48pm UTC](https://discuss.elastic.co/t/depreciated-legacy-visualization/379325 "2025-06-20T12:48:54Z")
Hello, I read that Legacy visualization will be depreciated in the future. We have now Kibana version 8.18.1 and more dashboards (over 60) with visualizations. When we will upgrade Kibana in the future version where w… --- ## [Two different controls to be applied on two separate visualizations on one dashboard](https://discuss.elastic.co/t/two-different-controls-to-be-applied-on-two-separate-visualizations-on-one-dashboard/378943)
**Author:** [@rubic](https://discuss.elastic.co/u/rubic)\ **Replies:** 14\ **Last updated:** [June 20, 2025, 11:19am UTC](https://discuss.elastic.co/t/two-different-controls-to-be-applied-on-two-separate-visualizations-on-one-dashboard/378943 "2025-06-20T11:19:02Z")
Hi, I'm trying create dashboard which will allow users to compare two, the same graphs showing hourly jobs distribution break down by date. The goal is to apply two, different dates on each graph using controls - I kno… --- ## [How can i get the date in a visulization with date histogram of interval in minutes, i have tried this already- https://github.com/elastic/kibana/issues/177804](https://discuss.elastic.co/t/how-can-i-get-the-date-in-a-visulization-with-date-histogram-of-interval-in-minutes-i-have-tried-this-already-https-github-com-elastic-kibana-issues-177804/379355)
**Author:** [@shinysap](https://discuss.elastic.co/u/shinysap)\ **Replies:** 1\ **Last updated:** [June 20, 2025, 8:09am UTC](https://discuss.elastic.co/t/how-can-i-get-the-date-in-a-visulization-with-date-histogram-of-interval-in-minutes-i-have-tried-this-already-https-github-com-elastic-kibana-issues-177804/379355 "2025-06-20T08:09:16Z")
Dear Elastic Team, How can i get the date in a visulization with date histogram of interval in minutes. i have tried this already doesnt work- \[Lens\] Timestamp in Data Tables · Issue #177804 · elastic/kibana · GitHub --- ## [Recover deleted visulization/dashboard from Kibana](https://discuss.elastic.co/t/recover-deleted-visulization-dashboard-from-kibana/379346)
**Author:** [@esijati](https://discuss.elastic.co/u/esijati)\ **Replies:** 1\ **Last updated:** [June 20, 2025, 8:03am UTC](https://discuss.elastic.co/t/recover-deleted-visulization-dashboard-from-kibana/379346 "2025-06-20T08:03:01Z")
I have multiple kibana spaces for different teams and each team has created its own custom dashboard. One of the team member mistakely deleted a kibana dashboard (visulization were not saved) and now want to recover it. … --- ## [Top-Level knn with collapse: Accuracy-Performance Trade-off & Filter Behavior](https://discuss.elastic.co/t/top-level-knn-with-collapse-accuracy-performance-trade-off-filter-behavior/379349)
**Author:** [@Rami\_Salman](https://discuss.elastic.co/u/Rami_Salman)\ **Replies:** 1\ **Last updated:** [June 20, 2025, 7:36am UTC](https://discuss.elastic.co/t/top-level-knn-with-collapse-accuracy-performance-trade-off-filter-behavior/379349 "2025-06-20T07:36:50Z")
Hello Elasticsearch Community, I'm facing a critical challenge trying to balance search accuracy and performance when combining kNN queries with collapse and inner\_hits in Elasticsearch 8.17. I'm seeing a puzzling filte… --- ## [Mapping: Allowing to load booleans eagerly as global ordinals like keyword](https://discuss.elastic.co/t/mapping-allowing-to-load-booleans-eagerly-as-global-ordinals-like-keyword/375723)
**Author:** [@spinscale](https://discuss.elastic.co/u/spinscale)\ **Replies:** 3\ **Last updated:** [June 20, 2025, 7:32am UTC](https://discuss.elastic.co/t/mapping-allowing-to-load-booleans-eagerly-as-global-ordinals-like-keyword/375723 "2025-06-20T07:32:19Z")
Hey, keywords can be configured to be loaded eagerly as global ordinals in the mapping. This is important to not run into delays if a query hits a segment for first time. I've been wondering if such an option should al… --- ## [Unable to delete documents from full index](https://discuss.elastic.co/t/unable-to-delete-documents-from-full-index/379266)
**Author:** [@fgjensen](https://discuss.elastic.co/u/fgjensen)\ **Replies:** 17\ **Last updated:** [June 20, 2025, 5:37am UTC](https://discuss.elastic.co/t/unable-to-delete-documents-from-full-index/379266 "2025-06-20T05:37:42Z")
Hi; I have an application with one build-in Elasticsearch node used for collecting log events into 3 indices. The application is deployed at several sites. At some point in the future the implementation is going to be … --- ## [Difference between regular induces and logsdb (datastreams)](https://discuss.elastic.co/t/difference-between-regular-induces-and-logsdb-datastreams/379324)
**Author:** [@roman.stupko](https://discuss.elastic.co/u/roman.stupko)\ **Replies:** 3\ **Last updated:** [June 19, 2025, 8:21pm UTC](https://discuss.elastic.co/t/difference-between-regular-induces-and-logsdb-datastreams/379324 "2025-06-19T20:21:16Z")
Hi, I recently decided to move my k8s cluster logs from regular induces to logsdb type of datastreams. For my induces now i use: dynamic mapping for all string fields to keyword (except message field, which i use for… --- ## [Why i got different result of aggregation?](https://discuss.elastic.co/t/why-i-got-different-result-of-aggregation/379289)
**Author:** [@Zoree](https://discuss.elastic.co/u/Zoree)\ **Replies:** 1\ **Last updated:** [June 19, 2025, 4:56pm UTC](https://discuss.elastic.co/t/why-i-got-different-result-of-aggregation/379289 "2025-06-19T16:56:33Z")
I have queries with aggregation, the query section is the same for both, but the aggregation section is a little different and I don't understand why the different results are coming. agg1: { "aggs": { "Met… --- ## [Elast alert substring](https://discuss.elastic.co/t/elast-alert-substring/379329)
**Author:** [@elastic\_interogation](https://discuss.elastic.co/u/elastic_interogation)\ **Replies:** 1\ **Last updated:** [June 19, 2025, 2:48pm UTC](https://discuss.elastic.co/t/elast-alert-substring/379329 "2025-06-19T14:48:04Z")
Hello, I am trying to parse my alerts, I want to get only a substring of a field (my field name is message). Let me give you an example, actually, I use: { "text": """ {{#context.hits}} - {{\_source.message}} {{/co… --- ## [How to Alert When Elastic Agent Goes Offline?](https://discuss.elastic.co/t/how-to-alert-when-elastic-agent-goes-offline/379222)
**Author:** [@bakhtiyar](https://discuss.elastic.co/u/bakhtiyar)\ **Replies:** 7\ **Last updated:** [June 19, 2025, 1:22pm UTC](https://discuss.elastic.co/t/how-to-alert-when-elastic-agent-goes-offline/379222 "2025-06-19T13:22:58Z")
Hi everyone, I'm using Elastic Agent with Fleet and I can see the agent status (e.g., healthy, offline) from the Fleet → Agents UI in Kibana. Now, I want to create an alert that triggers when an agent goes offline for … --- ## [How to Balance Shards When Routing by field in Elasticsearch?](https://discuss.elastic.co/t/how-to-balance-shards-when-routing-by-field-in-elasticsearch/379328)
**Author:** [@Dimitris\_Makris](https://discuss.elastic.co/u/Dimitris_Makris)\ **Replies:** 0\ **Last updated:** [June 19, 2025, 1:33pm UTC](https://discuss.elastic.co/t/how-to-balance-shards-when-routing-by-field-in-elasticsearch/379328 "2025-06-19T13:33:24Z")
Background & Setup I have an Elasticsearch index that stores information about users. Each user belongs to a group, and every user document contains a group\_id field. All queries to Elasticsearch are filtered by group\_id,… --- ## [Creation of rule](https://discuss.elastic.co/t/creation-of-rule/379285)
**Author:** [@madhavsankarg](https://discuss.elastic.co/u/madhavsankarg)\ **Replies:** 3\ **Last updated:** [June 19, 2025, 9:43am UTC](https://discuss.elastic.co/t/creation-of-rule/379285 "2025-06-19T09:43:04Z")
HI Everyone, I was trying to create a rule using Elasticsearch Query with KQL. In the step while trying to select the Data View I am not able to select other ones which is available and cant even see the list of availab… --- ## [Configuring the collection of ELK stack logs using filebeat](https://discuss.elastic.co/t/configuring-the-collection-of-elk-stack-logs-using-filebeat/378392)
**Author:** [@Ruslan\_Hafizov](https://discuss.elastic.co/u/Ruslan_Hafizov)\ **Replies:** 3\ **Last updated:** [June 17, 2025, 7:48am UTC](https://discuss.elastic.co/t/configuring-the-collection-of-elk-stack-logs-using-filebeat/378392 "2025-06-17T07:48:30Z")
I deployed the stack in docker and ran into a log parsing problem. About the configuration: Docker - uses the default logging plugin - json. A label has also been added to the container - co.elastic.logs/module=kibana … --- ## [Elasticsearch 8.17.3: Stuck "update\_tsdb\_data\_stream\_end\_times" Pending Task Blocking ILM Policy](https://discuss.elastic.co/t/elasticsearch-8-17-3-stuck-update-tsdb-data-stream-end-times-pending-task-blocking-ilm-policy/378224)
**Author:** [@bpaoli](https://discuss.elastic.co/u/bpaoli)\ **Replies:** 4\ **Last updated:** [June 19, 2025, 5:30am UTC](https://discuss.elastic.co/t/elasticsearch-8-17-3-stuck-update-tsdb-data-stream-end-times-pending-task-blocking-ilm-policy/378224 "2025-06-19T05:30:15Z")
Environment Elasticsearch 8.17.3 in a 3-node cluster SLES-OS 12 VMs JDK 21.0.5+11-JRE (issue also occurred with embedded JDK (java 23) and Java 17) 30GB partition for Elasticsearch data 64GB RAM per VM with JVM settings… --- ## [Could not load FFI Provider: (NotImplementedError) FFI not available: null](https://discuss.elastic.co/t/could-not-load-ffi-provider-notimplementederror-ffi-not-available-null/363551)
**Author:** [@rohit\_dhiman](https://discuss.elastic.co/u/rohit_dhiman)\ **Replies:** 12\ **Last updated:** [June 18, 2025, 5:02pm UTC](https://discuss.elastic.co/t/could-not-load-ffi-provider-notimplementederror-ffi-not-available-null/363551 "2025-06-18T17:02:21Z")
1. Logstash version: 8.3.2 2. Logstash installation source: RPM 3. Running logstash by executing below command inside directory /usr/share/logstash/bin ./logstash -f /etc/logstash/conf.d/app-uat-vl… --- ## [Allocation awarenes vs data tiering problems](https://discuss.elastic.co/t/allocation-awarenes-vs-data-tiering-problems/378820)
**Author:** [@nisow95612](https://discuss.elastic.co/u/nisow95612)\ **Replies:** 16\ **Last updated:** [June 18, 2025, 3:03pm UTC](https://discuss.elastic.co/t/allocation-awarenes-vs-data-tiering-problems/378820 "2025-06-18T15:03:02Z")
Minimal setup is like this: Node Data tier Rack 1 data\_hot,data\_content A 2 data\_hot,data\_content B 3 data\_hot,data\_content B 4 data\_cold A 5 data\_cold B Node 1 failed. I expected elastic create new … --- ## [Elastic Agent fails to back up agent.yml from ConfigMap when using Fleet and Deployment mode on Kubernetes](https://discuss.elastic.co/t/elastic-agent-fails-to-back-up-agent-yml-from-configmap-when-using-fleet-and-deployment-mode-on-kubernetes/379288)
**Author:** [@pmungekar7](https://discuss.elastic.co/u/pmungekar7)\ **Replies:** 0\ **Last updated:** [June 18, 2025, 11:31am UTC](https://discuss.elastic.co/t/elastic-agent-fails-to-back-up-agent-yml-from-configmap-when-using-fleet-and-deployment-mode-on-kubernetes/379288 "2025-06-18T11:31:51Z")
Hi all, I'm deploying Elastic Agent in a Kubernetes cluster using Fleet and following the official Elastic documentation for advanced configuration. My use case is different from the common DaemonSet setup — I'm deployi… --- ## [Elastic node get OOM(Out of memory) when make estimateCost](https://discuss.elastic.co/t/elastic-node-get-oom-out-of-memory-when-make-estimatecost/379291)
**Author:** [@Zoree](https://discuss.elastic.co/u/Zoree)\ **Replies:** 0\ **Last updated:** [June 18, 2025, 12:36pm UTC](https://discuss.elastic.co/t/elastic-node-get-oom-out-of-memory-when-make-estimatecost/379291 "2025-06-18T12:36:54Z")
We get OOM when function estimate Cost trying to complete. How i understand our query is too large? Stacktrace: Status: error. Problem Suspect 1 920 instances of org.elasticsearch.index.IndexService, loaded by jdk.int… --- ## [Flattened field contains one immense field whose keyed encoding is longer than the allowed max length of 32766 bytes](https://discuss.elastic.co/t/flattened-field-contains-one-immense-field-whose-keyed-encoding-is-longer-than-the-allowed-max-length-of-32766-bytes/376520)
**Author:** [@Moni\_Hazarika](https://discuss.elastic.co/u/Moni_Hazarika)\ **Replies:** 7\ **Last updated:** [June 18, 2025, 11:58am UTC](https://discuss.elastic.co/t/flattened-field-contains-one-immense-field-whose-keyed-encoding-is-longer-than-the-allowed-max-length-of-32766-bytes/376520 "2025-06-18T11:58:51Z")
Hi Team, We are using Elasticsearch with dotnet client version as PackageReference Include="Elastic.Clients.Elasticsearch" Version="8.17.1" We have an index in elastic where the mapping looks like below "mappings": {… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=59) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=61)