# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=62 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 63 --- ## [Use of retrievers in the search api](https://discuss.elastic.co/t/use-of-retrievers-in-the-search-api/379145)
**Author:** [@aperez900907](https://discuss.elastic.co/u/aperez900907)\ **Replies:** 2\ **Last updated:** [June 13, 2025, 3:00pm UTC](https://discuss.elastic.co/t/use-of-retrievers-in-the-search-api/379145 "2025-06-13T15:00:14Z")
Hi, I'm getting this error below: { "error": { "root\_cause": \[ { "type": "security\_exception", "reason": "current license is non-compliant for \[linear retriever\]", "license.expired.fe… --- ## [.NET NEST 7.17.5 and Elastic Version 9.0.2](https://discuss.elastic.co/t/net-nest-7-17-5-and-elastic-version-9-0-2/379165)
**Author:** [@urbanjasmine](https://discuss.elastic.co/u/urbanjasmine)\ **Replies:** 1\ **Last updated:** [June 13, 2025, 12:58pm UTC](https://discuss.elastic.co/t/net-nest-7-17-5-and-elastic-version-9-0-2/379165 "2025-06-13T12:58:07Z")
Hello everyone, We have been using the NEST .NET package to connect to Elastic and make calls/searches. Current situation: .NET Nest 7.17.5 Elastic version 8.16.3. To maintain compatibility, we are using the followi… --- ## [CTFd access issues](https://discuss.elastic.co/t/ctfd-access-issues/379148)
**Author:** [@crash2025](https://discuss.elastic.co/u/crash2025)\ **Replies:** 0\ **Last updated:** [June 12, 2025, 7:17pm UTC](https://discuss.elastic.co/t/ctfd-access-issues/379148 "2025-06-12T19:17:38Z")
Signed up for a free class but cannot access the lab. On step 5 it says to register but I do not get the screen . ANy idea of what to do ?? --- ## [Enrich IP address with custom mmdb database using ingest pipeline](https://discuss.elastic.co/t/enrich-ip-address-with-custom-mmdb-database-using-ingest-pipeline/379102)
**Author:** [@kuldeep\_gupta](https://discuss.elastic.co/u/kuldeep_gupta)\ **Replies:** 10\ **Last updated:** [June 12, 2025, 3:50pm UTC](https://discuss.elastic.co/t/enrich-ip-address-with-custom-mmdb-database-using-ingest-pipeline/379102 "2025-06-12T15:50:07Z")
I have below document in elasticsearch { "\_index": "test", "\_id": "guv6X5cBSvotes9C4gZS", "\_score": 1, "\_source": { "name": "Alice", "source.ip": "172.22.1.11" … --- ## [Ingest pipeline is not working for given document](https://discuss.elastic.co/t/ingest-pipeline-is-not-working-for-given-document/379099)
**Author:** [@kuldeep\_gupta](https://discuss.elastic.co/u/kuldeep_gupta)\ **Replies:** 6\ **Last updated:** [June 11, 2025, 5:02pm UTC](https://discuss.elastic.co/t/ingest-pipeline-is-not-working-for-given-document/379099 "2025-06-11T17:02:45Z")
i have below record which i want to process. \[ { "\_id": "GFk-X5cBY6REVzo7i86y", "\_index": "processor\_test", "\_source": { "event.original":"172.16.102.98 - - \[11/Jun/2025:19:05:43 +0530\] \\"POST /api/… --- ## [Inventory Alerting - More than 1 alerts for same hosts](https://discuss.elastic.co/t/inventory-alerting-more-than-1-alerts-for-same-hosts/379103)
**Author:** [@erikg](https://discuss.elastic.co/u/erikg)\ **Replies:** 2\ **Last updated:** [June 12, 2025, 1:44pm UTC](https://discuss.elastic.co/t/inventory-alerting-more-than-1-alerts-for-same-hosts/379103 "2025-06-12T13:44:29Z")
Hello, I am on Kibana/ES: v8.18.0 It appears that I created a memory usage Inventory alert. It works as expected until I notice 2 alerts pop up for the same host: Shouldn't it be one alert and until that recovers t… --- ## [How to show fild's contain throught connector log](https://discuss.elastic.co/t/how-to-show-filds-contain-throught-connector-log/379125)
**Author:** [@Dariia\_Hrebenichenko](https://discuss.elastic.co/u/Dariia_Hrebenichenko)\ **Replies:** 2\ **Last updated:** [June 12, 2025, 1:27pm UTC](https://discuss.elastic.co/t/how-to-show-filds-contain-throught-connector-log/379125 "2025-06-12T13:27:50Z")
Hello there! I'm working on an alerting system. I use Kibana connector log and Logstash to sand emails. For now I have rule to show just a count of files, but I would like to see the contain of field. For example, I … --- ## [\[Docker\] Elasticsearch Docker container stuck on "loaded module \[...\]" logs and never fully starts](https://discuss.elastic.co/t/docker-elasticsearch-docker-container-stuck-on-loaded-module-logs-and-never-fully-starts/378991)
**Author:** [@manbra](https://discuss.elastic.co/u/manbra)\ **Replies:** 11\ **Last updated:** [June 12, 2025, 12:39pm UTC](https://discuss.elastic.co/t/docker-elasticsearch-docker-container-stuck-on-loaded-module-logs-and-never-fully-starts/378991 "2025-06-12T12:39:18Z")
Description While running the Elasticsearch container (tag: docker.elastic.co/elasticsearch/elasticsearch:8.13.4), the service fails to complete startup and gets stuck after logging multiple loaded module \[...\] messages… --- ## [Elastic stack license](https://discuss.elastic.co/t/elastic-stack-license/379134)
**Author:** [@adilraad2001](https://discuss.elastic.co/u/adilraad2001)\ **Replies:** 1\ **Last updated:** [June 12, 2025, 11:57am UTC](https://discuss.elastic.co/t/elastic-stack-license/379134 "2025-06-12T11:57:51Z")
Hello Guys I have an Elastic stack deployed in my VM(On Premise) and now i want to buy License to open features like Connectors and ML is there anyone knew where i can find the prices of license (Standrad , Gold , Pla… --- ## [How to include a field value in message body in Rules and Connectors?](https://discuss.elastic.co/t/how-to-include-a-field-value-in-message-body-in-rules-and-connectors/379126)
**Author:** [@Dariia\_Hrebenichenko](https://discuss.elastic.co/u/Dariia_Hrebenichenko)\ **Replies:** 1\ **Last updated:** [June 12, 2025, 10:59am UTC](https://discuss.elastic.co/t/how-to-include-a-field-value-in-message-body-in-rules-and-connectors/379126 "2025-06-12T10:59:39Z")
Hello there! I'm working on an alerting system. I use Kibana connector log and Logstash to sand emails. For now I have rule to show just a count of files, but I want to include only specific fields in the message body… --- ## [Hide global nav and top nav](https://discuss.elastic.co/t/hide-global-nav-and-top-nav/379121)
**Author:** [@zhonglijun](https://discuss.elastic.co/u/zhonglijun)\ **Replies:** 1\ **Last updated:** [June 12, 2025, 10:50am UTC](https://discuss.elastic.co/t/hide-global-nav-and-top-nav/379121 "2025-06-12T10:50:58Z")
I set the embed query parameter and that hides both the global nav and the top nav. I'm trying to only apply this filter to the global (side) nav. Is there a simple way to achieve this? --- ## [Is it necessary to be running 7.17.28 before upgrade to 8?](https://discuss.elastic.co/t/is-it-necessary-to-be-running-7-17-28-before-upgrade-to-8/379129)
**Author:** [@mikewillis](https://discuss.elastic.co/u/mikewillis)\ **Replies:** 2\ **Last updated:** [June 12, 2025, 10:37am UTC](https://discuss.elastic.co/t/is-it-necessary-to-be-running-7-17-28-before-upgrade-to-8/379129 "2025-06-12T10:37:45Z")
Is it necessary to be running Elasticsearch 7.17.28 before upgrade to 8? An instance of Kibana upgrade assistant doesn't say anything about having to upgrade from 7.17.x that it's looking at. I can't find any documenta… --- ## [Elasticsearch died while starting up](https://discuss.elastic.co/t/elasticsearch-died-while-starting-up/378287)
**Author:** [@shubhi-gupta5](https://discuss.elastic.co/u/shubhi-gupta5)\ **Replies:** 17\ **Last updated:** [June 12, 2025, 8:41am UTC](https://discuss.elastic.co/t/elasticsearch-died-while-starting-up/378287 "2025-06-12T08:41:22Z")
Hi All, Running into this error while I am trying to deploy Elasticsearch v8.17.1 on ppc64le machine Gradle Version : 8.13 OS Info : Linux 5.14.0-503.38.1.el9\_5.ppc64le (ppc64le) JD… --- ## [Field Exists like capability in ES|QL](https://discuss.elastic.co/t/field-exists-like-capability-in-es-ql/379089)
**Author:** [@ashit\_pupu](https://discuss.elastic.co/u/ashit_pupu)\ **Replies:** 2\ **Last updated:** [June 12, 2025, 5:32am UTC](https://discuss.elastic.co/t/field-exists-like-capability-in-es-ql/379089 "2025-06-12T05:32:27Z")
Hi Team Reaching out to understand if there is any functionality available in ES|QL which could handle if a field doesn't exist. Currently if a field has never been indexed we don't have the field name in index mapping … --- ## [Monitor rule to detect failed pods](https://discuss.elastic.co/t/monitor-rule-to-detect-failed-pods/379106)
**Author:** [@marcelpineda](https://discuss.elastic.co/u/marcelpineda)\ **Replies:** 1\ **Last updated:** [June 11, 2025, 8:14pm UTC](https://discuss.elastic.co/t/monitor-rule-to-detect-failed-pods/379106 "2025-06-11T20:14:32Z")
I am trying to define Monitoring rule to detect pod status=failed. I've used Discover and the parameters below: Data view: pod-status-ad-hoc Filter: metrics.k8s.pod.phase: exists Query: ( ( "failed": \* ) AND ( "resou… --- ## [How to search for job title synonyms like "Product Manager", "PM", "Product Lead", etc.?](https://discuss.elastic.co/t/how-to-search-for-job-title-synonyms-like-product-manager-pm-product-lead-etc/379072)
**Author:** [@Orel\_Sapir](https://discuss.elastic.co/u/Orel_Sapir)\ **Replies:** 2\ **Last updated:** [June 11, 2025, 6:37pm UTC](https://discuss.elastic.co/t/how-to-search-for-job-title-synonyms-like-product-manager-pm-product-lead-etc/379072 "2025-06-11T18:37:36Z")
Hi everyone, I'm working on querying a collection of CVs using Elasticsearch. I want to search for the job title "Product Manager", but also retrieve results that include synonyms such as "PM", "Product Lead", "Product … --- ## ['Canvas' option not visible in my Elastic cloud deployment](https://discuss.elastic.co/t/canvas-option-not-visible-in-my-elastic-cloud-deployment/379086)
**Author:** [@Twan\_Scheffers](https://discuss.elastic.co/u/Twan_Scheffers)\ **Replies:** 7\ **Last updated:** [June 11, 2025, 2:26pm UTC](https://discuss.elastic.co/t/canvas-option-not-visible-in-my-elastic-cloud-deployment/379086 "2025-06-11T14:26:04Z")
Hello, I want to try out the 'Canvas' functionality in Kibana to see if we can use it for custom reporting. We created a hosted deployment (now version 9.0.2) with the following instances: Zone westeurope-1 Integratio… --- ## [Update doc in index](https://discuss.elastic.co/t/update-doc-in-index/379090)
**Author:** [@tazieviikz](https://discuss.elastic.co/u/tazieviikz)\ **Replies:** 0\ **Last updated:** [June 11, 2025, 9:26am UTC](https://discuss.elastic.co/t/update-doc-in-index/379090 "2025-06-11T09:26:20Z")
I need help with update docs in index. Filebeat upload CSV files from disk to index FB config - type: log id: persons enabled: true paths: - /data1/Logs/Preprod/Persons/\*.csv fields: log\_type: persons o… --- ## [Is it possible to setup 3 node elastic cluster without ca password](https://discuss.elastic.co/t/is-it-possible-to-setup-3-node-elastic-cluster-without-ca-password/379017)
**Author:** [@IamGuna](https://discuss.elastic.co/u/IamGuna)\ **Replies:** 2\ **Last updated:** [June 11, 2025, 9:20am UTC](https://discuss.elastic.co/t/is-it-possible-to-setup-3-node-elastic-cluster-without-ca-password/379017 "2025-06-11T09:20:58Z")
I was able to setup 3 node elastic cluster via elastic CA method - based on Setting up 3 node cluster for first time and getting errors - #2 by leandrojmp Now, the requirement is to use certs provided by org, certified … --- ## [Can filebeat's input and output sources support the Pulsar plugin?](https://discuss.elastic.co/t/can-filebeats-input-and-output-sources-support-the-pulsar-plugin/379084)
**Author:** [@BillXiangXBB](https://discuss.elastic.co/u/BillXiangXBB)\ **Replies:** 0\ **Last updated:** [June 11, 2025, 8:11am UTC](https://discuss.elastic.co/t/can-filebeats-input-and-output-sources-support-the-pulsar-plugin/379084 "2025-06-11T08:11:57Z")
Apache Pulsar is an open source distributed messaging middleware product, similar to Kafka. Now our projects use Pulsar to process stream data, but filebeat don't support it as an input/output source. --- ## [Elastic AI assistant - Dashboard recommendations](https://discuss.elastic.co/t/elastic-ai-assistant-dashboard-recommendations/379075)
**Author:** [@erikg](https://discuss.elastic.co/u/erikg)\ **Replies:** 0\ **Last updated:** [June 10, 2025, 9:48pm UTC](https://discuss.elastic.co/t/elastic-ai-assistant-dashboard-recommendations/379075 "2025-06-10T21:48:19Z")
Does Elastic AI assistant recommend you dashboards? For example, we are pretty good with filling in the description of the dashboard in Kibana, can elastic ai assistant read that and recommend me dashboards? --- ## [Fleet server failed to enroll](https://discuss.elastic.co/t/fleet-server-failed-to-enroll/379022)
**Author:** [@nerd](https://discuss.elastic.co/u/nerd)\ **Replies:** 2\ **Last updated:** [June 10, 2025, 7:25pm UTC](https://discuss.elastic.co/t/fleet-server-failed-to-enroll/379022 "2025-06-10T19:25:34Z")
Hi team, I’m currently facing issues enrolling the Fleet Server. During debugging, I encountered an EOF error, along with another related issue. Is there a known problem with Elastic Agent version 7.17.13, or could thi… --- ## [Fleet server enrolllment error](https://discuss.elastic.co/t/fleet-server-enrolllment-error/379047)
**Author:** [@nerd](https://discuss.elastic.co/u/nerd)\ **Replies:** 10\ **Last updated:** [June 10, 2025, 7:21pm UTC](https://discuss.elastic.co/t/fleet-server-enrolllment-error/379047 "2025-06-10T19:21:52Z")
Hey team am getting stuck on enrollment of fleet server am trying hard to debug but am get EOF and later --- ## [📌 \[Filebeat HTTPJSON\] Preserve Last Page Cursor for Next Run When Pagination Ends](https://discuss.elastic.co/t/filebeat-httpjson-preserve-last-page-cursor-for-next-run-when-pagination-ends/378501)
**Author:** [@mehrad\_ghalibafi](https://discuss.elastic.co/u/mehrad_ghalibafi)\ **Replies:** 3\ **Last updated:** [June 10, 2025, 6:51pm UTC](https://discuss.elastic.co/t/filebeat-httpjson-preserve-last-page-cursor-for-next-run-when-pagination-ends/378501 "2025-06-10T18:51:04Z")
Hi Elastic Team, I'm using Filebeat’s httpjson input to integrate with a paginated API that uses a next field for pagination. Here's what I have working so far: :white\_check\_mark: Current Working Setup response.pagina… --- ## [How to fetch dashboard queries](https://discuss.elastic.co/t/how-to-fetch-dashboard-queries/379066)
**Author:** [@Parthpuri\_Goswami](https://discuss.elastic.co/u/Parthpuri_Goswami)\ **Replies:** 1\ **Last updated:** [June 10, 2025, 6:41pm UTC](https://discuss.elastic.co/t/how-to-fetch-dashboard-queries/379066 "2025-06-10T18:41:07Z")
Hi all, I want to fetch dashboard and panel details with a query. Is it possible using an API? I have checked a few APIs, but they weren't helpful. For example, \[Get a list of dashboards | Kibana API documentation\](http… --- ## [Asset inventory view does not work for Serverless (security)](https://discuss.elastic.co/t/asset-inventory-view-does-not-work-for-serverless-security/379060)
**Author:** [@Scott\_Ross](https://discuss.elastic.co/u/Scott_Ross)\ **Replies:** 0\ **Last updated:** [June 10, 2025, 3:29pm UTC](https://discuss.elastic.co/t/asset-inventory-view-does-not-work-for-serverless-security/379060 "2025-06-10T15:29:49Z")
In the Elastic Security Serverless (GCP) we do not see data in the inventory tab (tech preview). this is the path in Kibana: /app/security/asset\_inventory?sourcerer=(default:(id:security-solution-default,selectedPattern… --- ## [Integrating rsyslog to logstash to include only fortinet syslog](https://discuss.elastic.co/t/integrating-rsyslog-to-logstash-to-include-only-fortinet-syslog/378912)
**Author:** [@DOkuwa](https://discuss.elastic.co/u/DOkuwa)\ **Replies:** 3\ **Last updated:** [June 10, 2025, 2:24pm UTC](https://discuss.elastic.co/t/integrating-rsyslog-to-logstash-to-include-only-fortinet-syslog/378912 "2025-06-10T14:24:33Z")
I have integrated rsyslog with logstash but cannot see the output in a standard output there are no error logs This is the logstash conf t input { udp { host =\> "10.200.253.122" port =\> 5140 type =\> "for… --- ## [Two field visualization in one table column, each in it's own row](https://discuss.elastic.co/t/two-field-visualization-in-one-table-column-each-in-its-own-row/378988)
**Author:** [@s.buksa](https://discuss.elastic.co/u/s.buksa)\ **Replies:** 9\ **Last updated:** [June 10, 2025, 2:14pm UTC](https://discuss.elastic.co/t/two-field-visualization-in-one-table-column-each-in-its-own-row/378988 "2025-06-10T14:14:45Z")
Hello, trying to figure out solution for the following case. I have log line which is structured as: Action=MarketingAction,Max Duration=400ms,Max Calls=3 Any ideas how to parse message using logstash filter in order … --- ## [Why does Logstash close idle TCP connections with RST instead of FIN?](https://discuss.elastic.co/t/why-does-logstash-close-idle-tcp-connections-with-rst-instead-of-fin/379000)
**Author:** [@vasek](https://discuss.elastic.co/u/vasek)\ **Replies:** 0\ **Last updated:** [June 9, 2025, 12:03pm UTC](https://discuss.elastic.co/t/why-does-logstash-close-idle-tcp-connections-with-rst-instead-of-fin/379000 "2025-06-09T12:03:44Z")
Hi Elastic team, I’m trying to better understand how client\_inactivity\_timeout works in Logstash, specifically in relation to how it closes idle TCP connections. Context: We have Winlogbeat agents sending logs over TCP… --- ## [ELK Stack and OS Upgrade Inquiry](https://discuss.elastic.co/t/elk-stack-and-os-upgrade-inquiry/379044)
**Author:** [@Wei\_Li](https://discuss.elastic.co/u/Wei_Li)\ **Replies:** 6\ **Last updated:** [June 10, 2025, 9:59am UTC](https://discuss.elastic.co/t/elk-stack-and-os-upgrade-inquiry/379044 "2025-06-10T09:59:25Z")
We currently have an Elasticsearch cluster with a valid license, consisting of 7 nodes deployed on VMs. The current version is 7.16.2. We are planning to upgrade both the ELK Stack and the underlying operating system. Ou… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=61) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=63)