# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=63 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 64 --- ## [Fleet indices prevent upgrade to Elasticsearch 9](https://discuss.elastic.co/t/fleet-indices-prevent-upgrade-to-elasticsearch-9/379006)
**Author:** [@sparkblaze](https://discuss.elastic.co/u/sparkblaze)\ **Replies:** 3\ **Last updated:** [June 10, 2025, 8:58am UTC](https://discuss.elastic.co/t/fleet-indices-prevent-upgrade-to-elasticsearch-9/379006 "2025-06-10T08:58:50Z")
I am trying to upgrade our test ELK stack from 8.x to 9.x. All of the components have been upgraded to 8.18.2 fine and have no issues. The Upgrade Assistant listed no critical issues and a handful of warnings (read-only… --- ## [Keep the hour range and set the day dynamically](https://discuss.elastic.co/t/keep-the-hour-range-and-set-the-day-dynamically/378922)
**Author:** [@Torado](https://discuss.elastic.co/u/Torado)\ **Replies:** 7\ **Last updated:** [June 10, 2025, 8:56am UTC](https://discuss.elastic.co/t/keep-the-hour-range-and-set-the-day-dynamically/378922 "2025-06-10T08:56:58Z")
Hello everyone, I've search for a long time, unfortunately I can't found any solution. Is it any way to set dynamically the day but keeping the date range fix when I creat a Kibana visualisation ? (I don't have access … --- ## [Filebeat: incorrect apt repository installation documentation](https://discuss.elastic.co/t/filebeat-incorrect-apt-repository-installation-documentation/378982)
**Author:** [@tom\_letter](https://discuss.elastic.co/u/tom_letter)\ **Replies:** 2\ **Last updated:** [June 10, 2025, 7:56am UTC](https://discuss.elastic.co/t/filebeat-incorrect-apt-repository-installation-documentation/378982 "2025-06-10T07:56:23Z")
Hi, at the time of writing this, the APT repository in filebeat documentation is not working. I believe that's due to a wrong URL. I managed to fix it using the same repository and key mentioned in elasticsearch/logst… --- ## [Index management best practice in ES 8](https://discuss.elastic.co/t/index-management-best-practice-in-es-8/379039)
**Author:** [@Coral\_Hayoun](https://discuss.elastic.co/u/Coral_Hayoun)\ **Replies:** 0\ **Last updated:** [June 10, 2025, 5:14am UTC](https://discuss.elastic.co/t/index-management-best-practice-in-es-8/379039 "2025-06-10T05:14:08Z")
Hello everyone, I have a pipeline where I store two types of entities in Elasticsearch, providing fast search filters and aggregation searches for my users. Entity Type 1: Needs to be stored indefinitely. Entity Type … --- ## [ELK stack in docker](https://discuss.elastic.co/t/elk-stack-in-docker/378721)
**Author:** [@piyush\_hn](https://discuss.elastic.co/u/piyush_hn)\ **Replies:** 12\ **Last updated:** [June 10, 2025, 6:07am UTC](https://discuss.elastic.co/t/elk-stack-in-docker/378721 "2025-06-10T06:07:18Z")
Hi All, I am working on a project to spin up ELK stack inside docker container. I have containers for elasticsearch/kibana up and running but whenever I am trying to run logstash it gives me the below error, I replace… --- ## [Elasticsearch Integration for Stack Monitoring fails](https://discuss.elastic.co/t/elasticsearch-integration-for-stack-monitoring-fails/378947)
**Author:** [@g\_ourmet](https://discuss.elastic.co/u/g_ourmet)\ **Replies:** 2\ **Last updated:** [June 9, 2025, 10:02pm UTC](https://discuss.elastic.co/t/elasticsearch-integration-for-stack-monitoring-fails/378947 "2025-06-09T22:02:12Z")
Good day, im running an ELK Stack version 8.17.7 with several Elastic-Agents. Problem Since the update from 8.17.6 to 8.17.7, self monitoring is no longer functional. Hence the idea to feed the stack monitoring with th… --- ## [Kibana: Trying to create a scripted field, but cannot figure out how retrieve the value of field 'client.domain'](https://discuss.elastic.co/t/kibana-trying-to-create-a-scripted-field-but-cannot-figure-out-how-retrieve-the-value-of-field-client-domain/378909)
**Author:** [@jba](https://discuss.elastic.co/u/jba)\ **Replies:** 2\ **Last updated:** [June 9, 2025, 8:30pm UTC](https://discuss.elastic.co/t/kibana-trying-to-create-a-scripted-field-but-cannot-figure-out-how-retrieve-the-value-of-field-client-domain/378909 "2025-06-09T20:30:08Z")
I have an index with data from our Bitbucket servers. The documents contains a lot of fields, but the one that is of interest to me is the keyword field client.domain (the FQDN of Jenkins servers). I want to create a scr… --- ## [Logstash output traffic significantly higher than input (minimal transformations) + TCP RST](https://discuss.elastic.co/t/logstash-output-traffic-significantly-higher-than-input-minimal-transformations-tcp-rst/378868)
**Author:** [@vasek](https://discuss.elastic.co/u/vasek)\ **Replies:** 23\ **Last updated:** [June 9, 2025, 1:38pm UTC](https://discuss.elastic.co/t/logstash-output-traffic-significantly-higher-than-input-minimal-transformations-tcp-rst/378868 "2025-06-09T13:38:56Z")
Hi, I'm investigating a situation where Logstash receives a certain amount of data, but the traffic sent from Logstash to Elasticsearch is significantly larger, even though I perform minimal transformations. Setup Inp… --- ## [How can i calculate cost of query?](https://discuss.elastic.co/t/how-can-i-calculate-cost-of-query/378995)
**Author:** [@Zoree](https://discuss.elastic.co/u/Zoree)\ **Replies:** 1\ **Last updated:** [June 9, 2025, 12:31pm UTC](https://discuss.elastic.co/t/how-can-i-calculate-cost-of-query/378995 "2025-06-09T12:31:06Z")
I want to create a functionality for calculating the cost of a query before it is launched, but I am interested in how to make very different queries. Suppose you think that 1 word = 1, operator "should" = 1,2, "mus"t = … --- ## [Logstash Filters not functioning](https://discuss.elastic.co/t/logstash-filters-not-functioning/378992)
**Author:** [@JJ192](https://discuss.elastic.co/u/JJ192)\ **Replies:** 1\ **Last updated:** [June 9, 2025, 8:58am UTC](https://discuss.elastic.co/t/logstash-filters-not-functioning/378992 "2025-06-09T08:58:20Z")
Hello, it seems that my filters are not working. I am not getting any errors and all data is available in the dashboard, but not with my filters applied. Is there any obvious issues that can be seen? Thanks! --- ## [Conditional if not working as expected](https://discuss.elastic.co/t/conditional-if-not-working-as-expected/378984)
**Author:** [@JJ192](https://discuss.elastic.co/u/JJ192)\ **Replies:** 1\ **Last updated:** [June 8, 2025, 8:30pm UTC](https://discuss.elastic.co/t/conditional-if-not-working-as-expected/378984 "2025-06-08T20:30:43Z")
Hello, I am attempting to add a tag to certain lines imported from a CSV file, depending on "10" being present in the "state\_id" field. I am not getting any error messages but the output is creating two indexes with all… --- ## [ECK Elasticsearch (9.0.1) Pod Stuck - 'Running' but Never 'Ready' (Local Storage)](https://discuss.elastic.co/t/eck-elasticsearch-9-0-1-pod-stuck-running-but-never-ready-local-storage/378900)
**Author:** [@Dror\_Roditti](https://discuss.elastic.co/u/Dror_Roditti)\ **Replies:** 1\ **Last updated:** [June 8, 2025, 7:01pm UTC](https://discuss.elastic.co/t/eck-elasticsearch-9-0-1-pod-stuck-running-but-never-ready-local-storage/378900 "2025-06-08T19:01:39Z")
ECK Elasticsearch (9.0.1) Pod Stuck - 'Running' but Never 'Ready' (Local Storage) Hello Elasticsearch Community, I'm facing a strange issue with a simple Elasticsearch deployment using ECK ( on my on-premise Kubernetes… --- ## [Elastic stack 10k EPS](https://discuss.elastic.co/t/elastic-stack-10k-eps/378903)
**Author:** [@adilraad2001](https://discuss.elastic.co/u/adilraad2001)\ **Replies:** 7\ **Last updated:** [June 7, 2025, 11:09pm UTC](https://discuss.elastic.co/t/elastic-stack-10k-eps/378903 "2025-06-07T23:09:49Z")
Hello guys i want to build my SIEM to handle at least 10000EPS what configuration should i do and what requirement need to use with what number of nodes and info i need --- ## [How to Visualize Prometheus Histogram Percentiles in Kibana (Metricbeat to Elasticsearch)](https://discuss.elastic.co/t/how-to-visualize-prometheus-histogram-percentiles-in-kibana-metricbeat-to-elasticsearch/378892)
**Author:** [@karjee](https://discuss.elastic.co/u/karjee)\ **Replies:** 1\ **Last updated:** [June 7, 2025, 5:56pm UTC](https://discuss.elastic.co/t/how-to-visualize-prometheus-histogram-percentiles-in-kibana-metricbeat-to-elasticsearch/378892 "2025-06-07T17:56:39Z")
I'm using the Prometheus Metricbeat module to scrape /metrics endpoints from a Go service running in EKS, and ship the metrics to Elasticsearch. Everything works fine and the data is available in Kibana. I'm particularl… --- ## [How to use Source in ElasticSearch Net](https://discuss.elastic.co/t/how-to-use-source-in-elasticsearch-net/366585)
**Author:** [@alikleitcr7](https://discuss.elastic.co/u/alikleitcr7)\ **Replies:** 2\ **Last updated:** [June 7, 2025, 5:05pm UTC](https://discuss.elastic.co/t/how-to-use-source-in-elasticsearch-net/366585 "2025-06-07T17:05:44Z")
How can I project fields in the Elasticsearch Net 8? I tried: SourceFilter filter = new SourceFilter(); filter.Includes = new List\() .. hm not the way SourceConfig sourceConfig = new SourceConfig(filter); Se… --- ## [Recovered node’s translog usage after replica is promoted to primary due to node loss](https://discuss.elastic.co/t/recovered-node-s-translog-usage-after-replica-is-promoted-to-primary-due-to-node-loss/378941)
**Author:** [@hamakim](https://discuss.elastic.co/u/hamakim)\ **Replies:** 3\ **Last updated:** [June 7, 2025, 8:42am UTC](https://discuss.elastic.co/t/recovered-node-s-translog-usage-after-replica-is-promoted-to-primary-due-to-node-loss/378941 "2025-06-07T08:42:36Z")
Hi, I have a question regarding shard recovery and translog handling in Elasticsearch. Let’s say a primary shard goes offline due to a sudden node failure. One of the replica shards is promoted to be the new primary. La… --- ## [Fleet server error: "Eat bulk checkin error; Keep on truckin'"](https://discuss.elastic.co/t/fleet-server-error-eat-bulk-checkin-error-keep-on-truckin/377477)
**Author:** [@Mario\_22](https://discuss.elastic.co/u/Mario_22)\ **Replies:** 1\ **Last updated:** [June 6, 2025, 9:06pm UTC](https://discuss.elastic.co/t/fleet-server-error-eat-bulk-checkin-error-keep-on-truckin/377477 "2025-06-06T21:06:00Z")
Hello, Since March 20, an error has appeared in the fleet-server logs {"log.level":"error","@timestamp":"2025-04-23T10:21:12.631Z","message":"Eat bulk checkin error; Keep on truckin'","component":{"binary":"fleet-serve… --- ## [Diskstat Windows - Could not return any performance counter](https://discuss.elastic.co/t/diskstat-windows-could-not-return-any-performance-counter/378033)
**Author:** [@dot-mike](https://discuss.elastic.co/u/dot-mike)\ **Replies:** 2\ **Last updated:** [June 6, 2025, 7:24pm UTC](https://discuss.elastic.co/t/diskstat-windows-could-not-return-any-performance-counter/378033 "2025-06-06T19:24:37Z")
Hi, I'm seeing many errors for Diskstat Windows with the error message Could not return any performance counter values for \\\\.\\K: .Error: Incorrect function. I'm using Elastic Agent with Windows integration. My questio… --- ## [Unexpected High Disk Utilization on All Frozen Nodes After Adding New Node in Elastic Cloud](https://discuss.elastic.co/t/unexpected-high-disk-utilization-on-all-frozen-nodes-after-adding-new-node-in-elastic-cloud/378910)
**Author:** [@SourabhK1](https://discuss.elastic.co/u/SourabhK1)\ **Replies:** 2\ **Last updated:** [June 6, 2025, 5:06pm UTC](https://discuss.elastic.co/t/unexpected-high-disk-utilization-on-all-frozen-nodes-after-adding-new-node-in-elastic-cloud/378910 "2025-06-06T17:06:36Z")
We’re using frozen tier in Elastic Cloud with searchable snapshots (fully mounted). Initially had 3 frozen nodes (~99.4% used disk capacity), and hit the 9000 shard limit. Added a 4th frozen node to increase capacity (… --- ## [Error during upgrade from Kibana 8.18.1 to 8.18.2](https://discuss.elastic.co/t/error-during-upgrade-from-kibana-8-18-1-to-8-18-2/378951)
**Author:** [@sbocquet](https://discuss.elastic.co/u/sbocquet)\ **Replies:** 1\ **Last updated:** [June 6, 2025, 4:04pm UTC](https://discuss.elastic.co/t/error-during-upgrade-from-kibana-8-18-1-to-8-18-2/378951 "2025-06-06T16:04:38Z")
Hi, On our Debain 12.x servers, we have an error when upgrading Kibana package from 8.18.1 to 8.18.2. root@elkglbvprd3:/etc/logstash/conf.d# apt install kibana Reading package lists... Done Building dependency tree... … --- ## [Filebeat Azure module - mapper\_parsing\_exception for field azure.signinlogs.properties.conditional\_access\_audiences](https://discuss.elastic.co/t/filebeat-azure-module-mapper-parsing-exception-for-field-azure-signinlogs-properties-conditional-access-audiences/378904)
**Author:** [@mczajkowski](https://discuss.elastic.co/u/mczajkowski)\ **Replies:** 1\ **Last updated:** [June 6, 2025, 3:31pm UTC](https://discuss.elastic.co/t/filebeat-azure-module-mapper-parsing-exception-for-field-azure-signinlogs-properties-conditional-access-audiences/378904 "2025-06-06T15:31:01Z")
Hello It seems there was a change in the Azure Singin logs syntax since 2025-06-04. Since that date the amount of logs grabbing by our Filebeat dramatically decreased. Debug log shows it is caused by "azure.signinlogs.… --- ## [Seeking advice for multiple object searches in array](https://discuss.elastic.co/t/seeking-advice-for-multiple-object-searches-in-array/378709)
**Author:** [@Pavel\_Stoyanov](https://discuss.elastic.co/u/Pavel_Stoyanov)\ **Replies:** 1\ **Last updated:** [June 6, 2025, 1:50pm UTC](https://discuss.elastic.co/t/seeking-advice-for-multiple-object-searches-in-array/378709 "2025-06-06T13:50:56Z")
Hi everyone, Me and my team have similar properties in our documents(of course we have multiple of these array of objects that we would like to query by): { ... "example\_array": \[ { "type": "som… --- ## [Novice trying to setup Kibana](https://discuss.elastic.co/t/novice-trying-to-setup-kibana/378823)
**Author:** [@SallySattary](https://discuss.elastic.co/u/SallySattary)\ **Replies:** 4\ **Last updated:** [June 6, 2025, 1:32pm UTC](https://discuss.elastic.co/t/novice-trying-to-setup-kibana/378823 "2025-06-06T13:32:52Z")
I have installed ELK stack myself on our staging and production VPS. It was all working absolutely fine a week ago. I'd set it up with authentication so we had to use our login credentials. I can see both kibana and Ela… --- ## [Setting up 3 node cluster for first time and getting errors](https://discuss.elastic.co/t/setting-up-3-node-cluster-for-first-time-and-getting-errors/378775)
**Author:** [@IamGuna](https://discuss.elastic.co/u/IamGuna)\ **Replies:** 12\ **Last updated:** [June 6, 2025, 1:24pm UTC](https://discuss.elastic.co/t/setting-up-3-node-cluster-for-first-time-and-getting-errors/378775 "2025-06-06T13:24:22Z")
I am trying to setup a 3 node cluster on RHEL 8.10 VMs with elasticsearch-8.18.1-linux-x86\_64.tar.gz. The ES\_JAVA\_HOME is configured with jdk-21.0.5 I have followed the steps from Set up HTTPS | Elastic Docs and generat… --- ## [Geo Data in Elastic](https://discuss.elastic.co/t/geo-data-in-elastic/378933)
**Author:** [@erikg](https://discuss.elastic.co/u/erikg)\ **Replies:** 3\ **Last updated:** [June 6, 2025, 11:41am UTC](https://discuss.elastic.co/t/geo-data-in-elastic/378933 "2025-06-06T11:41:05Z")
Hello, If i have a custom field & value like country.name: Italy how do I go about using this field to make a geo map? I have read there's a geoIP processor but thats for public ips only, I am looking for using the cu… --- ## [Kibana no longer working after upgrade](https://discuss.elastic.co/t/kibana-no-longer-working-after-upgrade/378870)
**Author:** [@axchauva](https://discuss.elastic.co/u/axchauva)\ **Replies:** 8\ **Last updated:** [June 6, 2025, 8:31am UTC](https://discuss.elastic.co/t/kibana-no-longer-working-after-upgrade/378870 "2025-06-06T08:31:21Z")
Hello I am newbie to Elasticsearch / Kibana and Debian. The system was installed / maintained by a former colleague who has left our company. I am following this procedure to upgrade to version 8.14.0. Elasticsearch in… --- ## [Fetch top k frequent fields](https://discuss.elastic.co/t/fetch-top-k-frequent-fields/378928)
**Author:** [@Parthpuri\_Goswami](https://discuss.elastic.co/u/Parthpuri_Goswami)\ **Replies:** 3\ **Last updated:** [June 6, 2025, 7:53am UTC](https://discuss.elastic.co/t/fetch-top-k-frequent-fields/378928 "2025-06-06T07:53:57Z")
Hi all, I want to fetch the top k fields that are most frequent in the last 5 minutes of documents or in whole index. I have tried some queries, as shown below, to get the desired output, but it's taking a long time. I … --- ## [Cannot run es with ERROR: Missing logging config file at xxx/log4j2.properties](https://discuss.elastic.co/t/cannot-run-es-with-error-missing-logging-config-file-at-xxx-log4j2-properties/378836)
**Author:** [@KevinFreeman](https://discuss.elastic.co/u/KevinFreeman)\ **Replies:** 3\ **Last updated:** [June 6, 2025, 6:09am UTC](https://discuss.elastic.co/t/cannot-run-es-with-error-missing-logging-config-file-at-xxx-log4j2-properties/378836 "2025-06-06T06:09:11Z")
es version: elasticsearch:8.18.0 yaml file. elastic: image: "${ELASTIC\_IMAGE}" container\_name: elastic read\_only: true user: "${UID:-1000}:${GID:-1000}" # Run as non-root user deploy: resou… --- ## [Kibana 8.18 Problem with generating PDF reports](https://discuss.elastic.co/t/kibana-8-18-problem-with-generating-pdf-reports/378926)
**Author:** [@hofrichterovak](https://discuss.elastic.co/u/hofrichterovak)\ **Replies:** 1\ **Last updated:** [June 6, 2025, 5:18am UTC](https://discuss.elastic.co/t/kibana-8-18-problem-with-generating-pdf-reports/378926 "2025-06-06T05:18:00Z")
Hello, I am using the user "elastic" to generate PDF reports. Everything worked on version 7.17, but after upgrading to version 8.18 it shows me an error when generating PDF reports - please, see image. What should I s… --- ## [Sample notebook for merging hnsw graphs](https://discuss.elastic.co/t/sample-notebook-for-merging-hnsw-graphs/378834)
**Author:** [@Chenzhe\_Jin](https://discuss.elastic.co/u/Chenzhe_Jin)\ **Replies:** 5\ **Last updated:** [June 5, 2025, 4:01pm UTC](https://discuss.elastic.co/t/sample-notebook-for-merging-hnsw-graphs/378834 "2025-06-05T16:01:44Z")
I am wondering whether or where I can find the sample code for this blog Speeding up merging of HNSW graphs - Elasticsearch Labs? [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=62) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=64)