# Elastic Stack

**URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=64

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 65

---

## [Sync 2 indices in the same cluster](https://discuss.elastic.co/t/sync-2-indices-in-the-same-cluster/359926)

<div class="topic-metadata">

**Author:** [@DanielR1](https://discuss.elastic.co/u/DanielR1)\
**Replies:** 6\
**Last updated:** [June 5, 2025, 3:35pm UTC](https://discuss.elastic.co/t/sync-2-indices-in-the-same-cluster/359926 "2025-06-05T15:35:03Z")

</div>

Hello! Is there a way to keep in sync two elasticsearch indices? Whatever is written by the app in one index, to be copied in a second index. It is not a viable solution to make the app writing at the same time to bot…

---

## [Error while getting SLM Stats from the Java Client](https://discuss.elastic.co/t/error-while-getting-slm-stats-from-the-java-client/378919)

<div class="topic-metadata">

**Author:** [@BenjaminD](https://discuss.elastic.co/u/BenjaminD)\
**Replies:** 3\
**Last updated:** [June 5, 2025, 3:21pm UTC](https://discuss.elastic.co/t/error-while-getting-slm-stats-from-the-java-client/378919 "2025-06-05T15:21:45Z")

</div>

Hi everyone. I'm using the Java client to handle some functionalities in my cluster. With the ElasticsearchSlmClient, I can create a policy and run it. But when I try to run slmClient.getStats(); I have the followin…

---

## [Role Mapping, I can´t see Index Templates](https://discuss.elastic.co/t/role-mapping-i-can-t-see-index-templates/368686)

<div class="topic-metadata">

**Author:** [@hofrichterovak](https://discuss.elastic.co/u/hofrichterovak)\
**Replies:** 4\
**Last updated:** [June 5, 2025, 3:01pm UTC](https://discuss.elastic.co/t/role-mapping-i-can-t-see-index-templates/368686 "2025-06-05T15:01:10Z")

</div>

Hello, I have a problem with Kibana rights. I have Kibana 7.17.23 with Platinum licence. When I would like to see Index Templates. Kibana logout me - on the picture: Other sections like Indices works fine. In DE…

---

## [Why can't we make the leader index as the follower, on the primary cluster in uni-directional CCR?](https://discuss.elastic.co/t/why-cant-we-make-the-leader-index-as-the-follower-on-the-primary-cluster-in-uni-directional-ccr/360880)

<div class="topic-metadata">

**Author:** [@Paresh\_Kalinani](https://discuss.elastic.co/u/Paresh_Kalinani)\
**Replies:** 1\
**Last updated:** [June 5, 2025, 1:45pm UTC](https://discuss.elastic.co/t/why-cant-we-make-the-leader-index-as-the-follower-on-the-primary-cluster-in-uni-directional-ccr/360880 "2025-06-05T13:45:39Z")

</div>

I have two clusters, the primary is called A and the secondary is B. I have indices in A for which I created follower indices in B. Now, I could pause the following, close, unfollow and open the indices in B to make th…

---

## [Error In Kibana After Upgrade to 9.x](https://discuss.elastic.co/t/error-in-kibana-after-upgrade-to-9-x/378817)

<div class="topic-metadata">

**Author:** [@Debasis\_Mallick](https://discuss.elastic.co/u/Debasis_Mallick)\
**Replies:** 5\
**Last updated:** [June 5, 2025, 1:00pm UTC](https://discuss.elastic.co/t/error-in-kibana-after-upgrade-to-9-x/378817 "2025-06-05T13:00:13Z")

</div>

HI Team, After upgrading kibana from 8.x to 9.x , we are experiencing below error in kibana log file. Due to which the stack monitoring we are not able to perform. {"service":{"node":{"roles":\["background\_tasks","ui"\]}…

---

## [Issue Storing Large Documents in Elasticsearch](https://discuss.elastic.co/t/issue-storing-large-documents-in-elasticsearch/378911)

<div class="topic-metadata">

**Author:** [@harsh\_bharkhda](https://discuss.elastic.co/u/harsh_bharkhda)\
**Replies:** 3\
**Last updated:** [June 5, 2025, 12:40pm UTC](https://discuss.elastic.co/t/issue-storing-large-documents-in-elasticsearch/378911 "2025-06-05T12:40:37Z")

</div>

I'm facing an issue while trying to index large data objects in Elasticsearch. When the object size increases (possibly due to a large metadata field), the document fails to get indexed, but no clear error is returned in…

---

## [Snapshot Restore to 9.0.1 Fails Despite Setting \`index.blocks.write=true\` on Source Index in 8.7.1](https://discuss.elastic.co/t/snapshot-restore-to-9-0-1-fails-despite-setting-index-blocks-write-true-on-source-index-in-8-7-1/378853)

<div class="topic-metadata">

**Author:** [@Bojan\_Komazec](https://discuss.elastic.co/u/Bojan_Komazec)\
**Replies:** 10\
**Last updated:** [June 5, 2025, 9:17am UTC](https://discuss.elastic.co/t/snapshot-restore-to-9-0-1-fails-despite-setting-index-blocks-write-true-on-source-index-in-8-7-1/378853 "2025-06-05T09:17:35Z")

</div>

Hi all, I'm attempting to restore a snapshot from an Elasticsearch 8.7.1 cluster into a 9.0.1 cluster running via ECK on AWS EKS. I have full access to both clusters. The snapshot was taken in 8.7.1 and includes some o…

---

## [Issue with Multi terms aggregation with Boolean field](https://discuss.elastic.co/t/issue-with-multi-terms-aggregation-with-boolean-field/378585)

<div class="topic-metadata">

**Author:** [@bsehra](https://discuss.elastic.co/u/bsehra)\
**Replies:** 15\
**Last updated:** [June 5, 2025, 9:04am UTC](https://discuss.elastic.co/t/issue-with-multi-terms-aggregation-with-boolean-field/378585 "2025-06-05T09:04:45Z")

</div>

I'm using Elasticsearch server 8.17.3 and Elasticsearch net Client 8.17.3. Looks like there is an issue with Elasticsearch resolving the multi terms aggregation involving a boolean field. I get below error where as I'm o…

---

## [Search Exports under Kibana (10 million documents)](https://discuss.elastic.co/t/search-exports-under-kibana-10-million-documents/378894)

<div class="topic-metadata">

**Author:** [@smm](https://discuss.elastic.co/u/smm)\
**Replies:** 2\
**Last updated:** [June 5, 2025, 8:43am UTC](https://discuss.elastic.co/t/search-exports-under-kibana-10-million-documents/378894 "2025-06-05T08:43:18Z")

</div>

Hi there, in an elk stack with basic licence for now (version 8.17.x), I would like to export about 10 million syslog documents out of Kibana. Is there a better way then 'export as a csv file'? Or how can I config the e…

---

## [SAN a valid option for an ELK stack?](https://discuss.elastic.co/t/san-a-valid-option-for-an-elk-stack/378888)

<div class="topic-metadata">

**Author:** [@smm](https://discuss.elastic.co/u/smm)\
**Replies:** 4\
**Last updated:** [June 5, 2025, 8:44am UTC](https://discuss.elastic.co/t/san-a-valid-option-for-an-elk-stack/378888 "2025-06-05T08:44:27Z")

</div>

Dear community, a quick question: I need space for my indices. Is local storage the only best option for hot data or is SAN a valid option too? I am running a 8.17.x, single node, productive, dockerized all-in-one solu…

---

## [We are using Elasticsearch version 8.13, We have continuous heavy aggregation queries, it is making whole cluster unstable](https://discuss.elastic.co/t/we-are-using-elasticsearch-version-8-13-we-have-continuous-heavy-aggregation-queries-it-is-making-whole-cluster-unstable/378699)

<div class="topic-metadata">

**Author:** [@KunwarAkanksha](https://discuss.elastic.co/u/KunwarAkanksha)\
**Replies:** 6\
**Last updated:** [June 5, 2025, 6:55am UTC](https://discuss.elastic.co/t/we-are-using-elasticsearch-version-8-13-we-have-continuous-heavy-aggregation-queries-it-is-making-whole-cluster-unstable/378699 "2025-06-05T06:55:59Z")

</div>

We have a heavy load aggregation , which cause circuit breaker quite often, I want to handle this before hand as the more ciicuit breakers are making our whole cluster unstable and many times it is making node with .secu…

---

## [How to Visualize Prometheus Histogram Percentiles in Kibana (Metricbeat to Elasticsearch)](https://discuss.elastic.co/t/how-to-visualize-prometheus-histogram-percentiles-in-kibana-metricbeat-to-elasticsearch/378890)

<div class="topic-metadata">

**Author:** [@Kanchan\_Karjee](https://discuss.elastic.co/u/Kanchan_Karjee)\
**Replies:** 1\
**Last updated:** [June 5, 2025, 5:45am UTC](https://discuss.elastic.co/t/how-to-visualize-prometheus-histogram-percentiles-in-kibana-metricbeat-to-elasticsearch/378890 "2025-06-05T05:45:18Z")

</div>

I'm using the Prometheus Metricbeat module to scrape /metrics endpoints from a Go service running in EKS, and ship the metrics to Elasticsearch. Everything works fine and the data is available in Kibana. I'm particularl…

---

## [Renew auto generated http certificates](https://discuss.elastic.co/t/renew-auto-generated-http-certificates/362929)

<div class="topic-metadata">

**Author:** [@Shaoranlaos](https://discuss.elastic.co/u/Shaoranlaos)\
**Replies:** 6\
**Last updated:** [June 5, 2025, 4:23am UTC](https://discuss.elastic.co/t/renew-auto-generated-http-certificates/362929 "2025-06-05T04:23:18Z")

</div>

Hello, can anyone help me how to renew the http certificates of the elasticsearch nodes in a autoconfigured on-prem cluster? The current ones were generated automatically from the enrollment process / at startup of the…

---

## [unable to set up my lab in the Learner Dashboard](https://discuss.elastic.co/t/unable-to-set-up-my-lab-in-the-learner-dashboard/378880)

<div class="topic-metadata">

**Author:** [@Abebes](https://discuss.elastic.co/u/Abebes)\
**Replies:** 1\
**Last updated:** [June 4, 2025, 8:08pm UTC](https://discuss.elastic.co/t/unable-to-set-up-my-lab-in-the-learner-dashboard/378880 "2025-06-04T20:08:39Z")

</div>

I am unable to set up my lab in the Learner Dashboard. I have received the confirmation of enrollment and successfully logged in to the training portal; however, I do not see the class title under "My Enrollments" in the…

---

## [Visualization issue in Kibana dashboard after upgrade to v8.17.1](https://discuss.elastic.co/t/visualization-issue-in-kibana-dashboard-after-upgrade-to-v8-17-1/374012)

<div class="topic-metadata">

**Author:** [@SaraAlshamsi](https://discuss.elastic.co/u/SaraAlshamsi)\
**Replies:** 8\
**Last updated:** [June 4, 2025, 6:01pm UTC](https://discuss.elastic.co/t/visualization-issue-in-kibana-dashboard-after-upgrade-to-v8-17-1/374012 "2025-06-04T18:01:29Z")

</div>

Hello, I have an issue with some visualization objects after we upgraded Kibana to v8.17.1. I created a dashboard when Kibana was v8.15.3. The dashboard contained multiple objects such as TSVB (markdown), Vega, lens (…

---

## [Can't start docker-compose elasticsearch](https://discuss.elastic.co/t/cant-start-docker-compose-elasticsearch/378860)

<div class="topic-metadata">

**Author:** [@Hasan\_Basri](https://discuss.elastic.co/u/Hasan_Basri)\
**Replies:** 1\
**Last updated:** [June 4, 2025, 1:41pm UTC](https://discuss.elastic.co/t/cant-start-docker-compose-elasticsearch/378860 "2025-06-04T13:41:22Z")

</div>

hello, I have a problem when running elastic using docker-compose with the error that appears is /usr/share/elasticsearch/bin/elasticsearch-env: line 158: cannot create temp file for here-document: Permission denied

---

## [Alerts indices custom components template](https://discuss.elastic.co/t/alerts-indices-custom-components-template/378731)

<div class="topic-metadata">

**Author:** [@aptfinf](https://discuss.elastic.co/u/aptfinf)\
**Replies:** 9\
**Last updated:** [June 4, 2025, 1:20pm UTC](https://discuss.elastic.co/t/alerts-indices-custom-components-template/378731 "2025-06-04T13:20:38Z")

</div>

Hello everyone, I have a question: I know that for the "logs" indices templates exists the component template "@custom" that gets automatically mapped to the index templates. Does this same thing exist for the ".intern…

---

## [Understand fleet pipelines and reroute](https://discuss.elastic.co/t/understand-fleet-pipelines-and-reroute/378804)

<div class="topic-metadata">

**Author:** [@mistrhanky1](https://discuss.elastic.co/u/mistrhanky1)\
**Replies:** 2\
**Last updated:** [June 3, 2025, 7:59pm UTC](https://discuss.elastic.co/t/understand-fleet-pipelines-and-reroute/378804 "2025-06-03T19:59:29Z")

</div>

I need to, for a number of reasons, reroute the output of a fleet pipeline. To keep it very simple, lets use the fortigate integration as the example. I want my data to come in via elastic agent(working), be processed by…

---

## [Group/update events in Elastic](https://discuss.elastic.co/t/group-update-events-in-elastic/378600)

<div class="topic-metadata">

**Author:** [@miguel4](https://discuss.elastic.co/u/miguel4)\
**Replies:** 1\
**Last updated:** [June 3, 2025, 1:39pm UTC](https://discuss.elastic.co/t/group-update-events-in-elastic/378600 "2025-06-03T13:39:32Z")

</div>

Hello, I post a question about a use case we have on our ELK architecture. We are setting up an infrastructure with Logstash + Elasticsearch + Kibana. The same event (same value for a given ID field but another differen…

---

## [Planning 8 PB Elasticsearch Deployment – Is Free Tier Sufficient or Will Licensing Be a Limitation?](https://discuss.elastic.co/t/planning-8-pb-elasticsearch-deployment-is-free-tier-sufficient-or-will-licensing-be-a-limitation/378813)

<div class="topic-metadata">

**Author:** [@emad\_omara](https://discuss.elastic.co/u/emad_omara)\
**Replies:** 5\
**Last updated:** [June 3, 2025, 1:09pm UTC](https://discuss.elastic.co/t/planning-8-pb-elasticsearch-deployment-is-free-tier-sufficient-or-will-licensing-be-a-limitation/378813 "2025-06-03T13:09:03Z")

</div>

Hi all, I'm planning a large-scale self-managed Elasticsearch deployment for an application that will eventually handle around 8 petabytes (PB) of data I'm currently evaluating whether the Basic (free) license of Elast…

---

## [LDAP Connection Elastic](https://discuss.elastic.co/t/ldap-connection-elastic/377281)

<div class="topic-metadata">

**Author:** [@vahagg1](https://discuss.elastic.co/u/vahagg1)\
**Replies:** 9\
**Last updated:** [June 3, 2025, 11:27am UTC](https://discuss.elastic.co/t/ldap-connection-elastic/377281 "2025-06-03T11:27:48Z")

</div>

I have a LDAP connection from a single Elastic to LDAP server which is Active Directory i use ldap not ldaps and get following error \[2025-04-18T11:59:27,596\]\[WARN \]\[o.e.x.s.a.l.s.LdapUtils \] \[elk\] Failed to obtain LD…

---

## [X509: certificate signed by unknown authority](https://discuss.elastic.co/t/x509-certificate-signed-by-unknown-authority/378684)

<div class="topic-metadata">

**Author:** [@madhavsankarg](https://discuss.elastic.co/u/madhavsankarg)\
**Replies:** 2\
**Last updated:** [June 3, 2025, 12:44pm UTC](https://discuss.elastic.co/t/x509-certificate-signed-by-unknown-authority/378684 "2025-06-03T12:44:12Z")

</div>

Hi All, Hearbeat version - 8.14.1 The certificate is updated for the specific URL, still in Uptime monitor we are getting the error x509: certificate signed by unknown authority. I can confirm that the CHain of the cer…

---

## [\[ERROR\]\[logstash.agent \] Failed to execute action](https://discuss.elastic.co/t/error-logstash-agent-failed-to-execute-action/378805)

<div class="topic-metadata">

**Author:** [@Reyhan](https://discuss.elastic.co/u/Reyhan)\
**Replies:** 2\
**Last updated:** [June 3, 2025, 8:41am UTC](https://discuss.elastic.co/t/error-logstash-agent-failed-to-execute-action/378805 "2025-06-03T08:41:58Z")

</div>

Was working on logstash and got stuck with this error: \< \[2025-05-28T06:57:49,669\]\[ERROR\]\[logstash.agent \] Failed to execute action {:action=\>LogStash::PipelineAction::Create/pipeline\_id:main, :exception=\>"Lo…

---

## [Issue when I am trying to upgraded Elasticsearch cluster from Elasticsearch 7.17.28 to 8.17.6,](https://discuss.elastic.co/t/issue-when-i-am-trying-to-upgraded-elasticsearch-cluster-from-elasticsearch-7-17-28-to-8-17-6/378807)

<div class="topic-metadata">

**Author:** [@kuroro](https://discuss.elastic.co/u/kuroro)\
**Replies:** 2\
**Last updated:** [June 3, 2025, 7:27am UTC](https://discuss.elastic.co/t/issue-when-i-am-trying-to-upgraded-elasticsearch-cluster-from-elasticsearch-7-17-28-to-8-17-6/378807 "2025-06-03T07:27:48Z")

</div>

Hi Everyone, I am trying to upgrade Elasticsearch cluster version from 7.17.28 to 8.17.6. I could see one node was successfully upgraded from 7.17.28 to 8.17.6, and it was automatically removed from the 7.x cluster aft…

---

## [HTTP Output errors - failed to response when sending to Splunk HF](https://discuss.elastic.co/t/http-output-errors-failed-to-response-when-sending-to-splunk-hf/378811)

<div class="topic-metadata">

**Author:** [@bonecruizer](https://discuss.elastic.co/u/bonecruizer)\
**Replies:** 0\
**Last updated:** [June 3, 2025, 7:04am UTC](https://discuss.elastic.co/t/http-output-errors-failed-to-response-when-sending-to-splunk-hf/378811 "2025-06-03T07:04:16Z")

</div>

We have a setup where a Logstash machine (v7.17.28) sends to a Splunk Heavy Forwarder using HTTP. We see a lot of HTTP Output errors and I am unable to find the cause. All data seems to arrive correctly. The error is (…

---

## [Trying out ES 9 — any Java API changes?](https://discuss.elastic.co/t/trying-out-es-9-any-java-api-changes/376812)

<div class="topic-metadata">

**Author:** [@KajMagnus](https://discuss.elastic.co/u/KajMagnus)\
**Replies:** 16\
**Last updated:** [June 2, 2025, 9:38pm UTC](https://discuss.elastic.co/t/trying-out-es-9-any-java-api-changes/376812 "2025-06-02T21:38:34Z")

</div>

When upgrading from Elasticsearch 8 to 9, do I need to update my application server Java code? I use the ES 8 Java API to talk to an ES 8 (and 9?) server. Is there any ES Java client version 9, for talking with ES serve…

---

## [ES node enrolment error](https://discuss.elastic.co/t/es-node-enrolment-error/378788)

<div class="topic-metadata">

**Author:** [@sreya\_14](https://discuss.elastic.co/u/sreya_14)\
**Replies:** 1\
**Last updated:** [June 2, 2025, 8:49pm UTC](https://discuss.elastic.co/t/es-node-enrolment-error/378788 "2025-06-02T20:49:31Z")

</div>

While enrolling a node I am getting below error ERROR: Aborting enrolling to cluster. This node doesn't appear to be auto-configured for security. Expected configuration is missing from elasticsearch.yml., with exit cod…

---

## [Unable to use repository-azure plugin to connect to Azure storage account in Gov cloud](https://discuss.elastic.co/t/unable-to-use-repository-azure-plugin-to-connect-to-azure-storage-account-in-gov-cloud/378147)

<div class="topic-metadata">

**Author:** [@dfinn](https://discuss.elastic.co/u/dfinn)\
**Replies:** 2\
**Last updated:** [June 2, 2025, 6:31pm UTC](https://discuss.elastic.co/t/unable-to-use-repository-azure-plugin-to-connect-to-azure-storage-account-in-gov-cloud/378147 "2025-06-02T18:31:52Z")

</div>

We successfully use the repository-azure plugin to use azure blob storage as a snapshot repo and have been doing this for quite a while in multiple elasticsearch clusters on Azure AKS in their commercial cloud. We have …

---

## [Understanding "id existence" check mechanism for custom ids](https://discuss.elastic.co/t/understanding-id-existence-check-mechanism-for-custom-ids/378795)

<div class="topic-metadata">

**Author:** [@danslapman](https://discuss.elastic.co/u/danslapman)\
**Replies:** 5\
**Last updated:** [June 2, 2025, 6:05pm UTC](https://discuss.elastic.co/t/understanding-id-existence-check-mechanism-for-custom-ids/378795 "2025-06-02T18:05:47Z")

</div>

Greetings! I'm seeking a way to verify/clarify my understanding on what's going on during indexing a document with custom \_id. I know that ES performs an existence check in such case, but I'm curious about details. For m…

---

## [How to get the \_id of a document easily? \[C#\]](https://discuss.elastic.co/t/how-to-get-the-id-of-a-document-easily-c/364260)

<div class="topic-metadata">

**Author:** [@Motsols](https://discuss.elastic.co/u/Motsols)\
**Replies:** 3\
**Last updated:** [June 2, 2025, 6:02pm UTC](https://discuss.elastic.co/t/how-to-get-the-id-of-a-document-easily-c/364260 "2025-06-02T18:02:41Z")

</div>

I'm indexing documents without an ID, letting ES set it by itself. How it is created nor the value is of any interest. How can I easily get this \_id in the response document? I'd very much love not to iterate over each…

[Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=63)

[Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=65)
