# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=66 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 67 --- ## [GeoIP Procesor](https://discuss.elastic.co/t/geoip-procesor/378624)
**Author:** [@Priyanka\_chauhan](https://discuss.elastic.co/u/Priyanka_chauhan)\ **Replies:** 2\ **Last updated:** [May 28, 2025, 11:58am UTC](https://discuss.elastic.co/t/geoip-procesor/378624 "2025-05-28T11:58:37Z")
Hi All, I dont have direct internet on my elk cluster , But I want to use geoip processor through ingest pipeline using elastic agent . But in logs it is showing there is no database available. I have downloaded the max… --- ## [Not able to get more than top 4 result matches, regardless of configuration](https://discuss.elastic.co/t/not-able-to-get-more-than-top-4-result-matches-regardless-of-configuration/378546)
**Author:** [@dave\_espinosa\_qs](https://discuss.elastic.co/u/dave_espinosa_qs)\ **Replies:** 3\ **Last updated:** [May 28, 2025, 10:29am UTC](https://discuss.elastic.co/t/not-able-to-get-more-than-top-4-result-matches-regardless-of-configuration/378546 "2025-05-28T10:29:12Z")
Hello everyone, I am using ES Enterprise version 8.18.1 (I cannot change it for the time being BTW, as that is managed by other department). I created a Vector Database - like ES Vector Store, with the following Mapping… --- ## [Query slowdowns when adding a second sort after \_score](https://discuss.elastic.co/t/query-slowdowns-when-adding-a-second-sort-after-score/378354)
**Author:** [@spinscale](https://discuss.elastic.co/u/spinscale)\ **Replies:** 1\ **Last updated:** [May 28, 2025, 7:49am UTC](https://discuss.elastic.co/t/query-slowdowns-when-adding-a-second-sort-after-score/378354 "2025-05-28T07:49:18Z")
Hey there! I have an interesting problem that I do have a hunch on but lack a full explanation. I am querying an index with a solid double digit million number of documents. One of my queries (nested, function score, s… --- ## [Docker integration - condition not working](https://discuss.elastic.co/t/docker-integration-condition-not-working/377864)
**Author:** [@dot-mike](https://discuss.elastic.co/u/dot-mike)\ **Replies:** 12\ **Last updated:** [May 28, 2025, 5:49am UTC](https://discuss.elastic.co/t/docker-integration-condition-not-working/377864 "2025-05-28T05:49:09Z")
Hi all, thanks for amazing product. I'm trying to set condition for docker logs ingestion and I'm not having success. I always get some kind of error, see below. Please help me enable conditional logs based on label. U… --- ## [Docker integration - unable to uninstall agent](https://discuss.elastic.co/t/docker-integration-unable-to-uninstall-agent/378567)
**Author:** [@gaimes410](https://discuss.elastic.co/u/gaimes410)\ **Replies:** 4\ **Last updated:** [May 28, 2025, 5:48am UTC](https://discuss.elastic.co/t/docker-integration-unable-to-uninstall-agent/378567 "2025-05-28T05:48:28Z")
Hey there! Im running elastic on-prem 8.18.1 with fleet-managed agents one of the policies running docker integration with a condition: stringContains(${docker.container.name}, "containerName") The integration with t… --- ## [Install elastic agent : fail to enroll: fail to execute request to fleet-server: x509: certificate signed by unknown authority](https://discuss.elastic.co/t/install-elastic-agent-fail-to-enroll-fail-to-execute-request-to-fleet-server-x509-certificate-signed-by-unknown-authority/378621)
**Author:** [@felixwong](https://discuss.elastic.co/u/felixwong)\ **Replies:** 2\ **Last updated:** [May 28, 2025, 3:07am UTC](https://discuss.elastic.co/t/install-elastic-agent-fail-to-enroll-fail-to-execute-request-to-fleet-server-x509-certificate-signed-by-unknown-authority/378621 "2025-05-28T03:07:58Z")
I tried to install and enroll agent into elastic sudo ./elastic-agent install --url=https://202.40.192.161:8220 --enrollment-token= bjBib0VKY0J… 1st enrollment attempt failed, retrying enrolling to URL: https://202.40.… --- ## [Alert Colors Confusing](https://discuss.elastic.co/t/alert-colors-confusing/378605)
**Author:** [@erikg](https://discuss.elastic.co/u/erikg)\ **Replies:** 1\ **Last updated:** [May 27, 2025, 11:02pm UTC](https://discuss.elastic.co/t/alert-colors-confusing/378605 "2025-05-27T23:02:00Z")
Hello, Noticed this in v9.0.0 The active seems to be taking on two different colors. --- ## [Elasticsearch Multi Tenant Sharding](https://discuss.elastic.co/t/elasticsearch-multi-tenant-sharding/378617)
**Author:** [@cufflink3401](https://discuss.elastic.co/u/cufflink3401)\ **Replies:** 0\ **Last updated:** [May 27, 2025, 9:52pm UTC](https://discuss.elastic.co/t/elasticsearch-multi-tenant-sharding/378617 "2025-05-27T21:52:00Z")
Hey, I'm trying to stabilize an old cluster. We are running on 7.10, and plan to upgrade, but first need to stabilize the situation. Our current configuration is running 57 shards, replication 1, on 4 nodes + 3 master … --- ## [Cannot restart(Stop and start) Logstash](https://discuss.elastic.co/t/cannot-restart-stop-and-start-logstash/378550)
**Author:** [@Clinton\_Pillay](https://discuss.elastic.co/u/Clinton_Pillay)\ **Replies:** 9\ **Last updated:** [May 27, 2025, 6:58pm UTC](https://discuss.elastic.co/t/cannot-restart-stop-and-start-logstash/378550 "2025-05-27T18:58:30Z")
So I start my logstash conf file, which works great and does exactly what I want it to do. I run iy by manually running: logstash -f csvedit.conf which runs logstash using my .conf file. I stop this script by pressing … --- ## [Field Year cannot be printed as the value 292278994 exceeds the maximum print width of 4](https://discuss.elastic.co/t/field-year-cannot-be-printed-as-the-value-292278994-exceeds-the-maximum-print-width-of-4/378581)
**Author:** [@jlp1](https://discuss.elastic.co/u/jlp1)\ **Replies:** 3\ **Last updated:** [May 27, 2025, 5:40pm UTC](https://discuss.elastic.co/t/field-year-cannot-be-printed-as-the-value-292278994-exceeds-the-maximum-print-width-of-4/378581 "2025-05-27T17:40:03Z")
I am using elasticsearch 7.17.6 I am getting "Field Year cannot be printed as the value 292278994 exceeds the maximum print width of 4" error when I try to sort by RegistrationDate. The strange thing is that I get this … --- ## [Installation filebeat on ubuntu 24 error](https://discuss.elastic.co/t/installation-filebeat-on-ubuntu-24-error/378599)
**Author:** [@fferraro87](https://discuss.elastic.co/u/fferraro87)\ **Replies:** 2\ **Last updated:** [May 27, 2025, 3:47pm UTC](https://discuss.elastic.co/t/installation-filebeat-on-ubuntu-24-error/378599 "2025-05-27T15:47:58Z")
hi i've follow that installation readme for apt because i've to install filebeat on my ubuntu 24.04 servers. But i've that error when i try to get apt update : Ign:7 https://artifacts.elastic.co/packages/9.0/apt sta… --- ## [Error In Elasticsearch Service in EC2 Instance](https://discuss.elastic.co/t/error-in-elasticsearch-service-in-ec2-instance/378598)
**Author:** [@Debasis\_Mallick](https://discuss.elastic.co/u/Debasis_Mallick)\ **Replies:** 1\ **Last updated:** [May 27, 2025, 3:02pm UTC](https://discuss.elastic.co/t/error-in-elasticsearch-service-in-ec2-instance/378598 "2025-05-27T15:02:57Z")
HI Team, When setting up an Elasticsearch cluster on an AWS EC2 instance, it's important to configure the elasticsearch.yml file correctly. When using the private IP of the EC2 instance, the service starts successfully.… --- ## [Logstash - Error at startup - Cannot determine timezone from nil](https://discuss.elastic.co/t/logstash-error-at-startup-cannot-determine-timezone-from-nil/378533)
**Author:** [@markus](https://discuss.elastic.co/u/markus)\ **Replies:** 3\ **Last updated:** [May 27, 2025, 2:57pm UTC](https://discuss.elastic.co/t/logstash-error-at-startup-cannot-determine-timezone-from-nil/378533 "2025-05-27T14:57:16Z")
Hi, I've stumbled upon a problem with my Logstash config. As soon as I use the translate filter Logstash refuses to start. I use the following minimal config to reproduce the issue: input { stdin { } } filter {… --- ## [Error illegal\_argument\_exception : Text fields are not optimised for operations that require per-document field data](https://discuss.elastic.co/t/error-illegal-argument-exception-text-fields-are-not-optimised-for-operations-that-require-per-document-field-data/378597)
**Author:** [@diegolakers](https://discuss.elastic.co/u/diegolakers)\ **Replies:** 0\ **Last updated:** [May 27, 2025, 2:18pm UTC](https://discuss.elastic.co/t/error-illegal-argument-exception-text-fields-are-not-optimised-for-operations-that-require-per-document-field-data/378597 "2025-05-27T14:18:16Z")
Hi, i'm experiencing a problem that i'm not able to solve. After years of working with no problems (using ELK stack version 7.6), when i try to make a research in Kibana, it is shown this message: "illegal\_argument\_exc… --- ## [Recv-Q with \> 380K segments waiting to be processed by logstash](https://discuss.elastic.co/t/recv-q-with-380k-segments-waiting-to-be-processed-by-logstash/378579)
**Author:** [@pepitogrillo](https://discuss.elastic.co/u/pepitogrillo)\ **Replies:** 0\ **Last updated:** [May 27, 2025, 10:14am UTC](https://discuss.elastic.co/t/recv-q-with-380k-segments-waiting-to-be-processed-by-logstash/378579 "2025-05-27T10:14:21Z")
Hi All, I am currently in a Docker swarm setup with 7 nodes ingesting 20K 200 bytes TPS . Recv-Q is at almost 4.000.000 segments waiting to be processed by logstash right now I have 80 workers, batch\_size=1000 and poo… --- ## [What can I do to avoid exceeding the max\_clause\_count limit in match queries?](https://discuss.elastic.co/t/what-can-i-do-to-avoid-exceeding-the-max-clause-count-limit-in-match-queries/378574)
**Author:** [@Zoree](https://discuss.elastic.co/u/Zoree)\ **Replies:** 0\ **Last updated:** [May 27, 2025, 9:44am UTC](https://discuss.elastic.co/t/what-can-i-do-to-avoid-exceeding-the-max-clause-count-limit-in-match-queries/378574 "2025-05-27T09:44:00Z")
In our search, span\_near was previously used for distance search with term queries, but this led to a smaller sample than I would like, I moved the implementation to IntervalQuery with match, but now an error is being is… --- ## [Does X-Pack perform authorization checks per index or shard on every request?](https://discuss.elastic.co/t/does-x-pack-perform-authorization-checks-per-index-or-shard-on-every-request/378556)
**Author:** [@catalyst1](https://discuss.elastic.co/u/catalyst1)\ **Replies:** 5\ **Last updated:** [May 27, 2025, 9:29am UTC](https://discuss.elastic.co/t/does-x-pack-perform-authorization-checks-per-index-or-shard-on-every-request/378556 "2025-05-27T09:29:46Z")
Hi, I'm currently managing an Elasticsearch cluster with X-Pack security enabled. Our setup includes approximately 6,400 indices and 23,200 shards. Right after I activated xpack, Elasticsearch's performance became extr… --- ## [How to know what Elasticsearch endpoint is used by Kibana to make graphs?](https://discuss.elastic.co/t/how-to-know-what-elasticsearch-endpoint-is-used-by-kibana-to-make-graphs/378529)
**Author:** [@philyeanaeknss](https://discuss.elastic.co/u/philyeanaeknss)\ **Replies:** 5\ **Last updated:** [May 27, 2025, 9:02am UTC](https://discuss.elastic.co/t/how-to-know-what-elasticsearch-endpoint-is-used-by-kibana-to-make-graphs/378529 "2025-05-27T09:02:11Z")
I have URI like ../discover#/?\_g=(filters:!(),refreshInterval:(pause:!t,value:0),time:(from:now%2Fd,to:now%2Fd))&\_a=(columns:!(\_source),filters:!(),index:{index},interval:auto,query:(language:kuery,query:%27%27),sort:!(… --- ## [Winlogbeat not parsing AnsiString fields correctly](https://discuss.elastic.co/t/winlogbeat-not-parsing-ansistring-fields-correctly/378510)
**Author:** [@AltairQ](https://discuss.elastic.co/u/AltairQ)\ **Replies:** 1\ **Last updated:** [May 27, 2025, 8:34am UTC](https://discuss.elastic.co/t/winlogbeat-not-parsing-ansistring-fields-correctly/378510 "2025-05-27T08:34:23Z")
Hello, I'd like to draw attention to what I believe is a bug in winlogbeat v9+ parsing logic for ETW events declared with inType="win:AnsiString". Long story short, the strings are not trimmed to the null terminator. I… --- ## [Help with querying all the documents within a given @timestamp field from an index](https://discuss.elastic.co/t/help-with-querying-all-the-documents-within-a-given-timestamp-field-from-an-index/378562)
**Author:** [@Nikhil\_Shivanath](https://discuss.elastic.co/u/Nikhil_Shivanath)\ **Replies:** 4\ **Last updated:** [May 27, 2025, 8:10am UTC](https://discuss.elastic.co/t/help-with-querying-all-the-documents-within-a-given-timestamp-field-from-an-index/378562 "2025-05-27T08:10:01Z")
Hi , I could really use some help with querying all the documents from an index between the @timestamp value of may 21 and may 22 ,. I'm using the python client as of now but it only seems to return 10,000 of these docum… --- ## [Filebeat doesn't send data to output/logstash](https://discuss.elastic.co/t/filebeat-doesnt-send-data-to-output-logstash/378563)
**Author:** [@rb18](https://discuss.elastic.co/u/rb18)\ **Replies:** 0\ **Last updated:** [May 27, 2025, 6:14am UTC](https://discuss.elastic.co/t/filebeat-doesnt-send-data-to-output-logstash/378563 "2025-05-27T06:14:11Z")
Hello, i want to send data from filebeat (version 9.0.0) to logstash (version 9.0.0) but no matter what I try, it just doesn't work. info: filebeat and logstash both run on the same virtual machine (Windows Server 2022… --- ## [ECE to ELK migration](https://discuss.elastic.co/t/ece-to-elk-migration/378032)
**Author:** [@sharathsurya](https://discuss.elastic.co/u/sharathsurya)\ **Replies:** 2\ **Last updated:** [May 27, 2025, 5:16am UTC](https://discuss.elastic.co/t/ece-to-elk-migration/378032 "2025-05-27T05:16:54Z")
Hi I am new to elastic products. We have a requirement to migrate from ECE (Elastic Cloud Enterprise, paid version ) to ELK (Elasticsearch, Kibana, Log stash) Open source version. Is it possible to migrate with existing… --- ## [Error on field and document level security](https://discuss.elastic.co/t/error-on-field-and-document-level-security/378462)
**Author:** [@teeraw](https://discuss.elastic.co/u/teeraw)\ **Replies:** 3\ **Last updated:** [May 27, 2025, 4:10am UTC](https://discuss.elastic.co/t/error-on-field-and-document-level-security/378462 "2025-05-27T04:10:35Z")
I want to filter the server list for each user role based on the servers they are responsible for. During my research, I found that this can be done using "document level security" I prepared the following JSON request … --- ## [Palo Alto Firewall Log Collection Issue with Elasticsearch](https://discuss.elastic.co/t/palo-alto-firewall-log-collection-issue-with-elasticsearch/377296)
**Author:** [@zakaria2](https://discuss.elastic.co/u/zakaria2)\ **Replies:** 13\ **Last updated:** [May 26, 2025, 10:21pm UTC](https://discuss.elastic.co/t/palo-alto-firewall-log-collection-issue-with-elasticsearch/377296 "2025-05-26T22:21:55Z")
Hello everyone, I'm having a problem collecting logs from my Palo Alto firewall to my Elastic stack (Elasticsearch, Logstash, Kibana). I configured the Palo Alto firewall to send logs in Syslog format to Logstash (see … --- ## [Backup Of Elastic Cluster](https://discuss.elastic.co/t/backup-of-elastic-cluster/378474)
**Author:** [@Debasis\_Mallick](https://discuss.elastic.co/u/Debasis_Mallick)\ **Replies:** 3\ **Last updated:** [May 26, 2025, 4:30pm UTC](https://discuss.elastic.co/t/backup-of-elastic-cluster/378474 "2025-05-26T16:30:45Z")
Hi Team, If we want to take backup of elastic cluster by using below command. Will it take backup everything in cluster like ILM Policy, SLM Policy and any settings related to cluster. PUT \_slm/policy/weekly-snapshots … --- ## [Receive Elasticsearch API connection with Logstash](https://discuss.elastic.co/t/receive-elasticsearch-api-connection-with-logstash/378541)
**Author:** [@widhalmt](https://discuss.elastic.co/u/widhalmt)\ **Replies:** 4\ **Last updated:** [May 26, 2025, 2:04pm UTC](https://discuss.elastic.co/t/receive-elasticsearch-api-connection-with-logstash/378541 "2025-05-26T14:04:07Z")
Hi, I have a tool (Icinga 2) that can write data into Elasticsearch. For a special project I need to reroute some of the data to Kafka. Can I use Logstash to receive and reroute the data? I mean is there an input that … --- ## [We can create our own dashboard on views per dashboard?](https://discuss.elastic.co/t/we-can-create-our-own-dashboard-on-views-per-dashboard/377185)
**Author:** [@shinysap](https://discuss.elastic.co/u/shinysap)\ **Replies:** 2\ **Last updated:** [May 26, 2025, 1:38pm UTC](https://discuss.elastic.co/t/we-can-create-our-own-dashboard-on-views-per-dashboard/377185 "2025-05-26T13:38:15Z")
Dear elastic Team, With recent release of kibana we noticed that there is a Dashboard views option. we can create our own dashboard on views per dashboard? However i could never find the source index for the dashboard … --- ## [Configure common user to export csv](https://discuss.elastic.co/t/configure-common-user-to-export-csv/378537)
**Author:** [@francieliton\_araujo](https://discuss.elastic.co/u/francieliton_araujo)\ **Replies:** 3\ **Last updated:** [May 26, 2025, 1:35pm UTC](https://discuss.elastic.co/t/configure-common-user-to-export-csv/378537 "2025-05-26T13:35:59Z")
I'm not able to give permission for a user to export one of the dashboard viewers. Can you help me? I'm on version 9.0.1 Here's an image of what I need to appear for him. --- ## [Input log file is not discovered in Kibana in window 11](https://discuss.elastic.co/t/input-log-file-is-not-discovered-in-kibana-in-window-11/378523)
**Author:** [@Jitendra2](https://discuss.elastic.co/u/Jitendra2)\ **Replies:** 1\ **Last updated:** [May 26, 2025, 8:56am UTC](https://discuss.elastic.co/t/input-log-file-is-not-discovered-in-kibana-in-window-11/378523 "2025-05-26T08:56:34Z")
I have configured and started elastic-search, kibana and logstash. Everything is working without error but I am not able to see my log file in kibana. below is logstash configuration. Can someone please suggest me what I… --- ## [Hello elastic world](https://discuss.elastic.co/t/hello-elastic-world/378507)
**Author:** [@roseebony532](https://discuss.elastic.co/u/roseebony532)\ **Replies:** 1\ **Last updated:** [May 26, 2025, 8:01am UTC](https://discuss.elastic.co/t/hello-elastic-world/378507 "2025-05-26T08:01:18Z")
Hello, is there a plugin that lets you text search and move your cursor while collecting the entire dap scope of a debugging session? Thank you, [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=65) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=67)