# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=67 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 68 --- ## [XOR operator in a Query String Query](https://discuss.elastic.co/t/xor-operator-in-a-query-string-query/373135)
**Author:** [@Chenko](https://discuss.elastic.co/u/Chenko)\ **Replies:** 2\ **Last updated:** [May 26, 2025, 5:10am UTC](https://discuss.elastic.co/t/xor-operator-in-a-query-string-query/373135 "2025-05-26T05:10:12Z")
Hi, First of all a happy 2025! I was reading the syntax documentation of the Query String Query and the Simple one. I noticed there was no XOR operator but there is OR AND and NOT. So I was wondering if it was possib… --- ## [Implement filebeat with ingest pipelies](https://discuss.elastic.co/t/implement-filebeat-with-ingest-pipelies/378482)
**Author:** [@dominbdg](https://discuss.elastic.co/u/dominbdg)\ **Replies:** 19\ **Last updated:** [May 25, 2025, 10:40pm UTC](https://discuss.elastic.co/t/implement-filebeat-with-ingest-pipelies/378482 "2025-05-25T22:40:53Z")
Hello, I have ELK instance which consists of elasticsearch, logstash and kibana. I would like to implement filebeat with ingest pipelines - meaning filebeat sends logs with tags and ingest pipelines recognize it and cr… --- ## [Possible to have Elasticsearch prefer same availability zone shard allocation?](https://discuss.elastic.co/t/possible-to-have-elasticsearch-prefer-same-availability-zone-shard-allocation/378504)
**Author:** [@BenB196](https://discuss.elastic.co/u/BenB196)\ **Replies:** 2\ **Last updated:** [May 25, 2025, 10:37pm UTC](https://discuss.elastic.co/t/possible-to-have-elasticsearch-prefer-same-availability-zone-shard-allocation/378504 "2025-05-25T22:37:04Z")
Hi All, I'm curious if anyone knows if the following scenario is possible within Elasticsearch. Suppose I have a 6-node cluster spread across 3 availability zones (AZ) (2 nodes per AZ). I want to have some resiliency, … --- ## [Issue with rollover ERROR](https://discuss.elastic.co/t/issue-with-rollover-error/378009)
**Author:** [@dominbdg](https://discuss.elastic.co/u/dominbdg)\ **Replies:** 4\ **Last updated:** [May 24, 2025, 1:14am UTC](https://discuss.elastic.co/t/issue-with-rollover-error/378009 "2025-05-24T01:14:50Z")
Hello, I have isssue with rollover error during step with ILM. I created ILM (all rollover settings disabled) to remove indexes after 365 days. During ILM work I founded below error: \> \> "step": "check-rollover-read… --- ## [GROK Help with timestamp](https://discuss.elastic.co/t/grok-help-with-timestamp/378433)
**Author:** [@dominbdg](https://discuss.elastic.co/u/dominbdg)\ **Replies:** 7\ **Last updated:** [May 23, 2025, 11:29pm UTC](https://discuss.elastic.co/t/grok-help-with-timestamp/378433 "2025-05-23T23:29:15Z")
Hello, I have below sample data: 10.10.0.1 - - \[20/May/2025:13:02:52 +0000\] "GET /website/redirect/2df4e11a-7e8f-4927-938b-7adfcc40f566 HTTP/1.1" 302 - I cannot set any know be me timestamps for such date/time Can so… --- ## [ML Anomaly Detection - Alert Thresholds](https://discuss.elastic.co/t/ml-anomaly-detection-alert-thresholds/378094)
**Author:** [@erikg](https://discuss.elastic.co/u/erikg)\ **Replies:** 3\ **Last updated:** [May 23, 2025, 11:38pm UTC](https://discuss.elastic.co/t/ml-anomaly-detection-alert-thresholds/378094 "2025-05-23T23:38:37Z")
Hello, I recently been building Anomaly Detection jobs and alerts. I was wondering if there's a way to specify a threshold. Here's my current issue: Anomaly Detection works by using the historical data as a baseline. … --- ## [Sum aggregation Giving incorrect resumt](https://discuss.elastic.co/t/sum-aggregation-giving-incorrect-resumt/378329)
**Author:** [@Arshukla](https://discuss.elastic.co/u/Arshukla)\ **Replies:** 14\ **Last updated:** [May 23, 2025, 4:46pm UTC](https://discuss.elastic.co/t/sum-aggregation-giving-incorrect-resumt/378329 "2025-05-23T16:46:03Z")
I'm encountering an issue in Kibana. When I check a particular variable in Discover, I can see that it has a value of 0 on four different dates. For the remaining dates, there is no data shown for this variable in Discov… --- ## [Is Logstash able to inline correct invalid JSON?](https://discuss.elastic.co/t/is-logstash-able-to-inline-correct-invalid-json/378473)
**Author:** [@Marcos\_Mondragon](https://discuss.elastic.co/u/Marcos_Mondragon)\ **Replies:** 3\ **Last updated:** [May 23, 2025, 4:43pm UTC](https://discuss.elastic.co/t/is-logstash-able-to-inline-correct-invalid-json/378473 "2025-05-23T16:43:44Z")
I'm trying to determine if there is a way within a Logstash conf file to correct an invalid JSON field being passed in? Here is the data: { "trace": "ID-in":"83455E37DD688327", "ID-out":"83455E37DD688327", "reply-to-in… --- ## [Limit Kibana watcher emails](https://discuss.elastic.co/t/limit-kibana-watcher-emails/378466)
**Author:** [@hofrichterovak](https://discuss.elastic.co/u/hofrichterovak)\ **Replies:** 1\ **Last updated:** [May 23, 2025, 9:59am UTC](https://discuss.elastic.co/t/limit-kibana-watcher-emails/378466 "2025-05-23T09:59:32Z")
Hello, I would like to ask about the Kibana watcher. When the watcher conditions are met, an email is sent. Is there any way to limit the maximum number of emails? I would like to run the watcher every 30 minutes, but… --- ## [Data Table Grouping](https://discuss.elastic.co/t/data-table-grouping/378443)
**Author:** [@erikg](https://discuss.elastic.co/u/erikg)\ **Replies:** 1\ **Last updated:** [May 23, 2025, 9:23am UTC](https://discuss.elastic.co/t/data-table-grouping/378443 "2025-05-23T09:23:22Z")
Hello All, I can't describe this type of logic but is it possible to do this with lens data table: The logic is first row contains a group, the second row contains the associated services but don't repeat the same v… --- ## [bucket script to find the percent change in filter bucket](https://discuss.elastic.co/t/bucket-script-to-find-the-percent-change-in-filter-bucket/378458)
**Author:** [@Ramji\_Balu\_Sudarsan](https://discuss.elastic.co/u/Ramji_Balu_Sudarsan)\ **Replies:** 0\ **Last updated:** [May 23, 2025, 7:24am UTC](https://discuss.elastic.co/t/bucket-script-to-find-the-percent-change-in-filter-bucket/378458 "2025-05-23T07:24:07Z")
I have formed an aggregation query to bucket my tickets based on created\_at epoch. Based on my query I will get two buckets each named previous and current. GET tickets\_trend\_analysis/\_search { "aggs": { "time\_win… --- ## [What is a JSON object?](https://discuss.elastic.co/t/what-is-a-json-object/378453)
**Author:** [@yuswanul](https://discuss.elastic.co/u/yuswanul)\ **Replies:** 2\ **Last updated:** [May 23, 2025, 6:01am UTC](https://discuss.elastic.co/t/what-is-a-json-object/378453 "2025-05-23T06:01:49Z")
Hi everyone, Sorry to ask a very basic question. At first, I'm trying to find a way to parse a JSON log in filebeat with container input type. Then I found this documentation. in the description, it said it only works i… --- ## [Logstash is not fully using index template](https://discuss.elastic.co/t/logstash-is-not-fully-using-index-template/376042)
**Author:** [@Jesselastic](https://discuss.elastic.co/u/Jesselastic)\ **Replies:** 1\ **Last updated:** [May 22, 2025, 10:56pm UTC](https://discuss.elastic.co/t/logstash-is-not-fully-using-index-template/376042 "2025-05-22T22:56:41Z")
I have syslog docs coming through logstash and everything is mapping to the correct field names. The index template that has a pattern matching the logs from logstash correctly creates datastreams and ilm is working gre… --- ## [Setup a Machine Learning rule is not active](https://discuss.elastic.co/t/setup-a-machine-learning-rule-is-not-active/378170)
**Author:** [@nzeland149](https://discuss.elastic.co/u/nzeland149)\ **Replies:** 25\ **Last updated:** [May 22, 2025, 2:03pm UTC](https://discuss.elastic.co/t/setup-a-machine-learning-rule-is-not-active/378170 "2025-05-22T14:03:26Z")
i have configured this rule but status always ok not active what can i do to fix this --- ## [Elastic-agent log errors](https://discuss.elastic.co/t/elastic-agent-log-errors/370299)
**Author:** [@Dth\_Revan](https://discuss.elastic.co/u/Dth_Revan)\ **Replies:** 1\ **Last updated:** [May 22, 2025, 12:41pm UTC](https://discuss.elastic.co/t/elastic-agent-log-errors/370299 "2025-05-22T12:41:19Z")
Hello! some time ago i discovered some strange logs that elastic agent throws. it writes it into .ds-logs-elastic\_agent.fleet\_server-default index and this path on host /opt/Elastic/Agent/data/elastic-agent-8.15.3-… --- ## [Logstash snmp integration plugin doesn't work](https://discuss.elastic.co/t/logstash-snmp-integration-plugin-doesnt-work/377181)
**Author:** [@Dth\_Revan](https://discuss.elastic.co/u/Dth_Revan)\ **Replies:** 1\ **Last updated:** [May 22, 2025, 12:36pm UTC](https://discuss.elastic.co/t/logstash-snmp-integration-plugin-doesnt-work/377181 "2025-05-22T12:36:49Z")
Hello, everybody! I wanted to try a logstash snmp plugin to get metrics from physical devices to migrate completely from zabbix to ELK. I spent very much time, but it doesn't work still... I'm going to describe my env.… --- ## [Shell built-in commands not captured via Auditd Manager](https://discuss.elastic.co/t/shell-built-in-commands-not-captured-via-auditd-manager/378264)
**Author:** [@saretawa5](https://discuss.elastic.co/u/saretawa5)\ **Replies:** 4\ **Last updated:** [May 22, 2025, 12:17pm UTC](https://discuss.elastic.co/t/shell-built-in-commands-not-captured-via-auditd-manager/378264 "2025-05-22T12:17:53Z")
Hello, I have both required integrations installed — Auditd Manager and Elastic Defend (Data Collection mode) — and I'm using them to support rules like "Tampering of Shell Command-Line History." For Auditd Manager: I… --- ## [Elastic Agent and Logstash SQL plugin](https://discuss.elastic.co/t/elastic-agent-and-logstash-sql-plugin/378335)
**Author:** [@tapiojaa](https://discuss.elastic.co/u/tapiojaa)\ **Replies:** 2\ **Last updated:** [May 22, 2025, 10:11am UTC](https://discuss.elastic.co/t/elastic-agent-and-logstash-sql-plugin/378335 "2025-05-22T10:11:39Z")
We're using Fleet managed Elastic Agents and appropriate integrations to collect logs from various environments and that is working great. We have however quite a few environments where logging is collected from MS-SQL t… --- ## [Increased Read IOPS usage after upgrade from 8.18.0 to 9.0.1](https://discuss.elastic.co/t/increased-read-iops-usage-after-upgrade-from-8-18-0-to-9-0-1/377986)
**Author:** [@applike-ss](https://discuss.elastic.co/u/applike-ss)\ **Replies:** 23\ **Last updated:** [May 22, 2025, 10:36am UTC](https://discuss.elastic.co/t/increased-read-iops-usage-after-upgrade-from-8-18-0-to-9-0-1/377986 "2025-05-22T10:36:06Z")
Hi all, since upgrading from 8.18.0 to 9.0.1 i'm seeing a massive increase of read IOPS on the data node disks. I couldn't see anything obvious in the release notes of 8.18.1, 9.0.0 and 9.0.1 that would lead to this. … --- ## [In Elasticsearch, Is updating document done in real time?](https://discuss.elastic.co/t/in-elasticsearch-is-updating-document-done-in-real-time/378407)
**Author:** [@yudianer](https://discuss.elastic.co/u/yudianer)\ **Replies:** 2\ **Last updated:** [May 22, 2025, 9:00am UTC](https://discuss.elastic.co/t/in-elasticsearch-is-updating-document-done-in-real-time/378407 "2025-05-22T09:00:56Z")
Hi, Refresh mechanism makes confused about if updating succeed once I get response from ES. Or is updating done in real-time and synchronised with user update request sending?. As many say, updating a document execute… --- ## [Eliminate excesive blanks or select fields for position](https://discuss.elastic.co/t/eliminate-excesive-blanks-or-select-fields-for-position/378390)
**Author:** [@fernandosss](https://discuss.elastic.co/u/fernandosss)\ **Replies:** 4\ **Last updated:** [May 22, 2025, 7:23am UTC](https://discuss.elastic.co/t/eliminate-excesive-blanks-or-select-fields-for-position/378390 "2025-05-22T07:23:00Z")
Hello, I'd like it if someone could help me with the following problem. I'm sending a series of logs to logstash/elastic. The problem is that my logs are separated by blanks, and sometimes after the first field, there… --- ## [Missing "Service Group" Integration in Citrix ADC with Elastic](https://discuss.elastic.co/t/missing-service-group-integration-in-citrix-adc-with-elastic/377234)
**Author:** [@ghyslaindetry](https://discuss.elastic.co/u/ghyslaindetry)\ **Replies:** 1\ **Last updated:** [May 21, 2025, 11:09pm UTC](https://discuss.elastic.co/t/missing-service-group-integration-in-citrix-adc-with-elastic/377234 "2025-05-21T23:09:32Z")
Hello Elastic Community, I am currently using Citrix ADC and have integrated it with Elastic to monitor various metrics and logs. While the integration works well for interfaces, virtual servers (lbvserver), services, s… --- ## [Multiline stack trace not working](https://discuss.elastic.co/t/multiline-stack-trace-not-working/378316)
**Author:** [@MelasticSan](https://discuss.elastic.co/u/MelasticSan)\ **Replies:** 2\ **Last updated:** [May 21, 2025, 3:54pm UTC](https://discuss.elastic.co/t/multiline-stack-trace-not-working/378316 "2025-05-21T15:54:54Z")
filebeat.inputs: - type: filestream enabled: true paths: - /var/tmp/javatest/simplejava.log json.keys\_under\_root: true json.add\_error\_key: false json.ignore\_decoding\_error: true json.overwrite\_keys: true … --- ## [Kibana alerts not sorting properly](https://discuss.elastic.co/t/kibana-alerts-not-sorting-properly/376407)
**Author:** [@rara01](https://discuss.elastic.co/u/rara01)\ **Replies:** 6\ **Last updated:** [May 21, 2025, 3:22pm UTC](https://discuss.elastic.co/t/kibana-alerts-not-sorting-properly/376407 "2025-05-21T15:22:08Z")
Hi, When trying to sort Alerts in Stack management - Alerts by date started, the sorting is not working as expected. When trying to sort alerts on "Started" from "New to Old", i get what seems randomly sorted values, sa… --- ## [Dark Blue Mode Bug](https://discuss.elastic.co/t/dark-blue-mode-bug/378353)
**Author:** [@erikg](https://discuss.elastic.co/u/erikg)\ **Replies:** 3\ **Last updated:** [May 21, 2025, 2:41pm UTC](https://discuss.elastic.co/t/dark-blue-mode-bug/378353 "2025-05-21T14:41:06Z")
Hello, I am guessing this is not supposed to happen: --- ## [Circuit breaking Issue occurring](https://discuss.elastic.co/t/circuit-breaking-issue-occurring/378386)
**Author:** [@mnaumtian](https://discuss.elastic.co/u/mnaumtian)\ **Replies:** 2\ **Last updated:** [May 21, 2025, 2:10pm UTC](https://discuss.elastic.co/t/circuit-breaking-issue-occurring/378386 "2025-05-21T14:10:20Z")
"root\_cause" : \[ { "type" : "circuit\_breaking\_exception", "reason" : "\[fielddata\] Data too large, data for \[\_id\] would be \[434536627/414.4mb\], which is larger than the limit of \[429496729/409.5mb\]", "bytes\_wanted" : … --- ## [Microsoft SQL Connector not able to connect](https://discuss.elastic.co/t/microsoft-sql-connector-not-able-to-connect/362961)
**Author:** [@sebaV\_20](https://discuss.elastic.co/u/sebaV_20)\ **Replies:** 12\ **Last updated:** [May 21, 2025, 1:28pm UTC](https://discuss.elastic.co/t/microsoft-sql-connector-not-able-to-connect/362961 "2025-05-21T13:28:33Z")
Hello, So Basically what the title says. I´m trying to create a native connector for an Azure deployed Microsoft SQL Database and i´m not being able to connect to the db. All this in the Connectors tab. I have this con… --- ## [Results from aliases in Index Management](https://discuss.elastic.co/t/results-from-aliases-in-index-management/378380)
**Author:** [@henrikuib](https://discuss.elastic.co/u/henrikuib)\ **Replies:** 0\ **Last updated:** [May 21, 2025, 11:18am UTC](https://discuss.elastic.co/t/results-from-aliases-in-index-management/378380 "2025-05-21T11:18:29Z")
It's currently not possible to search for an alias in Index Management. It's also impractical that you have to open each index to see if they have aliases. --- ## [Installation ELK on OCI](https://discuss.elastic.co/t/installation-elk-on-oci/378378)
**Author:** [@sreya\_14](https://discuss.elastic.co/u/sreya_14)\ **Replies:** 1\ **Last updated:** [May 21, 2025, 11:00am UTC](https://discuss.elastic.co/t/installation-elk-on-oci/378378 "2025-05-21T11:00:03Z")
I have requirement to install ELK in our OCI servers. When I checked in Elastic website to download the RPM,I found there are many . Which one I should use? Please guide me ,I am very new to this product --- ## [Filebeat filestream: Duplicate ingestion after "key with no value" in log.json registry file](https://discuss.elastic.co/t/filebeat-filestream-duplicate-ingestion-after-key-with-no-value-in-log-json-registry-file/378377)
**Author:** [@anpama](https://discuss.elastic.co/u/anpama)\ **Replies:** 0\ **Last updated:** [May 21, 2025, 9:18am UTC](https://discuss.elastic.co/t/filebeat-filestream-duplicate-ingestion-after-key-with-no-value-in-log-json-registry-file/378377 "2025-05-21T09:18:54Z")
Hi everyone, I'm seeing a duplicate ingestion issue with Filebeat 8.14 using the filestream input and default settings. For some files, Filebeat suddenly starts reading the whole file again, leading to duplicate events. … [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=66) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=68)