# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=68 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 69 --- ## [I'm experiencing an issue with rule configuration in Stack Management](https://discuss.elastic.co/t/im-experiencing-an-issue-with-rule-configuration-in-stack-management/378343)
**Author:** [@elastic\_interogation](https://discuss.elastic.co/u/elastic_interogation)\ **Replies:** 4\ **Last updated:** [May 21, 2025, 8:47am UTC](https://discuss.elastic.co/t/im-experiencing-an-issue-with-rule-configuration-in-stack-management/378343 "2025-05-21T08:47:45Z")
Hi, I would like some help in the Rules and Connectors folder, I created rules based on an Elasticsearch query to detect the number of matches, using a custom threshold that I want to set myself. However, I don't unde… --- ## [I can't configure a connector to send mail with alert](https://discuss.elastic.co/t/i-cant-configure-a-connector-to-send-mail-with-alert/378373)
**Author:** [@elastic\_interogation](https://discuss.elastic.co/u/elastic_interogation)\ **Replies:** 0\ **Last updated:** [May 21, 2025, 7:57am UTC](https://discuss.elastic.co/t/i-cant-configure-a-connector-to-send-mail-with-alert/378373 "2025-05-21T07:57:29Z")
Hi, I am trying to configure a connector to automatically send emails when an alert is triggered. For that, I went to the connector section and created my first connector. I configured the connector name, and in the se… --- ## [Product compatibility with version 9.X not available on Support Matrix](https://discuss.elastic.co/t/product-compatibility-with-version-9-x-not-available-on-support-matrix/378306)
**Author:** [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Replies:** 4\ **Last updated:** [May 21, 2025, 4:33am UTC](https://discuss.elastic.co/t/product-compatibility-with-version-9-x-not-available-on-support-matrix/378306 "2025-05-21T04:33:37Z")
Hello, This is a simple question, what are the product compatibility from older versions with the stack on version 9.X? The columns for the compatibility with Beats, Elastic Agent and Logstash in the support matrix pag… --- ## [Cannot access the Kibana Security Analyst for Elastic training lab](https://discuss.elastic.co/t/cannot-access-the-kibana-security-analyst-for-elastic-training-lab/378362)
**Author:** [@Ernest](https://discuss.elastic.co/u/Ernest)\ **Replies:** 0\ **Last updated:** [May 20, 2025, 11:50pm UTC](https://discuss.elastic.co/t/cannot-access-the-kibana-security-analyst-for-elastic-training-lab/378362 "2025-05-20T23:50:54Z")
I cannot access the Kibana Security Analyst for the Elastic training lab. The issue I encountered is attached. Please assist. --- ## [Stack Monitoring with Fleet agent and Elasticsearch docker containers](https://discuss.elastic.co/t/stack-monitoring-with-fleet-agent-and-elasticsearch-docker-containers/378360)
**Author:** [@JumboAg](https://discuss.elastic.co/u/JumboAg)\ **Replies:** 0\ **Last updated:** [May 20, 2025, 11:26pm UTC](https://discuss.elastic.co/t/stack-monitoring-with-fleet-agent-and-elasticsearch-docker-containers/378360 "2025-05-20T23:26:48Z")
I'm running a multi node elasticsearch cluster in docker containers. Is there a way to setup the elasticsearch fleet integration to monitor elasticsearch logs when elasticsearch is running in a docker container? The in… --- ## [ElasticSearch Node Rebuilt - lost indices](https://discuss.elastic.co/t/elasticsearch-node-rebuilt-lost-indices/377507)
**Author:** [@newmember](https://discuss.elastic.co/u/newmember)\ **Replies:** 3\ **Last updated:** [May 20, 2025, 8:51pm UTC](https://discuss.elastic.co/t/elasticsearch-node-rebuilt-lost-indices/377507 "2025-05-20T20:51:47Z")
I had to rebuild a failing ES NODE and after I finished the re-indexing I can see that in the nodes folder there are several other indices that I didn't restore and I don't think are needed by anyone. I don't think they… --- ## [One index or multiple index for exact same mapping, but the data are clustered based on a field](https://discuss.elastic.co/t/one-index-or-multiple-index-for-exact-same-mapping-but-the-data-are-clustered-based-on-a-field/378311)
**Author:** [@orfeas\_filippopoulos](https://discuss.elastic.co/u/orfeas_filippopoulos)\ **Replies:** 2\ **Last updated:** [May 20, 2025, 7:10pm UTC](https://discuss.elastic.co/t/one-index-or-multiple-index-for-exact-same-mapping-but-the-data-are-clustered-based-on-a-field/378311 "2025-05-20T19:10:33Z")
Hi there, community! I have a short question. I have around 100k documents, each ranging from a few hundred KB to a maximum of 1MB. The documents have exactly the same mapping but can be grouped into three different cl… --- ## [How to Use Custom Embeddings (Ollama) for Hybrid Search in Elasticsearch?](https://discuss.elastic.co/t/how-to-use-custom-embeddings-ollama-for-hybrid-search-in-elasticsearch/378323)
**Author:** [@Muhammad\_Fhadli](https://discuss.elastic.co/u/Muhammad_Fhadli)\ **Replies:** 1\ **Last updated:** [May 20, 2025, 6:15pm UTC](https://discuss.elastic.co/t/how-to-use-custom-embeddings-ollama-for-hybrid-search-in-elasticsearch/378323 "2025-05-20T18:15:47Z")
I'm trying to combine lexical search and semantic search using the RRF (Reciprocal Rank Fusion) algorithm, as described in the Elasticsearch documentation: Since my data is in Indonesian, I need to use a custom embeddi… --- ## [Elastic Indexes and Data Streams](https://discuss.elastic.co/t/elastic-indexes-and-data-streams/377674)
**Author:** [@h0nus](https://discuss.elastic.co/u/h0nus)\ **Replies:** 2\ **Last updated:** [May 20, 2025, 4:16pm UTC](https://discuss.elastic.co/t/elastic-indexes-and-data-streams/377674 "2025-05-20T16:16:51Z")
Hello everyone, I was wondering how should I make my policy for Elastic to clean the space up on a 200GB limited space VM. I studied deeply the config of Index Policies and I've set my custom ones for my needs. Since … --- ## [Does in-flight request breaker really track writing requests?](https://discuss.elastic.co/t/does-in-flight-request-breaker-really-track-writing-requests/378330)
**Author:** [@vsop\_479](https://discuss.elastic.co/u/vsop_479)\ **Replies:** 2\ **Last updated:** [May 20, 2025, 2:25pm UTC](https://discuss.elastic.co/t/does-in-flight-request-breaker-really-track-writing-requests/378330 "2025-05-20T14:25:34Z")
According to the comment above CircuitBreaker#IN\_FLIGHT\_REQUESTS: /\*\* \* The in-flight request breaker tracks bytes allocated for reading and \* writing requests on the network layer. \*/ String IN\_F… --- ## [\[multi\_match\] unknown token \[START\_ARRAY\] after \[query\]](https://discuss.elastic.co/t/multi-match-unknown-token-start-array-after-query/376415)
**Author:** [@anujtom](https://discuss.elastic.co/u/anujtom)\ **Replies:** 5\ **Last updated:** [May 20, 2025, 1:14pm UTC](https://discuss.elastic.co/t/multi-match-unknown-token-start-array-after-query/376415 "2025-05-20T13:14:48Z")
Hi, I am trying to fetch fields within same attribute to send response. Fetch "abc" "yui" pattern from full\_message attribute. GET /my\_index/\_search { "query": { "multi\_match": { "query": \[ "abc" , "yui" \] , "f… --- ## [Filebeat: add\_docker\_metadata doesn't always work](https://discuss.elastic.co/t/filebeat-add-docker-metadata-doesnt-always-work/378339)
**Author:** [@frans-wtax](https://discuss.elastic.co/u/frans-wtax)\ **Replies:** 0\ **Last updated:** [May 20, 2025, 11:49am UTC](https://discuss.elastic.co/t/filebeat-add-docker-metadata-doesnt-always-work/378339 "2025-05-20T11:49:12Z")
I have filebeat running directly on my OS and it's ingesting Docker log files from /var/log/docker/containers/\*/\*-json.log: filebeat: # List of inputs. inputs: - type: filestream id: container paths:… --- ## [Use of unmapped\_type in sorting](https://discuss.elastic.co/t/use-of-unmapped-type-in-sorting/378127)
**Author:** [@Parthpuri\_Goswami](https://discuss.elastic.co/u/Parthpuri_Goswami)\ **Replies:** 3\ **Last updated:** [May 20, 2025, 8:33am UTC](https://discuss.elastic.co/t/use-of-unmapped-type-in-sorting/378127 "2025-05-20T08:33:22Z")
Hi everyone, In my application, I want to sort fields similar to the Kibana Discover page. While exploring Kibana APIs for sorting, I noticed that Kibana addsunmapped\_type: "boolean" in sort query to all the fields. I j… --- ## [Dataview id from API request does not correlate with actual dataview id](https://discuss.elastic.co/t/dataview-id-from-api-request-does-not-correlate-with-actual-dataview-id/374181)
**Author:** [@elasticexpert2](https://discuss.elastic.co/u/elasticexpert2)\ **Replies:** 3\ **Last updated:** [May 20, 2025, 8:31am UTC](https://discuss.elastic.co/t/dataview-id-from-api-request-does-not-correlate-with-actual-dataview-id/374181 "2025-05-20T08:31:17Z")
I have been trying to use the Kibana API in order to get a list of all the dataviews and use their ID for link generation purposes. Following this doc \[get all dataviews\]: https://www.elastic.co/guide/en/kibana/current/… --- ## [Filebeat multi line pattern not working](https://discuss.elastic.co/t/filebeat-multi-line-pattern-not-working/378301)
**Author:** [@manikandanid](https://discuss.elastic.co/u/manikandanid)\ **Replies:** 6\ **Last updated:** [May 20, 2025, 8:29am UTC](https://discuss.elastic.co/t/filebeat-multi-line-pattern-not-working/378301 "2025-05-20T08:29:18Z")
Following is the multiline pattern config we have used. - type: filestream # Unique ID among all inputs, an ID is required. id: testfile # Change to true to enable this input configuration. enabled: true # … --- ## [Elasticsearch: How to delete restricted indices](https://discuss.elastic.co/t/elasticsearch-how-to-delete-restricted-indices/378284)
**Author:** [@cisupport-zkb](https://discuss.elastic.co/u/cisupport-zkb)\ **Replies:** 2\ **Last updated:** [May 20, 2025, 6:33am UTC](https://discuss.elastic.co/t/elasticsearch-how-to-delete-restricted-indices/378284 "2025-05-20T06:33:56Z")
Hi everyone, I'm trying to upgrade from Elasticsearch 8.18.0 to 9.0.1, but before upgrading I need to set to read only or delete old created indices with compatibility 7090199, otherwise won't boot up the Elasticsearch … --- ## [Critical http://10.54.120.149:9200 seems to be unreachable](https://discuss.elastic.co/t/critical-http-10-54-120-149-9200-seems-to-be-unreachable/377728)
**Author:** [@Madhu\_Challapalli](https://discuss.elastic.co/u/Madhu_Challapalli)\ **Replies:** 34\ **Last updated:** [May 20, 2025, 5:40am UTC](https://discuss.elastic.co/t/critical-http-10-54-120-149-9200-seems-to-be-unreachable/377728 "2025-05-20T05:40:51Z")
I have used below steps to install and run docker images for Elasticsearch and Kibana. --- ## [Optimizing Large-Scale Elasticsearch Logging Cluster for Resilience and Stability](https://discuss.elastic.co/t/optimizing-large-scale-elasticsearch-logging-cluster-for-resilience-and-stability/378283)
**Author:** [@mazerunner](https://discuss.elastic.co/u/mazerunner)\ **Replies:** 4\ **Last updated:** [May 20, 2025, 5:24am UTC](https://discuss.elastic.co/t/optimizing-large-scale-elasticsearch-logging-cluster-for-resilience-and-stability/378283 "2025-05-20T05:24:11Z")
We operate a logging cluster with: 180 hot nodes (i3.4xlarge, 400TB, 3-month retention) 250 warm nodes (i3en.2xlarge, 700TB, 15-month retention) 24 router nodes (r5.2xlarge) 3 master eligible nodes (c5.metal) Weekly in… --- ## [Issue with contextlink value for alerts](https://discuss.elastic.co/t/issue-with-contextlink-value-for-alerts/376496)
**Author:** [@MarioCDS](https://discuss.elastic.co/u/MarioCDS)\ **Replies:** 6\ **Last updated:** [May 19, 2025, 11:46pm UTC](https://discuss.elastic.co/t/issue-with-contextlink-value-for-alerts/376496 "2025-05-19T23:46:08Z")
Hello, We've been having an issue where our context.link in staging displays the wrong value for our alerts. In dev it shows the correct url like elk-dev.company.com but in staging it shows company-elk-staging.kb.westeu… --- ## [Http output "Mapping" setting sends all properties as strings](https://discuss.elastic.co/t/http-output-mapping-setting-sends-all-properties-as-strings/378309)
**Author:** [@skers95](https://discuss.elastic.co/u/skers95)\ **Replies:** 2\ **Last updated:** [May 19, 2025, 8:28pm UTC](https://discuss.elastic.co/t/http-output-mapping-setting-sends-all-properties-as-strings/378309 "2025-05-19T20:28:33Z")
Hello, I'm on Logstash v7.17, using 'http output' plugin to send logs to third party API. Per third party API spec and hard requirement, "zip" POST property must be a number, otherwise API rejects it. When I use "map… --- ## [Elasticsearch TLS through Ansible](https://discuss.elastic.co/t/elasticsearch-tls-through-ansible/378302)
**Author:** [@H\_TS](https://discuss.elastic.co/u/H_TS)\ **Replies:** 0\ **Last updated:** [May 19, 2025, 2:31pm UTC](https://discuss.elastic.co/t/elasticsearch-tls-through-ansible/378302 "2025-05-19T14:31:45Z")
Hello everybody, I am starting to lose it. I would love some assistance in setting up TLS on my Elasticsearch node. I have come quite a way, but I get stuck on trying to change the elastic user password in my ansible fil… --- ## [Getting error 'Payload Too Large' in Kibana UI](https://discuss.elastic.co/t/getting-error-payload-too-large-in-kibana-ui/378246)
**Author:** [@Natalia\_Mellino](https://discuss.elastic.co/u/Natalia_Mellino)\ **Replies:** 4\ **Last updated:** [May 19, 2025, 1:20pm UTC](https://discuss.elastic.co/t/getting-error-payload-too-large-in-kibana-ui/378246 "2025-05-19T13:20:35Z")
Hello! We are currently running the ELK on 7.17.26 version along with ReadonlyREST plugin in both Kibana an Elasticsearch in order to use Keycloak authentication in Kibana. This past weeks some users were experiencing th… --- ## [Struggling with TLS on Elasticsearch \[Ansible\]](https://discuss.elastic.co/t/struggling-with-tls-on-elasticsearch-ansible/378297)
**Author:** [@H\_TS](https://discuss.elastic.co/u/H_TS)\ **Replies:** 1\ **Last updated:** [May 19, 2025, 12:47pm UTC](https://discuss.elastic.co/t/struggling-with-tls-on-elasticsearch-ansible/378297 "2025-05-19T12:47:06Z")
Hello everyone, I am currently deploying an Elastic Stack on Azure VM's using Ansible. The installation of the components was ofcourse a walk in the park, but I can't seem to get TLS to work properly. Whenever I try to … --- ## [File Descriptors leak on upgrade to 8.17.3](https://discuss.elastic.co/t/file-descriptors-leak-on-upgrade-to-8-17-3/376685)
**Author:** [@Ricardo\_Ferreira](https://discuss.elastic.co/u/Ricardo_Ferreira)\ **Replies:** 3\ **Last updated:** [May 19, 2025, 11:48am UTC](https://discuss.elastic.co/t/file-descriptors-leak-on-upgrade-to-8-17-3/376685 "2025-05-19T11:48:39Z")
Hello, I've tried searching around the forum for potential similar issues but couldn't find anything related so apologies in advance if this issue has been raised before. I've completed an upgrade of our Elasticsearch … --- ## [Unable to generate enrollment-token for new elasticsearch node](https://discuss.elastic.co/t/unable-to-generate-enrollment-token-for-new-elasticsearch-node/378234)
**Author:** [@fabio.virive](https://discuss.elastic.co/u/fabio.virive)\ **Replies:** 3\ **Last updated:** [May 19, 2025, 11:35am UTC](https://discuss.elastic.co/t/unable-to-generate-enrollment-token-for-new-elasticsearch-node/378234 "2025-05-19T11:35:06Z")
When I use elasticsearch-create-enrollment-token -s node, to generate the token for enrol a new elastic node, I have the following error message: Unable to create enrollment token for scope \[node\] ERROR: Unable to crea… --- ## [Creating a Kinana table using a multi-field with es|ql](https://discuss.elastic.co/t/creating-a-kinana-table-using-a-multi-field-with-es-ql/377972)
**Author:** [@Robin\_Gorry](https://discuss.elastic.co/u/Robin_Gorry)\ **Replies:** 2\ **Last updated:** [May 19, 2025, 11:24am UTC](https://discuss.elastic.co/t/creating-a-kinana-table-using-a-multi-field-with-es-ql/377972 "2025-05-19T11:24:29Z")
v 8.17.4 I am trying to create a visualisation table in Kibana using an es|ql query. The main field in question is a Keyword multi-field call ItemsFound. I want the first column to be a list of unique items found. Co… --- ## [Capturing Service Layer](https://discuss.elastic.co/t/capturing-service-layer/378292)
**Author:** [@Pooya\_Mirzapour](https://discuss.elastic.co/u/Pooya_Mirzapour)\ **Replies:** 0\ **Last updated:** [May 19, 2025, 11:11am UTC](https://discuss.elastic.co/t/capturing-service-layer/378292 "2025-05-19T11:11:51Z")
I am using co.elastic.otel in my Spring boot project. Everything is working well, except I just see tracing in controller and repository level. I need to trace in service layer as well. How it is possible? My Maven depe… --- ## [Data mismatches happening while sending data to Elastic Search index using pyspark](https://discuss.elastic.co/t/data-mismatches-happening-while-sending-data-to-elastic-search-index-using-pyspark/377188)
**Author:** [@yolo1](https://discuss.elastic.co/u/yolo1)\ **Replies:** 5\ **Last updated:** [May 19, 2025, 10:24am UTC](https://discuss.elastic.co/t/data-mismatches-happening-while-sending-data-to-elastic-search-index-using-pyspark/377188 "2025-05-19T10:24:40Z")
Any idea why data sent through df.write. in pyspark the data doesn't match correctly . in the backend the data is correct. --- ## [How to know refresh interval of ES indexes?](https://discuss.elastic.co/t/how-to-know-refresh-interval-of-es-indexes/378282)
**Author:** [@philyeanaeknss](https://discuss.elastic.co/u/philyeanaeknss)\ **Replies:** 4\ **Last updated:** [May 19, 2025, 10:20am UTC](https://discuss.elastic.co/t/how-to-know-refresh-interval-of-es-indexes/378282 "2025-05-19T10:20:25Z")
I get ES indexes via /\_cat/indices endpoint. This tells me a number of documents for each index. I want to monitor such number and analyze it dynamic during three time intervals (minute/hour/day). But according inde… --- ## [ES | QL / Combining Charts?](https://discuss.elastic.co/t/es-ql-combining-charts/378050)
**Author:** [@erikg](https://discuss.elastic.co/u/erikg)\ **Replies:** 1\ **Last updated:** [May 19, 2025, 9:43am UTC](https://discuss.elastic.co/t/es-ql-combining-charts/378050 "2025-05-19T09:43:18Z")
Hello, I have this two pie charts: They are use different fields, but I would like to combine them into one: Is this possible with ES|QL [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=67) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=69)