# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=69 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 70 --- ## [How to get Elasticsearch index document count via HTTP request?](https://discuss.elastic.co/t/how-to-get-elasticsearch-index-document-count-via-http-request/378203)
**Author:** [@philyeanaeknss](https://discuss.elastic.co/u/philyeanaeknss)\ **Replies:** 2\ **Last updated:** [May 19, 2025, 9:07am UTC](https://discuss.elastic.co/t/how-to-get-elasticsearch-index-document-count-via-http-request/378203 "2025-05-19T09:07:27Z")
There's Elasticsearch Exporter and /metrics endpoint it returns es\_index\_document\_count fields. Is there an Elasticsearch API endpoint ables to return such data straight - without using exporters? --- ## [Alerting function from "Rules and Connector" can be able on Kibana version 7.17.28 with Basic License?](https://discuss.elastic.co/t/alerting-function-from-rules-and-connector-can-be-able-on-kibana-version-7-17-28-with-basic-license/378152)
**Author:** [@carbon](https://discuss.elastic.co/u/carbon)\ **Replies:** 1\ **Last updated:** [May 19, 2025, 6:31am UTC](https://discuss.elastic.co/t/alerting-function-from-rules-and-connector-can-be-able-on-kibana-version-7-17-28-with-basic-license/378152 "2025-05-19T06:31:55Z")
Alerting function from "Rules and Connector" can be able on Kibana version 7.17.28 with Basic License? --- ## [Location based recommendation](https://discuss.elastic.co/t/location-based-recommendation/374041)
**Author:** [@searchwithme](https://discuss.elastic.co/u/searchwithme)\ **Replies:** 1\ **Last updated:** [May 19, 2025, 6:29am UTC](https://discuss.elastic.co/t/location-based-recommendation/374041 "2025-05-19T06:29:17Z")
Hi team! I have a ecommerce usecase in which I want to show product recommendations based on user's geo location. eg) If they are from Chicago or somewhere cold (or even northern part of USA), as soon as the user logs i… --- ## [I want to use snapshot repositories to implement the archiving function of datastream streams](https://discuss.elastic.co/t/i-want-to-use-snapshot-repositories-to-implement-the-archiving-function-of-datastream-streams/378106)
**Author:** [@zhangzhihua](https://discuss.elastic.co/u/zhangzhihua)\ **Replies:** 1\ **Last updated:** [May 19, 2025, 6:04am UTC](https://discuss.elastic.co/t/i-want-to-use-snapshot-repositories-to-implement-the-archiving-function-of-datastream-streams/378106 "2025-05-19T06:04:29Z")
I want to leverage the snapshot repository in ES 8.18 to implement the archiving of the datastream. By saving the data to the object storage service, it enables restoration when needed. Suppose there are 10 indexes in a… --- ## [Unable to see logs in fleet integrations](https://discuss.elastic.co/t/unable-to-see-logs-in-fleet-integrations/378239)
**Author:** [@Ajeet](https://discuss.elastic.co/u/Ajeet)\ **Replies:** 1\ **Last updated:** [May 19, 2025, 5:23am UTC](https://discuss.elastic.co/t/unable-to-see-logs-in-fleet-integrations/378239 "2025-05-19T05:23:10Z")
I can see that the Fleet Agent is running, and the system-1 integration input shows as healthy, but I'm unable to see any logs. would someone assist on this, I installed fleet server on Master Elasticsearch node. --- ## [Logstash plugin installation created files](https://discuss.elastic.co/t/logstash-plugin-installation-created-files/378269)
**Author:** [@shivani\_aggarwal](https://discuss.elastic.co/u/shivani_aggarwal)\ **Replies:** 1\ **Last updated:** [May 18, 2025, 4:15pm UTC](https://discuss.elastic.co/t/logstash-plugin-installation-created-files/378269 "2025-05-18T16:15:37Z")
Hi, Background: I build docker images using logstash. After installing the logstash rpm, a few additional logstash plugins are installed. For ex. /usr/share/logstash/bin/logstash-plugin install logstash-output-opense… --- ## [Best practices for ECK on EKS with multi-AZ nodegroups and EBS volumes during node upgrades](https://discuss.elastic.co/t/best-practices-for-eck-on-eks-with-multi-az-nodegroups-and-ebs-volumes-during-node-upgrades/378256)
**Author:** [@hormander](https://discuss.elastic.co/u/hormander)\ **Replies:** 0\ **Last updated:** [May 17, 2025, 10:49am UTC](https://discuss.elastic.co/t/best-practices-for-eck-on-eks-with-multi-az-nodegroups-and-ebs-volumes-during-node-upgrades/378256 "2025-05-17T10:49:52Z")
Hi all, I'm running an Elasticsearch cluster on EKS using the ECK operator and I'm trying to understand the best way to handle node upgrades in a multi-AZ setup, especially with EBS volumes involved. Here’s a simplifie… --- ## [Vector functions in script fields context](https://discuss.elastic.co/t/vector-functions-in-script-fields-context/378254)
**Author:** [@ksalomatin](https://discuss.elastic.co/u/ksalomatin)\ **Replies:** 0\ **Last updated:** [May 17, 2025, 12:02am UTC](https://discuss.elastic.co/t/vector-functions-in-script-fields-context/378254 "2025-05-17T00:02:18Z")
Hi! I need to compute two vector similarities during search and return them as fields. Both fields are needed for downstream processing, so I cannot use scoring context that only returns a single combined score. This ol… --- ## [Log Restoration](https://discuss.elastic.co/t/log-restoration/378143)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 8\ **Last updated:** [May 16, 2025, 9:56pm UTC](https://discuss.elastic.co/t/log-restoration/378143 "2025-05-16T21:56:34Z")
Hi Team, Please advise , Long back we have ELK cluster running on 5.x after some months we have upgraded to 6.8. After a year we got VAs and we have decided to upgrade the cluster from 6.8.x to 7.17 . We are facing one … --- ## [Create Field in windows for workstation name](https://discuss.elastic.co/t/create-field-in-windows-for-workstation-name/378247)
**Author:** [@juancamiloll](https://discuss.elastic.co/u/juancamiloll)\ **Replies:** 1\ **Last updated:** [May 16, 2025, 8:47pm UTC](https://discuss.elastic.co/t/create-field-in-windows-for-workstation-name/378247 "2025-05-16T20:47:14Z")
Hello, I am currently performing a task to extract the fields related to the NTLM protocol to determine if this protocol is being used in my network. With the security, system and application logs that are collected fr… --- ## [Oracle Integration Not Sending .aud logs to Elastic](https://discuss.elastic.co/t/oracle-integration-not-sending-aud-logs-to-elastic/378102)
**Author:** [@rklee](https://discuss.elastic.co/u/rklee)\ **Replies:** 2\ **Last updated:** [May 16, 2025, 2:48pm UTC](https://discuss.elastic.co/t/oracle-integration-not-sending-aud-logs-to-elastic/378102 "2025-05-16T14:48:12Z")
In the oracle integration policy, I added the path where the oracle audit logs are located. But I am not receiving any of the logs. Any ideas? My Systems integrations logs are sending just fine. --- ## [How to Speed Up Elasticsearch bool.should Queries with Long Text Fields (Simulating max\_query\_terms in MLT)](https://discuss.elastic.co/t/how-to-speed-up-elasticsearch-bool-should-queries-with-long-text-fields-simulating-max-query-terms-in-mlt/378211)
**Author:** [@Saleh\_AbuAli](https://discuss.elastic.co/u/Saleh_AbuAli)\ **Replies:** 0\ **Last updated:** [May 16, 2025, 8:30am UTC](https://discuss.elastic.co/t/how-to-speed-up-elasticsearch-bool-should-queries-with-long-text-fields-simulating-max-query-terms-in-mlt/378211 "2025-05-16T08:30:59Z")
When dealing with large text fields like abstract (which may contain 500+ terms), using a bool.should query with multiple match or term clauses can significantly impact performance due to the sheer number of terms Elasti… --- ## [Questions about Filebeat Input Handling, QoS, and Overload Protection](https://discuss.elastic.co/t/questions-about-filebeat-input-handling-qos-and-overload-protection/378210)
**Author:** [@vnovotny98](https://discuss.elastic.co/u/vnovotny98)\ **Replies:** 0\ **Last updated:** [May 16, 2025, 7:45am UTC](https://discuss.elastic.co/t/questions-about-filebeat-input-handling-qos-and-overload-protection/378210 "2025-05-16T07:45:37Z")
Hello, I'm trying to get a better understanding of how Filebeat handles multiple inputs, especially in high-volume scenarios. 1. Input Consumption Behavior If Filebeat is reading from multiple log files—some high-volu… --- ## [Timezone in watchers](https://discuss.elastic.co/t/timezone-in-watchers/378186)
**Author:** [@RajuParipelly](https://discuss.elastic.co/u/RajuParipelly)\ **Replies:** 2\ **Last updated:** [May 16, 2025, 5:29am UTC](https://discuss.elastic.co/t/timezone-in-watchers/378186 "2025-05-16T05:29:46Z")
I attempted to configure a Watcher schedule using the timezone property as shown below: "schedule": { "timezone": "Pacific/Auckland", "daily": { "at": "12:00" } } However, when saving the Watcher, I encountered th… --- ## [How to prevent appending date.ndjson to the parsed output file](https://discuss.elastic.co/t/how-to-prevent-appending-date-ndjson-to-the-parsed-output-file/378204)
**Author:** [@MelasticSan](https://discuss.elastic.co/u/MelasticSan)\ **Replies:** 0\ **Last updated:** [May 15, 2025, 9:14pm UTC](https://discuss.elastic.co/t/how-to-prevent-appending-date-ndjson-to-the-parsed-output-file/378204 "2025-05-15T21:14:46Z")
How can I prevent filebeat from adding a "date.ndjson" to the outputfile I specify ? Is this possible output.file: path: "/tmp/filebeat" filename: filebeat.log ls /tmp/filebeat/filebeat.log\* /tmp/filebeat/filebeat.… --- ## [ISSUES WITH STARTING KABANA SERVICE](https://discuss.elastic.co/t/issues-with-starting-kabana-service/378187)
**Author:** [@eliaotito](https://discuss.elastic.co/u/eliaotito)\ **Replies:** 1\ **Last updated:** [May 15, 2025, 10:56pm UTC](https://discuss.elastic.co/t/issues-with-starting-kabana-service/378187 "2025-05-15T22:56:34Z")
Good Morning,all I have installed Kabana, Elastic Search, Filebeat on the ubuntu 24.04, but am getting an issue with accessing the URL for Kabana. Also, it shows on status it has failed like below, please let me know wh… --- ## [Kibana metric, can I get: sum of \`NumberOfPeople\` who attended clinics with a unique\`ClinicName\`?](https://discuss.elastic.co/t/kibana-metric-can-i-get-sum-of-numberofpeople-who-attended-clinics-with-a-unique-clinicname/377789)
**Author:** [@Robin\_Gorry](https://discuss.elastic.co/u/Robin_Gorry)\ **Replies:** 9\ **Last updated:** [May 15, 2025, 7:52pm UTC](https://discuss.elastic.co/t/kibana-metric-can-i-get-sum-of-numberofpeople-who-attended-clinics-with-a-unique-clinicname/377789 "2025-05-15T19:52:27Z")
v 8.17.4 In my metric visualisation I would like to show the sum of NumberOfPeople who attended clinics with a uniqueClinicName . Is this possible? I can see how I can get sum(NumberOfPeople) and unique\_count(ClinicNam… --- ## [Why Are Typical Values Negative or Missing in high\_sum Anomaly Detection in Elasticsearch?](https://discuss.elastic.co/t/why-are-typical-values-negative-or-missing-in-high-sum-anomaly-detection-in-elasticsearch/378196)
**Author:** [@Jordan\_Queiroz](https://discuss.elastic.co/u/Jordan_Queiroz)\ **Replies:** 0\ **Last updated:** [May 15, 2025, 6:30pm UTC](https://discuss.elastic.co/t/why-are-typical-values-negative-or-missing-in-high-sum-anomaly-detection-in-elasticsearch/378196 "2025-05-15T18:30:09Z")
Hello, everyone. I have a machine learning job that analyzes a numeric field where values are always greater than or equal to 0. The analysis function I'm using is high\_sum, and the field type is float. The machine lea… --- ## [Shutdown Elastic through API](https://discuss.elastic.co/t/shutdown-elastic-through-api/378194)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 1\ **Last updated:** [May 15, 2025, 5:29pm UTC](https://discuss.elastic.co/t/shutdown-elastic-through-api/378194 "2025-05-15T17:29:40Z")
Hi Team, We have Elastic cluster running(self-managed) . We wanted to shutdown or restart the service without going to server. I followed this documentation node-lifecycle but it didn't work for me. --- ## [OpenCTI Deployment and Integration with Elastic SIEM – Optimizing IOC Ingestion](https://discuss.elastic.co/t/opencti-deployment-and-integration-with-elastic-siem-optimizing-ioc-ingestion/378185)
**Author:** [@Vishag\_Learning](https://discuss.elastic.co/u/Vishag_Learning)\ **Replies:** 1\ **Last updated:** [May 15, 2025, 3:53pm UTC](https://discuss.elastic.co/t/opencti-deployment-and-integration-with-elastic-siem-optimizing-ioc-ingestion/378185 "2025-05-15T15:53:55Z")
Hi Team, I am currently working on the deployment of OpenCTI (On-Prem) and its integration with Elastic SIEM (hosted on AWS Cloud) to enable alerting based on IOC matches. To optimize storage consumption on AWS, I am co… --- ## [Delayed shutdown of filebeat only after finished processing log files](https://discuss.elastic.co/t/delayed-shutdown-of-filebeat-only-after-finished-processing-log-files/378188)
**Author:** [@durera](https://discuss.elastic.co/u/durera)\ **Replies:** 1\ **Last updated:** [May 15, 2025, 3:20pm UTC](https://discuss.elastic.co/t/delayed-shutdown-of-filebeat-only-after-finished-processing-log-files/378188 "2025-05-15T15:20:41Z")
I've not been able to find any reference to this in the docs, maybe it doesn't exist, or maybe my searchfu is failing me: is there a way to instruct filebeat to shutdown only after it's caught up with all the log files i… --- ## [Office 365 Integration Issue](https://discuss.elastic.co/t/office-365-integration-issue/378103)
**Author:** [@erikg](https://discuss.elastic.co/u/erikg)\ **Replies:** 5\ **Last updated:** [May 15, 2025, 2:49pm UTC](https://discuss.elastic.co/t/office-365-integration-issue/378103 "2025-05-15T14:49:35Z")
Hello, Anyone experiencing similar issues with the Office 365 integration? It was working fine for months and then it error out today --- ## [Proper way to extract df -h output](https://discuss.elastic.co/t/proper-way-to-extract-df-h-output/378144)
**Author:** [@yuswanul](https://discuss.elastic.co/u/yuswanul)\ **Replies:** 7\ **Last updated:** [May 15, 2025, 2:17pm UTC](https://discuss.elastic.co/t/proper-way-to-extract-df-h-output/378144 "2025-05-15T14:17:15Z")
Hello everyone, i got this data through snmp input plugin. After some mutate filter, I need to extract this data, and I chose to use grok filter. The data looks like this (there is blank space in the first line) Files… --- ## [Output file not created](https://discuss.elastic.co/t/output-file-not-created/378155)
**Author:** [@MelasticSan](https://discuss.elastic.co/u/MelasticSan)\ **Replies:** 1\ **Last updated:** [May 15, 2025, 11:12am UTC](https://discuss.elastic.co/t/output-file-not-created/378155 "2025-05-15T11:12:52Z")
Is there something wrong with my filebeat.yml file ? I am reading from one directory and copying it to another but it fails to create the file . I am not sending it to logstash or elastic . Version - filebeat version 8.… --- ## [How to know field is sortable or not](https://discuss.elastic.co/t/how-to-know-field-is-sortable-or-not/378124)
**Author:** [@Parthpuri\_Goswami](https://discuss.elastic.co/u/Parthpuri_Goswami)\ **Replies:** 3\ **Last updated:** [May 15, 2025, 10:05am UTC](https://discuss.elastic.co/t/how-to-know-field-is-sortable-or-not/378124 "2025-05-15T10:05:09Z")
Hi Everyone, In my application, I want to sort fields similar to the Kibana Discover page. After exploring the Kibana Discover page, I found that some fields are not sortable, meaning the sort functionality is disabled … --- ## [Synthetic Monitoring Private Locations per Agent](https://discuss.elastic.co/t/synthetic-monitoring-private-locations-per-agent/378139)
**Author:** [@catn0b0t](https://discuss.elastic.co/u/catn0b0t)\ **Replies:** 2\ **Last updated:** [May 15, 2025, 9:14am UTC](https://discuss.elastic.co/t/synthetic-monitoring-private-locations-per-agent/378139 "2025-05-15T09:14:56Z")
Hi, We have several fleet policies with with large numbers of agents. Now, we want to run some synthetic monitors on these agents, problem is that the monitor would look different on each host (different url to call, di… --- ## [Potential Issue in Consumer Lag Calculation on Kafka Metrics Overview Dashboard](https://discuss.elastic.co/t/potential-issue-in-consumer-lag-calculation-on-kafka-metrics-overview-dashboard/378164)
**Author:** [@Mudboyzh](https://discuss.elastic.co/u/Mudboyzh)\ **Replies:** 0\ **Last updated:** [May 15, 2025, 7:29am UTC](https://discuss.elastic.co/t/potential-issue-in-consumer-lag-calculation-on-kafka-metrics-overview-dashboard/378164 "2025-05-15T07:29:06Z")
I noticed that the Consumer Lag calculation in the \[Metrics Kafka\] Overview dashboard (8.16.0) provided by the Kafka Integration might be incorrect. I also have a Kafka UI set up for comparison, and the consumer lag val… --- ## [PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target](https://discuss.elastic.co/t/pkix-path-building-failed-sun-security-provider-certpath-suncertpathbuilderexception-unable-to-find-valid-certification-path-to-requested-target/378109)
**Author:** [@Ria](https://discuss.elastic.co/u/Ria)\ **Replies:** 4\ **Last updated:** [May 15, 2025, 6:31am UTC](https://discuss.elastic.co/t/pkix-path-building-failed-sun-security-provider-certpath-suncertpathbuilderexception-unable-to-find-valid-certification-path-to-requested-target/378109 "2025-05-15T06:31:16Z")
I'm using http\_poller input plugin in the logstash pipeline in order to ingest the REST API endpoint call response to feed into the elasticsearch index .This is my current configuration of the pipeline as I'm doing on my… --- ## [How to work Index Template?](https://discuss.elastic.co/t/how-to-work-index-template/378159)
**Author:** [@Subin\_Lee](https://discuss.elastic.co/u/Subin_Lee)\ **Replies:** 1\ **Last updated:** [May 15, 2025, 3:45am UTC](https://discuss.elastic.co/t/how-to-work-index-template/378159 "2025-05-15T03:45:54Z")
Hi there! I'm using AWS Managed OpenSearch 2.17. I'm just wondering how to work Index Templates of Elasticsearch. I want to make Index Template in Dashboard of AWS OpenSearch. If I only define 'Number of primary shar… --- ## [Scrolling API Seems Inconsistent](https://discuss.elastic.co/t/scrolling-api-seems-inconsistent/377763)
**Author:** [@Moose](https://discuss.elastic.co/u/Moose)\ **Replies:** 10\ **Last updated:** [May 14, 2025, 10:03pm UTC](https://discuss.elastic.co/t/scrolling-api-seems-inconsistent/377763 "2025-05-14T22:03:10Z")
I'm using the .NET NEST client in my Azure function to retrieve data from our Elastic account. Some of the SearchAsync requests I make exceed the 10,000 search result limit and as such I have to use the ScrollAsync reque… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=68) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=70)