# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=72 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 73 --- ## [Fleet server host setting going back to default](https://discuss.elastic.co/t/fleet-server-host-setting-going-back-to-default/377880)
**Author:** [@beginthread](https://discuss.elastic.co/u/beginthread)\ **Replies:** 3\ **Last updated:** [May 8, 2025, 1:03am UTC](https://discuss.elastic.co/t/fleet-server-host-setting-going-back-to-default/377880 "2025-05-08T01:03:30Z")
Hi team! In the fleet setting, I add an HTTPS Fleet server hosts and set it as the Default one. After a couple of minutes, it goes back to the http default one that was there. The only workaround is to change it direc… --- ## [Issue with logstash 8.17.4. Sincedb sometimes does not recognise the correct inode. After logstash restart it works](https://discuss.elastic.co/t/issue-with-logstash-8-17-4-sincedb-sometimes-does-not-recognise-the-correct-inode-after-logstash-restart-it-works/377867)
**Author:** [@devops\_training](https://discuss.elastic.co/u/devops_training)\ **Replies:** 9\ **Last updated:** [May 8, 2025, 12:12am UTC](https://discuss.elastic.co/t/issue-with-logstash-8-17-4-sincedb-sometimes-does-not-recognise-the-correct-inode-after-logstash-restart-it-works/377867 "2025-05-08T00:12:13Z")
db.log rotates to db\_backup.log. input to logstash input { file { path =\> "C:/Program Files (x86)/webserver/db/logs/db.log" exclude =\> "db\_backup.log" type =\> "db" start\_position =\> "beginning" sin… --- ## [How does Elastic know that previous version is less than 8.18.0?](https://discuss.elastic.co/t/how-does-elastic-know-that-previous-version-is-less-than-8-18-0/377924)
**Author:** [@Andy\_Beckham](https://discuss.elastic.co/u/Andy_Beckham)\ **Replies:** 2\ **Last updated:** [May 7, 2025, 8:34pm UTC](https://discuss.elastic.co/t/how-does-elastic-know-that-previous-version-is-less-than-8-18-0/377924 "2025-05-07T20:34:48Z")
I'm upgrading Elasticsearch to the latest version 9.0.1. After installing I am getting an error saying I first need to upgrade to 8.18.0 before jump to 9.0.1. No problem if I'm upgrading manually, but I need this to wo… --- ## [Visualisation metric out of global date range](https://discuss.elastic.co/t/visualisation-metric-out-of-global-date-range/377786)
**Author:** [@Robin\_Gorry](https://discuss.elastic.co/u/Robin_Gorry)\ **Replies:** 7\ **Last updated:** [May 7, 2025, 7:39pm UTC](https://discuss.elastic.co/t/visualisation-metric-out-of-global-date-range/377786 "2025-05-07T19:39:31Z")
v 8.17.4 I have a question about a specific use case, but I think it speaks to a broader principle of how Kibana works. I want to use a Metric visualisation panel to display the number of unique Clinics within the glob… --- ## [Filebeat high cpu and bandwidth usage when ES is on flood stage](https://discuss.elastic.co/t/filebeat-high-cpu-and-bandwidth-usage-when-es-is-on-flood-stage/377826)
**Author:** [@rstein](https://discuss.elastic.co/u/rstein)\ **Replies:** 5\ **Last updated:** [May 7, 2025, 5:37pm UTC](https://discuss.elastic.co/t/filebeat-high-cpu-and-bandwidth-usage-when-es-is-on-flood-stage/377826 "2025-05-07T17:37:03Z")
When using Filebeat outputting to a single node Elasticsearch, when the cluster node enters flood stage due to high disk usage, the Filebeat clients will start consuming considerable percentage of CPU and network bandwid… --- ## [Is it possible to search more than two occurrences](https://discuss.elastic.co/t/is-it-possible-to-search-more-than-two-occurrences/377837)
**Author:** [@shkhan](https://discuss.elastic.co/u/shkhan)\ **Replies:** 1\ **Last updated:** [May 7, 2025, 4:39pm UTC](https://discuss.elastic.co/t/is-it-possible-to-search-more-than-two-occurrences/377837 "2025-05-07T16:39:23Z")
I want to search keyword 'elastic' in a post which contains more than two occurrences. --- ## [File input plugin to process files not newer than X seconds ago](https://discuss.elastic.co/t/file-input-plugin-to-process-files-not-newer-than-x-seconds-ago/377915)
**Author:** [@Francesco\_Esposito](https://discuss.elastic.co/u/Francesco_Esposito)\ **Replies:** 1\ **Last updated:** [May 7, 2025, 3:43pm UTC](https://discuss.elastic.co/t/file-input-plugin-to-process-files-not-newer-than-x-seconds-ago/377915 "2025-05-07T15:43:16Z")
Hello again. I am trying to use file input plugin, read mode, delete after completion, but I need to take in charge just files that are not newer than X seconds ago. This because my logger application writes a new file… --- ## [Logstash does not accept SSL connections from beats](https://discuss.elastic.co/t/logstash-does-not-accept-ssl-connections-from-beats/377775)
**Author:** [@Ruslan\_Hafizov](https://discuss.elastic.co/u/Ruslan_Hafizov)\ **Replies:** 11\ **Last updated:** [May 7, 2025, 1:12pm UTC](https://discuss.elastic.co/t/logstash-does-not-accept-ssl-connections-from-beats/377775 "2025-05-07T13:12:04Z")
I was trying to set up SSL/TLS between beats and input beats in logstash. To create the certificates, I used the following commands: ### creating logstash.p12 elasticsearch-certutil crl --ca /usr/share/elasticsearch/con… --- ## [Slow Ingestion of Final Log Chunks (Filebeat + Logstash + Elasticsearch)](https://discuss.elastic.co/t/slow-ingestion-of-final-log-chunks-filebeat-logstash-elasticsearch/377214)
**Author:** [@RafaelXokito](https://discuss.elastic.co/u/RafaelXokito)\ **Replies:** 22\ **Last updated:** [May 7, 2025, 1:08pm UTC](https://discuss.elastic.co/t/slow-ingestion-of-final-log-chunks-filebeat-logstash-elasticsearch/377214 "2025-05-07T13:08:54Z")
Setup We are using the ELK stack to ingest logs from a file share. The logs are pre-existing files, and ingestion starts from scratch when the stack is brought up. Our setup: Elasticsearch 6 GB heap 6 replicas L… --- ## [Disable ML](https://discuss.elastic.co/t/disable-ml/377891)
**Author:** [@divadpoc](https://discuss.elastic.co/u/divadpoc)\ **Replies:** 4\ **Last updated:** [May 7, 2025, 12:42pm UTC](https://discuss.elastic.co/t/disable-ml/377891 "2025-05-07T12:42:33Z")
Hi. I just want to use the Basic license. Is there any benefit when I enable ML? Or any disadvantage when disabling ML? I don't seem to be able to find any documentation what benefits I get when using just the basic lic… --- ## [Unable to manage high load using elastic-agent.yml](https://discuss.elastic.co/t/unable-to-manage-high-load-using-elastic-agent-yml/377874)
**Author:** [@ErGeek](https://discuss.elastic.co/u/ErGeek)\ **Replies:** 3\ **Last updated:** [May 7, 2025, 12:39pm UTC](https://discuss.elastic.co/t/unable-to-manage-high-load-using-elastic-agent-yml/377874 "2025-05-07T12:39:23Z")
Hi All, We are collecting logs from the ForgeRock API using Elastic Agent, which forwards the logs to Kafka. From there, the logs are processed by Logstash. We are noticing a delay in log ingestion starting from the El… --- ## [Failed to use HTTPS for the kibana server](https://discuss.elastic.co/t/failed-to-use-https-for-the-kibana-server/377865)
**Author:** [@tomIFI](https://discuss.elastic.co/u/tomIFI)\ **Replies:** 6\ **Last updated:** [May 7, 2025, 9:47am UTC](https://discuss.elastic.co/t/failed-to-use-https-for-the-kibana-server/377865 "2025-05-07T09:47:14Z")
Hi ! I want to enable HTTPS for my kibana. I installed ELK (v9.0.0) with docker compose (v2) on my host 10.0.70.195 and I want to add more security to my stack. But now, I can't connect to the kibana interface via HTT… --- ## [:distribution:bwc:maintenance:createClone error during build](https://discuss.elastic.co/t/bwccreateclone-error-during-build/377815)
**Author:** [@jack\_a](https://discuss.elastic.co/u/jack_a)\ **Replies:** 1\ **Last updated:** [May 7, 2025, 8:28am UTC](https://discuss.elastic.co/t/bwccreateclone-error-during-build/377815 "2025-05-07T08:28:00Z")
while trying to go through the elasticsearch build process i am getting error related to task :distribution:bwc:maintenance:createClone, it seems to have something with backward compatibility check (just guessing) and i … --- ## [Wazuh Integration Issue: API Version & Alerts Index Pattern Failing in ELK Stack](https://discuss.elastic.co/t/wazuh-integration-issue-api-version-alerts-index-pattern-failing-in-elk-stack/377877)
**Author:** [@heli0s](https://discuss.elastic.co/u/heli0s)\ **Replies:** 1\ **Last updated:** [May 7, 2025, 1:43am UTC](https://discuss.elastic.co/t/wazuh-integration-issue-api-version-alerts-index-pattern-failing-in-elk-stack/377877 "2025-05-07T01:43:00Z")
Hi everyone, I am working on integrating Wazuh Manager (v4.10.1) with the ELK Stack (v7.10.2). Both are hosted on separate virtual machines: Wazuh Manager: Running on one VM (Wazuh GUI works fine). ELK Stack: Running … --- ## [Shrink of shard fails with error "source primary is allocated on another node"](https://discuss.elastic.co/t/shrink-of-shard-fails-with-error-source-primary-is-allocated-on-another-node/320360)
**Author:** [@Thomas\_Hasfjord](https://discuss.elastic.co/u/Thomas_Hasfjord)\ **Replies:** 7\ **Last updated:** [May 6, 2025, 6:25pm UTC](https://discuss.elastic.co/t/shrink-of-shard-fails-with-error-source-primary-is-allocated-on-another-node/320360 "2025-05-06T18:25:20Z")
We are running an ElasticCloud Cluster with 3 nodes and recently made a change to the lifecycle policy of one of our Data Streams: from: { "policy": { "phases": { "hot": { "actions": { "ro… --- ## [Using xml filter plugin](https://discuss.elastic.co/t/using-xml-filter-plugin/377823)
**Author:** [@Francesco\_Esposito](https://discuss.elastic.co/u/Francesco_Esposito)\ **Replies:** 5\ **Last updated:** [May 6, 2025, 3:53pm UTC](https://discuss.elastic.co/t/using-xml-filter-plugin/377823 "2025-05-06T15:53:52Z")
Hello again, I am trying to parse an XML string received on UDP input plugin with the XML filter plugin. The structure of the XML is: \ \string \ \string\ \string\ **Author:** [@guru\_dev](https://discuss.elastic.co/u/guru_dev)\ **Replies:** 9\ **Last updated:** [May 6, 2025, 3:48pm UTC](https://discuss.elastic.co/t/logstash-locks-the-file-during-the-file-rotation-in-windows-server/377793 "2025-05-06T15:48:24Z") Below is the error from logstash-plain.logstash \[2025-05-05T05:04:45,597\]\[WARN \]\[filewatch.tailmode.handlers.create\]\[main\]\[c1077e68a0985da91e9d9117b4ed7833cd278b44745ff7a8664043bc8322aec5\] failed to open file {:path=\>"C… --- ## [Displaying a string from the top row first column, possible?](https://discuss.elastic.co/t/displaying-a-string-from-the-top-row-first-column-possible/377094)
**Author:** [@JensHaglof](https://discuss.elastic.co/u/JensHaglof)\ **Replies:** 3\ **Last updated:** [May 6, 2025, 1:35pm UTC](https://discuss.elastic.co/t/displaying-a-string-from-the-top-row-first-column-possible/377094 "2025-05-06T13:35:36Z")
Imagine a table like this. I'm using the following query: | selectFilter | essql query=" SELECT case when delivery\_string like '%ups%' then 'UPS' when delivery\_string like '%dhl%' then 'DHL' … --- ## [Enrich Processor Not Working with Ingest Pipeline + Fleet Data Streams](https://discuss.elastic.co/t/enrich-processor-not-working-with-ingest-pipeline-fleet-data-streams/377809)
**Author:** [@mehrad\_ghalibafi](https://discuss.elastic.co/u/mehrad_ghalibafi)\ **Replies:** 2\ **Last updated:** [May 6, 2025, 12:31pm UTC](https://discuss.elastic.co/t/enrich-processor-not-working-with-ingest-pipeline-fleet-data-streams/377809 "2025-05-06T12:31:12Z")
Hi everyone, I'm building a small CTI platform where threat intelligence feeds (containing file hashes, IPs, etc.) are indexed into a custom index called tip\_index. I want to correlate fields like threat.indicator.file.… --- ## [Docs for indexing a document leads to an error \[Elasticsearch.NET 8.13.12\]](https://discuss.elastic.co/t/docs-for-indexing-a-document-leads-to-an-error-elasticsearch-net-8-13-12/359842)
**Author:** [@Motsols](https://discuss.elastic.co/u/Motsols)\ **Replies:** 3\ **Last updated:** [May 6, 2025, 12:28pm UTC](https://discuss.elastic.co/t/docs-for-indexing-a-document-leads-to-an-error-elasticsearch-net-8-13-12/359842 "2025-05-06T12:28:49Z")
I'm using the latest .NET client for elasticsearch. The docs shows this as an example of how to index documents: Getting started | Elasticsearch .NET Client \[8.9\] | Elastic When writing the same code in VS Community 20… --- ## [Restarting Filebeat on AKS Cluster](https://discuss.elastic.co/t/restarting-filebeat-on-aks-cluster/377749)
**Author:** [@Stephani\_Ferreira](https://discuss.elastic.co/u/Stephani_Ferreira)\ **Replies:** 3\ **Last updated:** [May 6, 2025, 11:35am UTC](https://discuss.elastic.co/t/restarting-filebeat-on-aks-cluster/377749 "2025-05-06T11:35:18Z")
Hello Elastic Forum! I've been having issues with Filebeat on our AKS clusters recently, it constantly restarts for no apparent reason. Two of our clusters are being affected by this, one for development and one for pro… --- ## [Filebeat isn’t assuming the configuration from beat.yml](https://discuss.elastic.co/t/filebeat-isn-t-assuming-the-configuration-from-beat-yml/377850)
**Author:** [@dglsilva](https://discuss.elastic.co/u/dglsilva)\ **Replies:** 0\ **Last updated:** [May 6, 2025, 10:51am UTC](https://discuss.elastic.co/t/filebeat-isn-t-assuming-the-configuration-from-beat-yml/377850 "2025-05-06T10:51:59Z")
Hello everyone, I've been trying to get my eck-stack to work, but filebeat and logstash aren't getting along very well. On the logstash side I saw that it is opening the 5044 beats port and listening. However Filebeat… --- ## [Migrate ElasticSearch Cluster to arm64](https://discuss.elastic.co/t/migrate-elasticsearch-cluster-to-arm64/377746)
**Author:** [@DanielR1](https://discuss.elastic.co/u/DanielR1)\ **Replies:** 8\ **Last updated:** [May 6, 2025, 8:45am UTC](https://discuss.elastic.co/t/migrate-elasticsearch-cluster-to-arm64/377746 "2025-05-06T08:45:56Z")
Hello! We have some big clusters installed on amd64 VMs. Given arm VMs are much cheaper we are considering moving these clusters to arm64. For example for 7.12.1 ES version, it would be possible to switch to arm64 VMs … --- ## [Filebeat does not detect log files (9.0.0)](https://discuss.elastic.co/t/filebeat-does-not-detect-log-files-9-0-0/377662)
**Author:** [@lbrame-work](https://discuss.elastic.co/u/lbrame-work)\ **Replies:** 4\ **Last updated:** [May 6, 2025, 8:15am UTC](https://discuss.elastic.co/t/filebeat-does-not-detect-log-files-9-0-0/377662 "2025-05-06T08:15:51Z")
Hello! First of all, I hope this is the right place to ask for help. I have been trying to use filebeat to forward application logs generated by an API application to a logstash instance, which then applies the necessar… --- ## [NRE on ElasticsearchClient](https://discuss.elastic.co/t/nre-on-elasticsearchclient/377820)
**Author:** [@ecrocombe](https://discuss.elastic.co/u/ecrocombe)\ **Replies:** 1\ **Last updated:** [May 6, 2025, 5:53am UTC](https://discuss.elastic.co/t/nre-on-elasticsearchclient/377820 "2025-05-06T05:53:27Z")
Im having a hard time connecting to elasticsearch form my dotnet 9 application. System.NullReferenceException: Object reference not set to an instance of an object. at Elastic.Transport.DistributedTransport\`1.Request… --- ## [Not getting log from custom path](https://discuss.elastic.co/t/not-getting-log-from-custom-path/377829)
**Author:** [@conandor](https://discuss.elastic.co/u/conandor)\ **Replies:** 1\ **Last updated:** [May 6, 2025, 3:34am UTC](https://discuss.elastic.co/t/not-getting-log-from-custom-path/377829 "2025-05-06T03:34:37Z")
I have elastic agent in fleet mode. I have docker application generate log at /log/mytest.log. I configured custom log to point to the path. All seem good but not getting log from the path. Did I missing anything? I conf… --- ## [Can't execute the elasticsearch-reset-password script](https://discuss.elastic.co/t/cant-execute-the-elasticsearch-reset-password-script/377825)
**Author:** [@Khoa\_Bui](https://discuss.elastic.co/u/Khoa_Bui)\ **Replies:** 2\ **Last updated:** [May 5, 2025, 11:00pm UTC](https://discuss.elastic.co/t/cant-execute-the-elasticsearch-reset-password-script/377825 "2025-05-05T23:00:53Z")
Hi, I am starting a fresh installation of elasticsearch on RPM using the instruction here. I got to step 6, and it doesn't seem to work: \[root@es-hscore1 elasticsearch\]# curl --cacert /etc/elasticsearch/certs/http\_ca… --- ## [Postgresql Configuration](https://discuss.elastic.co/t/postgresql-configuration/377792)
**Author:** [@Abel\_Sherino](https://discuss.elastic.co/u/Abel_Sherino)\ **Replies:** 4\ **Last updated:** [May 5, 2025, 4:38pm UTC](https://discuss.elastic.co/t/postgresql-configuration/377792 "2025-05-05T16:38:19Z")
\- module: postgresql metricsets: - database - bgwriter - activity period: 10s hosts: \["postgres://127.0.0.1:5432/?sslmode=disable"\] username: ceburupg password: "${POSTGRESQL\_PWD}" this is my postg… --- ## [How to customise a plugin for expand button](https://discuss.elastic.co/t/how-to-customise-a-plugin-for-expand-button/377568)
**Author:** [@Ishnoor\_Khroud](https://discuss.elastic.co/u/Ishnoor_Khroud)\ **Replies:** 1\ **Last updated:** [May 5, 2025, 1:42pm UTC](https://discuss.elastic.co/t/how-to-customise-a-plugin-for-expand-button/377568 "2025-05-05T13:42:22Z")
I have currently integrated the enhanced table plugin on my Kibana version 8.16.1 with the hopes that its source code could be modified to integrate an expand action button that will give detailed information on logs. Th… --- ## [Filtering ESQL Panel in a Kibana Dashboard](https://discuss.elastic.co/t/filtering-esql-panel-in-a-kibana-dashboard/377805)
**Author:** [@etp](https://discuss.elastic.co/u/etp)\ **Replies:** 1\ **Last updated:** [May 5, 2025, 10:32am UTC](https://discuss.elastic.co/t/filtering-esql-panel-in-a-kibana-dashboard/377805 "2025-05-05T10:32:00Z")
I'm creating a dashboard which uses the usual KQL for most metric panels. I have a esql based Table also in the dashboard. When filtering on the dashboard level, I see that the esql based Table is empty. Is there any spe… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=71) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=73)