# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=74 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 75 --- ## [Custom Threshold not triggering alert to index](https://discuss.elastic.co/t/custom-threshold-not-triggering-alert-to-index/377531)
**Author:** [@Dave\_Houser](https://discuss.elastic.co/u/Dave_Houser)\ **Replies:** 1\ **Last updated:** [April 30, 2025, 1:00pm UTC](https://discuss.elastic.co/t/custom-threshold-not-triggering-alert-to-index/377531 "2025-04-30T13:00:34Z")
I tried to create a rule using custom threshold to write to an index for the alert action. Running 8.13. I created the index, and mappings ahead of time I added the connector + the index I tested the rule by going bel… --- ## [Logstash monitoring with eck-operator](https://discuss.elastic.co/t/logstash-monitoring-with-eck-operator/377665)
**Author:** [@Jo\_De\_Troy](https://discuss.elastic.co/u/Jo_De_Troy)\ **Replies:** 0\ **Last updated:** [April 30, 2025, 11:53am UTC](https://discuss.elastic.co/t/logstash-monitoring-with-eck-operator/377665 "2025-04-30T11:53:00Z")
Hello all, has anyone tried specifying requests/limits for the metricbeat sidecar used for monitoring a logstash resource? Is there a supported way to specify these? My logstash fails with the message "... forbidden: … --- ## [Enabling entitlements for my plugin using Elastic Search 8.18.0](https://discuss.elastic.co/t/enabling-entitlements-for-my-plugin-using-elastic-search-8-18-0/377624)
**Author:** [@eereiter](https://discuss.elastic.co/u/eereiter)\ **Replies:** 2\ **Last updated:** [April 30, 2025, 10:50am UTC](https://discuss.elastic.co/t/enabling-entitlements-for-my-plugin-using-elastic-search-8-18-0/377624 "2025-04-30T10:50:00Z")
I have a custom search plugin that I can install. I am getting an exception when the plugin gets called: Not entitled: component \[cmr\_spatial\], module \[ALL-UNNAMED\], class \[class clojure.lang.DynamicClassLoader\], entit… --- ## [I want to integrate Bitdefender into Elastic](https://discuss.elastic.co/t/i-want-to-integrate-bitdefender-into-elastic/375010)
**Author:** [@RuthGl](https://discuss.elastic.co/u/RuthGl)\ **Replies:** 15\ **Last updated:** [April 30, 2025, 9:19am UTC](https://discuss.elastic.co/t/i-want-to-integrate-bitdefender-into-elastic/375010 "2025-04-30T09:19:08Z")
Hello, I am trying to integrate Bitdefender. I am using versiion 8.16.1. I have generated the API key and added the Bitdefender integration to the Fleet Server policy with the required details according to the parameter… --- ## [opensearch circuit\_breaking\_exception parent data too large](https://discuss.elastic.co/t/opensearch-circuit-breaking-exception-parent-data-too-large/377650)
**Author:** [@eswar\_eswar](https://discuss.elastic.co/u/eswar_eswar)\ **Replies:** 1\ **Last updated:** [April 30, 2025, 9:03am UTC](https://discuss.elastic.co/t/opensearch-circuit-breaking-exception-parent-data-too-large/377650 "2025-04-30T09:03:52Z")
Apr 28 03:34:14 IND-WZ-Master-001 opensearch-dashboards\[4112561\]: {"type":"log","@timestamp":"2025-04-27T22:04:14Z","tags":\["error","opensearch","data"\],"pid":4112561,"message":"\[circuit\_breaking\_exception\]: \[parent\] Dat… --- ## [Fleet Elastic Agent enrolled but no logs are being sent](https://discuss.elastic.co/t/fleet-elastic-agent-enrolled-but-no-logs-are-being-sent/376516)
**Author:** [@francesco.amato](https://discuss.elastic.co/u/francesco.amato)\ **Replies:** 1\ **Last updated:** [April 30, 2025, 7:11am UTC](https://discuss.elastic.co/t/fleet-elastic-agent-enrolled-but-no-logs-are-being-sent/376516 "2025-04-30T07:11:25Z")
Hi, I have a problem with one of my agent I installed the agent from Kibana Fleet page as I did with all my other agents but this one doesn't send any logs I have two integration activated: system custom udp logs T… --- ## [Elastic Shard sizing](https://discuss.elastic.co/t/elastic-shard-sizing/377652)
**Author:** [@akmoharana](https://discuss.elastic.co/u/akmoharana)\ **Replies:** 0\ **Last updated:** [April 30, 2025, 6:49am UTC](https://discuss.elastic.co/t/elastic-shard-sizing/377652 "2025-04-30T06:49:08Z")
HI Team, I have deployed the ELK ion the bubernetes, the Shard size of the elasticsearch is reached to the max limit, which is affecting the performance of the ELK. Can anyone please let me know how to increase the siz… --- ## [How is decided if a certificate is valid in verificationMode: full mode](https://discuss.elastic.co/t/how-is-decided-if-a-certificate-is-valid-in-verificationmode-full-mode/377417)
**Author:** [@jack\_a](https://discuss.elastic.co/u/jack_a)\ **Replies:** 2\ **Last updated:** [April 30, 2025, 5:56am UTC](https://discuss.elastic.co/t/how-is-decided-if-a-certificate-is-valid-in-verificationmode-full-mode/377417 "2025-04-30T05:56:18Z")
Sorry if it is a simple question but, when i set verificationMode to full how is decided that certificate is valid or not? Which part of certificate is compared to what to check the certificate validation? --- ## [Unable to download kibana csv report using access token](https://discuss.elastic.co/t/unable-to-download-kibana-csv-report-using-access-token/377613)
**Author:** [@Parth\_Modi](https://discuss.elastic.co/u/Parth_Modi)\ **Replies:** 6\ **Last updated:** [April 30, 2025, 5:01am UTC](https://discuss.elastic.co/t/unable-to-download-kibana-csv-report-using-access-token/377613 "2025-04-30T05:01:11Z")
I am trying to access kibana csv report using the reporting api /api/reporting/jobs/download/{jobId}. I am able to get the data using basic authentication in my api using username and password. However when i make reques… --- ## [How to add a Custom URL to Dashboard Fields?](https://discuss.elastic.co/t/how-to-add-a-custom-url-to-dashboard-fields/377607)
**Author:** [@seefa](https://discuss.elastic.co/u/seefa)\ **Replies:** 1\ **Last updated:** [April 30, 2025, 1:22am UTC](https://discuss.elastic.co/t/how-to-add-a-custom-url-to-dashboard-fields/377607 "2025-04-30T01:22:11Z")
Hello, In the image below, I want to redirect the user to the value of a different field within the index when they click on the value in the "Application Name" field. From what I found on various forums, it seems that … --- ## [Best practices for continuous transform with fixed gte filter and tiered storage (hot/warm indices)](https://discuss.elastic.co/t/best-practices-for-continuous-transform-with-fixed-gte-filter-and-tiered-storage-hot-warm-indices/377604)
**Author:** [@ak84](https://discuss.elastic.co/u/ak84)\ **Replies:** 1\ **Last updated:** [April 29, 2025, 6:25pm UTC](https://discuss.elastic.co/t/best-practices-for-continuous-transform-with-fixed-gte-filter-and-tiered-storage-hot-warm-indices/377604 "2025-04-29T18:25:00Z")
I'm using an Elasticsearch continuous transform to aggregate data from time-based indices (These are daily indices which contain time sensitive documents). My goal is to have the transform only process data starting from… --- ## [SQLRecoverableException: ORA-17008: Closed connection](https://discuss.elastic.co/t/sqlrecoverableexception-ora-17008-closed-connection/377428)
**Author:** [@Witcherek](https://discuss.elastic.co/u/Witcherek)\ **Replies:** 3\ **Last updated:** [April 29, 2025, 2:35pm UTC](https://discuss.elastic.co/t/sqlrecoverableexception-ora-17008-closed-connection/377428 "2025-04-29T14:35:08Z")
Hello, Since two weeks we have problem that from time to time our logstash pipeline which is connecting to oracle databse with jdbc\_streaming filter is throwing, exception=\>#\ **Author:** [@dogost](https://discuss.elastic.co/u/dogost)\ **Replies:** 0\ **Last updated:** [April 29, 2025, 2:16pm UTC](https://discuss.elastic.co/t/shards-metrics-of-elastic-agent-integration-elasticsearch-randomly-written-in-elasticsearch/377627 "2025-04-29T14:16:02Z") Hello, We are currently using Elastic Agent with the integration Elasticsearch, everything works as expected except the Shard metrics which seems to be written randomly into the cluster. We are using ES 8.17.3 with Ela… --- ## [Gitlab Integration Issue on Fleet Server](https://discuss.elastic.co/t/gitlab-integration-issue-on-fleet-server/377242)
**Author:** [@Lorenzo\_Z02](https://discuss.elastic.co/u/Lorenzo_Z02)\ **Replies:** 4\ **Last updated:** [April 29, 2025, 1:42pm UTC](https://discuss.elastic.co/t/gitlab-integration-issue-on-fleet-server/377242 "2025-04-29T13:42:26Z")
Dear all, I'm currently testing for sending the gitlab logs/metrics with the integration via Fleet Server on the Kibana Dashboard. As you can see on the screenshots , the agents results "HEALTHY", But I'dont know where… --- ## [Extract a specific field from a string](https://discuss.elastic.co/t/extract-a-specific-field-from-a-string/377618)
**Author:** [@stanislavcik](https://discuss.elastic.co/u/stanislavcik)\ **Replies:** 2\ **Last updated:** [April 29, 2025, 1:19pm UTC](https://discuss.elastic.co/t/extract-a-specific-field-from-a-string/377618 "2025-04-29T13:19:58Z")
How to extract a specific field from a string if the string length varies? --- ## [Cannot create ES7 instances on Elastic Cloud](https://discuss.elastic.co/t/cannot-create-es7-instances-on-elastic-cloud/377616)
**Author:** [@PaulBonnel](https://discuss.elastic.co/u/PaulBonnel)\ **Replies:** 2\ **Last updated:** [April 29, 2025, 12:49pm UTC](https://discuss.elastic.co/t/cannot-create-es7-instances-on-elastic-cloud/377616 "2025-04-29T12:49:53Z")
Hello, We cannot create ES7 instances on Elastic Cloud. Is this expected? We are quite surprised by this change since EOL of ES7 is scheduled for early 2026. Thanks --- ## [Elasticsearch trying to get access to old shards](https://discuss.elastic.co/t/elasticsearch-trying-to-get-access-to-old-shards/377421)
**Author:** [@TheJ](https://discuss.elastic.co/u/TheJ)\ **Replies:** 1\ **Last updated:** [April 29, 2025, 11:41am UTC](https://discuss.elastic.co/t/elasticsearch-trying-to-get-access-to-old-shards/377421 "2025-04-29T11:41:53Z")
Hi, I have hot nodes with weekly data retention and 3 warm nodes with yearly retention. When I try to run a query to get logs from the last 5 days, Elasticsearch is trying to access shards that were created a month ago … --- ## [Elastic PostgreSQL connector 8.12.2 with track\_commit\_timestamp off](https://discuss.elastic.co/t/elastic-postgresql-connector-8-12-2-with-track-commit-timestamp-off/377593)
**Author:** [@apostolos.e](https://discuss.elastic.co/u/apostolos.e)\ **Replies:** 2\ **Last updated:** [April 29, 2025, 7:15am UTC](https://discuss.elastic.co/t/elastic-postgresql-connector-8-12-2-with-track-commit-timestamp-off/377593 "2025-04-29T07:15:04Z")
Hi all, I am using ELK 8.12.2 along with Elastic PostgreSQL connector 8.12.2. Both have been setup on premises, in my infra. When track\_commit\_timestamp is off, the connector fails with: DBAPIError: (sqlalchemy.dialec… --- ## [ Ignoring the 'pipelines.yml' file because modules or command line options are specified](https://discuss.elastic.co/t/ignoring-the-pipelines-yml-file-because-modules-or-command-line-options-are-specified/377587)
**Author:** [@somiii\_AB](https://discuss.elastic.co/u/somiii_AB)\ **Replies:** 2\ **Last updated:** [April 28, 2025, 9:22pm UTC](https://discuss.elastic.co/t/ignoring-the-pipelines-yml-file-because-modules-or-command-line-options-are-specified/377587 "2025-04-28T21:22:52Z")
Is it possible to run multiple pipelines on the Windows version of Logstash? I can’t seem to get this to work for my files. I have installed Logstash on Windows and placed a pipelines.yml file in C:\\Program Files\\Logsta… --- ## [Odd query help?](https://discuss.elastic.co/t/odd-query-help/377586)
**Author:** [@ChrisR](https://discuss.elastic.co/u/ChrisR)\ **Replies:** 2\ **Last updated:** [April 28, 2025, 7:23pm UTC](https://discuss.elastic.co/t/odd-query-help/377586 "2025-04-28T19:23:20Z")
Is there a way to query for docs that contain one and only one keyword value? For example, supposing these docs: {"id": 1, "keywd": \["A"\]} {"id": 2, "keywd": \["B"\]} {"id": 3, "keywd": \["A", "B"\]} Is there a way to que… --- ## [Elastic agent replace logstash](https://discuss.elastic.co/t/elastic-agent-replace-logstash/375111)
**Author:** [@michael005](https://discuss.elastic.co/u/michael005)\ **Replies:** 14\ **Last updated:** [April 28, 2025, 7:05pm UTC](https://discuss.elastic.co/t/elastic-agent-replace-logstash/375111 "2025-04-28T19:05:11Z")
Hello, I've searched the forum and the elastic site, but haven't quite found what I'm looking for. I'm trying to get a better understanding of elastic agents to setup my test environment appropriately. I want to use mu… --- ## [Elasticsearch node is offline on Stack Monitoring](https://discuss.elastic.co/t/elasticsearch-node-is-offline-on-stack-monitoring/377577)
**Author:** [@makinshin](https://discuss.elastic.co/u/makinshin)\ **Replies:** 0\ **Last updated:** [April 28, 2025, 1:02pm UTC](https://discuss.elastic.co/t/elasticsearch-node-is-offline-on-stack-monitoring/377577 "2025-04-28T13:02:17Z")
Hello everyone! My node dispalyed as offline, but it's working. How to fix this problem? Elk and metricbeat are installed on the same VM. GET / { "name" : "elk-0", "cluster\_name" : "elasticsearch", "cluster… --- ## [Logstash JMS Input Plugin Failing to Connect to Broker URL (tcp://localhost:7222)](https://discuss.elastic.co/t/logstash-jms-input-plugin-failing-to-connect-to-broker-url-tcp-localhost-7222/371771)
**Author:** [@Loredana](https://discuss.elastic.co/u/Loredana)\ **Replies:** 1\ **Last updated:** [April 28, 2025, 1:00pm UTC](https://discuss.elastic.co/t/logstash-jms-input-plugin-failing-to-connect-to-broker-url-tcp-localhost-7222/371771 "2025-04-28T13:00:32Z")
Hi, We are using the Logstash JMS input plugin to read events from a JMS Queue and send them to Elasticsearch. However, we are encountering a strange issue where Logstash tries to connect to a default URL (tcp://localho… --- ## [Performance Issue with KNN + Filter on Large Index (v8.12)](https://discuss.elastic.co/t/performance-issue-with-knn-filter-on-large-index-v8-12/377279)
**Author:** [@Saleh\_AbuAli](https://discuss.elastic.co/u/Saleh_AbuAli)\ **Replies:** 12\ **Last updated:** [April 28, 2025, 12:48pm UTC](https://discuss.elastic.co/t/performance-issue-with-knn-filter-on-large-index-v8-12/377279 "2025-04-28T12:48:33Z")
Hi, I’m currently using KNN search in Elasticsearch (version 8.12) with the following setup: Query vector dimension: 384 Index size: 200M+ documents k = 100, num\_candidates = 200 Quantized vectors using 'int8\_hnsw' in… --- ## [Logstash does not see a field](https://discuss.elastic.co/t/logstash-does-not-see-a-field/377570)
**Author:** [@Rnx](https://discuss.elastic.co/u/Rnx)\ **Replies:** 4\ **Last updated:** [April 28, 2025, 12:31pm UTC](https://discuss.elastic.co/t/logstash-does-not-see-a-field/377570 "2025-04-28T12:31:17Z")
I can't reprocess any field in Logstash which is ingested from Jdbc. All Fields are properly inserted into Elastic, they have proper name and data, however I can't transform them anyhow. Here is the configuration: input… --- ## [Missing index pattern](https://discuss.elastic.co/t/missing-index-pattern/377559)
**Author:** [@Ayushi\_bhardwaj](https://discuss.elastic.co/u/Ayushi_bhardwaj)\ **Replies:** 1\ **Last updated:** [April 28, 2025, 12:27pm UTC](https://discuss.elastic.co/t/missing-index-pattern/377559 "2025-04-28T12:27:30Z")
I am trying to fetch the index in a specific dashboard however the index pattern goes missing For an Example:- In discover i can see 10 pattern but in dashboard in add filter section only limited index patterns are visi… --- ## [Ingest-data with problem in Kubernetes na GKE](https://discuss.elastic.co/t/ingest-data-with-problem-in-kubernetes-na-gke/377575)
**Author:** [@Renato\_Souza](https://discuss.elastic.co/u/Renato_Souza)\ **Replies:** 0\ **Last updated:** [April 28, 2025, 12:17pm UTC](https://discuss.elastic.co/t/ingest-data-with-problem-in-kubernetes-na-gke/377575 "2025-04-28T12:17:38Z")
I am implementing the stack below in my gke cluster version 1.30.10-gke.1022000 and I am getting an error in the ingest-data pod, it cannot start due to changes in the stateFulSet. apiVersion: argoproj.io/v1alpha1 kind:… --- ## [Index lifecycle policy](https://discuss.elastic.co/t/index-lifecycle-policy/377513)
**Author:** [@Frances\_Chu](https://discuss.elastic.co/u/Frances_Chu)\ **Replies:** 4\ **Last updated:** [April 28, 2025, 7:20am UTC](https://discuss.elastic.co/t/index-lifecycle-policy/377513 "2025-04-28T07:20:17Z")
I have two types of index in my system: Index\_A, where I store all documents, with '@timestamp' representing the log injection time to Elasticsearch, and '\_datetime' indicating the log's own timestamp. In order to minim… --- ## [Drill-down support in kibana Enterprise 2022.10.4 (build 117134)](https://discuss.elastic.co/t/drill-down-support-in-kibana-enterprise-2022-10-4-build-117134/377560)
**Author:** [@Guy\_Levin](https://discuss.elastic.co/u/Guy_Levin)\ **Replies:** 0\ **Last updated:** [April 28, 2025, 7:14am UTC](https://discuss.elastic.co/t/drill-down-support-in-kibana-enterprise-2022-10-4-build-117134/377560 "2025-04-28T07:14:15Z")
I have Kibana Enterprise 2022.10.4 (build 117134). I noticed that when I try to add a drill-down, there are two choices. The "go to dashboard" choice is enabled. The "go to url" is disabled. Is this disablement becau… --- ## [Multiple threat frameworks in a single rule](https://discuss.elastic.co/t/multiple-threat-frameworks-in-a-single-rule/377533)
**Author:** [@nahuel978](https://discuss.elastic.co/u/nahuel978)\ **Replies:** 3\ **Last updated:** [April 28, 2025, 2:55am UTC](https://discuss.elastic.co/t/multiple-threat-frameworks-in-a-single-rule/377533 "2025-04-28T02:55:41Z")
I'm interested in knowing if any Elastic detection rules use two different threat frameworks within the same rule. According to the ECS documentation: The threat.framework field is defined as a keyword, which suggests… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=73) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=75)