# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=75 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 76 --- ## [Integration Development - CEL State Tracking Questions](https://discuss.elastic.co/t/integration-development-cel-state-tracking-questions/377528)
**Author:** [@logalicious](https://discuss.elastic.co/u/logalicious)\ **Replies:** 1\ **Last updated:** [April 27, 2025, 9:49pm UTC](https://discuss.elastic.co/t/integration-development-cel-state-tracking-questions/377528 "2025-04-27T21:49:33Z")
Hello, I have a question about tracking state in CEL programs. Why do I need to publish my state values at the end of my program or wrap the program with state.with() to reuse values defined in my state? State.with() E… --- ## [Error generating a logstash image](https://discuss.elastic.co/t/error-generating-a-logstash-image/377549)
**Author:** [@bertuz](https://discuss.elastic.co/u/bertuz)\ **Replies:** 3\ **Last updated:** [April 27, 2025, 4:30pm UTC](https://discuss.elastic.co/t/error-generating-a-logstash-image/377549 "2025-04-27T16:30:30Z")
Freshman on elastic stack here. I'm trying to generate a logstash image with the following Dockerfile: FROM docker.elastic.co/logstash/logstash:8.1.0 RUN rm -f /usr/share/logstash/pipeline/logstash.conf && \\ bin/lo… --- ## [Values less than -1 bytes are not supported when cat/indices](https://discuss.elastic.co/t/values-less-than-1-bytes-are-not-supported-when-cat-indices/377539)
**Author:** [@vsop\_479](https://discuss.elastic.co/u/vsop_479)\ **Replies:** 1\ **Last updated:** [April 27, 2025, 2:32am UTC](https://discuss.elastic.co/t/values-less-than-1-bytes-are-not-supported-when-cat-indices/377539 "2025-04-27T02:32:37Z")
My cluster is green. I saw Error from \_cat APIs: Values less than -1 bytes are not supported, but my cluster already is 7.10.2, and \_cat/indices may only involve store size? --- ## [ES Search tutorial :: 'no such index \[my\_documents\]',](https://discuss.elastic.co/t/es-search-tutorial-no-such-index-my-documents/377538)
**Author:** [@A\_ai](https://discuss.elastic.co/u/A_ai)\ **Replies:** 9\ **Last updated:** [April 26, 2025, 6:07pm UTC](https://discuss.elastic.co/t/es-search-tutorial-no-such-index-my-documents/377538 "2025-04-26T18:07:17Z")
Hi Total noob to ES. I am doing the Search tutorial here: Search Basics - Elasticsearch Labs So far so good, but when I run the sample search term 'policy', it gives me a elasticsearch.NotFoundError: NotFoundError(404… --- ## [How to improve log ingestion in multi-node cluster](https://discuss.elastic.co/t/how-to-improve-log-ingestion-in-multi-node-cluster/376679)
**Author:** [@Mohijeetsinh\_Jadeja](https://discuss.elastic.co/u/Mohijeetsinh_Jadeja)\ **Replies:** 12\ **Last updated:** [April 26, 2025, 8:19am UTC](https://discuss.elastic.co/t/how-to-improve-log-ingestion-in-multi-node-cluster/376679 "2025-04-26T08:19:18Z")
Hi Everyone, Recently we started using elasticsearch with multi-node architecture to handle heavy logs ingestion which is around 200K per second on an average during normal workload (not sure is this too much logs or no… --- ## [Way to diagnose "high watermark" or approaching high watermark?](https://discuss.elastic.co/t/way-to-diagnose-high-watermark-or-approaching-high-watermark/377536)
**Author:** [@mrodent](https://discuss.elastic.co/u/mrodent)\ **Replies:** 5\ **Last updated:** [April 26, 2025, 7:50am UTC](https://discuss.elastic.co/t/way-to-diagnose-high-watermark-or-approaching-high-watermark/377536 "2025-04-26T07:50:16Z")
Near beginner/low-low intermediate here. A few months ago I spent a long time developing an app, in Python with a Rust module, to do automatic indexing of all the text documents under a particular directory in my system… --- ## [EXCEPTION\_ACCESS\_VIOLATION (0xc0000005)](https://discuss.elastic.co/t/exception-access-violation-0xc0000005/373334)
**Author:** [@khaled-absalam](https://discuss.elastic.co/u/khaled-absalam)\ **Replies:** 1\ **Last updated:** [April 25, 2025, 5:08pm UTC](https://discuss.elastic.co/t/exception-access-violation-0xc0000005/373334 "2025-04-25T17:08:13Z")
I'm encountering error running Elasticsearch 8.17.0 on Windows 11 Pro version 24H2 with embedded Java 23.0+37, this error started occurring since I upgraded Elasticsearch to 8.16.1, I've got a memory of 128GB and I'm usi… --- ## [Availability of Older Elasticsearch Versions on Elastic Cloud (Below 8.17.5)](https://discuss.elastic.co/t/availability-of-older-elasticsearch-versions-on-elastic-cloud-below-8-17-5/377399)
**Author:** [@Aniket\_Dubey10](https://discuss.elastic.co/u/Aniket_Dubey10)\ **Replies:** 10\ **Last updated:** [April 25, 2025, 3:16pm UTC](https://discuss.elastic.co/t/availability-of-older-elasticsearch-versions-on-elastic-cloud-below-8-17-5/377399 "2025-04-25T15:16:27Z")
Is it possible to deploy an earlier version, such as 8.10.2, via Elastic Cloud — either through advanced settings or support request? --- ## [Installation of Elastic Agents on Non-Persistent VDI Machines](https://discuss.elastic.co/t/installation-of-elastic-agents-on-non-persistent-vdi-machines/377504)
**Author:** [@SaigaGentil](https://discuss.elastic.co/u/SaigaGentil)\ **Replies:** 1\ **Last updated:** [April 25, 2025, 2:01pm UTC](https://discuss.elastic.co/t/installation-of-elastic-agents-on-non-persistent-vdi-machines/377504 "2025-04-25T14:01:04Z")
Hello, We have a use case where we'd like to monitor hundreds of Citrix VDI desktops. Those are machines that are regularly rebooted and are built based on an image that's prebuilt... We have 1 image that is pushed to … --- ## [How to find saved object invalid relations](https://discuss.elastic.co/t/how-to-find-saved-object-invalid-relations/377522)
**Author:** [@JimJ](https://discuss.elastic.co/u/JimJ)\ **Replies:** 0\ **Last updated:** [April 25, 2025, 1:55pm UTC](https://discuss.elastic.co/t/how-to-find-saved-object-invalid-relations/377522 "2025-04-25T13:55:25Z")
I have a problem with saved objects and their relationships. One dashboard has some invalid relations. In Kibana "Saved Objects" panel, I can see objects' relationships. The invalid relationship's objects are all inde… --- ## [Dynamic watcher/alerting without creating multiple watches](https://discuss.elastic.co/t/dynamic-watcher-alerting-without-creating-multiple-watches/377432)
**Author:** [@Rukmangadha\_Ajay](https://discuss.elastic.co/u/Rukmangadha_Ajay)\ **Replies:** 0\ **Last updated:** [April 23, 2025, 11:47am UTC](https://discuss.elastic.co/t/dynamic-watcher-alerting-without-creating-multiple-watches/377432 "2025-04-23T11:47:18Z")
Hi all, I’m using Elasticsearch (with Kibana) to log IBM ACE message flow exceptions, and I’ve already built pipelines to successfully index logs. Now, I need to configure a Watcher to send email alerts based on specifi… --- ## [Problem with calculating flow with ELK with filebeat](https://discuss.elastic.co/t/problem-with-calculating-flow-with-elk-with-filebeat/377519)
**Author:** [@Komeyl\_Pouya](https://discuss.elastic.co/u/Komeyl_Pouya)\ **Replies:** 0\ **Last updated:** [April 25, 2025, 11:38am UTC](https://discuss.elastic.co/t/problem-with-calculating-flow-with-elk-with-filebeat/377519 "2025-04-25T11:38:07Z")
hi The problem I have with this service is that it does not calculate flow accurately. Flow is received, but filebeat and its dashboards show it extremely low and cannot be understood by any standard. --- ## [Logstash error](https://discuss.elastic.co/t/logstash-error/377282)
**Author:** [@sreya\_14](https://discuss.elastic.co/u/sreya_14)\ **Replies:** 3\ **Last updated:** [April 25, 2025, 10:01am UTC](https://discuss.elastic.co/t/logstash-error/377282 "2025-04-25T10:01:39Z")
I am getting below error in logstash log Apr 18 12:24:19 pldevelk03 logstash\[12013\]: ERROR: Failed to parse YAML file "/etc/logstash/logstash.yml". Please confirm if the YAML structure is valid (e.g. look for Apr 18 12:… --- ## [Unable to load connector in Kibana](https://discuss.elastic.co/t/unable-to-load-connector-in-kibana/375605)
**Author:** [@premk](https://discuss.elastic.co/u/premk)\ **Replies:** 2\ **Last updated:** [April 25, 2025, 8:29am UTC](https://discuss.elastic.co/t/unable-to-load-connector-in-kibana/375605 "2025-04-25T08:29:05Z")
Kibana gives error as "Unable to load connector" as and when Connector feature is accessed. Enabled the debug logs also, it doesn't give much information. Only log entry as "\[2025-03-09T13:35:00.161+04:00\]\[ERROR\]\[http\] 5… --- ## [When the pod is initially started, filebeat is unable to carry some kubernetes metadata data such as the podname and image id fields](https://discuss.elastic.co/t/when-the-pod-is-initially-started-filebeat-is-unable-to-carry-some-kubernetes-metadata-data-such-as-the-podname-and-image-id-fields/377509)
**Author:** [@zhaobiao666](https://discuss.elastic.co/u/zhaobiao666)\ **Replies:** 0\ **Last updated:** [April 25, 2025, 7:19am UTC](https://discuss.elastic.co/t/when-the-pod-is-initially-started-filebeat-is-unable-to-carry-some-kubernetes-metadata-data-such-as-the-podname-and-image-id-fields/377509 "2025-04-25T07:19:05Z")
When using Filebeat to collect container logs, I noticed that the logs from the container's standard output at startup do not include certain Kubernetes metadata fields (e.g., pod name, image ID). These fields only appea… --- ## [ElasticSearch indices](https://discuss.elastic.co/t/elasticsearch-indices/377506)
**Author:** [@newmember](https://discuss.elastic.co/u/newmember)\ **Replies:** 1\ **Last updated:** [April 25, 2025, 12:39am UTC](https://discuss.elastic.co/t/elasticsearch-indices/377506 "2025-04-25T00:39:40Z")
I checked the indices on a host that I have been given access too. There are only 2 indices I want to continue to use. Where did all these other indices come from, did ES install then as default clearly many dont have … --- ## [Duplicate indexing behavior without \_id](https://discuss.elastic.co/t/duplicate-indexing-behavior-without-id/377501)
**Author:** [@csanadpoda](https://discuss.elastic.co/u/csanadpoda)\ **Replies:** 1\ **Last updated:** [April 24, 2025, 9:07pm UTC](https://discuss.elastic.co/t/duplicate-indexing-behavior-without-id/377501 "2025-04-24T21:07:06Z")
If I were to index documents without specifying a fixed \_id, when duplicate documents appear, would they be created as duplicate entries in the index, or would ES recognize that there's already the same entry in the inde… --- ## [Implementing Relative Score Fusion for Hybrid Search in Elasticsearch](https://discuss.elastic.co/t/implementing-relative-score-fusion-for-hybrid-search-in-elasticsearch/364408)
**Author:** [@ayubSubhaniya](https://discuss.elastic.co/u/ayubSubhaniya)\ **Replies:** 3\ **Last updated:** [April 24, 2025, 7:50pm UTC](https://discuss.elastic.co/t/implementing-relative-score-fusion-for-hybrid-search-in-elasticsearch/364408 "2025-04-24T19:50:05Z")
Hello Elasticsearch Community, I'm interested in implementing Relative Score Fusion (RSF) directly in Elasticsearch to combine BM25 and kNN search results with weighted rankings based on query length or type. I want to … --- ## [Persist ESQL rows after applying AVG and STD\_DEV](https://discuss.elastic.co/t/persist-esql-rows-after-applying-avg-and-std-dev/377497)
**Author:** [@O\_O\_O](https://discuss.elastic.co/u/O_O_O)\ **Replies:** 0\ **Last updated:** [April 24, 2025, 5:01pm UTC](https://discuss.elastic.co/t/persist-esql-rows-after-applying-avg-and-std-dev/377497 "2025-04-24T17:01:10Z")
If I need to calculate the standard deviation (STD\_DEV) for each row (using a number column from the row), how do I do that? I currently have the snippet below: FROM logs-\* | WHERE event.code == "4768" AND field1 == "v… --- ## [The upgrading of the Elastic Core on premise environment (Kibana, Logstash and Elastic Cluster) from 7.17.28 to 8.17, any recommendations?](https://discuss.elastic.co/t/the-upgrading-of-the-elastic-core-on-premise-environment-kibana-logstash-and-elastic-cluster-from-7-17-28-to-8-17-any-recommendations/377465)
**Author:** [@carbon](https://discuss.elastic.co/u/carbon)\ **Replies:** 4\ **Last updated:** [April 24, 2025, 3:15pm UTC](https://discuss.elastic.co/t/the-upgrading-of-the-elastic-core-on-premise-environment-kibana-logstash-and-elastic-cluster-from-7-17-28-to-8-17-any-recommendations/377465 "2025-04-24T15:15:03Z")
The upgrading of the Elastic Core on premise environment (Kibana, Logstash and Elastic Cluster with 3 nodes) from 7.17.28 to 8.17, any recommendations? --- ## [ Help Integrating Wazuh, MISP, and Logstash into a Preventive Security Analysis Module](https://discuss.elastic.co/t/help-integrating-wazuh-misp-and-logstash-into-a-preventive-security-analysis-module/377493)
**Author:** [@Nouaman\_Ahmamcha](https://discuss.elastic.co/u/Nouaman_Ahmamcha)\ **Replies:** 0\ **Last updated:** [April 24, 2025, 2:34pm UTC](https://discuss.elastic.co/t/help-integrating-wazuh-misp-and-logstash-into-a-preventive-security-analysis-module/377493 "2025-04-24T14:34:57Z")
Hi everyone, I'm currently working on a preventive security analysis module as part of a project, and I'm integrating the following components: Wazuh for SIEM and endpoint monitoring (running via Docker) MISP for thre… --- ## [Partial snapshot](https://discuss.elastic.co/t/partial-snapshot/377473)
**Author:** [@Farheen](https://discuss.elastic.co/u/Farheen)\ **Replies:** 6\ **Last updated:** [April 24, 2025, 2:03pm UTC](https://discuss.elastic.co/t/partial-snapshot/377473 "2025-04-24T14:03:11Z")
Why the snapshots of indices has been created as partially restored? --- ## [Nested fields Issues - Remove / rename](https://discuss.elastic.co/t/nested-fields-issues-remove-rename/377447)
**Author:** [@sai\_ravi\_shankar](https://discuss.elastic.co/u/sai_ravi_shankar)\ **Replies:** 3\ **Last updated:** [April 24, 2025, 1:09pm UTC](https://discuss.elastic.co/t/nested-fields-issues-remove-rename/377447 "2025-04-24T13:09:55Z")
Hi, Can someone help me on the below issue. I have a nested object where i am unable to rename or remove such fields. Below is the format of such field. test.test1.test2.test3.test4.test5 It has 4 objects and 1 field… --- ## [Sometimes no documents are returned in Elasticsearch](https://discuss.elastic.co/t/sometimes-no-documents-are-returned-in-elasticsearch/377425)
**Author:** [@Sushmita\_Gupta](https://discuss.elastic.co/u/Sushmita_Gupta)\ **Replies:** 6\ **Last updated:** [April 24, 2025, 12:57pm UTC](https://discuss.elastic.co/t/sometimes-no-documents-are-returned-in-elasticsearch/377425 "2025-04-24T12:57:28Z")
Hi, I'm using Elasticsearch and I’ve noticed something strange. For some queries, I get no documents back, even though I have set top\_k = 4. What’s confusing is that sometimes the same query does return results, but oth… --- ## [Error connecting to Kibana: fail to get the Kibana version](https://discuss.elastic.co/t/error-connecting-to-kibana-fail-to-get-the-kibana-version/376903)
**Author:** [@lundi](https://discuss.elastic.co/u/lundi)\ **Replies:** 7\ **Last updated:** [April 24, 2025, 12:26pm UTC](https://discuss.elastic.co/t/error-connecting-to-kibana-fail-to-get-the-kibana-version/376903 "2025-04-24T12:26:39Z")
I get an error after trying to load the dashboards from Filebeat into Kibana. filebeat setup --dashboards Loading dashboards (Kibana must be running and reachable) Exiting: error connecting to Kibana: fail to get the Ki… --- ## [Logstash preserve source ip](https://discuss.elastic.co/t/logstash-preserve-source-ip/377463)
**Author:** [@omoroka](https://discuss.elastic.co/u/omoroka)\ **Replies:** 6\ **Last updated:** [April 24, 2025, 12:17pm UTC](https://discuss.elastic.co/t/logstash-preserve-source-ip/377463 "2025-04-24T12:17:29Z")
Hi, I have a logstash server running on linux and this server is collecting logs from various devices like storages, switches, firewalls etc. All device send logs to the logstash servers 514 port, most of them is fine … --- ## [Is it possible to access detailed Elastic Agent metrics via API or local socket?](https://discuss.elastic.co/t/is-it-possible-to-access-detailed-elastic-agent-metrics-via-api-or-local-socket/377456)
**Author:** [@iTiago](https://discuss.elastic.co/u/iTiago)\ **Replies:** 1\ **Last updated:** [April 24, 2025, 11:51am UTC](https://discuss.elastic.co/t/is-it-possible-to-access-detailed-elastic-agent-metrics-via-api-or-local-socket/377456 "2025-04-24T11:51:57Z")
I'm investigating the possibility of connecting directly to the Elastic Agent (without going through Elasticsearch/Fleet) to monitor the behavior of each active source/configuration in real time and with greater granular… --- ## [Guidance on architectural decision making](https://discuss.elastic.co/t/guidance-on-architectural-decision-making/377484)
**Author:** [@billie007711](https://discuss.elastic.co/u/billie007711)\ **Replies:** 0\ **Last updated:** [April 24, 2025, 10:01am UTC](https://discuss.elastic.co/t/guidance-on-architectural-decision-making/377484 "2025-04-24T10:01:40Z")
I want to move logs from Cloudwatch logs ====\> SELF MANAGED ELASTIC SEARCH CLUSTER The volume of log is 5TB/day Option1: I use aws-forwarder plugin provided by Elasticsearch Option2 I use this flow Cloudwatch log… --- ## [X509 certificate signed by unknown authority error, even with --insecure flag](https://discuss.elastic.co/t/x509-certificate-signed-by-unknown-authority-error-even-with-insecure-flag/377467)
**Author:** [@nmcc1212](https://discuss.elastic.co/u/nmcc1212)\ **Replies:** 3\ **Last updated:** [April 24, 2025, 6:57am UTC](https://discuss.elastic.co/t/x509-certificate-signed-by-unknown-authority-error-even-with-insecure-flag/377467 "2025-04-24T06:57:14Z")
Hi, I am installing the elastic agent with sudo ./elastic-agent install --url=https://\ --enrollment-token=\ --insecure In the output of sudo elastic-agent inspect there is ssl: renegotiation: neve… --- ## [Analysis of ES 7.16 Memory Consumption: Multiple Factors Leading to Memory Surge and the Mystery of 9GB Memory Stuck in GC and Optimization Exploration](https://discuss.elastic.co/t/analysis-of-es-7-16-memory-consumption-multiple-factors-leading-to-memory-surge-and-the-mystery-of-9gb-memory-stuck-in-gc-and-optimization-exploration/377472)
**Author:** [@zhangzhihua](https://discuss.elastic.co/u/zhangzhihua)\ **Replies:** 0\ **Last updated:** [April 24, 2025, 3:45am UTC](https://discuss.elastic.co/t/analysis-of-es-7-16-memory-consumption-multiple-factors-leading-to-memory-surge-and-the-mystery-of-9gb-memory-stuck-in-gc-and-optimization-exploration/377472 "2025-04-24T03:45:07Z")
The recent memory consumption of JVM is as follows: The green area has optimized space for resident memory ES的Heap内存基本上被Segment Memory、Filter Cache、Field Data Cache、Bulk Queue、Indexing Buffer、Cluster State Buffer、各类… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=74) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=76)