# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=76 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 77 --- ## [Filtered Fleet Agents Show in other spaces](https://discuss.elastic.co/t/filtered-fleet-agents-show-in-other-spaces/377419)
**Author:** [@kulisiber](https://discuss.elastic.co/u/kulisiber)\ **Replies:** 2\ **Last updated:** [April 24, 2025, 1:54am UTC](https://discuss.elastic.co/t/filtered-fleet-agents-show-in-other-spaces/377419 "2025-04-24T01:54:32Z")
Hi everyone, Can I display the fleet agents that have been filtered specifically for that space in the Management \>\> Fleet menu. Please advise. Thanks before --- ## [Reindexing to new index after doing some filter](https://discuss.elastic.co/t/reindexing-to-new-index-after-doing-some-filter/377469)
**Author:** [@kulisiber](https://discuss.elastic.co/u/kulisiber)\ **Replies:** 0\ **Last updated:** [April 24, 2025, 1:49am UTC](https://discuss.elastic.co/t/reindexing-to-new-index-after-doing-some-filter/377469 "2025-04-24T01:49:40Z")
I would like to ask about ingest pipeline in Elastic SIEM. I'm a newbie here, sorry if I have a lot of questions. How to reindex from default index .kibana\_alerting\_cases\_8.15.0\_001 to a new index after filtering? I've … --- ## [Filebeat not sending all the logs to the output file](https://discuss.elastic.co/t/filebeat-not-sending-all-the-logs-to-the-output-file/377468)
**Author:** [@MelasticSan](https://discuss.elastic.co/u/MelasticSan)\ **Replies:** 0\ **Last updated:** [April 23, 2025, 11:16pm UTC](https://discuss.elastic.co/t/filebeat-not-sending-all-the-logs-to-the-output-file/377468 "2025-04-23T23:16:46Z")
There are a couple of files in /opt/logs/\*.0 and the file beat reads them properly but does not print all the lines and sends them to the output file . Is there a problem with my matching ? How can I make sure everythin… --- ## [ES v7.9 versus ES v8.17.3 performance](https://discuss.elastic.co/t/es-v7-9-versus-es-v8-17-3-performance/377459)
**Author:** [@kbnm](https://discuss.elastic.co/u/kbnm)\ **Replies:** 0\ **Last updated:** [April 23, 2025, 7:07pm UTC](https://discuss.elastic.co/t/es-v7-9-versus-es-v8-17-3-performance/377459 "2025-04-23T19:07:17Z")
Hi Elastic, I am wondering what performance gains there are from upgrading from Elasticsearch 7.9 to Elasticsearch 8.17.3. Is there documentation on performance metrics comparisons? --- ## [Logstash Troubleshooting: ERROR - (EACCES) Permission denied to output-file-path](https://discuss.elastic.co/t/logstash-troubleshooting-error-eacces-permission-denied-to-output-file-path/377407)
**Author:** [@MonkeyDono](https://discuss.elastic.co/u/MonkeyDono)\ **Replies:** 5\ **Last updated:** [April 23, 2025, 6:01pm UTC](https://discuss.elastic.co/t/logstash-troubleshooting-error-eacces-permission-denied-to-output-file-path/377407 "2025-04-23T18:01:01Z")
Hello I've been using Logstash for integration with Wazuh. Usually I hadn't have any issues by this since the pipeline it's pretty straight forward. My usuall config is the next one: input { syslog { port =\> … --- ## [Elastic agent enroll fail : Error: fail to enroll: fail to execute request to fleet-server: Forbidden](https://discuss.elastic.co/t/elastic-agent-enroll-fail-error-fail-to-enroll-fail-to-execute-request-to-fleet-server-forbidden/376893)
**Author:** [@Priyanka\_chauhan](https://discuss.elastic.co/u/Priyanka_chauhan)\ **Replies:** 1\ **Last updated:** [April 23, 2025, 4:28pm UTC](https://discuss.elastic.co/t/elastic-agent-enroll-fail-error-fail-to-enroll-fail-to-execute-request-to-fleet-server-forbidden/376893 "2025-04-23T16:28:35Z")
{"log.level":"info","@timestamp":"2025-04-08T10:39:28.316+0530","log.origin":{"function":"github.com/elastic/elastic-agent/internal/pkg/agent/cmd.(\*enrollCmd).enrollWithBackoff","file.name":"cmd/enroll\_cmd.go","file.line… --- ## [How to change Fleet server's Elasticsearch url?](https://discuss.elastic.co/t/how-to-change-fleet-servers-elasticsearch-url/377415)
**Author:** [@kevinlin](https://discuss.elastic.co/u/kevinlin)\ **Replies:** 1\ **Last updated:** [April 23, 2025, 4:24pm UTC](https://discuss.elastic.co/t/how-to-change-fleet-servers-elasticsearch-url/377415 "2025-04-23T16:24:54Z")
sudo elastic-agent inspect ...omit... fleet: access\_api\_key: omit agent: id: omit enabled: true host: localhost:8221 hosts: - https://192.168.0.11:8220 protocol: https proxy\_disable: true server: host: 0.0.0.0 inte… --- ## [Logstash: Client requested protocol TLSv1 is not enabled or supported in server context](https://discuss.elastic.co/t/logstash-client-requested-protocol-tlsv1-is-not-enabled-or-supported-in-server-context/377451)
**Author:** [@mikewillis](https://discuss.elastic.co/u/mikewillis)\ **Replies:** 0\ **Last updated:** [April 23, 2025, 3:23pm UTC](https://discuss.elastic.co/t/logstash-client-requested-protocol-tlsv1-is-not-enabled-or-supported-in-server-context/377451 "2025-04-23T15:23:27Z")
Logstash version 7.17. Can advise on why this error incessantly appears in the Logstash log, or any steps to figure out why? \[2025-04-22T14:00:00,158\]\[ERROR\]\[logstash.inputs.tcp \] null: closing due: io.netty.handl… --- ## [Is Graph Deperecated?](https://discuss.elastic.co/t/is-graph-deperecated/377289)
**Author:** [@erikg](https://discuss.elastic.co/u/erikg)\ **Replies:** 2\ **Last updated:** [April 23, 2025, 2:08pm UTC](https://discuss.elastic.co/t/is-graph-deperecated/377289 "2025-04-23T14:08:04Z")
Hello, I was wondering how come Graph never made it as a visualization in Dashboards. It also has little to no improvements in the last years, is this going away? --- ## [Elasticsearch version upgradation](https://discuss.elastic.co/t/elasticsearch-version-upgradation/377439)
**Author:** [@Vigneshraja](https://discuss.elastic.co/u/Vigneshraja)\ **Replies:** 1\ **Last updated:** [April 23, 2025, 2:02pm UTC](https://discuss.elastic.co/t/elasticsearch-version-upgradation/377439 "2025-04-23T14:02:36Z")
hello, actually we are using elasticseach and kibana as a docker container in version 8.14.1. currently the version is 9.0.0, how can we migrate to latest version without any data/indices loss?? when we tried using vo… --- ## [Performance penalty of many multi-fields with chains of normalizers](https://discuss.elastic.co/t/performance-penalty-of-many-multi-fields-with-chains-of-normalizers/377440)
**Author:** [@petrsimon](https://discuss.elastic.co/u/petrsimon)\ **Replies:** 0\ **Last updated:** [April 23, 2025, 1:11pm UTC](https://discuss.elastic.co/t/performance-penalty-of-many-multi-fields-with-chains-of-normalizers/377440 "2025-04-23T13:11:11Z")
Hi, I wanted to tidy up one index where several fields were created in application just for some specific searches. The content of those fields is normalized (some text removed, some replaced). So the application did th… --- ## [When Does BBQ Quantization Outperform Scalar Quantization](https://discuss.elastic.co/t/when-does-bbq-quantization-outperform-scalar-quantization/377393)
**Author:** [@DylanWelzel](https://discuss.elastic.co/u/DylanWelzel)\ **Replies:** 1\ **Last updated:** [April 23, 2025, 12:32pm UTC](https://discuss.elastic.co/t/when-does-bbq-quantization-outperform-scalar-quantization/377393 "2025-04-23T12:32:26Z")
Hi all, I’m experimenting with the new vector quantization formats in Elasticsearch 8.x and trying to figure out at what dataset size BBQ (binary quantization) really starts to outperform scalar quantization. What I’m … --- ## [How to dynamically route FortiGate logs to different data\_stream namespaces based on devid using Logstash?](https://discuss.elastic.co/t/how-to-dynamically-route-fortigate-logs-to-different-data-stream-namespaces-based-on-devid-using-logstash/377412)
**Author:** [@wangsubo](https://discuss.elastic.co/u/wangsubo)\ **Replies:** 3\ **Last updated:** [April 23, 2025, 12:25pm UTC](https://discuss.elastic.co/t/how-to-dynamically-route-fortigate-logs-to-different-data-stream-namespaces-based-on-devid-using-logstash/377412 "2025-04-23T12:25:49Z")
Hi everyone, I’m currently working on integrating logs from two FortiGate devices into Elasticsearch via the following pipeline: FortiGate (x2) → Elastic Agent (Fortigate Integration) → Logstash (Data Stream dynamic na… --- ## [Docker image v9.0.0 could not be found](https://discuss.elastic.co/t/docker-image-v9-0-0-could-not-be-found/377436)
**Author:** [@ceVW](https://discuss.elastic.co/u/ceVW)\ **Replies:** 0\ **Last updated:** [April 23, 2025, 12:15pm UTC](https://discuss.elastic.co/t/docker-image-v9-0-0-could-not-be-found/377436 "2025-04-23T12:15:26Z")
I'm trying to rollout a Kubernetes integration from our newly deployed Elastic 9.0.0 deployment. After applying the manifest k8s provides me with the error 'ImagePullBackOff'. The provided manifest in the integration s… --- ## [\`WriteTo\` JSON formatter](https://discuss.elastic.co/t/writeto-json-formatter/377362)
**Author:** [@khteh](https://discuss.elastic.co/u/khteh)\ **Replies:** 1\ **Last updated:** [April 23, 2025, 12:03pm UTC](https://discuss.elastic.co/t/writeto-json-formatter/377362 "2025-04-23T12:03:04Z")
I use GitHub - denis-peshkov/Serilog.Enrichers.HttpContext: Enriches Serilog events with client IP, Correlation Id, RequestBody, RequestQuery, HTTP request headers and information of the memory usage. to extract http h… --- ## [Issue with OpenJDK Vulnerabilities (CVE-2024) in Elasticsearch 8.15.2](https://discuss.elastic.co/t/issue-with-openjdk-vulnerabilities-cve-2024-in-elasticsearch-8-15-2/377328)
**Author:** [@debbbuu](https://discuss.elastic.co/u/debbbuu)\ **Replies:** 8\ **Last updated:** [April 23, 2025, 11:14am UTC](https://discuss.elastic.co/t/issue-with-openjdk-vulnerabilities-cve-2024-in-elasticsearch-8-15-2/377328 "2025-04-23T11:14:19Z")
Hi, As part of the vulnerability assessment (VA) scan on our ELK servers, we identified that the OpenJDK version is affected by multiple vulnerabilities. We are using a self-managed cluster. We did upgrade the ELK stack… --- ## [Logs not being recieved by Elasticsearch/Kibana from filebeats after following quick install instructions](https://discuss.elastic.co/t/logs-not-being-recieved-by-elasticsearch-kibana-from-filebeats-after-following-quick-install-instructions/377392)
**Author:** [@Will\_TfL](https://discuss.elastic.co/u/Will_TfL)\ **Replies:** 3\ **Last updated:** [April 23, 2025, 10:48am UTC](https://discuss.elastic.co/t/logs-not-being-recieved-by-elasticsearch-kibana-from-filebeats-after-following-quick-install-instructions/377392 "2025-04-23T10:48:55Z")
Hi All, Filebeats is connecting with Kibana, and I assume it is also connecting with Elasticsearch too. I can't understand, however, why the logs are not being recieived. This is what I see when accessing Kibana: Th… --- ## [Scope of the filestream input id](https://discuss.elastic.co/t/scope-of-the-filestream-input-id/377244)
**Author:** [@d3jolly](https://discuss.elastic.co/u/d3jolly)\ **Replies:** 0\ **Last updated:** [April 17, 2025, 9:31am UTC](https://discuss.elastic.co/t/scope-of-the-filestream-input-id/377244 "2025-04-17T09:31:35Z")
Hey, From the documentation A unique identifier for this filestream input. Each filestream input must have a unique ID. Filestream will not start inputs with duplicated IDs. What's the scope of the id? Global in ES?… --- ## [Non romanized lanuages like chinese, korean japanese](https://discuss.elastic.co/t/non-romanized-lanuages-like-chinese-korean-japanese/376786)
**Author:** [@Shabana\_Rumane](https://discuss.elastic.co/u/Shabana_Rumane)\ **Replies:** 1\ **Last updated:** [April 23, 2025, 8:57am UTC](https://discuss.elastic.co/t/non-romanized-lanuages-like-chinese-korean-japanese/376786 "2025-04-23T08:57:34Z")
Along with using plugins to help tokenize documents, is there any other way to identify similar words in different script or synonyms other than specifying them in the synonyms.txt? --- ## [3 Node Sankey Diagramm](https://discuss.elastic.co/t/3-node-sankey-diagramm/376671)
**Author:** [@Phil91](https://discuss.elastic.co/u/Phil91)\ **Replies:** 2\ **Last updated:** [April 23, 2025, 8:45am UTC](https://discuss.elastic.co/t/3-node-sankey-diagramm/376671 "2025-04-23T08:45:48Z")
Hi, I have a working 3 Node Sankey Diagramm but the lines go anywehre and not where they should go. { "$schema": "https://vega.github.io/schema/vega/v3.0.json", "data": \[ { "name": "rawData", "url":… --- ## [Logs by network device](https://discuss.elastic.co/t/logs-by-network-device/377387)
**Author:** [@josep68](https://discuss.elastic.co/u/josep68)\ **Replies:** 3\ **Last updated:** [April 23, 2025, 7:36am UTC](https://discuss.elastic.co/t/logs-by-network-device/377387 "2025-04-23T07:36:56Z")
Hello, I am a new user of ELK. I have seen how to use filebeat to monitor Linux and windows. How can I proceed to monitor lan devices such as Dahua or Hanwha cameras or Cambium and Ubiquity radio bridges? Thanks --- ## [Netflow.flow\_id data type incorrectly set to long instead of unsigned-long](https://discuss.elastic.co/t/netflow-flow-id-data-type-incorrectly-set-to-long-instead-of-unsigned-long/377377)
**Author:** [@vjineo](https://discuss.elastic.co/u/vjineo)\ **Replies:** 6\ **Last updated:** [April 23, 2025, 7:20am UTC](https://discuss.elastic.co/t/netflow-flow-id-data-type-incorrectly-set-to-long-instead-of-unsigned-long/377377 "2025-04-23T07:20:22Z")
In /etc/filebeats/fields.yaml file, netflow.flow\_id is set to type long. - name: flow\_id type: long As per NetFlow standard, it should be unsigned long. Because of this, events are getting dropped wi… --- ## [Output Plugin for Azure LAW or EventHub](https://discuss.elastic.co/t/output-plugin-for-azure-law-or-eventhub/377360)
**Author:** [@ricki1234](https://discuss.elastic.co/u/ricki1234)\ **Replies:** 3\ **Last updated:** [April 23, 2025, 5:17am UTC](https://discuss.elastic.co/t/output-plugin-for-azure-law-or-eventhub/377360 "2025-04-23T05:17:12Z")
Hello I'm trying to get data from an elasticsearch cluster to an Azure log-analytics-workspace or to an azure eventhub. Are there any output-plugins (I've read about the microsoft-logstash-output-azure-loganalytics - do… --- ## [Issue with Time Filters per Column in Kibana Lens when Global Time Filter is Applied](https://discuss.elastic.co/t/issue-with-time-filters-per-column-in-kibana-lens-when-global-time-filter-is-applied/377408)
**Author:** [@arrax\_10](https://discuss.elastic.co/u/arrax_10)\ **Replies:** 0\ **Last updated:** [April 23, 2025, 12:51am UTC](https://discuss.elastic.co/t/issue-with-time-filters-per-column-in-kibana-lens-when-global-time-filter-is-applied/377408 "2025-04-23T00:51:52Z")
Hello Elastic community! I am encountering an issue in Kibana Lens and I hope someone can help me resolve it. I am using Kibana Lens to create a data visualization, and I have several columns calculating accumulated val… --- ## [Multiple data path](https://discuss.elastic.co/t/multiple-data-path/377401)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 1\ **Last updated:** [April 22, 2025, 8:35pm UTC](https://discuss.elastic.co/t/multiple-data-path/377401 "2025-04-22T20:35:04Z")
Are Elastic removing multple data.path? It was deprecated in 8.0 but not remove due to push back from community. what is the verdict on version 9.0? --- ## [Filebeats NetFlow: Events dropped due to out of range of long value](https://discuss.elastic.co/t/filebeats-netflow-events-dropped-due-to-out-of-range-of-long-value/377375)
**Author:** [@vjineo](https://discuss.elastic.co/u/vjineo)\ **Replies:** 1\ **Last updated:** [April 22, 2025, 2:42pm UTC](https://discuss.elastic.co/t/filebeats-netflow-events-dropped-due-to-out-of-range-of-long-value/377375 "2025-04-22T14:42:41Z")
Most of the events are dropped with below error: {\\"type\\":\\"document\_parsing\_exception\\",\\"reason\\":\\"\[1:1475\] failed to parse field \[netflow.flow\_id\] of type \[long\] in document with id 'M7a4XZYB\_Zr7jpsbS6pn'. Preview … --- ## [Dockerfiles – Ubuntu 20.04 EOL May 31, 2025 (Ubuntu 22.04 Upgrade)](https://discuss.elastic.co/t/dockerfiles-ubuntu-20-04-eol-may-31-2025-ubuntu-22-04-upgrade/377381)
**Author:** [@pclem](https://discuss.elastic.co/u/pclem)\ **Replies:** 0\ **Last updated:** [April 22, 2025, 2:41pm UTC](https://discuss.elastic.co/t/dockerfiles-ubuntu-20-04-eol-may-31-2025-ubuntu-22-04-upgrade/377381 "2025-04-22T14:41:38Z")
Hey Community! This is my first time posting here, so apologies if my post breaks any rules. Our team relies heavily on Elasticsearch Docker Images (Elasticsearch, Logstash, Filebeat), which currently use Ubuntu 20.04 … --- ## [Filebeat Input Dynamic file path](https://discuss.elastic.co/t/filebeat-input-dynamic-file-path/377379)
**Author:** [@mdamera905](https://discuss.elastic.co/u/mdamera905)\ **Replies:** 0\ **Last updated:** [April 22, 2025, 2:23pm UTC](https://discuss.elastic.co/t/filebeat-input-dynamic-file-path/377379 "2025-04-22T14:23:02Z")
I have a requirement to monitor dynamic log path using Elastic.Log Path is as follows. Can you please help whats the file path I should be included in the filebeat.yml file ? Log Name- C:\\appname\\data\\logs\\appname\_a123… --- ## [Changes removed from system index templates](https://discuss.elastic.co/t/changes-removed-from-system-index-templates/377371)
**Author:** [@jcruz](https://discuss.elastic.co/u/jcruz)\ **Replies:** 0\ **Last updated:** [April 22, 2025, 12:58pm UTC](https://discuss.elastic.co/t/changes-removed-from-system-index-templates/377371 "2025-04-22T12:58:54Z")
I have made some changes to a system index template (.alerts-security.alerts-default-index-template) by adding a new Component Template to map some custom fields for use as filters in the Alerts dashboard. However, after… --- ## [\[Kibana 9.0\] Search Sessions are still available in 9.0—Backgrounding Queries Coming to ES|QL](https://discuss.elastic.co/t/kibana-9-0-search-sessions-are-still-available-in-9-0-backgrounding-queries-coming-to-es-ql/377370)
**Author:** [@ghudgins](https://discuss.elastic.co/u/ghudgins)\ **Replies:** 0\ **Last updated:** [April 22, 2025, 11:49am UTC](https://discuss.elastic.co/t/kibana-9-0-search-sessions-are-still-available-in-9-0-backgrounding-queries-coming-to-es-ql/377370 "2025-04-22T11:49:20Z")
Hey everyone, With the latest/upcoming Kibana 9.0 release, we wanted to provide some clarity around the Search Sessions feature. While it is officially marked as deprecated as of 8.15, it remains available for use in 9.… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=75) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=77)