# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=78 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 79 --- ## [Initial Interval Hardcored in Microsoft Fileset Configs](https://discuss.elastic.co/t/initial-interval-hardcored-in-microsoft-fileset-configs/373205)
**Author:** [@DumbBoi](https://discuss.elastic.co/u/DumbBoi)\ **Replies:** 4\ **Last updated:** [April 17, 2025, 11:18am UTC](https://discuss.elastic.co/t/initial-interval-hardcored-in-microsoft-fileset-configs/373205 "2025-04-17T11:18:45Z")
The initial intervals for microsoft defender atp and 365 defender are hard coded to last 5 and 55 minutes respectively. There doesn't seem to be any constraints in the API documentation. I plan on creating a PR to fix th… --- ## [Not entitled: component \[repository-s3\] after update from 8.17.4 to 8.18.0](https://discuss.elastic.co/t/not-entitled-component-repository-s3-after-update-from-8-17-4-to-8-18-0/377166)
**Author:** [@ATecha](https://discuss.elastic.co/u/ATecha)\ **Replies:** 11\ **Last updated:** [April 17, 2025, 10:54am UTC](https://discuss.elastic.co/t/not-entitled-component-repository-s3-after-update-from-8-17-4-to-8-18-0/377166 "2025-04-17T10:54:21Z")
Noticed this in the log after updating from 8.17.4 to the just-released 8.18.0. It occurred in the first startup, and any restart since. \[2025-04-15T14:44:04,795\]\[INFO \]\[o.e.n.Node \] \[node-0-dev\] Default … --- ## [TOO\_MANY\_REQUESTS/12/disk usage exceeded flood-stage watermark, index has read-only-allow-delete block](https://discuss.elastic.co/t/too-many-requests-12-disk-usage-exceeded-flood-stage-watermark-index-has-read-only-allow-delete-block/377233)
**Author:** [@Jackman](https://discuss.elastic.co/u/Jackman)\ **Replies:** 8\ **Last updated:** [April 17, 2025, 8:49am UTC](https://discuss.elastic.co/t/too-many-requests-12-disk-usage-exceeded-flood-stage-watermark-index-has-read-only-allow-delete-block/377233 "2025-04-17T08:49:19Z")
Hey Guys im currently running an elastic-search container on my docker where im running a local development area, which all seemed fine at first but at one point i got the error in the title or to be exact: 2025-04-17 0… --- ## [High index size causing performance issue](https://discuss.elastic.co/t/high-index-size-causing-performance-issue/377213)
**Author:** [@PRASHANT\_MEHTA](https://discuss.elastic.co/u/PRASHANT_MEHTA)\ **Replies:** 5\ **Last updated:** [April 16, 2025, 9:24pm UTC](https://discuss.elastic.co/t/high-index-size-causing-performance-issue/377213 "2025-04-16T21:24:44Z")
Hello, I have a java application that is writting data directly to an Elasticsearch index named as candidate having 1 primary and 1replica and this is now causing issue.Need to increase no of primary shard. 300gb candi… --- ## [What's the difference between UDP workers and Pipeline Workers](https://discuss.elastic.co/t/whats-the-difference-between-udp-workers-and-pipeline-workers/377220)
**Author:** [@Francesco\_Esposito](https://discuss.elastic.co/u/Francesco_Esposito)\ **Replies:** 0\ **Last updated:** [April 16, 2025, 8:04pm UTC](https://discuss.elastic.co/t/whats-the-difference-between-udp-workers-and-pipeline-workers/377220 "2025-04-16T20:04:02Z")
As the question says, I am curious to understand the different impacts of having multiple Pipeline Workers and multiple UDP input plugin Workers. No much information can be found in the documentation. How would you siz… --- ## [Help updating Elastic ssl keystore - fatal alert:bad certificate error](https://discuss.elastic.co/t/help-updating-elastic-ssl-keystore-fatal-alert-bad-certificate-error/377210)
**Author:** [@Steven\_Cherry](https://discuss.elastic.co/u/Steven_Cherry)\ **Replies:** 1\ **Last updated:** [April 16, 2025, 5:44pm UTC](https://discuss.elastic.co/t/help-updating-elastic-ssl-keystore-fatal-alert-bad-certificate-error/377210 "2025-04-16T17:44:11Z")
I am attempting to update Elastic with a new certificate for the SSL keystore. I created a PFX with an updated certificate and secured it with a password equal to the current password as shown by the command "/usr/share… --- ## [Elastic search .net client not removing field](https://discuss.elastic.co/t/elastic-search-net-client-not-removing-field/377184)
**Author:** [@Vias\_Giraud](https://discuss.elastic.co/u/Vias_Giraud)\ **Replies:** 1\ **Last updated:** [April 16, 2025, 2:17pm UTC](https://discuss.elastic.co/t/elastic-search-net-client-not-removing-field/377184 "2025-04-16T14:17:29Z")
I have ingest pipeline , to remove field content to free up space like below : var pipeResponse = await \_client.Ingest.PutPipelineAsync\("attachments", p =\> p .Description("Document attachme… --- ## [Some one provide EOL date of ELK components 7.9.x version](https://discuss.elastic.co/t/some-one-provide-eol-date-of-elk-components-7-9-x-version/377195)
**Author:** [@Domnic\_Raj\_D](https://discuss.elastic.co/u/Domnic_Raj_D)\ **Replies:** 1\ **Last updated:** [April 16, 2025, 1:35pm UTC](https://discuss.elastic.co/t/some-one-provide-eol-date-of-elk-components-7-9-x-version/377195 "2025-04-16T13:35:43Z")
Hi Team, Could you please provide the EOL date of all ELK components of 7.9.x as I found like this. Shall we get release updates/patches for 7.x.x? --- ## [ESQL Get a specific field in the most recent document from a group of documents](https://discuss.elastic.co/t/esql-get-a-specific-field-in-the-most-recent-document-from-a-group-of-documents/377197)
**Author:** [@logalicious](https://discuss.elastic.co/u/logalicious)\ **Replies:** 0\ **Last updated:** [April 16, 2025, 1:19pm UTC](https://discuss.elastic.co/t/esql-get-a-specific-field-in-the-most-recent-document-from-a-group-of-documents/377197 "2025-04-16T13:19:45Z")
I have an index for purchases. In each document there is a customer.name and cashier.name field. I want to group the documents using ESQL based on customer.name and return the most recent value of cashier.name. This will… --- ## [What is the fix for CVE-2024-52980 in elasticsearch 7.x versions](https://discuss.elastic.co/t/what-is-the-fix-for-cve-2024-52980-in-elasticsearch-7-x-versions/377099)
**Author:** [@Amaresh\_Selva](https://discuss.elastic.co/u/Amaresh_Selva)\ **Replies:** 4\ **Last updated:** [April 16, 2025, 11:17am UTC](https://discuss.elastic.co/t/what-is-the-fix-for-cve-2024-52980-in-elasticsearch-7-x-versions/377099 "2025-04-16T11:17:09Z")
we are currently using elasticsearch 7.17.26 in our client side and 7.17.24 in servers . we received a notification about CVE-2024-52980 in elasticsearch what is the fix for this CVE for 7.x versions we only see that i… --- ## [Indexation stopped during indices rollover](https://discuss.elastic.co/t/indexation-stopped-during-indices-rollover/377180)
**Author:** [@Josselin](https://discuss.elastic.co/u/Josselin)\ **Replies:** 3\ **Last updated:** [April 16, 2025, 9:10am UTC](https://discuss.elastic.co/t/indexation-stopped-during-indices-rollover/377180 "2025-04-16T09:10:35Z")
Hello, We have currently one big cluster (300+ nodes) with tiering. We are using Elasticsearch version 8.4.3 Since some months we are seeing issues during indices rollover, where the bulk index requests are delayed fo… --- ## [logstash is issue](https://discuss.elastic.co/t/logstash-is-issue/377176)
**Author:** [@yunguo](https://discuss.elastic.co/u/yunguo)\ **Replies:** 2\ **Last updated:** [April 16, 2025, 8:57am UTC](https://discuss.elastic.co/t/logstash-is-issue/377176 "2025-04-16T08:57:10Z")
/usr/share/logstash/vendor/bundle/jruby/3.1.0/gems/concurrent-ruby-1.1.9/lib/concurrent-ruby/concurrent/executor/java\_thread\_pool\_executor.rb:13: warning: method redefined; discarding old to\_int /usr/share/logstash/vend… --- ## [Why do errors occur when running in a kubernetes cluster?](https://discuss.elastic.co/t/why-do-errors-occur-when-running-in-a-kubernetes-cluster/376737)
**Author:** [@Vladimir\_Fomin1](https://discuss.elastic.co/u/Vladimir_Fomin1)\ **Replies:** 1\ **Last updated:** [April 3, 2025, 11:51am UTC](https://discuss.elastic.co/t/why-do-errors-occur-when-running-in-a-kubernetes-cluster/376737 "2025-04-03T11:51:56Z")
After I run Logstash in a Kubernetes cluster with the settings of input { gelf { port =\> 7003 type =\> "some-type-1" } gelf { port =\> 7004 type =\> "some-type-2" … --- ## [Elastic-agent + Logstash (for enrichment) + Elasticsearch](https://discuss.elastic.co/t/elastic-agent-logstash-for-enrichment-elasticsearch/377104)
**Author:** [@francesco.amato](https://discuss.elastic.co/u/francesco.amato)\ **Replies:** 5\ **Last updated:** [April 16, 2025, 7:03am UTC](https://discuss.elastic.co/t/elastic-agent-logstash-for-enrichment-elasticsearch/377104 "2025-04-16T07:03:38Z")
Hello to everyone We have this structure: 1 Elasticsearch Cluster 1 Elastic-agent managed by our Fleet server 1 Logstash instance installed on the elastic-agent We have already configured the elastic-agent to send UD… --- ## [Problem with copy\_saved\_objects API](https://discuss.elastic.co/t/problem-with-copy-saved-objects-api/374765)
**Author:** [@Federico\_Ruso](https://discuss.elastic.co/u/Federico_Ruso)\ **Replies:** 4\ **Last updated:** [April 16, 2025, 6:27am UTC](https://discuss.elastic.co/t/problem-with-copy-saved-objects-api/374765 "2025-04-16T06:27:57Z")
Hello! I'm using copy\_saved\_objects Kibana API to copy dashboards between spaces with 8.17 version. The visualizations in the new dashboard works fine, but the controls doesn't work and show me "No options found". Appa… --- ## [New logsdb format](https://discuss.elastic.co/t/new-logsdb-format/377101)
**Author:** [@skeyby](https://discuss.elastic.co/u/skeyby)\ **Replies:** 22\ **Last updated:** [April 16, 2025, 5:38am UTC](https://discuss.elastic.co/t/new-logsdb-format/377101 "2025-04-16T05:38:38Z")
Hello everybody. A few weeks ago I've set up a new Elasticsearch cluster to hold logs coming from our Kubernetes cluster. Since we installed a brand new 8.17 we decided to give the new logsdb format a go. We started w… --- ## [Memory leak](https://discuss.elastic.co/t/memory-leak/377174)
**Author:** [@Arun\_Kumar9](https://discuss.elastic.co/u/Arun_Kumar9)\ **Replies:** 0\ **Last updated:** [April 16, 2025, 3:31am UTC](https://discuss.elastic.co/t/memory-leak/377174 "2025-04-16T03:31:22Z")
I have integrated elastic apm in my python service. My service creates atleast 300 processes at startup, which are consumers for pulsar, i have observed the service is consuming to much memory. Service is under heavy loa… --- ## [Ubuntu 24.04 Support](https://discuss.elastic.co/t/ubuntu-24-04-support/371457)
**Author:** [@computersalat](https://discuss.elastic.co/u/computersalat)\ **Replies:** 4\ **Last updated:** [April 15, 2025, 10:35pm UTC](https://discuss.elastic.co/t/ubuntu-24-04-support/371457 "2025-04-15T22:35:05Z")
Hi, what about compatibility of Auditbeat and Ubuntu 24.04 ? It is sadly not listed in the matrix yet. Thank you for information :slight\_smile: --- ## [Esitmate Logstash Requirement on Centerlized Managed](https://discuss.elastic.co/t/esitmate-logstash-requirement-on-centerlized-managed/377127)
**Author:** [@kishorkumar](https://discuss.elastic.co/u/kishorkumar)\ **Replies:** 1\ **Last updated:** [April 15, 2025, 7:59pm UTC](https://discuss.elastic.co/t/esitmate-logstash-requirement-on-centerlized-managed/377127 "2025-04-15T19:59:32Z")
I’m currently using centralized Logstash management from Kibana, with a single pipeline in place. Logstash Version: 8.11 Elasticsearch Version: 8.11 Here’s my pipeline configuration: input { elasticsearch { hos… --- ## [\[Solved\] Error in logstash elasticsearch:9200](https://discuss.elastic.co/t/solved-error-in-logstash-elasticsearch-9200/376927)
**Author:** [@GabrielMunumel](https://discuss.elastic.co/u/GabrielMunumel)\ **Replies:** 1\ **Last updated:** [April 15, 2025, 5:21pm UTC](https://discuss.elastic.co/t/solved-error-in-logstash-elasticsearch-9200/376927 "2025-04-15T17:21:13Z")
Hello, I'm running a ElasticStack using a docker compose. The errors in logstash are: \[2025-04-08T17:04:18,301\]\[WARN \]\[logstash.licensechecker.licensereader\] Attempted to resurrect connection to dead ES instance, but g… --- ## [Elastic Agent Kubernetes - Kube State Metrics for Services are empty data streams](https://discuss.elastic.co/t/elastic-agent-kubernetes-kube-state-metrics-for-services-are-empty-data-streams/377155)
**Author:** [@Alphayeeeet](https://discuss.elastic.co/u/Alphayeeeet)\ **Replies:** 0\ **Last updated:** [April 15, 2025, 3:14pm UTC](https://discuss.elastic.co/t/elastic-agent-kubernetes-kube-state-metrics-for-services-are-empty-data-streams/377155 "2025-04-15T15:14:15Z")
Hi, we have an interesting issue. We use Elastic-Agent to get cluster metrics from RedHat OpenShift Monitoring kube state metrics instance. However though all metrics are ingested perfectly fine, the metricsets service… --- ## [Should I publish multiple node HTTP ports when running all Elasticsearch nodes inside one Docker container?](https://discuss.elastic.co/t/should-i-publish-multiple-node-http-ports-when-running-all-elasticsearch-nodes-inside-one-docker-container/376972)
**Author:** [@HorselessName](https://discuss.elastic.co/u/HorselessName)\ **Replies:** 8\ **Last updated:** [April 15, 2025, 3:12pm UTC](https://discuss.elastic.co/t/should-i-publish-multiple-node-http-ports-when-running-all-elasticsearch-nodes-inside-one-docker-container/376972 "2025-04-15T15:12:24Z")
Hi everyone, I'm building a multi-node Elasticsearch cluster inside a single Docker container for learning purposes. Instead of using the official Docker image, I’m going old-school: manually unpacking the .tar.gz binar… --- ## [Can Dashboard Controllers Selections be save as a saved query / saved Dashboard?](https://discuss.elastic.co/t/can-dashboard-controllers-selections-be-save-as-a-saved-query-saved-dashboard/377153)
**Author:** [@jack\_a](https://discuss.elastic.co/u/jack_a)\ **Replies:** 0\ **Last updated:** [April 15, 2025, 2:09pm UTC](https://discuss.elastic.co/t/can-dashboard-controllers-selections-be-save-as-a-saved-query-saved-dashboard/377153 "2025-04-15T14:09:45Z")
I have a dashboard with multiple controllers that allow user to limit displayed data. Is there a way to allow users save their selection in a format like saved query so they do no have to go through some specific selecti… --- ## [Elasticsearch AWS Cognito OIDC issue](https://discuss.elastic.co/t/elasticsearch-aws-cognito-oidc-issue/377149)
**Author:** [@eugeniof](https://discuss.elastic.co/u/eugeniof)\ **Replies:** 3\ **Last updated:** [April 15, 2025, 1:34pm UTC](https://discuss.elastic.co/t/elasticsearch-aws-cognito-oidc-issue/377149 "2025-04-15T13:34:58Z")
Hello, I have a problem when I try to use JWT token provided by AWS Cognito. Specifically I add this configuration to my elasticsearch.yml, on elastic cloud: xpack: security: authc: realms: oidc: … --- ## [Kibana REST API / Saved Objects API Failing When Running From Source (v8.13.4)](https://discuss.elastic.co/t/kibana-rest-api-saved-objects-api-failing-when-running-from-source-v8-13-4/377098)
**Author:** [@Anirudh\_Nagothu](https://discuss.elastic.co/u/Anirudh_Nagothu)\ **Replies:** 2\ **Last updated:** [April 15, 2025, 11:28am UTC](https://discuss.elastic.co/t/kibana-rest-api-saved-objects-api-failing-when-running-from-source-v8-13-4/377098 "2025-04-15T11:28:38Z")
I am running Kibana directly from the source code cloned from GitHub (version 8.13.4) and have disabled security via xpack.security.enabled: false in both elasticsearch.yml and kibana.yml. When I attempt to import saved… --- ## [Implementing pinned queries in search-ui](https://discuss.elastic.co/t/implementing-pinned-queries-in-search-ui/377135)
**Author:** [@dabby](https://discuss.elastic.co/u/dabby)\ **Replies:** 0\ **Last updated:** [April 15, 2025, 8:16am UTC](https://discuss.elastic.co/t/implementing-pinned-queries-in-search-ui/377135 "2025-04-15T08:16:51Z")
Hello, I am currently using the search-ui library for a react website, using the elasticsearch connector. I would like to implement pinned queries, but I'm unsure of how to proceed. I have tried looking through the do… --- ## [Ingesting XML data from UDP input plugin thru elasticsearch output plugin](https://discuss.elastic.co/t/ingesting-xml-data-from-udp-input-plugin-thru-elasticsearch-output-plugin/377125)
**Author:** [@Francesco\_Esposito](https://discuss.elastic.co/u/Francesco_Esposito)\ **Replies:** 1\ **Last updated:** [April 14, 2025, 11:51pm UTC](https://discuss.elastic.co/t/ingesting-xml-data-from-udp-input-plugin-thru-elasticsearch-output-plugin/377125 "2025-04-14T23:51:21Z")
Hello everyone, I need to ingest an XML received over UDP input plugin. The output plugin needs to be "elasticsearch". This is an example of XML: \ \FRANCESCOE-RMT\ \3C38C41D-9F66-47AB-AF8D… --- ## [Conexion de elastic con orracle database](https://discuss.elastic.co/t/conexion-de-elastic-con-orracle-database/377116)
**Author:** [@angeles\_martinez\_dom](https://discuss.elastic.co/u/angeles_martinez_dom)\ **Replies:** 3\ **Last updated:** [April 14, 2025, 8:13pm UTC](https://discuss.elastic.co/t/conexion-de-elastic-con-orracle-database/377116 "2025-04-14T20:13:40Z")
hola estoy tratando de conectarme a una base de datos pero al momento de correr mi archivo de configuracion sale lo sig. a alguien le pasa lo mismo? --- ## [Pre-filter points in geo(tile) aggregations](https://discuss.elastic.co/t/pre-filter-points-in-geo-tile-aggregations/377011)
**Author:** [@frens](https://discuss.elastic.co/u/frens)\ **Replies:** 9\ **Last updated:** [April 14, 2025, 3:29pm UTC](https://discuss.elastic.co/t/pre-filter-points-in-geo-tile-aggregations/377011 "2025-04-14T15:29:05Z")
Elasticsearch supports bounds for geo-tile aggregations. Is there any way to filter the points before the transformation to tiles? We're considering scripted fields, plugins, and other things. But it would be ideal if w… --- ## [Auditbeat tries to manage audit settings if socket\_type: multicast is set](https://discuss.elastic.co/t/auditbeat-tries-to-manage-audit-settings-if-socket-type-multicast-is-set/376188)
**Author:** [@metanot](https://discuss.elastic.co/u/metanot)\ **Replies:** 5\ **Last updated:** [April 14, 2025, 3:08pm UTC](https://discuss.elastic.co/t/auditbeat-tries-to-manage-audit-settings-if-socket-type-multicast-is-set/376188 "2025-04-14T15:08:59Z")
Hello all, i'm trying to implement hardened installation of auditbeat on host (running not from root, limiting exposed capacities via systemd AmbientCapacities/setcap). Auditbeat version is 8.17 If i use config option s… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=77) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=79)