# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=79 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 80 --- ## [Troubleshooting an unstable cluster](https://discuss.elastic.co/t/troubleshooting-an-unstable-cluster/377070)
**Author:** [@lwm2016](https://discuss.elastic.co/u/lwm2016)\ **Replies:** 19\ **Last updated:** [April 14, 2025, 12:23pm UTC](https://discuss.elastic.co/t/troubleshooting-an-unstable-cluster/377070 "2025-04-14T12:23:54Z")
Hi Team, We have deployed a cluster of across 9 physical machines, each hosting multiple instances. The hardware specifications per machine are: 112 CPU cores 503 GB memory Here's cluster and node info { "name" :… --- ## [Elastic search cluster x-pack security](https://discuss.elastic.co/t/elastic-search-cluster-x-pack-security/377103)
**Author:** [@Akash\_More](https://discuss.elastic.co/u/Akash_More)\ **Replies:** 0\ **Last updated:** [April 14, 2025, 10:23am UTC](https://discuss.elastic.co/t/elastic-search-cluster-x-pack-security/377103 "2025-04-14T10:23:30Z")
Hello sir, I am using two IPs: 92 and 93. On IP 92, node-1 is installed, and on IP 93, node-2 is installed. After that, I added two extra nodes using the tar file on each IP, so now on IP 92, nodes 1, 3, and 4 are instal… --- ## [Nested Query not working](https://discuss.elastic.co/t/nested-query-not-working/377093)
**Author:** [@I.am\_mohit](https://discuss.elastic.co/u/I.am_mohit)\ **Replies:** 1\ **Last updated:** [April 14, 2025, 9:11am UTC](https://discuss.elastic.co/t/nested-query-not-working/377093 "2025-04-14T09:11:00Z")
public class Calendars { public decimal? NightlyPrice { get; set; } public bool? Availability { get; set; } public List\ Dates{ get; set; } } public class CalendarDates { public DateT… --- ## [How to match an empty field in kibana](https://discuss.elastic.co/t/how-to-match-an-empty-field-in-kibana/376952)
**Author:** [@ron03](https://discuss.elastic.co/u/ron03)\ **Replies:** 1\ **Last updated:** [April 12, 2025, 9:31pm UTC](https://discuss.elastic.co/t/how-to-match-an-empty-field-in-kibana/376952 "2025-04-12T21:31:35Z")
In one log request we have multiple attributes, in that one of the attribute value is empty. How I can get the result for the particular attribute which has empty value using DQL query. I tried the query like "\\n "p… --- ## [How to delete index template for data stream](https://discuss.elastic.co/t/how-to-delete-index-template-for-data-stream/363505)
**Author:** [@andre22](https://discuss.elastic.co/u/andre22)\ **Replies:** 2\ **Last updated:** [April 12, 2025, 8:17pm UTC](https://discuss.elastic.co/t/how-to-delete-index-template-for-data-stream/363505 "2025-04-12T20:17:20Z")
Hi, I have created an index template which creates a data stream for testing purposes and would like to get rid of it. I cannot delete the index template: OK, there is still an exisitng data stream. I cannot delete t… --- ## [Elasticsearch server is not starting](https://discuss.elastic.co/t/elasticsearch-server-is-not-starting/377051)
**Author:** [@mithun321](https://discuss.elastic.co/u/mithun321)\ **Replies:** 5\ **Last updated:** [April 12, 2025, 12:22pm UTC](https://discuss.elastic.co/t/elasticsearch-server-is-not-starting/377051 "2025-04-12T12:22:32Z")
I'm getting this error I'm starting Elasticsearch server Job for elasticsearch.service failed because the control process exited with error code. See "systemctl status elasticsearch.service" and "journalctl -xeu elasti… --- ## [Does setting a high size in terms aggregation affect memory usage if the actual bucket count is low?](https://discuss.elastic.co/t/does-setting-a-high-size-in-terms-aggregation-affect-memory-usage-if-the-actual-bucket-count-is-low/377060)
**Author:** [@lostpeacock](https://discuss.elastic.co/u/lostpeacock)\ **Replies:** 1\ **Last updated:** [April 12, 2025, 8:30am UTC](https://discuss.elastic.co/t/does-setting-a-high-size-in-terms-aggregation-affect-memory-usage-if-the-actual-bucket-count-is-low/377060 "2025-04-12T08:30:14Z")
I'm using a terms aggregation in Elasticsearch and have a question about the size parameter. Let's say I set size: 1000, but in reality, the number of buckets generated is always much lower—around 150 at most. My questi… --- ## [Understanding Logstash pipeline to pipeline communication](https://discuss.elastic.co/t/understanding-logstash-pipeline-to-pipeline-communication/377064)
**Author:** [@LogstashQuestions](https://discuss.elastic.co/u/LogstashQuestions)\ **Replies:** 2\ **Last updated:** [April 12, 2025, 5:44am UTC](https://discuss.elastic.co/t/understanding-logstash-pipeline-to-pipeline-communication/377064 "2025-04-12T05:44:37Z")
I'm trying to fix some performance issues in a Logstash pipeline that was set up using pipeline to pipeline communication but I'm not sure if the way it was set up makes sense. There are 2 pipelines defined, with the fir… --- ## [In version 8.17.3, some default pipelines are automatically created after being deleted using DELETE \_ingest/pipeline/\*](https://discuss.elastic.co/t/in-version-8-17-3-some-default-pipelines-are-automatically-created-after-being-deleted-using-delete-ingest-pipeline/376945)
**Author:** [@AdolphGai](https://discuss.elastic.co/u/AdolphGai)\ **Replies:** 5\ **Last updated:** [April 11, 2025, 6:28pm UTC](https://discuss.elastic.co/t/in-version-8-17-3-some-default-pipelines-are-automatically-created-after-being-deleted-using-delete-ingest-pipeline/376945 "2025-04-11T18:28:25Z")
Install elasticsearch 8.17.3 and find that there are many default pipelines Run the DELETE \_ingest/pipeline/\* and \_ingest/pipeline/pipeline\_id command. The command output is deleted successfully But with get, the discov… --- ## [Search timeout doesn't work](https://discuss.elastic.co/t/search-timeout-doesnt-work/376809)
**Author:** [@swami\_dtex](https://discuss.elastic.co/u/swami_dtex)\ **Replies:** 4\ **Last updated:** [April 11, 2025, 5:04pm UTC](https://discuss.elastic.co/t/search-timeout-doesnt-work/376809 "2025-04-11T17:04:26Z")
In our testing, we are observing that the following timeout settings aren't honored. This is in Elasticsearch 6.8.23. escurl -XPUT //\_cluster/settings -d '{"persistent": {"search.default\_search\_timeout": "5m"}}' escurl … --- ## [Logstash RabbitMQ Input Plugin Consumes Messages Despite ack =\> false Setting](https://discuss.elastic.co/t/logstash-rabbitmq-input-plugin-consumes-messages-despite-ack-false-setting/377002)
**Author:** [@fakman0](https://discuss.elastic.co/u/fakman0)\ **Replies:** 7\ **Last updated:** [April 11, 2025, 4:33pm UTC](https://discuss.elastic.co/t/logstash-rabbitmq-input-plugin-consumes-messages-despite-ack-false-setting/377002 "2025-04-11T16:33:17Z")
Description: I'm using Logstash with RabbitMQ input plugin to read messages from a queue and write them to Elasticsearch. I want Logstash to only read the messages without consuming them (like a logger), but it's still … --- ## [Can a Platinum-Licensed Cluster's watcher query Basic-Licensed Clusters?](https://discuss.elastic.co/t/can-a-platinum-licensed-clusters-watcher-query-basic-licensed-clusters/377044)
**Author:** [@yago82](https://discuss.elastic.co/u/yago82)\ **Replies:** 1\ **Last updated:** [April 11, 2025, 2:27pm UTC](https://discuss.elastic.co/t/can-a-platinum-licensed-clusters-watcher-query-basic-licensed-clusters/377044 "2025-04-11T14:27:00Z")
Hello Elastic community,​ I'm exploring the possibility of setting up Watcher alerts on a Platinum-licensed Elasticsearch cluster that would query data from other Elasticsearch clusters operating under the Basic license… --- ## [Searchable Snapshot and HDD vs SSD/NVMe Performance](https://discuss.elastic.co/t/searchable-snapshot-and-hdd-vs-ssd-nvme-performance/377039)
**Author:** [@BenB196](https://discuss.elastic.co/u/BenB196)\ **Replies:** 2\ **Last updated:** [April 11, 2025, 2:05pm UTC](https://discuss.elastic.co/t/searchable-snapshot-and-hdd-vs-ssd-nvme-performance/377039 "2025-04-11T14:05:29Z")
Hi All, I have a question that I couldn't really find an answer to: When using searchable snapshots, is the data stored and read in a "sequential" order, in a way that would be ideal for using HDDs with, or is the "rec… --- ## [Running elasticsearch-users cashes the pod](https://discuss.elastic.co/t/running-elasticsearch-users-cashes-the-pod/377018)
**Author:** [@kam\_ka](https://discuss.elastic.co/u/kam_ka)\ **Replies:** 1\ **Last updated:** [April 11, 2025, 12:44pm UTC](https://discuss.elastic.co/t/running-elasticsearch-users-cashes-the-pod/377018 "2025-04-11T12:44:29Z")
I am not sure what is wrong: elasticsearch@elasticsearch-es-default-0:~$ bin/elasticsearch-users list command terminated with exit code 137 Any param I give to this cli command crashes the pod. it is running on t3.med… --- ## [Dashboard URL filters](https://discuss.elastic.co/t/dashboard-url-filters/376997)
**Author:** [@catn0b0t](https://discuss.elastic.co/u/catn0b0t)\ **Replies:** 1\ **Last updated:** [April 11, 2025, 9:12am UTC](https://discuss.elastic.co/t/dashboard-url-filters/376997 "2025-04-11T09:12:55Z")
Have already read a number of posts (some a few years old) elaborating on the RISON format used in the url filters for dashboard, but none of them were very helpful. Where can I find documentation on how to specify filte… --- ## [Broken track\_total\_hits behaviour in aggregation](https://discuss.elastic.co/t/broken-track-total-hits-behaviour-in-aggregation/377008)
**Author:** [@spinscale](https://discuss.elastic.co/u/spinscale)\ **Replies:** 4\ **Last updated:** [April 11, 2025, 8:55am UTC](https://discuss.elastic.co/t/broken-track-total-hits-behaviour-in-aggregation/377008 "2025-04-11T08:55:52Z")
Hey, I am running an aggregation only request, that looks like this: GET product\_data/\_search?request\_cache=false&terminate\_after=500000 { "timeout": "300ms", "track\_total\_hits": true, "size": 0, "query": {… --- ## [Elasticsearch upgrade 7.17 to 8.17 -- Elasticsearch is working using curl IP but not with client/application URL](https://discuss.elastic.co/t/elasticsearch-upgrade-7-17-to-8-17-elasticsearch-is-working-using-curl-ip-but-not-with-client-application-url/377010)
**Author:** [@Venkatesh\_Kumar1](https://discuss.elastic.co/u/Venkatesh_Kumar1)\ **Replies:** 3\ **Last updated:** [April 11, 2025, 8:39am UTC](https://discuss.elastic.co/t/elasticsearch-upgrade-7-17-to-8-17-elasticsearch-is-working-using-curl-ip-but-not-with-client-application-url/377010 "2025-04-11T08:39:48Z")
Dear All, we are working on Elasticsearch upgrade from version 7.17 to 8.17.3. Elasticsearch has been updated and pulled data from source through Logstash. Able to view the indices/search result in Kibana and through cur… --- ## [HTTP end point to call Logstash API](https://discuss.elastic.co/t/http-end-point-to-call-logstash-api/376980)
**Author:** [@rmeemanage](https://discuss.elastic.co/u/rmeemanage)\ **Replies:** 1\ **Last updated:** [April 10, 2025, 4:14pm UTC](https://discuss.elastic.co/t/http-end-point-to-call-logstash-api/376980 "2025-04-10T16:14:10Z")
I want to call Logstash API in Elastic Cloud. How can I find HTTP endpoint url? --- ## [In Elasticsearch, data after a certain date is not coming through](https://discuss.elastic.co/t/in-elasticsearch-data-after-a-certain-date-is-not-coming-through/376075)
**Author:** [@aiagent\_ai](https://discuss.elastic.co/u/aiagent_ai)\ **Replies:** 12\ **Last updated:** [April 10, 2025, 3:06pm UTC](https://discuss.elastic.co/t/in-elasticsearch-data-after-a-certain-date-is-not-coming-through/376075 "2025-04-10T15:06:43Z")
Problem: My application is running on Docker, and I am using Elasticsearch. The index has been created. When I make a curl request, I get a response, but in my application, data after March 5th is not showing up. Howeve… --- ## [Skipping Integrations Server in favor of Logstash](https://discuss.elastic.co/t/skipping-integrations-server-in-favor-of-logstash/376960)
**Author:** [@H\_TS](https://discuss.elastic.co/u/H_TS)\ **Replies:** 5\ **Last updated:** [April 10, 2025, 2:52pm UTC](https://discuss.elastic.co/t/skipping-integrations-server-in-favor-of-logstash/376960 "2025-04-10T14:52:11Z")
Hello everyone, I am new to the Elastic Stack and have learned a lot about it in the past weeks. I am currently looking into the Elastic Cloud as it got me exited after researching the Elastic Stack. One thing I notice… --- ## [Dashboard Analytics/Stats](https://discuss.elastic.co/t/dashboard-analytics-stats/376965)
**Author:** [@erikg](https://discuss.elastic.co/u/erikg)\ **Replies:** 2\ **Last updated:** [April 10, 2025, 1:52pm UTC](https://discuss.elastic.co/t/dashboard-analytics-stats/376965 "2025-04-10T13:52:41Z")
Hello, Is there a system index or way to grab the dashboard activity from the single dashboard stats: I want to build a dashboard to see how all dashboards compare against each other without having to click through … --- ## [Unable to use env variable with multiple hosts, for ES hosts output](https://discuss.elastic.co/t/unable-to-use-env-variable-with-multiple-hosts-for-es-hosts-output/372982)
**Author:** [@Maeris](https://discuss.elastic.co/u/Maeris)\ **Replies:** 3\ **Last updated:** [April 10, 2025, 8:47am UTC](https://discuss.elastic.co/t/unable-to-use-env-variable-with-multiple-hosts-for-es-hosts-output/372982 "2025-04-10T08:47:35Z")
Hi, I'm running logstash in a k8s cluster using the logstash helm chart. I have a .env file from which I create a k8s secret, which is used within logstash. in my .env, I have my hosts defined like: ES\_NODES="elk1.ho… --- ## [Filebeats 8.10.2 as a service doesn't find any files](https://discuss.elastic.co/t/filebeats-8-10-2-as-a-service-doesnt-find-any-files/376873)
**Author:** [@Son\_Pham](https://discuss.elastic.co/u/Son_Pham)\ **Replies:** 5\ **Last updated:** [April 10, 2025, 8:25am UTC](https://discuss.elastic.co/t/filebeats-8-10-2-as-a-service-doesnt-find-any-files/376873 "2025-04-10T08:25:13Z")
Hi, when I start filebeat.exe the Data gets log files are found and sent to elasticsearch. But if I start filebeats as service from windows services, the logs show me no files found. Best Regards Son --- ## [\_id not being set when I pass it in my actions setup](https://discuss.elastic.co/t/id-not-being-set-when-i-pass-it-in-my-actions-setup/376968)
**Author:** [@olaaustine](https://discuss.elastic.co/u/olaaustine)\ **Replies:** 4\ **Last updated:** [April 10, 2025, 7:42am UTC](https://discuss.elastic.co/t/id-not-being-set-when-i-pass-it-in-my-actions-setup/376968 "2025-04-10T07:42:31Z")
Not sure if I did it wrong or this is an issue, so i created one of my actions data\_index = { '\_op\_type': 'create', "\_index": index\_name, "\_id": code, "doc": \*\*\*\* … --- ## [Ruby agent is broken for more than 3 months for newer versions of ruby](https://discuss.elastic.co/t/ruby-agent-is-broken-for-more-than-3-months-for-newer-versions-of-ruby/376986)
**Author:** [@ratwithbat](https://discuss.elastic.co/u/ratwithbat)\ **Replies:** 0\ **Last updated:** [April 10, 2025, 7:11am UTC](https://discuss.elastic.co/t/ruby-agent-is-broken-for-more-than-3-months-for-newer-versions-of-ruby/376986 "2025-04-10T07:11:28Z")
Hi. Ruby agent is broken for more than 3 months. The ruby agent has a serious incompatibility issue with the new version of ruby, the community has submitted a pr for consideration but no response for almost 4 months. P… --- ## [Create default monitoring rules](https://discuss.elastic.co/t/create-default-monitoring-rules/328810)
**Author:** [@lduvnjak](https://discuss.elastic.co/u/lduvnjak)\ **Replies:** 2\ **Last updated:** [April 10, 2025, 12:45am UTC](https://discuss.elastic.co/t/create-default-monitoring-rules/328810 "2025-04-10T00:45:51Z")
Hey Everyone, When enabling monitoring it creates default rules for some standard issues like "shard size too large", "CCR read exception", etc. The rules are listed here. What I'm interested in, is how to recreate th… --- ## [Elastic Agent folder size growth](https://discuss.elastic.co/t/elastic-agent-folder-size-growth/376966)
**Author:** [@juancamiloll](https://discuss.elastic.co/u/juancamiloll)\ **Replies:** 2\ **Last updated:** [April 9, 2025, 8:44pm UTC](https://discuss.elastic.co/t/elastic-agent-folder-size-growth/376966 "2025-04-09T20:44:19Z")
Hello everyone, In some companies server administrators can be very picky when requesting to install new applications which for them will increase resource consumption. In my case I have been notified that several serv… --- ## [Yml files content are not getting indexed](https://discuss.elastic.co/t/yml-files-content-are-not-getting-indexed/376964)
**Author:** [@Daivik](https://discuss.elastic.co/u/Daivik)\ **Replies:** 0\ **Last updated:** [April 9, 2025, 2:52pm UTC](https://discuss.elastic.co/t/yml-files-content-are-not-getting-indexed/376964 "2025-04-09T14:52:26Z")
Currently have connected azure blob storage and elasticsearch using the connector in UI and all the files are getting indexed but only the \*.yml files content is not getting indexed. There is no error also. Could anyone… --- ## [Error 'Test failed to run' with AI Assistant using OpenRouter Integration](https://discuss.elastic.co/t/error-test-failed-to-run-with-ai-assistant-using-openrouter-integration/376961)
**Author:** [@yago82](https://discuss.elastic.co/u/yago82)\ **Replies:** 0\ **Last updated:** [April 9, 2025, 2:02pm UTC](https://discuss.elastic.co/t/error-test-failed-to-run-with-ai-assistant-using-openrouter-integration/376961 "2025-04-09T14:02:31Z")
Hello, I'm currently utilizing Elastic's AI Assistant with a trial license and have integrated OpenRouter as the AI provider. However, when entering the OpenRouter URL and the corresponding API Key, I encounter the foll… --- ## [Field Enrichment](https://discuss.elastic.co/t/field-enrichment/376958)
**Author:** [@Gowtham1](https://discuss.elastic.co/u/Gowtham1)\ **Replies:** 0\ **Last updated:** [April 9, 2025, 1:16pm UTC](https://discuss.elastic.co/t/field-enrichment/376958 "2025-04-09T13:16:06Z")
Hi, How to enrich the field from one kafka topic/index to another kafka topic/index? (eg) Field name "device.model.class". I want to enrich the field device.model.class from one kafka topic/index to another kafka topic… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=78) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=80)