# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=8 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 9 --- ## [About elk log issues](https://discuss.elastic.co/t/about-elk-log-issues/386790)
**Author:** [@Vtm](https://discuss.elastic.co/u/Vtm)\ **Replies:** 0\ **Last updated:** [June 10, 2026, 9:09am UTC](https://discuss.elastic.co/t/about-elk-log-issues/386790 "2026-06-10T09:09:52Z")
Hello everyone, Need help with Elasticsearch cluster metadata recovery. We originally had a 3-node cluster, but after a restart/patching activity the cluster failed master election. We later rebuilt the cluster and all… --- ## [Filebeat 9.3.1 slow to shutdown, takes \> 50s, using type: filestream,](https://discuss.elastic.co/t/filebeat-9-3-1-slow-to-shutdown-takes-50s-using-type-filestream/386789)
**Author:** [@Alex\_Rune\_Berg](https://discuss.elastic.co/u/Alex_Rune_Berg)\ **Replies:** 0\ **Last updated:** [June 10, 2026, 9:01am UTC](https://discuss.elastic.co/t/filebeat-9-3-1-slow-to-shutdown-takes-50s-using-type-filestream/386789 "2026-06-10T09:01:30Z")
Our filebeat does not stop quickly after changing it to use the 'type: filestream', we used 'type: log' before and it stopped immediately. We stop filebeat by sending it a -TERM, using pkill -TERM filebeat It normally… --- ## [On-premise elasticsearch support for Windows Server 2025](https://discuss.elastic.co/t/on-premise-elasticsearch-support-for-windows-server-2025/379619)
**Author:** [@vikas.shirke](https://discuss.elastic.co/u/vikas.shirke)\ **Replies:** 3\ **Last updated:** [June 10, 2026, 8:12am UTC](https://discuss.elastic.co/t/on-premise-elasticsearch-support-for-windows-server-2025/379619 "2026-06-10T08:12:34Z")
I have checked OS support matrix but didnt see anything mentioned about Windows Server 2025. Can someone please confirm when ELK will start supporting on-premise Elasticsearch and Kibana on Windows Server 2025? --- ## [Elasticsearch 9.1.3 - Unable to Recover or Delete Protected System Indices .secrets-inference and .security-7 After Multiple Recovery Attempts](https://discuss.elastic.co/t/elasticsearch-9-1-3-unable-to-recover-or-delete-protected-system-indices-secrets-inference-and-security-7-after-multiple-recovery-attempts/386751)
**Author:** [@Shubham\_Khodpe](https://discuss.elastic.co/u/Shubham_Khodpe)\ **Replies:** 8\ **Last updated:** [June 10, 2026, 7:11am UTC](https://discuss.elastic.co/t/elasticsearch-9-1-3-unable-to-recover-or-delete-protected-system-indices-secrets-inference-and-security-7-after-multiple-recovery-attempts/386751 "2026-06-10T07:11:51Z")
Hello Team, I am seeking assistance with an issue involving two protected system indices in our Elasticsearch 9.1.3 cluster: .secrets-inference .security-7 Environment Elasticsearch Version: 9.1.3 Installation Type… --- ## [High RAM usage with Active Directory Entity Analytics integration on a 4GB RAM server](https://discuss.elastic.co/t/high-ram-usage-with-active-directory-entity-analytics-integration-on-a-4gb-ram-server/386780)
**Author:** [@PatreKerier](https://discuss.elastic.co/u/PatreKerier)\ **Replies:** 1\ **Last updated:** [June 10, 2026, 6:26am UTC](https://discuss.elastic.co/t/high-ram-usage-with-active-directory-entity-analytics-integration-on-a-4gb-ram-server/386780 "2026-06-10T06:26:11Z")
Hello everyone, I’ve run into an issue with excessive resource consumption by the Elastic Agent and am looking for advice on optimizing policies and limits. Context: A customer has a server with very modest hardware sp… --- ## [Elasticsearch coordinating node OOM/crash under sustained ingest (60k docs/min) with high shard count (~800)](https://discuss.elastic.co/t/elasticsearch-coordinating-node-oom-crash-under-sustained-ingest-60k-docs-min-with-high-shard-count-800/386708)
**Author:** [@Osmel\_Pillot\_Leyva](https://discuss.elastic.co/u/Osmel_Pillot_Leyva)\ **Replies:** 4\ **Last updated:** [June 9, 2026, 1:32pm UTC](https://discuss.elastic.co/t/elasticsearch-coordinating-node-oom-crash-under-sustained-ingest-60k-docs-min-with-high-shard-count-800/386708 "2026-06-09T13:32:50Z")
I have an Elasticsearch cluster with 3 master nodes, 1 data node, 1 ingest node, and 1 coordinating node. I also have 1 Kibana instance and 1 Fleet Server. Data ingestion is performed through approximately 12 Elastic Age… --- ## [Configuring verification\_mode for Elastic Agent & Fleet Server](https://discuss.elastic.co/t/configuring-verification-mode-for-elastic-agent-fleet-server/386764)
**Author:** [@Reviving9721](https://discuss.elastic.co/u/Reviving9721)\ **Replies:** 0\ **Last updated:** [June 8, 2026, 8:45pm UTC](https://discuss.elastic.co/t/configuring-verification-mode-for-elastic-agent-fleet-server/386764 "2026-06-08T20:45:18Z")
Take the following configuration as an example reference: fleet: ... server: host: 0.0.0.0 internal\_port: 8221 output: elasticsearch: hosts: - 192.168.122.196:9200 protocol:… --- ## [Elasticsearch alerts don't show source.ip](https://discuss.elastic.co/t/elasticsearch-alerts-dont-show-source-ip/386763)
**Author:** [@komposektoras](https://discuss.elastic.co/u/komposektoras)\ **Replies:** 0\ **Last updated:** [June 8, 2026, 4:54pm UTC](https://discuss.elastic.co/t/elasticsearch-alerts-dont-show-source-ip/386763 "2026-06-08T16:54:16Z")
I have built a project lab with following tools: Component Tool Hypervisor VirtualBox Attacker VM Kali Linux Victim VM Ubuntu Server 22.04 SIEM VM Ubuntu Server 22.04 Log shipper (Linux) Filebeat … --- ## [Filebeat - Single-line JSON log ingestion: expected behavior and required configuration](https://discuss.elastic.co/t/filebeat-single-line-json-log-ingestion-expected-behavior-and-required-configuration/386753)
**Author:** [@aymanmazroui](https://discuss.elastic.co/u/aymanmazroui)\ **Replies:** 2\ **Last updated:** [June 8, 2026, 1:59pm UTC](https://discuss.elastic.co/t/filebeat-single-line-json-log-ingestion-expected-behavior-and-required-configuration/386753 "2026-06-08T13:59:58Z")
Hi, I have a specific use case and I need to know if Filebeat can handle it. My log files consist of a single very long line of JSON (no newline characters), which can be up to 27 MB in size. The entire file content i… --- ## [9.4.1 Agent Update on Windows get's orphaned](https://discuss.elastic.co/t/9-4-1-agent-update-on-windows-gets-orphaned/386535)
**Author:** [@GKre](https://discuss.elastic.co/u/GKre)\ **Replies:** 5\ **Last updated:** [June 8, 2026, 3:55am UTC](https://discuss.elastic.co/t/9-4-1-agent-update-on-windows-gets-orphaned/386535 "2026-06-08T03:55:15Z")
I regularly update my Elastic environment. Upgrading to version 9.4.1 was somewhat painful due to the “CPU flag” issue, but with the help of the forum, I was able to get everything back up and running. After that, I pro… --- ## [Nest to the new API](https://discuss.elastic.co/t/nest-to-the-new-api/386742)
**Author:** [@xef](https://discuss.elastic.co/u/xef)\ **Replies:** 0\ **Last updated:** [June 6, 2026, 10:08pm UTC](https://discuss.elastic.co/t/nest-to-the-new-api/386742 "2026-06-06T22:08:30Z")
We used to be able to build filters incrementally as below. How do we do it in the new API. Thanks internal static List\\> BuildFilter(SearchCriteria searchCriteria, string c… --- ## [Count of record drops on the hour](https://discuss.elastic.co/t/count-of-record-drops-on-the-hour/386676)
**Author:** [@HuwT](https://discuss.elastic.co/u/HuwT)\ **Replies:** 3\ **Last updated:** [June 5, 2026, 5:01pm UTC](https://discuss.elastic.co/t/count-of-record-drops-on-the-hour/386676 "2026-06-05T17:01:39Z")
Hello, I am running a single node ELK cluster including filebeat. My main pipeline involves Filebeat \> Logstash \> Elastic and I'm running no log mutations or alterations in logstash. I am seeing periodic drops, approxim… --- ## [Canvas - Saved Visualizations Not Loading](https://discuss.elastic.co/t/canvas-saved-visualizations-not-loading/386696)
**Author:** [@ArielC](https://discuss.elastic.co/u/ArielC)\ **Replies:** 1\ **Last updated:** [June 5, 2026, 9:14am UTC](https://discuss.elastic.co/t/canvas-saved-visualizations-not-loading/386696 "2026-06-05T09:14:02Z")
My saved visualizations are not loading in canvas. The method used involved using the expression editor to allow for saved lens visualizations to be loaded into Canvas, and respond to global filters. The script used… --- ## [Elasticsearch Indexing](https://discuss.elastic.co/t/elasticsearch-indexing/386724)
**Author:** [@akmoharana](https://discuss.elastic.co/u/akmoharana)\ **Replies:** 1\ **Last updated:** [June 5, 2026, 7:29am UTC](https://discuss.elastic.co/t/elasticsearch-indexing/386724 "2026-06-05T07:29:33Z")
Hi Team, I am using the ELK stack along with Filebeat for a monitoring project. Currently, Filebeat is collecting logs from a specific directory, and the log files follow a defined naming pattern. We also perform weekl… --- ## [BUG: Heartbeat goes into a state of writing billions of error logs](https://discuss.elastic.co/t/bug-heartbeat-goes-into-a-state-of-writing-billions-of-error-logs/386726)
**Author:** [@up2neck](https://discuss.elastic.co/u/up2neck)\ **Replies:** 0\ **Last updated:** [June 5, 2026, 6:10am UTC](https://discuss.elastic.co/t/bug-heartbeat-goes-into-a-state-of-writing-billions-of-error-logs/386726 "2026-06-05T06:10:21Z")
Hello, Since version 9.3.1 of our deployment, that now uses 9.4.2 we observe the following behaviour in Heartbeat: Heartbeat is deployed with Elastic Agent, that controlled by the ECK operator Heartbeat is used for ru… --- ## [Elastic search java client - co.elastic.clients:elasticsearch-java: and minimum target java road map](https://discuss.elastic.co/t/elastic-search-java-client-co-elastic-clients-and-minimum-target-java-road-map/386328)
**Author:** [@manick02](https://discuss.elastic.co/u/manick02)\ **Replies:** 2\ **Last updated:** [June 5, 2026, 6:08am UTC](https://discuss.elastic.co/t/elastic-search-java-client-co-elastic-clients-and-minimum-target-java-road-map/386328 "2026-06-05T06:08:03Z")
We use co.elastic.clients:elasticsearch-java in our application, which currently targets Java 17. We understand the 8.x client requires Java 17 as a minimum. Does Elastic have a published roadmap or policy for when the … --- ## [Elasticsearch Nodes Randomly Crashing Due to JVM Native Memory Allocation Failure on Windows Servers](https://discuss.elastic.co/t/elasticsearch-nodes-randomly-crashing-due-to-jvm-native-memory-allocation-failure-on-windows-servers/386422)
**Author:** [@Shubham\_Khodpe](https://discuss.elastic.co/u/Shubham_Khodpe)\ **Replies:** 5\ **Last updated:** [June 4, 2026, 9:50am UTC](https://discuss.elastic.co/t/elasticsearch-nodes-randomly-crashing-due-to-jvm-native-memory-allocation-failure-on-windows-servers/386422 "2026-06-04T09:50:01Z")
Hi Team, We are facing frequent Elasticsearch node crashes across all nodes in our cluster and need guidance on identifying the root cause and recommended tuning. Environment Details Elasticsearch Version: 9.1.3 OS… --- ## [Elasticsearch coordinating node OOM/crash under sustained ingest (60k docs/min) with high shard count (~800)](https://discuss.elastic.co/t/elasticsearch-coordinating-node-oom-crash-under-sustained-ingest-60k-docs-min-with-high-shard-count-800/386710)
**Author:** [@Osmel\_Pillot](https://discuss.elastic.co/u/Osmel_Pillot)\ **Replies:** 1\ **Last updated:** [June 4, 2026, 3:53am UTC](https://discuss.elastic.co/t/elasticsearch-coordinating-node-oom-crash-under-sustained-ingest-60k-docs-min-with-high-shard-count-800/386710 "2026-06-04T03:53:49Z")
I have an Elasticsearch cluster with 3 master nodes (6 GB RAM each), 2 data nodes (16 GB RAM each), 1 ingest node (8 GB RAM), 1 coordinating node (16 GB RAM), and 1 transform node (6 GB RAM). Additionally, I have 1 Kiban… --- ## [Kaspersky Logs for SOC](https://discuss.elastic.co/t/kaspersky-logs-for-soc/386695)
**Author:** [@breno.bazaga](https://discuss.elastic.co/u/breno.bazaga)\ **Replies:** 0\ **Last updated:** [June 3, 2026, 1:49pm UTC](https://discuss.elastic.co/t/kaspersky-logs-for-soc/386695 "2026-06-03T13:49:51Z")
Hello everyone, I currently work in a SOC environment and I am working on a use case involving monitoring and ingestion of Kaspersky logs into Elastic for managed security services. During the integration process, I no… --- ## [Logstash credentials management](https://discuss.elastic.co/t/logstash-credentials-management/386680)
**Author:** [@ShubhamKumarJena](https://discuss.elastic.co/u/ShubhamKumarJena)\ **Replies:** 1\ **Last updated:** [June 3, 2026, 1:14pm UTC](https://discuss.elastic.co/t/logstash-credentials-management/386680 "2026-06-03T13:14:51Z")
Hello ! \*\* Problem Statement\*\* We are reviewing the current authentication mechanism used by our Logstash deployment and would like to align it with industry best practices. Currently, certain Logstash pipelines requ… --- ## [Duplicate Elastic Agent metrics → 409 conflicts in Logstash (.metrics-\* only)](https://discuss.elastic.co/t/duplicate-elastic-agent-metrics-409-conflicts-in-logstash-metrics-only/386672)
**Author:** [@username456](https://discuss.elastic.co/u/username456)\ **Replies:** 0\ **Last updated:** [June 3, 2026, 7:40am UTC](https://discuss.elastic.co/t/duplicate-elastic-agent-metrics-409-conflicts-in-logstash-metrics-only/386672 "2026-06-03T07:40:53Z")
Hello, We are currently experiencing an issue with Fleet-managed Elastic Agent where metrics are being sent twice, resulting in 409 version conflict errors in Logstash. We have not been able to identify the cause of thi… --- ## [Elastic POC Sizing & Architecture](https://discuss.elastic.co/t/elastic-poc-sizing-architecture/386669)
**Author:** [@Sharmon](https://discuss.elastic.co/u/Sharmon)\ **Replies:** 0\ **Last updated:** [June 3, 2026, 3:58am UTC](https://discuss.elastic.co/t/elastic-poc-sizing-architecture/386669 "2026-06-03T03:58:56Z")
Hello Everyone, I recently joined in a Distributor for elastic and now we have to do POC, I am fairly new to Elastic and my main concern is if we have an estimated ingest of around 400 GB/Day how do we design the archi… --- ## [How to ingest paginated API data into Elasticsearch?](https://discuss.elastic.co/t/how-to-ingest-paginated-api-data-into-elasticsearch/386648)
**Author:** [@1o1o](https://discuss.elastic.co/u/1o1o)\ **Replies:** 1\ **Last updated:** [June 2, 2026, 7:51pm UTC](https://discuss.elastic.co/t/how-to-ingest-paginated-api-data-into-elasticsearch/386648 "2026-06-02T19:51:25Z")
Hi everyone, I’m trying to ingest data from a web application API into an Elasticsearch index. Context: The API is HTTP-based and returns JSON data It supports pagination cursor-based I need to regularly fetch… --- ## [Elastic Architecture on Ex-Hypervisor servers](https://discuss.elastic.co/t/elastic-architecture-on-ex-hypervisor-servers/386605)
**Author:** [@othcher](https://discuss.elastic.co/u/othcher)\ **Replies:** 2\ **Last updated:** [June 2, 2026, 8:57am UTC](https://discuss.elastic.co/t/elastic-architecture-on-ex-hypervisor-servers/386605 "2026-06-02T08:57:59Z")
Hello ELK community, I'm currently implementing my first ELK infrastructure in production. The plan is to ingest S3 logs that are sent from 54 source servers where we installed filebeat. We have 3 physical servers ava… --- ## [How to authenticate to Elastic via API with PowerShell?](https://discuss.elastic.co/t/how-to-authenticate-to-elastic-via-api-with-powershell/365714)
**Author:** [@logalicious](https://discuss.elastic.co/u/logalicious)\ **Replies:** 3\ **Last updated:** [June 1, 2026, 7:13am UTC](https://discuss.elastic.co/t/how-to-authenticate-to-elastic-via-api-with-powershell/365714 "2026-06-01T07:13:16Z")
I am trying to generate a dashboard PDF via POST URL. The documentation provides the following curl command: curl \\ -XPOST \\ -u elastic \\ -H 'kbn-xsrf: true' \\ 'http://0.0.0.0:5601/api/reporting/generate/csv?jobParam… --- ## [LAG() LEAD() Functions in ES|QL](https://discuss.elastic.co/t/lag-lead-functions-in-es-ql/386589)
**Author:** [@YousefNein](https://discuss.elastic.co/u/YousefNein)\ **Replies:** 0\ **Last updated:** [May 31, 2026, 12:27am UTC](https://discuss.elastic.co/t/lag-lead-functions-in-es-ql/386589 "2026-05-31T00:27:12Z")
Will there be an addition for LAG() or LEAD() functions that are in SQL added to ES|QL in the future? --- ## [Practical issues related to disk usage](https://discuss.elastic.co/t/practical-issues-related-to-disk-usage/386568)
**Author:** [@mloine](https://discuss.elastic.co/u/mloine)\ **Replies:** 2\ **Last updated:** [May 30, 2026, 8:42am UTC](https://discuss.elastic.co/t/practical-issues-related-to-disk-usage/386568 "2026-05-30T08:42:34Z")
Hello, I am encountering a situation now: Version: 6.8.1 Number of nodes: 20, of which 15 nodes are 500G and 5 nodes are 2000G Now the 500G disk must be filled up to trigger the water level configuration of the disk. … --- ## [Logstash output input Logstash](https://discuss.elastic.co/t/logstash-output-input-logstash/386571)
**Author:** [@Sam11](https://discuss.elastic.co/u/Sam11)\ **Replies:** 3\ **Last updated:** [May 29, 2026, 4:01pm UTC](https://discuss.elastic.co/t/logstash-output-input-logstash/386571 "2026-05-29T16:01:44Z")
Recently I started getting frequent Read timed out errors from Logstash 1 which is seding to another logstash via the plugin input/output Logstash. I am experiencing a major latency issue. Data is not lost, but logs arr… --- ## [Version conflict, document already exists when putting new documents](https://discuss.elastic.co/t/version-conflict-document-already-exists-when-putting-new-documents/386577)
**Author:** [@scip](https://discuss.elastic.co/u/scip)\ **Replies:** 1\ **Last updated:** [May 29, 2026, 12:37pm UTC](https://discuss.elastic.co/t/version-conflict-document-already-exists-when-putting-new-documents/386577 "2026-05-29T12:37:52Z")
For testing+learning purposes I created a new index and add new docs in a loop. I am using a cli tool for this, which I call in a simple shell loop: while :; do ts=$(date --iso-8601=second) msg=$(dicepwgen -c 6) e… --- ## [Kibana 9.4.1 xpack disabled not working anymore](https://discuss.elastic.co/t/kibana-9-4-1-xpack-disabled-not-working-anymore/386347)
**Author:** [@VamPikmin](https://discuss.elastic.co/u/VamPikmin)\ **Replies:** 8\ **Last updated:** [May 28, 2026, 10:50pm UTC](https://discuss.elastic.co/t/kibana-9-4-1-xpack-disabled-not-working-anymore/386347 "2026-05-28T22:50:00Z")
I can't access Kibana with xpack security disabled since upgrading my test setup to 9.4.1 I'm proxying Kibana with nginx [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=7) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=9)