# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=80 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 81 --- ## [Migration of ELK from on prem 7.17 to 8.x in OCI](https://discuss.elastic.co/t/migration-of-elk-from-on-prem-7-17-to-8-x-in-oci/376902)
**Author:** [@sreya\_14](https://discuss.elastic.co/u/sreya_14)\ **Replies:** 2\ **Last updated:** [April 9, 2025, 9:28am UTC](https://discuss.elastic.co/t/migration-of-elk-from-on-prem-7-17-to-8-x-in-oci/376902 "2025-04-09T09:28:46Z")
We have different versions in our ELK stack . Please suggest a plan for migration to 8.x . IAAS or SAAS ,which is recomended? Server 1 elasticsearch-7.17.8-1.x86\_64 elasticsearch-curator-5.7.6-1.x86\_64 apm-server-6.6.2… --- ## [How to display specific values on a time graph](https://discuss.elastic.co/t/how-to-display-specific-values-on-a-time-graph/376941)
**Author:** [@Jice](https://discuss.elastic.co/u/Jice)\ **Replies:** 1\ **Last updated:** [April 9, 2025, 9:10am UTC](https://discuss.elastic.co/t/how-to-display-specific-values-on-a-time-graph/376941 "2025-04-09T09:10:19Z")
Hi, I have a dataview about actions done by users (coming from indexes built from logs). Each row has columns for user, his profile (role) and a timestamp for the time he performs the action. The idea is to have a gra… --- ## [How to add ReadOnlyUsers button next to Login button on the Kibana Login page](https://discuss.elastic.co/t/how-to-add-readonlyusers-button-next-to-login-button-on-the-kibana-login-page/375545)
**Author:** [@karthikmaal](https://discuss.elastic.co/u/karthikmaal)\ **Replies:** 2\ **Last updated:** [April 9, 2025, 9:08am UTC](https://discuss.elastic.co/t/how-to-add-readonlyusers-button-next-to-login-button-on-the-kibana-login-page/375545 "2025-04-09T09:08:34Z")
Hi, I am currently using Kibana v7.6 and have made some customizations to the login page. Specifically, I've added a "ReadOnlyUsers" button next to the Login button (screenshot attached). When clicked, this button autom… --- ## [Querying Watches with Specific Alert Condition States](https://discuss.elastic.co/t/querying-watches-with-specific-alert-condition-states/376948)
**Author:** [@Santiago\_Carnicero](https://discuss.elastic.co/u/Santiago_Carnicero)\ **Replies:** 0\ **Last updated:** [April 9, 2025, 8:43am UTC](https://discuss.elastic.co/t/querying-watches-with-specific-alert-condition-states/376948 "2025-04-09T08:43:57Z")
Dear Elasticsearch Community, I'm implementing a monitoring dashboard that needs to display all active watches that have met their alerting conditions within a specific time window but have not returned to a normal stat… --- ## [Can users do a search and get all the details or is it only aggregated data that we can see from the cold tier](https://discuss.elastic.co/t/can-users-do-a-search-and-get-all-the-details-or-is-it-only-aggregated-data-that-we-can-see-from-the-cold-tier/376940)
**Author:** [@Farheen](https://discuss.elastic.co/u/Farheen)\ **Replies:** 4\ **Last updated:** [April 9, 2025, 7:26am UTC](https://discuss.elastic.co/t/can-users-do-a-search-and-get-all-the-details-or-is-it-only-aggregated-data-that-we-can-see-from-the-cold-tier/376940 "2025-04-09T07:26:26Z")
In the cold phase, are all fields searchable? --- ## [Filebeat unable to connect to azure storage account blob](https://discuss.elastic.co/t/filebeat-unable-to-connect-to-azure-storage-account-blob/376017)
**Author:** [@Sushmitha\_Shetty](https://discuss.elastic.co/u/Sushmitha_Shetty)\ **Replies:** 2\ **Last updated:** [April 9, 2025, 6:46am UTC](https://discuss.elastic.co/t/filebeat-unable-to-connect-to-azure-storage-account-blob/376017 "2025-04-09T06:46:21Z")
I have azure storage container blob in azure with .json file uploaded in it i want automatically json file should be fetched from the blob storage and pushed to elasticsearch using helm how can we acheive it using filebe… --- ## [Azure append Blobs](https://discuss.elastic.co/t/azure-append-blobs/320537)
**Author:** [@lars-s](https://discuss.elastic.co/u/lars-s)\ **Replies:** 2\ **Last updated:** [April 9, 2025, 6:43am UTC](https://discuss.elastic.co/t/azure-append-blobs/320537 "2025-04-09T06:43:26Z")
Hi, i'm new here. I've an problem to read from an azure append blob file with filebeat. i use this configuration: - type: azure-blob-storage id: my-azureblobstorage-id enabled: true acc… --- ## [I want to read an append-format Blob file with filebeat](https://discuss.elastic.co/t/i-want-to-read-an-append-format-blob-file-with-filebeat/375140)
**Author:** [@syo04suke26](https://discuss.elastic.co/u/syo04suke26)\ **Replies:** 2\ **Last updated:** [April 9, 2025, 6:37am UTC](https://discuss.elastic.co/t/i-want-to-read-an-append-format-blob-file-with-filebeat/375140 "2025-04-09T06:37:52Z")
\[background\] I want to configure a data pipeline that uses filebeat to collect log data output to Azure Storage and output it to Logstash. Blob files are append-based and are logged approximately every minute. The log … --- ## [Kibana bar chart empty if ranking is used](https://discuss.elastic.co/t/kibana-bar-chart-empty-if-ranking-is-used/376899)
**Author:** [@Rene\_S](https://discuss.elastic.co/u/Rene_S)\ **Replies:** 3\ **Last updated:** [April 8, 2025, 6:22pm UTC](https://discuss.elastic.co/t/kibana-bar-chart-empty-if-ranking-is-used/376899 "2025-04-08T18:22:38Z")
Hi, we imported several dashboards for uberAgent and try to bring them to the latest and greatest Kibana version. While still in test mode, we create some new visualizations and I have a problem. We have a list of proc… --- ## [Issue with beats (filebeat/metricbeat) with output to kafka](https://discuss.elastic.co/t/issue-with-beats-filebeat-metricbeat-with-output-to-kafka/376914)
**Author:** [@sergeykk](https://discuss.elastic.co/u/sergeykk)\ **Replies:** 0\ **Last updated:** [April 8, 2025, 2:14pm UTC](https://discuss.elastic.co/t/issue-with-beats-filebeat-metricbeat-with-output-to-kafka/376914 "2025-04-08T14:14:03Z")
When filebeat/metricbeat configured to send output to kafka, offset for timestamp functionality in kafka is not working. This is likely due to bug in Sarama (the underlying library filebeat/metricbeat use) not setting M… --- ## [\[Bug\] Elastic Agent reports healthy even if two integrations set up which listen on the same tcp port which doesnt work](https://discuss.elastic.co/t/bug-elastic-agent-reports-healthy-even-if-two-integrations-set-up-which-listen-on-the-same-tcp-port-which-doesnt-work/376901)
**Author:** [@fbpolar](https://discuss.elastic.co/u/fbpolar)\ **Replies:** 1\ **Last updated:** [April 8, 2025, 1:54pm UTC](https://discuss.elastic.co/t/bug-elastic-agent-reports-healthy-even-if-two-integrations-set-up-which-listen-on-the-same-tcp-port-which-doesnt-work/376901 "2025-04-08T13:54:49Z")
When setting up two custom tcp integrations on the same elastic agent, it reports being healthy, even if the second integration doesnt work since it cannot listen on the same port as the first tcp integration. Reproduce… --- ## [ESQL where the field value is a list](https://discuss.elastic.co/t/esql-where-the-field-value-is-a-list/376907)
**Author:** [@duckasylum](https://discuss.elastic.co/u/duckasylum)\ **Replies:** 1\ **Last updated:** [April 8, 2025, 1:33pm UTC](https://discuss.elastic.co/t/esql-where-the-field-value-is-a-list/376907 "2025-04-08T13:33:46Z")
Hi, I have an index created from JSON files and due to the structure of the JSON with multiple same name keys I have now fields which are lists. I am wondering how to use such fields in ESQL queries. For example in the i… --- ## [Is my vector search quick enough](https://discuss.elastic.co/t/is-my-vector-search-quick-enough/376906)
**Author:** [@Capybara07](https://discuss.elastic.co/u/Capybara07)\ **Replies:** 5\ **Last updated:** [April 8, 2025, 12:50pm UTC](https://discuss.elastic.co/t/is-my-vector-search-quick-enough/376906 "2025-04-08T12:50:57Z")
I have 1536 dimension vectors, During benchmarking I am doing vector similarity search using script (not knn) by matching one vector agains 30k stored documents with vectors and getting response in about 4s The time i… --- ## [Sometimes My Rule does not send emails even if conditions are met](https://discuss.elastic.co/t/sometimes-my-rule-does-not-send-emails-even-if-conditions-are-met/376908)
**Author:** [@Khaled\_Saidi](https://discuss.elastic.co/u/Khaled_Saidi)\ **Replies:** 0\ **Last updated:** [April 8, 2025, 12:41pm UTC](https://discuss.elastic.co/t/sometimes-my-rule-does-not-send-emails-even-if-conditions-are-met/376908 "2025-04-08T12:41:50Z")
Hi the team, When I run my rule manually, and the data matches, I receive two separate emails. But when I let it run automatically... I only receive one email instead of two. And sometimes, I even receive nothing at al… --- ## [Add\_kubernetes\_metadata in network flow enrich source.ip and destination.ip](https://discuss.elastic.co/t/add-kubernetes-metadata-in-network-flow-enrich-source-ip-and-destination-ip/376876)
**Author:** [@Farhad\_Salehi](https://discuss.elastic.co/u/Farhad_Salehi)\ **Replies:** 1\ **Last updated:** [April 8, 2025, 10:36am UTC](https://discuss.elastic.co/t/add-kubernetes-metadata-in-network-flow-enrich-source-ip-and-destination-ip/376876 "2025-04-08T10:36:38Z")
i want use add\_kubernetes\_metadata for both source.ip and destination.ip but it just add source.ip information in kubernetes.pod.name and .... and i dont have any data from destinatio.ip. --- ## [Iptables docker chain block](https://discuss.elastic.co/t/iptables-docker-chain-block/376898)
**Author:** [@felixwong](https://discuss.elastic.co/u/felixwong)\ **Replies:** 0\ **Last updated:** [April 8, 2025, 9:17am UTC](https://discuss.elastic.co/t/iptables-docker-chain-block/376898 "2025-04-08T09:17:25Z")
After installing Elasticsearch (port 8174) in Docker, I am experiencing packet drops in the Docker-related iptables chains, specifically: The DOCKER chain is dropping all traffic between non-bridge interfaces and Dock… --- ## [Receiving elasticsearch bulks in Logstash input](https://discuss.elastic.co/t/receiving-elasticsearch-bulks-in-logstash-input/376867)
**Author:** [@wedkarz014](https://discuss.elastic.co/u/wedkarz014)\ **Replies:** 2\ **Last updated:** [April 8, 2025, 8:58am UTC](https://discuss.elastic.co/t/receiving-elasticsearch-bulks-in-logstash-input/376867 "2025-04-08T08:58:34Z")
Hi, Now, we use direct integration, application (es\_output) to elasticsearch (using ingest pipeline) But we would like to add logstash to our architecture. Is it possible to don't change output in the application, so e… --- ## [Request for Assistance in Extracting Fields and corresponding values from Elasticsearch](https://discuss.elastic.co/t/request-for-assistance-in-extracting-fields-and-corresponding-values-from-elasticsearch/376869)
**Author:** [@elastic\_interogation](https://discuss.elastic.co/u/elastic_interogation)\ **Replies:** 1\ **Last updated:** [April 8, 2025, 8:01am UTC](https://discuss.elastic.co/t/request-for-assistance-in-extracting-fields-and-corresponding-values-from-elasticsearch/376869 "2025-04-08T08:01:46Z")
Hi, I am looking to extract all available fields from my Elasticsearch index along with their possible values. I have more than 500 fields to extract. My goal is to create a comprehensive table where: Each column rep… --- ## [Parse log data as metric to create visualization](https://discuss.elastic.co/t/parse-log-data-as-metric-to-create-visualization/376849)
**Author:** [@Eshwar\_K](https://discuss.elastic.co/u/Eshwar_K)\ **Replies:** 1\ **Last updated:** [April 8, 2025, 7:56am UTC](https://discuss.elastic.co/t/parse-log-data-as-metric-to-create-visualization/376849 "2025-04-08T07:56:15Z")
Hi Community, Good day! I am trying to create chart visualization for fields which I extracted for one of the data sets but while creating the visualization it is taking count of documents instead of values which are e… --- ## [How to estimate the size of a snapshot for a single index or indices in Elasticsearch?](https://discuss.elastic.co/t/how-to-estimate-the-size-of-a-snapshot-for-a-single-index-or-indices-in-elasticsearch/376892)
**Author:** [@nguyenlethaihoang](https://discuss.elastic.co/u/nguyenlethaihoang)\ **Replies:** 2\ **Last updated:** [April 8, 2025, 7:01am UTC](https://discuss.elastic.co/t/how-to-estimate-the-size-of-a-snapshot-for-a-single-index-or-indices-in-elasticsearch/376892 "2025-04-08T07:01:07Z")
Hi everyone, I'm currently working with Elasticsearch snapshots and I need some clarification on how to estimate the size of a snapshot, especially for a specific index. For example: Let's say I have an index called l… --- ## [Failed to determine the health of cluster whats wrong with my configuration](https://discuss.elastic.co/t/failed-to-determine-the-health-of-cluster-whats-wrong-with-my-configuration/376888)
**Author:** [@Bonar\_Panjaitan](https://discuss.elastic.co/u/Bonar_Panjaitan)\ **Replies:** 0\ **Last updated:** [April 8, 2025, 4:46am UTC](https://discuss.elastic.co/t/failed-to-determine-the-health-of-cluster-whats-wrong-with-my-configuration/376888 "2025-04-08T04:46:09Z")
im running on single node elastic. failed when i try to reset the password. help me master. ======================== Elasticsearch Configuration ========================= NOTE: Elasticsearch comes with reasonable defau… --- ## [Logsdb will save about 65% disk spaces but i have received these results (Am I doing something wrong here)](https://discuss.elastic.co/t/logsdb-will-save-about-65-disk-spaces-but-i-have-received-these-results-am-i-doing-something-wrong-here/376883)
**Author:** [@kishorkumar](https://discuss.elastic.co/u/kishorkumar)\ **Replies:** 3\ **Last updated:** [April 7, 2025, 11:43pm UTC](https://discuss.elastic.co/t/logsdb-will-save-about-65-disk-spaces-but-i-have-received-these-results-am-i-doing-something-wrong-here/376883 "2025-04-07T23:43:25Z")
I have tried uploading the simple logs data of windows from direct upload with about 279 KB file size that after ingestion into elastic was about 277.58kb. named windows\_2k\_simple that 277.58kb. same with logsdb setti… --- ## [Kibana alerts stops being generated](https://discuss.elastic.co/t/kibana-alerts-stops-being-generated/373904)
**Author:** [@Hint7\_7](https://discuss.elastic.co/u/Hint7_7)\ **Replies:** 5\ **Last updated:** [April 7, 2025, 9:36pm UTC](https://discuss.elastic.co/t/kibana-alerts-stops-being-generated/373904 "2025-04-07T21:36:10Z")
Hello, I have a problem in kibana Alerts (security -\> Alerts) stops being generated. I tried to restart Kibana, it's starts UP but the alerts aren't received. Can you please help me or give me any needed information that… --- ## [Replace the kibana logo](https://discuss.elastic.co/t/replace-the-kibana-logo/376859)
**Author:** [@anagha03](https://discuss.elastic.co/u/anagha03)\ **Replies:** 2\ **Last updated:** [April 7, 2025, 7:44pm UTC](https://discuss.elastic.co/t/replace-the-kibana-logo/376859 "2025-04-07T19:44:39Z")
Can we replace the Kibana Logo in its newer version 8.17 Can someone help me with this --- ## [Kubernetes integration not shipping container logs](https://discuss.elastic.co/t/kubernetes-integration-not-shipping-container-logs/360733)
**Author:** [@pk92](https://discuss.elastic.co/u/pk92)\ **Replies:** 3\ **Last updated:** [April 7, 2025, 8:58am UTC](https://discuss.elastic.co/t/kubernetes-integration-not-shipping-container-logs/360733 "2025-04-07T08:58:35Z")
Hi, I have a K3S cluster running and installed the Elastic Agent on a node to test the shipping of logs and metrics from the cluster. After some fiddling I got most of the metrics (with kube-state-metrics) running. My p… --- ## [Clarification on ETW keywords Field Representation and Human-Readable Conversion](https://discuss.elastic.co/t/clarification-on-etw-keywords-field-representation-and-human-readable-conversion/376736)
**Author:** [@sikson](https://discuss.elastic.co/u/sikson)\ **Replies:** 1\ **Last updated:** [April 7, 2025, 8:56am UTC](https://discuss.elastic.co/t/clarification-on-etw-keywords-field-representation-and-human-readable-conversion/376736 "2025-04-07T08:56:48Z")
Hi! I’m working with Filebeat (v8.15.3) to ingest Windows ETW events (provider.name: Microsoft-Windows-DNSServer) and noticed that the keywords field is represented as a large decimal integer (e.g., "keywords": "9223372… --- ## [Elasticsearch Not Logging Query Details Despite Enabling Audit Logs](https://discuss.elastic.co/t/elasticsearch-not-logging-query-details-despite-enabling-audit-logs/376790)
**Author:** [@kishorkumar](https://discuss.elastic.co/u/kishorkumar)\ **Replies:** 10\ **Last updated:** [April 7, 2025, 6:59am UTC](https://discuss.elastic.co/t/elasticsearch-not-logging-query-details-despite-enabling-audit-logs/376790 "2025-04-07T06:59:17Z")
I have enabled the xpack.security.audit.enabled: true and also added xpack.security.audit.logfile.events.emit\_request\_body: true but when i query from postman but that does not seems to logging as i can only two streams … --- ## [Selective retnetion for an index](https://discuss.elastic.co/t/selective-retnetion-for-an-index/376720)
**Author:** [@Anusha\_Kusanghi](https://discuss.elastic.co/u/Anusha_Kusanghi)\ **Replies:** 8\ **Last updated:** [April 7, 2025, 5:55am UTC](https://discuss.elastic.co/t/selective-retnetion-for-an-index/376720 "2025-04-07T05:55:09Z")
We have a requirement in Elasticsearch where, for a single index, we need to store certain fields for one month and others for three months. Since there is no direct selective retention with ILM , we aim to achieve this… --- ## [ECK Kibana recieves 401 in minutes if no operations in Kibana](https://discuss.elastic.co/t/eck-kibana-recieves-401-in-minutes-if-no-operations-in-kibana/376363)
**Author:** [@LongKang\_Fan](https://discuss.elastic.co/u/LongKang_Fan)\ **Replies:** 2\ **Last updated:** [April 7, 2025, 3:47am UTC](https://discuss.elastic.co/t/eck-kibana-recieves-401-in-minutes-if-no-operations-in-kibana/376363 "2025-04-07T03:47:42Z")
Hi, I used the ECK operator to deploy an ELK cluster on my local k8s cluster with: 3 instances of Elasticsearch 3 instances of Logstash 1 Kibana instance A few Filebeat instances The ELK pipeline is working well—Fileb… --- ## [Language broken, when get .csv file with search result, SHARE menu](https://discuss.elastic.co/t/language-broken-when-get-csv-file-with-search-result-share-menu/376837)
**Author:** [@suminlim](https://discuss.elastic.co/u/suminlim)\ **Replies:** 3\ **Last updated:** [April 7, 2025, 1:33am UTC](https://discuss.elastic.co/t/language-broken-when-get-csv-file-with-search-result-share-menu/376837 "2025-04-07T01:33:55Z")
Hello, I have a problem on saving the .csv file from a search result (at discovery). When I clicked a "share" button and try to get result as a .csv file, it generates the .csv very well but Korean Language is broken. … [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=79) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=81)