# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=81 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 82 --- ## [kibana server is not ready yet](https://discuss.elastic.co/t/kibana-server-is-not-ready-yet/369205)
**Author:** [@Mat3](https://discuss.elastic.co/u/Mat3)\ **Replies:** 1\ **Last updated:** [April 6, 2025, 6:38pm UTC](https://discuss.elastic.co/t/kibana-server-is-not-ready-yet/369205 "2025-04-06T18:38:43Z")
Hey, I post here you never know. I am currently setting up ELK in order to monitor logs which are stored on an rsyslog server. I installed Elasticsearch correctly, but without a complicated dashboard. Now I am looking … --- ## [Having our own Elastic search DB, if we want to use Kibana for Production MS use , do we need a license still?](https://discuss.elastic.co/t/having-our-own-elastic-search-db-if-we-want-to-use-kibana-for-production-ms-use-do-we-need-a-license-still/376839)
**Author:** [@sujitghose](https://discuss.elastic.co/u/sujitghose)\ **Replies:** 4\ **Last updated:** [April 6, 2025, 1:08pm UTC](https://discuss.elastic.co/t/having-our-own-elastic-search-db-if-we-want-to-use-kibana-for-production-ms-use-do-we-need-a-license-still/376839 "2025-04-06T13:08:20Z")
Having our own Elastic search DB, if we want to use Kibana only for log viewing for Production MS use, do we need a license still? --- ## [How to optimize my ElasticSearch Query](https://discuss.elastic.co/t/how-to-optimize-my-elasticsearch-query/376531)
**Author:** [@simon\_Guille](https://discuss.elastic.co/u/simon_Guille)\ **Replies:** 22\ **Last updated:** [April 5, 2025, 11:30pm UTC](https://discuss.elastic.co/t/how-to-optimize-my-elasticsearch-query/376531 "2025-04-05T23:30:19Z")
Hello, I use a really strong request for my project. I tried to follow Elasticsearch tunes for search speed but it looks like its slower than before. Here you can find my request before I did the optimizations : { "qu… --- ## [How can i create file monitoring in ELK](https://discuss.elastic.co/t/how-can-i-create-file-monitoring-in-elk/376642)
**Author:** [@Mohan.k](https://discuss.elastic.co/u/Mohan.k)\ **Replies:** 1\ **Last updated:** [April 5, 2025, 9:56pm UTC](https://discuss.elastic.co/t/how-can-i-create-file-monitoring-in-elk/376642 "2025-04-05T21:56:18Z")
Can you someone suggest me to configure file monitoring in ELK side. i have elastic agent is running on my Logstash and created the integration as but data is not ingesting. Can you please help me to ingesting data sid… --- ## [Best Way to Convert Dynamic Frontend Filters to Elasticsearch Query DSL (Deeply Nested + AND/OR Support)](https://discuss.elastic.co/t/best-way-to-convert-dynamic-frontend-filters-to-elasticsearch-query-dsl-deeply-nested-and-or-support/376831)
**Author:** [@Hitanshi\_Mehta](https://discuss.elastic.co/u/Hitanshi_Mehta)\ **Replies:** 1\ **Last updated:** [April 5, 2025, 3:53pm UTC](https://discuss.elastic.co/t/best-way-to-convert-dynamic-frontend-filters-to-elasticsearch-query-dsl-deeply-nested-and-or-support/376831 "2025-04-05T15:53:51Z")
Hi everyone, I'm working on a frontend application that includes a flexible filter UI, allowing users to build complex search conditions using nested groups and logical operators (AND, OR). Each filter has a structure l… --- ## [Zeek module not processing logs](https://discuss.elastic.co/t/zeek-module-not-processing-logs/376799)
**Author:** [@thurbs](https://discuss.elastic.co/u/thurbs)\ **Replies:** 0\ **Last updated:** [April 4, 2025, 5:43pm UTC](https://discuss.elastic.co/t/zeek-module-not-processing-logs/376799 "2025-04-04T17:43:15Z")
Rocky 9 VM. Zeek version 6.0.4 Running into an issue where filebeat isn't processing zeek logs after enabling zeek module. I can get filebeat to process the logs manually through filebeat.yml I verify through journalct… --- ## [Match against threat feed entries without Enterprise license](https://discuss.elastic.co/t/match-against-threat-feed-entries-without-enterprise-license/376771)
**Author:** [@artschooldropout](https://discuss.elastic.co/u/artschooldropout)\ **Replies:** 3\ **Last updated:** [April 4, 2025, 2:42pm UTC](https://discuss.elastic.co/t/match-against-threat-feed-entries-without-enterprise-license/376771 "2025-04-04T14:42:45Z")
We use Filebeat to ingest network logs. We're experimenting with threat feed ingestion, and would like to find matches between fields in our logs (say destination.ip) and entries in the threat feed. Is there a way to do … --- ## [Logstash KV filter not working on Greedydata](https://discuss.elastic.co/t/logstash-kv-filter-not-working-on-greedydata/376764)
**Author:** [@Elk\_huh](https://discuss.elastic.co/u/Elk_huh)\ **Replies:** 4\ **Last updated:** [April 4, 2025, 12:40pm UTC](https://discuss.elastic.co/t/logstash-kv-filter-not-working-on-greedydata/376764 "2025-04-04T12:40:44Z")
Raw logs \<190\>SCO-0000-CS01: 2025 Apr 3 17:53:36 UTC: %ACLLOG-6-ACLLOG: SGT: 0, Src IP: 1.1.1.1, Dst IP: 9.9.9.9, Src Port: 504, Dst Port: 443, Src Intf: port-channel1002, Protocol: "UDP"(17), ACL Name: alltraffic, ACE… --- ## [Make cumulative sum to zero at midnight](https://discuss.elastic.co/t/make-cumulative-sum-to-zero-at-midnight/376768)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 2\ **Last updated:** [April 4, 2025, 12:24pm UTC](https://discuss.elastic.co/t/make-cumulative-sum-to-zero-at-midnight/376768 "2025-04-04T12:24:05Z")
I have simple data get in every 15 min. date - size and I would like to create cumulative sum of size. but at midnight I would like to reset it to zero and start over again for a day. how do I do it? is it possible? i… --- ## [Logstash intermittently working](https://discuss.elastic.co/t/logstash-intermittently-working/375324)
**Author:** [@vaseemQA](https://discuss.elastic.co/u/vaseemQA)\ **Replies:** 3\ **Last updated:** [April 4, 2025, 9:14am UTC](https://discuss.elastic.co/t/logstash-intermittently-working/375324 "2025-04-04T09:14:07Z")
hi Team, I'm using Starting Logstash {"logstash.version"=\>"6.8.23"}, my es query is able to show the results in dev-tools, but when i run them through logstash from my local machine, its not working, let me give my samp… --- ## [Elastic pod is not Ready: Readiness probe failed: nc: connect to 127.0.0.1 port 8080 (tcp) failed: Connection refused](https://discuss.elastic.co/t/elastic-pod-is-not-ready-readiness-probe-failed-nc-connect-to-127-0-0-1-port-8080-tcp-failed-connection-refused/368853)
**Author:** [@nnikushkin](https://discuss.elastic.co/u/nnikushkin)\ **Replies:** 4\ **Last updated:** [April 4, 2025, 8:15am UTC](https://discuss.elastic.co/t/elastic-pod-is-not-ready-readiness-probe-failed-nc-connect-to-127-0-0-1-port-8080-tcp-failed-connection-refused/368853 "2025-04-04T08:15:55Z")
Hello everyone, We had recently an upgrade of K8s nodes, during which one all pods were killed. Since the Elastic instances were deployed via ECK, the ECK operator automatically recreated the pods. However, the Elastic … --- ## [Logstash Node stats API does not return anything for pipelines after upgrade to 8.17.3 (from 8.16.1)](https://discuss.elastic.co/t/logstash-node-stats-api-does-not-return-anything-for-pipelines-after-upgrade-to-8-17-3-from-8-16-1/376721)
**Author:** [@Dheeraj\_Gupta](https://discuss.elastic.co/u/Dheeraj_Gupta)\ **Replies:** 1\ **Last updated:** [April 4, 2025, 5:17am UTC](https://discuss.elastic.co/t/logstash-node-stats-api-does-not-return-anything-for-pipelines-after-upgrade-to-8-17-3-from-8-16-1/376721 "2025-04-04T05:17:22Z")
Hi, We have been using node stats API (pipelines end point) to monitor health of our multiple logstash pipelines. After we have upgraded from 8.16.1 to 8.17.3, the endpoint is returning pipelines: {} despite pipelines … --- ## [Fleet-server keeping restarting 401 missing credentials](https://discuss.elastic.co/t/fleet-server-keeping-restarting-401-missing-credentials/376773)
**Author:** [@asha\_kiran](https://discuss.elastic.co/u/asha_kiran)\ **Replies:** 0\ **Last updated:** [April 3, 2025, 10:54pm UTC](https://discuss.elastic.co/t/fleet-server-keeping-restarting-401-missing-credentials/376773 "2025-04-03T22:54:32Z")
Fleet-server pod doesn't restart but the agent keeps restarting for every minute with error missing credentials for REST/ even though the credentials are validating and fetching response from elasticsearch. Version 8.17… --- ## [Seperate the elements into multiple documents using ingest pipeline](https://discuss.elastic.co/t/seperate-the-elements-into-multiple-documents-using-ingest-pipeline/376752)
**Author:** [@sai7276p](https://discuss.elastic.co/u/sai7276p)\ **Replies:** 3\ **Last updated:** [April 3, 2025, 8:00pm UTC](https://discuss.elastic.co/t/seperate-the-elements-into-multiple-documents-using-ingest-pipeline/376752 "2025-04-03T20:00:32Z")
Hi I want to create multiple documents/events based on the target field. Target field contains multiple elements and want to seperate it and create multiple documents using ingest pipeline. I tried with foreach and scri… --- ## [How to use the EVAL SPLIT command?](https://discuss.elastic.co/t/how-to-use-the-eval-split-command/376757)
**Author:** [@Piotr\_Lojowski](https://discuss.elastic.co/u/Piotr_Lojowski)\ **Replies:** 0\ **Last updated:** [April 3, 2025, 4:22pm UTC](https://discuss.elastic.co/t/how-to-use-the-eval-split-command/376757 "2025-04-03T16:22:23Z")
Hi! I'm just starting out with Elastic. How do I use the EVAL SPLIT command? I have a field that contains the following text: value1; value2; value3; I'd like to split them into separate columns. --- ## [Shards distribution implements after upgrade](https://discuss.elastic.co/t/shards-distribution-implements-after-upgrade/376747)
**Author:** [@juancamiloll](https://discuss.elastic.co/u/juancamiloll)\ **Replies:** 7\ **Last updated:** [April 3, 2025, 5:21pm UTC](https://discuss.elastic.co/t/shards-distribution-implements-after-upgrade/376747 "2025-04-03T17:21:30Z")
Hello, I was informed that there was a vulnerability \[CVE-2025-25012\] in older versions of ELK so I set out to go through the whole process to upgrade to the latest version. It is the second time I do it and I am afraid… --- ## [Percentage breakdown for each subgroup](https://discuss.elastic.co/t/percentage-breakdown-for-each-subgroup/376750)
**Author:** [@mat-bro](https://discuss.elastic.co/u/mat-bro)\ **Replies:** 2\ **Last updated:** [April 3, 2025, 4:01pm UTC](https://discuss.elastic.co/t/percentage-breakdown-for-each-subgroup/376750 "2025-04-03T16:01:32Z")
Hi, I am trying to create a table in Kibana Lens (8.13) to calculate statistics for some products. In particular, for each month and product type, I would need to calculate the number of products considered and the perc… --- ## [Breaking changes between elastic agent 8.16.1 and 8.16.3](https://discuss.elastic.co/t/breaking-changes-between-elastic-agent-8-16-1-and-8-16-3/374219)
**Author:** [@mtr\_sw](https://discuss.elastic.co/u/mtr_sw)\ **Replies:** 9\ **Last updated:** [April 3, 2025, 2:23pm UTC](https://discuss.elastic.co/t/breaking-changes-between-elastic-agent-8-16-1-and-8-16-3/374219 "2025-04-03T14:23:23Z")
We were successfully running the elastic agent using the image 8.16.1 in a Kubernetes replica set with the following environment variables set: FLEET\_ENROLL = "1" FLEET\_URL="\ via https" FLEET\_ENROLLME… --- ## [Unable to connect to Elastic Cloud using cloud\_id and cloud\_auth](https://discuss.elastic.co/t/unable-to-connect-to-elastic-cloud-using-cloud-id-and-cloud-auth/376745)
**Author:** [@Francesco\_Esposito](https://discuss.elastic.co/u/Francesco_Esposito)\ **Replies:** 1\ **Last updated:** [April 3, 2025, 1:52pm UTC](https://discuss.elastic.co/t/unable-to-connect-to-elastic-cloud-using-cloud-id-and-cloud-auth/376745 "2025-04-03T13:52:40Z")
Good morning, I am trying to connect with Elasticsearch Output Plugin using cloud\_id and cloud\_auth. I receive an error message about permissions to access https://my\_cloud\_instance/\_license, looks like, for a grant pro… --- ## [Kibana : Fleet & Integrations infinite loading on new Air Gap installation](https://discuss.elastic.co/t/kibana-fleet-integrations-infinite-loading-on-new-air-gap-installation/376675)
**Author:** [@cyberman](https://discuss.elastic.co/u/cyberman)\ **Replies:** 1\ **Last updated:** [April 3, 2025, 12:49pm UTC](https://discuss.elastic.co/t/kibana-fleet-integrations-infinite-loading-on-new-air-gap-installation/376675 "2025-04-03T12:49:05Z")
TL;TR In an AirGap environment, Kibana, "Management \> Fleet & Integrations" shows an infinite loading despite successful connection to the local EPR according to the logs. No errors in browser and no obvious errors in … --- ## [Loss of Logs occurred while migrating from log input to filestream input](https://discuss.elastic.co/t/loss-of-logs-occurred-while-migrating-from-log-input-to-filestream-input/370532)
**Author:** [@koti903281](https://discuss.elastic.co/u/koti903281)\ **Replies:** 1\ **Last updated:** [April 3, 2025, 10:04am UTC](https://discuss.elastic.co/t/loss-of-logs-occurred-while-migrating-from-log-input-to-filestream-input/370532 "2025-04-03T10:04:47Z")
Hi All 1.We are trying to migrate from existing log input to filestream input in filebeat for Autodiscover disable case. 2.We are using the filebeat,logstash and opensearch as 3pp in our micro-services. 3.This is the … --- ## [Agent integration custom log creation failed](https://discuss.elastic.co/t/agent-integration-custom-log-creation-failed/376729)
**Author:** [@Joey\_Visbeen](https://discuss.elastic.co/u/Joey_Visbeen)\ **Replies:** 0\ **Last updated:** [April 3, 2025, 8:47am UTC](https://discuss.elastic.co/t/agent-integration-custom-log-creation-failed/376729 "2025-04-03T08:47:09Z")
When trying to create a custom log integration for an elastic-agent this error pops up: Datastreams matching "logs-custom.log-\*" already exist and are not managed by this package, force flag is required After some rese… --- ## [Elasticsearch Engineer (On-Demand) lab expired](https://discuss.elastic.co/t/elasticsearch-engineer-on-demand-lab-expired/376726)
**Author:** [@hasham](https://discuss.elastic.co/u/hasham)\ **Replies:** 0\ **Last updated:** [April 3, 2025, 8:22am UTC](https://discuss.elastic.co/t/elasticsearch-engineer-on-demand-lab-expired/376726 "2025-04-03T08:22:07Z")
My Elasticsearch Engineer (On-demand) lab has expired after 90 days since I first accessed it. Is there a way it can be re-instated? Or at the minimum, can the lab guide be provided so that I can attempt the lab on a dif… --- ## [How alerts gets recovered?](https://discuss.elastic.co/t/how-alerts-gets-recovered/376725)
**Author:** [@Amol\_Nagotkar](https://discuss.elastic.co/u/Amol_Nagotkar)\ **Replies:** 0\ **Last updated:** [April 3, 2025, 8:17am UTC](https://discuss.elastic.co/t/how-alerts-gets-recovered/376725 "2025-04-03T08:17:42Z")
Hi all, As you can see in above image. 1st alert the rule is On basis of what it is saying recovered. i have thrown errors multiple types to check this. Plus what is the way to remove/delete recovered alerts ? p… --- ## [2D Heatmap for startTime](https://discuss.elastic.co/t/2d-heatmap-for-starttime/376700)
**Author:** [@guyasp](https://discuss.elastic.co/u/guyasp)\ **Replies:** 2\ **Last updated:** [April 3, 2025, 7:42am UTC](https://discuss.elastic.co/t/2d-heatmap-for-starttime/376700 "2025-04-03T07:42:37Z")
Hello, I have a logging of records with creation timestamps, named startTime. I would like to create a 2D heatmap showing peak hours - that is, my horizontal axis should be set to "Date histogram" of this values, with… --- ## [Best Practice for server.ssl.key Permissions in Kibana?](https://discuss.elastic.co/t/best-practice-for-server-ssl-key-permissions-in-kibana/376710)
**Author:** [@anpama](https://discuss.elastic.co/u/anpama)\ **Replies:** 1\ **Last updated:** [April 2, 2025, 9:42pm UTC](https://discuss.elastic.co/t/best-practice-for-server-ssl-key-permissions-in-kibana/376710 "2025-04-02T21:42:01Z")
Hi everyone, I'm setting up SSL for Kibana (via server.ssl.key in kibana.yml) to encrypt browser traffic. My private key file has 600 permissions, and Kibana can’t read it unless I run it as root. However, both the doc… --- ## [Huge amount of Space not released for \_recovery\_source](https://discuss.elastic.co/t/huge-amount-of-space-not-released-for-recovery-source/375477)
**Author:** [@Wei\_Chen](https://discuss.elastic.co/u/Wei_Chen)\ **Replies:** 10\ **Last updated:** [April 2, 2025, 9:14pm UTC](https://discuss.elastic.co/t/huge-amount-of-space-not-released-for-recovery-source/375477 "2025-04-02T21:14:39Z")
Hi, I am trying to optimize my dense vector space usage of the \_source field but haven't got any luck so far. I tried with turning on synthetic source, but then I observed that I now see a new \_recovery\_source field taki… --- ## [Indexing rate for data streams](https://discuss.elastic.co/t/indexing-rate-for-data-streams/376566)
**Author:** [@Dr00py](https://discuss.elastic.co/u/Dr00py)\ **Replies:** 3\ **Last updated:** [April 2, 2025, 4:50pm UTC](https://discuss.elastic.co/t/indexing-rate-for-data-streams/376566 "2025-04-02T16:50:17Z")
I want to calculate the indexing speed of documents in primary shards in my data streams. When monitoring is enabled, I can see the index rate for each index. But I can't do this for any data stream from my clusters. I … --- ## [Packetbeat cant capt http and dns](https://discuss.elastic.co/t/packetbeat-cant-capt-http-and-dns/376412)
**Author:** [@nzeland149](https://discuss.elastic.co/u/nzeland149)\ **Replies:** 3\ **Last updated:** [April 2, 2025, 3:13pm UTC](https://discuss.elastic.co/t/packetbeat-cant-capt-http-and-dns/376412 "2025-04-02T15:13:41Z")
hi i have configured port mirriong in my network to a second interface in my packetbeat machine to send logs to elastic it sends networkflows but i cant see http transaction or dns where should be the probelem (mayber … --- ## [LOGSTASH - wrong pipeline processor Pipeline](https://discuss.elastic.co/t/logstash-wrong-pipeline-processor-pipeline/376423)
**Author:** [@Echo\_01](https://discuss.elastic.co/u/Echo_01)\ **Replies:** 11\ **Last updated:** [April 2, 2025, 2:27pm UTC](https://discuss.elastic.co/t/logstash-wrong-pipeline-processor-pipeline/376423 "2025-04-02T14:27:32Z")
Having update a three node Elasticsearch cluster from 8.12.1 to 8.17.3 Logstash is generating error logs containing the following: , :error=\>{"type"=\>"illegal\_state\_exception", "reason"=\>"Pipeline processor configured f… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=80) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=82)