# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=82 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 83 --- ## [Elastic query](https://discuss.elastic.co/t/elastic-query/376688)
**Author:** [@Paf](https://discuss.elastic.co/u/Paf)\ **Replies:** 0\ **Last updated:** [April 2, 2025, 1:41pm UTC](https://discuss.elastic.co/t/elastic-query/376688 "2025-04-02T13:41:40Z")
Hello, Il would like to make a query that is use to analyze the data to identify, for each distinct value of the field « Field\_a », if the values of the field\_b change from « value\_b\_1 » to « value\_b\_2 » over a given pe… --- ## [Typesafety and ElasticSearch](https://discuss.elastic.co/t/typesafety-and-elasticsearch/376689)
**Author:** [@CLOVIS-AI](https://discuss.elastic.co/u/CLOVIS-AI)\ **Replies:** 0\ **Last updated:** [April 2, 2025, 1:41pm UTC](https://discuss.elastic.co/t/typesafety-and-elasticsearch/376689 "2025-04-02T13:41:46Z")
Hi! I'm the author of KtMongo, a Kotlin driver for MongoDB. One of the features of KtMongo is the ability to use Kotlin's DSLs to recreate typesafe requests within Kotlin itself. For example, a user could declare the s… --- ## [Elastic search 1000 req/s with max response time under 100 ms](https://discuss.elastic.co/t/elastic-search-1000-req-s-with-max-response-time-under-100-ms/376506)
**Author:** [@Majri\_Mohamed](https://discuss.elastic.co/u/Majri_Mohamed)\ **Replies:** 5\ **Last updated:** [April 2, 2025, 1:30pm UTC](https://discuss.elastic.co/t/elastic-search-1000-req-s-with-max-response-time-under-100-ms/376506 "2025-04-02T13:30:29Z")
my server is 85 vCPU with 200 gb ram i want to run 1000 req/s of medium search queries and aggregations with 100% success and max latency and response time under 100 ms I need help on the configuration please for Elast… --- ## [ES6 Cluster , with mult-NIC(Each node has more than two ips) bindip to 0.0.0.0 successfully . But Same with ES8 does not work](https://discuss.elastic.co/t/es6-cluster-with-mult-nic-each-node-has-more-than-two-ips-bindip-to-0-0-0-0-successfully-but-same-with-es8-does-not-work/376447)
**Author:** [@Varinder](https://discuss.elastic.co/u/Varinder)\ **Replies:** 13\ **Last updated:** [April 2, 2025, 1:12pm UTC](https://discuss.elastic.co/t/es6-cluster-with-mult-nic-each-node-has-more-than-two-ips-bindip-to-0-0-0-0-successfully-but-same-with-es8-does-not-work/376447 "2025-04-02T13:12:48Z")
ES6 Cluster , with mult-NIC(Each node has more than two ips) bindip to 0.0.0.0 successfully . But Same with ES8 does not work. ES 8.15.2 Cluster throws and error in installation of two or more servers with (Each server… --- ## [Unenrollment on already offline hosts](https://discuss.elastic.co/t/unenrollment-on-already-offline-hosts/376631)
**Author:** [@Ziyi26](https://discuss.elastic.co/u/Ziyi26)\ **Replies:** 2\ **Last updated:** [April 2, 2025, 11:20am UTC](https://discuss.elastic.co/t/unenrollment-on-already-offline-hosts/376631 "2025-04-02T11:20:06Z")
Hi there, We have a lot of Offline Elastic Agents on hosts which have not checked in for over 6 months. Per documentation, the enrollment-timeout should take care of this by automatically unenroll them and set them as i… --- ## [Fail to generate certs](https://discuss.elastic.co/t/fail-to-generate-certs/376625)
**Author:** [@zan135](https://discuss.elastic.co/u/zan135)\ **Replies:** 2\ **Last updated:** [April 2, 2025, 11:10am UTC](https://discuss.elastic.co/t/fail-to-generate-certs/376625 "2025-04-02T11:10:51Z")
Hello I'm trying to deploy elasticsearch and kibana using docker-compose but the elasticsearch container exited because the file usr/share/elasticsearch/config/certs/transport.p12 does not exists. Precision 1 : I want t… --- ## [Two simple and quite basic questions regarding search performance in elastichsearch](https://discuss.elastic.co/t/two-simple-and-quite-basic-questions-regarding-search-performance-in-elastichsearch/376662)
**Author:** [@smm](https://discuss.elastic.co/u/smm)\ **Replies:** 7\ **Last updated:** [April 2, 2025, 11:07am UTC](https://discuss.elastic.co/t/two-simple-and-quite-basic-questions-regarding-search-performance-in-elastichsearch/376662 "2025-04-02T11:07:15Z")
Dear community I have two simple and quite basic questions regarding search performance in elastichsearch in general: If I am interested of doing searches in the documents / indicies in a time window of max. the latest … --- ## [Recurring searches with the same request for dense\_vector exhibit consistency issues in the results](https://discuss.elastic.co/t/recurring-searches-with-the-same-request-for-dense-vector-exhibit-consistency-issues-in-the-results/372347)
**Author:** [@Zona-hu](https://discuss.elastic.co/u/Zona-hu)\ **Replies:** 2\ **Last updated:** [April 2, 2025, 10:35am UTC](https://discuss.elastic.co/t/recurring-searches-with-the-same-request-for-dense-vector-exhibit-consistency-issues-in-the-results/372347 "2025-04-02T10:35:55Z")
In an index without replicas, with no data being written, some vector requests, when repeated, yield inconsistent results. This issue is reproducible in versions 8.13.4, 8.15.1, and 8.17.0, but cannot be reproduced in v… --- ## [Winlogbeat was mistakenly killed by 360 antivirus software, how to solve it](https://discuss.elastic.co/t/winlogbeat-was-mistakenly-killed-by-360-antivirus-software-how-to-solve-it/376156)
**Author:** [@shaohuan](https://discuss.elastic.co/u/shaohuan)\ **Replies:** 9\ **Last updated:** [April 2, 2025, 9:55am UTC](https://discuss.elastic.co/t/winlogbeat-was-mistakenly-killed-by-360-antivirus-software-how-to-solve-it/376156 "2025-04-02T09:55:29Z")
When the program is running, it is always mistakenly killed by 360 antivirus software --- ## [Can not send alert Email by Kibana](https://discuss.elastic.co/t/can-not-send-alert-email-by-kibana/376670)
**Author:** [@JackLu](https://discuss.elastic.co/u/JackLu)\ **Replies:** 0\ **Last updated:** [April 2, 2025, 8:39am UTC](https://discuss.elastic.co/t/can-not-send-alert-email-by-kibana/376670 "2025-04-02T08:39:53Z")
Hello guys: I tried to set up email alerts using the Kibana UI interface, but I was unable to configure it successfully. Besides Gmail, I also tried using Outlook with ports 465 and 587, testing both secure and … --- ## [Sharepoint](https://discuss.elastic.co/t/sharepoint/376424)
**Author:** [@volivares](https://discuss.elastic.co/u/volivares)\ **Replies:** 4\ **Last updated:** [April 2, 2025, 8:31am UTC](https://discuss.elastic.co/t/sharepoint/376424 "2025-04-02T08:31:18Z")
I'm having an issue with the SharePoint connector that isn't finishing its updates completely. It's throwing the following error: PermissionsMissing: Received Unauthorized response for https://xxxx.sharepoint.com/sites… --- ## [Testing with Filebeat vs Custom Filestream Integration](https://discuss.elastic.co/t/testing-with-filebeat-vs-custom-filestream-integration/376654)
**Author:** [@erikg](https://discuss.elastic.co/u/erikg)\ **Replies:** 2\ **Last updated:** [April 1, 2025, 10:32pm UTC](https://discuss.elastic.co/t/testing-with-filebeat-vs-custom-filestream-integration/376654 "2025-04-01T22:32:37Z")
Hello, I have custom filebeat logs and I am moving them to Elastic Agent's Custom File stream Integration. For testing everything from how the multiline is processed to the transformation to the data, was done by rinse … --- ## [Client.Timeout or context cancellation while reading body events: body.payloads.map(payload)](https://discuss.elastic.co/t/client-timeout-or-context-cancellation-while-reading-body-events-body-payloads-map-payload/376605)
**Author:** [@checo2024](https://discuss.elastic.co/u/checo2024)\ **Replies:** 0\ **Last updated:** [April 1, 2025, 12:35am UTC](https://discuss.elastic.co/t/client-timeout-or-context-cancellation-while-reading-body-events-body-payloads-map-payload/376605 "2025-04-01T00:35:16Z")
After upgrading Elasticsearch to 8.17.4 (Windows), Elastic Agent and AbuseCH 2.6.1 integration the hosts listed in Fleet show unhealthy status. The logs show the following error : elastic\_agent cel-default \[elastic\_ag… --- ## [Restore snapshot checksum problem (Troubleshooting corruption)](https://discuss.elastic.co/t/restore-snapshot-checksum-problem-troubleshooting-corruption/369764)
**Author:** [@IgorSim](https://discuss.elastic.co/u/IgorSim)\ **Replies:** 22\ **Last updated:** [April 1, 2025, 5:05pm UTC](https://discuss.elastic.co/t/restore-snapshot-checksum-problem-troubleshooting-corruption/369764 "2025-04-01T17:05:55Z")
Hi, i'm encountering a problem when restoring ES snapshot into an empty cluster, some of the indices can't be restored due to org.apache.lucene.index.CorruptIndexException checksum failed (i'm using ES version 8.10) I'm… --- ## [Custom Filestream Integration - Error](https://discuss.elastic.co/t/custom-filestream-integration-error/376652)
**Author:** [@erikg](https://discuss.elastic.co/u/erikg)\ **Replies:** 2\ **Last updated:** [April 1, 2025, 5:02pm UTC](https://discuss.elastic.co/t/custom-filestream-integration-error/376652 "2025-04-01T17:02:09Z")
Hello can someone help explain this error and how to potential fix it? --- ## [Elastic GeoIP does not work for Linux hosts](https://discuss.elastic.co/t/elastic-geoip-does-not-work-for-linux-hosts/373987)
**Author:** [@maof97](https://discuss.elastic.co/u/maof97)\ **Replies:** 3\ **Last updated:** [April 1, 2025, 4:20pm UTC](https://discuss.elastic.co/t/elastic-geoip-does-not-work-for-linux-hosts/373987 "2025-04-01T16:20:42Z")
Hello, I have a rather strange problem. My fleet agents that are either Windows or MacOS will send the network flows just fine, including geoid enrichment: Example: But the flows send by Linux hosts do not contain … --- ## [Maximum characters limit text fields in elasticsearch](https://discuss.elastic.co/t/maximum-characters-limit-text-fields-in-elasticsearch/376616)
**Author:** [@venkatkumar229](https://discuss.elastic.co/u/venkatkumar229)\ **Replies:** 1\ **Last updated:** [April 1, 2025, 3:27pm UTC](https://discuss.elastic.co/t/maximum-characters-limit-text-fields-in-elasticsearch/376616 "2025-04-01T15:27:16Z")
Hi Team, We are using an API to get the data into elasticsearch and the API will give the entire documents in the response body which will be stored into elasticsearch into message or event.original. Could you please le… --- ## [Winlogbeat can't communicate with Elastic search Server](https://discuss.elastic.co/t/winlogbeat-cant-communicate-with-elastic-search-server/376650)
**Author:** [@lorimer](https://discuss.elastic.co/u/lorimer)\ **Replies:** 0\ **Last updated:** [April 1, 2025, 2:50pm UTC](https://discuss.elastic.co/t/winlogbeat-cant-communicate-with-elastic-search-server/376650 "2025-04-01T14:50:52Z")
Installed winlogbeat in 2 systems running Windows 2022 Server. None of them communicated it's log files to the Elastic Search server --- ## [Testing Custom Log Ingestion Issue: ECS Field](https://discuss.elastic.co/t/testing-custom-log-ingestion-issue-ecs-field/376603)
**Author:** [@erikg](https://discuss.elastic.co/u/erikg)\ **Replies:** 3\ **Last updated:** [April 1, 2025, 2:36pm UTC](https://discuss.elastic.co/t/testing-custom-log-ingestion-issue-ecs-field/376603 "2025-04-01T14:36:48Z")
Hello, I am trying to test out parsing some new logs via Custom File stream Integration. I did an initial upload and then worked backwards by creating the ingest pipeline using the sample documents from the initial uplo… --- ## [Alert Rules - doesn't run by using rule type "elasticsearch query"](https://discuss.elastic.co/t/alert-rules-doesnt-run-by-using-rule-type-elasticsearch-query/376647)
**Author:** [@kchen](https://discuss.elastic.co/u/kchen)\ **Replies:** 0\ **Last updated:** [April 1, 2025, 2:07pm UTC](https://discuss.elastic.co/t/alert-rules-doesnt-run-by-using-rule-type-elasticsearch-query/376647 "2025-04-01T14:07:30Z")
Hello everyone, I am creating a kibana rule (7.17) to fire an action to microsoft teams. If I used the rule type "log threshold" with Notify "On a custom action interval", e.g. every 10 minutes, then the action was inv… --- ## [Have horizontal bar charts been removed from lens in kibana?](https://discuss.elastic.co/t/have-horizontal-bar-charts-been-removed-from-lens-in-kibana/376638)
**Author:** [@Matt\_Field](https://discuss.elastic.co/u/Matt_Field)\ **Replies:** 1\ **Last updated:** [April 1, 2025, 2:23pm UTC](https://discuss.elastic.co/t/have-horizontal-bar-charts-been-removed-from-lens-in-kibana/376638 "2025-04-01T14:23:37Z")
I am on kibana 8.17 - it seems a whole load of chart types are no longer available or have they just been hidden from view? --- ## [How can I disable user access to alerts?](https://discuss.elastic.co/t/how-can-i-disable-user-access-to-alerts/376648)
**Author:** [@Razu\_Nator](https://discuss.elastic.co/u/Razu_Nator)\ **Replies:** 1\ **Last updated:** [April 1, 2025, 2:12pm UTC](https://discuss.elastic.co/t/how-can-i-disable-user-access-to-alerts/376648 "2025-04-01T14:12:17Z")
Hi, I want to take away the privileges of users to create alerts, how can I do this? I currently gave privileges to Analytics Discover (All) Dashboard (All) Visualize Library (All) Observability: Infrastructure (… --- ## [Is setting up elk stack on docker intentionaly this complicated?](https://discuss.elastic.co/t/is-setting-up-elk-stack-on-docker-intentionaly-this-complicated/376622)
**Author:** [@batttererere](https://discuss.elastic.co/u/batttererere)\ **Replies:** 11\ **Last updated:** [April 1, 2025, 12:42pm UTC](https://discuss.elastic.co/t/is-setting-up-elk-stack-on-docker-intentionaly-this-complicated/376622 "2025-04-01T12:42:41Z")
I've been dealing with this for a couple hours now, followed half a dozen tutorials i am not a noob, i've set up a thousand servers, i run my own stack at home with a dozen containers. but this? impossible. does anyo… --- ## [Error: Invalid response when creating PDF report from dashboard](https://discuss.elastic.co/t/error-invalid-response-when-creating-pdf-report-from-dashboard/376572)
**Author:** [@rara01](https://discuss.elastic.co/u/rara01)\ **Replies:** 3\ **Last updated:** [April 1, 2025, 10:10am UTC](https://discuss.elastic.co/t/error-invalid-response-when-creating-pdf-report-from-dashboard/376572 "2025-04-01T10:10:55Z")
Hi, I'm using elastic cloud. This morning i got error regarding no report from watcher, that is sending post request for pdf report from dashboard. First error is that watcher script has ::es\_redacted:: password, which … --- ## [Logstash authenticating Error inAAD](https://discuss.elastic.co/t/logstash-authenticating-error-inaad/376627)
**Author:** [@LUMAL](https://discuss.elastic.co/u/LUMAL)\ **Replies:** 0\ **Last updated:** [April 1, 2025, 9:37am UTC](https://discuss.elastic.co/t/logstash-authenticating-error-inaad/376627 "2025-04-01T09:37:56Z")
I´m using Logstash to ingest information in Auxiliary logs and Sentinel the problem I have is that I´m receiving a \*Error while authenticating with AAD \[Excon::Error::BadRequest: '400', Response: '{"error":"unauthorized\_… --- ## [Retrieve linked doc with images in a multimodal RAG app](https://discuss.elastic.co/t/retrieve-linked-doc-with-images-in-a-multimodal-rag-app/368287)
**Author:** [@zan135](https://discuss.elastic.co/u/zan135)\ **Replies:** 2\ **Last updated:** [April 1, 2025, 9:26am UTC](https://discuss.elastic.co/t/retrieve-linked-doc-with-images-in-a-multimodal-rag-app/368287 "2025-04-01T09:26:46Z")
Hello, I need to retrieve documents using a "join" property. Let's explain: I have 2 kind of documents in my index : "test" images and chunks, they are formatted like this { "type":"image" or "chunk", "content":"… --- ## [How can APM anomaly detection be fine-tuned or adjusted to effectively address periodic fluctuations in service metrics?](https://discuss.elastic.co/t/how-can-apm-anomaly-detection-be-fine-tuned-or-adjusted-to-effectively-address-periodic-fluctuations-in-service-metrics/376610)
**Author:** [@arT1](https://discuss.elastic.co/u/arT1)\ **Replies:** 2\ **Last updated:** [April 1, 2025, 8:49am UTC](https://discuss.elastic.co/t/how-can-apm-anomaly-detection-be-fine-tuned-or-adjusted-to-effectively-address-periodic-fluctuations-in-service-metrics/376610 "2025-04-01T08:49:21Z")
Elastic Stack v8.13.3 Use the Elastic APM monitoring service and enable APM Machine Learning (ML). My service metrics data exhibits a regular pattern, with a higher number of visits during weekdays and a significantly l… --- ## [Is it possible to create a new index (transform) by using a field of array type from another index?](https://discuss.elastic.co/t/is-it-possible-to-create-a-new-index-transform-by-using-a-field-of-array-type-from-another-index/376607)
**Author:** [@Nishanth\_Vimalesh](https://discuss.elastic.co/u/Nishanth_Vimalesh)\ **Replies:** 0\ **Last updated:** [April 1, 2025, 1:45am UTC](https://discuss.elastic.co/t/is-it-possible-to-create-a-new-index-transform-by-using-a-field-of-array-type-from-another-index/376607 "2025-04-01T01:45:08Z")
Hi Team, I have a set of documents in an index (index\_a) with fields that look like this: { \_id: \<\>, another\_id: \<\>, float\_field: \<\>, array: \[ {array\_1\_field\_1: \<\>, array\_1\_field\_2: \<\>}, {array\_2\_field\_1: \<\>, array\_2\_f… --- ## [Controls Kibana Bug](https://discuss.elastic.co/t/controls-kibana-bug/366624)
**Author:** [@Ankita\_Pachauri](https://discuss.elastic.co/u/Ankita_Pachauri)\ **Replies:** 4\ **Last updated:** [March 31, 2025, 6:46pm UTC](https://discuss.elastic.co/t/controls-kibana-bug/366624 "2025-03-31T18:46:32Z")
Hi team, We are using version 8.13.4, and have a dashboard from which we have drill down created from Vega to another dashboard which has two controls. The issue is that whenever we drill down to the dashboards with con… --- ## [Logstash Grok isnt working](https://discuss.elastic.co/t/logstash-grok-isnt-working/376599)
**Author:** [@Elk\_huh](https://discuss.elastic.co/u/Elk_huh)\ **Replies:** 3\ **Last updated:** [March 31, 2025, 11:01pm UTC](https://discuss.elastic.co/t/logstash-grok-isnt-working/376599 "2025-03-31T23:01:41Z")
I am trying to parse this but it isnt working Raw Logs \<187\>SCO-N9504-CS01: 2025 Mar 31 18:34:03 UTC: %AUTHPRIV-3-SYSTEM\_MSG: pam\_aaa:Authentication failed from console - login (message repeated 1 time) Code filte… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=81) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=83)