# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=83 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 84 --- ## [Error trying to filebeat package](https://discuss.elastic.co/t/error-trying-to-filebeat-package/376600)
**Author:** [@nahuel978](https://discuss.elastic.co/u/nahuel978)\ **Replies:** 0\ **Last updated:** [March 31, 2025, 9:54pm UTC](https://discuss.elastic.co/t/error-trying-to-filebeat-package/376600 "2025-03-31T21:54:59Z")
Hello everyone! I'm trying to generate Filebeat packages for version 7.10.2. To do this, I created a workflow that allows you to choose the architecture and rename packages. The problem is that this works with the Ubuntu… --- ## [Datastream : reindex an indice](https://discuss.elastic.co/t/datastream-reindex-an-indice/376571)
**Author:** [@sbocquet](https://discuss.elastic.co/u/sbocquet)\ **Replies:** 3\ **Last updated:** [March 31, 2025, 9:04pm UTC](https://discuss.elastic.co/t/datastream-reindex-an-indice/376571 "2025-03-31T21:04:30Z")
Hi, I have a datastream named "logs-local1-default" that have 3 indices: .ds-logs-local1-default-2024.12.11-000001 .ds-logs-local1-default-2025.02.15-000002 .ds-logs-local1-default-2025.03.25-000003 One (the second o… --- ## [Elastic Agent - ZIA integration](https://discuss.elastic.co/t/elastic-agent-zia-integration/376336)
**Author:** [@Elk\_huh](https://discuss.elastic.co/u/Elk_huh)\ **Replies:** 5\ **Last updated:** [March 31, 2025, 7:35pm UTC](https://discuss.elastic.co/t/elastic-agent-zia-integration/376336 "2025-03-31T19:35:19Z")
I recently set up ZIA integration with Elastic agent, we are getting the Datastreams but are unable to search for anything, anything comes back with no results , verified default template and all fields are keywords but… --- ## [Logstash 8.17.4 filter filter plugin name elasticsearch not found](https://discuss.elastic.co/t/logstash-8-17-4-filter-filter-plugin-name-elasticsearch-not-found/376533)
**Author:** [@dramis](https://discuss.elastic.co/u/dramis)\ **Replies:** 3\ **Last updated:** [March 31, 2025, 4:16pm UTC](https://discuss.elastic.co/t/logstash-8-17-4-filter-filter-plugin-name-elasticsearch-not-found/376533 "2025-03-31T16:16:13Z")
Hello, I just upgrade logstash to 8.17.4 and I got a error: \[2025-03-28T10:26:23,030\]\[ERROR\]\[logstash.agent \] Failed to execute action {:action=\>LogStash::PipelineAction::Create/pipeline\_id:filelogger, :except… --- ## [Kibana Plugin Cache Busting](https://discuss.elastic.co/t/kibana-plugin-cache-busting/376534)
**Author:** [@Dallas\_Toth](https://discuss.elastic.co/u/Dallas_Toth)\ **Replies:** 1\ **Last updated:** [March 31, 2025, 3:47pm UTC](https://discuss.elastic.co/t/kibana-plugin-cache-busting/376534 "2025-03-31T15:47:27Z")
We have a plugin that we continually develop on. Base Kibana version is 8.13.2. When we release new versions of the plugin we always create a new image of Kibana with the new updated image installed to deploy as a conta… --- ## [Logstash Kusto pipeline shows Uploading Failed for local file](https://discuss.elastic.co/t/logstash-kusto-pipeline-shows-uploading-failed-for-local-file/376593)
**Author:** [@Disha\_Bodade](https://discuss.elastic.co/u/Disha_Bodade)\ **Replies:** 0\ **Last updated:** [March 31, 2025, 3:32pm UTC](https://discuss.elastic.co/t/logstash-kusto-pipeline-shows-uploading-failed-for-local-file/376593 "2025-03-31T15:32:04Z")
Hi Team, Not sure it is right place to ask this. We have closed environment which is not exposed to internet. And I have configured to send logs to Azure Data Explorer via Logstash Kusto output plugin. We allowed traf… --- ## [Integration Error - OpenCTI](https://discuss.elastic.co/t/integration-error-opencti/376591)
**Author:** [@deathgame](https://discuss.elastic.co/u/deathgame)\ **Replies:** 1\ **Last updated:** [March 31, 2025, 3:20pm UTC](https://discuss.elastic.co/t/integration-error-opencti/376591 "2025-03-31T15:20:51Z")
Hello, After installing Opencti in a docker environment, I want to get the threat indicators to Elasticsearch. For that, I used the Elastic Agent integration for OpenCTI. However, this integration always shows me this … --- ## [How to deal with duplicate data](https://discuss.elastic.co/t/how-to-deal-with-duplicate-data/375229)
**Author:** [@ksobon](https://discuss.elastic.co/u/ksobon)\ **Replies:** 6\ **Last updated:** [March 31, 2025, 2:24pm UTC](https://discuss.elastic.co/t/how-to-deal-with-duplicate-data/375229 "2025-03-31T14:24:17Z")
I have a Filebeat pipeline that is ingesting data from an end-user machine that might be stored there for 30 days. My Logstash pipeline has the following settings: document\_id =\> "%{\[@metadata\]\[newId\]}" action =\> "creat… --- ## [How to create composite "Bar horizontal percentage" charts](https://discuss.elastic.co/t/how-to-create-composite-bar-horizontal-percentage-charts/376580)
**Author:** [@Michal714](https://discuss.elastic.co/u/Michal714)\ **Replies:** 5\ **Last updated:** [March 31, 2025, 2:29pm UTC](https://discuss.elastic.co/t/how-to-create-composite-bar-horizontal-percentage-charts/376580 "2025-03-31T14:29:52Z")
Hi, I would like to generate a composite "Bar horizontal percentage" chart in Kibana. See PowerPoint version below: I have tried to reproduce this chart in Kibana by using three different methods. None of the method… --- ## [Response 500 when I create a snapshot repository](https://discuss.elastic.co/t/response-500-when-i-create-a-snapshot-repository/376478)
**Author:** [@mahendra5.kumawat](https://discuss.elastic.co/u/mahendra5.kumawat)\ **Replies:** 3\ **Last updated:** [March 31, 2025, 1:58pm UTC](https://discuss.elastic.co/t/response-500-when-i-create-a-snapshot-repository/376478 "2025-03-31T13:58:21Z")
request body: { "type":"s3", "settings":{ "endpoint":"xxx.com", "bucket":"my\_bucket", "client":"oss\_dev" } } I have add keystore: elasticsearch-keystore add s3.client.oss\_dev.access\_key elasticsearch-keystore … --- ## [Abuse.ch API key required but no option in integration](https://discuss.elastic.co/t/abuse-ch-api-key-required-but-no-option-in-integration/376165)
**Author:** [@daniel.velinov](https://discuss.elastic.co/u/daniel.velinov)\ **Replies:** 3\ **Last updated:** [March 31, 2025, 1:35pm UTC](https://discuss.elastic.co/t/abuse-ch-api-key-required-but-no-option-in-integration/376165 "2025-03-31T13:35:54Z")
Hello It appears that Abuse.ch can now block the Threat intel integration because of rate limiting restrictions. If we were to use API key however there is no option to place that under the integration since they requir… --- ## [Kibana Dashboards controls not interactive](https://discuss.elastic.co/t/kibana-dashboards-controls-not-interactive/369713)
**Author:** [@phani\_kumar](https://discuss.elastic.co/u/phani_kumar)\ **Replies:** 5\ **Last updated:** [March 31, 2025, 8:53am UTC](https://discuss.elastic.co/t/kibana-dashboards-controls-not-interactive/369713 "2025-03-31T08:53:24Z")
I've couple of dashboards in my kibana space. For both the dashboards, using controls \[optionlist\], created a filter using one field in my index. Also using links, formed horizontal menu / tabs to navigate between one a… --- ## [Filebeat io.pressure no such file or directory issue](https://discuss.elastic.co/t/filebeat-io-pressure-no-such-file-or-directory-issue/376579)
**Author:** [@PodarcisMuralis](https://discuss.elastic.co/u/PodarcisMuralis)\ **Replies:** 0\ **Last updated:** [March 31, 2025, 11:13am UTC](https://discuss.elastic.co/t/filebeat-io-pressure-no-such-file-or-directory-issue/376579 "2025-03-31T11:13:04Z")
I have multiple Linux servers and Filebeat 7.16.3. I get this log on all servers and it throws the log every 1-2 min. 2025-03-31T13:00:18.519+0200 ERROR metrics/metrics.go:380 error getting cgroup stats: error fe… --- ## [Kibana Shows Black Screen After Login Need Help](https://discuss.elastic.co/t/kibana-shows-black-screen-after-login-need-help/375155)
**Author:** [@xirawa](https://discuss.elastic.co/u/xirawa)\ **Replies:** 3\ **Last updated:** [March 2, 2025, 4:26am UTC](https://discuss.elastic.co/t/kibana-shows-black-screen-after-login-need-help/375155 "2025-03-02T04:26:47Z")
Hi Everyone, I recently upgraded my Elastic Stack version X.X and now when I try to access Kibana, all I see is a black screen after logging in. The browser loads the Kibana interface, but no content appears. Elasticse… --- ## [Expired Certificate (agent / fleet)](https://discuss.elastic.co/t/expired-certificate-agent-fleet/376403)
**Author:** [@GKre](https://discuss.elastic.co/u/GKre)\ **Replies:** 9\ **Last updated:** [March 30, 2025, 1:22pm UTC](https://discuss.elastic.co/t/expired-certificate-agent-fleet/376403 "2025-03-30T13:22:40Z")
First - this is all about a private, protected and insecure test environment! I decided to install agents with the --insecure option and since some days i found out that there's no more data received in the server. Fle… --- ## [Unable to install elasticsearch on ubuntu](https://discuss.elastic.co/t/unable-to-install-elasticsearch-on-ubuntu/376565)
**Author:** [@remoteconn-7891](https://discuss.elastic.co/u/remoteconn-7891)\ **Replies:** 12\ **Last updated:** [March 31, 2025, 5:47am UTC](https://discuss.elastic.co/t/unable-to-install-elasticsearch-on-ubuntu/376565 "2025-03-31T05:47:06Z")
Hello, I'm back. So I'm on Ubuntu Desktop now and trying to install Elasticsearch on the local terminal. The problem, I get an error that says it can't find the package. Here is the error message I get (venv) corey-jam… --- ## [Disable entitlement by default in elastic 8.17](https://discuss.elastic.co/t/disable-entitlement-by-default-in-elastic-8-17/376509)
**Author:** [@smiley\_tamy](https://discuss.elastic.co/u/smiley_tamy)\ **Replies:** 3\ **Last updated:** [March 31, 2025, 1:27am UTC](https://discuss.elastic.co/t/disable-entitlement-by-default-in-elastic-8-17/376509 "2025-03-31T01:27:15Z")
I have a requirement to disable the checks for elasticsearch entitlement. Could you please let me know how is it possible --- ## [NMAP Codec Plugin - Logstash Configuration and Index Template Issues](https://discuss.elastic.co/t/nmap-codec-plugin-logstash-configuration-and-index-template-issues/376547)
**Author:** [@ljonesa](https://discuss.elastic.co/u/ljonesa)\ **Replies:** 2\ **Last updated:** [March 29, 2025, 8:23pm UTC](https://discuss.elastic.co/t/nmap-codec-plugin-logstash-configuration-and-index-template-issues/376547 "2025-03-29T20:23:16Z")
Hello, I have been trying to take an Nmap scan's XML output into Elasticsearch and I have come across a few issues. Below is my Logstash configuration file. input { file { mode =\> "tail" path =\> "/usr/share/logs… --- ## [Data Node Offline on Kibana Dashboard](https://discuss.elastic.co/t/data-node-offline-on-kibana-dashboard/376300)
**Author:** [@gardito-git](https://discuss.elastic.co/u/gardito-git)\ **Replies:** 3\ **Last updated:** [March 28, 2025, 11:28pm UTC](https://discuss.elastic.co/t/data-node-offline-on-kibana-dashboard/376300 "2025-03-28T23:28:59Z")
Greetings everyone, I'm sorry I'm newbie here I have a single master node, single data node and 1 kibana node in our Dev ENV I'm trying to monitoring our Elasticsearch Cluster with this guide when I click the red butto… --- ## [Restart Elasticsearch Instance one at a time](https://discuss.elastic.co/t/restart-elasticsearch-instance-one-at-a-time/376344)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 3\ **Last updated:** [March 28, 2025, 11:24pm UTC](https://discuss.elastic.co/t/restart-elasticsearch-instance-one-at-a-time/376344 "2025-03-28T23:24:04Z")
Hi Team, I want to discuss one issue that Every month we have OS patching. The team will apply patches at server level and they asked application team to stop their application so that they can go for reboot activity on… --- ## [Elastic OpenAI Connector Local LLM](https://discuss.elastic.co/t/elastic-openai-connector-local-llm/375228)
**Author:** [@marmai16](https://discuss.elastic.co/u/marmai16)\ **Replies:** 3\ **Last updated:** [March 28, 2025, 6:53pm UTC](https://discuss.elastic.co/t/elastic-openai-connector-local-llm/375228 "2025-03-28T18:53:58Z")
Hello everyone, i have an elastic instance where i try to set up a custom OpenAI connector to a machine with a locally hosted LLM to use within the AI Assistant. Since 8.17 it is possible to use an OpenAI compatible API… --- ## [Cloudwatch Output -Log group Name](https://discuss.elastic.co/t/cloudwatch-output-log-group-name/376526)
**Author:** [@paw2025](https://discuss.elastic.co/u/paw2025)\ **Replies:** 2\ **Last updated:** [March 28, 2025, 6:26pm UTC](https://discuss.elastic.co/t/cloudwatch-output-log-group-name/376526 "2025-03-28T18:26:15Z")
Hi, I'm trying to send logs to Cloudwatch via logstash. How can I define Log group name in Cloudwatch Output? I don't see any option. Is there any default name for it? \[2025-03-27T21:34:33,162\]\[ERROR\]\[logstash.output… --- ## [Dashboards always deploy to default space](https://discuss.elastic.co/t/dashboards-always-deploy-to-default-space/376543)
**Author:** [@styku](https://discuss.elastic.co/u/styku)\ **Replies:** 0\ **Last updated:** [March 28, 2025, 5:23pm UTC](https://discuss.elastic.co/t/dashboards-always-deploy-to-default-space/376543 "2025-03-28T17:23:32Z")
I am trying to get started with sample dashboards for Metricbeat, but I need to have them in separate Kibana spaces. I know about the setup.kibana.space.id: "space-id" option in metricbeat.yml, and I have it set proper… --- ## [Alert on no data per source?](https://discuss.elastic.co/t/alert-on-no-data-per-source/376425)
**Author:** [@Mike8](https://discuss.elastic.co/u/Mike8)\ **Replies:** 12\ **Last updated:** [March 28, 2025, 4:45pm UTC](https://discuss.elastic.co/t/alert-on-no-data-per-source/376425 "2025-03-28T16:45:37Z")
here @leandrojmp suggested a Log Threshold to get reported when no logs are added in the last 5 mins. This works but only if you add the specific source as a WITH condition. In my case I want to be reported on say 6 sour… --- ## [Unconfirmed Bug: q-Values in Accept-Language Header prevents search results](https://discuss.elastic.co/t/unconfirmed-bug-q-values-in-accept-language-header-prevents-search-results/376540)
**Author:** [@freezernick](https://discuss.elastic.co/u/freezernick)\ **Replies:** 0\ **Last updated:** [March 28, 2025, 4:35pm UTC](https://discuss.elastic.co/t/unconfirmed-bug-q-values-in-accept-language-header-prevents-search-results/376540 "2025-03-28T16:35:27Z")
I have a simple search query that works in all browsers except FF desktop. I could narrow it down to the q-Values of the Accept-Language Header from FF. de,en-US;q=0.7,en;q=0.3 -\> no results de,en-US; -\> results I'm … --- ## [Snapshot restore not restoring DataViews/Dashboard/Alerts](https://discuss.elastic.co/t/snapshot-restore-not-restoring-dataviews-dashboard-alerts/376536)
**Author:** [@optionalname1](https://discuss.elastic.co/u/optionalname1)\ **Replies:** 0\ **Last updated:** [March 28, 2025, 3:46pm UTC](https://discuss.elastic.co/t/snapshot-restore-not-restoring-dataviews-dashboard-alerts/376536 "2025-03-28T15:46:31Z")
Hey there, I was having some issues with my kibana logs/access and then I tried to restore using an old snapshot. But now all my views dashboard alerts are gone. Any chance I can get them back? Thank you in advance. --- ## [Bad version on master node](https://discuss.elastic.co/t/bad-version-on-master-node/376488)
**Author:** [@MaxiNimkus](https://discuss.elastic.co/u/MaxiNimkus)\ **Replies:** 8\ **Last updated:** [March 28, 2025, 2:23pm UTC](https://discuss.elastic.co/t/bad-version-on-master-node/376488 "2025-03-28T14:23:44Z")
Hi everyone, I have an ELASTIC cluster with 3 master nodes and 6 data nodes. I'm having a problem because one master node has upgraded to 8.17.3 while all the other nodes are running 8.17.0. I want to remove this mast… --- ## [Can't use @timestamp in WHERE clause](https://discuss.elastic.co/t/cant-use-timestamp-in-where-clause/376517)
**Author:** [@JensHaglof](https://discuss.elastic.co/u/JensHaglof)\ **Replies:** 4\ **Last updated:** [March 28, 2025, 1:32pm UTC](https://discuss.elastic.co/t/cant-use-timestamp-in-where-clause/376517 "2025-03-28T13:32:45Z")
This query works: query=" SELECT COUNT(1) as value FROM "drs-fija-order" WHERE 1 = 1" This doesn't: query=" SELECT COUNT(1) as value FROM "drs-fija-order" WHERE 1 = 1 and @timestamp \> NOW() - interval 1 hour" … --- ## [Possible bug: Elasticsearch not honouring index.unassigned.node\_left.delayed\_timeout](https://discuss.elastic.co/t/possible-bug-elasticsearch-not-honouring-index-unassigned-node-left-delayed-timeout/376393)
**Author:** [@juan.domenech](https://discuss.elastic.co/u/juan.domenech)\ **Replies:** 5\ **Last updated:** [March 28, 2025, 1:16pm UTC](https://discuss.elastic.co/t/possible-bug-elasticsearch-not-honouring-index-unassigned-node-left-delayed-timeout/376393 "2025-03-28T13:16:20Z")
In Elasticsearch latest (8.17.3) running in Kubernetes ECK (2.16.0) will wait for 5 minutes to assign an Unassigned shard no matter the value of index.unassigned.node\_left.delayed\_timeout in the index configuration. Ple… --- ## [Check event format against template](https://discuss.elastic.co/t/check-event-format-against-template/376451)
**Author:** [@ddoroshenko](https://discuss.elastic.co/u/ddoroshenko)\ **Replies:** 4\ **Last updated:** [March 28, 2025, 10:13am UTC](https://discuss.elastic.co/t/check-event-format-against-template/376451 "2025-03-28T10:13:03Z")
Hi, is it possible to check events format against certain template in Logstash? For example I want to make sure that event contains certain mandatory fields, i.e. "environment", "application" etc. For example I want t… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=82) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=84)