# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=89 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 90 --- ## [Is there any example of using bucketSelector in java client 8.14.1?](https://discuss.elastic.co/t/is-there-any-example-of-using-bucketselector-in-java-client-8-14-1/375924)
**Author:** [@TheXs](https://discuss.elastic.co/u/TheXs)\ **Replies:** 2\ **Last updated:** [March 14, 2025, 3:33pm UTC](https://discuss.elastic.co/t/is-there-any-example-of-using-bucketselector-in-java-client-8-14-1/375924 "2025-03-14T15:33:05Z")
Hi, there. I am currently using 8.14.1 rest client for java, by now, I want to use bucketSelector to filter the bucket. However, I can't find any example showing how to use that api and I tried a bit but still not able … --- ## [Lense visualization with reference line based on max count of documents of any interval](https://discuss.elastic.co/t/lense-visualization-with-reference-line-based-on-max-count-of-documents-of-any-interval/375942)
**Author:** [@david11](https://discuss.elastic.co/u/david11)\ **Replies:** 2\ **Last updated:** [March 14, 2025, 3:27pm UTC](https://discuss.elastic.co/t/lense-visualization-with-reference-line-based-on-max-count-of-documents-of-any-interval/375942 "2025-03-14T15:27:14Z")
v 8.17.3 I have created a lense visualization with horizontal axis as "date histogram" of the field "@timestamp" and vertical axis as "count of records". Together with the filter of the lense i get a nice chart of the c… --- ## [Forwarding the http input data to http output data](https://discuss.elastic.co/t/forwarding-the-http-input-data-to-http-output-data/375567)
**Author:** [@Francesco\_Esposito](https://discuss.elastic.co/u/Francesco_Esposito)\ **Replies:** 32\ **Last updated:** [March 14, 2025, 3:24pm UTC](https://discuss.elastic.co/t/forwarding-the-http-input-data-to-http-output-data/375567 "2025-03-14T15:24:47Z")
Hello there. Passing from Elastic On-Prem to Elastic Cloud, I am trying to use Logstash to create a "store and forward" implementation for creating documents in elastic. So, practically, before I was directly writing to… --- ## [Visualization help in TSVB or Lens for CPU metrics](https://discuss.elastic.co/t/visualization-help-in-tsvb-or-lens-for-cpu-metrics/375937)
**Author:** [@julgineer](https://discuss.elastic.co/u/julgineer)\ **Replies:** 1\ **Last updated:** [March 14, 2025, 3:13pm UTC](https://discuss.elastic.co/t/visualization-help-in-tsvb-or-lens-for-cpu-metrics/375937 "2025-03-14T15:13:51Z")
Hello, I am currently trying to build a dashboard to visualize metrics from Metricbeat. Metricbeat is running as a DaemonSet in Kubernetes and pushes infrastructure and application metrics to Elasticsearch every minute… --- ## [Installing elastic Agent in a path other than /opt/](https://discuss.elastic.co/t/installing-elastic-agent-in-a-path-other-than-opt/375928)
**Author:** [@juancamiloll](https://discuss.elastic.co/u/juancamiloll)\ **Replies:** 2\ **Last updated:** [March 14, 2025, 1:57pm UTC](https://discuss.elastic.co/t/installing-elastic-agent-in-a-path-other-than-opt/375928 "2025-03-14T13:57:43Z")
Hello everyone, As I am not the person in charge of administering the servers I have to make a request by mail to the administrator to install the agent. The answer he gave me was that it has no space in /opt/ and I mu… --- ## [Is there any way to add Lens Dashboard in Canvas Dashboard](https://discuss.elastic.co/t/is-there-any-way-to-add-lens-dashboard-in-canvas-dashboard/375860)
**Author:** [@Shubham\_Pant](https://discuss.elastic.co/u/Shubham_Pant)\ **Replies:** 2\ **Last updated:** [March 14, 2025, 1:14pm UTC](https://discuss.elastic.co/t/is-there-any-way-to-add-lens-dashboard-in-canvas-dashboard/375860 "2025-03-14T13:14:51Z")
Hi, I want to show lens dashboard in Canvas dashboard. Is it feasible in canvas? --- ## [Canavas' conditioned formatting does not work](https://discuss.elastic.co/t/canavas-conditioned-formatting-does-not-work/375915)
**Author:** [@Valdo237](https://discuss.elastic.co/u/Valdo237)\ **Replies:** 0\ **Last updated:** [March 14, 2025, 12:55pm UTC](https://discuss.elastic.co/t/canavas-conditioned-formatting-does-not-work/375915 "2025-03-14T12:55:49Z")
I've set up a canvas painting that I want to present, but the color-conditioned formatting doesn't work at all, even though it's set up properly. Can you tell me where the problem lies? --- ## [Deploying and enrolling an agent using ansible. (Ansible-lint failure)](https://discuss.elastic.co/t/deploying-and-enrolling-an-agent-using-ansible-ansible-lint-failure/375897)
**Author:** [@Joey\_Visbeen](https://discuss.elastic.co/u/Joey_Visbeen)\ **Replies:** 1\ **Last updated:** [March 14, 2025, 11:33am UTC](https://discuss.elastic.co/t/deploying-and-enrolling-an-agent-using-ansible-ansible-lint-failure/375897 "2025-03-14T11:33:13Z")
For the installation of the agent on a Linux server I use RPM. This involves using yum. After which the downloaded agent needs to be enrolled. The command in Ansible in straight forward, but Ansible-lint blocks it becaus… --- ## [Is there any known issues for high shared and buff/cache usage with elasticsearch java client](https://discuss.elastic.co/t/is-there-any-known-issues-for-high-shared-and-buff-cache-usage-with-elasticsearch-java-client/374797)
**Author:** [@sibasish.palo](https://discuss.elastic.co/u/sibasish.palo)\ **Replies:** 16\ **Last updated:** [March 14, 2025, 11:05am UTC](https://discuss.elastic.co/t/is-there-any-known-issues-for-high-shared-and-buff-cache-usage-with-elasticsearch-java-client/374797 "2025-03-14T11:05:46Z")
i am using below Elasticsearch java client and see high shared and buff/cache memory usage with the application. \ \co.elastic.clients\ \elasticsearch-java\ **Author:** [@Alice\_Ionescu](https://discuss.elastic.co/u/Alice_Ionescu)\ **Replies:** 3\ **Last updated:** [March 14, 2025, 7:15am UTC](https://discuss.elastic.co/t/create-a-table-visualization-with-nested-fields/375647 "2025-03-14T07:15:49Z") Hello, I have the following index user\_roles { "user\_roles" : { "mappings" : { "properties" : { "roles" : { "type" : "nested", "properties" : { "effective\_from" : { … --- ## [Table visualization on arrays](https://discuss.elastic.co/t/table-visualization-on-arrays/375902)
**Author:** [@Alice\_Ionescu](https://discuss.elastic.co/u/Alice_Ionescu)\ **Replies:** 0\ **Last updated:** [March 14, 2025, 8:53am UTC](https://discuss.elastic.co/t/table-visualization-on-arrays/375902 "2025-03-14T08:53:44Z")
Hello, We have some documents with nested fields (roles) for which we did a flattening by created an array (roles\_display) Here is it the mapping of the index { "mappings": { "properties": { "compliance\_fl… --- ## [Dense vector field in nested object](https://discuss.elastic.co/t/dense-vector-field-in-nested-object/375000)
**Author:** [@yli](https://discuss.elastic.co/u/yli)\ **Replies:** 7\ **Last updated:** [March 14, 2025, 8:45am UTC](https://discuss.elastic.co/t/dense-vector-field-in-nested-object/375000 "2025-03-14T08:45:31Z")
Hi, I tried two different index mapping for my file content indexing with separate the file content into different text sections with corresponding text section embeddings. Flat file section index mapping In this case, … --- ## [Grok pattern](https://discuss.elastic.co/t/grok-pattern/375613)
**Author:** [@arcsons](https://discuss.elastic.co/u/arcsons)\ **Replies:** 9\ **Last updated:** [March 14, 2025, 8:17am UTC](https://discuss.elastic.co/t/grok-pattern/375613 "2025-03-14T08:17:46Z")
Hello everyone, I have an error in my logs. I have created a grok pattern and added it to the agent policy, but it still doesn't work. I have tested the grok pattern with just a few fields \<%{NUMBER:syslog\_pri}\>%… --- ## [Fuzzy matching multi term query problem](https://discuss.elastic.co/t/fuzzy-matching-multi-term-query-problem/375896)
**Author:** [@mateo80](https://discuss.elastic.co/u/mateo80)\ **Replies:** 0\ **Last updated:** [March 14, 2025, 7:38am UTC](https://discuss.elastic.co/t/fuzzy-matching-multi-term-query-problem/375896 "2025-03-14T07:38:46Z")
Hi guys Looks like I'm missing something obvious when trying to fuzzy match multi term query. What I'd like to achieve is to get only "Goleniow Helenow" result when providing "Goleniow Heleniow" query (city + district … --- ## [I am using Kibana version 8.5.3 and have a panel in my dashboard with the time range set from 6 AM yesterday to 6 AM today. However, when I use the drilldown feature, it automatically adjusts the time range to 12 AM yesterday to 12 AM today, instead of pr](https://discuss.elastic.co/t/i-am-using-kibana-version-8-5-3-and-have-a-panel-in-my-dashboard-with-the-time-range-set-from-6-am-yesterday-to-6-am-today-however-when-i-use-the-drilldown-feature-it-automatically-adjusts-the-time-range-to-12-am-yesterday-to-12-am-today-instead-of-pr/375501)
**Author:** [@Hari\_Prasad1](https://discuss.elastic.co/u/Hari_Prasad1)\ **Replies:** 1\ **Last updated:** [March 14, 2025, 6:03am UTC](https://discuss.elastic.co/t/i-am-using-kibana-version-8-5-3-and-have-a-panel-in-my-dashboard-with-the-time-range-set-from-6-am-yesterday-to-6-am-today-however-when-i-use-the-drilldown-feature-it-automatically-adjusts-the-time-range-to-12-am-yesterday-to-12-am-today-instead-of-pr/375501 "2025-03-14T06:03:19Z")
I am using Kibana version 8.5.3 and have a panel in my dashboard and selected the time range set from 6 AM yesterday to 6 AM today. However, when I use the drilldown feature, it automatically adjusts the time range to 12… --- ## [Seeking Advice on Hardware Specifications for ELK-based Log Monitoring System](https://discuss.elastic.co/t/seeking-advice-on-hardware-specifications-for-elk-based-log-monitoring-system/375888)
**Author:** [@yt.seo](https://discuss.elastic.co/u/yt.seo)\ **Replies:** 0\ **Last updated:** [March 14, 2025, 5:53am UTC](https://discuss.elastic.co/t/seeking-advice-on-hardware-specifications-for-elk-based-log-monitoring-system/375888 "2025-03-14T05:53:30Z")
Hello, I am planning to set up an ELK-based log monitoring system on internal servers and would appreciate some guidance on determining the appropriate hardware specifications. I am looking for advice on hardware requi… --- ## [Elastiflow IP Reputation does not show data after Update from 7.2.1 to 7.5.0](https://discuss.elastic.co/t/elastiflow-ip-reputation-does-not-show-data-after-update-from-7-2-1-to-7-5-0/370471)
**Author:** [@olivettinho](https://discuss.elastic.co/u/olivettinho)\ **Replies:** 1\ **Last updated:** [November 22, 2024, 8:02pm UTC](https://discuss.elastic.co/t/elastiflow-ip-reputation-does-not-show-data-after-update-from-7-2-1-to-7-5-0/370471 "2024-11-22T20:02:45Z")
Hello everyone, yesterday I updated our elastiflow-container from v7.2.1 to v7.5.0. I also imported the newest Kibana dashboards from the elastiflow Docs. Since then, the IP Reputation dashboard does not show any data. … --- ## [Loss power now my cluster will not connect](https://discuss.elastic.co/t/loss-power-now-my-cluster-will-not-connect/375539)
**Author:** [@Trent-alex](https://discuss.elastic.co/u/Trent-alex)\ **Replies:** 6\ **Last updated:** [March 13, 2025, 10:12pm UTC](https://discuss.elastic.co/t/loss-power-now-my-cluster-will-not-connect/375539 "2025-03-13T22:12:15Z")
So i lost power in the building. My servers came back up but... now my nodes dont communicate. Any help would be appreciated \[ERROR\]\[o.e.b.Elasticsearch \] \[herzai\] node validation exception \[1\] bootstrap checks f… --- ## [Filter out client.address in WHERE](https://discuss.elastic.co/t/filter-out-client-address-in-where/375727)
**Author:** [@JSElasticDiscuss](https://discuss.elastic.co/u/JSElasticDiscuss)\ **Replies:** 8\ **Last updated:** [March 13, 2025, 5:11pm UTC](https://discuss.elastic.co/t/filter-out-client-address-in-where/375727 "2025-03-13T17:11:02Z")
I am trying to write an ES|QL query that filters out client.address based with a WHERE clause, using wildcards to get rid of internal IP ranges. We are currently using the client.address field as a keyword, and trying to… --- ## [Monitor Trigger Not Producing Alert (tests work fine)](https://discuss.elastic.co/t/monitor-trigger-not-producing-alert-tests-work-fine/375856)
**Author:** [@Bear-Up-A-Tree](https://discuss.elastic.co/u/Bear-Up-A-Tree)\ **Replies:** 0\ **Last updated:** [March 13, 2025, 5:05pm UTC](https://discuss.elastic.co/t/monitor-trigger-not-producing-alert-tests-work-fine/375856 "2025-03-13T17:05:47Z")
My company is using open stack 7.10.2 and I've been asked to set up a monitor, trigger, and alert for when a certain value falls below a set threshold. When I run the monitor, it works fine. When I run the trigger, it wo… --- ## [Mustache script result size limit exceeded](https://discuss.elastic.co/t/mustache-script-result-size-limit-exceeded/375818)
**Author:** [@Arun\_Kumar8](https://discuss.elastic.co/u/Arun_Kumar8)\ **Replies:** 1\ **Last updated:** [March 13, 2025, 3:26pm UTC](https://discuss.elastic.co/t/mustache-script-result-size-limit-exceeded/375818 "2025-03-13T15:26:55Z")
Hi Team, After upgrading the elastic version 7.17.11 to 7.17.27 we are getting the below error while searching in Elasticsearch. our request body size is less than 1 MB, even though we are getting the same exception. … --- ## [Osquery, Yara and Sigfile](https://discuss.elastic.co/t/osquery-yara-and-sigfile/371816)
**Author:** [@DiscussArb](https://discuss.elastic.co/u/DiscussArb)\ **Replies:** 1\ **Last updated:** [March 13, 2025, 2:39pm UTC](https://discuss.elastic.co/t/osquery-yara-and-sigfile/371816 "2025-03-13T14:39:45Z")
I have a bunch of Yara rules that I would like to run on demand using the Yara table in Osquery. Is it possible to use the sigfile parameter, and if so, where should the file be stored so that Osquery finds the sigfile w… --- ## [Inaccurate Cluster total Data in app Monitoring](https://discuss.elastic.co/t/inaccurate-cluster-total-data-in-app-monitoring/375820)
**Author:** [@Nicoletta](https://discuss.elastic.co/u/Nicoletta)\ **Replies:** 4\ **Last updated:** [March 13, 2025, 2:03pm UTC](https://discuss.elastic.co/t/inaccurate-cluster-total-data-in-app-monitoring/375820 "2025-03-13T14:03:22Z")
Hello, I noticed that the total Data managed by a cluster (version 7.2) is slighty different than the sum of the store.size of all indexes (including system ones). I see something like this in the Kibana app Monitoring … --- ## [Azure Microsoft Entra Id integration with Elastic Fleet](https://discuss.elastic.co/t/azure-microsoft-entra-id-integration-with-elastic-fleet/373638)
**Author:** [@Umang\_Pachaury](https://discuss.elastic.co/u/Umang_Pachaury)\ **Replies:** 1\ **Last updated:** [March 13, 2025, 9:26am UTC](https://discuss.elastic.co/t/azure-microsoft-entra-id-integration-with-elastic-fleet/373638 "2025-03-13T09:26:00Z")
Hi Team We need to fetch Microsoft Entra Id SignIn logs using integration with Elasticsearch fleet. We've added its respective integration under a policy and provided required values. The integration is shown as "Healt… --- ## [Logstash file input for log rotation files](https://discuss.elastic.co/t/logstash-file-input-for-log-rotation-files/375815)
**Author:** [@devops\_training](https://discuss.elastic.co/u/devops_training)\ **Replies:** 0\ **Last updated:** [March 13, 2025, 9:23am UTC](https://discuss.elastic.co/t/logstash-file-input-for-log-rotation-files/375815 "2025-03-13T09:23:54Z")
\[2025-03-12T23:41:09,844\]\[INFO \]\[logstash.outputs.elsticsearch\]\[main\]\[fb620d57153c1bad1d3ce0fa625d11e35cc5c8b4b14994fd6f9c6cba50debda9\] Retrying failed action {:status=\>429, :action=\>\["index", {:\_id=\>nil, :\_index=\>"examp… --- ## [Parsing Json fields Cisco ESA Iron Port](https://discuss.elastic.co/t/parsing-json-fields-cisco-esa-iron-port/375714)
**Author:** [@odo24](https://discuss.elastic.co/u/odo24)\ **Replies:** 6\ **Last updated:** [March 13, 2025, 8:38am UTC](https://discuss.elastic.co/t/parsing-json-fields-cisco-esa-iron-port/375714 "2025-03-13T08:38:53Z")
I use this Logstash filter below to parse Cisco ESA logs filter { if "cef" in \[tags\] { mutate { # CEF:0 is pipe delimited, split into individual fields split =\> \["cef\_message", "|"\] add\_… --- ## [Kibana throws encryptionKey missing although it is present?](https://discuss.elastic.co/t/kibana-throws-encryptionkey-missing-although-it-is-present/375525)
**Author:** [@petlit2049](https://discuss.elastic.co/u/petlit2049)\ **Replies:** 5\ **Last updated:** [March 13, 2025, 6:49am UTC](https://discuss.elastic.co/t/kibana-throws-encryptionkey-missing-although-it-is-present/375525 "2025-03-13T06:49:44Z")
Why does Kibana throw this exception: A new encryption key is generated for saved objects each time you start Kibana. Without a persistent key, you cannot delete or modify rules after Kibana restarts. To set a persiste… --- ## [Do I need to upgrade?. Kibana 8.17.3 Security Update (ESA-2025-06)](https://discuss.elastic.co/t/do-i-need-to-upgrade-kibana-8-17-3-security-update-esa-2025-06/375756)
**Author:** [@Nghia\_D\_ng](https://discuss.elastic.co/u/Nghia_D_ng)\ **Replies:** 5\ **Last updated:** [March 13, 2025, 3:54am UTC](https://discuss.elastic.co/t/do-i-need-to-upgrade-kibana-8-17-3-security-update-esa-2025-06/375756 "2025-03-13T03:54:59Z")
Hi Elastic Team Member, @ikakavas, I have read the information from Ikakavas, I am very concerned about my system. But I also want to ask you some questions. Please help me answer my questions. I am using ELK cluster… --- ## [Starting Fscrawler with SSL error](https://discuss.elastic.co/t/starting-fscrawler-with-ssl-error/375028)
**Author:** [@jimmorrison](https://discuss.elastic.co/u/jimmorrison)\ **Replies:** 52\ **Last updated:** [March 12, 2025, 10:52pm UTC](https://discuss.elastic.co/t/starting-fscrawler-with-ssl-error/375028 "2025-03-12T22:52:21Z")
Hi, Elasticsearch daemon is running and when I start Fscrawler I have this fatal error. Thanks 15:43:15,867 WARN \[f.p.e.c.f.c.ElasticsearchClient\] Failed to create elasticsearch client on Elasticsearch{nodes=\[https://1… --- ## [Kibana APM does not show data even though there is APM data](https://discuss.elastic.co/t/kibana-apm-does-not-show-data-even-though-there-is-apm-data/375750)
**Author:** [@rodolk](https://discuss.elastic.co/u/rodolk)\ **Replies:** 17\ **Last updated:** [March 12, 2025, 10:26pm UTC](https://discuss.elastic.co/t/kibana-apm-does-not-show-data-even-though-there-is-apm-data/375750 "2025-03-12T22:26:37Z")
Kibana i snot showing data when I go to Observability-\>APM-\>Services It doesn't show data neither in services, nor traces, nor dependencies Kibana version: 8.15.3 Elasticsearch version: 8.15.3 APM Server version: 8.1… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=88) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=90)