# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=9 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 10 --- ## [How to apply logical operators to search query in golang?](https://discuss.elastic.co/t/how-to-apply-logical-operators-to-search-query-in-golang/386536)
**Author:** [@scip](https://discuss.elastic.co/u/scip)\ **Replies:** 2\ **Last updated:** [May 28, 2026, 12:57pm UTC](https://discuss.elastic.co/t/how-to-apply-logical-operators-to-search-query-in-golang/386536 "2026-05-28T12:57:13Z")
Hi, how can I specify if I want a query to use the AND or OR operator? For a SimpleQuery this is easy, just call DefaultOperator(operator.Operator{"AND"}). But how Do I specify this with a BoolQuery? What I found is, t… --- ## [Kibana audit events for dashboard (It is possible?)](https://discuss.elastic.co/t/kibana-audit-events-for-dashboard-it-is-possible/385823)
**Author:** [@Whoami1980](https://discuss.elastic.co/u/Whoami1980)\ **Replies:** 2\ **Last updated:** [May 28, 2026, 11:52am UTC](https://discuss.elastic.co/t/kibana-audit-events-for-dashboard-it-is-possible/385823 "2026-05-28T11:52:49Z")
We are able to create query to query kibana audit events for changes regarding alerting rules and ml jobs. However it doesnt seems like there is any option for us to do the same for dashboard. For example. we want to kno… --- ## [How to rename missing values in visualizations in kibana 9.2](https://discuss.elastic.co/t/how-to-rename-missing-values-in-visualizations-in-kibana-9-2/386524)
**Author:** [@Ranakel](https://discuss.elastic.co/u/Ranakel)\ **Replies:** 1\ **Last updated:** [May 28, 2026, 3:03am UTC](https://discuss.elastic.co/t/how-to-rename-missing-values-in-visualizations-in-kibana-9-2/386524 "2026-05-28T03:03:11Z")
Hi all, In kibana 8.17 , I was used to renamimg missing values I wanted to show on charts like in this screen shot. With kibana lens in 9.2 , I can't find the equivalent . I only found how to show missing valiues… --- ## [Kibana Showing Only 5xx Errors for API Logs Despite of receving 200 Responses too in Analytics](https://discuss.elastic.co/t/kibana-showing-only-5xx-errors-for-api-logs-despite-of-receving-200-responses-too-in-analytics/386525)
**Author:** [@devapi](https://discuss.elastic.co/u/devapi)\ **Replies:** 1\ **Last updated:** [May 27, 2026, 6:46pm UTC](https://discuss.elastic.co/t/kibana-showing-only-5xx-errors-for-api-logs-despite-of-receving-200-responses-too-in-analytics/386525 "2026-05-27T18:46:40Z")
We have successfully set up and integrated Elasticsearch with the IBM Analytics subsystem to offload API logs into ELK. However, while applying a filter on the API-Name field in the Kibana UI for a specific valid timesta… --- ## [S3 compatible storage are not able to mounted for snapshot](https://discuss.elastic.co/t/s3-compatible-storage-are-not-able-to-mounted-for-snapshot/386444)
**Author:** [@Rajesh\_Kannan](https://discuss.elastic.co/u/Rajesh_Kannan)\ **Replies:** 11\ **Last updated:** [May 27, 2026, 11:05am UTC](https://discuss.elastic.co/t/s3-compatible-storage-are-not-able-to-mounted-for-snapshot/386444 "2026-05-27T11:05:50Z")
We are trying to mount the s3 storage( S3 compatible DataCore (caringo)) bucket on elastic 9.3.0 using the below command and we are getting "s3\_exception: A header you provided implies functionality that is not implement… --- ## [Unable to configure precision\_threshold for Unique Count in Kibana Lens (v9.3.3)](https://discuss.elastic.co/t/unable-to-configure-precision-threshold-for-unique-count-in-kibana-lens-v9-3-3/386505)
**Author:** [@Vignesh2](https://discuss.elastic.co/u/Vignesh2)\ **Replies:** 3\ **Last updated:** [May 27, 2026, 10:10am UTC](https://discuss.elastic.co/t/unable-to-configure-precision-threshold-for-unique-count-in-kibana-lens-v9-3-3/386505 "2026-05-27T10:10:34Z")
Hi team, I'm facing an accuracy issue with the Unique Count aggregation in Kibana Lens and could not find a way to configure precision\_threshold through the UI. Environment Kibana version: 9.3.3 Visualization: Lens (… --- ## [Kibana shows 500-Internal Server Error after upgrade from 9.3.1 to 9.4.1 when security is turend off](https://discuss.elastic.co/t/kibana-shows-500-internal-server-error-after-upgrade-from-9-3-1-to-9-4-1-when-security-is-turend-off/386504)
**Author:** [@Dheeraj\_Gupta](https://discuss.elastic.co/u/Dheeraj_Gupta)\ **Replies:** 1\ **Last updated:** [May 26, 2026, 2:53pm UTC](https://discuss.elastic.co/t/kibana-shows-500-internal-server-error-after-upgrade-from-9-3-1-to-9-4-1-when-security-is-turend-off/386504 "2026-05-26T14:53:46Z")
We have deployed Elasticsearch and Kibana on an internal network. The elasticsearch cluster has security and ML disabled xpack.security.enabled: false xpack.security.transport.ssl.enabled: false xpack.security.http.ssl.… --- ## [Moving index using custom attribute](https://discuss.elastic.co/t/moving-index-using-custom-attribute/386492)
**Author:** [@doniyey](https://discuss.elastic.co/u/doniyey)\ **Replies:** 3\ **Last updated:** [May 26, 2026, 7:59am UTC](https://discuss.elastic.co/t/moving-index-using-custom-attribute/386492 "2026-05-26T07:59:27Z")
Hello everyone, I am working on a project with elasticsearch 9.4.1, where the goal is to move a specific data stream (ds) to a dedicated cold node for that data stream. Here are the nodes I have prepared: ip … --- ## [Intermittent log loss observed in a UDP-based Logstash architecture behind a load balancer, with ongoing investigation into possible packet drops, idle-timeout behavior, and UDP input tuning recommendations.](https://discuss.elastic.co/t/intermittent-log-loss-observed-in-a-udp-based-logstash-architecture-behind-a-load-balancer-with-ongoing-investigation-into-possible-packet-drops-idle-timeout-behavior-and-udp-input-tuning-recommendations/386494)
**Author:** [@Usha\_Nookala](https://discuss.elastic.co/u/Usha_Nookala)\ **Replies:** 1\ **Last updated:** [May 25, 2026, 5:02pm UTC](https://discuss.elastic.co/t/intermittent-log-loss-observed-in-a-udp-based-logstash-architecture-behind-a-load-balancer-with-ongoing-investigation-into-possible-packet-drops-idle-timeout-behavior-and-udp-input-tuning-recommendations/386494 "2026-05-25T17:02:03Z")
Hi everyone, We are currently troubleshooting intermittent log loss in a Logstash setup using the UDP input plugin and wanted to check if anyone in the community has faced similar behavior. Current setup (genericized): … --- ## [Problem Updating kibana 8.19 -\> 9.4.1](https://discuss.elastic.co/t/problem-updating-kibana-8-19-9-4-1/386468)
**Author:** [@Shahar\_Argov](https://discuss.elastic.co/u/Shahar_Argov)\ **Replies:** 1\ **Last updated:** [May 24, 2026, 12:24pm UTC](https://discuss.elastic.co/t/problem-updating-kibana-8-19-9-4-1/386468 "2026-05-24T12:24:30Z")
We have been updating our cluster from 8.19 to 9.4.1, we finished all the nodes except the kibana. when updating we saw the service stuck on \[plugins.screenshotting.chromium\] Browser executable: /usr/share/kibana/node\_mo… --- ## [How to group application logs by error uniqueness and count occurrences in Elasticsearch/Kibana?](https://discuss.elastic.co/t/how-to-group-application-logs-by-error-uniqueness-and-count-occurrences-in-elasticsearch-kibana/386445)
**Author:** [@Raushan](https://discuss.elastic.co/u/Raushan)\ **Replies:** 1\ **Last updated:** [May 22, 2026, 5:31pm UTC](https://discuss.elastic.co/t/how-to-group-application-logs-by-error-uniqueness-and-count-occurrences-in-elasticsearch-kibana/386445 "2026-05-22T17:31:28Z")
Hi everyone, We are currently shipping our application logs directly to Elasticsearch, and we are trying to find a way to analyze our error patterns more effectively. Specifically, we need to: Identify the uniqueness … --- ## [Free Elasticsearch MCP Server with a Semantic-to-Lexical layer for Business rules](https://discuss.elastic.co/t/free-elasticsearch-mcp-server-with-a-semantic-to-lexical-layer-for-business-rules/386456)
**Author:** [@rbeg](https://discuss.elastic.co/u/rbeg)\ **Replies:** 0\ **Last updated:** [May 22, 2026, 12:45pm UTC](https://discuss.elastic.co/t/free-elasticsearch-mcp-server-with-a-semantic-to-lexical-layer-for-business-rules/386456 "2026-05-22T12:45:44Z")
Hello guys, this is A generic Model Context Protocol (MCP) server that connects LLMs to Elasticsearch, with a Semantic-to-Lexical (S2L) layer that translates technical field names into business knowledge — without har… --- ## [Elasticsearch Kibana 9.4.0 Basic authentication returns 401 Unauthorized](https://discuss.elastic.co/t/elasticsearch-kibana-9-4-0-basic-authentication-returns-401-unauthorized/386318)
**Author:** [@GeertVerbeurgt](https://discuss.elastic.co/u/GeertVerbeurgt)\ **Replies:** 37\ **Last updated:** [May 22, 2026, 11:05am UTC](https://discuss.elastic.co/t/elasticsearch-kibana-9-4-0-basic-authentication-returns-401-unauthorized/386318 "2026-05-22T11:05:15Z")
After upgrading from elasticsearch/kibana version 9.3.0 to elasticsearch/kibana 9.4.0 I'm no longer able to login with basic authentication via the Authorization Header. This returns the error 401 Unauthorized. { "ser… --- ## [Ingest pipeline doesnt work](https://discuss.elastic.co/t/ingest-pipeline-doesnt-work/386407)
**Author:** [@Shahar\_Argov](https://discuss.elastic.co/u/Shahar_Argov)\ **Replies:** 4\ **Last updated:** [May 21, 2026, 2:12pm UTC](https://discuss.elastic.co/t/ingest-pipeline-doesnt-work/386407 "2026-05-21T14:12:36Z")
hi, I want to send logs through ingest pipeline to rename them to a different name, now the pipeline does look like its running but the names arent changing. if i try it with a random file from the index it said it wor… --- ## [Windows - LS 9.4.0 - Unable to update plugins](https://discuss.elastic.co/t/windows-ls-9-4-0-unable-to-update-plugins/386405)
**Author:** [@novaksam](https://discuss.elastic.co/u/novaksam)\ **Replies:** 2\ **Last updated:** [May 21, 2026, 1:41pm UTC](https://discuss.elastic.co/t/windows-ls-9-4-0-unable-to-update-plugins/386405 "2026-05-21T13:41:04Z")
Is anyone else having issues updating plugins on windows with fresh downloads of logstash? I'm getting the following error: Error Bundler::InstallError, retrying 1/10 Bundler::GenericSystemCallError: There was an error… --- ## [Does the restore function support incremental recovery?](https://discuss.elastic.co/t/does-the-restore-function-support-incremental-recovery/386434)
**Author:** [@mloine](https://discuss.elastic.co/u/mloine)\ **Replies:** 5\ **Last updated:** [May 21, 2026, 10:38am UTC](https://discuss.elastic.co/t/does-the-restore-function-support-incremental-recovery/386434 "2026-05-21T10:38:54Z")
Hello, we currently have a scenario where the new and old clusters are switched, and data will be restored to the new cluster using snapshots; I would like to ask if the restore method also supports incremental recovery… --- ## [Where the detection rules store? in which index?](https://discuss.elastic.co/t/where-the-detection-rules-store-in-which-index/386144)
**Author:** [@neshat1485](https://discuss.elastic.co/u/neshat1485)\ **Replies:** 4\ **Last updated:** [May 21, 2026, 9:01am UTC](https://discuss.elastic.co/t/where-the-detection-rules-store-in-which-index/386144 "2026-05-21T09:01:25Z")
i see that we have an index with the name .kibana\_security\_solution\* that the prebuilt and default detection rules are in this index but i couldn't find the index that store the data of the custom detection rules that w… --- ## [Airgap standalone Elastic Agent Upgrade](https://discuss.elastic.co/t/airgap-standalone-elastic-agent-upgrade/386355)
**Author:** [@Ryan\_Clark](https://discuss.elastic.co/u/Ryan_Clark)\ **Replies:** 2\ **Last updated:** [May 21, 2026, 6:50am UTC](https://discuss.elastic.co/t/airgap-standalone-elastic-agent-upgrade/386355 "2026-05-21T06:50:31Z")
I'm running a standalone agent on an airgap Windows system using the zip deployment. I'm trying to upgrade from 8.19.0 to 8.19.15 as a test. It appears that there is a way to use the elastic-agent.exe upgrade command wi… --- ## [Designing an Elasticsearch index for multiple domain models without field explosion](https://discuss.elastic.co/t/designing-an-elasticsearch-index-for-multiple-domain-models-without-field-explosion/386402)
**Author:** [@Mevevlin](https://discuss.elastic.co/u/Mevevlin)\ **Replies:** 2\ **Last updated:** [May 20, 2026, 4:16pm UTC](https://discuss.elastic.co/t/designing-an-elasticsearch-index-for-multiple-domain-models-without-field-explosion/386402 "2026-05-20T16:16:49Z")
I’m designing a search system where multiple SQL tables are synced into a single Elasticsearch index. The issue I’m running into is that the tables are not perfectly aligned in terms of contextual meaning. For example: … --- ## [Need Help: Date-wise Index Creation with Application Using Built-in Elasticsearch and Static Index Name](https://discuss.elastic.co/t/need-help-date-wise-index-creation-with-application-using-built-in-elasticsearch-and-static-index-name/386007)
**Author:** [@Shubham\_Khodpe](https://discuss.elastic.co/u/Shubham_Khodpe)\ **Replies:** 6\ **Last updated:** [May 20, 2026, 1:24pm UTC](https://discuss.elastic.co/t/need-help-date-wise-index-creation-with-application-using-built-in-elasticsearch-and-static-index-name/386007 "2026-05-20T13:24:00Z")
\## Environment Details ### Elasticsearch (self-managed cluster on AWS) 4 Data Nodes (1 TB each) 2 Master Nodes Daily data ingestion around 300 GB (without replica) and approximately 600 GB with 1 replica Data source is… --- ## [ECK AWS Pod Identity instead of iam user/secret key pair](https://discuss.elastic.co/t/eck-aws-pod-identity-instead-of-iam-user-secret-key-pair/386418)
**Author:** [@khteh](https://discuss.elastic.co/u/khteh)\ **Replies:** 0\ **Last updated:** [May 20, 2026, 5:21am UTC](https://discuss.elastic.co/t/eck-aws-pod-identity-instead-of-iam-user-secret-key-pair/386418 "2026-05-20T05:21:57Z")
I used to add the AWS credentials into elasticsearch (ECK) keystore to backup to AWS S3. And then I was told that this is not a recommended good practice but should use pod identity or environment variables injected by i… --- ## [JSON Schema for DSL Query Language](https://discuss.elastic.co/t/json-schema-for-dsl-query-language/386415)
**Author:** [@aidin](https://discuss.elastic.co/u/aidin)\ **Replies:** 1\ **Last updated:** [May 20, 2026, 1:54am UTC](https://discuss.elastic.co/t/json-schema-for-dsl-query-language/386415 "2026-05-20T01:54:19Z")
Hi, Is there a JSON Schema definition for the DSL Query language? I found some old topics here without an answer. I was wondering if a schema has been created since then. There are definitions for the entire API, but … --- ## [Stable analysis plugin with native library fails entitlements in Elasticsearch 8.19.12](https://discuss.elastic.co/t/stable-analysis-plugin-with-native-library-fails-entitlements-in-elasticsearch-8-19-12/386411)
**Author:** [@dbenito](https://discuss.elastic.co/u/dbenito)\ **Replies:** 0\ **Last updated:** [May 19, 2026, 3:34pm UTC](https://discuss.elastic.co/t/stable-analysis-plugin-with-native-library-fails-entitlements-in-elasticsearch-8-19-12/386411 "2026-05-19T15:34:36Z")
Stable analysis plugin with native library fails entitlements in Elasticsearch 8.19.12 We are building a stable-analysis plugin that registers a custom TokenFilter via the stable plugin API. The plugin needs to load a bu… --- ## [MQTT Integration using Elastc Agent](https://discuss.elastic.co/t/mqtt-integration-using-elastc-agent/358653)
**Author:** [@allatrue](https://discuss.elastic.co/u/allatrue)\ **Replies:** 1\ **Last updated:** [May 19, 2026, 11:18am UTC](https://discuss.elastic.co/t/mqtt-integration-using-elastc-agent/358653 "2026-05-19T11:18:02Z")
Hi all, I'm wondering, if there is an integration for Elastic Agent to collect data from MQTT-Broker? It's possible with filebeat, but how can I configure it in Elastic Agent managed by Fleet? Thanks, Regards --- ## [How to fetch data through multiple indexes](https://discuss.elastic.co/t/how-to-fetch-data-through-multiple-indexes/386380)
**Author:** [@Suiiinaldo](https://discuss.elastic.co/u/Suiiinaldo)\ **Replies:** 3\ **Last updated:** [May 19, 2026, 9:35am UTC](https://discuss.elastic.co/t/how-to-fetch-data-through-multiple-indexes/386380 "2026-05-19T09:35:26Z")
Problem: I need to fetch data through multiple indexes. Use Case: Currently I have an index "something-\*", and it stores data monthly (for example something-2026-05, something-2026-04). Now I need to fetch data for la… --- ## [Clarification on CVE / Vulnerability ID related to bundled commons-text-1.4.jar in Elasticsearch 8.19.x](https://discuss.elastic.co/t/clarification-on-cve-vulnerability-id-related-to-bundled-commons-text-1-4-jar-in-elasticsearch-8-19-x/386398)
**Author:** [@lukecw](https://discuss.elastic.co/u/lukecw)\ **Replies:** 2\ **Last updated:** [May 19, 2026, 9:19am UTC](https://discuss.elastic.co/t/clarification-on-cve-vulnerability-id-related-to-bundled-commons-text-1-4-jar-in-elasticsearch-8-19-x/386398 "2026-05-19T09:19:19Z")
Hello, we need clarification regarding a vulnerability finding raised by our security scanner on Elasticsearch. The scanner is reporting the following issue: CVE: CVE-2025-46295 Vulnerability ID: OO0TMV On our… --- ## [Elastic APM Agent - CVE-2026-34480](https://discuss.elastic.co/t/elastic-apm-agent-cve-2026-34480/386100)
**Author:** [@leoluzh](https://discuss.elastic.co/u/leoluzh)\ **Replies:** 3\ **Last updated:** [May 18, 2026, 8:09pm UTC](https://discuss.elastic.co/t/elastic-apm-agent-cve-2026-34480/386100 "2026-05-18T20:09:52Z")
When running a NeuVector scan, CVE-2026-34480 was found in the elastic-apm-agent artifact (version 1.55.6) for the log4j-core dependency. Vulnerabilities: 5, HIGH: 1, MEDIUM: 3, LOW: 1, UNKNOWN: 0 File: app/libs/apm-ag… --- ## [Updating xpack certificates to a new CA in an active Elasticsearch cluster without downtime](https://discuss.elastic.co/t/updating-xpack-certificates-to-a-new-ca-in-an-active-elasticsearch-cluster-without-downtime/385871)
**Author:** [@Anup\_Kumar](https://discuss.elastic.co/u/Anup_Kumar)\ **Replies:** 22\ **Last updated:** [May 15, 2026, 12:39pm UTC](https://discuss.elastic.co/t/updating-xpack-certificates-to-a-new-ca-in-an-active-elasticsearch-cluster-without-downtime/385871 "2026-05-15T12:39:34Z")
Hi, We have an active Elasticsearch cluster (large) with TLS/SSL enabled for inter-node communication (xpack.security.transport.ssl). We are planning to replace the existing node certificates with new ones issued by a d… --- ## [Migrating off ElasticSearch as sole primary database for a relational business domain — anyone done this?](https://discuss.elastic.co/t/migrating-off-elasticsearch-as-sole-primary-database-for-a-relational-business-domain-anyone-done-this/386137)
**Author:** [@lets\_get\_relational](https://discuss.elastic.co/u/lets_get_relational)\ **Replies:** 13\ **Last updated:** [May 15, 2026, 12:34pm UTC](https://discuss.elastic.co/t/migrating-off-elasticsearch-as-sole-primary-database-for-a-relational-business-domain-anyone-done-this/386137 "2026-05-15T12:34:16Z")
\# Migrating off Elasticsearch as sole primary database for a relational business domain — anyone done this? I've inherited a ~6 year old production Django application where Elasticsearch is the only data store. Not "ES … --- ## [Kibana FATAL log](https://discuss.elastic.co/t/kibana-fatal-log/386352)
**Author:** [@blacknight1019](https://discuss.elastic.co/u/blacknight1019)\ **Replies:** 0\ **Last updated:** [May 15, 2026, 2:09am UTC](https://discuss.elastic.co/t/kibana-fatal-log/386352 "2026-05-15T02:09:22Z")
I am currently upgrading my ELK stack from version 8.19.14 to version 9.3.3. After setting up Windows Task Scheduler to start the services automatically, I found that Kibana reports the following error in kibana.log. Ho… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=8) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=10)