# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=90 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 91 --- ## [Add\_cloud\_metadata fails to retrieve instance ID on Oracle Cloud Infrastructure (OCI) in versions after 8.12.0](https://discuss.elastic.co/t/add-cloud-metadata-fails-to-retrieve-instance-id-on-oracle-cloud-infrastructure-oci-in-versions-after-8-12-0/375731)
**Author:** [@daniel\_ferraz](https://discuss.elastic.co/u/daniel_ferraz)\ **Replies:** 1\ **Last updated:** [March 12, 2025, 7:06pm UTC](https://discuss.elastic.co/t/add-cloud-metadata-fails-to-retrieve-instance-id-on-oracle-cloud-infrastructure-oci-in-versions-after-8-12-0/375731 "2025-03-12T19:06:33Z")
I’m opening this discussion to address a regression in Metricbeat versions after 8.12.0, particularly 8.12.2 and later, where instance IDs for OCI are no longer retrieved. In version 8.12.0, these were correctly fetched … --- ## [Watcher + PDF in email with filter last 24hours](https://discuss.elastic.co/t/watcher-pdf-in-email-with-filter-last-24hours/375792)
**Author:** [@Real\_Talk](https://discuss.elastic.co/u/Real_Talk)\ **Replies:** 0\ **Last updated:** [March 12, 2025, 4:16pm UTC](https://discuss.elastic.co/t/watcher-pdf-in-email-with-filter-last-24hours/375792 "2025-03-12T16:16:47Z")
Hello, Sorry, I am new to the ELK universe. I created an observer with a filter, and I configured it to add a PDF in a notification email. My filter is set to the last 24 hours (at the current time), I would like to mo… --- ## [Running Rules at Specific Time](https://discuss.elastic.co/t/running-rules-at-specific-time/375659)
**Author:** [@erikg](https://discuss.elastic.co/u/erikg)\ **Replies:** 1\ **Last updated:** [March 12, 2025, 4:15pm UTC](https://discuss.elastic.co/t/running-rules-at-specific-time/375659 "2025-03-12T16:15:06Z")
Hello, I am migrating some Watchers into Rules. I use cron schedule in Watcher to execute the alert at specific time, 6:30 am. The issue is I am not sure if this is possible in Kibana Rules? Or am I missing something? --- ## [Spaces are missing in filestream when logging 'message' to console](https://discuss.elastic.co/t/spaces-are-missing-in-filestream-when-logging-message-to-console/375637)
**Author:** [@rawa-resul](https://discuss.elastic.co/u/rawa-resul)\ **Replies:** 2\ **Last updated:** [March 12, 2025, 3:53pm UTC](https://discuss.elastic.co/t/spaces-are-missing-in-filestream-when-logging-message-to-console/375637 "2025-03-12T15:53:23Z")
I am running filebeat 8.16.1 on an ansible-operator Docker image (operator-framework/ansible-operator:v1.35.0). I have set up the filebeat.yml as filestream to collect the ansible operator logs, however, I have noticed … --- ## [Kibana GUI Access Problems](https://discuss.elastic.co/t/kibana-gui-access-problems/375770)
**Author:** [@pofudukhamsi](https://discuss.elastic.co/u/pofudukhamsi)\ **Replies:** 2\ **Last updated:** [March 12, 2025, 2:03pm UTC](https://discuss.elastic.co/t/kibana-gui-access-problems/375770 "2025-03-12T14:03:36Z")
Hello, When I want to access the Kibana interface, I get something like the following, How should I proceed with the issue? Network Error (tcp\_error) A communication error occurred: "Operation timed out" The Web Serv… --- ## [Configure audit logging](https://discuss.elastic.co/t/configure-audit-logging/375772)
**Author:** [@danil.kalmikov1](https://discuss.elastic.co/u/danil.kalmikov1)\ **Replies:** 1\ **Last updated:** [March 12, 2025, 1:21pm UTC](https://discuss.elastic.co/t/configure-audit-logging/375772 "2025-03-12T13:21:17Z")
Hello, Community. I want to collect audit logs connected to user activity (like user create/delete, set/change password, create new role, delete role, change role, change user role, success/failed auth etc.) Is it poss… --- ## [Which index holds the fleet Healthy/Unhealthy status?](https://discuss.elastic.co/t/which-index-holds-the-fleet-healthy-unhealthy-status/374068)
**Author:** [@Kamal2](https://discuss.elastic.co/u/Kamal2)\ **Replies:** 1\ **Last updated:** [March 12, 2025, 12:42pm UTC](https://discuss.elastic.co/t/which-index-holds-the-fleet-healthy-unhealthy-status/374068 "2025-03-12T12:42:14Z")
Hi Team, I need to find which fleet agent is healthy or unhealthy but I am unable to find the index. --- ## [Add tag to queries for slowlog](https://discuss.elastic.co/t/add-tag-to-queries-for-slowlog/375777)
**Author:** [@rschirin](https://discuss.elastic.co/u/rschirin)\ **Replies:** 0\ **Last updated:** [March 12, 2025, 11:38am UTC](https://discuss.elastic.co/t/add-tag-to-queries-for-slowlog/375777 "2025-03-12T11:38:41Z")
Looking back to this thread I would like to know if there is any news about this topic. Is there a way to add a "tag" to queries which end up in the ES index\_search\_slowlogs? Generally, if I enable slowlog I have to lo… --- ## [Error during checkin with fleet-server](https://discuss.elastic.co/t/error-during-checkin-with-fleet-server/375776)
**Author:** [@geo5](https://discuss.elastic.co/u/geo5)\ **Replies:** 0\ **Last updated:** [March 12, 2025, 11:14am UTC](https://discuss.elastic.co/t/error-during-checkin-with-fleet-server/375776 "2025-03-12T11:14:47Z")
I am trying to enroll an Elastic Agent with Elasticsearch, but my agent is in a Kubernetes cluster. I am using the same YAML that Kibana generated for me, but my container shows this error: {"log.level":"warn","@timesta… --- ## [Dummy Monitor in Heartbeat.yml](https://discuss.elastic.co/t/dummy-monitor-in-heartbeat-yml/375763)
**Author:** [@BenKenobi](https://discuss.elastic.co/u/BenKenobi)\ **Replies:** 0\ **Last updated:** [March 12, 2025, 8:33am UTC](https://discuss.elastic.co/t/dummy-monitor-in-heartbeat-yml/375763 "2025-03-12T08:33:18Z")
Is it possible to create a monitor in heartbeat.yml that always sends 100% availability? Would it look like this? type: script enabled: true id: AlwaysAvailable name: xxxx script: | echo "availability=100" schedu… --- ## [Issues with @timestamp vs timestamp](https://discuss.elastic.co/t/issues-with-timestamp-vs-timestamp/375433)
**Author:** [@pix9](https://discuss.elastic.co/u/pix9)\ **Replies:** 12\ **Last updated:** [March 12, 2025, 8:36am UTC](https://discuss.elastic.co/t/issues-with-timestamp-vs-timestamp/375433 "2025-03-12T08:36:13Z")
Hey folks, Currently we are using following ELK Stack as per given below for managing access logs from our web-servers. Packages : elasticsearch-8.6.1-1 logstash-8.6.1-1 kibana-8.6.1-1 filebeat-8.6.1-1 Index size fo… --- ## [Stack Monitoring: Node Details empty](https://discuss.elastic.co/t/stack-monitoring-node-details-empty/375699)
**Author:** [@it-intelliroad](https://discuss.elastic.co/u/it-intelliroad)\ **Replies:** 0\ **Last updated:** [March 11, 2025, 11:07am UTC](https://discuss.elastic.co/t/stack-monitoring-node-details-empty/375699 "2025-03-11T11:07:58Z")
using: Kibana 8.14.2, Elasticsearch 8.14.2 kibana is running as docker-ct. i did set up stack monitoring via Kibana and the " Monitor Elasticsearch node with Metricbeat" page. publishing and monitoring is done via buil… --- ## [Clarification on winlog.event\_data.paramXX Field in Windows System Application Logs](https://discuss.elastic.co/t/clarification-on-winlog-event-data-paramxx-field-in-windows-system-application-logs/375759)
**Author:** [@amarasinghe.kaluarac](https://discuss.elastic.co/u/amarasinghe.kaluarac)\ **Replies:** 0\ **Last updated:** [March 12, 2025, 7:08am UTC](https://discuss.elastic.co/t/clarification-on-winlog-event-data-paramxx-field-in-windows-system-application-logs/375759 "2025-03-12T07:08:01Z")
Hi All, While browsing the Windows system.application logs, I came across the field winlog.event\_data.paramXX. After reviewing the Elasticsearch documentation, I noticed that this field is mentioned as a keyword type, b… --- ## [Logstash file output can't fetch data from filebeat as input, input source is journald logs](https://discuss.elastic.co/t/logstash-file-output-cant-fetch-data-from-filebeat-as-input-input-source-is-journald-logs/375751)
**Author:** [@huanghaiqing1](https://discuss.elastic.co/u/huanghaiqing1)\ **Replies:** 0\ **Last updated:** [March 12, 2025, 12:59am UTC](https://discuss.elastic.co/t/logstash-file-output-cant-fetch-data-from-filebeat-as-input-input-source-is-journald-logs/375751 "2025-03-12T00:59:56Z")
Here, here we choose filebeat as input in logstash, because the source is "journald" binary logs. And choose file as output in logstash. Logstash service and configure seem ok. Filebeat input port is working also. But j… --- ## [The logs on kibana are truncated in the message field](https://discuss.elastic.co/t/the-logs-on-kibana-are-truncated-in-the-message-field/374856)
**Author:** [@alessiovitolo25](https://discuss.elastic.co/u/alessiovitolo25)\ **Replies:** 7\ **Last updated:** [March 11, 2025, 11:13pm UTC](https://discuss.elastic.co/t/the-logs-on-kibana-are-truncated-in-the-message-field/374856 "2025-03-11T23:13:23Z")
The logs on kibana are truncated in the message field ( maximum 1000 characters). If I open the json the message is complete (about 150,000 characters) It seems to be a kibana limitation problem because even from devtoo… --- ## [Time filter on Markdown text using ES SQL query syntax](https://discuss.elastic.co/t/time-filter-on-markdown-text-using-es-sql-query-syntax/375745)
**Author:** [@ArielC](https://discuss.elastic.co/u/ArielC)\ **Replies:** 0\ **Last updated:** [March 11, 2025, 9:55pm UTC](https://discuss.elastic.co/t/time-filter-on-markdown-text-using-es-sql-query-syntax/375745 "2025-03-11T21:55:15Z")
I am using markdown text to display a value inside of a textbox. The text displays the following: "On average X% of users open all worksets" However it is not responding to my time filter. filters "timefilter" | essq… --- ## [Ingest Azure Siginin logs array of json object using http\_poller](https://discuss.elastic.co/t/ingest-azure-siginin-logs-array-of-json-object-using-http-poller/375720)
**Author:** [@O\_O\_O](https://discuss.elastic.co/u/O_O_O)\ **Replies:** 10\ **Last updated:** [March 11, 2025, 8:30pm UTC](https://discuss.elastic.co/t/ingest-azure-siginin-logs-array-of-json-object-using-http-poller/375720 "2025-03-11T20:30:48Z")
I am trying to use the logstash http\_poller input plugin to ingest Azure Signin Logs (without an eventhub), then pass each document to logs-azure.signinlogs-1.22.0 ingest pipeline for proper parsing. My current logstash… --- ## [Experiencing Error trying to Launch Logstash](https://discuss.elastic.co/t/experiencing-error-trying-to-launch-logstash/375227)
**Author:** [@abbyode](https://discuss.elastic.co/u/abbyode)\ **Replies:** 26\ **Last updated:** [March 11, 2025, 7:20pm UTC](https://discuss.elastic.co/t/experiencing-error-trying-to-launch-logstash/375227 "2025-03-11T19:20:18Z")
I am experiencing some errors trying to launch logstash. I am using logstash plug-in to send json data to Sentinel Log Analytics Workspace. Below is the error i'm getting. \[ERROR\] 2025-02-28 15:45:10.466 \[Agent thread\] … --- ## [ML Trained Models stucked in downloading status](https://discuss.elastic.co/t/ml-trained-models-stucked-in-downloading-status/375350)
**Author:** [@jeffwasright](https://discuss.elastic.co/u/jeffwasright)\ **Replies:** 6\ **Last updated:** [March 11, 2025, 7:06pm UTC](https://discuss.elastic.co/t/ml-trained-models-stucked-in-downloading-status/375350 "2025-03-11T19:06:58Z")
I'm having issues downloading trained models from Kibana.. I have setup the cluster using file based access and have both elser\_model\_2 and elser\_model\_2\_linux-x86\_64 and is currently downloading from Kibana, but it is s… --- ## [Readiness probe failed: Error: Got HTTP code 503 but expected a 200](https://discuss.elastic.co/t/readiness-probe-failed-error-got-http-code-503-but-expected-a-200/375681)
**Author:** [@Sushmitha\_Shetty](https://discuss.elastic.co/u/Sushmitha_Shetty)\ **Replies:** 3\ **Last updated:** [March 11, 2025, 6:12pm UTC](https://discuss.elastic.co/t/readiness-probe-failed-error-got-http-code-503-but-expected-a-200/375681 "2025-03-11T18:12:05Z")
Hello . I am running Elasticsearch and kibana in my minikube , and when i describe the pod of kibana i am getting below error . whereas , Elasticsearch and kibana pods shows running , but kibana pod shows 0/1 . Below i… --- ## [Remove the values/fields from Logstash](https://discuss.elastic.co/t/remove-the-values-fields-from-logstash/375711)
**Author:** [@Gowtham1](https://discuss.elastic.co/u/Gowtham1)\ **Replies:** 3\ **Last updated:** [March 11, 2025, 6:28pm UTC](https://discuss.elastic.co/t/remove-the-values-fields-from-logstash/375711 "2025-03-11T18:28:26Z")
Hi, I want to remove this values %{\[@METADATA\]\[HOST\]\[1\]} from the field named "FLOOR" . Please see the below Logstash pipeline config. We have split the fields and then the field name %{\[@METADATA\]\[HOST\]\[1\]} coming as… --- ## [Filter the values based on particular string in Logstash](https://discuss.elastic.co/t/filter-the-values-based-on-particular-string-in-logstash/375717)
**Author:** [@Gowtham1](https://discuss.elastic.co/u/Gowtham1)\ **Replies:** 4\ **Last updated:** [March 11, 2025, 6:27pm UTC](https://discuss.elastic.co/t/filter-the-values-based-on-particular-string-in-logstash/375717 "2025-03-11T18:27:52Z")
Hi, We have a field named "AP\_NAME" this field value contains a common names like WIRAP and WIRWM but some additional names also coming to this field so I want put a condition in logstash to get only this particular WIR… --- ## [How to map memory size](https://discuss.elastic.co/t/how-to-map-memory-size/364296)
**Author:** [@mg77345](https://discuss.elastic.co/u/mg77345)\ **Replies:** 6\ **Last updated:** [March 11, 2025, 6:01pm UTC](https://discuss.elastic.co/t/how-to-map-memory-size/364296 "2025-03-11T18:01:17Z")
I have fields that are currently being ingested as resources\_used.vmem: 1028974kb resources\_requested.vmem: 2000000kb They are mapped as keyword, but i would like to have the "kb" (or file size denom.) stripped and to… --- ## [Getting system metrics from metricbeat in docker container](https://discuss.elastic.co/t/getting-system-metrics-from-metricbeat-in-docker-container/375728)
**Author:** [@FKarraz](https://discuss.elastic.co/u/FKarraz)\ **Replies:** 0\ **Last updated:** [March 11, 2025, 5:22pm UTC](https://discuss.elastic.co/t/getting-system-metrics-from-metricbeat-in-docker-container/375728 "2025-03-11T17:22:48Z")
I'm trying to implement a metricbeat service running from a container in order to ingest host metrics into my elasticsearch cluster. On each server, I have a metricbeat running as a service directly on the host and the … --- ## [Cluster-health check with elasticsearch-java against 7.x cluster](https://discuss.elastic.co/t/cluster-health-check-with-elasticsearch-java-against-7-x-cluster/375724)
**Author:** [@Hans\_Kruse](https://discuss.elastic.co/u/Hans_Kruse)\ **Replies:** 1\ **Last updated:** [March 11, 2025, 5:15pm UTC](https://discuss.elastic.co/t/cluster-health-check-with-elasticsearch-java-against-7-x-cluster/375724 "2025-03-11T17:15:01Z")
Getting cluster health from an es-7 cluster using the elasticsearch-java (es8) language client does not work out of the box. How do I configure the client in a compatible way? We are finishing our migration from es7 c… --- ## [Elastic Endpoint service failed (missed 3 check-ins)](https://discuss.elastic.co/t/elastic-endpoint-service-failed-missed-3-check-ins/375726)
**Author:** [@daniel.velinov](https://discuss.elastic.co/u/daniel.velinov)\ **Replies:** 1\ **Last updated:** [March 11, 2025, 4:37pm UTC](https://discuss.elastic.co/t/elastic-endpoint-service-failed-missed-3-check-ins/375726 "2025-03-11T16:37:00Z")
Hello I have been having issues with Elastic Agents on my Proxmox hosts (Debian12) and in particular the Endpoint integration that fails to become Healthy. All other integrations, like packet capture and system logs are… --- ## [Inplace Mapping Update for Index](https://discuss.elastic.co/t/inplace-mapping-update-for-index/375712)
**Author:** [@Aditya\_Teltia](https://discuss.elastic.co/u/Aditya_Teltia)\ **Replies:** 2\ **Last updated:** [March 11, 2025, 3:46pm UTC](https://discuss.elastic.co/t/inplace-mapping-update-for-index/375712 "2025-03-11T15:46:33Z")
Hi Team, Wanted to understand, if there is any specific reason why Elasticsearch doesn't allow updating mapping of index in place for existing fields? Is this anti pattern? Or Is there any particular reason? Wasn't abl… --- ## [Elastic Fleet Server installed, but doesnt show up as fleet server](https://discuss.elastic.co/t/elastic-fleet-server-installed-but-doesnt-show-up-as-fleet-server/375705)
**Author:** [@rara01](https://discuss.elastic.co/u/rara01)\ **Replies:** 1\ **Last updated:** [March 11, 2025, 2:23pm UTC](https://discuss.elastic.co/t/elastic-fleet-server-installed-but-doesnt-show-up-as-fleet-server/375705 "2025-03-11T14:23:23Z")
Hi, I have installed fleet server in docker based on docker tutorial. I have agent showing up in Fleet, with fleet server policy and fleet server integrations. However, when i want to add agent, it shows that i dont hav… --- ## [Best approach to make app logs queryable in ELK](https://discuss.elastic.co/t/best-approach-to-make-app-logs-queryable-in-elk/375710)
**Author:** [@siakc](https://discuss.elastic.co/u/siakc)\ **Replies:** 0\ **Last updated:** [March 11, 2025, 2:14pm UTC](https://discuss.elastic.co/t/best-approach-to-make-app-logs-queryable-in-elk/375710 "2025-03-11T14:14:04Z")
I have a nodejs app that currently uses bunyan logger to dump big amounts of logs in JSON format on the disk (one file a day). These logs have various nested fields, some about service requests and responses, and some ab… --- ## [Grok ecs\_compatibility option](https://discuss.elastic.co/t/grok-ecs-compatibility-option/375702)
**Author:** [@frans-wtax](https://discuss.elastic.co/u/frans-wtax)\ **Replies:** 2\ **Last updated:** [March 11, 2025, 12:44pm UTC](https://discuss.elastic.co/t/grok-ecs-compatibility-option/375702 "2025-03-11T12:44:56Z")
Hey all, I noticed that my grok filter that uses the COMBINEDAPACHELOG pattern (logstash-patterns-core/patterns/ecs-v1/httpd at main · logstash-plugins/logstash-patterns-core · GitHub) doesn't actually return the \[user\]… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=89) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=91)