# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=91 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 92 --- ## [Cluster vs. Index Segment Size Settings Precedence for max\_merged\_segment](https://discuss.elastic.co/t/cluster-vs-index-segment-size-settings-precedence-for-max-merged-segment/375694)
**Author:** [@Saleh\_AbuAli](https://discuss.elastic.co/u/Saleh_AbuAli)\ **Replies:** 0\ **Last updated:** [March 11, 2025, 10:31am UTC](https://discuss.elastic.co/t/cluster-vs-index-segment-size-settings-precedence-for-max-merged-segment/375694 "2025-03-11T10:31:30Z")
I've noticed what appears to be cluster settings taking precedence over index-specific settings for segment size limits, and I'm seeking clarification on how these settings interact. My index settings explicitly specify… --- ## [Difference between Global Settings and Advanced Settings](https://discuss.elastic.co/t/difference-between-global-settings-and-advanced-settings/375690)
**Author:** [@hofrichterovak](https://discuss.elastic.co/u/hofrichterovak)\ **Replies:** 0\ **Last updated:** [March 11, 2025, 9:34am UTC](https://discuss.elastic.co/t/difference-between-global-settings-and-advanced-settings/375690 "2025-03-11T09:34:18Z")
Hello, Please what is difference between Advanced Settings and Global Settings in Kibana Saved Objects when I have multiple SPACES? I tried to find it out in Documentation, but I didn´t find it. Thank you, Have a … --- ## [Save Index in specific Directory](https://discuss.elastic.co/t/save-index-in-specific-directory/375384)
**Author:** [@NikoCosmico01](https://discuss.elastic.co/u/NikoCosmico01)\ **Replies:** 7\ **Last updated:** [March 11, 2025, 8:50am UTC](https://discuss.elastic.co/t/save-index-in-specific-directory/375384 "2025-03-11T08:50:17Z")
Hi, I've the ELK stack installed via docker having in particular 3 ES nodes and 1 LogStash node. My question is if there is a way to have the data ingested from a specific LogStash pipeline saved in a specific director… --- ## [Ambiguous reference configuring logging to ElasticCloud in Elastic.Serilog.Sinks](https://discuss.elastic.co/t/ambiguous-reference-configuring-logging-to-elasticcloud-in-elastic-serilog-sinks/368372)
**Author:** [@kabcampbell](https://discuss.elastic.co/u/kabcampbell)\ **Replies:** 2\ **Last updated:** [March 10, 2025, 7:12pm UTC](https://discuss.elastic.co/t/ambiguous-reference-configuring-logging-to-elasticcloud-in-elastic-serilog-sinks/368372 "2025-03-10T19:12:04Z")
I'm following the documentation for adding the logging configuration for writing to elastic using the Elastic.Serilog.Sinks and when I try to use the logging configuration extension method xxx.WriteTo.ElasticCloud(xxxx) … --- ## [Cross Cluster Search](https://discuss.elastic.co/t/cross-cluster-search/375665)
**Author:** [@jmello31](https://discuss.elastic.co/u/jmello31)\ **Replies:** 0\ **Last updated:** [March 10, 2025, 5:48pm UTC](https://discuss.elastic.co/t/cross-cluster-search/375665 "2025-03-10T17:48:00Z")
I am trying to configure cross cluster search within my ECK stack and I am having a hard time with the documentation. I am trying to configure with the API key related route and I am confused where to set the requisite … --- ## [Master\_not\_discovered\_exception after upgrade to Ubuntu Jammy and Docker 28.0.1](https://discuss.elastic.co/t/master-not-discovered-exception-after-upgrade-to-ubuntu-jammy-and-docker-28-0-1/375239)
**Author:** [@PMDubuc](https://discuss.elastic.co/u/PMDubuc)\ **Replies:** 17\ **Last updated:** [March 10, 2025, 5:17pm UTC](https://discuss.elastic.co/t/master-not-discovered-exception-after-upgrade-to-ubuntu-jammy-and-docker-28-0-1/375239 "2025-03-10T17:17:42Z")
We are trying to upgrade our Elastic Stack deployment to run on Ubuntu Jammy (22.04) (The docker is based on Ubuntu 20.04.6 this is 7.17.12 it also happens with the 7.17.28) and docker version 28.0.1. on the hosts. P… --- ## [MSSQL Connector not syncing](https://discuss.elastic.co/t/mssql-connector-not-syncing/375046)
**Author:** [@jjmcmullan](https://discuss.elastic.co/u/jjmcmullan)\ **Replies:** 5\ **Last updated:** [March 10, 2025, 5:02pm UTC](https://discuss.elastic.co/t/mssql-connector-not-syncing/375046 "2025-03-10T17:02:43Z")
Hi folks, I've got a docker install of elastic that I built using the blog posts "getting-started-with-the-elastic-stack-and-docker-compose-part\[1 and 2\]" and that all went very well. I have since decided to add the con… --- ## [Multi-node shrink prototype](https://discuss.elastic.co/t/multi-node-shrink-prototype/375652)
**Author:** [@tobyb121](https://discuss.elastic.co/u/tobyb121)\ **Replies:** 3\ **Last updated:** [March 10, 2025, 4:08pm UTC](https://discuss.elastic.co/t/multi-node-shrink-prototype/375652 "2025-03-10T16:08:56Z")
I've seen issues when running on larger clusters caused by index shrink. The root cause of these issues tends to be the requirement for all shards to be recovered on a single node, as this can cause significant hotspots … --- ## [Invalid requests count in custom dashboard](https://discuss.elastic.co/t/invalid-requests-count-in-custom-dashboard/375646)
**Author:** [@Amol\_Nagotkar](https://discuss.elastic.co/u/Amol_Nagotkar)\ **Replies:** 1\ **Last updated:** [March 10, 2025, 3:50pm UTC](https://discuss.elastic.co/t/invalid-requests-count-in-custom-dashboard/375646 "2025-03-10T15:50:46Z")
Hi all i have 4 services in APM, see tpm below-\> if i have try to create custom visualisation using -\> it gives me counts, almost 3x of above tpm (i kept time range last 1 min) how to solve this ? let me now i… --- ## [Metricbeat unable to connect to elasticsearch behind proxy](https://discuss.elastic.co/t/metricbeat-unable-to-connect-to-elasticsearch-behind-proxy/375204)
**Author:** [@Rade\_Pajic](https://discuss.elastic.co/u/Rade_Pajic)\ **Replies:** 7\ **Last updated:** [March 10, 2025, 3:03pm UTC](https://discuss.elastic.co/t/metricbeat-unable-to-connect-to-elasticsearch-behind-proxy/375204 "2025-03-10T15:03:23Z")
Hello, I'm trying to connect Metricbeat from one cluster to Elasticsearch on another cluster. Elasticsearch is exposed via an Ingress (gateway) on a private domain. I'm using ECK Operator version 2.12.1 for deployment.… --- ## [Facing Issue while parsing nested JSON](https://discuss.elastic.co/t/facing-issue-while-parsing-nested-json/375595)
**Author:** [@madhavi\_pdb](https://discuss.elastic.co/u/madhavi_pdb)\ **Replies:** 6\ **Last updated:** [March 10, 2025, 2:53pm UTC](https://discuss.elastic.co/t/facing-issue-while-parsing-nested-json/375595 "2025-03-10T14:53:08Z")
Hello Community, I have been facing parsing issue for past 24 hrs, I could not understand if log stash does not allow JSON parsing, adding new fields without GROK, KV ,Flattening SCENARIO: INPUT LOG: { "accountname… --- ## [Osquerybeat Permission Error - No Queries possible](https://discuss.elastic.co/t/osquerybeat-permission-error-no-queries-possible/371400)
**Author:** [@matled](https://discuss.elastic.co/u/matled)\ **Replies:** 4\ **Last updated:** [March 10, 2025, 12:27pm UTC](https://discuss.elastic.co/t/osquerybeat-permission-error-no-queries-possible/371400 "2025-03-10T12:27:57Z")
We are using Elastic-Stack 8.16.1 and also Elastic-Agents 8.16.1 integrated in Elastic Fleet. Currently, we are having problems with Osquery on Windows Systems where we traced the problem down to the following errors: … --- ## [Vulnerable Apache Lucene in ElasticSearch 7.17.28](https://discuss.elastic.co/t/vulnerable-apache-lucene-in-elasticsearch-7-17-28/375655)
**Author:** [@treektPL](https://discuss.elastic.co/u/treektPL)\ **Replies:** 4\ **Last updated:** [March 10, 2025, 2:10pm UTC](https://discuss.elastic.co/t/vulnerable-apache-lucene-in-elasticsearch-7-17-28/375655 "2025-03-10T14:10:57Z")
Hi, I see that the latest update of Elasticsearch 7.17.28 have still vulnerability CVE-2024-45772 which affects Apache Lucene from 4.4.0 before 9.12.0. That mean's ES should update Lucene to 9.12.0 at least. Do we know… --- ## [Persistence of lifecycle policies accross container rebuild](https://discuss.elastic.co/t/persistence-of-lifecycle-policies-accross-container-rebuild/375464)
**Author:** [@Cyanat](https://discuss.elastic.co/u/Cyanat)\ **Replies:** 3\ **Last updated:** [March 10, 2025, 11:25am UTC](https://discuss.elastic.co/t/persistence-of-lifecycle-policies-accross-container-rebuild/375464 "2025-03-10T11:25:39Z")
Hi, I have an Elasticsearch server running on a Docker infrastructure with the following containers: Kibana Logstash Elasticsearch Once my server was set up, I used the Kibana interface to define Lifecycle policies t… --- ## [Shard rebalancing may temporarily unbalance cluster](https://discuss.elastic.co/t/shard-rebalancing-may-temporarily-unbalance-cluster/374911)
**Author:** [@Iron](https://discuss.elastic.co/u/Iron)\ **Replies:** 1\ **Last updated:** [March 10, 2025, 11:00am UTC](https://discuss.elastic.co/t/shard-rebalancing-may-temporarily-unbalance-cluster/374911 "2025-03-10T11:00:36Z")
Please let me know if the following issue can appear in the version below 8 points. issue : "Shard rebalancing may temporarily unbalance cluster" ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Shard reb… --- ## [Index Pre-Load for Vector Store](https://discuss.elastic.co/t/index-pre-load-for-vector-store/375564)
**Author:** [@peedeeboy](https://discuss.elastic.co/u/peedeeboy)\ **Replies:** 5\ **Last updated:** [March 10, 2025, 10:47am UTC](https://discuss.elastic.co/t/index-pre-load-for-vector-store/375564 "2025-03-10T10:47:42Z")
Hey all :waving\_hand: We have dedicated ES clusters we use for our vector database and approx kNN searching (single hnsw\_int8 dense vector) as part of our hybrid-search solution. We've started to push one cluster prett… --- ## [Unable to map prod production s3 repo on test cluster](https://discuss.elastic.co/t/unable-to-map-prod-production-s3-repo-on-test-cluster/375638)
**Author:** [@Suresh\_Hemke](https://discuss.elastic.co/u/Suresh_Hemke)\ **Replies:** 0\ **Last updated:** [March 10, 2025, 9:51am UTC](https://discuss.elastic.co/t/unable-to-map-prod-production-s3-repo-on-test-cluster/375638 "2025-03-10T09:51:11Z")
Hello Team, We have an AWS S3 repository configured on our production Elasticsearch cluster for backup snapshots, and this repository is successfully mapped to our PERF environment to restore snapshots without any issue… --- ## [Kibana Reporting issue](https://discuss.elastic.co/t/kibana-reporting-issue/375306)
**Author:** [@Mahmoud0x](https://discuss.elastic.co/u/Mahmoud0x)\ **Replies:** 11\ **Last updated:** [March 10, 2025, 10:29am UTC](https://discuss.elastic.co/t/kibana-reporting-issue/375306 "2025-03-10T10:29:15Z")
Hi, I am facing this issue when I try to create a Kibana dashboard report. No report generated ReportingError(code: browser\_screenshot\_error) "Protocol error (Emulation.setTouchEmulationEnabled): Target closed" --- ## [Beats Input Batch Size Warning](https://discuss.elastic.co/t/beats-input-batch-size-warning/375640)
**Author:** [@dawiro](https://discuss.elastic.co/u/dawiro)\ **Replies:** 0\ **Last updated:** [March 10, 2025, 9:54am UTC](https://discuss.elastic.co/t/beats-input-batch-size-warning/375640 "2025-03-10T09:54:49Z")
Hi, We're seeing this warning in our logstash logs: \[2025-03-10T09:26:40,147\]\[WARN \]\[org.logstash.beats.V2Batch\]\[base-input\]\[beats-input\] Received batch of size 67137414 bytes that is too large to fit into the pre-allo… --- ## [Disable Internal shards](https://discuss.elastic.co/t/disable-internal-shards/374631)
**Author:** [@rihad](https://discuss.elastic.co/u/rihad)\ **Replies:** 0\ **Last updated:** [February 17, 2025, 2:12pm UTC](https://discuss.elastic.co/t/disable-internal-shards/374631 "2025-02-17T14:12:28Z")
Hi, after upgrading ES from 7.14 to 7.17.11 I started noticing these entries in \_cat/shards: index shard prirep state docs store .ds-.logs-deprecation.elasti… --- ## [Create data\_stream for container logs](https://discuss.elastic.co/t/create-data-stream-for-container-logs/374744)
**Author:** [@prakash85](https://discuss.elastic.co/u/prakash85)\ **Replies:** 0\ **Last updated:** [February 19, 2025, 9:28am UTC](https://discuss.elastic.co/t/create-data-stream-for-container-logs/374744 "2025-02-19T09:28:12Z")
Hi All, I'm new here and i have query creating data\_streams for container logs we have a common ELK without logstash for all - dev, stg,tst & prd and when we send logs from container to elasticsearch the dataset is pre… --- ## [How to generate reports or logs when deleting indices via ILM?](https://discuss.elastic.co/t/how-to-generate-reports-or-logs-when-deleting-indices-via-ilm/375633)
**Author:** [@Manal\_A](https://discuss.elastic.co/u/Manal_A)\ **Replies:** 0\ **Last updated:** [March 10, 2025, 8:44am UTC](https://discuss.elastic.co/t/how-to-generate-reports-or-logs-when-deleting-indices-via-ilm/375633 "2025-03-10T08:44:33Z")
Hi everyone, I am looking for a way to generate reports or logs when indices are deleted as part of an Index Lifecycle Management (ILM) policy in Elasticsearch. Specifically: \*Does Elasticsearch provide built-in report… --- ## [Difference between (on status changes, recovered) and (on check interval, recovered) when defining alert](https://discuss.elastic.co/t/difference-between-on-status-changes-recovered-and-on-check-interval-recovered-when-defining-alert/375631)
**Author:** [@jack\_a](https://discuss.elastic.co/u/jack_a)\ **Replies:** 0\ **Last updated:** [March 10, 2025, 8:37am UTC](https://discuss.elastic.co/t/difference-between-on-status-changes-recovered-and-on-check-interval-recovered-when-defining-alert/375631 "2025-03-10T08:37:47Z")
I was trying to define a rule of type Elasticsearch query in observability, in action query section i can not understand the difference between these two. option 1 for each alert: on status changes run when: reovered … --- ## [Best practice to add more indices](https://discuss.elastic.co/t/best-practice-to-add-more-indices/375627)
**Author:** [@Vivek\_Burman](https://discuss.elastic.co/u/Vivek_Burman)\ **Replies:** 5\ **Last updated:** [March 10, 2025, 7:19am UTC](https://discuss.elastic.co/t/best-practice-to-add-more-indices/375627 "2025-03-10T07:19:59Z")
"error":"validation\_exception","reason":"Validation Failed: 1: this action would add \[2\] shards, but this cluster currently has \[999\]/\[1000\] maximum normal shards open;" Hi, I've a requirement where I need to add more i… --- ## [Kibana jwt authentication](https://discuss.elastic.co/t/kibana-jwt-authentication/375623)
**Author:** [@Jad\_Nacouzi](https://discuss.elastic.co/u/Jad_Nacouzi)\ **Replies:** 0\ **Last updated:** [March 9, 2025, 9:29pm UTC](https://discuss.elastic.co/t/kibana-jwt-authentication/375623 "2025-03-09T21:29:10Z")
Hello, I have a reactjs app which i will integrate kibana inside it using iframe. For now when i open the page that contain kibana the user need to login, is there any chance to use my jwt token that i am generation fro… --- ## [Probleme winlogbeats](https://discuss.elastic.co/t/probleme-winlogbeats/375524)
**Author:** [@team\_simsim](https://discuss.elastic.co/u/team_simsim)\ **Replies:** 7\ **Last updated:** [March 9, 2025, 5:12pm UTC](https://discuss.elastic.co/t/probleme-winlogbeats/375524 "2025-03-09T17:12:21Z")
hello my winlogbeats clients don't want to come up when I start the service there is this error Exiting: failed to sanitize the YAML pipeline file: security/ingest/security.yml: key 'false' is not string but bool than… --- ## [Autodiscover in Beats doesn't seem to see my container when I update it](https://discuss.elastic.co/t/autodiscover-in-beats-doesnt-seem-to-see-my-container-when-i-update-it/375591)
**Author:** [@Cedric\_Rochefolle](https://discuss.elastic.co/u/Cedric_Rochefolle)\ **Replies:** 1\ **Last updated:** [March 8, 2025, 2:07pm UTC](https://discuss.elastic.co/t/autodiscover-in-beats-doesnt-seem-to-see-my-container-when-i-update-it/375591 "2025-03-08T14:07:14Z")
I have finally been able to configure Beats in the way that I need. That is to capture logs only from selected containers. I'm using processors.drop\_event to exclude the containers that I don't want. I'm also using auto… --- ## [Unable to parse message field in logstash using grok filter](https://discuss.elastic.co/t/unable-to-parse-message-field-in-logstash-using-grok-filter/375516)
**Author:** [@huzaifa224](https://discuss.elastic.co/u/huzaifa224)\ **Replies:** 0\ **Last updated:** [March 6, 2025, 12:19pm UTC](https://discuss.elastic.co/t/unable-to-parse-message-field-in-logstash-using-grok-filter/375516 "2025-03-06T12:19:22Z")
I have set up a Fleet Server in Kibana, and my Meraki Firewall is sending VPN data to Logstash. I’ve configured a Logstash filter to process the logs and store the filtered data at a custom path. Additionally, I have in… --- ## [Cannot add runtime field to an existing index](https://discuss.elastic.co/t/cannot-add-runtime-field-to-an-existing-index/375577)
**Author:** [@wpm](https://discuss.elastic.co/u/wpm)\ **Replies:** 1\ **Last updated:** [March 7, 2025, 11:15pm UTC](https://discuss.elastic.co/t/cannot-add-runtime-field-to-an-existing-index/375577 "2025-03-07T23:15:42Z")
I am trying to add a runtime field following the example from "Map a runtime field" in the documentation. PUT my-index-000001/ { "mappings": { "runtime": { "day\_of\_week": { "type": "keyword", … --- ## [Logstash file output crashes when writing to append only filesystem](https://discuss.elastic.co/t/logstash-file-output-crashes-when-writing-to-append-only-filesystem/375569)
**Author:** [@hilsonp](https://discuss.elastic.co/u/hilsonp)\ **Replies:** 0\ **Last updated:** [March 7, 2025, 5:16pm UTC](https://discuss.elastic.co/t/logstash-file-output-crashes-when-writing-to-append-only-filesystem/375569 "2025-03-07T17:16:51Z")
Hello, We have a logstash pipeline which output is configured to write to an append only nfs filesystem (WORM - NetApp SnapLock Volume Append Mode (VAM)). File are being written but all of a sudden, the pipeline will c… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=90) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=92)