# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=93 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 94 --- ## [Storing apm logs in file](https://discuss.elastic.co/t/storing-apm-logs-in-file/375446)
**Author:** [@Alex21](https://discuss.elastic.co/u/Alex21)\ **Replies:** 0\ **Last updated:** [March 5, 2025, 10:14am UTC](https://discuss.elastic.co/t/storing-apm-logs-in-file/375446 "2025-03-05T10:14:28Z")
I am using the Elastic APM Java agent with WildFly. Is it possible to store only APM event logs (such as request-response time) in a file instead of sending them to the APM server? I tried using -Delastic.apm.log\_file … --- ## [How to ensure unique sorting with search\_after in Elasticsearch 8?](https://discuss.elastic.co/t/how-to-ensure-unique-sorting-with-search-after-in-elasticsearch-8/375233)
**Author:** [@jiel](https://discuss.elastic.co/u/jiel)\ **Replies:** 2\ **Last updated:** [March 5, 2025, 9:52am UTC](https://discuss.elastic.co/t/how-to-ensure-unique-sorting-with-search-after-in-elasticsearch-8/375233 "2025-03-05T09:52:29Z")
Hello, I am working on a tool that needs to retrieve large batches of records from an Elasticsearch index. The recommended method used to be the Scroll API, but it is now deprecated in favor of search\_after as stated in… --- ## [connect ElasticSearch script to Kibana dashboard](https://discuss.elastic.co/t/connect-elasticsearch-script-to-kibana-dashboard/375244)
**Author:** [@IgorStan](https://discuss.elastic.co/u/IgorStan)\ **Replies:** 7\ **Last updated:** [March 5, 2025, 9:45am UTC](https://discuss.elastic.co/t/connect-elasticsearch-script-to-kibana-dashboard/375244 "2025-03-05T09:45:25Z")
I don't understand how to connect Elasticsearch Dev Tools scripts to Kibana dashboard. Say that we have a nice script: GET name\_of\_my\_index/\_search { "size": 0, "aggs": { "tags\_count": { "scripted\_metric"… --- ## [Elasticsearch service is not starting](https://discuss.elastic.co/t/elasticsearch-service-is-not-starting/375435)
**Author:** [@Temor\_Shah\_Waris](https://discuss.elastic.co/u/Temor_Shah_Waris)\ **Replies:** 4\ **Last updated:** [March 5, 2025, 9:27am UTC](https://discuss.elastic.co/t/elasticsearch-service-is-not-starting/375435 "2025-03-05T09:27:09Z")
Dear Friends, I configured SSL certificate on elasticsearch yml file after restart the service it is not running ( I do checked the yml file, SSL certificate CA, Key and CRT file ) also I checked the permissions which a… --- ## [Share rules and Connectors to other spaces as well their related objects](https://discuss.elastic.co/t/share-rules-and-connectors-to-other-spaces-as-well-their-related-objects/375439)
**Author:** [@kishorkumar](https://discuss.elastic.co/u/kishorkumar)\ **Replies:** 0\ **Last updated:** [March 5, 2025, 9:22am UTC](https://discuss.elastic.co/t/share-rules-and-connectors-to-other-spaces-as-well-their-related-objects/375439 "2025-03-05T09:22:24Z")
Any way to Share Rules and Connector to other spaces as well (Rules , and related object to other spaces ) As we have mutilple spaces for our app teams and developers and others. we want to share the connectors and ale… --- ## [How to search for specific items in nested logs](https://discuss.elastic.co/t/how-to-search-for-specific-items-in-nested-logs/375437)
**Author:** [@random\_typescript](https://discuss.elastic.co/u/random_typescript)\ **Replies:** 0\ **Last updated:** [March 5, 2025, 9:08am UTC](https://discuss.elastic.co/t/how-to-search-for-specific-items-in-nested-logs/375437 "2025-03-05T09:08:24Z")
When I search for logs with nested JSON objects like below where "combined" is an object. Some of the search terms I am using for searching this are not working. For example when trying to search for logs with the "l… --- ## [Index rollover and ILM issue](https://discuss.elastic.co/t/index-rollover-and-ilm-issue/374824)
**Author:** [@parthmaniar](https://discuss.elastic.co/u/parthmaniar)\ **Replies:** 12\ **Last updated:** [March 4, 2025, 4:43pm UTC](https://discuss.elastic.co/t/index-rollover-and-ilm-issue/374824 "2025-03-04T16:43:47Z")
Hello I hope my message finds the community & their loved ones safe and healthy. I have a 3-node cluster. 2 nodes store data and carry out processing 1 node is a voting only node. All the data to Elasticsear… --- ## [Dashboard is not getting updated in frequent interval of time](https://discuss.elastic.co/t/dashboard-is-not-getting-updated-in-frequent-interval-of-time/375431)
**Author:** [@NIAElastic](https://discuss.elastic.co/u/NIAElastic)\ **Replies:** 0\ **Last updated:** [March 5, 2025, 7:48am UTC](https://discuss.elastic.co/t/dashboard-is-not-getting-updated-in-frequent-interval-of-time/375431 "2025-03-05T07:48:08Z")
Hello, We are receiving logs from NFS at a 3-minute interval every day. However, on one of the Kibana servers, the dashboard is not reflecting the data as expected. Instead of displaying data every 3 minutes, it is show… --- ## [Set metricbeat password from file in kubernetes, is it possible?](https://discuss.elastic.co/t/set-metricbeat-password-from-file-in-kubernetes-is-it-possible/375361)
**Author:** [@TomH](https://discuss.elastic.co/u/TomH)\ **Replies:** 2\ **Last updated:** [March 5, 2025, 7:31am UTC](https://discuss.elastic.co/t/set-metricbeat-password-from-file-in-kubernetes-is-it-possible/375361 "2025-03-05T07:31:46Z")
Setting elastic password via environment variable is not particularly secure so we want to set it via file. The file is provided by kubernetes CSI driver. The suggestion for metricbeat on kubernetes that I found so far… --- ## [Logstash has a lag in pushing events to Elastic](https://discuss.elastic.co/t/logstash-has-a-lag-in-pushing-events-to-elastic/374798)
**Author:** [@devops\_training](https://discuss.elastic.co/u/devops_training)\ **Replies:** 18\ **Last updated:** [March 5, 2025, 7:28am UTC](https://discuss.elastic.co/t/logstash-has-a-lag-in-pushing-events-to-elastic/374798 "2025-03-05T07:28:14Z")
logstash config input { file { path =\> "C:/Program Files (x86)/db/Server/logs/oracle.log" type =\> "localhost\_access\_log" start\_position =\> "beginning" ignore\_older =\> 86400 # ignore files older than 24 … --- ## [Elasticsearch cluster - container vs. native](https://discuss.elastic.co/t/elasticsearch-cluster-container-vs-native/375427)
**Author:** [@gruens](https://discuss.elastic.co/u/gruens)\ **Replies:** 1\ **Last updated:** [March 5, 2025, 6:56am UTC](https://discuss.elastic.co/t/elasticsearch-cluster-container-vs-native/375427 "2025-03-05T06:56:02Z")
Hello Community, we already run two non-critical three node clusters on vsphere virtual machines (RHEL) with podman. The criticality will increase in the future, so we want to relaunch/improve our current instances. I… --- ## [Cold tier in self managed cluster](https://discuss.elastic.co/t/cold-tier-in-self-managed-cluster/375426)
**Author:** [@searchwithme](https://discuss.elastic.co/u/searchwithme)\ **Replies:** 0\ **Last updated:** [March 5, 2025, 6:29am UTC](https://discuss.elastic.co/t/cold-tier-in-self-managed-cluster/375426 "2025-03-05T06:29:47Z")
can someone please help me understand this: Data tiers | Elasticsearch Guide \[8.17\] | Elastic It says: 1/ cold tier uses searchable snapshots 2/ it can also be used with a replica How do I implement this in self mana… --- ## [I checked my elasticsearch.service and its running well, but i cant healthcheck it](https://discuss.elastic.co/t/i-checked-my-elasticsearch-service-and-its-running-well-but-i-cant-healthcheck-it/375419)
**Author:** [@Duong\_Hieu](https://discuss.elastic.co/u/Duong_Hieu)\ **Replies:** 0\ **Last updated:** [March 5, 2025, 3:36am UTC](https://discuss.elastic.co/t/i-checked-my-elasticsearch-service-and-its-running-well-but-i-cant-healthcheck-it/375419 "2025-03-05T03:36:01Z")
my service is running and actived but when i run \ it showed \ and \ --- ## [After edited the elasticsearch.yml file, my service turn into inactive](https://discuss.elastic.co/t/after-edited-the-elasticsearch-yml-file-my-service-turn-into-inactive/375338)
**Author:** [@Duong\_Hieu](https://discuss.elastic.co/u/Duong_Hieu)\ **Replies:** 7\ **Last updated:** [March 5, 2025, 3:32am UTC](https://discuss.elastic.co/t/after-edited-the-elasticsearch-yml-file-my-service-turn-into-inactive/375338 "2025-03-05T03:32:52Z")
Hi, im new to elasticsearch, i already install elasticsearch and kibana, they're running well but things have change when i edited the elastichsearch.yml file After i edited, the elasticsearch service turn to inactive s… --- ## [Upgrading from 8.x to 9.x with \_source disabled](https://discuss.elastic.co/t/upgrading-from-8-x-to-9-x-with-source-disabled/375388)
**Author:** [@kpachar](https://discuss.elastic.co/u/kpachar)\ **Replies:** 5\ **Last updated:** [March 5, 2025, 3:23am UTC](https://discuss.elastic.co/t/upgrading-from-8-x-to-9-x-with-source-disabled/375388 "2025-03-05T03:23:28Z")
Hello, I am exploring disabling \_source for some of my indices. The documentation has warnings about doing that. One specific line in the warnings is not very clear to me: "The ability to reindex from one Elasticse… --- ## [Does Elastic Cloud Hosting Charge you for 24 hours in advance?](https://discuss.elastic.co/t/does-elastic-cloud-hosting-charge-you-for-24-hours-in-advance/375413)
**Author:** [@manpap11](https://discuss.elastic.co/u/manpap11)\ **Replies:** 0\ **Last updated:** [March 5, 2025, 12:22am UTC](https://discuss.elastic.co/t/does-elastic-cloud-hosting-charge-you-for-24-hours-in-advance/375413 "2025-03-05T00:22:13Z")
Hello everyone, I'm quite new to the ecosystem so thanks in advance for your patience! As the title of the post suggests I enabled the trial for the Elastic Cloud Hosting to see the features and capabilities, at first … --- ## [What is the meaning of the following acronyms? "o.e.a.a.i.m.p." and "o.e.c.s."](https://discuss.elastic.co/t/what-is-the-meaning-of-the-following-acronyms-o-e-a-a-i-m-p-and-o-e-c-s/375405)
**Author:** [@Chris\_McGrath](https://discuss.elastic.co/u/Chris_McGrath)\ **Replies:** 5\ **Last updated:** [March 4, 2025, 10:39pm UTC](https://discuss.elastic.co/t/what-is-the-meaning-of-the-following-acronyms-o-e-a-a-i-m-p-and-o-e-c-s/375405 "2025-03-04T22:39:05Z")
I saw in AWS OpenSearch logs a message very similar to a stack overflow post, The key part of which is: \[2020-03-17T09:13:08,964\]\[DEBUG\]\[o.e.c.s.MasterService \] \[prod-apm-elasticsearch103.example.com\] processing \[put… --- ## [Filebeat Multiline Parsing with Regex flushing lines with ^M](https://discuss.elastic.co/t/filebeat-multiline-parsing-with-regex-flushing-lines-with-m/375408)
**Author:** [@srenta97](https://discuss.elastic.co/u/srenta97)\ **Replies:** 0\ **Last updated:** [March 4, 2025, 10:37pm UTC](https://discuss.elastic.co/t/filebeat-multiline-parsing-with-regex-flushing-lines-with-m/375408 "2025-03-04T22:37:43Z")
Hello Community, We have setup filebeat for xml like log ingestion in our on-prem environments using the following configuration in filebeat.yml - type: filestream enabled: true paths: - /cognos/\*/logs/XQE/\*.xm… --- ## [Elasticsearch cluster with Docker vs Kubernetes](https://discuss.elastic.co/t/elasticsearch-cluster-with-docker-vs-kubernetes/375074)
**Author:** [@mpniel](https://discuss.elastic.co/u/mpniel)\ **Replies:** 9\ **Last updated:** [March 4, 2025, 8:34pm UTC](https://discuss.elastic.co/t/elasticsearch-cluster-with-docker-vs-kubernetes/375074 "2025-03-04T20:34:48Z")
Question regarding the upgrade of an Elasticsearch cluster, which has over 50 nodes, to a new cluster running RedHat operating system. The question is: should we build the new cluster in a Docker environment or a Kub… --- ## [PDF content wrong sequence and space](https://discuss.elastic.co/t/pdf-content-wrong-sequence-and-space/375001)
**Author:** [@uniconfortced](https://discuss.elastic.co/u/uniconfortced)\ **Replies:** 2\ **Last updated:** [March 4, 2025, 3:32pm UTC](https://discuss.elastic.co/t/pdf-content-wrong-sequence-and-space/375001 "2025-03-04T15:32:48Z")
Good morning, I am new into Elasticsearch use. I install it to search information from content of PDF generated by my old ERP. Elastic extract correct text but into wrong sequence that depend from PDF read sequence or t… --- ## [Achieving a books dot google dot com workflow with Elasticsearch as search engine, any indexer and tesseract OCR tool?](https://discuss.elastic.co/t/achieving-a-books-dot-google-dot-com-workflow-with-elasticsearch-as-search-engine-any-indexer-and-tesseract-ocr-tool/375380)
**Author:** [@davecomputertips](https://discuss.elastic.co/u/davecomputertips)\ **Replies:** 1\ **Last updated:** [March 4, 2025, 3:26pm UTC](https://discuss.elastic.co/t/achieving-a-books-dot-google-dot-com-workflow-with-elasticsearch-as-search-engine-any-indexer-and-tesseract-ocr-tool/375380 "2025-03-04T15:26:37Z")
Chatgpt and deepseek hallucinated on this so asking here: 10s of pdfs is downloaded. I want to search for a particular topic inside the content of pdf. I search it. Then I want to read that pdf going to that exact page… --- ## [Logstash categorizing all Sonicwall events as "Emergency"](https://discuss.elastic.co/t/logstash-categorizing-all-sonicwall-events-as-emergency/374319)
**Author:** [@savante21](https://discuss.elastic.co/u/savante21)\ **Replies:** 2\ **Last updated:** [March 4, 2025, 2:51pm UTC](https://discuss.elastic.co/t/logstash-categorizing-all-sonicwall-events-as-emergency/374319 "2025-03-04T14:51:21Z")
I am using logstash to capture syslogs from a sonicwall firewall in order to transmit to Wazuh cloud. Our default configuration is : input { syslog { port =\> "514" type =\> "sonicwall" } } output { fi… --- ## [Shard best practices count vs stats for limit](https://discuss.elastic.co/t/shard-best-practices-count-vs-stats-for-limit/375377)
**Author:** [@zedEm](https://discuss.elastic.co/u/zedEm)\ **Replies:** 0\ **Last updated:** [March 4, 2025, 1:45pm UTC](https://discuss.elastic.co/t/shard-best-practices-count-vs-stats-for-limit/375377 "2025-03-04T13:45:37Z")
I have a question about ES best practices as written here Size your shards | Elasticsearch Guide \[8.17\] | Elastic. During inspections I have come across index size discrepancy with stats vs count. This is most likely du… --- ## [Elasticsearch vulnerability issue](https://discuss.elastic.co/t/elasticsearch-vulnerability-issue/375373)
**Author:** [@linuxadmins](https://discuss.elastic.co/u/linuxadmins)\ **Replies:** 1\ **Last updated:** [March 4, 2025, 1:25pm UTC](https://discuss.elastic.co/t/elasticsearch-vulnerability-issue/375373 "2025-03-04T13:25:04Z")
Dear Recipient, The Tanable application has found a problem with the elasticsearch nodejs high built into kibana, the number is CVE: CVE-2025-23083,CVE-2025-23084,CVE-2025-23085. We would like guidance on this, when it… --- ## [Unable to remove "default" data views from Default space](https://discuss.elastic.co/t/unable-to-remove-default-data-views-from-default-space/375376)
**Author:** [@petlit2049](https://discuss.elastic.co/u/petlit2049)\ **Replies:** 0\ **Last updated:** [March 4, 2025, 12:31pm UTC](https://discuss.elastic.co/t/unable-to-remove-default-data-views-from-default-space/375376 "2025-03-04T12:31:47Z")
Hi! I'd like to get rid of the following data views from the Default space: logs-\* metrics-\* synthetics-dashboard and I'm using ansible to set up my custom environments. One of my tasks does the following: … --- ## [ERROR: \[1\] bootstrap checks failed. You must address the points described in the following \[1\] lines before starting Elasticsearch](https://discuss.elastic.co/t/error-1-bootstrap-checks-failed-you-must-address-the-points-described-in-the-following-1-lines-before-starting-elasticsearch/375358)
**Author:** [@ACoder](https://discuss.elastic.co/u/ACoder)\ **Replies:** 4\ **Last updated:** [March 4, 2025, 12:01pm UTC](https://discuss.elastic.co/t/error-1-bootstrap-checks-failed-you-must-address-the-points-described-in-the-following-1-lines-before-starting-elasticsearch/375358 "2025-03-04T12:01:28Z")
I use the official docker image, version 8.6.0, encounter this error when starting up, but there is no info after this error message, so I don't know what to do. --- ## [Exception while emitting periodic batch from Serilog.Sinks](https://discuss.elastic.co/t/exception-while-emitting-periodic-batch-from-serilog-sinks/375371)
**Author:** [@Deekshi](https://discuss.elastic.co/u/Deekshi)\ **Replies:** 0\ **Last updated:** [March 4, 2025, 11:51am UTC](https://discuss.elastic.co/t/exception-while-emitting-periodic-batch-from-serilog-sinks/375371 "2025-03-04T11:51:38Z")
Facing below issue Exception while emitting periodic batch from Serilog.Sinks.Elasticsearch.Durable.ElasticsearchLogClient: Elasticsearch.Net.ElasticsearchClientException: The client is unable to verify that the server … --- ## [ransportException: Expecting JSON data but response content-type is application/octet-stream (Elastic Cloud 8.12)](https://discuss.elastic.co/t/ransportexception-expecting-json-data-but-response-content-type-is-application-octet-stream-elastic-cloud-8-12/375323)
**Author:** [@r3b1135h5](https://discuss.elastic.co/u/r3b1135h5)\ **Replies:** 1\ **Last updated:** [March 4, 2025, 8:22am UTC](https://discuss.elastic.co/t/ransportexception-expecting-json-data-but-response-content-type-is-application-octet-stream-elastic-cloud-8-12/375323 "2025-03-04T08:22:23Z")
Hello, I'm encountering a co.elastic.clients.transport.TransportException with the following error message: co.elastic.clients.transport.TransportException: node: http://my-elasticsearch-project-c2b746.es.ap-southeast-… --- ## [Documentation question](https://discuss.elastic.co/t/documentation-question/375319)
**Author:** [@alon\_hen](https://discuss.elastic.co/u/alon_hen)\ **Replies:** 4\ **Last updated:** [March 4, 2025, 7:44am UTC](https://discuss.elastic.co/t/documentation-question/375319 "2025-03-04T07:44:08Z")
Hey guys, im trying to read through the docs to understand what a production grade deployment needs , anyways I have reached the part where im reading about node roles Now - there is something rather confusing to me in… --- ## [How to convert kibana query to elastic search json programmatically](https://discuss.elastic.co/t/how-to-convert-kibana-query-to-elastic-search-json-programmatically/375346)
**Author:** [@zifan\_yan](https://discuss.elastic.co/u/zifan_yan)\ **Replies:** 0\ **Last updated:** [March 4, 2025, 7:29am UTC](https://discuss.elastic.co/t/how-to-convert-kibana-query-to-elastic-search-json-programmatically/375346 "2025-03-04T07:29:43Z")
I have KQL looking like these: f6:v6 or (f1:v1 or f2:v2 or (f3:v3 and f4:v4)) and not f5:v5 field1:(value1 or value2) and field2:value3 and not field3:value4 I would like to convert to elastic searching json using pro… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=92) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=94)