# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=98 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 99 --- ## [Ingestion pipeline doesn't appear to be invoked](https://discuss.elastic.co/t/ingestion-pipeline-doesnt-appear-to-be-invoked/374816)
**Author:** [@wrh](https://discuss.elastic.co/u/wrh)\ **Replies:** 0\ **Last updated:** [February 20, 2025, 1:06pm UTC](https://discuss.elastic.co/t/ingestion-pipeline-doesnt-appear-to-be-invoked/374816 "2025-02-20T13:06:38Z")
I'm working on ingesting DB2 logs from db2diag.log into elastic. Here's the steps I have taken so far, and how much is working: Index Template - create an index template logs-db2.diag with index pattern logs-db2.diag-\* … --- ## [How can I add controls specific to a visualization in kibana dashboard?](https://discuss.elastic.co/t/how-can-i-add-controls-specific-to-a-visualization-in-kibana-dashboard/361459)
**Author:** [@Anupama2262](https://discuss.elastic.co/u/Anupama2262)\ **Replies:** 6\ **Last updated:** [February 20, 2025, 3:16pm UTC](https://discuss.elastic.co/t/how-can-i-add-controls-specific-to-a-visualization-in-kibana-dashboard/361459 "2025-02-20T15:16:14Z")
I have two doubts regarding control Dashboard Visualization Filtering Issue: I have a dashboard with five visualizations: two visualizations created with one data view containing an email field, and three visualizat… --- ## [Parsing nested json](https://discuss.elastic.co/t/parsing-nested-json/374629)
**Author:** [@user-27022024](https://discuss.elastic.co/u/user-27022024)\ **Replies:** 6\ **Last updated:** [February 20, 2025, 2:55pm UTC](https://discuss.elastic.co/t/parsing-nested-json/374629 "2025-02-20T14:55:43Z")
I am having issues with our AWS ecs -\> fluentbit -\> elasticsearch set up, specifically around nested json. For example, if the log message is: { "endpoint": "/process", "payload": { "body": { "success":… --- ## [Long message is truncated by logstash](https://discuss.elastic.co/t/long-message-is-truncated-by-logstash/374691)
**Author:** [@Misakiz](https://discuss.elastic.co/u/Misakiz)\ **Replies:** 5\ **Last updated:** [February 19, 2025, 9:53am UTC](https://discuss.elastic.co/t/long-message-is-truncated-by-logstash/374691 "2025-02-19T09:53:50Z")
\ **Author:** [@julian.dto](https://discuss.elastic.co/u/julian.dto)\ **Replies:** 0\ **Last updated:** [February 20, 2025, 1:46pm UTC](https://discuss.elastic.co/t/sorted-pagination-in-terms-aggregation-search/374820 "2025-02-20T13:46:58Z") Hello! I am trying to run an aggregation search with pagination. The solutions I found were either partitioning or using search\_after. With partitioning the sorting will only be inside of the partition, not the overall… --- ## [Avoid duplicate insertions](https://discuss.elastic.co/t/avoid-duplicate-insertions/374809)
**Author:** [@Cristina\_Marletta\_Li](https://discuss.elastic.co/u/Cristina_Marletta_Li)\ **Replies:** 3\ **Last updated:** [February 20, 2025, 1:58pm UTC](https://discuss.elastic.co/t/avoid-duplicate-insertions/374809 "2025-02-20T13:58:25Z")
Hi, What is the best method to avoid duplicate insertions (based on one or two fields) in an index? I am thinking of a mechanism like Primary Key of relational databases. Thanks for your suggestions. Cristina --- ## [Install size Elastic Agent](https://discuss.elastic.co/t/install-size-elastic-agent/374801)
**Author:** [@peter.verhage](https://discuss.elastic.co/u/peter.verhage)\ **Replies:** 1\ **Last updated:** [February 20, 2025, 1:23pm UTC](https://discuss.elastic.co/t/install-size-elastic-agent/374801 "2025-02-20T13:23:07Z")
We replaced all of the filebeat and winlogbeat agents with Elastic Agent, in order to better manage versions. Currently we are using version 8.17.2 after an upgrade from 8.17.1. We ran into some issues with upgrades of … --- ## [Problem with oracle dates though logstasg](https://discuss.elastic.co/t/problem-with-oracle-dates-though-logstasg/374770)
**Author:** [@Borja](https://discuss.elastic.co/u/Borja)\ **Replies:** 2\ **Last updated:** [February 20, 2025, 1:03pm UTC](https://discuss.elastic.co/t/problem-with-oracle-dates-though-logstasg/374770 "2025-02-20T13:03:48Z")
Hi all, We are migrating some queries used on logstash on a previous DB2 pipeline to a new oracle database pipeline. We have checked them on db clients like Dbvisualizer or dbviewer and running these converted queries … --- ## [Elasticsearch query | DSL Rules trigger count](https://discuss.elastic.co/t/elasticsearch-query-dsl-rules-trigger-count/374810)
**Author:** [@joaosf](https://discuss.elastic.co/u/joaosf)\ **Replies:** 0\ **Last updated:** [February 20, 2025, 11:47am UTC](https://discuss.elastic.co/t/elasticsearch-query-dsl-rules-trigger-count/374810 "2025-02-20T11:47:37Z")
Hi all, I created a script query and now I want to trigger an email if the count is more than 0. GET /xpto\_xpto/\_search { "\_source": false, "track\_total\_hits": false, "size": 0, "query": { "bool": { }… --- ## [Kibana Discover view and graph customization (v8.15 / 8.16)](https://discuss.elastic.co/t/kibana-discover-view-and-graph-customization-v8-15-8-16/374807)
**Author:** [@rufik](https://discuss.elastic.co/u/rufik)\ **Replies:** 1\ **Last updated:** [February 20, 2025, 11:38am UTC](https://discuss.elastic.co/t/kibana-discover-view-and-graph-customization-v8-15-8-16/374807 "2025-02-20T11:38:03Z")
There is a histogram graph on Discover view and I can breakdown it by a field. It works fine but is it possible to customize histogram in a way: make breakdown option more than "top 3 values"? change the colors mapping… --- ## [Network Packet Capture integration stuck in a FAILED state](https://discuss.elastic.co/t/network-packet-capture-integration-stuck-in-a-failed-state/374767)
**Author:** [@pok\_lehbim](https://discuss.elastic.co/u/pok_lehbim)\ **Replies:** 1\ **Last updated:** [February 20, 2025, 10:59am UTC](https://discuss.elastic.co/t/network-packet-capture-integration-stuck-in-a-failed-state/374767 "2025-02-20T10:59:17Z")
I am trying to add the Network Packet Capture integration to an agent but it's not working at all. The machine is a windows host, and it's managed from a fleet. I've looked into the logs but there isn't any pertinent in… --- ## [Error creating runner from config: Can only start an input when all related states are finished](https://discuss.elastic.co/t/error-creating-runner-from-config-can-only-start-an-input-when-all-related-states-are-finished/374803)
**Author:** [@Ace091](https://discuss.elastic.co/u/Ace091)\ **Replies:** 0\ **Last updated:** [February 20, 2025, 10:45am UTC](https://discuss.elastic.co/t/error-creating-runner-from-config-can-only-start-an-input-when-all-related-states-are-finished/374803 "2025-02-20T10:45:55Z")
Hello All , Recently facing a problem of inconsistent filebeat state, when I started using two filebeat daemonsets on my kubernetes cluster. for reference here I am attatching my two filebeat configurations - prov… --- ## [Embedding generation using E5 failing for some records](https://discuss.elastic.co/t/embedding-generation-using-e5-failing-for-some-records/374090)
**Author:** [@Carlos\_Fernando\_Palm](https://discuss.elastic.co/u/Carlos_Fernando_Palm)\ **Replies:** 1\ **Last updated:** [February 20, 2025, 9:45am UTC](https://discuss.elastic.co/t/embedding-generation-using-e5-failing-for-some-records/374090 "2025-02-20T09:45:12Z")
I am trying to use the E5 model to generate embeddings for some documents. I used a reindex to generate the embeddings: POST \_reindex?wait\_for\_completion=false { "source": { "index": "source\_index", "size": 5… --- ## [Reindex stops stops after 1000 docs](https://discuss.elastic.co/t/reindex-stops-stops-after-1000-docs/374779)
**Author:** [@honungsburk](https://discuss.elastic.co/u/honungsburk)\ **Replies:** 3\ **Last updated:** [February 20, 2025, 7:30am UTC](https://discuss.elastic.co/t/reindex-stops-stops-after-1000-docs/374779 "2025-02-20T07:30:07Z")
Hello! I currently have 1 index filled with about 500k documents that I want to reindex into another index where I have added a semantic text search field. It is the most basic kind that uses the built in stuff in Elast… --- ## [Missing Drilldown Option in Discover for Dashboards - Kibana Version 8.17.2](https://discuss.elastic.co/t/missing-drilldown-option-in-discover-for-dashboards-kibana-version-8-17-2/374667)
**Author:** [@prashant1](https://discuss.elastic.co/u/prashant1)\ **Replies:** 2\ **Last updated:** [February 20, 2025, 6:02am UTC](https://discuss.elastic.co/t/missing-drilldown-option-in-discover-for-dashboards-kibana-version-8-17-2/374667 "2025-02-20T06:02:59Z")
We are currently using Kibana version 8.17.2, and we are experiencing an issue where the Drilldown option is not visible in the Discover section for dashboards. We have tried navigating through the interface multiple tim… --- ## [Filebeat stopped working after adding a node to the cluster](https://discuss.elastic.co/t/filebeat-stopped-working-after-adding-a-node-to-the-cluster/374785)
**Author:** [@andrejjorje](https://discuss.elastic.co/u/andrejjorje)\ **Replies:** 1\ **Last updated:** [February 20, 2025, 1:36am UTC](https://discuss.elastic.co/t/filebeat-stopped-working-after-adding-a-node-to-the-cluster/374785 "2025-02-20T01:36:49Z")
Hello everybody. I have installed one node with ELK 8.17.2 on Ubuntu 24.04.Elasticsearch, Kibana and Filebeat.All working. I decided then to install another elasticsearch node for redundancy.Only elasticsearch. I was a… --- ## [URL templating for Drilldowns using required field from the dashboard filters](https://discuss.elastic.co/t/url-templating-for-drilldowns-using-required-field-from-the-dashboard-filters/372019)
**Author:** [@venkatkumar229](https://discuss.elastic.co/u/venkatkumar229)\ **Replies:** 7\ **Last updated:** [February 19, 2025, 11:37pm UTC](https://discuss.elastic.co/t/url-templating-for-drilldowns-using-required-field-from-the-dashboard-filters/372019 "2025-02-19T23:37:23Z")
Hi Team, We are trying to create a drilldown using URL templating to link two dashboards. But while moving from one dashboard to other we need to carry one particular field(recon\_key) which is added in the filters to be… --- ## [Logstash 8.17.1 stuck on starting successfully](https://discuss.elastic.co/t/logstash-8-17-1-stuck-on-starting-successfully/374786)
**Author:** [@latte123](https://discuss.elastic.co/u/latte123)\ **Replies:** 2\ **Last updated:** [February 19, 2025, 10:01pm UTC](https://discuss.elastic.co/t/logstash-8-17-1-stuck-on-starting-successfully/374786 "2025-02-19T22:01:58Z")
I used config file with syslog for input/output from Openshift few times without changes successfully. It stopped working for unknown reason. Attached is output with traces on logstash restart; logstash.yml attached. Be… --- ## [Issue with Filebeat Custom cluster\_id Field and Routing Logs to Specific Kibana Spaces via Ingest Pipeline](https://discuss.elastic.co/t/issue-with-filebeat-custom-cluster-id-field-and-routing-logs-to-specific-kibana-spaces-via-ingest-pipeline/364645)
**Author:** [@Anudeep](https://discuss.elastic.co/u/Anudeep)\ **Replies:** 1\ **Last updated:** [February 19, 2025, 9:38pm UTC](https://discuss.elastic.co/t/issue-with-filebeat-custom-cluster-id-field-and-routing-logs-to-specific-kibana-spaces-via-ingest-pipeline/364645 "2025-02-19T21:38:23Z")
I'm configuring Filebeat to add a custom field (cluster\_id) to logs and route these logs to specific indices based on the cluster\_id. Additionally, I want to ensure that these logs are only visible in specific Kibana spa… --- ## [Large log data indexing best practices (datastreams?)](https://discuss.elastic.co/t/large-log-data-indexing-best-practices-datastreams/374780)
**Author:** [@AnthonyKeydel](https://discuss.elastic.co/u/AnthonyKeydel)\ **Replies:** 2\ **Last updated:** [February 19, 2025, 8:59pm UTC](https://discuss.elastic.co/t/large-log-data-indexing-best-practices-datastreams/374780 "2025-02-19T20:59:38Z")
Hi there! I've been working to refine my Elastic instance for months now, and have gotten a bit tangled in the details. :face\_with\_spiral\_eyes: Before promoting the PoC into a live Production environment, I could use a… --- ## [Extremely increased disk usage since upgrade to 8.17.1](https://discuss.elastic.co/t/extremely-increased-disk-usage-since-upgrade-to-8-17-1/374405)
**Author:** [@Alphayeeeet](https://discuss.elastic.co/u/Alphayeeeet)\ **Replies:** 39\ **Last updated:** [February 19, 2025, 8:46pm UTC](https://discuss.elastic.co/t/extremely-increased-disk-usage-since-upgrade-to-8-17-1/374405 "2025-02-19T20:46:39Z")
Hi, we upgraded our production stack to 8.17.1 at the beginning of the week. Now after it ran for a few days the amount of data (especially Kubernetes cluster metrics) has been increased enormously since the upgrade. … --- ## [Kibana upgrade - 8.16.1 plugin error](https://discuss.elastic.co/t/kibana-upgrade-8-16-1-plugin-error/374590)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 3\ **Last updated:** [February 19, 2025, 8:00pm UTC](https://discuss.elastic.co/t/kibana-upgrade-8-16-1-plugin-error/374590 "2025-02-19T20:00:36Z")
I upgraded kibana and now getting this everytime I try to load dashboard. once I clear the session it works. how do I fix this? I don't need this observabilityAIAssistant. I would like to disable this as all user is ge… --- ## [Filebeat system module "no filesets enabled" with custom path](https://discuss.elastic.co/t/filebeat-system-module-no-filesets-enabled-with-custom-path/374640)
**Author:** [@mateodi](https://discuss.elastic.co/u/mateodi)\ **Replies:** 5\ **Last updated:** [February 19, 2025, 3:30pm UTC](https://discuss.elastic.co/t/filebeat-system-module-no-filesets-enabled-with-custom-path/374640 "2025-02-19T15:30:17Z")
Hello. I'm failing to ship my syslog (located in a custom path) to elasticsearch using filebeat's system module. My system.yml file: # Module: system # Docs: https://www.elastic.co/guide/en/beats/filebeat/main/filebea… --- ## [Ruby dumps tons of runtime errors after upgrade to 8.16.2](https://discuss.elastic.co/t/ruby-dumps-tons-of-runtime-errors-after-upgrade-to-8-16-2/374774)
**Author:** [@Mash1](https://discuss.elastic.co/u/Mash1)\ **Replies:** 6\ **Last updated:** [February 19, 2025, 3:29pm UTC](https://discuss.elastic.co/t/ruby-dumps-tons-of-runtime-errors-after-upgrade-to-8-16-2/374774 "2025-02-19T15:29:59Z")
Hi everyone, After upgrading Logstash to 8.16.2 , The /var/log/logstash/logstash-plain.log is filling up very quickly with ERROR logs pointing to what seems to be runtime errors in Ruby code. We use Ruby in one of the f… --- ## [How to save docker elastic search data permanently in azure storage](https://discuss.elastic.co/t/how-to-save-docker-elastic-search-data-permanently-in-azure-storage/374654)
**Author:** [@Constellation2025](https://discuss.elastic.co/u/Constellation2025)\ **Replies:** 5\ **Last updated:** [February 19, 2025, 3:19pm UTC](https://discuss.elastic.co/t/how-to-save-docker-elastic-search-data-permanently-in-azure-storage/374654 "2025-02-19T15:19:26Z")
How can I permanently save Elasticsearch data in Azure while using Docker, ensuring that the data remains intact even if the container is stopped or restarted? --- ## [How to unhide redacted values](https://discuss.elastic.co/t/how-to-unhide-redacted-values/374622)
**Author:** [@a\_mandel](https://discuss.elastic.co/u/a_mandel)\ **Replies:** 3\ **Last updated:** [February 19, 2025, 3:22pm UTC](https://discuss.elastic.co/t/how-to-unhide-redacted-values/374622 "2025-02-19T15:22:50Z")
I am using elastic for logging in asp.net (Elastic.Extensions.Logging) I am looking at the logs through Logs in Explorer(Beta). When I look at the logDetails and I check the url.query that was used in this scope the para… --- ## [AI assistant giving errors](https://discuss.elastic.co/t/ai-assistant-giving-errors/373285)
**Author:** [@flalar](https://discuss.elastic.co/u/flalar)\ **Replies:** 8\ **Last updated:** [February 19, 2025, 3:21pm UTC](https://discuss.elastic.co/t/ai-assistant-giving-errors/373285 "2025-02-19T15:21:07Z")
We've set up the Azure OpenAI connector and things are looking good when testing the connector. We also see requests comming into the model on the Azure side. However we get an error in Kibana saying Failed to load res… --- ## [Extracting values from a JSON array without using a ruby script](https://discuss.elastic.co/t/extracting-values-from-a-json-array-without-using-a-ruby-script/374768)
**Author:** [@Matvey\_Dr](https://discuss.elastic.co/u/Matvey_Dr)\ **Replies:** 1\ **Last updated:** [February 19, 2025, 2:43pm UTC](https://discuss.elastic.co/t/extracting-values-from-a-json-array-without-using-a-ruby-script/374768 "2025-02-19T14:43:14Z")
Hello, I have json of this type at the input: { "folders": \[{ "template": "template\_name1", "attrs": \[{ "attrStr": { "key": "key1", … --- ## [Fleet Agent Cannot Export to CSV](https://discuss.elastic.co/t/fleet-agent-cannot-export-to-csv/374752)
**Author:** [@kulisiber](https://discuss.elastic.co/u/kulisiber)\ **Replies:** 4\ **Last updated:** [February 19, 2025, 2:43pm UTC](https://discuss.elastic.co/t/fleet-agent-cannot-export-to-csv/374752 "2025-02-19T14:43:19Z")
I have a need to list all fleet agents with status and such for document purposes. I didn't find an export agent feature like on the Wazuh Dashboard. As a result, I tried to query Dev Tools but still didn't get the right… --- ## [.NET Client: Implementing Location Bias in a Query](https://discuss.elastic.co/t/net-client-implementing-location-bias-in-a-query/374685)
**Author:** [@Patricius](https://discuss.elastic.co/u/Patricius)\ **Replies:** 3\ **Last updated:** [February 19, 2025, 2:23pm UTC](https://discuss.elastic.co/t/net-client-implementing-location-bias-in-a-query/374685 "2025-02-19T14:23:41Z")
Hello, I'm working on a query with location bias with the new Elastic.Clients.Elasticsearch but I can't find any good documentation on how to do it. My EF-Core entity has those variables: public double Latitude { get;… [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=97) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=99)