# Elastic Stack **URL:** https://discuss.elastic.co/c/elastic-stack/81.md?page=99 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 100 --- ## [Filebeat and Netflow with two Syslog Senders](https://discuss.elastic.co/t/filebeat-and-netflow-with-two-syslog-senders/374677)
**Author:** [@max77](https://discuss.elastic.co/u/max77)\ **Replies:** 1\ **Last updated:** [February 19, 2025, 2:06pm UTC](https://discuss.elastic.co/t/filebeat-and-netflow-with-two-syslog-senders/374677 "2025-02-19T14:06:57Z")
helo i am a newbie in Elasticsearch and filebeat i installed and configured the System on a Ubuntu 24 its run filebeat; Version: 7.17.27 i have now two firewalls thats logs with netflow to the Filebeat server i only… --- ## [OAUTH support for logstash kafka output for azure eventhub kafka endpoint](https://discuss.elastic.co/t/oauth-support-for-logstash-kafka-output-for-azure-eventhub-kafka-endpoint/374773)
**Author:** [@PARAS\_PAUL1](https://discuss.elastic.co/u/PARAS_PAUL1)\ **Replies:** 0\ **Last updated:** [February 19, 2025, 1:57pm UTC](https://discuss.elastic.co/t/oauth-support-for-logstash-kafka-output-for-azure-eventhub-kafka-endpoint/374773 "2025-02-19T13:57:55Z")
Hi All, I'm trying to push events to Azure Eventhub kafka endpoint. I'm able to successfully connect and publish to the topic when I use SASL\_SSL. But I want to use OAUTH. As per the microsoft documentation \[https://le… --- ## [Unable to login elastic https page 5601](https://discuss.elastic.co/t/unable-to-login-elastic-https-page-5601/374733)
**Author:** [@f.seagaia\_o](https://discuss.elastic.co/u/f.seagaia_o)\ **Replies:** 1\ **Last updated:** [February 19, 2025, 12:28pm UTC](https://discuss.elastic.co/t/unable-to-login-elastic-https-page-5601/374733 "2025-02-19T12:28:03Z")
Hi all, I cannot login my elasticsearch server page work from 2023-03-13. I login to page by elasticsearch user and correct password but return the login page again with no error messages ("password is incollect",etc). … --- ## [Cluster not forming](https://discuss.elastic.co/t/cluster-not-forming/374581)
**Author:** [@joelatgrayv](https://discuss.elastic.co/u/joelatgrayv)\ **Replies:** 14\ **Last updated:** [February 19, 2025, 12:10pm UTC](https://discuss.elastic.co/t/cluster-not-forming/374581 "2025-02-19T12:10:01Z")
I’m trying to get an ES cluster working with a cloud formation. I have it all up and running but the cluster is not forming correctly. This is the error that I’m getting: {"@timestamp":"2025-02-14T22:02:57.598Z", "log.… --- ## [Unable to set mustache.max\_output\_size\_bytes in elasticsearch.yml version 7.17.25](https://discuss.elastic.co/t/unable-to-set-mustache-max-output-size-bytes-in-elasticsearch-yml-version-7-17-25/372412)
**Author:** [@ManojKumarM](https://discuss.elastic.co/u/ManojKumarM)\ **Replies:** 17\ **Last updated:** [February 19, 2025, 12:18pm UTC](https://discuss.elastic.co/t/unable-to-set-mustache-max-output-size-bytes-in-elasticsearch-yml-version-7-17-25/372412 "2025-02-19T12:18:15Z")
Hi, We have recently upgraded to 7.17.25 and trying to set the below configuration in elasticsearch.yml as recommended in the release notes mustache.max\_output\_size\_bytes: 10485760 however we see that configuration is… --- ## [Exiting: data path already locked by another beat. Please make sure that multiple beats are not sharing the same data path (path.data)](https://discuss.elastic.co/t/exiting-data-path-already-locked-by-another-beat-please-make-sure-that-multiple-beats-are-not-sharing-the-same-data-path-path-data/374738)
**Author:** [@Muhammad\_Junaid](https://discuss.elastic.co/u/Muhammad_Junaid)\ **Replies:** 0\ **Last updated:** [February 19, 2025, 8:53am UTC](https://discuss.elastic.co/t/exiting-data-path-already-locked-by-another-beat-please-make-sure-that-multiple-beats-are-not-sharing-the-same-data-path-path-data/374738 "2025-02-19T08:53:45Z")
Hi, I have installed the filebeat to multiple EC2 machine and shipping logs to Elasticsearch. version is same for all instances. Service is working file and making connection to ELK stack but getting problem that logs a… --- ## [ES|QL and the \_size field](https://discuss.elastic.co/t/es-ql-and-the-size-field/374753)
**Author:** [@pilarjin](https://discuss.elastic.co/u/pilarjin)\ **Replies:** 1\ **Last updated:** [February 19, 2025, 11:13am UTC](https://discuss.elastic.co/t/es-ql-and-the-size-field/374753 "2025-02-19T11:13:13Z")
Hi, is it possible to use \_size field in ES|QL? I didn't find it mentioned in the limitations documentation. We are trying to identify traces that generate too much data as feedback for developers what to optimize. Ex… --- ## [How to parse optional fields in dhcp lease logs?](https://discuss.elastic.co/t/how-to-parse-optional-fields-in-dhcp-lease-logs/374602)
**Author:** [@kriti\_dabas](https://discuss.elastic.co/u/kriti_dabas)\ **Replies:** 5\ **Last updated:** [February 19, 2025, 10:47am UTC](https://discuss.elastic.co/t/how-to-parse-optional-fields-in-dhcp-lease-logs/374602 "2025-02-19T10:47:32Z")
I want help in parsing of optional fields lease 1.1.1.1 { starts 5 2025/02/14 05:32:50; ends 5 2025/02/14 05:37:55; tstp 5 2025/02/14 05:37:55; cltt 5 2025/02/14 05:37:54; binding state free; hardware ethern… --- ## [How to specify index name in Elastic.Serilog.Sinks](https://discuss.elastic.co/t/how-to-specify-index-name-in-elastic-serilog-sinks/374741)
**Author:** [@Nick\_Farsi](https://discuss.elastic.co/u/Nick_Farsi)\ **Replies:** 0\ **Last updated:** [February 19, 2025, 9:13am UTC](https://discuss.elastic.co/t/how-to-specify-index-name-in-elastic-serilog-sinks/374741 "2025-02-19T09:13:36Z")
I have switched from Serilog.Sinks.Elasticsearch package to Elastic.Serilog.Sinks. Before I would specify target index name like this: string indexFormat = settings.IndexName.Replace("$ComponentID$", componentId.ToLowe… --- ## [Recent Upgrade of elastic to 8.17.2 from 8.15.4 has deleted our url drilldowns on saved search](https://discuss.elastic.co/t/recent-upgrade-of-elastic-to-8-17-2-from-8-15-4-has-deleted-our-url-drilldowns-on-saved-search/374666)
**Author:** [@venkatkumar229](https://discuss.elastic.co/u/venkatkumar229)\ **Replies:** 1\ **Last updated:** [February 19, 2025, 8:56am UTC](https://discuss.elastic.co/t/recent-upgrade-of-elastic-to-8-17-2-from-8-15-4-has-deleted-our-url-drilldowns-on-saved-search/374666 "2025-02-19T08:56:02Z")
Hi Team, We are using URL drilldowns in kibana dashboards on saved search objects but after upgrading our elasticsearch to 8.17.2 we have lost the drilldowns on saved searches and not able to create them. Please let us … --- ## [Need help with grokking complex logfile](https://discuss.elastic.co/t/need-help-with-grokking-complex-logfile/374709)
**Author:** [@componentByss](https://discuss.elastic.co/u/componentByss)\ **Replies:** 1\ **Last updated:** [February 18, 2025, 10:52pm UTC](https://discuss.elastic.co/t/need-help-with-grokking-complex-logfile/374709 "2025-02-18T22:52:05Z")
Hello! If anyone could provide assistance with setting up the correct grok filter for a complex logfile like this: ======== Query 1 of 2 ======== /\* \[User: 239\] events :: edit \*/ SELECT \`Attribute\`.\`type\`, \`Attribute\`.\`… --- ## [Using retrievers in the open source version](https://discuss.elastic.co/t/using-retrievers-in-the-open-source-version/374706)
**Author:** [@Saleh\_AbuAli](https://discuss.elastic.co/u/Saleh_AbuAli)\ **Replies:** 3\ **Last updated:** [February 18, 2025, 9:26pm UTC](https://discuss.elastic.co/t/using-retrievers-in-the-open-source-version/374706 "2025-02-18T21:26:03Z")
Hi, I’m looking to implement a hybrid search combining kNN and BM25. Is it possible to use retrievers in the open-source version of Elasticsearch to perform this in a single search query instead of using multi-search? --- ## [Conventional index with ILM policy in filebeat-8.17](https://discuss.elastic.co/t/conventional-index-with-ilm-policy-in-filebeat-8-17/374710)
**Author:** [@rahuldastidar](https://discuss.elastic.co/u/rahuldastidar)\ **Replies:** 0\ **Last updated:** [February 18, 2025, 8:55pm UTC](https://discuss.elastic.co/t/conventional-index-with-ilm-policy-in-filebeat-8-17/374710 "2025-02-18T20:55:41Z")
Friendly folks of this community, can someone provide me a sample filebeat.yml for conventional index creation , with ILM policy enabled, I am using version 8.17.1 in filebeat and my Elasticsearch cluster is at version 8… --- ## [Issue with logstash](https://discuss.elastic.co/t/issue-with-logstash/374643)
**Author:** [@guru\_dev](https://discuss.elastic.co/u/guru_dev)\ **Replies:** 8\ **Last updated:** [February 18, 2025, 7:29am UTC](https://discuss.elastic.co/t/issue-with-logstash/374643 "2025-02-18T07:29:18Z")
When logstash restarts it pushes latest log. Other time it does not push logs. I restarted logstash on feb 7. I see only feb 7 log event in Elasticsearch even today. There is no errrors reported in logstash-plain.log l… --- ## [Create a data table visualization which excludes false values (Using TopHit)](https://discuss.elastic.co/t/create-a-data-table-visualization-which-excludes-false-values-using-tophit/365271)
**Author:** [@Pinky\_Mary\_Stanly](https://discuss.elastic.co/u/Pinky_Mary_Stanly)\ **Replies:** 1\ **Last updated:** [February 18, 2025, 1:48pm UTC](https://discuss.elastic.co/t/create-a-data-table-visualization-which-excludes-false-values-using-tophit/365271 "2025-02-18T13:48:05Z")
Hi, I have a data table visualization in Kibana 7.10.2 where I am displaying No., Name, Status and Time. In my case, for the same 'No.' field, I have many 'Name' and for the same 'Name', I have many 'Status'. And I nee… --- ## [TSVB Aggregation Count Filters](https://discuss.elastic.co/t/tsvb-aggregation-count-filters/359613)
**Author:** [@darrenkealey](https://discuss.elastic.co/u/darrenkealey)\ **Replies:** 1\ **Last updated:** [February 18, 2025, 1:39pm UTC](https://discuss.elastic.co/t/tsvb-aggregation-count-filters/359613 "2025-02-18T13:39:44Z")
Hello I want to be be able to perform a math aggregation that will divide variable A by B. Variable A: I want to be able to use the count aggregation but filter by only the documents that have a certain field, I've loo… --- ## [Implementing Hybrid Search with k-NN and BM25 in Elasticsearch Open Source](https://discuss.elastic.co/t/implementing-hybrid-search-with-k-nn-and-bm25-in-elasticsearch-open-source/374680)
**Author:** [@Saleh\_AbuAli](https://discuss.elastic.co/u/Saleh_AbuAli)\ **Replies:** 2\ **Last updated:** [February 18, 2025, 1:12pm UTC](https://discuss.elastic.co/t/implementing-hybrid-search-with-k-nn-and-bm25-in-elasticsearch-open-source/374680 "2025-02-18T13:12:52Z")
Hi, I am currently using Elasticsearch version 8.16 and am looking to implement hybrid search that combines k-NN and BM25. Since I am using the open-source version, I am unable to utilize RRF. Is there a way to use retr… --- ## [Plug-in cannot read or write files](https://discuss.elastic.co/t/plug-in-cannot-read-or-write-files/374588)
**Author:** [@lgjut](https://discuss.elastic.co/u/lgjut)\ **Replies:** 3\ **Last updated:** [February 18, 2025, 12:33pm UTC](https://discuss.elastic.co/t/plug-in-cannot-read-or-write-files/374588 "2025-02-18T12:33:35Z")
When developing a text analysis plug-in, need to read and write dic directory: package com.lietu.bigramSeg; import org.apache.lucene.analysis.Tokenizer; import org.elasticsearch.plugin.analysis.TokenizerFactory; import… --- ## [Effect of "enable accuracy mode" on "shard\_size"](https://discuss.elastic.co/t/effect-of-enable-accuracy-mode-on-shard-size/374648)
**Author:** [@antay](https://discuss.elastic.co/u/antay)\ **Replies:** 2\ **Last updated:** [February 18, 2025, 12:05pm UTC](https://discuss.elastic.co/t/effect-of-enable-accuracy-mode-on-shard-size/374648 "2025-02-18T12:05:56Z")
I believe I understand the effect of the "shard\_size" parameter in relation to Terms aggregations, described here: https://www.elastic.co/guide/en/elasticsearch/reference/8.15/search-aggregations-bucket-terms-aggregation… --- ## [Limit watcher\_admin role to certain watches](https://discuss.elastic.co/t/limit-watcher-admin-role-to-certain-watches/374635)
**Author:** [@Nicoletta](https://discuss.elastic.co/u/Nicoletta)\ **Replies:** 2\ **Last updated:** [February 18, 2025, 9:44am UTC](https://discuss.elastic.co/t/limit-watcher-admin-role-to-certain-watches/374635 "2025-02-18T09:44:03Z")
Hi, I was wondering if there's a way to give a user the possibility to create and manage only certain watches, for example all the watches that have a defined prefix. With the builtin role watcher\_admin (or the cluster… --- ## [How to Connect ODBC with Direct Query from Power BI with Elesticserach](https://discuss.elastic.co/t/how-to-connect-odbc-with-direct-query-from-power-bi-with-elesticserach/374637)
**Author:** [@venkat\_subbareddy](https://discuss.elastic.co/u/venkat_subbareddy)\ **Replies:** 1\ **Last updated:** [February 18, 2025, 9:38am UTC](https://discuss.elastic.co/t/how-to-connect-odbc-with-direct-query-from-power-bi-with-elesticserach/374637 "2025-02-18T09:38:33Z")
Hi Team, As you know ODBC connection don't have direct Query option and would like to connect through Power BI with Real time. Please help me on this. --- ## [Count and filtering in KQL](https://discuss.elastic.co/t/count-and-filtering-in-kql/370235)
**Author:** [@HermannSamimi](https://discuss.elastic.co/u/HermannSamimi)\ **Replies:** 1\ **Last updated:** [February 18, 2025, 9:29am UTC](https://discuss.elastic.co/t/count-and-filtering-in-kql/370235 "2025-02-18T09:29:46Z")
Hello folks, I want the query in a Lens metric visual as below: count of A where b \>= 9 / (count fo A) \* 100 please help. Thanks --- ## [How to Achieve Continuous Data Visualization Without Custom Ranges](https://discuss.elastic.co/t/how-to-achieve-continuous-data-visualization-without-custom-ranges/368770)
**Author:** [@vilakshan2996](https://discuss.elastic.co/u/vilakshan2996)\ **Replies:** 1\ **Last updated:** [February 18, 2025, 9:28am UTC](https://discuss.elastic.co/t/how-to-achieve-continuous-data-visualization-without-custom-ranges/368770 "2025-02-18T09:28:52Z")
Hey everyone, I’m a complete beginner with ELK and could use some help. I used an area plot to visualize response bytes against the record count, but it's not working as expected. I was aiming for a continuous or more… --- ## [Elastic ILM](https://discuss.elastic.co/t/elastic-ilm/374670)
**Author:** [@amarasinghe.kaluarac](https://discuss.elastic.co/u/amarasinghe.kaluarac)\ **Replies:** 2\ **Last updated:** [February 18, 2025, 9:19am UTC](https://discuss.elastic.co/t/elastic-ilm/374670 "2025-02-18T09:19:11Z")
Hi all, I have a use case where my index should remain in the hot phase for 3 days, then move to the cold phase for 11 days, followed by the frozen phase for 90 days, after which the data should be deleted. My concern … --- ## [Issue with Time Shift](https://discuss.elastic.co/t/issue-with-time-shift/369762)
**Author:** [@vanessa.johnson](https://discuss.elastic.co/u/vanessa.johnson)\ **Replies:** 1\ **Last updated:** [February 18, 2025, 9:18am UTC](https://discuss.elastic.co/t/issue-with-time-shift/369762 "2025-02-18T09:18:24Z")
Hi all, I'm trying to have a time shift bar graph in a month to month comparison. I'm looking to have the record count of the current month compared to the record count of the previous month. Ideally, the visualization … --- ## [AlreadyClosedException error for a Elasticsearch image from \`docker commit\`](https://discuss.elastic.co/t/alreadyclosedexception-error-for-a-elasticsearch-image-from-docker-commit/374660)
**Author:** [@liu\_ben](https://discuss.elastic.co/u/liu_ben)\ **Replies:** 1\ **Last updated:** [February 18, 2025, 5:24am UTC](https://discuss.elastic.co/t/alreadyclosedexception-error-for-a-elasticsearch-image-from-docker-commit/374660 "2025-02-18T05:24:03Z")
We have a use case to preload some data (e.g. creating some indexes ) into a running Elasticsearch container and once finished, docker commit it to create a data-preloaded image that can be used later. Everything works … --- ## [Possible to assign Kibana feature privileges independent of Space?](https://discuss.elastic.co/t/possible-to-assign-kibana-feature-privileges-independent-of-space/374473)
**Author:** [@ATecha](https://discuss.elastic.co/u/ATecha)\ **Replies:** 1\ **Last updated:** [February 17, 2025, 11:52pm UTC](https://discuss.elastic.co/t/possible-to-assign-kibana-feature-privileges-independent-of-space/374473 "2025-02-17T23:52:45Z")
Elasticsearch and Kibana 8.17 Platinum license Is it possible to assign Kibana feature privileges independent of Spaces? Or do I need to redesign my access? For example, if I have a Developer Role, the features they'd… --- ## [Cannot update deprecated index setting mapping.source](https://discuss.elastic.co/t/cannot-update-deprecated-index-setting-mapping-source/374645)
**Author:** [@Matt\_Field](https://discuss.elastic.co/u/Matt_Field)\ **Replies:** 3\ **Last updated:** [February 17, 2025, 6:54pm UTC](https://discuss.elastic.co/t/cannot-update-deprecated-index-setting-mapping-source/374645 "2025-02-17T18:54:49Z")
Upon upgrading elasticsearch 8.17 a number of my indices have gone red. This is because they have the setting index.mapping.source.mode: "STORED" I have seen that this setting is now a premium feature as described her… --- ## [\[2025-02-11T15:35:06,661\]\[WARN \]\[o.e.h.AbstractHttpServerTransport\]](https://discuss.elastic.co/t/2025-02-11t1506-661-warn-o-e-h-abstracthttpservertransport/374371)
**Author:** [@nunex\_17](https://discuss.elastic.co/u/nunex_17)\ **Replies:** 3\ **Last updated:** [February 17, 2025, 5:21pm UTC](https://discuss.elastic.co/t/2025-02-11t1506-661-warn-o-e-h-abstracthttpservertransport/374371 "2025-02-17T17:21:39Z")
\[2025-02-11T15:35:06,661\]\[WARN \]\[o.e.h.AbstractHttpServerTransport\] \[timon\] caught exception while handling client http traffic, closing connection Netty4HttpChannel{localAddress=/ES-IP:9200, remoteAddress=/Elastalert-IP… --- ## [Registry logs don't get to elastic](https://discuss.elastic.co/t/registry-logs-dont-get-to-elastic/374647)
**Author:** [@pok\_lehbim](https://discuss.elastic.co/u/pok_lehbim)\ **Replies:** 0\ **Last updated:** [February 17, 2025, 4:13pm UTC](https://discuss.elastic.co/t/registry-logs-dont-get-to-elastic/374647 "2025-02-17T16:13:19Z")
Hi, I've been trying to get registry changes to show up in elastic but despite having everything working locally and all other logs getting sent over, all registry-related events seem to be ignored and I have nothing on … [Previous page](https://discuss.elastic.co/c/elastic-stack/81.md?page=98) [Next page](https://discuss.elastic.co/c/elastic-stack/81.md?page=100)