# Latest **URL:** https://discuss.elastic.co/latest.md?page=749 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 750 --- ## [Unable to load data from filebeat using input of AWS S3](https://discuss.elastic.co/t/unable-to-load-data-from-filebeat-using-input-of-aws-s3/327268)
**Author:** [@vivekd](https://discuss.elastic.co/u/vivekd)\ **Replies:** 4\ **Last updated:** [March 14, 2023, 3:40pm UTC](https://discuss.elastic.co/t/unable-to-load-data-from-filebeat-using-input-of-aws-s3/327268 "2023-03-14T15:40:29Z")
Hi Team, We are unable to load data from filebeat using input of AWS S3. We have followed the below article for setting the filebeat configuration. Post configuration of filebeat, Please let us know on how to create … --- ## [Thousands of services, means thousands of shards?](https://discuss.elastic.co/t/thousands-of-services-means-thousands-of-shards/327683)
**Author:** [@jtocher](https://discuss.elastic.co/u/jtocher)\ **Replies:** 0\ **Last updated:** [March 14, 2023, 3:07pm UTC](https://discuss.elastic.co/t/thousands-of-services-means-thousands-of-shards/327683 "2023-03-14T15:07:10Z")
At our organization, we have a system that has north of 1000 microservices, deployed across multiple environments. These are all instrumented with telemetry, communicating to our Elastic Stack. This past year we've migra… --- ## [SearchUI - Using autocompleteQuery with elastic search connector](https://discuss.elastic.co/t/searchui-using-autocompletequery-with-elastic-search-connector/327682)
**Author:** [@jackfrost](https://discuss.elastic.co/u/jackfrost)\ **Replies:** 0\ **Last updated:** [March 14, 2023, 3:04pm UTC](https://discuss.elastic.co/t/searchui-using-autocompletequery-with-elastic-search-connector/327682 "2023-03-14T15:04:18Z")
Im moving from using the app search connector to the elastic client connector. It seems that autocompleteQuery does not work in the Elasticsearch connector the same way it does in the app search connector. Example App… --- ## [VxLAN packet decription - packetbeat](https://discuss.elastic.co/t/vxlan-packet-decription-packetbeat/327545)
**Author:** [@mihai.radulescu](https://discuss.elastic.co/u/mihai.radulescu)\ **Replies:** 1\ **Last updated:** [March 14, 2023, 3:01pm UTC](https://discuss.elastic.co/t/vxlan-packet-decription-packetbeat/327545 "2023-03-14T15:01:06Z")
Hello, I have the same issue like Docker overlay networks I'm using AWS mirroring to send traffic from one Network Interface to another EC2 instance where I have installed ES. AWS is using VXLAN and sends the traffic o… --- ## [Dev console suddenly just a blank canvas](https://discuss.elastic.co/t/dev-console-suddenly-just-a-blank-canvas/327596)
**Author:** [@stefws](https://discuss.elastic.co/u/stefws)\ **Replies:** 4\ **Last updated:** [March 14, 2023, 2:17pm UTC](https://discuss.elastic.co/t/dev-console-suddenly-just-a-blank-canvas/327596 "2023-03-14T14:17:15Z")
Suddenly one day my Dev Tools Console v.8.6.1 on top of a v.8.6.1 cluster is just a blank canvas, don't why, hints appreciated, TIA! Was a while ago playing with ldap/AD authentication but reverted it again as basic lic… --- ## [Datastream snapshot strategy](https://discuss.elastic.co/t/datastream-snapshot-strategy/327672)
**Author:** [@YP30](https://discuss.elastic.co/u/YP30)\ **Replies:** 0\ **Last updated:** [March 14, 2023, 1:57pm UTC](https://discuss.elastic.co/t/datastream-snapshot-strategy/327672 "2023-03-14T13:57:04Z")
Hello! We're planning to set up a cluster and use a datastream to ingest our custom logs into elasticsearch. Current setup (spread out over 3 ftServers): 3x master nodes (4vCPU, 12GB RAM) 3x data nodes (4vCPU, 64GB R… --- ## [Building an index for faster search](https://discuss.elastic.co/t/building-an-index-for-faster-search/326301)
**Author:** [@orlenkoda5](https://discuss.elastic.co/u/orlenkoda5)\ **Replies:** 2\ **Last updated:** [March 14, 2023, 1:49pm UTC](https://discuss.elastic.co/t/building-an-index-for-faster-search/326301 "2023-03-14T13:49:35Z")
Hi everyone, I have one question. How should I build my index to reduce the time of searching? In my case, using aggregations for distinct search really increases the time of searching. --- ## [X509: certificate signed by unknown authority](https://discuss.elastic.co/t/x509-certificate-signed-by-unknown-authority/327572)
**Author:** [@AbbysS](https://discuss.elastic.co/u/AbbysS)\ **Replies:** 8\ **Last updated:** [March 14, 2023, 1:48pm UTC](https://discuss.elastic.co/t/x509-certificate-signed-by-unknown-authority/327572 "2023-03-14T13:48:51Z")
Hi everyone, I'm new on the forum. I'm little confuse, i try to learn many tutorials on fleet server / agent but i don't know how i can create my own certificate to deploy in production. I try to learn the ELK tutoria… --- ## [Service Metricbeat Suddenly Stop After Loaded Dashboard](https://discuss.elastic.co/t/service-metricbeat-suddenly-stop-after-loaded-dashboard/327622)
**Author:** [@Tw1cUser](https://discuss.elastic.co/u/Tw1cUser)\ **Replies:** 3\ **Last updated:** [March 14, 2023, 1:44pm UTC](https://discuss.elastic.co/t/service-metricbeat-suddenly-stop-after-loaded-dashboard/327622 "2023-03-14T13:44:12Z")
After i command .\\metricbeat setup my metricbeat service still running, but after loaded to dashboard to kibana, my metricbeat service suddenly stop, i don't know why. my config metricbeat.yml it's okay my output it's … --- ## [Indexing script with parameters into percolation field breaks in 8.5](https://discuss.elastic.co/t/indexing-script-with-parameters-into-percolation-field-breaks-in-8-5/327667)
**Author:** [@cehj](https://discuss.elastic.co/u/cehj)\ **Replies:** 0\ **Last updated:** [March 14, 2023, 1:07pm UTC](https://discuss.elastic.co/t/indexing-script-with-parameters-into-percolation-field-breaks-in-8-5/327667 "2023-03-14T13:07:26Z")
When indexing into a percolation field on a document, we submit something like: { "bool": { "filter": \[ { "script": { "script": { "sour… --- ## [Filebeat loses first lines when file rotated](https://discuss.elastic.co/t/filebeat-loses-first-lines-when-file-rotated/327655)
**Author:** [@Alexander\_A](https://discuss.elastic.co/u/Alexander_A)\ **Replies:** 0\ **Last updated:** [March 14, 2023, 12:28pm UTC](https://discuss.elastic.co/t/filebeat-loses-first-lines-when-file-rotated/327655 "2023-03-14T12:28:58Z")
We have discovered that filebeat loses first lines when file rotated. For example we use the following config to get auditbeat logs and when file rotated (auditbeat restarted) we see that first lines missing (written in… --- ## [First search Request on Elasticsearch is slow](https://discuss.elastic.co/t/first-search-request-on-elasticsearch-is-slow/327560)
**Author:** [@Rakhshunda\_Noorein\_J](https://discuss.elastic.co/u/Rakhshunda_Noorein_J)\ **Replies:** 3\ **Last updated:** [March 14, 2023, 11:41am UTC](https://discuss.elastic.co/t/first-search-request-on-elasticsearch-is-slow/327560 "2023-03-14T11:41:33Z")
Hello, Having an issue on elasticsearch, my first request to search in elastic is slow. Once any term gets searched then it becomes fast. I have researched about this and get to know the solution is to change the index … --- ## [System integration : specifying the interfaces needed](https://discuss.elastic.co/t/system-integration-specifying-the-interfaces-needed/326783)
**Author:** [@fabien9402](https://discuss.elastic.co/u/fabien9402)\ **Replies:** 1\ **Last updated:** [March 14, 2023, 10:38am UTC](https://discuss.elastic.co/t/system-integration-specifying-the-interfaces-needed/326783 "2023-03-14T10:38:30Z")
Hi, In the "System" integration of our policies we want to have the metrics of specific network interfaces. In the configuration menu, there is indeed the possibility of specifying the interfaces needed. It is specifie… --- ## [Slower Perfomance with Elaticsearch cluster in kubernetes compared to Docker](https://discuss.elastic.co/t/slower-perfomance-with-elaticsearch-cluster-in-kubernetes-compared-to-docker/325759)
**Author:** [@samdevops](https://discuss.elastic.co/u/samdevops)\ **Replies:** 12\ **Last updated:** [March 14, 2023, 10:30am UTC](https://discuss.elastic.co/t/slower-perfomance-with-elaticsearch-cluster-in-kubernetes-compared-to-docker/325759 "2023-03-14T10:30:02Z")
We are facing issues with Elasticsearch deployment resulting in response time being slower in EKS to that in Docker. In both cases, we are using AWS to provision EC2 instances. Docker consists of a single EC2 instance w… --- ## [Cannot read properties of undefined (reading 'KPIs') Getting this error when trying to built dashboard using VEGA](https://discuss.elastic.co/t/cannot-read-properties-of-undefined-reading-kpis-getting-this-error-when-trying-to-built-dashboard-using-vega/327647)
**Author:** [@Arshukla](https://discuss.elastic.co/u/Arshukla)\ **Replies:** 0\ **Last updated:** [March 14, 2023, 10:21am UTC](https://discuss.elastic.co/t/cannot-read-properties-of-undefined-reading-kpis-getting-this-error-when-trying-to-built-dashboard-using-vega/327647 "2023-03-14T10:21:59Z")
Hello team, I am getting the above mentioned error "Cannot read properties of undefined (reading 'KPIs')" when I am trying to execute below code in VEGA { "$schema": "https://vega.github.io/schema/vega/v4.17.json", … --- ## [Sorting in Lens pies](https://discuss.elastic.co/t/sorting-in-lens-pies/327436)
**Author:** [@InesCM](https://discuss.elastic.co/u/InesCM)\ **Replies:** 2\ **Last updated:** [March 14, 2023, 9:48am UTC](https://discuss.elastic.co/t/sorting-in-lens-pies/327436 "2023-03-14T09:48:50Z")
Hi there! I thought that this was an issue with Legacy (aggregation based) visualizations, but I'm seeing this in Lens too... Am I missing something, or this makes no sense? When I slice a donut chart by ranges, the co… --- ## [How to set auto-reloading conf files in logstash.yml or pipeline.yml](https://discuss.elastic.co/t/how-to-set-auto-reloading-conf-files-in-logstash-yml-or-pipeline-yml/327425)
**Author:** [@terrymu](https://discuss.elastic.co/u/terrymu)\ **Replies:** 2\ **Last updated:** [March 14, 2023, 9:39am UTC](https://discuss.elastic.co/t/how-to-set-auto-reloading-conf-files-in-logstash-yml-or-pipeline-yml/327425 "2023-03-14T09:39:51Z")
Hi All, I know here is a feature that can auto-reloading conf files without logstash restart action. So my question is easy, how to turn on auto-reloading function in logstash.yml or pipeline.yml ? I need an workin… --- ## [Spike in failed logon events ML rule alerting](https://discuss.elastic.co/t/spike-in-failed-logon-events-ml-rule-alerting/327642)
**Author:** [@Maretti](https://discuss.elastic.co/u/Maretti)\ **Replies:** 0\ **Last updated:** [March 14, 2023, 9:31am UTC](https://discuss.elastic.co/t/spike-in-failed-logon-events-ml-rule-alerting/327642 "2023-03-14T09:31:53Z")
Hi everyone I am experimenting with the ML learning rule that alerts when a spike happens in failed logon events. I did a RDP bruteforce from kali to windows in the bruteforce the password did get guessed so the host is… --- ## [Upgrade to 7.x aggregation performance degradation](https://discuss.elastic.co/t/upgrade-to-7-x-aggregation-performance-degradation/327449)
**Author:** [@dbajra94](https://discuss.elastic.co/u/dbajra94)\ **Replies:** 1\ **Last updated:** [March 14, 2023, 8:51am UTC](https://discuss.elastic.co/t/upgrade-to-7-x-aggregation-performance-degradation/327449 "2023-03-14T08:51:39Z")
We are currently in process of migrating our Cloud tenants to 7.16.3 in preparation for an internal 8.6 Elasticsearch upgrade of our software. However, we have noticed that our aggregation queries have suffered a hard un… --- ## [Issue with datastream, each similar datastream have own hidden index](https://discuss.elastic.co/t/issue-with-datastream-each-similar-datastream-have-own-hidden-index/327201)
**Author:** [@danoque](https://discuss.elastic.co/u/danoque)\ **Replies:** 5\ **Last updated:** [March 14, 2023, 8:45am UTC](https://discuss.elastic.co/t/issue-with-datastream-each-similar-datastream-have-own-hidden-index/327201 "2023-03-14T08:45:11Z")
I have issue after i configured datastream without "Component Templates". I created datastream with , so like this: "my-index-pattern-" in field "Index patterns". And then, each day elastic creats new datastream with h… --- ## [Metricbeat kept connecting to http://localhost:9200 while using AWS privatelink](https://discuss.elastic.co/t/metricbeat-kept-connecting-to-http-localhost-9200-while-using-aws-privatelink/327634)
**Author:** [@tanwk2](https://discuss.elastic.co/u/tanwk2)\ **Replies:** 0\ **Last updated:** [March 14, 2023, 8:30am UTC](https://discuss.elastic.co/t/metricbeat-kept-connecting-to-http-localhost-9200-while-using-aws-privatelink/327634 "2023-03-14T08:30:21Z")
Anyone has the same problem where the Metricbeats keep trying to connect to Elasticsearch Url: http://localhost:9200 until around 1h 30 mins later and it finds the correct Elasticsearch Url that was identified in the fle… --- ## [Monitors failed to sync with the Synthetics service](https://discuss.elastic.co/t/monitors-failed-to-sync-with-the-synthetics-service/327373)
**Author:** [@irivas95](https://discuss.elastic.co/u/irivas95)\ **Replies:** 8\ **Last updated:** [March 14, 2023, 7:47am UTC](https://discuss.elastic.co/t/monitors-failed-to-sync-with-the-synthetics-service/327373 "2023-03-14T07:47:07Z")
Hi, I know this feature is in beta but I wanted to ask if anyone has received an error similar to the one in the image and if you know what it could be due to. I am using the synthetic monitors feature from the kibana … --- ## [Failed to install APM Agent .net with Profiling Auto instrumentation](https://discuss.elastic.co/t/failed-to-install-apm-agent-net-with-profiling-auto-instrumentation/327620)
**Author:** [@zerratriani](https://discuss.elastic.co/u/zerratriani)\ **Replies:** 1\ **Last updated:** [March 14, 2023, 4:05am UTC](https://discuss.elastic.co/t/failed-to-install-apm-agent-net-with-profiling-auto-instrumentation/327620 "2023-03-14T04:05:27Z")
Hi, I am trying to install APM on a .net application using the Profiling Auto instrumentation method according to the following document: Profiler Auto instrumentation | APM .NET Agent Reference \[1.x\] | Elastic I have s… --- ## [Metricbeat on Openshift & Nginx](https://discuss.elastic.co/t/metricbeat-on-openshift-nginx/327335)
**Author:** [@Ivan\_Hosea](https://discuss.elastic.co/u/Ivan_Hosea)\ **Replies:** 2\ **Last updated:** [March 14, 2023, 3:38am UTC](https://discuss.elastic.co/t/metricbeat-on-openshift-nginx/327335 "2023-03-14T03:38:07Z")
Hi, I was wondering if there's any way to monitor nginx inside openshift service with metricbeat & filebeat. Can anyone help me with this? --- ## [Use of customized Managed ILM policies](https://discuss.elastic.co/t/use-of-customized-managed-ilm-policies/327594)
**Author:** [@Savva\_Morozov](https://discuss.elastic.co/u/Savva_Morozov)\ **Replies:** 5\ **Last updated:** [March 14, 2023, 1:44am UTC](https://discuss.elastic.co/t/use-of-customized-managed-ilm-policies/327594 "2023-03-14T01:44:19Z")
Hello! I would like to know is it safe to use customized Managed ILM policies? And can it be that after some update of the cluster that customized Managed ILM policies will be reset to default values? I've also tried … --- ## [Event Filter \* field](https://discuss.elastic.co/t/event-filter-field/325674)
**Author:** [@NathanLau](https://discuss.elastic.co/u/NathanLau)\ **Replies:** 4\ **Last updated:** [March 14, 2023, 1:12am UTC](https://discuss.elastic.co/t/event-filter-field/325674 "2023-03-14T01:12:04Z")
Hi all , The purpose is refuse receive some logs. (Endpoint) there are a lot of event on everyday , don't want to receive not meaningful logs to occupied the space , how could filter all value of \* or filter the field… --- ## [How the 'Transform API' Works](https://discuss.elastic.co/t/how-the-transform-api-works/327516)
**Author:** [@SEUNGHYO](https://discuss.elastic.co/u/SEUNGHYO)\ **Replies:** 2\ **Last updated:** [March 14, 2023, 1:00am UTC](https://discuss.elastic.co/t/how-the-transform-api-works/327516 "2023-03-14T01:00:50Z")
Hello. I was check "search \> aggregation (size=0)" and "transform \> pivot \> aggregation (\_preview)" I checked that the transform side has much fewer tooks. (Same aggs, small size set for simple comparison -\> There wa… --- ## [Disabling an integration in fleet](https://discuss.elastic.co/t/disabling-an-integration-in-fleet/327600)
**Author:** [@marcoderama](https://discuss.elastic.co/u/marcoderama)\ **Replies:** 0\ **Last updated:** [March 13, 2023, 10:00pm UTC](https://discuss.elastic.co/t/disabling-an-integration-in-fleet/327600 "2023-03-13T22:00:58Z")
I'm testing various agent policy incantations within fleet so I have a bunch of them now. As such, I have more going on at once than I'd like. It would be useful if I could mark an agent policy as "disabled" within fle… --- ## [Extract stored field in elasticsearch document using start and end offset](https://discuss.elastic.co/t/extract-stored-field-in-elasticsearch-document-using-start-and-end-offset/327598)
**Author:** [@Ancel](https://discuss.elastic.co/u/Ancel)\ **Replies:** 0\ **Last updated:** [March 13, 2023, 9:43pm UTC](https://discuss.elastic.co/t/extract-stored-field-in-elasticsearch-document-using-start-and-end-offset/327598 "2023-03-13T21:43:30Z")
Hi all, I am seeking some pointers. Given the start and end offsets of text within a document field (e.g. as provided by the termvectors API), I would like to extract the stored text between those offsets. This text was … --- ## [Cannot restore index \[.security-7\]](https://discuss.elastic.co/t/cannot-restore-index-security-7/327473)
**Author:** [@Verdugo\_Gonzalo](https://discuss.elastic.co/u/Verdugo_Gonzalo)\ **Replies:** 6\ **Last updated:** [March 13, 2023, 9:39pm UTC](https://discuss.elastic.co/t/cannot-restore-index-security-7/327473 "2023-03-13T21:39:19Z")
Hello everyone, I'm trying to migrate all my users from my old 7.9 cluster to a new 8.5 cluster. I was reviewing the documentation and proceeded to take a snapshot of the security indexes of my old cluster to be able t… [Previous page](https://discuss.elastic.co/latest.md?page=748) [Next page](https://discuss.elastic.co/latest.md?page=750)