# Top **URL:** https://discuss.elastic.co/top.md?page=1 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 2 --- ## [Alerting on field value change](https://discuss.elastic.co/t/alerting-on-field-value-change/383451)
**Author:** [@mohsin106](https://discuss.elastic.co/u/mohsin106)\ **Replies:** 12\ **Last updated:** [November 16, 2025, 1:10pm UTC](https://discuss.elastic.co/t/alerting-on-field-value-change/383451 "2025-11-16T13:10:12Z")
I’m currently logging on-change data in ES, and I’m running a latest transform to store the most updated data into a separate index. I was advised that an ingest pipeline will help me compare any value coming in with th… --- ## [Filebeat now processor seams to be buggy](https://discuss.elastic.co/t/filebeat-now-processor-seams-to-be-buggy/389776)
**Author:** [@Toony](https://discuss.elastic.co/u/Toony)\ **Replies:** 14\ **Last updated:** [August 20, 2026, 12:15pm UTC](https://discuss.elastic.co/t/filebeat-now-processor-seams-to-be-buggy/389776 "2026-08-20T12:15:47Z")
Hi, It seems the now processor behaves strangely If I set a now processor in filebeat at the top yaml level like this: processors: - now: field: metadata.timeline.t1 and configure Logstash like this: input {… --- ## [S3 compatible storage are not able to mounted for snapshot](https://discuss.elastic.co/t/s3-compatible-storage-are-not-able-to-mounted-for-snapshot/386444)
**Author:** [@Rajesh\_Kannan](https://discuss.elastic.co/u/Rajesh_Kannan)\ **Replies:** 11\ **Last updated:** [May 27, 2026, 11:05am UTC](https://discuss.elastic.co/t/s3-compatible-storage-are-not-able-to-mounted-for-snapshot/386444 "2026-05-27T11:05:50Z")
We are trying to mount the s3 storage( S3 compatible DataCore (caringo)) bucket on elastic 9.3.0 using the below command and we are getting "s3\_exception: A header you provided implies functionality that is not implement… --- ## [.geoip\_database index created in es7 prevents es9 upgrade](https://discuss.elastic.co/t/geoip-database-index-created-in-es7-prevents-es9-upgrade/388618)
**Author:** [@manick02](https://discuss.elastic.co/u/manick02)\ **Replies:** 14\ **Last updated:** [July 24, 2026, 6:22am UTC](https://discuss.elastic.co/t/geoip-database-index-created-in-es7-prevents-es9-upgrade/388618 "2026-07-24T06:22:49Z")
We follow an es upgrade approach where we reindex the index on every major version upgrade. We noticed during our es9 upgrade from es8, there is a system index .geoip\_database which was created in es7 is not allowing es… --- ## [Loghstash service is not getting started going in continues restart having error: Logstash stopped processing because of an error: (NoMethodError) private method \`run' called for #\](https://discuss.elastic.co/t/loghstash-service-is-not-getting-started-going-in-continues-restart-having-error-logstash-stopped-processing-because-of-an-error-nomethoderror-private-method-run-called-for-logstash-0x32a806ef/386799)
**Author:** [@ashish.jagtap](https://discuss.elastic.co/u/ashish.jagtap)\ **Replies:** 15\ **Last updated:** [June 12, 2026, 6:47am UTC](https://discuss.elastic.co/t/loghstash-service-is-not-getting-started-going-in-continues-restart-having-error-logstash-stopped-processing-because-of-an-error-nomethoderror-private-method-run-called-for-logstash-0x32a806ef/386799 "2026-06-12T06:47:06Z")
loghstash service is not getting started going in continues restart. Error: Logstash stopped processing because of an error: (NoMethodError) private method run' called for #\ Jun 10 16:15:03… --- ## [Kibana does not load in brower](https://discuss.elastic.co/t/kibana-does-not-load-in-brower/385546)
**Author:** [@riahc3](https://discuss.elastic.co/u/riahc3)\ **Replies:** 9\ **Last updated:** [May 12, 2026, 2:00pm UTC](https://discuss.elastic.co/t/kibana-does-not-load-in-brower/385546 "2026-05-12T14:00:17Z")
Hello I upgraded Kibana 8 to 9 (obviously everything else) but it does not load in my browser. I see this in the logs: tail -f /data/kibana/logs/kibana.log | jq { "service": { "node": { "roles": \[ "background\_tasks… --- ## [Not all logs from strongswan available](https://discuss.elastic.co/t/not-all-logs-from-strongswan-available/387402)
**Author:** [@leprovokateur](https://discuss.elastic.co/u/leprovokateur)\ **Replies:** 11\ **Last updated:** [July 1, 2026, 9:58am UTC](https://discuss.elastic.co/t/not-all-logs-from-strongswan-available/387402 "2026-07-01T09:58:49Z")
Hi, I have StrongSwan installed on a debian 13 machine. The logs are written to the journal. I use elastic-agent in version 9.3.3 trying to read this logs, the stack is in version 9.3.3, too. journalctl -u strongswan sh… --- ## [Parent data too large?](https://discuss.elastic.co/t/parent-data-too-large/385254)
**Author:** [@linkerc](https://discuss.elastic.co/u/linkerc)\ **Replies:** 12\ **Last updated:** [March 5, 2026, 10:21am UTC](https://discuss.elastic.co/t/parent-data-too-large/385254 "2026-03-05T10:21:45Z")
I am getting the below error on a shard assignment. org.elasticsearch.common.breaker.CircuitBreakingException: \[parent\] Data too large, data for \[internal:index/shard/recovery/translog\_ops\] would be \[28701173408/26.7gb\]… --- ## [Long-term snapshot compatibility across major versions (10+ year archive use case)](https://discuss.elastic.co/t/long-term-snapshot-compatibility-across-major-versions-10-year-archive-use-case/385068)
**Author:** [@jiriNovotny](https://discuss.elastic.co/u/jiriNovotny)\ **Replies:** 9\ **Last updated:** [February 16, 2026, 8:01pm UTC](https://discuss.elastic.co/t/long-term-snapshot-compatibility-across-major-versions-10-year-archive-use-case/385068 "2026-02-16T20:01:31Z")
Hello, I’m looking for clarification regarding the functionality described in the documentation about reading indices from older Elasticsearch versions: Currently, our process is as follows: We store indices as sna… --- ## [Logstash.outputs.elasticsearch - Failed to perform request: Connection refused](https://discuss.elastic.co/t/logstash-outputs-elasticsearch-failed-to-perform-request-connection-refused/385421)
**Author:** [@JimJ](https://discuss.elastic.co/u/JimJ)\ **Replies:** 11\ **Last updated:** [March 20, 2026, 1:25pm UTC](https://discuss.elastic.co/t/logstash-outputs-elasticsearch-failed-to-perform-request-connection-refused/385421 "2026-03-20T13:25:13Z")
I am using an on-prem 8.11.3 elastic+logstash stack. logstash uses elasticsearch output plugin to post events to elastic. current set-up uses 2 servers. elasticsearch { hosts =\> \[ "srv1:9200", "srv2:9200" \] data\_str… --- ## [Kibana memory consumption growing linearly until it crashes](https://discuss.elastic.co/t/kibana-memory-consumption-growing-linearly-until-it-crashes/383618)
**Author:** [@Fabio\_Hecht](https://discuss.elastic.co/u/Fabio_Hecht)\ **Replies:** 14\ **Last updated:** [December 17, 2025, 7:23am UTC](https://discuss.elastic.co/t/kibana-memory-consumption-growing-linearly-until-it-crashes/383618 "2025-12-17T07:23:24Z")
Hi there! I have an issue with a simple Elastic / Kibana deployment on OpenShift. Even with no data being ingested in Elastic and virtually no users (just me testing), Kibana’s memory consumption grows linearly until the… --- ## [\_DataId Health Monitoring](https://discuss.elastic.co/t/dataid-health-monitoring/385914)
**Author:** [@saratsekhar](https://discuss.elastic.co/u/saratsekhar)\ **Replies:** 12\ **Last updated:** [April 22, 2026, 6:45am UTC](https://discuss.elastic.co/t/dataid-health-monitoring/385914 "2026-04-22T06:45:46Z")
Looking to build a logic which alerts whenever there is a log stoppage detected on Elastic through \_dataId. I appreciate any suggestions here. --- ## [Troubleshooting performance and load](https://discuss.elastic.co/t/troubleshooting-performance-and-load/385292)
**Author:** [@Whoami1980](https://discuss.elastic.co/u/Whoami1980)\ **Replies:** 16\ **Last updated:** [March 5, 2026, 7:23am UTC](https://discuss.elastic.co/t/troubleshooting-performance-and-load/385292 "2026-03-05T07:23:57Z")
Is there a centralise repository or knowledge base that we can start for general troubelshooting. For scenrios not limiting to below. Elastic fleet server Health Check. What are the things to watch out for? Overlo… --- ## [Field \_size on data stream](https://discuss.elastic.co/t/field-size-on-data-stream/384982)
**Author:** [@Cristina\_Marletta\_Li](https://discuss.elastic.co/u/Cristina_Marletta_Li)\ **Replies:** 15\ **Last updated:** [February 18, 2026, 10:18am UTC](https://discuss.elastic.co/t/field-size-on-data-stream/384982 "2026-02-18T10:18:30Z")
Hi,I'd like to set the \_size field on a data stream associated with an integration. How can I do this? The data stream has a custom index template associated with it: GET \_index\_template/logs-thales\_udp.log-custom { "… --- ## [Logstash - %{+YYYY} returns a year two years behind around year boundary – how is this possible?](https://discuss.elastic.co/t/logstash-yyyy-returns-a-year-two-years-behind-around-year-boundary-how-is-this-possible/384359)
**Author:** [@josh\_tran](https://discuss.elastic.co/u/josh_tran)\ **Replies:** 12\ **Last updated:** [January 15, 2026, 9:46am UTC](https://discuss.elastic.co/t/logstash-yyyy-returns-a-year-two-years-behind-around-year-boundary-how-is-this-possible/384359 "2026-01-15T09:46:00Z")
I have a Logstash pipeline where I build a timestamp string manually and then parse it into event.timestamp because we do not have a year value in the log message, there are just day and month in the file name. Environm… --- ## [New ELK 9.x cluster and Kibana HA](https://discuss.elastic.co/t/new-elk-9-x-cluster-and-kibana-ha/383780)
**Author:** [@d.silwon](https://discuss.elastic.co/u/d.silwon)\ **Replies:** 13\ **Last updated:** [December 15, 2025, 1:19pm UTC](https://discuss.elastic.co/t/new-elk-9-x-cluster-and-kibana-ha/383780 "2025-12-15T13:19:19Z")
Dears, I need your advice on installing a new ELK 9.x cluster. The cluster will be set up on VMs in the following configuration: 3 x MASTER node 8 x DATA node 2 x Kibana node 2 x Logstash node If I configure two se… --- ## [Courses on Elastic.Clients.Elasticsearch](https://discuss.elastic.co/t/courses-on-elastic-clients-elasticsearch/386125)
**Author:** [@xef](https://discuss.elastic.co/u/xef)\ **Replies:** 12\ **Last updated:** [June 15, 2026, 1:27pm UTC](https://discuss.elastic.co/t/courses-on-elastic-clients-elasticsearch/386125 "2026-06-15T13:27:55Z")
We need to upgrade from NEST to the new API and are DESPARATELY looking for courses (paid or unpaid) to guide us through this process. Can anyone help? Thanks --- ## [Filebeat Event Publishing Delay to Kafka](https://discuss.elastic.co/t/filebeat-event-publishing-delay-to-kafka/385064)
**Author:** [@Thirupathi](https://discuss.elastic.co/u/Thirupathi)\ **Replies:** 9\ **Last updated:** [February 24, 2026, 8:52am UTC](https://discuss.elastic.co/t/filebeat-event-publishing-delay-to-kafka/385064 "2026-02-24T08:52:30Z")
From the logs, we can see that the logger timestamp indicates a noticeable time gap between event processing and event publishing to Kafka. Due to this delay, events are not being pushed to Kafka in real-time as expected… --- ## [High sustained read traffic from Elasticsearch hot pods](https://discuss.elastic.co/t/high-sustained-read-traffic-from-elasticsearch-hot-pods/385508)
**Author:** [@cjpowers](https://discuss.elastic.co/u/cjpowers)\ **Replies:** 16\ **Last updated:** [April 14, 2026, 1:40pm UTC](https://discuss.elastic.co/t/high-sustained-read-traffic-from-elasticsearch-hot-pods/385508 "2026-04-14T13:40:32Z")
I’m running an EFK stack in an RKE2 cluster on RHEL 8.5. The VMs are hosted in vSphere and use centralized NetApp storage. Our Elasticsearch footprint currently looks like this: 2 master nodes 2 client nodes 2 hot da… --- ## [Kibana 9.3.1 dashboard loads slow](https://discuss.elastic.co/t/kibana-9-3-1-dashboard-loads-slow/387206)
**Author:** [@mittal\_rawal](https://discuss.elastic.co/u/mittal_rawal)\ **Replies:** 9\ **Last updated:** [June 25, 2026, 2:18pm UTC](https://discuss.elastic.co/t/kibana-9-3-1-dashboard-loads-slow/387206 "2026-06-25T14:18:38Z")
Hi Team, i have recently migrated elk from 8.16 to 9.3.1 i notice slowness in dashboard load. time take to loads 1-2 minutes for all panels in dashboard i want to load that within 10sec below i am sharing my cluster d… --- ## [Kibana Index Pattern Configuration Problem](https://discuss.elastic.co/t/kibana-index-pattern-configuration-problem/386854)
**Author:** [@Pacous](https://discuss.elastic.co/u/Pacous)\ **Replies:** 12\ **Last updated:** [June 19, 2026, 6:00pm UTC](https://discuss.elastic.co/t/kibana-index-pattern-configuration-problem/386854 "2026-06-19T18:00:59Z")
I configured Logstash as follows: input { file { path =\> "/var/log/apache2/access.log" } } filter { grok { match =\> { "message" =\> "%{COMBINEDAPACHELOG}" } } date { match =\> \[ "timestamp", "dd/MMM/yyyy:HH:mm:ss Z"… --- ## [Can not modify my fleet server and agent configuration on ECK](https://discuss.elastic.co/t/can-not-modify-my-fleet-server-and-agent-configuration-on-eck/384265)
**Author:** [@NiceAgent](https://discuss.elastic.co/u/NiceAgent)\ **Replies:** 12\ **Last updated:** [December 30, 2025, 3:42am UTC](https://discuss.elastic.co/t/can-not-modify-my-fleet-server-and-agent-configuration-on-eck/384265 "2025-12-30T03:42:12Z")
I deployed eck-operator on my microk8s system. Then I used eck-operator to deploy Elasticsearch and Kibana. Next, I wanted to deploy Fleet and its agent. I added the configuration to Kibana (as shown in Figure 1). A… --- ## [Syncing Tables from Microsoft SQL Server to Elastic using Logstash](https://discuss.elastic.co/t/syncing-tables-from-microsoft-sql-server-to-elastic-using-logstash/386309)
**Author:** [@Mevevlin](https://discuss.elastic.co/u/Mevevlin)\ **Replies:** 9\ **Last updated:** [May 15, 2026, 12:23am UTC](https://discuss.elastic.co/t/syncing-tables-from-microsoft-sql-server-to-elastic-using-logstash/386309 "2026-05-15T00:23:14Z")
I'm trying to sync my SQL server database to my elasticsearch database. I've got the following input setup now: input { jdbc { jdbc\_driver\_library =\> "/usr/share/logstash/drivers/mssql-jdbc.jre8.jar" jdbc\_driv… --- ## [AWS integration 7.1 fleet agent bug or UI glitch](https://discuss.elastic.co/t/aws-integration-7-1-fleet-agent-bug-or-ui-glitch/388899)
**Author:** [@stanley783](https://discuss.elastic.co/u/stanley783)\ **Replies:** 10\ **Last updated:** [July 30, 2026, 3:01pm UTC](https://discuss.elastic.co/t/aws-integration-7-1-fleet-agent-bug-or-ui-glitch/388899 "2026-07-30T15:01:48Z")
Recently upgraded ELK cluster from 9.3.2 to 9.4.4. On older version had AWS integration of version 6.20, on new cluster upgraded it to 7.1 latest. Prior to upgrade, we had 1 Elastic agent with this integration 6.2 (agent… --- ## [Filebeat OOM (Out Of Memory) Error](https://discuss.elastic.co/t/filebeat-oom-out-of-memory-error/383768)
**Author:** [@Thirupathi](https://discuss.elastic.co/u/Thirupathi)\ **Replies:** 9\ **Last updated:** [December 12, 2025, 7:25am UTC](https://discuss.elastic.co/t/filebeat-oom-out-of-memory-error/383768 "2025-12-12T07:25:47Z")
harvester\_buffer\_size: 5368709120 message\_max\_bytes: 5368709120 multiline.max\_lines: 5368709120 i configured above configuration in filebet after am getting below issue mp":"2025-11-30T05:04:30.546-0500","log.logger":"… --- ## [FSCrawler 2.10-SNAPSHOT not indexing PDF content](https://discuss.elastic.co/t/fscrawler-2-10-snapshot-not-indexing-pdf-content/384593)
**Author:** [@DaManDOH](https://discuss.elastic.co/u/DaManDOH)\ **Replies:** 11\ **Last updated:** [January 22, 2026, 12:33am UTC](https://discuss.elastic.co/t/fscrawler-2-10-snapshot-not-indexing-pdf-content/384593 "2026-01-22T00:33:45Z")
TL;DR: Under a full ES v9.2 stack running under Docker Compose, FSCrawler v2.10-SNAPSHOT only returns TesseractOCRParser timeout errors when trying to ingest any PDFs. Full details I’m currently building a local Elasti… --- ## [Filebeat occasionally loses logs: Dropping event: no topic could be selected (Kubernetes + Kafka)](https://discuss.elastic.co/t/filebeat-occasionally-loses-logs-dropping-event-no-topic-could-be-selected-kubernetes-kafka/383685)
**Author:** [@ruizengyang](https://discuss.elastic.co/u/ruizengyang)\ **Replies:** 9\ **Last updated:** [December 8, 2025, 4:01pm UTC](https://discuss.elastic.co/t/filebeat-occasionally-loses-logs-dropping-event-no-topic-could-be-selected-kubernetes-kafka/383685 "2025-12-08T16:01:51Z")
Hi everyone, I’ve been troubleshooting an issue for the last few days and would like to confirm whether this behavior is expected or if there is a workaround. Problem When Filebeat starts on a Kubernetes node (DaemonS… --- ## [ILMs in cluster not performing rollover when conditions are met](https://discuss.elastic.co/t/ilms-in-cluster-not-performing-rollover-when-conditions-are-met/383369)
**Author:** [@Natalia\_Mellino](https://discuss.elastic.co/u/Natalia_Mellino)\ **Replies:** 9\ **Last updated:** [November 18, 2025, 6:30pm UTC](https://discuss.elastic.co/t/ilms-in-cluster-not-performing-rollover-when-conditions-are-met/383369 "2025-11-18T18:30:29Z")
Hello! We have an Elasticsearch cluster running 8.19.3 version (master, hot, cold and coordinating nodes) and we’re seeing some issues regarding our ILM policies. We are using data streams so we’ve configured several IL… --- ## [Apm data timestamps wrong =\> high load and slow responses](https://discuss.elastic.co/t/apm-data-timestamps-wrong-high-load-and-slow-responses/387329)
**Author:** [@nb71](https://discuss.elastic.co/u/nb71)\ **Replies:** 13\ **Last updated:** [June 30, 2026, 2:41pm UTC](https://discuss.elastic.co/t/apm-data-timestamps-wrong-high-load-and-slow-responses/387329 "2026-06-30T14:41:12Z")
We have an Elastic Cloud installation running version 9.4.0. Overall, it is quite heavily loaded. We have multiple dashboards that use APM and RUM data. We started noticing that the dashboards were becoming slower and … --- ## [Need help with Visualisation - highest percentage of PQ current size FOR THE LAST 60 mins](https://discuss.elastic.co/t/need-help-with-visualisation-highest-percentage-of-pq-current-size-for-the-last-60-mins/385462)
**Author:** [@Whoami1980](https://discuss.elastic.co/u/Whoami1980)\ **Replies:** 15\ **Last updated:** [March 19, 2026, 9:10am UTC](https://discuss.elastic.co/t/need-help-with-visualisation-highest-percentage-of-pq-current-size-for-the-last-60-mins/385462 "2026-03-19T09:10:15Z")
We need help in the following. This is what we have configure below. However how can we see the top 10 records in a table ORDER BY highest percentage of PQ current size FOR THE LAST 60 mins Data View Records host.hos… --- ## [Problems with displaying the map in the dashboard](https://discuss.elastic.co/t/problems-with-displaying-the-map-in-the-dashboard/382771)
**Author:** [@Alberto\_Russo](https://discuss.elastic.co/u/Alberto_Russo)\ **Replies:** 11\ **Last updated:** [October 24, 2025, 3:06am UTC](https://discuss.elastic.co/t/problems-with-displaying-the-map-in-the-dashboard/382771 "2025-10-24T03:06:38Z")
I installed the official Elastic integration to collect 365 logs. Using the dashboard that provides the integration, I see nothing in the map section (see image). Has anyone encountered this issue? Or does anyone know ho… --- ## [Elastic Agent 9.1.3 – system\_audit.package on Rocky Linux 9.6 – no DNF install/remove events](https://discuss.elastic.co/t/elastic-agent-9-1-3-system-audit-package-on-rocky-linux-9-6-no-dnf-install-remove-events/383289)
**Author:** [@vasek](https://discuss.elastic.co/u/vasek)\ **Replies:** 9\ **Last updated:** [November 11, 2025, 1:28pm UTC](https://discuss.elastic.co/t/elastic-agent-9-1-3-system-audit-package-on-rocky-linux-9-6-no-dnf-install-remove-events/383289 "2025-11-11T13:28:10Z")
Hi, I’m trying to collect package installation/removal events using the system\_audit.package stream on Rocky Linux 9.6. I’m running Elastic Agent 9.1.3 (elastic-agent-complete) in a Podman container. image: \`\`docker.e… --- ## [Primary shards for search](https://discuss.elastic.co/t/primary-shards-for-search/384310)
**Author:** [@Elastic04](https://discuss.elastic.co/u/Elastic04)\ **Replies:** 10\ **Last updated:** [January 20, 2026, 5:56am UTC](https://discuss.elastic.co/t/primary-shards-for-search/384310 "2026-01-20T05:56:30Z")
I a currently using 3 primary shards and 2 replica shards. How reducing number of primary shards affects search and what’s the impact on cluster? --- ## [Output in kibana not expected](https://discuss.elastic.co/t/output-in-kibana-not-expected/383888)
**Author:** [@DOkuwa](https://discuss.elastic.co/u/DOkuwa)\ **Replies:** 10\ **Last updated:** [December 9, 2025, 3:13pm UTC](https://discuss.elastic.co/t/output-in-kibana-not-expected/383888 "2025-12-09T15:13:39Z")
i use filebeat to parse a json file and the expected output is showing all the fields in the different lines and not as one document This the input file { "source": "10.200.10.1:57500", "subscription-name": "defau… --- ## [Http port 9200 behind Citrix ADC loadbalancing](https://discuss.elastic.co/t/http-port-9200-behind-citrix-adc-loadbalancing/385721)
**Author:** [@stefws](https://discuss.elastic.co/u/stefws)\ **Replies:** 12\ **Last updated:** [April 1, 2026, 5:18pm UTC](https://discuss.elastic.co/t/http-port-9200-behind-citrix-adc-loadbalancing/385721 "2026-04-01T17:18:34Z")
Trying desperately to avoid our Citrix ADC health monitoring of elasticsearch https port 9200 backend services from seeing LB monitoring traffic as plain text and thus avoid log error events like: received plaintext htt… --- ## [Are date indexes not allowed anymore?](https://discuss.elastic.co/t/are-date-indexes-not-allowed-anymore/383941)
**Author:** [@ethrbunny](https://discuss.elastic.co/u/ethrbunny)\ **Replies:** 10\ **Last updated:** [December 11, 2025, 6:31pm UTC](https://discuss.elastic.co/t/are-date-indexes-not-allowed-anymore/383941 "2025-12-11T18:31:56Z")
My indexes are created from a template as ‘name-year.month.date’. It seems that this isn’t acceptable for index-lifecycle-policies anymore. I get this error “index name \[name-2025.12.09\] does not match pattern '^.\*-\\d+$'… --- ## [PII security with Elastic.Clients.Elasticsearch 9.2.1](https://discuss.elastic.co/t/pii-security-with-elastic-clients-elasticsearch-9-2-1/383609)
**Author:** [@Davyd\_McColl](https://discuss.elastic.co/u/Davyd_McColl)\ **Replies:** 10\ **Last updated:** [November 26, 2025, 3:09pm UTC](https://discuss.elastic.co/t/pii-security-with-elastic-clients-elasticsearch-9-2-1/383609 "2025-11-26T15:09:06Z")
Good day I’m not sure if I’m posting this in the right place, but here goes. I’m trying to implement an ES index with an object that has mainly numeric fields, and some text fields. I want to be able to search by any f… --- ## [Logstash 8.9.0: How to match messages containing words starting with "sap" (e.g., sapxxx) using a filter?](https://discuss.elastic.co/t/logstash-8-9-0-how-to-match-messages-containing-words-starting-with-sap-e-g-sapxxx-using-a-filter/383889)
**Author:** [@Pan\_Vad](https://discuss.elastic.co/u/Pan_Vad)\ **Replies:** 11\ **Last updated:** [December 8, 2025, 1:18pm UTC](https://discuss.elastic.co/t/logstash-8-9-0-how-to-match-messages-containing-words-starting-with-sap-e-g-sapxxx-using-a-filter/383889 "2025-12-08T13:18:45Z")
Could you please help me with a Logstash filter pipeline configuration that can catch messages of the following type: \<30\>Dec 5 15:01:05 saphcmdevdb systemd\[1\]: snapperd.service: Deactivated successfully. I need to d… --- ## [Elasticsearch data encryption](https://discuss.elastic.co/t/elasticsearch-data-encryption/388100)
**Author:** [@Kesavan](https://discuss.elastic.co/u/Kesavan)\ **Replies:** 10\ **Last updated:** [July 13, 2026, 10:17am UTC](https://discuss.elastic.co/t/elasticsearch-data-encryption/388100 "2026-07-13T10:17:42Z")
HI Everyone, Currently i am using elastic 7.17.5 along with spring boot. Index creation and data save and retrieval is happening via Java only. Below is my requirement, I need to have a data saved in the Elasticsearch… --- ## [Logstash file output - pipeline stop working after flush error](https://discuss.elastic.co/t/logstash-file-output-pipeline-stop-working-after-flush-error/383505)
**Author:** [@Po-temkin](https://discuss.elastic.co/u/Po-temkin)\ **Replies:** 9\ **Last updated:** [December 1, 2025, 12:35pm UTC](https://discuss.elastic.co/t/logstash-file-output-pipeline-stop-working-after-flush-error/383505 "2025-12-01T12:35:21Z")
Have a nice day everyone. Not long ago, I started to notice missing syslog logs from random host groups. At first, I simply restarted our Logstash nodes that act as syslog forwarders, and the problem went away. But ov… --- ## [Does "Serverless" mean it cant be used on self hosted intances?](https://discuss.elastic.co/t/does-serverless-mean-it-cant-be-used-on-self-hosted-intances/385267)
**Author:** [@ItsMeBrille](https://discuss.elastic.co/u/ItsMeBrille)\ **Replies:** 11\ **Last updated:** [March 2, 2026, 7:38pm UTC](https://discuss.elastic.co/t/does-serverless-mean-it-cant-be-used-on-self-hosted-intances/385267 "2026-03-02T19:38:56Z")
Does the "Serverless" tag mean I can’t use those services on self hosted intances? I want to connect to the MCP endpoint /api/agent\_builder/mcp, but it says the docs have the “tag” Serverless. Does this mean I cannot … --- ## [Logstash not reading log files from Windows network share folder](https://discuss.elastic.co/t/logstash-not-reading-log-files-from-windows-network-share-folder/384144)
**Author:** [@dalal404](https://discuss.elastic.co/u/dalal404)\ **Replies:** 10\ **Last updated:** [December 19, 2025, 12:14pm UTC](https://discuss.elastic.co/t/logstash-not-reading-log-files-from-windows-network-share-folder/384144 "2025-12-19T12:14:47Z")
Hello, I am running Logstash 9.1.2 on Windows Server 2019, and i am trying to read logs from a network share folder - //MACHINE-1/folder$/somedir/star\*/some\*star.log ( read the “star” as star character ). But it doesnt… --- ## [How to display case and single products together in search results](https://discuss.elastic.co/t/how-to-display-case-and-single-products-together-in-search-results/383549)
**Author:** [@Elastic04](https://discuss.elastic.co/u/Elastic04)\ **Replies:** 11\ **Last updated:** [November 20, 2025, 2:26pm UTC](https://discuss.elastic.co/t/how-to-display-case-and-single-products-together-in-search-results/383549 "2025-11-20T14:26:13Z")
We have a usecase to display case and single products next to each other in search results. How can I achieve this? --- ## [Some Artifactory logs parsed by Logstash grok, others indexed but fields not visible in Kibana](https://discuss.elastic.co/t/some-artifactory-logs-parsed-by-logstash-grok-others-indexed-but-fields-not-visible-in-kibana/384341)
**Author:** [@Pratiksha\_Desai](https://discuss.elastic.co/u/Pratiksha_Desai)\ **Replies:** 9\ **Last updated:** [January 4, 2026, 5:43am UTC](https://discuss.elastic.co/t/some-artifactory-logs-parsed-by-logstash-grok-others-indexed-but-fields-not-visible-in-kibana/384341 "2026-01-04T05:43:40Z")
Hello Team, I am ingesting multiple Artifactory log types through Filebeat → Logstash → Elasticsearch, but I am facing an issue where only some log lines are parsed correctly, while others are indexed without parsed fie… --- ## [Search is very slow in multilingual setup](https://discuss.elastic.co/t/search-is-very-slow-in-multilingual-setup/383666)
**Author:** [@manohar\_chowdary](https://discuss.elastic.co/u/manohar_chowdary)\ **Replies:** 9\ **Last updated:** [November 26, 2025, 10:53am UTC](https://discuss.elastic.co/t/search-is-very-slow-in-multilingual-setup/383666 "2025-11-26T10:53:53Z")
Hello, We currently have english, french, spanish and 7 other languages supported in search and search has become too slow now, even sometimes it timeout, one of bottle necks i think is to do with multilingual support ,… --- ## [Elasticsearch MCP Server for 5.x 6.x 7.x 8.x 9.x](https://discuss.elastic.co/t/elasticsearch-mcp-server-for-5-x-6-x-7-x-8-x-9-x/384705)
**Author:** [@azmatjan139](https://discuss.elastic.co/u/azmatjan139)\ **Replies:** 0\ **Last updated:** [January 23, 2026, 6:55am UTC](https://discuss.elastic.co/t/elasticsearch-mcp-server-for-5-x-6-x-7-x-8-x-9-x/384705 "2026-01-23T06:55:47Z")
Elasticsearch MCP Server: Complete Cluster Management Through Natural Language Background Elasticsearch 9.2 introduced native MCP (Model Context Protocol) support, enabling direct integration with AI assistants like Clau… --- ## [🎉 What’s new in Elastic 9.3](https://discuss.elastic.co/t/what-s-new-in-elastic-9-3/384891)
**Author:** [@piotrprz](https://discuss.elastic.co/u/piotrprz)\ **Replies:** 0\ **Last updated:** [February 3, 2026, 5:21pm UTC](https://discuss.elastic.co/t/what-s-new-in-elastic-9-3/384891 "2026-02-03T17:21:25Z")
:tada: What’s new in Elastic 9.3 Elastic 9.3 builds on the features introduced in 9.2 and focuses largely on making them easier and more predictable to run in production: better automation primitives, faster analytics… --- ## [Dec 21st, 2025: \[EN\] Analyzing traces in Discover faster and clearer](https://discuss.elastic.co/t/dec-21st-2025-en-analyzing-traces-in-discover-faster-and-clearer/383615)
**Author:** [@irene\_blanco](https://discuss.elastic.co/u/irene_blanco)\ **Replies:** 0\ **Last updated:** [December 21, 2025, 8:00am UTC](https://discuss.elastic.co/t/dec-21st-2025-en-analyzing-traces-in-discover-faster-and-clearer/383615 "2025-12-21T08:00:30Z")
Este artículo está disponible en Español. Analyzing traces in Discover faster and clearer Having trouble with slow endpoints and not sure where to start? Now in Discover, when the Solution View of the space is set t… --- ## [🎉 What’s new in Elastic 9.2](https://discuss.elastic.co/t/what-s-new-in-elastic-9-2/383071)
**Author:** [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Replies:** 0\ **Last updated:** [October 29, 2025, 11:25am UTC](https://discuss.elastic.co/t/what-s-new-in-elastic-9-2/383071 "2025-10-29T11:25:38Z")
:tada: What’s new in Elastic 9.2 Learn about Elastic 9.2 with Agent Builder, DiskBBQ, Streams, Significant Events, and more. Note that some of those new features are in tech preview and hidden by default but there a… --- ## [🎉 What’s new in Elastic 9.4](https://discuss.elastic.co/t/what-s-new-in-elastic-9-4/386175)
**Author:** [@dadoonet](https://discuss.elastic.co/u/dadoonet)\ **Replies:** 0\ **Last updated:** [May 5, 2026, 4:31pm UTC](https://discuss.elastic.co/t/what-s-new-in-elastic-9-4/386175 "2026-05-05T16:31:00Z")
:tada: What’s new in Elastic 9.4 Elastic 9.4 continues to reinforce the Elasticsearch Platform's role as the context and retrieval layer for AI workloads, while dramatically expanding its capabilities in metrics and t… [Previous page](https://discuss.elastic.co/top.md?per_page=50) [Next page](https://discuss.elastic.co/top.md?page=2&per_page=50)