# Top **URL:** https://discuss.elastic.co/top.md?page=11 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 12 --- ## [Elastic Cloud on Kubernetes 3.5.0 Security Update (ESA-2026-146)](https://discuss.elastic.co/t/elastic-cloud-on-kubernetes-3-5-0-security-update-esa-2026-146/390106)
**Author:** [@Bryan\_Garcia](https://discuss.elastic.co/u/Bryan_Garcia)\ **Replies:** 0\ **Last updated:** [September 1, 2026, 10:32pm UTC](https://discuss.elastic.co/t/elastic-cloud-on-kubernetes-3-5-0-security-update-esa-2026-146/390106 "2026-09-01T22:32:05Z")
Incomplete Cleanup in Elastic Cloud on Kubernetes Leading to Unauthorized Cross-Namespace Credential Retention Incomplete Cleanup (CWE-459) in Elastic Cloud on Kubernetes (ECK) can lead to unauthorized access via Privil… --- ## [Kibana download relevant files](https://discuss.elastic.co/t/kibana-download-relevant-files/382843)
**Author:** [@kucerp21](https://discuss.elastic.co/u/kucerp21)\ **Replies:** 8\ **Last updated:** [October 20, 2025, 10:07pm UTC](https://discuss.elastic.co/t/kibana-download-relevant-files/382843 "2025-10-20T22:07:01Z")
We use Kibana as a UI for searching and analyzing some data that we store in Elasticsearch. The individual data entries in Elasticsearch have S3 identifiers stored with them for relevant files. We need to enable our user… --- ## [Performance Issue on Elasticsearch (Plain search query)](https://discuss.elastic.co/t/performance-issue-on-elasticsearch-plain-search-query/385178)
**Author:** [@crchaulagain](https://discuss.elastic.co/u/crchaulagain)\ **Replies:** 2\ **Last updated:** [March 3, 2026, 5:35am UTC](https://discuss.elastic.co/t/performance-issue-on-elasticsearch-plain-search-query/385178 "2026-03-03T05:35:41Z")
Hey everyone, I'm using ES (9.1.7) and running into a performance issue with my Elasticsearch setup and could use some insights. Here’s the situation: I have a cluster with 4 client nodes, 8 data nodes, and 3 master no… --- ## [Kibana cluster status show stale](https://discuss.elastic.co/t/kibana-cluster-status-show-stale/385502)
**Author:** [@Whoami1980](https://discuss.elastic.co/u/Whoami1980)\ **Replies:** 4\ **Last updated:** [April 9, 2026, 7:28am UTC](https://discuss.elastic.co/t/kibana-cluster-status-show-stale/385502 "2026-04-09T07:28:29Z")
Management \>\> Stack Monitoring Clusters \>\> Click on the cluster Cluster Overview page \>\> Scroll down to Kibana \>\> Click Instances Kibana instances page status show stale All instances are green. alerts are clear. Las… --- ## ["AlreadyClosedException" with "Too Many Open Files" - breaking indexing](https://discuss.elastic.co/t/alreadyclosedexception-with-too-many-open-files-breaking-indexing/388808)
**Author:** [@astrodi](https://discuss.elastic.co/u/astrodi)\ **Replies:** 6\ **Last updated:** [July 27, 2026, 5:17pm UTC](https://discuss.elastic.co/t/alreadyclosedexception-with-too-many-open-files-breaking-indexing/388808 "2026-07-27T17:17:09Z")
Hello there :waving\_hand: I'm experiencing allocation issues on cluster with 22 data nodes (K8S cluster, each node holds 29-41 shards). In total, there is 122M documents, 13TB of storage consumed and 456 pri. shards + … --- ## [ELSER model loaded in ML node, but do I need it?](https://discuss.elastic.co/t/elser-model-loaded-in-ml-node-but-do-i-need-it/384835)
**Author:** [@taprove](https://discuss.elastic.co/u/taprove)\ **Replies:** 0\ **Last updated:** [January 30, 2026, 7:46pm UTC](https://discuss.elastic.co/t/elser-model-loaded-in-ml-node-but-do-i-need-it/384835 "2026-01-30T19:46:50Z")
My questions: Do ML nodes have to have a Trained Model assigned? Does adding a Trained Model for other features (AI Assistant, KB functionality) cause it to automatically deploy to ML nodes? Is there anyway to remove i… --- ## [Kibana “Managed API keys” can be hidden/misclassified by editing metadata.managed (UI + Dev Tools)](https://discuss.elastic.co/t/kibana-managed-api-keys-can-be-hidden-misclassified-by-editing-metadata-managed-ui-dev-tools/384407)
**Author:** [@Bolto](https://discuss.elastic.co/u/Bolto)\ **Replies:** 0\ **Last updated:** [January 7, 2026, 10:47am UTC](https://discuss.elastic.co/t/kibana-managed-api-keys-can-be-hidden-misclassified-by-editing-metadata-managed-ui-dev-tools/384407 "2026-01-07T10:47:20Z")
Hi Elastic team/community, While reviewing API Keys in Kibana, I noticed that the flag used to identify Managed API keys (created/used by Kibana background tasks) can be overwritten by a user by editing the API key meta… --- ## [Filebeat memory usage increases overtime until OOM](https://discuss.elastic.co/t/filebeat-memory-usage-increases-overtime-until-oom/387098)
**Author:** [@ryd-devops](https://discuss.elastic.co/u/ryd-devops)\ **Replies:** 3\ **Last updated:** [June 23, 2026, 6:28pm UTC](https://discuss.elastic.co/t/filebeat-memory-usage-increases-overtime-until-oom/387098 "2026-06-23T18:28:25Z")
We run filebeat (9.4.2) in our kubernetes clusters, mostly using the autodiscoverfeature and annotations. We have a lot of cronjobs and sidecar containers as well.. from a logging perspective filebeat is working great b… --- ## [Logstash output to Azure blobstorage](https://discuss.elastic.co/t/logstash-output-to-azure-blobstorage/383117)
**Author:** [@Kumar\_6](https://discuss.elastic.co/u/Kumar_6)\ **Replies:** 4\ **Last updated:** [October 31, 2025, 8:00am UTC](https://discuss.elastic.co/t/logstash-output-to-azure-blobstorage/383117 "2025-10-31T08:00:30Z")
Hi, everyone I have been looking over Internet in order to find a plugin for Logstash or FIlebeat in order to send data to azure blobstorage. i haven’t find it. as i see only s3 output is available. is azure blobstor… --- ## [Elastic Cloud on Kubernetes 3.5.0 Security Update (ESA-2026-145)](https://discuss.elastic.co/t/elastic-cloud-on-kubernetes-3-5-0-security-update-esa-2026-145/390105)
**Author:** [@Bryan\_Garcia](https://discuss.elastic.co/u/Bryan_Garcia)\ **Replies:** 0\ **Last updated:** [September 1, 2026, 10:31pm UTC](https://discuss.elastic.co/t/elastic-cloud-on-kubernetes-3-5-0-security-update-esa-2026-145/390105 "2026-09-01T22:31:42Z")
Incorrect Authorization in Elastic Cloud on Kubernetes Leading to Unauthorized Modification of Data Incorrect Authorization (CWE-863) in Elastic Cloud on Kubernetes (ECK) can lead to unauthorized modification of data vi… --- ## [How to get details about es CVE fixes](https://discuss.elastic.co/t/how-to-get-details-about-es-cve-fixes/389615)
**Author:** [@manick02](https://discuss.elastic.co/u/manick02)\ **Replies:** 7\ **Last updated:** [August 17, 2026, 11:27am UTC](https://discuss.elastic.co/t/how-to-get-details-about-es-cve-fixes/389615 "2026-08-17T11:27:41Z")
I read somewhere in the forum that Elastic does not discuss about CVE fixes in the forum. What is the right method to reach-out to elastic? There are two things we need to document for every CVE identified in ES - 1 whet… --- ## [Elasticsearch 8.18.0, 9.0.0 Security Update (ESA-2026-111)](https://discuss.elastic.co/t/elasticsearch-8-18-0-9-0-0-security-update-esa-2026-111/389495)
**Author:** [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Replies:** 0\ **Last updated:** [August 13, 2026, 10:46am UTC](https://discuss.elastic.co/t/elasticsearch-8-18-0-9-0-0-security-update-esa-2026-111/389495 "2026-08-13T10:46:46Z")
Memory Allocation with Excessive Size Value in Elasticsearch Leading to Denial of Service Memory Allocation with Excessive Size Value (CWE-789) in the ES|QL query processing of Elasticsearch can lead to denial of servic… --- ## [Snapshot repository](https://discuss.elastic.co/t/snapshot-repository/389276)
**Author:** [@Shahar\_Argov](https://discuss.elastic.co/u/Shahar_Argov)\ **Replies:** 6\ **Last updated:** [August 9, 2026, 8:03am UTC](https://discuss.elastic.co/t/snapshot-repository/389276 "2026-08-09T08:03:24Z")
hi again, i have a problem with my snapshot repository I'm using the data tiers in the elastic (the data from my winbeats is going from my winlogbeats to the logstash and from there to the elastic hot node, warm node a… --- ## [Unable to get RUM agent working - mixed content error](https://discuss.elastic.co/t/unable-to-get-rum-agent-working-mixed-content-error/383751)
**Author:** [@mirde](https://discuss.elastic.co/u/mirde)\ **Replies:** 6\ **Last updated:** [December 2, 2025, 3:57pm UTC](https://discuss.elastic.co/t/unable-to-get-rum-agent-working-mixed-content-error/383751 "2025-12-02T15:57:26Z")
Course: Elastic Observability Engineer (On-Demand) Version: 8.8.2 Question: I have followed the labs in 3.4 and I see petclinic-react in Kibana Observability \> APM \> Services but it is not connecting to petclinic-node… --- ## [APM Server 8.19.20, 9.4.5, 9.5.1 Security Update (ESA-2026-152)](https://discuss.elastic.co/t/apm-server-8-19-20-9-4-5-9-5-1-security-update-esa-2026-152/390110)
**Author:** [@Bryan\_Garcia](https://discuss.elastic.co/u/Bryan_Garcia)\ **Replies:** 0\ **Last updated:** [September 1, 2026, 10:33pm UTC](https://discuss.elastic.co/t/apm-server-8-19-20-9-4-5-9-5-1-security-update-esa-2026-152/390110 "2026-09-01T22:33:38Z")
Improper Handling of Highly Compressed Data in APM Server Leading to Persistent Denial of Service Improper Handling of Highly Compressed Data (CWE-409) in APM Server can lead to a persistent denial of service via Excess… --- ## [Int Overflow produces invalid Filebeat stats](https://discuss.elastic.co/t/int-overflow-produces-invalid-filebeat-stats/389458)
**Author:** [@fleaz](https://discuss.elastic.co/u/fleaz)\ **Replies:** 3\ **Last updated:** [August 17, 2026, 1:09pm UTC](https://discuss.elastic.co/t/int-overflow-produces-invalid-filebeat-stats/389458 "2026-08-17T13:09:48Z")
Hey, we recently discovered some strange metrics coming from our Filebeats (8.19.19 running in k8s) because we have an alert to check for queue usage and alert if the queue gets to full. Sometimes the value for "Queue … --- ## [Unable to remove Default data view](https://discuss.elastic.co/t/unable-to-remove-default-data-view/383604)
**Author:** [@mittal\_rawal](https://discuss.elastic.co/u/mittal_rawal)\ **Replies:** 6\ **Last updated:** [December 10, 2025, 1:55pm UTC](https://discuss.elastic.co/t/unable-to-remove-default-data-view/383604 "2025-12-10T13:55:25Z")
“I have multiple data views for different dashboards, but the default data view keeps loading even for dashboards where it’s not used. I want to remove the default data view—how can I do that?” ELK stack version: 8.16.1 … --- ## [Java APM agent crashes JVM](https://discuss.elastic.co/t/java-apm-agent-crashes-jvm/386522)
**Author:** [@adminunix](https://discuss.elastic.co/u/adminunix)\ **Replies:** 3\ **Last updated:** [May 27, 2026, 1:59pm UTC](https://discuss.elastic.co/t/java-apm-agent-crashes-jvm/386522 "2026-05-27T13:59:31Z")
Hello, The APM agent has caused a JVM crash on a production Tomcat system. Kibana version: 9.4.0 Elasticsearch version: 9.4.0 APM Server version: 9.4.0 APM Agent language and version: APM Java agent version 1.55.… --- ## [After upgrade to 9.3.4 problem with system and windows integration](https://discuss.elastic.co/t/after-upgrade-to-9-3-4-problem-with-system-and-windows-integration/386156)
**Author:** [@Mario\_22](https://discuss.elastic.co/u/Mario_22)\ **Replies:** 2\ **Last updated:** [May 5, 2026, 5:49am UTC](https://discuss.elastic.co/t/after-upgrade-to-9-3-4-problem-with-system-and-windows-integration/386156 "2026-05-05T05:49:04Z")
Windows Event Logs stop indexing after upgrade to Elastic Agent 9.3.4 — system.application, system.system, Sysmon, PowerShell, and Custom Windows logs dropped with HTTP 400 Malformed content / dataset mapping conflict; p… --- ## [Elasticsearch Nodes Randomly Crashing Due to JVM Native Memory Allocation Failure on Windows Servers](https://discuss.elastic.co/t/elasticsearch-nodes-randomly-crashing-due-to-jvm-native-memory-allocation-failure-on-windows-servers/386422)
**Author:** [@Shubham\_Khodpe](https://discuss.elastic.co/u/Shubham_Khodpe)\ **Replies:** 5\ **Last updated:** [June 4, 2026, 9:50am UTC](https://discuss.elastic.co/t/elasticsearch-nodes-randomly-crashing-due-to-jvm-native-memory-allocation-failure-on-windows-servers/386422 "2026-06-04T09:50:01Z")
Hi Team, We are facing frequent Elasticsearch node crashes across all nodes in our cluster and need guidance on identifying the root cause and recommended tuning. Environment Details Elasticsearch Version: 9.1.3 OS… --- ## [Error Migration 8.19.12 -\> 9.1.3](https://discuss.elastic.co/t/error-migration-8-19-12-9-1-3/385410)
**Author:** [@M1ghty1](https://discuss.elastic.co/u/M1ghty1)\ **Replies:** 5\ **Last updated:** [March 11, 2026, 12:24pm UTC](https://discuss.elastic.co/t/error-migration-8-19-12-9-1-3/385410 "2026-03-11T12:24:55Z")
I am currently migrating from elasticsearch 8.19.12 to 9.1.3. I fixed the issues in upgrade assistant in 8.19.12, created a snapshot which is valid (status = SUCCESS). But when i try to import the snapshot in 9.1.3 i ge… --- ## [Kibana Instance Crashing During PDF/CSV Export on Elastic Cloud](https://discuss.elastic.co/t/kibana-instance-crashing-during-pdf-csv-export-on-elastic-cloud/384990)
**Author:** [@Hichem\_Blagui](https://discuss.elastic.co/u/Hichem_Blagui)\ **Replies:** 4\ **Last updated:** [February 12, 2026, 2:07pm UTC](https://discuss.elastic.co/t/kibana-instance-crashing-during-pdf-csv-export-on-elastic-cloud/384990 "2026-02-12T14:07:28Z")
Hi, I am experiencing frequent instance crashes when attempting to export default dashboards (PDF/PNG/CSV) from Kibana. I am currently using Elastic Cloud and do not have access to the underlying terminal or the physica… --- ## [Kibana 8.19.20, 9.3.5, 9.4.2 Security Update (ESA-2026-136)](https://discuss.elastic.co/t/kibana-8-19-20-9-3-5-9-4-2-security-update-esa-2026-136/389492)
**Author:** [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Replies:** 0\ **Last updated:** [August 13, 2026, 10:39am UTC](https://discuss.elastic.co/t/kibana-8-19-20-9-3-5-9-4-2-security-update-esa-2026-136/389492 "2026-08-13T10:39:59Z")
Uncaught Exception in Kibana Cases Leading to Denial of Service Uncaught Exception (CWE-248) in Kibana Cases can lead to denial of service via Input Data Manipulation (CAPEC-153). Malformed link syntax stored in a case … --- ## [Found not migrated detection alerts](https://discuss.elastic.co/t/found-not-migrated-detection-alerts/385044)
**Author:** [@CD9820](https://discuss.elastic.co/u/CD9820)\ **Replies:** 2\ **Last updated:** [September 10, 2026, 6:57pm UTC](https://discuss.elastic.co/t/found-not-migrated-detection-alerts/385044 "2026-09-10T18:57:35Z")
Hello we are planning our upgrade from 8.19.x to 9.2.x The upgrade assistant contains a warning for Kibana: "Found not migrated detection alerts" I have tried to migrate but this does not work (example with .reindexed… --- ## [ElasticDefendStatus - File not found (v9.3.0)](https://discuss.elastic.co/t/elasticdefendstatus-file-not-found-v9-3-0/384899)
**Author:** [@adamsmesher](https://discuss.elastic.co/u/adamsmesher)\ **Replies:** 4\ **Last updated:** [February 6, 2026, 6:39pm UTC](https://discuss.elastic.co/t/elasticdefendstatus-file-not-found-v9-3-0/384899 "2026-02-06T18:39:33Z")
Hi Everyone! After updating to version 9.3, the Elastic Defend status is not displayed on the endpoints. file:///C:/Program%20Files/Elastic/Endpoint/cache/ElasticDefendStatus.html Register as antivirus - Sync with … --- ## [Logstash geoip download/update](https://discuss.elastic.co/t/logstash-geoip-download-update/383241)
**Author:** [@murali\_vraman](https://discuss.elastic.co/u/murali_vraman)\ **Replies:** 4\ **Last updated:** [November 6, 2025, 3:20pm UTC](https://discuss.elastic.co/t/logstash-geoip-download-update/383241 "2025-11-06T15:20:57Z")
I have enabled the following settings in logstash.yml file. When it does detect changes, does it do a full download of the database? xpack.geoip.downloader.endpoint: "https://geoip.elastic.co/v1/database" xpack.geoip.d… --- ## [Elasticsearch 8.19.20, 9.4.5 Security Update (ESA-2026-77)](https://discuss.elastic.co/t/elasticsearch-8-19-20-9-4-5-security-update-esa-2026-77/389500)
**Author:** [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Replies:** 0\ **Last updated:** [August 13, 2026, 10:47am UTC](https://discuss.elastic.co/t/elasticsearch-8-19-20-9-4-5-security-update-esa-2026-77/389500 "2026-08-13T10:47:03Z")
Inefficient Algorithmic Complexity in Elasticsearch Leading to Denial of Service A flaw in Elasticsearch allows a low-privileged authenticated user who can index documents to submit a single small document containing a … --- ## [Logback ECS Encoder vs Logstash](https://discuss.elastic.co/t/logback-ecs-encoder-vs-logstash/383307)
**Author:** [@haider665](https://discuss.elastic.co/u/haider665)\ **Replies:** 0\ **Last updated:** [November 9, 2025, 8:39am UTC](https://discuss.elastic.co/t/logback-ecs-encoder-vs-logstash/383307 "2025-11-09T08:39:09Z")
I was doing some study on ELK stack and how to implement it with our spring boot microservices. I have seen two approaches to get logs from my application to kibana dashboard. Using logstash: File beat reads the log fr… --- ## [Integrating fortigate firewall to elastic](https://discuss.elastic.co/t/integrating-fortigate-firewall-to-elastic/382949)
**Author:** [@phumlani](https://discuss.elastic.co/u/phumlani)\ **Replies:** 2\ **Last updated:** [October 28, 2025, 8:49pm UTC](https://discuss.elastic.co/t/integrating-fortigate-firewall-to-elastic/382949 "2025-10-28T20:49:52Z")
I am required to pull logs from the firewall(fortigate), and Office365. I have registered the application on microsoft AZURE for office365 and assigned permissions(Office365 management API(ActivityFeed.Read, ActivityFeed… --- ## [It looks like winlogbeat (8.19.10) is showing noisy warn logs again](https://discuss.elastic.co/t/it-looks-like-winlogbeat-8-19-10-is-showing-noisy-warn-logs-again/385125)
**Author:** [@Alyssa\_Nunez](https://discuss.elastic.co/u/Alyssa_Nunez)\ **Replies:** 4\ **Last updated:** [March 5, 2026, 2:19pm UTC](https://discuss.elastic.co/t/it-looks-like-winlogbeat-8-19-10-is-showing-noisy-warn-logs-again/385125 "2026-03-05T14:19:59Z")
Hi, I was going over some logs for an incident and noticed that a lot of logs we’re seeing are similar to the ones report here: Channel not found would be suppressed ( \[Winlogbeat\] Suppress excessive channel not found w… --- ## [Using the frozen tier with Elastic Cloud and ILM policies](https://discuss.elastic.co/t/using-the-frozen-tier-with-elastic-cloud-and-ilm-policies/383342)
**Author:** [@javierE](https://discuss.elastic.co/u/javierE)\ **Replies:** 4\ **Last updated:** [November 19, 2025, 4:25pm UTC](https://discuss.elastic.co/t/using-the-frozen-tier-with-elastic-cloud-and-ilm-policies/383342 "2025-11-19T16:25:41Z")
Hi all, I’m evaluating the frozen tier functionality in Elastic Cloud deployment, aiming to keep around ten years of historical data available for occasional analysis and compliance purposes. Given that we plan to ret… --- ## [Checking if updated documents are visible to search](https://discuss.elastic.co/t/checking-if-updated-documents-are-visible-to-search/383843)
**Author:** [@Mo\_B](https://discuss.elastic.co/u/Mo_B)\ **Replies:** 6\ **Last updated:** [December 3, 2025, 10:17pm UTC](https://discuss.elastic.co/t/checking-if-updated-documents-are-visible-to-search/383843 "2025-12-03T22:17:19Z")
Given a set of recently updated documents (indexed without waiting for refresh), is there a way to check if they have been refreshed, or to wait until they have been refreshed (without calling \_refresh)? Waiting for x … --- ## [Elasticsearch not creating required output as expected with logstash and filebeat](https://discuss.elastic.co/t/elasticsearch-not-creating-required-output-as-expected-with-logstash-and-filebeat/383551)
**Author:** [@DOkuwa](https://discuss.elastic.co/u/DOkuwa)\ **Replies:** 7\ **Last updated:** [November 20, 2025, 4:53pm UTC](https://discuss.elastic.co/t/elasticsearch-not-creating-required-output-as-expected-with-logstash-and-filebeat/383551 "2025-11-20T16:53:04Z")
Good morning , I have installed filebeat , logstash,kibana and elasticsearch on the same server I want filebeat to push a particular json file to logstash and then appear in kibana i have configured the filebeat.yml … --- ## [In ElasticSearch version 7.14.2, the following query causes the estimated\_size of the request circuit breaker to keep increasing and will not decrease even after 1-2 days](https://discuss.elastic.co/t/in-elasticsearch-version-7-14-2-the-following-query-causes-the-estimated-size-of-the-request-circuit-breaker-to-keep-increasing-and-will-not-decrease-even-after-1-2-days/383288)
**Author:** [@dackh](https://discuss.elastic.co/u/dackh)\ **Replies:** 7\ **Last updated:** [November 10, 2025, 6:23am UTC](https://discuss.elastic.co/t/in-elasticsearch-version-7-14-2-the-following-query-causes-the-estimated-size-of-the-request-circuit-breaker-to-keep-increasing-and-will-not-decrease-even-after-1-2-days/383288 "2025-11-10T06:23:52Z")
This index has 2 million documents, each with approximately 300 fields. The query syntax is as follows: GET /option\_indicator/\_search { "profile": true, "\_source": true, "track\_total\_hits": true, "size": 0,… --- ## [OpenTelemetry Integration on AirGapped Environment](https://discuss.elastic.co/t/opentelemetry-integration-on-airgapped-environment/385042)
**Author:** [@gbschenkel](https://discuss.elastic.co/u/gbschenkel)\ **Replies:** 4\ **Last updated:** [March 6, 2026, 2:11pm UTC](https://discuss.elastic.co/t/opentelemetry-integration-on-airgapped-environment/385042 "2026-03-06T14:11:27Z")
Hi, we have two ELK clusters, one for production and other for monitoring. The cluster don’t have access to internet, so is an AirGapped environment, the Elastic Artifacts are being rerouted using Sonatype Nexus Reposit… --- ## [Very strange ingest pipeline problem](https://discuss.elastic.co/t/very-strange-ingest-pipeline-problem/383942)
**Author:** [@rugenl](https://discuss.elastic.co/u/rugenl)\ **Replies:** 5\ **Last updated:** [December 10, 2025, 5:52pm UTC](https://discuss.elastic.co/t/very-strange-ingest-pipeline-problem/383942 "2025-12-10T17:52:31Z")
I have a need to add an ingest pipeline to the elastic-cloud-logs-9 data stream in a cloud-hosted environment running 9.2. It’s not complicated logic, but it’s a little complicated extracting a field from message with 2… --- ## [Kibana 8.19.21, 9.4.6, 9.5.2 Security Update (ESA-2026-144)](https://discuss.elastic.co/t/kibana-8-19-21-9-4-6-9-5-2-security-update-esa-2026-144/390064)
**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\ **Replies:** 0\ **Last updated:** [September 1, 2026, 6:40pm UTC](https://discuss.elastic.co/t/kibana-8-19-21-9-4-6-9-5-2-security-update-esa-2026-144/390064 "2026-09-01T18:40:51Z")
Missing Authorization in Kibana Leading to Information Disclosure Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Privilege Abuse (CAPEC-122). An authorization control was not applied to… --- ## [Upgrade from 7.17.9 to 8.19.18 to 9.4.3](https://discuss.elastic.co/t/upgrade-from-7-17-9-to-8-19-18-to-9-4-3/390473)
**Author:** [@sundar.s](https://discuss.elastic.co/u/sundar.s)\ **Replies:** 4\ **Last updated:** [September 17, 2026, 10:17am UTC](https://discuss.elastic.co/t/upgrade-from-7-17-9-to-8-19-18-to-9-4-3/390473 "2026-09-17T10:17:24Z")
Hi Team, I am trying to run upgrades on a dockerized ES environment. With indices created in 7.17.9, I am able to successfuly migrate to 8.19.18, by just bringing up a new container of ES 8.19.18 pointing to the same v… --- ## [Change agent fingerprint / certificate](https://discuss.elastic.co/t/change-agent-fingerprint-certificate/385638)
**Author:** [@GKre](https://discuss.elastic.co/u/GKre)\ **Replies:** 4\ **Last updated:** [March 27, 2026, 12:38pm UTC](https://discuss.elastic.co/t/change-agent-fingerprint-certificate/385638 "2026-03-27T12:38:06Z")
No - i am not an “elastic crack” but a stupid beginner. I am hosting my elastic - fleet managed - environment to better understand how SIEM is working. Well - after my certificates got invalid / got outdated i decided t… --- ## [Logstash filter JSON parse error](https://discuss.elastic.co/t/logstash-filter-json-parse-error/384918)
**Author:** [@rokkotnik](https://discuss.elastic.co/u/rokkotnik)\ **Replies:** 7\ **Last updated:** [February 6, 2026, 12:42pm UTC](https://discuss.elastic.co/t/logstash-filter-json-parse-error/384918 "2026-02-06T12:42:06Z")
Hi, I keep getting json parse error and I’ve been playing with filter for hours. \[logstash.codecs.json \]\[main\]\[68389d\] JSON parse error, original data now in message field {:message=\>"Could not set field 'ip' on ob… --- ## [Moving to integrations and ingest pipelines, need Logstash aggregate filter plugin replacement](https://discuss.elastic.co/t/moving-to-integrations-and-ingest-pipelines-need-logstash-aggregate-filter-plugin-replacement/386507)
**Author:** [@nilsen](https://discuss.elastic.co/u/nilsen)\ **Replies:** 5\ **Last updated:** [May 27, 2026, 11:25am UTC](https://discuss.elastic.co/t/moving-to-integrations-and-ingest-pipelines-need-logstash-aggregate-filter-plugin-replacement/386507 "2026-05-27T11:25:18Z")
Previously used Logstash to push data into Elastic. For some logs that had the most important data scattered around we used the Aggregate Filter Plugin to gather data across multiple lines and then push one single docume… --- ## [Getting Session error on Kibana UI](https://discuss.elastic.co/t/getting-session-error-on-kibana-ui/385888)
**Author:** [@Cache\_Digitech](https://discuss.elastic.co/u/Cache_Digitech)\ **Replies:** 8\ **Last updated:** [April 17, 2026, 3:20pm UTC](https://discuss.elastic.co/t/getting-session-error-on-kibana-ui/385888 "2026-04-17T15:20:34Z")
As shown in the screenshot , I’m having this issue . I tried a fresh installation and again after running for few days , I got this error again. I did some research and found that the roles for the kibana\_system user … --- ## [Error after creating Detection rules in Elastic Security; Not getting alerts](https://discuss.elastic.co/t/error-after-creating-detection-rules-in-elastic-security-not-getting-alerts/385908)
**Author:** [@wicklanm](https://discuss.elastic.co/u/wicklanm)\ **Replies:** 3\ **Last updated:** [April 16, 2026, 7:05pm UTC](https://discuss.elastic.co/t/error-after-creating-detection-rules-in-elastic-security-not-getting-alerts/385908 "2026-04-16T19:05:02Z")
Hey everyone, After I added Security Detection Rules in my Elastic Search, I get the following error below. what does this mean and what can I do to fix it? I am not getting any alerts from this. This is for my Windows … --- ## [Pod fails to become ready after restart](https://discuss.elastic.co/t/pod-fails-to-become-ready-after-restart/383162)
**Author:** [@leighr](https://discuss.elastic.co/u/leighr)\ **Replies:** 1\ **Last updated:** [December 31, 2025, 3:40pm UTC](https://discuss.elastic.co/t/pod-fails-to-become-ready-after-restart/383162 "2025-12-31T15:40:11Z")
elastic operator v2.16.1 is installed in the cluster. k8s is running in Amazon EKS, k8s version 1.32 The following brings up a four node cluster with no errors: apiVersion: elasticsearch.k8s.elastic.co/v1 kind: Elasti… --- ## [SAVE Option in dashboard appears when no changes made; Sometimes needs clicking twice](https://discuss.elastic.co/t/save-option-in-dashboard-appears-when-no-changes-made-sometimes-needs-clicking-twice/384596)
**Author:** [@geoffrey](https://discuss.elastic.co/u/geoffrey)\ **Replies:** 0\ **Last updated:** [January 18, 2026, 6:54am UTC](https://discuss.elastic.co/t/save-option-in-dashboard-appears-when-no-changes-made-sometimes-needs-clicking-twice/384596 "2026-01-18T06:54:29Z")
I have got some dashboards setup for displaying DMARC information in Kibana (email reporting information). I am running V9.2 of ES and Kibana. What I notice is that the save option frequently appears when no changes hav… --- ## [Filebeat to Elastic-Agent Swap](https://discuss.elastic.co/t/filebeat-to-elastic-agent-swap/385490)
**Author:** [@kamandohl](https://discuss.elastic.co/u/kamandohl)\ **Replies:** 6\ **Last updated:** [March 19, 2026, 11:30am UTC](https://discuss.elastic.co/t/filebeat-to-elastic-agent-swap/385490 "2026-03-19T11:30:17Z")
We currently are utilizing Filebeat 8.13.x to ship sensor data for Zeek and Suricata via Kafka and utilizing Logstash to subscribe from Kafka and push to Elasticsearch. We are in the mist of moving from filebeat to ela… --- ## [Logstash Grok filter Not working](https://discuss.elastic.co/t/logstash-grok-filter-not-working/384762)
**Author:** [@Elk\_huh](https://discuss.elastic.co/u/Elk_huh)\ **Replies:** 6\ **Last updated:** [January 28, 2026, 7:41pm UTC](https://discuss.elastic.co/t/logstash-grok-filter-not-working/384762 "2026-01-28T19:41:41Z")
\<181\>Jan 28 14:49:00 cisco CISE\_RADIUS\_Accounting 0001444968 1 0 2026-01-28 14:49:00.791 +00:00 0794387998 3002 NOTICE Radius-Accounting: RADIUS Accounting watchdog update, ConfigVersionId=312, Device IP Address=1.1.1.1,… --- ## [Request for Guidance on Resolving the ‘View in Context’ Issue in the Logs Stream Menu](https://discuss.elastic.co/t/request-for-guidance-on-resolving-the-view-in-context-issue-in-the-logs-stream-menu/384453)
**Author:** [@sjoh9163](https://discuss.elastic.co/u/sjoh9163)\ **Replies:** 6\ **Last updated:** [January 13, 2026, 11:03am UTC](https://discuss.elastic.co/t/request-for-guidance-on-resolving-the-view-in-context-issue-in-the-logs-stream-menu/384453 "2026-01-13T11:03:25Z")
Hello everyone, As part of applying security features to our ELK stack, we recently upgraded all components from version 8.14 to 8.19. During the upgrade, we initially encountered an issue where the Logs Stream menu wa… --- ## [When 8.19.14 will be released? Being hitting hard by #144748](https://discuss.elastic.co/t/when-8-19-14-will-be-released-being-hitting-hard-by-144748/385798)
**Author:** [@carlosmg1](https://discuss.elastic.co/u/carlosmg1)\ **Replies:** 4\ **Last updated:** [April 8, 2026, 4:45pm UTC](https://discuss.elastic.co/t/when-8-19-14-will-be-released-being-hitting-hard-by-144748/385798 "2026-04-08T16:45:42Z")
Hi, we upgraded to 8.19.13, just to discover we’re having a lot of problems because mentioned issue related to percolate queries. i’ve seen the release note for the 8.19.14 is already up, but no release itself (btw, we … --- ## [Real cluster state size](https://discuss.elastic.co/t/real-cluster-state-size/385796)
**Author:** [@Nicko](https://discuss.elastic.co/u/Nicko)\ **Replies:** 7\ **Last updated:** [April 7, 2026, 1:54pm UTC](https://discuss.elastic.co/t/real-cluster-state-size/385796 "2026-04-07T13:54:56Z")
When I try to get the cluster state size via GET \_nodes/stats in kibana dev tools it gives me this data from the node, which is holding cluster state now "serialized\_cluster\_states": { "full\_states": { "count": 77… [Previous page](https://discuss.elastic.co/top.md?page=10&per_page=50) [Next page](https://discuss.elastic.co/top.md?page=12&per_page=50)