# Top

**URL:** https://discuss.elastic.co/top.md?page=12

[Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md)

**Page:** 13

---

## [Elastic Maps Server 8.19.19, 9.4.4, 9.5.1 Security Update (ESA-2026-148)](https://discuss.elastic.co/t/elastic-maps-server-8-19-19-9-4-4-9-5-1-security-update-esa-2026-148/390108)

<div class="topic-metadata">

**Author:** [@Bryan\_Garcia](https://discuss.elastic.co/u/Bryan_Garcia)\
**Replies:** 0\
**Last updated:** [September 1, 2026, 10:32pm UTC](https://discuss.elastic.co/t/elastic-maps-server-8-19-19-9-4-4-9-5-1-security-update-esa-2026-148/390108 "2026-09-01T22:32:51Z")

</div>

Improper Limitation of a Pathname to a Restricted Directory in Elastic Maps Server Leading to Unauthorized File Disclosure Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) in Elast…

---

## [How to reindex a data stream into another data stream?](https://discuss.elastic.co/t/how-to-reindex-a-data-stream-into-another-data-stream/383131)

<div class="topic-metadata">

**Author:** [@dot-mike](https://discuss.elastic.co/u/dot-mike)\
**Replies:** 2\
**Last updated:** [November 3, 2025, 2:02pm UTC](https://discuss.elastic.co/t/how-to-reindex-a-data-stream-into-another-data-stream/383131 "2025-11-03T14:02:06Z")

</div>

Hi community, I’m trying to reindex data from one data stream to another. Basically, I want data from this data stream logs-syslog.myproduct.logs to go into logs-syslog.myproduct\_logs-default The issue is that when th…

---

## [Same \_id ends up duplicated across rollover indices behind a write alias — can this be prevented via template/ILM?](https://discuss.elastic.co/t/same-id-ends-up-duplicated-across-rollover-indices-behind-a-write-alias-can-this-be-prevented-via-template-ilm/385348)

<div class="topic-metadata">

**Author:** [@juan\_ma\_tejada](https://discuss.elastic.co/u/juan_ma_tejada)\
**Replies:** 1\
**Last updated:** [March 4, 2026, 7:34pm UTC](https://discuss.elastic.co/t/same-id-ends-up-duplicated-across-rollover-indices-behind-a-write-alias-can-this-be-prevented-via-template-ilm/385348 "2026-03-04T19:34:01Z")

</div>

Hi all, I’m indexing documents into Elasticsearch using a deterministic \_id (SHA1 of email + normalized\_context). I write to an alias that uses ILM rollover, so over time it creates backing indices like: data-000073 …

---

## [Upgrading kibana from 8.18.4 to 8.19.4](https://discuss.elastic.co/t/upgrading-kibana-from-8-18-4-to-8-19-4/384668)

<div class="topic-metadata">

**Author:** [@Anjali3](https://discuss.elastic.co/u/Anjali3)\
**Replies:** 4\
**Last updated:** [January 28, 2026, 10:50am UTC](https://discuss.elastic.co/t/upgrading-kibana-from-8-18-4-to-8-19-4/384668 "2026-01-28T10:50:01Z")

</div>

Hi Team, Need quick help! I am upgrading elasticsearch from 8.18.4 to 8.19.4 but getting below errors: at org.elasticsearch.server.cli.JvmOption.flagsFinal(JvmOption.java:125) at org.elasticsearch.server.cli.JvmOption.…

---

## [Kibana 9.4.6, 9.5.2 Security Update (ESA-2026-130)](https://discuss.elastic.co/t/kibana-9-4-6-9-5-2-security-update-esa-2026-130/390059)

<div class="topic-metadata">

**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\
**Replies:** 0\
**Last updated:** [September 1, 2026, 6:40pm UTC](https://discuss.elastic.co/t/kibana-9-4-6-9-5-2-security-update-esa-2026-130/390059 "2026-09-01T18:40:35Z")

</div>

Incorrect Authorization in Kibana Leading to Unauthorized Disabling of Privilege Monitoring Incorrect Authorization (CWE-863) in Kibana Entity Analytics can lead to a loss of security monitoring via Accessing Functional…

---

## [logstash-output-elasticsearch error](https://discuss.elastic.co/t/logstash-output-elasticsearch-error/387936)

<div class="topic-metadata">

**Author:** [@wujun](https://discuss.elastic.co/u/wujun)\
**Replies:** 3\
**Last updated:** [August 20, 2026, 10:49am UTC](https://discuss.elastic.co/t/logstash-output-elasticsearch-error/387936 "2026-08-20T10:49:20Z")

</div>

\[WARN \] 2026-07-09 10:54:37.480 \[Ruby-0-Thread-9: /usr/share/logstash/vendor/bundle/jruby/3.4.0/gems/logstash-output-elasticsearch-12.1.3-java/lib/logstash/outputs/elasticsearch/http\_client/pool.rb:234\] elasticsearch - F…

---

## [Elastic Cloud Enterprise - cannot upload my own certificates](https://discuss.elastic.co/t/elastic-cloud-enterprise-cannot-upload-my-own-certificates/384221)

<div class="topic-metadata">

**Author:** [@CD9820](https://discuss.elastic.co/u/CD9820)\
**Replies:** 3\
**Last updated:** [December 23, 2025, 3:31pm UTC](https://discuss.elastic.co/t/elastic-cloud-enterprise-cannot-upload-my-own-certificates/384221 "2025-12-23T15:31:51Z")

</div>

Hello I am installing ECE on prem. When uploading my own certificates I get this error. I followed these instructions but I still get the error : Manage security certificates | Elastic Docs Is there another way to …

---

## [Where the detection rules store? in which index?](https://discuss.elastic.co/t/where-the-detection-rules-store-in-which-index/386144)

<div class="topic-metadata">

**Author:** [@neshat1485](https://discuss.elastic.co/u/neshat1485)\
**Replies:** 4\
**Last updated:** [May 21, 2026, 9:01am UTC](https://discuss.elastic.co/t/where-the-detection-rules-store-in-which-index/386144 "2026-05-21T09:01:25Z")

</div>

i see that we have an index with the name .kibana\_security\_solution\* that the prebuilt and default detection rules are in this index but i couldn't find the index that store the data of the custom detection rules that w…

---

## [Elastic Observability Exam query](https://discuss.elastic.co/t/elastic-observability-exam-query/386148)

<div class="topic-metadata">

**Author:** [@Sharmon](https://discuss.elastic.co/u/Sharmon)\
**Replies:** 3\
**Last updated:** [June 2, 2026, 8:39pm UTC](https://discuss.elastic.co/t/elastic-observability-exam-query/386148 "2026-06-02T20:39:06Z")

</div>

Course: Elastic Certified Observability Exam Version: 8.8 Hello Elastic Training Team, I recently completed my Instructor-Led Training (ILT) and have a question regarding the exam requirements for APM. Edit and confi…

---

## [\[Syslog output\] Erratic message output behavior](https://discuss.elastic.co/t/syslog-output-erratic-message-output-behavior/384670)

<div class="topic-metadata">

**Author:** [@TLB35](https://discuss.elastic.co/u/TLB35)\
**Replies:** 6\
**Last updated:** [January 21, 2026, 6:01pm UTC](https://discuss.elastic.co/t/syslog-output-erratic-message-output-behavior/384670 "2026-01-21T18:01:53Z")

</div>

Hi, I'm doing this post as I am encountering a "weird" issue with the syslog-output plugin behavior. My use case is quite simple. My logstash perform a redirection to a nginx cluster. Here is the code snippet : if \[ty…

---

## [Logstash - Translate Use custom MIBS (OEM - Oracle Enterprise Manager)](https://discuss.elastic.co/t/logstash-translate-use-custom-mibs-oem-oracle-enterprise-manager/382915)

<div class="topic-metadata">

**Author:** [@Tal1](https://discuss.elastic.co/u/Tal1)\
**Replies:** 8\
**Last updated:** [October 23, 2025, 4:18pm UTC](https://discuss.elastic.co/t/logstash-translate-use-custom-mibs-oem-oracle-enterprise-manager/382915 "2025-10-23T16:18:41Z")

</div>

Greetings Experts, I hope someone will be able to help me with that issue. I’ve installed Logstash version 9.1.4 on linux redhat machine (version 9.5). logstash is up and running on port 162 receiving snmp trap v3 - e…

---

## [Different responses for search with terms query and get document by id](https://discuss.elastic.co/t/different-responses-for-search-with-terms-query-and-get-document-by-id/385114)

<div class="topic-metadata">

**Author:** [@jprucia](https://discuss.elastic.co/u/jprucia)\
**Replies:** 5\
**Last updated:** [March 17, 2026, 12:42pm UTC](https://discuss.elastic.co/t/different-responses-for-search-with-terms-query-and-get-document-by-id/385114 "2026-03-17T12:42:25Z")

</div>

Here is the scenario: app is running an integration test and is spinning up docker container using official docker image, version 8.7.0. When it’s up nd running, test doest its setup (it is using Spring Data Elasticsearc…

---

## [Maximum cpu cores for a data node](https://discuss.elastic.co/t/maximum-cpu-cores-for-a-data-node/383267)

<div class="topic-metadata">

**Author:** [@yuswanul](https://discuss.elastic.co/u/yuswanul)\
**Replies:** 1\
**Last updated:** [November 6, 2025, 12:50pm UTC](https://discuss.elastic.co/t/maximum-cpu-cores-for-a-data-node/383267 "2025-11-06T12:50:26Z")

</div>

Hi there, i’m just wondering. Is there a maximum number of CPU cores for a data node? Because, for the memory, it is limited to 30-32 GB Heap, right? But does CPU have the same thing? or can we scale it up as high as we…

---

## [Elastic APM + PacketBeat](https://discuss.elastic.co/t/elastic-apm-packetbeat/383222)

<div class="topic-metadata">

**Author:** [@erikg](https://discuss.elastic.co/u/erikg)\
**Replies:** 0\
**Last updated:** [November 4, 2025, 11:48pm UTC](https://discuss.elastic.co/t/elastic-apm-packetbeat/383222 "2025-11-04T23:48:57Z")

</div>

Hello, Other APM solutions offer a network component as part of their APM solution. This network component provides monitoring that helps identify whether network issues are related to application problems. Here’s a re…

---

## [Fleet Server Enroll failure](https://discuss.elastic.co/t/fleet-server-enroll-failure/388685)

<div class="topic-metadata">

**Author:** [@Zaryab\_Shaikh](https://discuss.elastic.co/u/Zaryab_Shaikh)\
**Replies:** 4\
**Last updated:** [July 30, 2026, 7:11am UTC](https://discuss.elastic.co/t/fleet-server-enroll-failure/388685 "2026-07-30T07:11:51Z")

</div>

Title: Fleet Server on External Ubuntu VM Fails to Bootstrap with ECK Deployment Dear Community, I hope you are doing well. I am trying to deploy a standalone Fleet Server on an Ubuntu VM and connect it to my Elastic …

---

## [Basic example of Span with RUM?](https://discuss.elastic.co/t/basic-example-of-span-with-rum/382794)

<div class="topic-metadata">

**Author:** [@learningelastic](https://discuss.elastic.co/u/learningelastic)\
**Replies:** 4\
**Last updated:** [November 5, 2025, 2:45am UTC](https://discuss.elastic.co/t/basic-example-of-span-with-rum/382794 "2025-11-05T02:45:12Z")

</div>

I am trying to test the span feature of RUM. So i wrote this simple code: \<!DOCTYPE html\> \<html lang="en"\> \<head\> \<meta charset="utf-8" /\> \<title\>Span\</title\> \<script src="https://unpkg.com/@elastic/apm-rum@5.12.0…

---

## [Kibana 9.4.6, 9.5.1 Security Update (ESA-2026-149)](https://discuss.elastic.co/t/kibana-9-4-6-9-5-1-security-update-esa-2026-149/390069)

<div class="topic-metadata">

**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\
**Replies:** 0\
**Last updated:** [September 1, 2026, 6:41pm UTC](https://discuss.elastic.co/t/kibana-9-4-6-9-5-1-security-update-esa-2026-149/390069 "2026-09-01T18:41:12Z")

</div>

Missing Authorization in Kibana Leading to Unauthorized Disclosure of Fleet Deployment Metadata Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Exploiting Incorrectly Configured Access C…

---

## [Kibana 9.4.6 Security Update (ESA-2026-84)](https://discuss.elastic.co/t/kibana-9-4-6-security-update-esa-2026-84/390054)

<div class="topic-metadata">

**Author:** [@ismisepaul](https://discuss.elastic.co/u/ismisepaul)\
**Replies:** 0\
**Last updated:** [September 1, 2026, 6:40pm UTC](https://discuss.elastic.co/t/kibana-9-4-6-security-update-esa-2026-84/390054 "2026-09-01T18:40:17Z")

</div>

Allocation of Resources Without Limits or Throttling in Kibana Leading to Denial of Service Allocation of Resources Without Limits or Throttling (CWE-770) in Kibana can lead to a denial of service via Excessive Allocati…

---

## [Upgrade to 9.x - logstash-filter-elastic\_integration](https://discuss.elastic.co/t/upgrade-to-9-x-logstash-filter-elastic-integration/385035)

<div class="topic-metadata">

**Author:** [@CD9820](https://discuss.elastic.co/u/CD9820)\
**Replies:** 5\
**Last updated:** [February 25, 2026, 2:24pm UTC](https://discuss.elastic.co/t/upgrade-to-9-x-logstash-filter-elastic-integration/385035 "2026-02-25T14:24:41Z")

</div>

Hello, we are planning our upgrade from 8.19.x to 9.2.x For some ingestflows we use the logstash-filter-elastic\_integration In the upgrade documentation Elastic recommends upgrading Elasticsearch first, followed by Ki…

---

## [Handle batching just like Persistent Queue using the In-Memory Queue](https://discuss.elastic.co/t/handle-batching-just-like-persistent-queue-using-the-in-memory-queue/383453)

<div class="topic-metadata">

**Author:** [@Oscar\_Moyeda](https://discuss.elastic.co/u/Oscar_Moyeda)\
**Replies:** 6\
**Last updated:** [November 18, 2025, 7:14pm UTC](https://discuss.elastic.co/t/handle-batching-just-like-persistent-queue-using-the-in-memory-queue/383453 "2025-11-18T19:14:27Z")

</div>

Hi everyone. I am using Logstash Version: 9.1.0 I was debugging my output plugin and I found out that when using the default In-memory queue, Logstash would batch the events into smaller chunks of events. I have script…

---

## [404 when curl URL Ingest, Elasticsearch and Fleet](https://discuss.elastic.co/t/404-when-curl-url-ingest-elasticsearch-and-fleet/386860)

<div class="topic-metadata">

**Author:** [@steven.p](https://discuss.elastic.co/u/steven.p)\
**Replies:** 3\
**Last updated:** [June 16, 2026, 2:12pm UTC](https://discuss.elastic.co/t/404-when-curl-url-ingest-elasticsearch-and-fleet/386860 "2026-06-16T14:12:17Z")

</div>

Hi I am just trying to understand when doing a CURL on the URLs of Fleet, Elasticsearch and Ingest, that it always presents a 404. This is with an agents installed and without. Is there some sort of block?

---

## [Cluster overview not working](https://discuss.elastic.co/t/cluster-overview-not-working/385180)

<div class="topic-metadata">

**Author:** [@juancamiloll](https://discuss.elastic.co/u/juancamiloll)\
**Replies:** 1\
**Last updated:** [February 24, 2026, 8:25pm UTC](https://discuss.elastic.co/t/cluster-overview-not-working/385180 "2026-02-24T20:25:46Z")

</div>

Hello, I am currently on version 8.19.8 and am preparing to first upgrade to the latest version of 8.x and then to 9.x. In “Upgrade Assistant,” I set out to remove the warnings I had, and when I got to the last one rel…

---

## [Entitlements and tmpdir](https://discuss.elastic.co/t/entitlements-and-tmpdir/384627)

<div class="topic-metadata">

**Author:** [@frantz45](https://discuss.elastic.co/u/frantz45)\
**Replies:** 4\
**Last updated:** [January 20, 2026, 3:02pm UTC](https://discuss.elastic.co/t/entitlements-and-tmpdir/384627 "2026-01-20T15:02:29Z")

</div>

Hello, I’ve just tried v8.19.10 and I get an issue with entitlements: \[2026-01-19T17:13:13,437\]\[ERROR\]\[o.e.b.Elasticsearch \] \[redacted\] fatal exception while booting Elasticsearch java.lang.IllegalArgumentExceptio…

---

## [Threat Intel Rules and Threat Enrichments](https://discuss.elastic.co/t/threat-intel-rules-and-threat-enrichments/385093)

<div class="topic-metadata">

**Author:** [@K4ruzo](https://discuss.elastic.co/u/K4ruzo)\
**Replies:** 1\
**Last updated:** [March 10, 2026, 6:07pm UTC](https://discuss.elastic.co/t/threat-intel-rules-and-threat-enrichments/385093 "2026-03-10T18:07:44Z")

</div>

I have some questions about the timing of detection rules and their threat enrichments. I am working with the prebuilt rule “Threat Intel IP Address Indicator Match” and I am trying to reduce false positives. My goal is…

---

## [Apm-agent-python: FastAPI ≥0.137 breaks ElasticAPM middleware - AttributeError "'\_IncludedRouter' object has no attribute 'path'"](https://discuss.elastic.co/t/apm-agent-python-fastapi-0-137-breaks-elasticapm-middleware-attributeerror-includedrouter-object-has-no-attribute-path/387112)

<div class="topic-metadata">

**Author:** [@Sophie\_Clark](https://discuss.elastic.co/u/Sophie_Clark)\
**Replies:** 2\
**Last updated:** [June 23, 2026, 7:25am UTC](https://discuss.elastic.co/t/apm-agent-python-fastapi-0-137-breaks-elasticapm-middleware-attributeerror-includedrouter-object-has-no-attribute-path/387112 "2026-06-23T07:25:06Z")

</div>

APM Agent language and version: Python - elastic-apm (6.26.1). The bug affects all current releases (≤ 6.26.1): the newest agent (6.26.1, 25 May 2026) predates FastAPI 0.137.0 (14 Jun 2026), so no released version handle…

---

## [Kibana 9.x internal APIs blocked – how to support iframe SSO login from external app](https://discuss.elastic.co/t/kibana-9-x-internal-apis-blocked-how-to-support-iframe-sso-login-from-external-app/383276)

<div class="topic-metadata">

**Author:** [@Shivam\_Mahajan](https://discuss.elastic.co/u/Shivam_Mahajan)\
**Replies:** 2\
**Last updated:** [November 11, 2025, 3:26am UTC](https://discuss.elastic.co/t/kibana-9-x-internal-apis-blocked-how-to-support-iframe-sso-login-from-external-app/383276 "2025-11-11T03:26:35Z")

</div>

We upgraded from Kibana 8.9.0 to 9.2.0 and our previous integration stopped working. Earlier, our external application (Application A) used the /internal/security/login endpoint to authenticate users programmatically and…

---

## [9.4.4 tag but no 9.4.4 release](https://discuss.elastic.co/t/9-4-4-tag-but-no-9-4-4-release/388655)

<div class="topic-metadata">

**Author:** [@Michka](https://discuss.elastic.co/u/Michka)\
**Replies:** 3\
**Last updated:** [July 23, 2026, 8:42pm UTC](https://discuss.elastic.co/t/9-4-4-tag-but-no-9-4-4-release/388655 "2026-07-23T20:42:08Z")

</div>

Hello Homebrew maintainer here. We noticed that there is no 9.4.4 release on Github, but a 9.4.4 tag. Is this expected? In general the latest tag is also marked as official release for Elastic, so we want to make sure …

---

## [Elasticsearch discovery seed\_hosts](https://discuss.elastic.co/t/elasticsearch-discovery-seed-hosts/384733)

<div class="topic-metadata">

**Author:** [@varun\_vetrivendan](https://discuss.elastic.co/u/varun_vetrivendan)\
**Replies:** 4\
**Last updated:** [January 26, 2026, 2:15pm UTC](https://discuss.elastic.co/t/elasticsearch-discovery-seed-hosts/384733 "2026-01-26T14:15:05Z")

</div>

The Current Master ensures that the cluster state is present in all the nodes inclusive of the data nodes. Which means the datanodes know the cluster state and who the current master is and which nodes are master eligibl…

---

## [Architecture Desing CCR](https://discuss.elastic.co/t/architecture-desing-ccr/390890)

<div class="topic-metadata">

**Author:** [@chandrakt](https://discuss.elastic.co/u/chandrakt)\
**Replies:** 6\
**Last updated:** [October 8, 2026, 3:12pm UTC](https://discuss.elastic.co/t/architecture-desing-ccr/390890 "2026-10-08T15:12:37Z")

</div>

Dear Team, We are planning to implement an on-premises Elastic SIEM/EDR solution for an OT/IT security environment comprising approximately 60 endpoints and an estimated daily log ingestion volume of 50 GB/day. Before …

---

## [Can't log in to my first lab and Help Desk sent me here - Help?](https://discuss.elastic.co/t/cant-log-in-to-my-first-lab-and-help-desk-sent-me-here-help/383280)

<div class="topic-metadata">

**Author:** [@SeanHmusic](https://discuss.elastic.co/u/SeanHmusic)\
**Replies:** 3\
**Last updated:** [November 7, 2025, 5:03pm UTC](https://discuss.elastic.co/t/cant-log-in-to-my-first-lab-and-help-desk-sent-me-here-help/383280 "2025-11-07T17:03:03Z")

</div>

Good day. So sorry to bother you with this trivial matter, but I can’t get into my first Kibana lab and Help Desk sent me here. They thought you might be able to help better. Course: The course I’m taking atm is the “E…

---

## [Calculating size for status](https://discuss.elastic.co/t/calculating-size-for-status/383209)

<div class="topic-metadata">

**Author:** [@YousefNein](https://discuss.elastic.co/u/YousefNein)\
**Replies:** 4\
**Last updated:** [November 6, 2025, 8:33pm UTC](https://discuss.elastic.co/t/calculating-size-for-status/383209 "2025-11-06T20:33:54Z")

</div>

Is there a proper way to calculate EPS or GB per day using Elasticsearch or Kibana dashboards?

---

## [Transactions Not Properly Labeled Since .NET 10 Upgrade](https://discuss.elastic.co/t/transactions-not-properly-labeled-since-net-10-upgrade/384458)

<div class="topic-metadata">

**Author:** [@Brandon\_Liles](https://discuss.elastic.co/u/Brandon_Liles)\
**Replies:** 1\
**Last updated:** [February 2, 2026, 1:39pm UTC](https://discuss.elastic.co/t/transactions-not-properly-labeled-since-net-10-upgrade/384458 "2026-02-02T13:39:20Z")

</div>

Kibana version: 8.18.2 Elasticsearch version: 8.18.2 APM Server version: 8.18.2 APM Agent language and version: Elastic.Apm.NetCoreAll 1.34.1 running on .NET 10 Browser version: n/a Original install method (e.g. dow…

---

## [Fleet Server 8.19.20, 9.4.5, 9.5.1 Security Update (ESA-2026-93)](https://discuss.elastic.co/t/fleet-server-8-19-20-9-4-5-9-5-1-security-update-esa-2026-93/389510)

<div class="topic-metadata">

**Author:** [@ikakavas](https://discuss.elastic.co/u/ikakavas)\
**Replies:** 0\
**Last updated:** [August 13, 2026, 10:47am UTC](https://discuss.elastic.co/t/fleet-server-8-19-20-9-4-5-9-5-1-security-update-esa-2026-93/389510 "2026-08-13T10:47:36Z")

</div>

Improper Control of Generation of Code in Fleet Server Leading to Code Injection Description: Improper Control of Generation of Code ('Code Injection') (CWE-94) in Fleet Server can lead to the execution of attacker-sup…

---

## [ILM Indices Blocking Master Queue - All Operations Timeout](https://discuss.elastic.co/t/ilm-indices-blocking-master-queue-all-operations-timeout/385725)

<div class="topic-metadata">

**Author:** [@Anup\_Kumar](https://discuss.elastic.co/u/Anup_Kumar)\
**Replies:** 5\
**Last updated:** [April 2, 2026, 8:40am UTC](https://discuss.elastic.co/t/ilm-indices-blocking-master-queue-all-operations-timeout/385725 "2026-04-02T08:40:02Z")

</div>

Our ES cluster has blocked master queue for 12+ days. All cluster state change operations timeout after 30s, including: Index open operations Index delete operations ILM move commands ILM stop/start commands …

---

## [ILM Policy](https://discuss.elastic.co/t/ilm-policy/389839)

<div class="topic-metadata">

**Author:** [@Marek\_Galbavy](https://discuss.elastic.co/u/Marek_Galbavy)\
**Replies:** 3\
**Last updated:** [August 21, 2026, 12:06pm UTC](https://discuss.elastic.co/t/ilm-policy/389839 "2026-08-21T12:06:43Z")

</div>

Hi, I'm preparing for the Elastic certification and I have a dilemma regarding ILM policy. If the task in the exam were, for example, to set the warm phase to 7d, cold to 14d, etc., how should this be solved correctly? S…

---

## [Kibana lost services in apm after timerange extend](https://discuss.elastic.co/t/kibana-lost-services-in-apm-after-timerange-extend/383582)

<div class="topic-metadata">

**Author:** [@Karol\_Niema](https://discuss.elastic.co/u/Karol_Niema)\
**Replies:** 3\
**Last updated:** [February 2, 2026, 8:37am UTC](https://discuss.elastic.co/t/kibana-lost-services-in-apm-after-timerange-extend/383582 "2026-02-02T08:37:30Z")

</div>

kibana 9.03 elasticserach 9.0.3 Hello I am facing problem with disappeared services in Observability -\> services problem occurs when time range extend, after changing to last 15 min it also happens when exten…

---

## [Help with Lens Bar (only show values)](https://discuss.elastic.co/t/help-with-lens-bar-only-show-values/384344)

<div class="topic-metadata">

**Author:** [@erikg](https://discuss.elastic.co/u/erikg)\
**Replies:** 6\
**Last updated:** [January 3, 2026, 2:51am UTC](https://discuss.elastic.co/t/help-with-lens-bar-only-show-values/384344 "2026-01-03T02:51:47Z")

</div>

Hello All, I was creating a visualization of process metrics using Elastic Agent System Integration. This is collecting top processes by CPU. I am wondering how do I show only data, if you see some values appear but th…

---

## [Create a custom dashboard on elastic alerting data](https://discuss.elastic.co/t/create-a-custom-dashboard-on-elastic-alerting-data/384108)

<div class="topic-metadata">

**Author:** [@Maretti](https://discuss.elastic.co/u/Maretti)\
**Replies:** 2\
**Last updated:** [December 16, 2025, 11:15am UTC](https://discuss.elastic.co/t/create-a-custom-dashboard-on-elastic-alerting-data/384108 "2025-12-16T11:15:59Z")

</div>

Hi, I would like to create a dashboard with the data from elastic alerting. According to this documentation page the data is visible under .internal-alerts-\* indices I can see those in index management ex. .internal…

---

## [Newly created Agent policy has space\_id set to null in version 9.4.2](https://discuss.elastic.co/t/newly-created-agent-policy-has-space-id-set-to-null-in-version-9-4-2/386845)

<div class="topic-metadata">

**Author:** [@umesh2020](https://discuss.elastic.co/u/umesh2020)\
**Replies:** 3\
**Last updated:** [June 13, 2026, 12:14am UTC](https://discuss.elastic.co/t/newly-created-agent-policy-has-space-id-set-to-null-in-version-9-4-2/386845 "2026-06-13T00:14:32Z")

</div>

POST kbn://api/fleet/agent\_policies { "description": "Private Location Agent Policy", "monitoring\_enabled": \[ "logs", "metrics" \], "name": "Priv Location Agent Policy", "namespace": "default" } { "item": {…

---

## [Paraya 7 JAX-RS invalid transaction name + no span captured with @WithSpan](https://discuss.elastic.co/t/paraya-7-jax-rs-invalid-transaction-name-no-span-captured-with-withspan/384995)

<div class="topic-metadata">

**Author:** [@ciment](https://discuss.elastic.co/u/ciment)\
**Replies:** 3\
**Last updated:** [March 17, 2026, 12:42pm UTC](https://discuss.elastic.co/t/paraya-7-jax-rs-invalid-transaction-name-no-span-captured-with-withspan/384995 "2026-03-17T12:42:03Z")

</div>

Hi, @Sylvain\_Juge Based on previous discussion ( Problem with distributing tracing for Jakarta 10 and payara 6 ) I have already prepared project to test EDOT java agent with payara7. I have problem with payara 7.2026.…

---

## [Security labs documentation via API call - ignoreSecurityLabs](https://discuss.elastic.co/t/security-labs-documentation-via-api-call-ignoresecuritylabs/389948)

<div class="topic-metadata">

**Author:** [@novst](https://discuss.elastic.co/u/novst)\
**Replies:** 2\
**Last updated:** [September 3, 2026, 2:25pm UTC](https://discuss.elastic.co/t/security-labs-documentation-via-api-call-ignoresecuritylabs/389948 "2026-09-03T14:25:11Z")

</div>

Hello, I am trying to automate installation for the customer and I want to install "Elastic documentation" and "Security labs" under http://localhost:5601/app/management/ai/genAiSettings According to documentation Crea…

---

## [Elastic 8.10.4](https://discuss.elastic.co/t/elastic-8-10-4/383848)

<div class="topic-metadata">

**Author:** [@jgomezf](https://discuss.elastic.co/u/jgomezf)\
**Replies:** 7\
**Last updated:** [December 9, 2025, 5:32pm UTC](https://discuss.elastic.co/t/elastic-8-10-4/383848 "2025-12-09T17:32:57Z")

</div>

Hello. We are working with elastic 8.4.x and the ecs-logstash was working correctly. We have updated the version 8.10..4 and the ecs-logstash and pattern is not found. It's possibility that the version is not available.…

---

## [Creation date of logstash created files, with %{+YYYY.MM.dd} in the name, is offset by few hours](https://discuss.elastic.co/t/creation-date-of-logstash-created-files-with-yyyy-mm-dd-in-the-name-is-offset-by-few-hours/385002)

<div class="topic-metadata">

**Author:** [@Toxic\_Bunny](https://discuss.elastic.co/u/Toxic_Bunny)\
**Replies:** 4\
**Last updated:** [February 22, 2026, 3:28pm UTC](https://discuss.elastic.co/t/creation-date-of-logstash-created-files-with-yyyy-mm-dd-in-the-name-is-offset-by-few-hours/385002 "2026-02-22T15:28:31Z")

</div>

Logstash sends all unprocessed leftovers into a separate .log file for archiving purposes output{ file { path =\> "/var/log/logstash/archive-%{+YYYY.MM.dd}.log" } } The problem is that logstash additionally offsets …

---

## [Architecture check: Offloading Logstash gsub regex to K8s pod sidecars to save CPU?](https://discuss.elastic.co/t/architecture-check-offloading-logstash-gsub-regex-to-k8s-pod-sidecars-to-save-cpu/385800)

<div class="topic-metadata">

**Author:** [@Ilya\_Ploskovitov](https://discuss.elastic.co/u/Ilya_Ploskovitov)\
**Replies:** 0\
**Last updated:** [April 7, 2026, 1:43pm UTC](https://discuss.elastic.co/t/architecture-check-offloading-logstash-gsub-regex-to-k8s-pod-sidecars-to-save-cpu/385800 "2026-04-07T13:43:49Z")

</div>

Hi everyone, We’ve been dealing with a classic pipeline bottleneck: our Logstash nodes are burning massive amounts of CPU because we have dozens of gsub mutate filters to scrub PII and secrets (like emails, Stripe token…

---

## [Repository URL Changed: /packages/x.x/yum/ No Longer Working - Official Documentation Needed](https://discuss.elastic.co/t/repository-url-changed-packages-x-x-yum-no-longer-working-official-documentation-needed/385469)

<div class="topic-metadata">

**Author:** [@ven\_off](https://discuss.elastic.co/u/ven_off)\
**Replies:** 0\
**Last updated:** [March 16, 2026, 1:41pm UTC](https://discuss.elastic.co/t/repository-url-changed-packages-x-x-yum-no-longer-working-official-documentation-needed/385469 "2026-03-16T13:41:22Z")

</div>

Hello Elasticsearch Community, We're experiencing issues syncing Elasticsearch packages from the official repository and have discovered that the repository URL structure has changed Problem: Our mirrors server is con…

---

## [Dec 1st, 2025: \[FR\] Cher Père Noël, Voici un petit --help pour les fêtes](https://discuss.elastic.co/t/dec-1st-2025-fr-cher-pere-noel-voici-un-petit-help-pour-les-fetes/383562)

<div class="topic-metadata">

**Author:** [@Laurent\_Saint-Felix](https://discuss.elastic.co/u/Laurent_Saint-Felix)\
**Replies:** 0\
**Last updated:** [December 1, 2025, 8:00am UTC](https://discuss.elastic.co/t/dec-1st-2025-fr-cher-pere-noel-voici-un-petit-help-pour-les-fetes/383562 "2025-12-01T08:00:44Z")

</div>

This post also exists in English. Chaque année, le Père Noël est confronté au même problème de mise à l'échelle : Des milliards d'enfants, une seule fenêtre de livraison, aucune marge d'erreur. Pendant des siècles,…

---

## [Elastic Agent to Logstash](https://discuss.elastic.co/t/elastic-agent-to-logstash/385314)

<div class="topic-metadata">

**Author:** [@arav](https://discuss.elastic.co/u/arav)\
**Replies:** 3\
**Last updated:** [March 3, 2026, 1:14pm UTC](https://discuss.elastic.co/t/elastic-agent-to-logstash/385314 "2026-03-03T13:14:30Z")

</div>

I cant send the elastic agent to logstash I have the logstash listed in Fleet → Settings While creating a policy, while selecting output for integration, the logstash option is available but not clickable

---

## [Best practices for migrating ELK artifacts and configurations across environments](https://discuss.elastic.co/t/best-practices-for-migrating-elk-artifacts-and-configurations-across-environments/385051)

<div class="topic-metadata">

**Author:** [@Tortoise](https://discuss.elastic.co/u/Tortoise)\
**Replies:** 4\
**Last updated:** [February 16, 2026, 1:25pm UTC](https://discuss.elastic.co/t/best-practices-for-migrating-elk-artifacts-and-configurations-across-environments/385051 "2026-02-16T13:25:19Z")

</div>

Hi All, I am looking for guidance on best practices for migrating ELK artifacts from lower environments (e.g., Dev/Test) to higher environments (e.g., UAT/Prod). For application code, we typically use GitLab/Jenkins wi…

---

## [Rule Consumer explanation](https://discuss.elastic.co/t/rule-consumer-explanation/383264)

<div class="topic-metadata">

**Author:** [@lduvnjak](https://discuss.elastic.co/u/lduvnjak)\
**Replies:** 3\
**Last updated:** [November 21, 2025, 11:40am UTC](https://discuss.elastic.co/t/rule-consumer-explanation/383264 "2025-11-21T11:40:57Z")

</div>

Hi everyone, Can someone give me a rundown of what each consumer means and is tied to? Regarding the Rule APIs (Create/Update). There's an open Github issue for improving the documentation but it seems to be in one he…

---

## [Best practice for enriching logs with environment names](https://discuss.elastic.co/t/best-practice-for-enriching-logs-with-environment-names/384655)

<div class="topic-metadata">

**Author:** [@curiousdba](https://discuss.elastic.co/u/curiousdba)\
**Replies:** 4\
**Last updated:** [January 22, 2026, 3:46pm UTC](https://discuss.elastic.co/t/best-practice-for-enriching-logs-with-environment-names/384655 "2026-01-22T15:46:54Z")

</div>

I want to enrich logs by adding service information (Environment specifically). Add a service name to logs seems like what I want. But none of the options seem ideal. Ideally I would have an agent policy for (say) the …

[Previous page](https://discuss.elastic.co/top.md?page=11&per_page=50)

[Next page](https://discuss.elastic.co/top.md?page=13&per_page=50)