# Top **URL:** https://discuss.elastic.co/top.md?page=14 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 15 --- ## [License dection rules](https://discuss.elastic.co/t/license-dection-rules/390802)
**Author:** [@vas-vas777](https://discuss.elastic.co/u/vas-vas777)\ **Replies:** 3\ **Last updated:** [October 16, 2026, 11:58am UTC](https://discuss.elastic.co/t/license-dection-rules/390802 "2026-10-16T11:58:33Z")
Hello, everyone! I develope my self-made EDR application. In this application I use YARA app from VirusTotal. In future. I will plan sell my software for third parties. Can I use your yara rules (protections-artifacts/ya… --- ## [Installation - receive this message:](https://discuss.elastic.co/t/installation-receive-this-message/384603)
**Author:** [@jwelby](https://discuss.elastic.co/u/jwelby)\ **Replies:** 3\ **Last updated:** [January 19, 2026, 8:45pm UTC](https://discuss.elastic.co/t/installation-receive-this-message/384603 "2026-01-19T20:45:47Z")
error root\_cause 0 type "status\_exception" reason "Cluster state has not been recovered yet, cannot write to the \[null\] index" type "authentication\_processing\_error" reason "failed to promote the aut… --- ## [Attempting to match or filter but still always return all values](https://discuss.elastic.co/t/attempting-to-match-or-filter-but-still-always-return-all-values/385708)
**Author:** [@Whoami1980](https://discuss.elastic.co/u/Whoami1980)\ **Replies:** 8\ **Last updated:** [April 2, 2026, 9:13am UTC](https://discuss.elastic.co/t/attempting-to-match-or-filter-but-still-always-return-all-values/385708 "2026-04-02T09:13:12Z")
Can anyone share a working example of how to match or filter a field based on existing data? I have attempted the following query but it still returns all values. Also whats the difference between match and filter? Thank… --- ## [ECK Filebeat, ID duplicate for containers in the same namespace as Filebeat](https://discuss.elastic.co/t/eck-filebeat-id-duplicate-for-containers-in-the-same-namespace-as-filebeat/383016)
**Author:** [@kee8veiN](https://discuss.elastic.co/u/kee8veiN)\ **Replies:** 3\ **Last updated:** [October 28, 2025, 4:36pm UTC](https://discuss.elastic.co/t/eck-filebeat-id-duplicate-for-containers-in-the-same-namespace-as-filebeat/383016 "2025-10-28T16:36:11Z")
Hello team. I encountered a problem (ECK installation) with Beats/Filebeat (autodiscover Kubernetes mode), {"log.level":"error","@timestamp":"2025-10-27T11:34:59.854Z","log.logger":"input","log.origin":{"function":"git… --- ## [Elastic search java client - co.elastic.clients:elasticsearch-java: and minimum target java road map](https://discuss.elastic.co/t/elastic-search-java-client-co-elastic-clients-and-minimum-target-java-road-map/386328)
**Author:** [@manick02](https://discuss.elastic.co/u/manick02)\ **Replies:** 2\ **Last updated:** [June 5, 2026, 6:08am UTC](https://discuss.elastic.co/t/elastic-search-java-client-co-elastic-clients-and-minimum-target-java-road-map/386328 "2026-06-05T06:08:03Z")
We use co.elastic.clients:elasticsearch-java in our application, which currently targets Java 17. We understand the 8.x client requires Java 17 as a minimum. Does Elastic have a published roadmap or policy for when the … --- ## [Migration from ES 8.19.20 to 9.5.2 blocked by internal index: .transform-internal-007](https://discuss.elastic.co/t/migration-from-es-8-19-20-to-9-5-2-blocked-by-internal-index-transform-internal-007/390043)
**Author:** [@halmartin](https://discuss.elastic.co/u/halmartin)\ **Replies:** 3\ **Last updated:** [September 1, 2026, 7:04pm UTC](https://discuss.elastic.co/t/migration-from-es-8-19-20-to-9-5-2-blocked-by-internal-index-transform-internal-007/390043 "2026-09-01T19:04:00Z")
Hello, I have an Elasticsearch 8.19.20 self-hosted basic/free cluster used for logging and Kibana that I am trying to upgrade to 9.5.2. in Kibana, under Management \> Stack management I see no Migration Assistant so I am… --- ## [Logstash output input Logstash](https://discuss.elastic.co/t/logstash-output-input-logstash/386571)
**Author:** [@Sam11](https://discuss.elastic.co/u/Sam11)\ **Replies:** 3\ **Last updated:** [May 29, 2026, 4:01pm UTC](https://discuss.elastic.co/t/logstash-output-input-logstash/386571 "2026-05-29T16:01:44Z")
Recently I started getting frequent Read timed out errors from Logstash 1 which is seding to another logstash via the plugin input/output Logstash. I am experiencing a major latency issue. Data is not lost, but logs arr… --- ## [Repository\_verification\_exception](https://discuss.elastic.co/t/repository-verification-exception/383588)
**Author:** [@juancamiloll](https://discuss.elastic.co/u/juancamiloll)\ **Replies:** 3\ **Last updated:** [November 21, 2025, 2:23pm UTC](https://discuss.elastic.co/t/repository-verification-exception/383588 "2025-11-21T14:23:43Z")
I am in the process of configuring the “Snapshot and restore” functionality. I have a cluster of 3 servers for Elasticsearch. From the available options, “Shared File System” has been selected. I took one of the se… --- ## [Migrating from Elastic NEST v7 to .NET Elastic Client v9: Aggregation with Nested clause](https://discuss.elastic.co/t/migrating-from-elastic-nest-v7-to-net-elastic-client-v9-aggregation-with-nested-clause/383958)
**Author:** [@Vadym\_Romanenko](https://discuss.elastic.co/u/Vadym_Romanenko)\ **Replies:** 2\ **Last updated:** [December 10, 2025, 3:22pm UTC](https://discuss.elastic.co/t/migrating-from-elastic-nest-v7-to-net-elastic-client-v9-aggregation-with-nested-clause/383958 "2025-12-10T15:22:45Z")
I’m moving code from the NEST client to the Elasticsearch client v9.2. I’m trying to generate aggregation that contains a nested filter. Here is sample of the old code with NEST: AggregationContainerDescriptor\ ret; … --- ## [Does the restore function support incremental recovery?](https://discuss.elastic.co/t/does-the-restore-function-support-incremental-recovery/386434)
**Author:** [@mloine](https://discuss.elastic.co/u/mloine)\ **Replies:** 5\ **Last updated:** [May 21, 2026, 10:38am UTC](https://discuss.elastic.co/t/does-the-restore-function-support-incremental-recovery/386434 "2026-05-21T10:38:54Z")
Hello, we currently have a scenario where the new and old clusters are switched, and data will be restored to the new cluster using snapshots; I would like to ask if the restore method also supports incremental recovery… --- ## [Hot/Warm Architecture with uniform hardware?](https://discuss.elastic.co/t/hot-warm-architecture-with-uniform-hardware/384152)
**Author:** [@algo](https://discuss.elastic.co/u/algo)\ **Replies:** 5\ **Last updated:** [December 18, 2025, 6:57am UTC](https://discuss.elastic.co/t/hot-warm-architecture-with-uniform-hardware/384152 "2025-12-18T06:57:16Z")
Is there any benefit to (or any problems with) data tiering if all nodes use the same type of storage media? In the past, I’ve seen suggestions to transition to a hot/warm/cold architecture for different storage media - … --- ## [RFC: Disable automatic refresh in event analyzer](https://discuss.elastic.co/t/rfc-disable-automatic-refresh-in-event-analyzer/390600)
**Author:** [@michael-a](https://discuss.elastic.co/u/michael-a)\ **Replies:** 0\ **Last updated:** [September 23, 2026, 8:35am UTC](https://discuss.elastic.co/t/rfc-disable-automatic-refresh-in-event-analyzer/390600 "2026-09-23T08:35:03Z")
When analyzing events from detections/alerts with automatic refresh, the analyze view automatically refresh too which isn't necessarily what one wants. Therefore it would be better if the automatic refresh either would t… --- ## [Elastic Cloud on Kubernetes 3.5.0 Security Update (ESA-2026-113)](https://discuss.elastic.co/t/elastic-cloud-on-kubernetes-3-5-0-security-update-esa-2026-113/389493)
**Author:** [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Replies:** 0\ **Last updated:** [August 13, 2026, 10:46am UTC](https://discuss.elastic.co/t/elastic-cloud-on-kubernetes-3-5-0-security-update-esa-2026-113/389493 "2026-08-13T10:46:40Z")
Cleartext Storage of Sensitive Information in an Environment Variable in Elastic Cloud on Kubernetes Leading to Information Disclosure Cleartext Storage of Sensitive Information in an Environment Variable (CWE-526) in E… --- ## [Metricbeat SQL Module with cursor rereading rows](https://discuss.elastic.co/t/metricbeat-sql-module-with-cursor-rereading-rows/387286)
**Author:** [@lpeter](https://discuss.elastic.co/u/lpeter)\ **Replies:** 3\ **Last updated:** [June 25, 2026, 7:39am UTC](https://discuss.elastic.co/t/metricbeat-sql-module-with-cursor-rereading-rows/387286 "2026-06-25T07:39:31Z")
Hello! I think I may have hit a bug where Metricbeat SQL module's cursor state can be read from the wrong Elastic Agent component data path, causing cursor reset and duplicate ingestion. This is on Elastic Agent / Metr… --- ## [Question about APM Logs feature support across agents](https://discuss.elastic.co/t/question-about-apm-logs-feature-support-across-agents/383418)
**Author:** [@barcus](https://discuss.elastic.co/u/barcus)\ **Replies:** 3\ **Last updated:** [December 4, 2025, 3:07pm UTC](https://discuss.elastic.co/t/question-about-apm-logs-feature-support-across-agents/383418 "2025-12-04T15:07:34Z")
Hello APM team, I have a question regarding the experimental feature that allows application logs to be ingested through the APM Agent and stored directly into the APM log indices (one index per APM service). From what… --- ## [JsonXContent NoClassDefFoundError only in Production — Works Locally](https://discuss.elastic.co/t/jsonxcontent-noclassdeffounderror-only-in-production-works-locally/383673)
**Author:** [@Md\_Nisar\_Ahmed](https://discuss.elastic.co/u/Md_Nisar_Ahmed)\ **Replies:** 3\ **Last updated:** [November 26, 2025, 1:35pm UTC](https://discuss.elastic.co/t/jsonxcontent-noclassdeffounderror-only-in-production-works-locally/383673 "2025-11-26T13:35:51Z")
Hi team, I am getting this error only in my production server, but the exact same code works perfectly on my local machine: java.lang.NoClassDefFoundError: Could not initialize class org.elasticsearch.xcontent.json.Js… --- ## [Problem Updating kibana 8.19 -\> 9.4.1](https://discuss.elastic.co/t/problem-updating-kibana-8-19-9-4-1/386468)
**Author:** [@Shahar\_Argov](https://discuss.elastic.co/u/Shahar_Argov)\ **Replies:** 1\ **Last updated:** [May 24, 2026, 12:24pm UTC](https://discuss.elastic.co/t/problem-updating-kibana-8-19-9-4-1/386468 "2026-05-24T12:24:30Z")
We have been updating our cluster from 8.19 to 9.4.1, we finished all the nodes except the kibana. when updating we saw the service stuck on \[plugins.screenshotting.chromium\] Browser executable: /usr/share/kibana/node\_mo… --- ## [Trigger alert for individual cpu core crossing 95% utilization](https://discuss.elastic.co/t/trigger-alert-for-individual-cpu-core-crossing-95-utilization/389959)
**Author:** [@PRASHANT\_MEHTA](https://discuss.elastic.co/u/PRASHANT_MEHTA)\ **Replies:** 2\ **Last updated:** [August 28, 2026, 12:19pm UTC](https://discuss.elastic.co/t/trigger-alert-for-individual-cpu-core-crossing-95-utilization/389959 "2026-08-28T12:19:32Z")
I have a simple requirement to trigger alert if any of the CPU core breach 95% threshold:(using alert/rule in kibana) Challenge facing: system.core.total.pct this field gives abnormal values to be used like 1000, 4700, … --- ## [Logstash 8.19.x is required which java 17 or Java 21](https://discuss.elastic.co/t/logstash-8-19-x-is-required-which-java-17-or-java-21/386036)
**Author:** [@Siddhartha](https://discuss.elastic.co/u/Siddhartha)\ **Replies:** 2\ **Last updated:** [April 27, 2026, 7:06am UTC](https://discuss.elastic.co/t/logstash-8-19-x-is-required-which-java-17-or-java-21/386036 "2026-04-27T07:06:23Z")
Logstash 8.19.x is required which java 17 or Java 21 though JDK 21 is bundled with it --- ## [Detection rules manual run: cannot be scheduled earlier than 90 days ago](https://discuss.elastic.co/t/detection-rules-manual-run-cannot-be-scheduled-earlier-than-90-days-ago/383033)
**Author:** [@niklaskurvinen](https://discuss.elastic.co/u/niklaskurvinen)\ **Replies:** 2\ **Last updated:** [October 31, 2025, 4:33am UTC](https://discuss.elastic.co/t/detection-rules-manual-run-cannot-be-scheduled-earlier-than-90-days-ago/383033 "2025-10-31T04:33:00Z")
Hi, Just came across the “Manual rule run cannot be scheduled earlier than 90 days ago” message for the first time. Is there a reason for this limitation and more importantly; can I override it? Tried to find any kind o… --- ## [Clear out old alerts](https://discuss.elastic.co/t/clear-out-old-alerts/383019)
**Author:** [@dot-mike](https://discuss.elastic.co/u/dot-mike)\ **Replies:** 2\ **Last updated:** [October 27, 2025, 3:54pm UTC](https://discuss.elastic.co/t/clear-out-old-alerts/383019 "2025-10-27T15:54:35Z")
Hi community, is it safe to remove the indicies .internal.alerts-observability.logs.alerts-default-\ or .internal.alerts-observability.metrics.alerts-default-\ to clear out old alerts? I want to start from scratc… --- ## [GUI \>\> Cluster \>\> Logstash \>\> Nodes (no nodes displayed)](https://discuss.elastic.co/t/gui-cluster-logstash-nodes-no-nodes-displayed/385739)
**Author:** [@Whoami1980](https://discuss.elastic.co/u/Whoami1980)\ **Replies:** 6\ **Last updated:** [April 9, 2026, 5:50am UTC](https://discuss.elastic.co/t/gui-cluster-logstash-nodes-no-nodes-displayed/385739 "2026-04-09T05:50:33Z")
When we click on Nodes under the Logstash section. Nothing is displayed!! --- ## [Fleet-managed APM Server monitoring metrics on a dedicated monitoring cluster](https://discuss.elastic.co/t/fleet-managed-apm-server-monitoring-metrics-on-a-dedicated-monitoring-cluster/387506)
**Author:** [@javierE](https://discuss.elastic.co/u/javierE)\ **Replies:** 3\ **Last updated:** [July 6, 2026, 6:39pm UTC](https://discuss.elastic.co/t/fleet-managed-apm-server-monitoring-metrics-on-a-dedicated-monitoring-cluster/387506 "2026-07-06T18:39:14Z")
Hi everyone, I'm testing a fleet-managed apmserver and trying to understand the correct way to monitor the APM Server itself. My current setup is: A Fleet-managed APM Server. (stack version 9.4.1) The policy default… --- ## [UnHealthy agent](https://discuss.elastic.co/t/unhealthy-agent/385188)
**Author:** [@harry22](https://discuss.elastic.co/u/harry22)\ **Replies:** 3\ **Last updated:** [February 28, 2026, 5:20am UTC](https://discuss.elastic.co/t/unhealthy-agent/385188 "2026-02-28T05:20:36Z")
PS C:\\Program Files\\Elastic\\Agent\> .'.\\elastic-agent.exe' status ┌─ fleet │ └─ status: (STARTING) └─ elastic-agent ├─ status: (DEGRADED) 1 or more components/units in a degraded state └─ endpoint-default ├─ status… --- ## [Debian 13 and Beats 8.x](https://discuss.elastic.co/t/debian-13-and-beats-8-x/383870)
**Author:** [@d3jolly](https://discuss.elastic.co/u/d3jolly)\ **Replies:** 1\ **Last updated:** [December 4, 2025, 5:50pm UTC](https://discuss.elastic.co/t/debian-13-and-beats-8-x/383870 "2025-12-04T17:50:40Z")
Hi, According to the Support Matrix, Beats on Debian 13 (at least Filebeat and Metricbeat, since e.g. Auditbeat doesn’t list anything past Debian 10) should be v9.2.x Potential issues when running unofficially supporte… --- ## [Endpoint does not show up in Asset management page](https://discuss.elastic.co/t/endpoint-does-not-show-up-in-asset-management-page/387505)
**Author:** [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Replies:** 3\ **Last updated:** [July 3, 2026, 6:51pm UTC](https://discuss.elastic.co/t/endpoint-does-not-show-up-in-asset-management-page/387505 "2026-07-03T18:51:03Z")
Hello, I have a deployment on Elastic Cloud for tests and I'm doing a test with Elastic Defend. I have a policy that has Elastic Defend configured with 1 agent enrolled with healthy status. But when I go into Asset… --- ## [Upgrade agent on Fleet server](https://discuss.elastic.co/t/upgrade-agent-on-fleet-server/383902)
**Author:** [@kernelpanic](https://discuss.elastic.co/u/kernelpanic)\ **Replies:** 1\ **Last updated:** [December 5, 2025, 6:55pm UTC](https://discuss.elastic.co/t/upgrade-agent-on-fleet-server/383902 "2025-12-05T18:55:19Z")
Hello, I’ve successfully updated most of the Elasticsearch stack to the latest version 9.2.2 I’m having difficulty understanding how I upgrade the agent on the Fleet server; I can’t update the agent from the Fleet secti… --- ## [Why these at the end of all the pages in elastic.co](https://discuss.elastic.co/t/why-these-at-the-end-of-all-the-pages-in-elastic-co/386788)
**Author:** [@neko\_1995](https://discuss.elastic.co/u/neko_1995)\ **Replies:** 3\ **Last updated:** [June 11, 2026, 6:07am UTC](https://discuss.elastic.co/t/why-these-at-the-end-of-all-the-pages-in-elastic-co/386788 "2026-06-11T06:07:57Z")
--- ## [Alerts missing key fields](https://discuss.elastic.co/t/alerts-missing-key-fields/384449)
**Author:** [@michael-a](https://discuss.elastic.co/u/michael-a)\ **Replies:** 3\ **Last updated:** [February 9, 2026, 2:05pm UTC](https://discuss.elastic.co/t/alerts-missing-key-fields/384449 "2026-02-09T14:05:04Z")
We get alerts where key fields like host.name and process.name are missing. Looking at a rule with this issue - "Potential Malware-Driven SSH Brute Force Attempt", which is a threshold rule, all the requirements of the r… --- ## [Unable to create snapshots with cifs share 9.4.0](https://discuss.elastic.co/t/unable-to-create-snapshots-with-cifs-share-9-4-0/386271)
**Author:** [@expErg](https://discuss.elastic.co/u/expErg)\ **Replies:** 4\ **Last updated:** [May 12, 2026, 7:19am UTC](https://discuss.elastic.co/t/unable-to-create-snapshots-with-cifs-share-9-4-0/386271 "2026-05-12T07:19:04Z")
Hello, Since upgrading to 9.4.0, we are experiencing snapshot failures on our CIFS-mounted shared repository. Timeline: Last successful snapshot: May 6, before the upgrade Upgrade to 9.4.0 performed: May 6 at 12:00 P… --- ## [Index lifecycle policy not being applied on indices after updating](https://discuss.elastic.co/t/index-lifecycle-policy-not-being-applied-on-indices-after-updating/386004)
**Author:** [@YousefNein](https://discuss.elastic.co/u/YousefNein)\ **Replies:** 5\ **Last updated:** [April 23, 2026, 3:00pm UTC](https://discuss.elastic.co/t/index-lifecycle-policy-not-being-applied-on-indices-after-updating/386004 "2026-04-23T15:00:55Z")
As the title suggests, I have updated an index lifecycle policy, and the old indices are still stuck with the old settings. I have tried refreshing the index, clearing the cache, removing the ILM policy and adding it aga… --- ## [APM service groups](https://discuss.elastic.co/t/apm-service-groups/385634)
**Author:** [@kaidika](https://discuss.elastic.co/u/kaidika)\ **Replies:** 1\ **Last updated:** [June 5, 2026, 2:01pm UTC](https://discuss.elastic.co/t/apm-service-groups/385634 "2026-06-05T14:01:19Z")
Kibana version: 9.3.1 Hi, We started using the APM service groups and there’s a slight inconvenience. The groups can’t be edited. You would need to delete old one and create a new one. So incase of a typo or changes in… --- ## [Elastic agent / kibana http requests to 169.254.169.254 on startup](https://discuss.elastic.co/t/elastic-agent-kibana-http-requests-to-169-254-169-254-on-startup/388325)
**Author:** [@username456](https://discuss.elastic.co/u/username456)\ **Replies:** 3\ **Last updated:** [July 15, 2026, 7:41am UTC](https://discuss.elastic.co/t/elastic-agent-kibana-http-requests-to-169-254-169-254-on-startup/388325 "2026-07-15T07:41:44Z")
We've noticed that restarting the Elastic Agent or Kibana service results in outgoing requests to 169.254.169.254 on ports 80 and 443. Does anyone know why these requests are made and whether this behavior can be disabl… --- ## [Elastic Agent Logs Disk Usage and Shard Count](https://discuss.elastic.co/t/elastic-agent-logs-disk-usage-and-shard-count/384417)
**Author:** [@jnpetty](https://discuss.elastic.co/u/jnpetty)\ **Replies:** 4\ **Last updated:** [January 7, 2026, 9:44pm UTC](https://discuss.elastic.co/t/elastic-agent-logs-disk-usage-and-shard-count/384417 "2026-01-07T21:44:55Z")
I’m looking for some help on how to better handle log data generated by Elastic. For example, what looks to be Elastic Agent log data is consuming almost 4.5tb on our frozen tier, double the size of any other dataset on … --- ## [Fleet Server 8.19.20, 9.4.5, 9.5.1 Security Update (ESA-2026-112)](https://discuss.elastic.co/t/fleet-server-8-19-20-9-4-5-9-5-1-security-update-esa-2026-112/389509)
**Author:** [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Replies:** 0\ **Last updated:** [August 13, 2026, 10:47am UTC](https://discuss.elastic.co/t/fleet-server-8-19-20-9-4-5-9-5-1-security-update-esa-2026-112/389509 "2026-08-13T10:47:33Z")
Authorization Bypass Through User-Controlled Key in Fleet Server Leading to Information Disclosure Authorization Bypass Through User-Controlled Key (CWE-639) in Fleet Server can lead to information disclosure via Manipu… --- ## [Removing empty indices](https://discuss.elastic.co/t/removing-empty-indices/388901)
**Author:** [@bbreer](https://discuss.elastic.co/u/bbreer)\ **Replies:** 3\ **Last updated:** [July 31, 2026, 12:43pm UTC](https://discuss.elastic.co/t/removing-empty-indices/388901 "2026-07-31T12:43:19Z")
I would like to remove these empty indices because I need to free up the shards. I know this is a restricted data stream which may be why no matter what privileges i add to the role, I still can't delete them. Any on… --- ## [Clarification on CVE / Vulnerability ID related to bundled commons-text-1.4.jar in Elasticsearch 8.19.x](https://discuss.elastic.co/t/clarification-on-cve-vulnerability-id-related-to-bundled-commons-text-1-4-jar-in-elasticsearch-8-19-x/386398)
**Author:** [@lukecw](https://discuss.elastic.co/u/lukecw)\ **Replies:** 2\ **Last updated:** [May 19, 2026, 9:19am UTC](https://discuss.elastic.co/t/clarification-on-cve-vulnerability-id-related-to-bundled-commons-text-1-4-jar-in-elasticsearch-8-19-x/386398 "2026-05-19T09:19:19Z")
Hello, we need clarification regarding a vulnerability finding raised by our security scanner on Elasticsearch. The scanner is reporting the following issue: CVE: CVE-2025-46295 Vulnerability ID: OO0TMV On our… --- ## [Cannot Edit Monitor](https://discuss.elastic.co/t/cannot-edit-monitor/384846)
**Author:** [@lomar](https://discuss.elastic.co/u/lomar)\ **Replies:** 4\ **Last updated:** [February 2, 2026, 11:51am UTC](https://discuss.elastic.co/t/cannot-edit-monitor/384846 "2026-02-02T11:51:06Z")
When I try to delete via the Elasticsearch API, I get the same error code. I would appreciate your help. ELK Stack version: 9.2.4 Cluster status: green --- ## [Enable Response Body in APM securely?](https://discuss.elastic.co/t/enable-response-body-in-apm-securely/388627)
**Author:** [@kkumar123](https://discuss.elastic.co/u/kkumar123)\ **Replies:** 3\ **Last updated:** [August 3, 2026, 7:24pm UTC](https://discuss.elastic.co/t/enable-response-body-in-apm-securely/388627 "2026-08-03T19:24:38Z")
Looking for enabling the APM Response body from Kibana or Observability UI instead of code if not possible then how we can do it code but securely. Kibana version: 9.3.4 Elasticsearch version: 9.3.4 APM Server versio… --- ## [Using multiple data views in a single alert definition?](https://discuss.elastic.co/t/using-multiple-data-views-in-a-single-alert-definition/383683)
**Author:** [@gueguet57](https://discuss.elastic.co/u/gueguet57)\ **Replies:** 5\ **Last updated:** [December 1, 2025, 2:48pm UTC](https://discuss.elastic.co/t/using-multiple-data-views-in-a-single-alert-definition/383683 "2025-12-01T14:48:40Z")
Hi everyone, I’m wondering if it’s possible for an alert to reference multiple data views in its definition. My use case: I have one data view per environment, and I’d like to avoid duplicating the same alert definitio… --- ## [Transform creation error - request body is required](https://discuss.elastic.co/t/transform-creation-error-request-body-is-required/383394)
**Author:** [@dot-mike](https://discuss.elastic.co/u/dot-mike)\ **Replies:** 5\ **Last updated:** [November 15, 2025, 7:46am UTC](https://discuss.elastic.co/t/transform-creation-error-request-body-is-required/383394 "2025-11-15T07:46:37Z")
Hi community, I was looking to create a transform to show count of documents aggregated over unique syslog hostnames. So I proceeded to create the transform through the Kibana GUI and encountered an error: Internal Serv… --- ## [Elasticsearch Indexes are being created for Older dates](https://discuss.elastic.co/t/elasticsearch-indexes-are-being-created-for-older-dates/385959)
**Author:** [@Saikumar77](https://discuss.elastic.co/u/Saikumar77)\ **Replies:** 6\ **Last updated:** [April 22, 2026, 12:34pm UTC](https://discuss.elastic.co/t/elasticsearch-indexes-are-being-created-for-older-dates/385959 "2026-04-22T12:34:36Z")
Hi, We are hosting the ELK Stack on a VM and using Index Lifecycle Policies to manage log retention for different environments. However, we are currently facing an issue. We have configured a 4-day retention policy, an… --- ## [Archive functionality and licensing](https://discuss.elastic.co/t/archive-functionality-and-licensing/384340)
**Author:** [@javierE](https://discuss.elastic.co/u/javierE)\ **Replies:** 2\ **Last updated:** [January 5, 2026, 12:36pm UTC](https://discuss.elastic.co/t/archive-functionality-and-licensing/384340 "2026-01-05T12:36:07Z")
Hi, I’m trying to clarify my understanding of the following paragraph from the documentation: The archive functionality provides slower read-only access to older Elasticsearch data, for compliance or regulatory reas… --- ## [ILM policy for indices from APM server](https://discuss.elastic.co/t/ilm-policy-for-indices-from-apm-server/384133)
**Author:** [@Narek\_Martirosyan](https://discuss.elastic.co/u/Narek_Martirosyan)\ **Replies:** 2\ **Last updated:** [December 19, 2025, 7:48am UTC](https://discuss.elastic.co/t/ilm-policy-for-indices-from-apm-server/384133 "2025-12-19T07:48:45Z")
Hi, I’m running Elasticsearch 9.0.3 managed by ECK on AKS, and I’m seeing persistent high JVM heap usage on my warm nodes. Cluster topology 3 × master nodes 2 × hot data nodes 2 × warm data nodes Persistent… --- ## [“libvec.dylib” Not Opened](https://discuss.elastic.co/t/libvec-dylib-not-opened/385136)
**Author:** [@anjanesh](https://discuss.elastic.co/u/anjanesh)\ **Replies:** 3\ **Last updated:** [February 21, 2026, 4:16am UTC](https://discuss.elastic.co/t/libvec-dylib-not-opened/385136 "2026-02-21T04:16:04Z")
I can’t seem to get EleasticSearch 9.3.0 working on my MacBook Air M2 - Sequoia 15.7.4 (24G517) bin % ./elasticsearch --version Version: 9.3.0, Build: tar/17b451d8979a29e31935fe1eb901310350b30e62/2026-01-29T10:05:46.708… --- ## [Forming an Elasticsearch cluster](https://discuss.elastic.co/t/forming-an-elasticsearch-cluster/384041)
**Author:** [@SamehSaeed](https://discuss.elastic.co/u/SamehSaeed)\ **Replies:** 3\ **Last updated:** [December 16, 2025, 7:57am UTC](https://discuss.elastic.co/t/forming-an-elasticsearch-cluster/384041 "2025-12-16T07:57:43Z")
Hello, I’m trying to add a second node to my ES cluster but I’m facing issues with SSL handshake. \[2025-12-14T15:38:54,881\]\[WARN \]\[o.e.t.TcpTransport \] \[SCPRLUWS05\] exception caught on transport layer \[Netty4TcpC… --- ## [Elastic Rule Alert With External hyper link field creation in highlighted Fields \[feature request\]](https://discuss.elastic.co/t/elastic-rule-alert-with-external-hyper-link-field-creation-in-highlighted-fields-feature-request/384868)
**Author:** [@welch27330](https://discuss.elastic.co/u/welch27330)\ **Replies:** 2\ **Last updated:** [February 13, 2026, 2:34am UTC](https://discuss.elastic.co/t/elastic-rule-alert-with-external-hyper-link-field-creation-in-highlighted-fields-feature-request/384868 "2026-02-13T02:34:30Z")
Is there a way to construct a URL that will render as a hyper link in the alerts dashboard that will allow the user to review (Highlighted fields) the alert and then show a hyperlink to the external asset that the inform… --- ## [Use filebeat processor to concatenate string](https://discuss.elastic.co/t/use-filebeat-processor-to-concatenate-string/384725)
**Author:** [@mistrhanky1](https://discuss.elastic.co/u/mistrhanky1)\ **Replies:** 2\ **Last updated:** [January 26, 2026, 3:15pm UTC](https://discuss.elastic.co/t/use-filebeat-processor-to-concatenate-string/384725 "2026-01-26T15:15:49Z")
I have a situation where a customer has a custom syslog file for the Citrix ADC Netscaler. I would like to use the fleet integration for this but it doesn’t support the header format they have. I would like to modify tha… --- ## [Question about using Elasticsearch for RAG](https://discuss.elastic.co/t/question-about-using-elasticsearch-for-rag/383993)
**Author:** [@bobwiller](https://discuss.elastic.co/u/bobwiller)\ **Replies:** 1\ **Last updated:** [December 31, 2025, 6:37am UTC](https://discuss.elastic.co/t/question-about-using-elasticsearch-for-rag/383993 "2025-12-31T06:37:28Z")
Just learned about the RAG Playground in Elastic, so I am hoping this is an opportunity to simplify my project: Here is my scenario / goal: We have an old rules-based app that parses store items like bikes, bike parts,… --- ## [Upgrade adding new nodes of newer version instead of rolling upgrade](https://discuss.elastic.co/t/upgrade-adding-new-nodes-of-newer-version-instead-of-rolling-upgrade/390839)
**Author:** [@carlosmg1](https://discuss.elastic.co/u/carlosmg1)\ **Replies:** 6\ **Last updated:** [October 6, 2026, 11:04am UTC](https://discuss.elastic.co/t/upgrade-adding-new-nodes-of-newer-version-instead-of-rolling-upgrade/390839 "2026-10-06T11:04:28Z")
Hi, We've done plenty of upgrades of newer version in a cluster with around 40 nodes, upgrading 8.x version. For an upgrade from the 8.x to the 9.x we're analyzing how viable is to add new nodes during the upgrade of 9.… [Previous page](https://discuss.elastic.co/top.md?page=13&per_page=50) [Next page](https://discuss.elastic.co/top.md?page=15&per_page=50)