# Top **URL:** https://discuss.elastic.co/top.md?page=15 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 16 --- ## [When is an error definitely a permanent failure?](https://discuss.elastic.co/t/when-is-an-error-definitely-a-permanent-failure/384083)
**Author:** [@Mo\_B](https://discuss.elastic.co/u/Mo_B)\ **Replies:** 6\ **Last updated:** [December 17, 2025, 7:58am UTC](https://discuss.elastic.co/t/when-is-an-error-definitely-a-permanent-failure/384083 "2025-12-17T07:58:47Z")
I am using the .NET Elasticsearch client v 9.1.0. I want to check when a response represents a guaranteed permanent failure, i.e. a retry would be guaranteed to fail again (e.g. if the request is malformed, the document … --- ## [Elastic Feedback: Hire Dashboard Designer](https://discuss.elastic.co/t/elastic-feedback-hire-dashboard-designer/385513)
**Author:** [@erikg](https://discuss.elastic.co/u/erikg)\ **Replies:** 1\ **Last updated:** [March 25, 2026, 12:21pm UTC](https://discuss.elastic.co/t/elastic-feedback-hire-dashboard-designer/385513 "2026-03-25T12:21:21Z")
Hey, I mean well when I say this, but could Elastic improve its out-of-the-box managed dashboards I did OpenTelemetry Docker, and this was the dashboard that came with it: I understand people have different tastes … --- ## [Index pattern](https://discuss.elastic.co/t/index-pattern/383849)
**Author:** [@jgomezf](https://discuss.elastic.co/u/jgomezf)\ **Replies:** 4\ **Last updated:** [December 4, 2025, 11:11pm UTC](https://discuss.elastic.co/t/index-pattern/383849 "2025-12-04T23:11:16Z")
We have worked with the version elastic 8.4.10 and we cannot delete old index through curl delete https:localhost:9200/indices/ds.logsxxx{yesterday}\*. Do you have any idea as delete old index through scripts Thanks --- ## [Response\_split not splitting final response after a chain/while sequence completes](https://discuss.elastic.co/t/response-split-not-splitting-final-response-after-a-chain-while-sequence-completes/389417)
**Author:** [@lduvnjak](https://discuss.elastic.co/u/lduvnjak)\ **Replies:** 2\ **Last updated:** [August 20, 2026, 10:42pm UTC](https://discuss.elastic.co/t/response-split-not-splitting-final-response-after-a-chain-while-sequence-completes/389417 "2026-08-20T22:42:35Z")
I have a working chain/while setup that polls an async job-status endpoint until completion — this part works correctly, and only the final ("finished") response reaches message/event.original, as expected. The problem:… --- ## [X509: certificate signed by unknown authority , elastic agent + Tenable SC](https://discuss.elastic.co/t/x509-certificate-signed-by-unknown-authority-elastic-agent-tenable-sc/383835)
**Author:** [@Alaeddine\_khadraoui](https://discuss.elastic.co/u/Alaeddine_khadraoui)\ **Replies:** 3\ **Last updated:** [December 3, 2025, 11:31am UTC](https://discuss.elastic.co/t/x509-certificate-signed-by-unknown-authority-elastic-agent-tenable-sc/383835 "2025-12-03T11:31:39Z")
dear elastic community Im working on integrating Tenable Security Center via elastic agent , and getting x509: certificate signed by unknown , can please advise what actions to check also if the certificate signed by u… --- ## [Merging Deployments](https://discuss.elastic.co/t/merging-deployments/388830)
**Author:** [@Tortoise](https://discuss.elastic.co/u/Tortoise)\ **Replies:** 4\ **Last updated:** [August 1, 2026, 12:42pm UTC](https://discuss.elastic.co/t/merging-deployments/388830 "2026-08-01T12:42:28Z")
Hello Folks , Say on Cloud i have a deployment ABC & XYZ. I now want to merge these 2 deployments say XYZ to ABC instead of managing both the deployments separately . Could someone share pointers or high level steps , … --- ## [Enabling auth after upgrading elasticsearch cluster from 7.17.9 to 8.17.6](https://discuss.elastic.co/t/enabling-auth-after-upgrading-elasticsearch-cluster-from-7-17-9-to-8-17-6/385154)
**Author:** [@syed-asak](https://discuss.elastic.co/u/syed-asak)\ **Replies:** 4\ **Last updated:** [February 23, 2026, 10:42am UTC](https://discuss.elastic.co/t/enabling-auth-after-upgrading-elasticsearch-cluster-from-7-17-9-to-8-17-6/385154 "2026-02-23T10:42:30Z")
Hello everyone, I am looking for guidance on safely enabling security on an existing large Elasticsearch cluster. Current Environment Elasticsearch version: 8.17.6 Deployment type: VM-based cluster (not Kubernetes… --- ## [Modification de l'affichage d'un graphe dans un dzshboard](https://discuss.elastic.co/t/modification-de-laffichage-dun-graphe-dans-un-dzshboard/383409)
**Author:** [@Barbara](https://discuss.elastic.co/u/Barbara)\ **Replies:** 3\ **Last updated:** [November 13, 2025, 7:56am UTC](https://discuss.elastic.co/t/modification-de-laffichage-dun-graphe-dans-un-dzshboard/383409 "2025-11-13T07:56:21Z")
Bonjour J'ai un dashboard affichant des graph et autres d'alertes diverses. Selon des seuils calculés, je voudrais que le graph au delà du seuil prédéfini apparaisse en haut de mon dash, par exemple. Ou en plus gros, ou… --- ## [Elastic Cloud on Kubernetes 3.5.0 Security Update (ESA-2026-121)](https://discuss.elastic.co/t/elastic-cloud-on-kubernetes-3-5-0-security-update-esa-2026-121/389494)
**Author:** [@ikakavas](https://discuss.elastic.co/u/ikakavas)\ **Replies:** 0\ **Last updated:** [August 13, 2026, 10:46am UTC](https://discuss.elastic.co/t/elastic-cloud-on-kubernetes-3-5-0-security-update-esa-2026-121/389494 "2026-08-13T10:46:43Z")
Unintended Proxy or Intermediary in Elastic Cloud on Kubernetes Leading to Cross-Namespace Secret Disclosure The Elastic Cloud on Kubernetes (ECK) operator reads a list of secret references from an annotation on secrets… --- ## [Syslog parser fails on double backslashes in structured data](https://discuss.elastic.co/t/syslog-parser-fails-on-double-backslashes-in-structured-data/385386)
**Author:** [@briandoesdev](https://discuss.elastic.co/u/briandoesdev)\ **Replies:** 2\ **Last updated:** [March 10, 2026, 1:35pm UTC](https://discuss.elastic.co/t/syslog-parser-fails-on-double-backslashes-in-structured-data/385386 "2026-03-10T13:35:19Z")
Hello everyone, My org is using the Custom UDP Logs integration to ingest RFC 5424 syslog messages from several network appliances. One of the appliances includes structured data with a parameter value containing a doub… --- ## [Lots of Documents getting failed and dropped at the Logstash(seen in logstash logs)](https://discuss.elastic.co/t/lots-of-documents-getting-failed-and-dropped-at-the-logstash-seen-in-logstash-logs/384512)
**Author:** [@Siddhant\_Gupta1](https://discuss.elastic.co/u/Siddhant_Gupta1)\ **Replies:** 2\ **Last updated:** [January 14, 2026, 1:03pm UTC](https://discuss.elastic.co/t/lots-of-documents-getting-failed-and-dropped-at-the-logstash-seen-in-logstash-logs/384512 "2026-01-14T13:03:15Z")
We use logstash to send the logs to Azure EventHub and then to Azure Data Explorer(ADX). Also, we use Filebeat to send the logs to logstash first. The issue is that some of the logs are not reaching to ADX and its interm… --- ## [Elastic Agent 9.1.5 Fingerprint Processor Inconsistency - Breaks Log Integrity](https://discuss.elastic.co/t/elastic-agent-9-1-5-fingerprint-processor-inconsistency-breaks-log-integrity/382837)
**Author:** [@blakester205](https://discuss.elastic.co/u/blakester205)\ **Replies:** 2\ **Last updated:** [October 20, 2025, 5:09pm UTC](https://discuss.elastic.co/t/elastic-agent-9-1-5-fingerprint-processor-inconsistency-breaks-log-integrity/382837 "2025-10-20T17:09:44Z")
Elastic Agent 9.1.5 Fingerprint Processor Bug - Different Hashes for Identical Data Hey everyone, I've run into a pretty serious issue with the fingerprint processor in Elastic Agent 9.1.5 that I wanted to share with th… --- ## [Elastic Agent 9.3.7 CPU spikes](https://discuss.elastic.co/t/elastic-agent-9-3-7-cpu-spikes/390264)
**Author:** [@etrevino-lumificyber](https://discuss.elastic.co/u/etrevino-lumificyber)\ **Replies:** 1\ **Last updated:** [September 9, 2026, 1:36am UTC](https://discuss.elastic.co/t/elastic-agent-9-3-7-cpu-spikes/390264 "2026-09-09T01:36:06Z")
I mostly see the spiking when apps are being opened or occasionally while they are being used. I tested using standard apps like Outlook, Excel, Word, Chrome. Doing a search in Chrome for example caused a spike from 7% t… --- ## [ML jobs has no warnings or errors but message seems to be lagging](https://discuss.elastic.co/t/ml-jobs-has-no-warnings-or-errors-but-message-seems-to-be-lagging/385542)
**Author:** [@Whoami1980](https://discuss.elastic.co/u/Whoami1980)\ **Replies:** 6\ **Last updated:** [March 30, 2026, 5:55am UTC](https://discuss.elastic.co/t/ml-jobs-has-no-warnings-or-errors-but-message-seems-to-be-lagging/385542 "2026-03-30T05:55:08Z")
In one of our ML jobs. There doesnt appears to be any errors or warning in the job message. However the latest\_record\_timestamp is lagging behind the current\_timestamp KIndly advice how we can further look into this. … --- ## [Recommendations for LLM nodes sizing](https://discuss.elastic.co/t/recommendations-for-llm-nodes-sizing/383813)
**Author:** [@michael-a](https://discuss.elastic.co/u/michael-a)\ **Replies:** 6\ **Last updated:** [December 3, 2025, 2:04pm UTC](https://discuss.elastic.co/t/recommendations-for-llm-nodes-sizing/383813 "2025-12-03T14:04:50Z")
We’re about to implement our first LLM node (on Kubernetes) but haven’t been able to find current recommendations when it comes to sizing it. Are there any general rules we can apply based on number of events, log size e… --- ## [Installing APM Agent for .NET App on OpenShift](https://discuss.elastic.co/t/installing-apm-agent-for-net-app-on-openshift/386876)
**Author:** [@Umut](https://discuss.elastic.co/u/Umut)\ **Replies:** 2\ **Last updated:** [June 16, 2026, 12:07pm UTC](https://discuss.elastic.co/t/installing-apm-agent-for-net-app-on-openshift/386876 "2026-06-16T12:07:07Z")
Hello, I want to install an APM agent on a .NET application running on OpenShift. How can I do it? Thanks. --- ## [Where to find Elasticsearch internal logs when using ECK](https://discuss.elastic.co/t/where-to-find-elasticsearch-internal-logs-when-using-eck/384311)
**Author:** [@gueguet57](https://discuss.elastic.co/u/gueguet57)\ **Replies:** 1\ **Last updated:** [December 31, 2025, 2:35pm UTC](https://discuss.elastic.co/t/where-to-find-elasticsearch-internal-logs-when-using-eck/384311 "2025-12-31T14:35:36Z")
Hello all, I’ve deployed an Elastic stack using ECK and I’m trying to understand what logs Elastic produces and sotres about itself and how to access them. For example, I’d like to investigate whether Elasticsearch pre… --- ## [Snapshot and Restore settings only](https://discuss.elastic.co/t/snapshot-and-restore-settings-only/382930)
**Author:** [@juancamiloll](https://discuss.elastic.co/u/juancamiloll)\ **Replies:** 1\ **Last updated:** [October 26, 2025, 5:53am UTC](https://discuss.elastic.co/t/snapshot-and-restore-settings-only/382930 "2025-10-26T05:53:40Z")
At the moment, I don't have the capacity to take a snapshot of the ingested data or the indexes as such. I'm sure that 100GB isn't enough to back up ingested data. But thinking about disaster recovery, I would like to h… --- ## [Hypothetical - ingest nodes vs data nodes](https://discuss.elastic.co/t/hypothetical-ingest-nodes-vs-data-nodes/383932)
**Author:** [@rugenl](https://discuss.elastic.co/u/rugenl)\ **Replies:** 3\ **Last updated:** [December 9, 2025, 5:50pm UTC](https://discuss.elastic.co/t/hypothetical-ingest-nodes-vs-data-nodes/383932 "2025-12-09T17:50:47Z")
I got into a design discussion: Is it better to use ingest nodes or direct to data (hot) nodes? One thing that I don’t think I’ve ever seen discussed is this, say we’re ingesting to data nodes, a bulk request will like… --- ## [Ingest pipeline doesnt work](https://discuss.elastic.co/t/ingest-pipeline-doesnt-work/386407)
**Author:** [@Shahar\_Argov](https://discuss.elastic.co/u/Shahar_Argov)\ **Replies:** 4\ **Last updated:** [May 21, 2026, 2:12pm UTC](https://discuss.elastic.co/t/ingest-pipeline-doesnt-work/386407 "2026-05-21T14:12:36Z")
hi, I want to send logs through ingest pipeline to rename them to a different name, now the pipeline does look like its running but the names arent changing. if i try it with a random file from the index it said it wor… --- ## [Averaging last values of multiple beats](https://discuss.elastic.co/t/averaging-last-values-of-multiple-beats/386182)
**Author:** [@Benjamin\_Klein](https://discuss.elastic.co/u/Benjamin_Klein)\ **Replies:** 4\ **Last updated:** [May 7, 2026, 6:28pm UTC](https://discuss.elastic.co/t/averaging-last-values-of-multiple-beats/386182 "2026-05-07T18:28:51Z")
I have a collection of Heartbeat monitors pinging several different hosts. Each host has multiple services being pinged (by different beats). Is there a way to display, for each host, either the number of beats that came… --- ## [Adding license seem to work, then reverts back to Basic](https://discuss.elastic.co/t/adding-license-seem-to-work-then-reverts-back-to-basic/385164)
**Author:** [@michael-a](https://discuss.elastic.co/u/michael-a)\ **Replies:** 4\ **Last updated:** [February 24, 2026, 9:04am UTC](https://discuss.elastic.co/t/adding-license-seem-to-work-then-reverts-back-to-basic/385164 "2026-02-24T09:04:43Z")
Adding the license to our self-hosted Kubernetes cluster using the API, it gets accepted (API response true/valid) and we can see that the license is active in both Kibana and Stack Monitoring. However, shortly after the… --- ## [High availability Ingest architecture](https://discuss.elastic.co/t/high-availability-ingest-architecture/385425)
**Author:** [@fer.mt](https://discuss.elastic.co/u/fer.mt)\ **Replies:** 2\ **Last updated:** [March 12, 2026, 6:29pm UTC](https://discuss.elastic.co/t/high-availability-ingest-architecture/385425 "2026-03-12T18:29:09Z")
Context: My team manages an on-prem Elastic deployment. We have an ECE license. We had an outage a few weeks ago when our elastic nodes ran out of space caused by a problem with the move of data to the frozen layer. S… --- ## [Persistent Reindex Failure from Source-Only Snapshot: unexpected docvalues type NONE for field '\_ignored' error](https://discuss.elastic.co/t/persistent-reindex-failure-from-source-only-snapshot-unexpected-docvalues-type-none-for-field-ignored-error/383178)
**Author:** [@Rizaldi\_Sanjaya](https://discuss.elastic.co/u/Rizaldi_Sanjaya)\ **Replies:** 2\ **Last updated:** [November 21, 2025, 4:14am UTC](https://discuss.elastic.co/t/persistent-reindex-failure-from-source-only-snapshot-unexpected-docvalues-type-none-for-field-ignored-error/383178 "2025-11-21T04:14:38Z")
Hello, I am attempting to restore a data stream from a source-only snapshot and then reindex it into a new, functional data stream, as required by the source-only documentation. The restore operation completes successf… --- ## [Elastic Engineer On-Demand Course Lab in Strigo said "This course has ended"](https://discuss.elastic.co/t/elastic-engineer-on-demand-course-lab-in-strigo-said-this-course-has-ended/383263)
**Author:** [@Chi\_Dung\_Le](https://discuss.elastic.co/u/Chi_Dung_Le)\ **Replies:** 1\ **Last updated:** [November 6, 2025, 9:38am UTC](https://discuss.elastic.co/t/elastic-engineer-on-demand-course-lab-in-strigo-said-this-course-has-ended/383263 "2025-11-06T09:38:00Z")
I registered Elastic Engineer On-Demand Course on August 2025. But due to personal health issue, I didn’t have enough time to learn the course. Now I return but the lab environment in Strigo said “This course has ended".… --- ## [Upgrading from 7.x to 8.x with soft deletes disabled](https://discuss.elastic.co/t/upgrading-from-7-x-to-8-x-with-soft-deletes-disabled/384722)
**Author:** [@ahmedasadi](https://discuss.elastic.co/u/ahmedasadi)\ **Replies:** 6\ **Last updated:** [January 29, 2026, 6:34pm UTC](https://discuss.elastic.co/t/upgrading-from-7-x-to-8-x-with-soft-deletes-disabled/384722 "2026-01-29T18:34:21Z")
Hi, We use Elasticsearch as a lightweight index rather than a primary data store. The actual documents live elsewhere, and ES is only used to retrieve matching document IDs. Our current Elasticsearch 7.x setup includes… --- ## [Private connection to elastic cloud deployment](https://discuss.elastic.co/t/private-connection-to-elastic-cloud-deployment/383303)
**Author:** [@searchwithme](https://discuss.elastic.co/u/searchwithme)\ **Replies:** 3\ **Last updated:** [November 9, 2025, 1:38pm UTC](https://discuss.elastic.co/t/private-connection-to-elastic-cloud-deployment/383303 "2025-11-09T13:38:21Z")
Hi! We are evlauting elastic cloud but only if this is possible : set up private connectivity between onprem (or laptop) to elastic cloud deployment . From docs, I see private connection is posisble just with private li… --- ## [Winlogbeat 9.4.3 parsing fields wrong unless include\_xml is supplied](https://discuss.elastic.co/t/winlogbeat-9-4-3-parsing-fields-wrong-unless-include-xml-is-supplied/388680)
**Author:** [@tt-ah](https://discuss.elastic.co/u/tt-ah)\ **Replies:** 2\ **Last updated:** [August 6, 2026, 1:50pm UTC](https://discuss.elastic.co/t/winlogbeat-9-4-3-parsing-fields-wrong-unless-include-xml-is-supplied/388680 "2026-08-06T13:50:15Z")
Hello everyone! I noticed at least one field being processed incorrectly after updating our Elasticsearch and Winlogbeats to 9.4.3 (from 8.x.x). I do not have other findings yet, but I doubt this is the only case. Appl… --- ## [Reroute logs in different dataset/datastreams/data\_namespaces](https://discuss.elastic.co/t/reroute-logs-in-different-dataset-datastreams-data-namespaces/386282)
**Author:** [@proclick](https://discuss.elastic.co/u/proclick)\ **Replies:** 2\ **Last updated:** [May 11, 2026, 3:08pm UTC](https://discuss.elastic.co/t/reroute-logs-in-different-dataset-datastreams-data-namespaces/386282 "2026-05-11T15:08:34Z")
Hello guys, I ingest logs from one SaaS solution though the pre-built elastic agent integration. The logs are pretty noisy and I want to reroute them in different namespaces (data streams) to apply different ILM policie… --- ## [Crowdstrike Integration Degraded](https://discuss.elastic.co/t/crowdstrike-integration-degraded/385987)
**Author:** [@4l13v](https://discuss.elastic.co/u/4l13v)\ **Replies:** 2\ **Last updated:** [April 22, 2026, 1:23pm UTC](https://discuss.elastic.co/t/crowdstrike-integration-degraded/385987 "2026-04-22T13:23:18Z")
The problem is 3 months ago, I have integrated Crowdstrike via API. It okay, and I am getting alerts from Falcon without problems. But Fleet server came unhealthy in these days. {failed to decode discover body: EOF} . … --- ## [Elasticsearch Netflow Top-N dashboard showing data in bytes instead of MB.GB etc](https://discuss.elastic.co/t/elasticsearch-netflow-top-n-dashboard-showing-data-in-bytes-instead-of-mb-gb-etc/390772)
**Author:** [@ahsan0331](https://discuss.elastic.co/u/ahsan0331)\ **Replies:** 4\ **Last updated:** [October 14, 2026, 7:24am UTC](https://discuss.elastic.co/t/elasticsearch-netflow-top-n-dashboard-showing-data-in-bytes-instead-of-mb-gb-etc/390772 "2026-10-14T07:24:01Z")
Hi i have upgraded "or so to speak" from filebeat netflow module to elastic netflow fleet based. And while i see its dashboards are somewhat good compared to the filebeat ones. but one dashboard that i used a lot in fil… --- ## [Strange Grok with message](https://discuss.elastic.co/t/strange-grok-with-message/383686)
**Author:** [@Andex](https://discuss.elastic.co/u/Andex)\ **Replies:** 4\ **Last updated:** [November 26, 2025, 8:27pm UTC](https://discuss.elastic.co/t/strange-grok-with-message/383686 "2025-11-26T20:27:20Z")
Hello guys I have this logstash filter filter { if \[log\]\[file\]\[path\] == "/dwdwdosw/Top/log/services/uds-default-pippo.it" or \[log\]\[file\]\[path\] == "/aledwgosw/Top/log/services/uds-default-pluto.it" { mutate { … --- ## [False Positive Report - itzOpti.exe - Elastic](https://discuss.elastic.co/t/false-positive-report-itzopti-exe-elastic/385949)
**Author:** [@Luca1](https://discuss.elastic.co/u/Luca1)\ **Replies:** 1\ **Last updated:** [April 29, 2026, 9:40pm UTC](https://discuss.elastic.co/t/false-positive-report-itzopti-exe-elastic/385949 "2026-04-29T21:40:26Z")
Hello, I am reporting a false positive detection for my file. Vendor: Elastic Detection name: Malicious (high Confidence) SHA256: 6ed1f7c0565b84201b7f9b7ed47eee7f73fddad453ae9e4ce7914369b9ad1311 VirusTotal: VirusTot… --- ## [Managing multiple Elasticsearch clusters across different Kubernetes clusters with a single ECK instance](https://discuss.elastic.co/t/managing-multiple-elasticsearch-clusters-across-different-kubernetes-clusters-with-a-single-eck-instance/385226)
**Author:** [@CitizenSteak](https://discuss.elastic.co/u/CitizenSteak)\ **Replies:** 1\ **Last updated:** [March 1, 2026, 9:31pm UTC](https://discuss.elastic.co/t/managing-multiple-elasticsearch-clusters-across-different-kubernetes-clusters-with-a-single-eck-instance/385226 "2026-03-01T21:31:07Z")
I have a Kubernetes cluster A where I deployed an Elasticsearch cluster A with the Operator. Now, I have a Kubernetes cluster B where I want to deploy an Elasticsearch cluster B but I would like for it to be managed by t… --- ## [Elasticsearch Serverless + Vector Search + Data Streams / Time Series Tradeoffs](https://discuss.elastic.co/t/elasticsearch-serverless-vector-search-data-streams-time-series-tradeoffs/386275)
**Author:** [@Januka\_Samaranayake](https://discuss.elastic.co/u/Januka_Samaranayake)\ **Replies:** 3\ **Last updated:** [May 12, 2026, 8:16am UTC](https://discuss.elastic.co/t/elasticsearch-serverless-vector-search-data-streams-time-series-tradeoffs/386275 "2026-05-12T08:16:25Z")
Hello everyone, I am trying to better understand the tradeoffs between Elasticsearch Serverless, Data Streams, TSDS (index.mode=time\_series), and future vector search workloads. Current Situation We currently have arou… --- ## [FsCrawler snapshot 2.10 not compatible with the Elastic search version 9.2.4 and 9.3.0 getting error](https://discuss.elastic.co/t/fscrawler-snapshot-2-10-not-compatible-with-the-elastic-search-version-9-2-4-and-9-3-0-getting-error/384944)
**Author:** [@sunilhpan](https://discuss.elastic.co/u/sunilhpan)\ **Replies:** 2\ **Last updated:** [February 20, 2026, 8:39am UTC](https://discuss.elastic.co/t/fscrawler-snapshot-2-10-not-compatible-with-the-elastic-search-version-9-2-4-and-9-3-0-getting-error/384944 "2026-02-20T08:39:20Z")
FsCrawler snapshot 2.10 not compatible with the Elastic search version 9.2.4 and 9.3.0 getting error - Getting below error need to resolve this not sure what error is it Elasticsearch 9.2.4 and 9.3.0 says to install the … --- ## [Kibana still shows the hidden indices even with Include hidden indices set to off](https://discuss.elastic.co/t/kibana-still-shows-the-hidden-indices-even-with-include-hidden-indices-set-to-off/387310)
**Author:** [@alifiroozi80](https://discuss.elastic.co/u/alifiroozi80)\ **Replies:** 4\ **Last updated:** [June 27, 2026, 7:29am UTC](https://discuss.elastic.co/t/kibana-still-shows-the-hidden-indices-even-with-include-hidden-indices-set-to-off/387310 "2026-06-27T07:29:18Z")
Hello everyone Even with Include hidden indices set to off, I can still see the . indices (belongs to xpack) in Kibana. How can I disable them so they don't show in Kibana? version: 9.4.2 --- ## [Can I Safely Use Aliases if My Application Requires a Single Fixed Index Name for All Operations?](https://discuss.elastic.co/t/can-i-safely-use-aliases-if-my-application-requires-a-single-fixed-index-name-for-all-operations/383496)
**Author:** [@mike\_wills](https://discuss.elastic.co/u/mike_wills)\ **Replies:** 4\ **Last updated:** [November 17, 2025, 9:05pm UTC](https://discuss.elastic.co/t/can-i-safely-use-aliases-if-my-application-requires-a-single-fixed-index-name-for-all-operations/383496 "2025-11-17T21:05:31Z")
Hello everyone, I’m looking for some guidance on an aliasing challenge I’m running into. We’re using an in-house Java-based application as the frontend to our Elasticsearch cluster. I’ve been exploring index aliases t… --- ## [Cannot create Exception for Rule "Persistence via Extensible Firmware Modification"](https://discuss.elastic.co/t/cannot-create-exception-for-rule-persistence-via-extensible-firmware-modification/386795)
**Author:** [@RalphDibney](https://discuss.elastic.co/u/RalphDibney)\ **Replies:** 2\ **Last updated:** [June 15, 2026, 1:35pm UTC](https://discuss.elastic.co/t/cannot-create-exception-for-rule-persistence-via-extensible-firmware-modification/386795 "2026-06-15T13:35:28Z")
The Defend Rule "Malicious Behavior Prevention Alert: Persistence via Extensible Firmware Modification" gets triggered in our environment. The behavior is explainable and unproblematic, so we wanted to create an endpoint… --- ## [Place for Development Discussions?](https://discuss.elastic.co/t/place-for-development-discussions/385123)
**Author:** [@Andi\_Jane\_Woernicki](https://discuss.elastic.co/u/Andi_Jane_Woernicki)\ **Replies:** 1\ **Last updated:** [March 10, 2026, 7:48pm UTC](https://discuss.elastic.co/t/place-for-development-discussions/385123 "2026-03-10T19:48:07Z")
Hello, I’m new here - since yesterday actually. I checked out the related items that came up when I started to write this post, and most of them turned out to be about support, about asking questions and getting answers. … --- ## [Filebeat - duplicated logs when using journald Input with systemd units](https://discuss.elastic.co/t/filebeat-duplicated-logs-when-using-journald-input-with-systemd-units/385347)
**Author:** [@maxp1](https://discuss.elastic.co/u/maxp1)\ **Replies:** 1\ **Last updated:** [March 5, 2026, 12:15am UTC](https://discuss.elastic.co/t/filebeat-duplicated-logs-when-using-journald-input-with-systemd-units/385347 "2026-03-05T00:15:46Z")
Hello, I've encountered an issue while using the journald input in Filebeat, specifically when specifying individual systemd units. Instead of separating logs based on the systemd unit, Filebeat seems to be processing th… --- ## [Custom rules parameter](https://discuss.elastic.co/t/custom-rules-parameter/383337)
**Author:** [@Le\_Philosophe](https://discuss.elastic.co/u/Le_Philosophe)\ **Replies:** 4\ **Last updated:** [November 22, 2025, 5:08pm UTC](https://discuss.elastic.co/t/custom-rules-parameter/383337 "2025-11-22T17:08:25Z")
Hello, I have some data i collected and visualizing in Kibana.Now I have defined a ML job to monitor high/low filerate but I want the ML analysis to stop outside the range the data is collected(eg: 7 to 9pm data are not… --- ## [We do not use Scroll Query or PIT, What caused our ElasticSearch Cluster big OpenContexts Spike](https://discuss.elastic.co/t/we-do-not-use-scroll-query-or-pit-what-caused-our-elasticsearch-cluster-big-opencontexts-spike/383467)
**Author:** [@Thomas59](https://discuss.elastic.co/u/Thomas59)\ **Replies:** 4\ **Last updated:** [November 16, 2025, 5:35pm UTC](https://discuss.elastic.co/t/we-do-not-use-scroll-query-or-pit-what-caused-our-elasticsearch-cluster-big-opencontexts-spike/383467 "2025-11-16T17:35:10Z")
We experienced OpenContexts spikes in our Elasticsearch 6.8 environment. Since we’re not using Scroll Queries or Point in Time (PIT), I’d like to understand: What could be causing these OpenContexts spikes? Note: We h… --- ## [Negative Request Breaker Estimated Size](https://discuss.elastic.co/t/negative-request-breaker-estimated-size/383184)
**Author:** [@Aditya\_Teltia](https://discuss.elastic.co/u/Aditya_Teltia)\ **Replies:** 4\ **Last updated:** [November 4, 2025, 10:30am UTC](https://discuss.elastic.co/t/negative-request-breaker-estimated-size/383184 "2025-11-04T10:30:41Z")
Hi Everyone, I am using ES-8.15.5 and while using this in production I am getting negative value of requests circuit breaker estimated\_size\_in\_bytes. Not able to reproduce this locally either. I am having hard time ide… --- ## [I can't seem to connect to logstash for some reason?](https://discuss.elastic.co/t/i-cant-seem-to-connect-to-logstash-for-some-reason/384209)
**Author:** [@Miksos](https://discuss.elastic.co/u/Miksos)\ **Replies:** 5\ **Last updated:** [December 22, 2025, 11:00am UTC](https://discuss.elastic.co/t/i-cant-seem-to-connect-to-logstash-for-some-reason/384209 "2025-12-22T11:00:20Z")
Dec 20 17:46:32 ELK-Server logstash\[690\]: \[2025-12-20T17:46:32,609\]\[WARN \]\[logstash.outputs.elasticsearch\]\[main\] Attempted to resurrect connection to dead ES instance, but got an error {:url=\>"khttp://localhost:9200/", :… --- ## [Airgap standalone Elastic Agent Upgrade](https://discuss.elastic.co/t/airgap-standalone-elastic-agent-upgrade/386355)
**Author:** [@Ryan\_Clark](https://discuss.elastic.co/u/Ryan_Clark)\ **Replies:** 2\ **Last updated:** [May 21, 2026, 6:50am UTC](https://discuss.elastic.co/t/airgap-standalone-elastic-agent-upgrade/386355 "2026-05-21T06:50:31Z")
I'm running a standalone agent on an airgap Windows system using the zip deployment. I'm trying to upgrade from 8.19.0 to 8.19.15 as a test. It appears that there is a way to use the elastic-agent.exe upgrade command wi… --- ## [Unclosed session error with Data extraction service](https://discuss.elastic.co/t/unclosed-session-error-with-data-extraction-service/383450)
**Author:** [@SPRINGPEACHVINH](https://discuss.elastic.co/u/SPRINGPEACHVINH)\ **Replies:** 2\ **Last updated:** [February 3, 2026, 11:17am UTC](https://discuss.elastic.co/t/unclosed-session-error-with-data-extraction-service/383450 "2026-02-03T11:17:41Z")
Hi, I’m running a AWS S3 connector (8.17.1) and extraction service (0.3.5) Docker containers. After sync job I see this warning: Unclosed client session client\_session: \ **Author:** [@fsch](https://discuss.elastic.co/u/fsch)\ **Replies:** 1\ **Last updated:** [March 9, 2026, 1:02am UTC](https://discuss.elastic.co/t/top-n-processes-system-process-metrics/385034 "2026-03-09T01:02:38Z") Hi, I have a question concerning the system metrics field system.process.cpu.total.norm.pct described as "The percentage of CPU time spent by the process since the last event. This value is normalized by the number of C… --- ## [Inconsistency count observed for term aggregation operation](https://discuss.elastic.co/t/inconsistency-count-observed-for-term-aggregation-operation/383916)
**Author:** [@harshkoshta](https://discuss.elastic.co/u/harshkoshta)\ **Replies:** 7\ **Last updated:** [December 10, 2025, 10:20am UTC](https://discuss.elastic.co/t/inconsistency-count-observed-for-term-aggregation-operation/383916 "2025-12-10T10:20:17Z")
Describe the issue: Inconsistency count observed for term aggregation operation We are applying aggregation on keyword type field (non-nested) our mapping { "mappings": { "dynamic": "strict", "prope… --- ## [Where is fleet-server CA?](https://discuss.elastic.co/t/where-is-fleet-server-ca/383491)
**Author:** [@Blason](https://discuss.elastic.co/u/Blason)\ **Replies:** 1\ **Last updated:** [November 17, 2025, 5:55pm UTC](https://discuss.elastic.co/t/where-is-fleet-server-ca/383491 "2025-11-17T17:55:42Z")
Hello, I am bit confused about fleet-server ca file? where is that stored? I mean I installed the elasticstack and then installed the fleet server on same server. Generated certificate using instances.yml instances: … [Previous page](https://discuss.elastic.co/top.md?page=14&per_page=50) [Next page](https://discuss.elastic.co/top.md?page=16&per_page=50)