# Top **URL:** https://discuss.elastic.co/top.md?page=17 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 18 --- ## [We are trying to configure Kibana with Entra ID(Azure Active directory) and it is not working properly](https://discuss.elastic.co/t/we-are-trying-to-configure-kibana-with-entra-id-azure-active-directory-and-it-is-not-working-properly/386130)
**Author:** [@AKAM14](https://discuss.elastic.co/u/AKAM14)\ **Replies:** 4\ **Last updated:** [May 2, 2026, 5:30pm UTC](https://discuss.elastic.co/t/we-are-trying-to-configure-kibana-with-entra-id-azure-active-directory-and-it-is-not-working-properly/386130 "2026-05-02T17:30:13Z")
Hello Everyone, We are having a onprem cluster 8.17.x where we are trying to configure entra id for kibana login. unable to successfully do it. unfortunately we are not getting any logs in kibana or elk after the config… --- ## [The Service list in Kibana APM](https://discuss.elastic.co/t/the-service-list-in-kibana-apm/383206)
**Author:** [@Henk\_Stobbe](https://discuss.elastic.co/u/Henk_Stobbe)\ **Replies:** 1\ **Last updated:** [November 9, 2025, 5:55am UTC](https://discuss.elastic.co/t/the-service-list-in-kibana-apm/383206 "2025-11-09T05:55:27Z")
Hello, I want to export the list of Services from Kibana, is this stored in an seperate index or does Kibana looks in the traces for this when you open the Dashboard? Who knows? KR Henk --- ## [Regarding FileBeats Configuration Issues](https://discuss.elastic.co/t/regarding-filebeats-configuration-issues/383358)
**Author:** [@RainZ](https://discuss.elastic.co/u/RainZ)\ **Replies:** 3\ **Last updated:** [November 14, 2025, 12:17pm UTC](https://discuss.elastic.co/t/regarding-filebeats-configuration-issues/383358 "2025-11-14T12:17:55Z")
I have set up an ELK server currently in the testing phase. I deployed a Filebeats instance on a Windows Server to collect logs from Application, Security, System, and Windows PowerShell. However, my Logstash is only cap… --- ## [Using time shift in ES|QL dashboard panels](https://discuss.elastic.co/t/using-time-shift-in-es-ql-dashboard-panels/389751)
**Author:** [@tallakh](https://discuss.elastic.co/u/tallakh)\ **Replies:** 2\ **Last updated:** [August 19, 2026, 7:17am UTC](https://discuss.elastic.co/t/using-time-shift-in-es-ql-dashboard-panels/389751 "2026-08-19T07:17:12Z")
Is time shift planned for ES|QL dashboard panels? I'm building Kibana dashboards using ES|QL and would like to compare the time range selected in the dashboard with the same period 52 weeks earlier. Ideally, I'd like t… --- ## [Question on the Default Kibana NodeJS Setting --max-old-space-size=2048](https://discuss.elastic.co/t/question-on-the-default-kibana-nodejs-setting-max-old-space-size-2048/386310)
**Author:** [@metalshanked](https://discuss.elastic.co/u/metalshanked)\ **Replies:** 2\ **Last updated:** [May 15, 2026, 1:57am UTC](https://discuss.elastic.co/t/question-on-the-default-kibana-nodejs-setting-max-old-space-size-2048/386310 "2026-05-15T01:57:21Z")
The below note for ECK seems to imply that setting the container mem limits should suffice instead of overriding the pod spec template for kibana. https://www.elastic.co/docs/deploy-manage/production-guidance/kibana-con… --- ## [Security alerts notes](https://discuss.elastic.co/t/security-alerts-notes/385113)
**Author:** [@Cristina\_Marletta\_Li](https://discuss.elastic.co/u/Cristina_Marletta_Li)\ **Replies:** 2\ **Last updated:** [February 19, 2026, 2:20pm UTC](https://discuss.elastic.co/t/security-alerts-notes/385113 "2026-02-19T14:20:05Z")
Hi all, I added a note to a security alert. The document associated with the alert is viewable in Discover, but I don't see any fields containing my note. In which index is the note stored? I read that it is stored in … --- ## [Elastic Agent + Security Onion](https://discuss.elastic.co/t/elastic-agent-security-onion/385187)
**Author:** [@harry22](https://discuss.elastic.co/u/harry22)\ **Replies:** 0\ **Last updated:** [February 24, 2026, 4:31pm UTC](https://discuss.elastic.co/t/elastic-agent-security-onion/385187 "2026-02-24T16:31:55Z")
Hi team, I recentely deployed Security onion lab on Vmware workstation Allowed allow hosts on Security Onion with my home private Subnet Checked and verified all services showing up on VM Checked and verified on Pow… --- ## [Oracle Integration condition](https://discuss.elastic.co/t/oracle-integration-condition/385431)
**Author:** [@hubkos](https://discuss.elastic.co/u/hubkos)\ **Replies:** 4\ **Last updated:** [March 17, 2026, 9:51pm UTC](https://discuss.elastic.co/t/oracle-integration-condition/385431 "2026-03-17T21:51:49Z")
Hi all, is there a possibility to add a condition for Oracle Integration? Just like PostgreSQL has one, I’d like to “activate” Oracle Integration based on agent Providers. Thanks and greetings, Hubert --- ## [Trial extension request for Elastic ML features on on-premises](https://discuss.elastic.co/t/trial-extension-request-for-elastic-ml-features-on-on-premises/385128)
**Author:** [@abel1](https://discuss.elastic.co/u/abel1)\ **Replies:** 1\ **Last updated:** [March 5, 2026, 5:16am UTC](https://discuss.elastic.co/t/trial-extension-request-for-elastic-ml-features-on-on-premises/385128 "2026-03-05T05:16:38Z")
Hello, I previously submitted a request to extend my Elastic trial license for 30 days to test Machine Learning features on my self-managed (on-premises) setup. I haven’t received a response yet and would appreciate … --- ## [How to filter an ESQL dashboard on a field in the index being looked up on](https://discuss.elastic.co/t/how-to-filter-an-esql-dashboard-on-a-field-in-the-index-being-looked-up-on/386052)
**Author:** [@TSlump](https://discuss.elastic.co/u/TSlump)\ **Replies:** 3\ **Last updated:** [April 28, 2026, 10:07am UTC](https://discuss.elastic.co/t/how-to-filter-an-esql-dashboard-on-a-field-in-the-index-being-looked-up-on/386052 "2026-04-28T10:07:39Z")
Hi, I'm having trouble finding a nice intuitive way to filter an ESQL dashboard. Any ideas would be greatly appreciated ! I have two indices: buildings and rooms, where each room has a building Id. On the dashboard I ha… --- ## [Error calling connector: Status code: undefined. Message: Unexpected API Error: ECONNABORTED - timeout of 60000ms exceeded](https://discuss.elastic.co/t/error-calling-connector-status-code-undefined-message-unexpected-api-error-econnaborted-timeout-of-60000ms-exceeded/383621)
**Author:** [@juancamiloll](https://discuss.elastic.co/u/juancamiloll)\ **Replies:** 3\ **Last updated:** [December 5, 2025, 7:47pm UTC](https://discuss.elastic.co/t/error-calling-connector-status-code-undefined-message-unexpected-api-error-econnaborted-timeout-of-60000ms-exceeded/383621 "2025-12-05T19:47:33Z")
Hello, I am receiving this error message. Do you have any idea how I can diagnose it? I have already deleted the connector and created it again, but the problem persists. Error calling connector: Status code: undefine… --- ## [Failed to decrypt report job data. Please ensure that xpack.reporting.encryptionKey is set and re-generate this report](https://discuss.elastic.co/t/failed-to-decrypt-report-job-data-please-ensure-that-xpack-reporting-encryptionkey-is-set-and-re-generate-this-report/384933)
**Author:** [@francescoa](https://discuss.elastic.co/u/francescoa)\ **Replies:** 2\ **Last updated:** [February 9, 2026, 9:10am UTC](https://discuss.elastic.co/t/failed-to-decrypt-report-job-data-please-ensure-that-xpack-reporting-encryptionkey-is-set-and-re-generate-this-report/384933 "2026-02-09T09:10:10Z")
Hi everyone :slight\_smile: I’m new here, I signed up because we’re having some issues with Kibana and I’m hoping someone can help :heart: We have Kibana v8.13.4 exposed on an AWS EC2 instance. It’s the only one Kibana … --- ## [Creating an alarm that outputs the group name](https://discuss.elastic.co/t/creating-an-alarm-that-outputs-the-group-name/384911)
**Author:** [@tractor\_boy](https://discuss.elastic.co/u/tractor_boy)\ **Replies:** 2\ **Last updated:** [February 6, 2026, 9:31am UTC](https://discuss.elastic.co/t/creating-an-alarm-that-outputs-the-group-name/384911 "2026-02-06T09:31:24Z")
I am trying to build an alert that emits data via a web hook. The alert has grouping, so multiple alerts can fire an any one time. What I’ve not managed to do is get the group name to be included in the data sent throu… --- ## [Filebeat re-ingesting old logs after pod restart (ECK on GKE) - ignore\_older not working](https://discuss.elastic.co/t/filebeat-re-ingesting-old-logs-after-pod-restart-eck-on-gke-ignore-older-not-working/384328)
**Author:** [@Marwan\_Ghonem](https://discuss.elastic.co/u/Marwan_Ghonem)\ **Replies:** 2\ **Last updated:** [January 2, 2026, 3:27pm UTC](https://discuss.elastic.co/t/filebeat-re-ingesting-old-logs-after-pod-restart-eck-on-gke-ignore-older-not-working/384328 "2026-01-02T15:27:52Z")
Problem Filebeat is repeatedly re-ingesting old logs (4-15 days old) causing previously deleted indices to be recreated. Environment Filebeat version: 7.10.1 ADeployment: ECK (Elastic Cloud on Kubernetes) DaemonS… --- ## [How to handle duplicate records in datastreams using fingerprint](https://discuss.elastic.co/t/how-to-handle-duplicate-records-in-datastreams-using-fingerprint/384260)
**Author:** [@venkatkumar229](https://discuss.elastic.co/u/venkatkumar229)\ **Replies:** 2\ **Last updated:** [December 26, 2025, 11:34am UTC](https://discuss.elastic.co/t/how-to-handle-duplicate-records-in-datastreams-using-fingerprint/384260 "2025-12-26T11:34:00Z")
Hi Team, I am ingesting data from a Kafka topic into Elasticsearch using Logstash. The incoming data can contain duplicates, so I am using a fingerprint filter on a unique business field (seqId) and setting it as the d… --- ## [Deleting users from elasticsearch but still appear on assignees](https://discuss.elastic.co/t/deleting-users-from-elasticsearch-but-still-appear-on-assignees/383116)
**Author:** [@naverlyn](https://discuss.elastic.co/u/naverlyn)\ **Replies:** 2\ **Last updated:** [November 1, 2025, 4:58am UTC](https://discuss.elastic.co/t/deleting-users-from-elasticsearch-but-still-appear-on-assignees/383116 "2025-11-01T04:58:00Z")
Hi, Is this intentional to delete users but still appear on assignees panel? For example, i have user named “hytam” on elasticsearch (I previously deleted already) but still appearing on assignees. In users page, there… --- ## [Dec 11th, 2025: \[EN\] Building an AI-Powered Email Phishing Detection](https://discuss.elastic.co/t/dec-11th-2025-en-building-an-ai-powered-email-phishing-detection/383298)
**Author:** [@Julien\_Martin](https://discuss.elastic.co/u/Julien_Martin)\ **Replies:** 0\ **Last updated:** [December 11, 2025, 8:00am UTC](https://discuss.elastic.co/t/dec-11th-2025-en-building-an-ai-powered-email-phishing-detection/383298 "2025-12-11T08:00:32Z")
Cet article existe aussi en Français. Building an AI-Powered Email Phishing Detection System with n8n and Elastic Agent Builder Phishing attacks continue to dominate the cybersecurity threat landscape, with attackers… --- ## [Using Elasticsearch for QR-Based Digital Membership Card System](https://discuss.elastic.co/t/using-elasticsearch-for-qr-based-digital-membership-card-system/385664)
**Author:** [@dicogi](https://discuss.elastic.co/u/dicogi)\ **Replies:** 1\ **Last updated:** [March 27, 2026, 1:50pm UTC](https://discuss.elastic.co/t/using-elasticsearch-for-qr-based-digital-membership-card-system/385664 "2026-03-27T13:50:42Z")
Hi everyone, I’m working on a digital membership card system where each user is issued a unique QR code that can be scanned for quick verification during events, access control, or attendance tracking. The goal is to ke… --- ## [container input: CRI partial line reassembly ignores max\_bytes, causing OOM](https://discuss.elastic.co/t/container-input-cri-partial-line-reassembly-ignores-max-bytes-causing-oom/385340)
**Author:** [@raychinov](https://discuss.elastic.co/u/raychinov)\ **Replies:** 1\ **Last updated:** [March 5, 2026, 2:15pm UTC](https://discuss.elastic.co/t/container-input-cri-partial-line-reassembly-ignores-max-bytes-causing-oom/385340 "2026-03-05T14:15:36Z")
Filebeat version 8.19.12 Operating system and version Linux (Kubernetes with containerd runtime) Description of the problem including expected versus actual behavior When a container log contains many consecutive CRI p… --- ## [ILM vs routing for growing vector database with separate clients](https://discuss.elastic.co/t/ilm-vs-routing-for-growing-vector-database-with-separate-clients/383962)
**Author:** [@Pablito77](https://discuss.elastic.co/u/Pablito77)\ **Replies:** 5\ **Last updated:** [December 10, 2025, 5:56pm UTC](https://discuss.elastic.co/t/ilm-vs-routing-for-growing-vector-database-with-separate-clients/383962 "2025-12-10T17:56:39Z")
Hello, I use elasticsearch as a vector db for 1024 dim vectors. My initial setup would be around 20 million vectors, but it may increase to 100 milion vectors over time. However i always prefilter the vector search to a… --- ## [One Deata view @timestamp alarm](https://discuss.elastic.co/t/one-deata-view-timestamp-alarm/385624)
**Author:** [@Wing\_W](https://discuss.elastic.co/u/Wing_W)\ **Replies:** 3\ **Last updated:** [March 27, 2026, 6:10am UTC](https://discuss.elastic.co/t/one-deata-view-timestamp-alarm/385624 "2026-03-27T06:10:22Z")
This request queries Elasticsearch to fetch the documents. Search session id: d53c937d-ef25-4122-862c-9cc00f861186 Node c60fcARCT5m2jef2\_njmog Reason error fetching \[structured.@timestamp\]: Field \[structured.@timest… --- ## [gVal expression to evaluate the length of JSON Array](https://discuss.elastic.co/t/gval-expression-to-evaluate-the-length-of-json-array/383057)
**Author:** [@Chow](https://discuss.elastic.co/u/Chow)\ **Replies:** 3\ **Last updated:** [October 30, 2025, 4:04am UTC](https://discuss.elastic.co/t/gval-expression-to-evaluate-the-length-of-json-array/383057 "2025-10-30T04:04:20Z")
Hi, We have a synthetics lightweight HTTP Ping monitor, that returns a JSON. The requirement is to check the length of an array in JSON response. I used the response from the following URL to test it https://status.s… --- ## [Auto update GeoLite DB](https://discuss.elastic.co/t/auto-update-geolite-db/386728)
**Author:** [@CD9820](https://discuss.elastic.co/u/CD9820)\ **Replies:** 2\ **Last updated:** [June 22, 2026, 1:49pm UTC](https://discuss.elastic.co/t/auto-update-geolite-db/386728 "2026-06-22T13:49:28Z")
Hello Logstash logs following warnings/errors related to GeoLite: failed to fetch ASN database {:exception=\>"503 Service Unavailable"} failed to fetch City database {:exception=\>"503 Service Unavailable"} The managed… --- ## [V8.17.3 ES Cloud: Random morning ConnectionTimeout to Elastic Cloud from Django/Kubernetes, same request succeeds seconds later](https://discuss.elastic.co/t/v8-17-3-es-cloud-random-morning-connectiontimeout-to-elastic-cloud-from-django-kubernetes-same-request-succeeds-seconds-later/386774)
**Author:** [@Husein\_Kantarci](https://discuss.elastic.co/u/Husein_Kantarci)\ **Replies:** 2\ **Last updated:** [June 16, 2026, 10:01am UTC](https://discuss.elastic.co/t/v8-17-3-es-cloud-random-morning-connectiontimeout-to-elastic-cloud-from-django-kubernetes-same-request-succeeds-seconds-later/386774 "2026-06-16T10:01:23Z")
Hi, We are seeing intermittent elastic\_transport.ConnectionTimeout: Connection timed out errors from our Django application to Elastic Cloud. Environment: Django app running on Kubernetes (EKS) uWSGI, 1 process per p… --- ## [Does the .tasks index still exist in ES 8 and beyond?](https://discuss.elastic.co/t/does-the-tasks-index-still-exist-in-es-8-and-beyond/385426)
**Author:** [@davysteegen](https://discuss.elastic.co/u/davysteegen)\ **Replies:** 2\ **Last updated:** [March 12, 2026, 8:19pm UTC](https://discuss.elastic.co/t/does-the-tasks-index-still-exist-in-es-8-and-beyond/385426 "2026-03-12T20:19:49Z")
Hi, We are in the process of migrating our ES 7 to ES 8. The Java application that connects to the elasticsearch had a job that periodically removed all documents from the system .tasks index where the completed flag is… --- ## [Elasticsearch classic plugin: problem with entitlements](https://discuss.elastic.co/t/elasticsearch-classic-plugin-problem-with-entitlements/385137)
**Author:** [@Peter\_van\_der\_Weerd](https://discuss.elastic.co/u/Peter_van_der_Weerd)\ **Replies:** 1\ **Last updated:** [February 20, 2026, 3:55pm UTC](https://discuss.elastic.co/t/elasticsearch-classic-plugin-problem-with-entitlements/385137 "2026-02-20T15:55:33Z")
I’m writing a classic plugin for a custom similarity. ES9.0.1. The plugin tries to load resources from its own jar: Enumeration\ resources = Utils.class.getClassLoader().getResources("META-INF/MANIFEST.MF"… --- ## [Logstash TCP input SSL connection failing without closing due reason](https://discuss.elastic.co/t/logstash-tcp-input-ssl-connection-failing-without-closing-due-reason/382927)
**Author:** [@ThorNicolai](https://discuss.elastic.co/u/ThorNicolai)\ **Replies:** 1\ **Last updated:** [November 12, 2025, 8:46am UTC](https://discuss.elastic.co/t/logstash-tcp-input-ssl-connection-failing-without-closing-due-reason/382927 "2025-11-12T08:46:27Z")
Dear members of the forum, I have been struggling to get a connection working regarding incoming TCP SSL data. We are running an Ubuntu server with Logstash, we have multiple pipelines running, but this specific one wo… --- ## [Kibana GUI simple filter not able to get it work :(](https://discuss.elastic.co/t/kibana-gui-simple-filter-not-able-to-get-it-work/385598)
**Author:** [@Whoami1980](https://discuss.elastic.co/u/Whoami1980)\ **Replies:** 5\ **Last updated:** [March 30, 2026, 8:02am UTC](https://discuss.elastic.co/t/kibana-gui-simple-filter-not-able-to-get-it-work/385598 "2026-03-30T08:02:19Z")
I thought this was easy but after several attempt i wasnt able to get it working. We have a routine morning health check. i was trying to focus on errors or issue for the snapshot or agent logs but to no avail. For the… --- ## [Grok doesn't work on Elastic but on dubugger yes](https://discuss.elastic.co/t/grok-doesnt-work-on-elastic-but-on-dubugger-yes/383641)
**Author:** [@Andex](https://discuss.elastic.co/u/Andex)\ **Replies:** 5\ **Last updated:** [November 25, 2025, 8:09pm UTC](https://discuss.elastic.co/t/grok-doesnt-work-on-elastic-but-on-dubugger-yes/383641 "2025-11-25T20:09:01Z")
Hi, i’m running a pipeline with Grok filter and date filter. The date filter is running good. Even if my grok matches the logs, on elastic I don't see them parsed, it's like it ignores my grok filter. This is the pipeli… --- ## [How to limit bandwidth usage of Windows Filebeat](https://discuss.elastic.co/t/how-to-limit-bandwidth-usage-of-windows-filebeat/385357)
**Author:** [@waitspring](https://discuss.elastic.co/u/waitspring)\ **Replies:** 1\ **Last updated:** [March 6, 2026, 6:18am UTC](https://discuss.elastic.co/t/how-to-limit-bandwidth-usage-of-windows-filebeat/385357 "2026-03-06T06:18:36Z")
Hello, every big brothers: I installed Filebeat in Windows Server 2012, and make Filebeat send log data to Kafka. I want to limit Filebeat’s bandwidth usage in 50Kbit, because my Windows Server 2012 only has 2Mbit band… --- ## [Count of record drops on the hour](https://discuss.elastic.co/t/count-of-record-drops-on-the-hour/386676)
**Author:** [@HuwT](https://discuss.elastic.co/u/HuwT)\ **Replies:** 3\ **Last updated:** [June 5, 2026, 5:01pm UTC](https://discuss.elastic.co/t/count-of-record-drops-on-the-hour/386676 "2026-06-05T17:01:39Z")
Hello, I am running a single node ELK cluster including filebeat. My main pipeline involves Filebeat \> Logstash \> Elastic and I'm running no log mutations or alterations in logstash. I am seeing periodic drops, approxim… --- ## [Contacting Sales](https://discuss.elastic.co/t/contacting-sales/383656)
**Author:** [@hying](https://discuss.elastic.co/u/hying)\ **Replies:** 3\ **Last updated:** [November 26, 2025, 12:01pm UTC](https://discuss.elastic.co/t/contacting-sales/383656 "2025-11-26T12:01:15Z")
Hello everyone! I’ve been trying to get in touch with the sales team of Elastic for a couple of weeks now, because my company is considering a platinum license. I’ve filled out the contact form with my contact details t… --- ## [Impact of CVE-2025-46295](https://discuss.elastic.co/t/impact-of-cve-2025-46295/384442)
**Author:** [@Max-KI](https://discuss.elastic.co/u/Max-KI)\ **Replies:** 0\ **Last updated:** [January 8, 2026, 2:40pm UTC](https://discuss.elastic.co/t/impact-of-cve-2025-46295/384442 "2026-01-08T14:40:49Z")
CVE-2025-46295 I just downloaded elastic-9.2.3 for Windows. Our security scanner is flagging it because commons-text-1.4.jar is found in the directory elasticsearch-9.2.3\\modules\\x-pack-inference, and CVE-2025-46295 has … --- ## [How to change data view for an already created map?](https://discuss.elastic.co/t/how-to-change-data-view-for-an-already-created-map/389961)
**Author:** [@HaydenB0101](https://discuss.elastic.co/u/HaydenB0101)\ **Replies:** 1\ **Last updated:** [August 27, 2026, 7:18pm UTC](https://discuss.elastic.co/t/how-to-change-data-view-for-an-already-created-map/389961 "2026-08-27T19:18:16Z")
Hello, I imported a map from a separate server and want to change the data view that the map is using. I can't find any option to change the data view, only to see the details of the source. I tried looking through the … --- ## [Tragic failure of primary marks all replica failed](https://discuss.elastic.co/t/tragic-failure-of-primary-marks-all-replica-failed/385277)
**Author:** [@xuanyuan300](https://discuss.elastic.co/u/xuanyuan300)\ **Replies:** 5\ **Last updated:** [March 4, 2026, 12:28am UTC](https://discuss.elastic.co/t/tragic-failure-of-primary-marks-all-replica-failed/385277 "2026-03-04T00:28:52Z")
Hi team We recently encountered the same problem Index with multiple replicas turned red when node with primary went down . Are there any plans to fix it? --- ## [Elastic/Kibana Excessive Memory Consumption in Docker Causes Tasks to Hang and OOM Kills](https://discuss.elastic.co/t/elastic-kibana-excessive-memory-consumption-in-docker-causes-tasks-to-hang-and-oom-kills/389876)
**Author:** [@yogesh119905](https://discuss.elastic.co/u/yogesh119905)\ **Replies:** 1\ **Last updated:** [August 23, 2026, 1:50pm UTC](https://discuss.elastic.co/t/elastic-kibana-excessive-memory-consumption-in-docker-causes-tasks-to-hang-and-oom-kills/389876 "2026-08-23T13:50:11Z")
Kibana version: 9.5.0 Elasticsearch version: 9.5.0 Server OS version: 24.04.3 LTS (Noble Numbat) Original install method (e.g. download page, yum, from source, etc.): Docker Describe the bug: Kibana is consuming… --- ## [Parsing a logstash file](https://discuss.elastic.co/t/parsing-a-logstash-file/383788)
**Author:** [@DOkuwa](https://discuss.elastic.co/u/DOkuwa)\ **Replies:** 2\ **Last updated:** [December 1, 2025, 6:08pm UTC](https://discuss.elastic.co/t/parsing-a-logstash-file/383788 "2025-12-01T18:08:53Z")
I want to parse my logstash file to be able to delete some unnecessary fields that appear in kibana This is the input file from filebeat { "source": "10.200.226.62:57500", "subscription-name": "default-1764331045"… --- ## [RBAC for AI agents and space restrictions for agents](https://discuss.elastic.co/t/rbac-for-ai-agents-and-space-restrictions-for-agents/389431)
**Author:** [@venkatkumar229](https://discuss.elastic.co/u/venkatkumar229)\ **Replies:** 1\ **Last updated:** [August 20, 2026, 10:54pm UTC](https://discuss.elastic.co/t/rbac-for-ai-agents-and-space-restrictions-for-agents/389431 "2026-08-20T22:54:21Z")
Hi Team, We have two questions related to AI Agents and would appreciate your guidance. 1. Restricting users to access only specific agents We have multiple AI Agents within a single Space in our Elastic environment, f… --- ## [Elastic-agent stuck in offline status](https://discuss.elastic.co/t/elastic-agent-stuck-in-offline-status/385697)
**Author:** [@Alaeddine\_khadraoui](https://discuss.elastic.co/u/Alaeddine_khadraoui)\ **Replies:** 1\ **Last updated:** [April 3, 2026, 5:59am UTC](https://discuss.elastic.co/t/elastic-agent-stuck-in-offline-status/385697 "2026-04-03T05:59:14Z")
Dear Elastic Community i have elastic agent installed on linux on the host elastic-agent status showing Healthy/running but in fleet server UI it showing always offline ,i did re-installation of the agent but still offl… --- ## [ECK Fleet Server setup confusion and failure](https://discuss.elastic.co/t/eck-fleet-server-setup-confusion-and-failure/384857)
**Author:** [@gueguet57](https://discuss.elastic.co/u/gueguet57)\ **Replies:** 1\ **Last updated:** [February 3, 2026, 10:36am UTC](https://discuss.elastic.co/t/eck-fleet-server-setup-confusion-and-failure/384857 "2026-02-03T10:36:57Z")
Hi, I have an existing ECK stack (ES + Kibana) running fine. I’m now trying to add Fleet Server and configure Kibana accordingly, but I’m a bit confused. I’m following: https://www.elastic.co/docs/deploy-manage/depl… --- ## [ES|QL: How to count latest status per key without transform](https://discuss.elastic.co/t/es-ql-how-to-count-latest-status-per-key-without-transform/384430)
**Author:** [@Tortoise](https://discuss.elastic.co/u/Tortoise)\ **Replies:** 1\ **Last updated:** [January 8, 2026, 8:20am UTC](https://discuss.elastic.co/t/es-ql-how-to-count-latest-status-per-key-without-transform/384430 "2026-01-08T08:20:14Z")
Hello Team, I am trying to compute metrics based only on the latest record per key using ES|QL in 9.x version? I have a time-series index where each entity (e.g. trainnumber) emits multiple events over time and I want … --- ## [Anonymize and/or remove my account please](https://discuss.elastic.co/t/anonymize-and-or-remove-my-account-please/382994)
**Author:** [@anon9652915](https://discuss.elastic.co/u/anon9652915)\ **Replies:** 1\ **Last updated:** [October 26, 2025, 9:54pm UTC](https://discuss.elastic.co/t/anonymize-and-or-remove-my-account-please/382994 "2025-10-26T21:54:08Z")
This account is long dead, would rather not have it associated anymore. Can a mod please anonymize and/or delete it? Thank you in advance --- ## [Filebeat - Single-line JSON log ingestion: expected behavior and required configuration](https://discuss.elastic.co/t/filebeat-single-line-json-log-ingestion-expected-behavior-and-required-configuration/386753)
**Author:** [@aymanmazroui](https://discuss.elastic.co/u/aymanmazroui)\ **Replies:** 2\ **Last updated:** [June 8, 2026, 1:59pm UTC](https://discuss.elastic.co/t/filebeat-single-line-json-log-ingestion-expected-behavior-and-required-configuration/386753 "2026-06-08T13:59:58Z")
Hi, I have a specific use case and I need to know if Filebeat can handle it. My log files consist of a single very long line of JSON (no newline characters), which can be up to 27 MB in size. The entire file content i… --- ## [Error: Dynamic contract resolving fails due to undeclared dependency fleet](https://discuss.elastic.co/t/error-dynamic-contract-resolving-fails-due-to-undeclared-dependency-fleet/386432)
**Author:** [@yogesh119905](https://discuss.elastic.co/u/yogesh119905)\ **Replies:** 2\ **Last updated:** [May 21, 2026, 10:47am UTC](https://discuss.elastic.co/t/error-dynamic-contract-resolving-fails-due-to-undeclared-dependency-fleet/386432 "2026-05-21T10:47:33Z")
Description: When attempting to index management page and I am getting following error on kibana. Is this related to plugins problem ? \*\*Error: Dynamic contract resolving requires the dependencies to be declared in th… --- ## [Logstash credentials management](https://discuss.elastic.co/t/logstash-credentials-management/386680)
**Author:** [@ShubhamKumarJena](https://discuss.elastic.co/u/ShubhamKumarJena)\ **Replies:** 1\ **Last updated:** [June 3, 2026, 1:14pm UTC](https://discuss.elastic.co/t/logstash-credentials-management/386680 "2026-06-03T13:14:51Z")
Hello ! \*\* Problem Statement\*\* We are reviewing the current authentication mechanism used by our Logstash deployment and would like to align it with industry best practices. Currently, certain Logstash pipelines requ… --- ## [Elasticsearch fails to start after install with custom paths, possible BUG](https://discuss.elastic.co/t/elasticsearch-fails-to-start-after-install-with-custom-paths-possible-bug/384091)
**Author:** [@commandline](https://discuss.elastic.co/u/commandline)\ **Replies:** 1\ **Last updated:** [December 15, 2025, 8:49pm UTC](https://discuss.elastic.co/t/elasticsearch-fails-to-start-after-install-with-custom-paths-possible-bug/384091 "2025-12-15T20:49:19Z")
when installing elasticsearch with custom paths set in /etc/elasticsearch/elasticsearch.yml and no other change this throws a very uninformative and annoying error. systemd-entrypoint\\\[13576\\\]: ERROR: Unable to create l… --- ## [Can We Temporarily Disable Filestream Integration for a Elastic Agent Policy to temporarily collect data instead of unenroll it?](https://discuss.elastic.co/t/can-we-temporarily-disable-filestream-integration-for-a-elastic-agent-policy-to-temporarily-collect-data-instead-of-unenroll-it/383969)
**Author:** [@josh\_tran](https://discuss.elastic.co/u/josh_tran)\ **Replies:** 4\ **Last updated:** [January 6, 2026, 12:48pm UTC](https://discuss.elastic.co/t/can-we-temporarily-disable-filestream-integration-for-a-elastic-agent-policy-to-temporarily-collect-data-instead-of-unenroll-it/383969 "2026-01-06T12:48:18Z")
Hi all, Currently, my system is collecting log data using Filestream (Custom Logs integration). The thousand agents are managed by policies in the Fleet server. The machines that have the Agents installed usually need … --- ## [Export result to clipboard in Kibana with ES|QL](https://discuss.elastic.co/t/export-result-to-clipboard-in-kibana-with-es-ql/385507)
**Author:** [@dot-mike](https://discuss.elastic.co/u/dot-mike)\ **Replies:** 2\ **Last updated:** [March 18, 2026, 5:05pm UTC](https://discuss.elastic.co/t/export-result-to-clipboard-in-kibana-with-es-ql/385507 "2026-03-18T17:05:19Z")
Dear community, I am wondering if there exists a way to copy data from result table to clipboard so it's formatted in markdown or similar syntax? Lets take this ES|QL below it will generate up to maximum 20 rows. I wo… --- ## [Elastic Stack Self-Managed Multi-Node – Fleet Server TLS](https://discuss.elastic.co/t/elastic-stack-self-managed-multi-node-fleet-server-tls/384902)
**Author:** [@4l13v](https://discuss.elastic.co/u/4l13v)\ **Replies:** 1\ **Last updated:** [April 9, 2026, 1:10pm UTC](https://discuss.elastic.co/t/elastic-stack-self-managed-multi-node-fleet-server-tls/384902 "2026-04-09T13:10:19Z")
I am running a self-managed Elastic Stack (8.x) on a private network and trying to deploy Fleet Server with production TLS certificates. I am facing certificate trust and agent enrollment issues. Then I saw on documenta… --- ## [APM some time dont show trace.id by link/to/trace](https://discuss.elastic.co/t/apm-some-time-dont-show-trace-id-by-link-to-trace/385491)
**Author:** [@tmp13](https://discuss.elastic.co/u/tmp13)\ **Replies:** 1\ **Last updated:** [March 18, 2026, 6:13am UTC](https://discuss.elastic.co/t/apm-some-time-dont-show-trace-id-by-link-to-trace/385491 "2026-03-18T06:13:02Z")
Kibana version: 9.3.0 Elasticsearch version: 9.3.0 APM Server version: 9.3.0 Browser version: Firefox/Safari Original install method (e.g. download page, yum, deb, from source, etc.) and version: tar.gz Fresh instal… [Previous page](https://discuss.elastic.co/top.md?page=16&per_page=50) [Next page](https://discuss.elastic.co/top.md?page=18&per_page=50)