# Top **URL:** https://discuss.elastic.co/top.md?page=19 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 20 --- ## [Filebeat Unable to Handle Single Large Event (~5GB)](https://discuss.elastic.co/t/filebeat-unable-to-handle-single-large-event-5gb/384782)
**Author:** [@Thirupathi](https://discuss.elastic.co/u/Thirupathi)\ **Replies:** 1\ **Last updated:** [January 29, 2026, 1:57pm UTC](https://discuss.elastic.co/t/filebeat-unable-to-handle-single-large-event-5gb/384782 "2026-01-29T13:57:18Z")
We are facing an issue where Filebeat is not able to process or hold a single large event of approximately 5 GB . Due to this limitation, the event is not being shipped successfully to Elasticsearch. This appears to be … --- ## [Managing Thousands of Small Vector Indices in Elasticsearch: Potential Issues and Best Practices](https://discuss.elastic.co/t/managing-thousands-of-small-vector-indices-in-elasticsearch-potential-issues-and-best-practices/383172)
**Author:** [@noday](https://discuss.elastic.co/u/noday)\ **Replies:** 1\ **Last updated:** [November 3, 2025, 3:40pm UTC](https://discuss.elastic.co/t/managing-thousands-of-small-vector-indices-in-elasticsearch-potential-issues-and-best-practices/383172 "2025-11-03T15:40:13Z")
If using Elasticsearch as a vector database, and considering that many knowledge bases employ different embedding models, over time this can result in a large number of small indices, for example, tens of thousands. Coul… --- ## [High CPU Usage on Elastic Defend and Kibana Processes](https://discuss.elastic.co/t/high-cpu-usage-on-elastic-defend-and-kibana-processes/386663)
**Author:** [@YousefNein](https://discuss.elastic.co/u/YousefNein)\ **Replies:** 0\ **Last updated:** [June 2, 2026, 11:35pm UTC](https://discuss.elastic.co/t/high-cpu-usage-on-elastic-defend-and-kibana-processes/386663 "2026-06-02T23:35:40Z")
Hello, I have two problems related to CPU usage being very high with two ES related processes. I'm currently using 3 ES nodes on the same machine using Docker. 1 Master hot/content, 1 warm, and 1 cold. The machine has … --- ## [Kibana Theme (again)](https://discuss.elastic.co/t/kibana-theme-again/385607)
**Author:** [@Doc\_Kaos](https://discuss.elastic.co/u/Doc_Kaos)\ **Replies:** 3\ **Last updated:** [March 25, 2026, 4:58pm UTC](https://discuss.elastic.co/t/kibana-theme-again/385607 "2026-03-25T16:58:36Z")
Only finding 9 year old topics for theming Kibana. I currently have 17 tabs open with Kibana for different clusters. It would be immensely useful to be able to have certain ones “blue”, some “green”, some “red” as a vis… --- ## [Netapp & elasticsearch?](https://discuss.elastic.co/t/netapp-elasticsearch/390020)
**Author:** [@smm](https://discuss.elastic.co/u/smm)\ **Replies:** 2\ **Last updated:** [September 1, 2026, 4:47am UTC](https://discuss.elastic.co/t/netapp-elasticsearch/390020 "2026-09-01T04:47:01Z")
I would like to run an Elastic stack on VMware VMs. These VMs should run on NetApp via iSCSI/FC with XFS. It is a good or a bad idea? Does it work as good as local storage? Any input, shared story / experience about thi… --- ## [Elastic - ESET AV integration](https://discuss.elastic.co/t/elastic-eset-av-integration/385971)
**Author:** [@PatreKerier](https://discuss.elastic.co/u/PatreKerier)\ **Replies:** 2\ **Last updated:** [April 22, 2026, 12:25pm UTC](https://discuss.elastic.co/t/elastic-eset-av-integration/385971 "2026-04-22T12:25:04Z")
Good afternoon! Please tell me if anyone has configured the integration of ESET AntiVirus with ELASTIC. I deployed a Linux-based syslog server, specified the address and port 514 or 6514 in ESET, but there are no logs, … --- ## [Elastic rule Hyperlinks in Highlighted Fields](https://discuss.elastic.co/t/elastic-rule-hyperlinks-in-highlighted-fields/384894)
**Author:** [@welch27330](https://discuss.elastic.co/u/welch27330)\ **Replies:** 2\ **Last updated:** [February 13, 2026, 2:48am UTC](https://discuss.elastic.co/t/elastic-rule-hyperlinks-in-highlighted-fields/384894 "2026-02-13T02:48:48Z")
Is it possible to create a custom clickable hyperlink in the highlighted fields. The link could be constructed in several ways but generally constructed from data that is present in the alert it self. The reason for thi… --- ## [Autodiscovery Strategy for Transitioning from Heartbeat to Synthetics](https://discuss.elastic.co/t/autodiscovery-strategy-for-transitioning-from-heartbeat-to-synthetics/387228)
**Author:** [@Cristian\_Pereyra](https://discuss.elastic.co/u/Cristian_Pereyra)\ **Replies:** 1\ **Last updated:** [June 24, 2026, 2:10am UTC](https://discuss.elastic.co/t/autodiscovery-strategy-for-transitioning-from-heartbeat-to-synthetics/387228 "2026-06-24T02:10:57Z")
Hello everyone. The topic that brings us here is Heartbeat autodiscover. We have many deployments that are going to be modified and we need to automate the detection and creation of monitors. The problem that is added … --- ## [Crash in filebeat 9.3.0 on error "concurrent map iteration and map write"](https://discuss.elastic.co/t/crash-in-filebeat-9-3-0-on-error-concurrent-map-iteration-and-map-write/386208)
**Author:** [@grzegorzkw](https://discuss.elastic.co/u/grzegorzkw)\ **Replies:** 1\ **Last updated:** [June 15, 2026, 12:15pm UTC](https://discuss.elastic.co/t/crash-in-filebeat-9-3-0-on-error-concurrent-map-iteration-and-map-write/386208 "2026-06-15T12:15:01Z")
Hello, One of our filebeat deployments is bumping into the below error which crashes the service overall: fatal error: concurrent map iteration and map write goroutine 1 \[running\]: internal/runtime/maps.fatal({0x69991… --- ## [Unexpected high memory usage in Elasticsearch cluster – looking for optimization advice](https://discuss.elastic.co/t/unexpected-high-memory-usage-in-elasticsearch-cluster-looking-for-optimization-advice/384629)
**Author:** [@jimmykalru](https://discuss.elastic.co/u/jimmykalru)\ **Replies:** 1\ **Last updated:** [January 19, 2026, 5:55pm UTC](https://discuss.elastic.co/t/unexpected-high-memory-usage-in-elasticsearch-cluster-looking-for-optimization-advice/384629 "2026-01-19T17:55:39Z")
I’m running an Elasticsearch cluster in a production environment and recently noticed consistently high memory usage across all data nodes. Even during periods of low query activity, heap usage remains elevated and occas… --- ## [Context group not visible in rule](https://discuss.elastic.co/t/context-group-not-visible-in-rule/384052)
**Author:** [@Dhruv\_Naik](https://discuss.elastic.co/u/Dhruv_Naik)\ **Replies:** 1\ **Last updated:** [December 15, 2025, 10:13am UTC](https://discuss.elastic.co/t/context-group-not-visible-in-rule/384052 "2025-12-15T10:13:52Z")
I’ve set a GROUP BY query which looks as follows under Rules: When I test the index connector via Dev Tools the context.group stays empty. My document is formatted as follows: { "alert\_type": "ERROR\_THRESHOLD\_BREA… --- ## [Prevent to create global exceptions for space user](https://discuss.elastic.co/t/prevent-to-create-global-exceptions-for-space-user/389911)
**Author:** [@adamsmesher](https://discuss.elastic.co/u/adamsmesher)\ **Replies:** 1\ **Last updated:** [August 25, 2026, 12:30pm UTC](https://discuss.elastic.co/t/prevent-to-create-global-exceptions-for-space-user/389911 "2026-08-25T12:30:02Z")
Any ability to prevent users from another space from creating "global" exceptions? Goal is to add permissions to add endpoint exceptions only for policies which related only to specific space. --- ## [Indexing a small multi-field text dataset with the Elasticsearch Python client](https://discuss.elastic.co/t/indexing-a-small-multi-field-text-dataset-with-the-elasticsearch-python-client/389858)
**Author:** [@Cagatay\_Aydin](https://discuss.elastic.co/u/Cagatay_Aydin)\ **Replies:** 1\ **Last updated:** [August 24, 2026, 1:17pm UTC](https://discuss.elastic.co/t/indexing-a-small-multi-field-text-dataset-with-the-elasticsearch-python-client/389858 "2026-08-24T13:17:45Z")
Hi everyone, I have been testing Elasticsearch with a small dataset where each document contains several related text fields rather than one large body field. The dataset has 78 tarot card records. Each record includes… --- ## [Need an explanation for the Kibana Licensing](https://discuss.elastic.co/t/need-an-explanation-for-the-kibana-licensing/385300)
**Author:** [@ItsMeBrille](https://discuss.elastic.co/u/ItsMeBrille)\ **Replies:** 1\ **Last updated:** [March 2, 2026, 2:59pm UTC](https://discuss.elastic.co/t/need-an-explanation-for-the-kibana-licensing/385300 "2026-03-02T14:59:35Z")
I read this: License settings | Reference but there are some things I dont understand. This issue says it is only for elasticsearch: Unable to configure xpack license setting via ENV vars · Issue #78 · elastic/kibana-do… --- ## [Latency graph not showing](https://discuss.elastic.co/t/latency-graph-not-showing/389668)
**Author:** [@ajoshi](https://discuss.elastic.co/u/ajoshi)\ **Replies:** 3\ **Last updated:** [August 15, 2026, 4:24pm UTC](https://discuss.elastic.co/t/latency-graph-not-showing/389668 "2026-08-15T16:24:03Z")
latency graph not coming in APM dashboard other things are coming i don't know why ? --- ## [How to fetch data through multiple indexes](https://discuss.elastic.co/t/how-to-fetch-data-through-multiple-indexes/386380)
**Author:** [@Suiiinaldo](https://discuss.elastic.co/u/Suiiinaldo)\ **Replies:** 3\ **Last updated:** [May 19, 2026, 9:35am UTC](https://discuss.elastic.co/t/how-to-fetch-data-through-multiple-indexes/386380 "2026-05-19T09:35:26Z")
Problem: I need to fetch data through multiple indexes. Use Case: Currently I have an index "something-\*", and it stores data monthly (for example something-2026-05, something-2026-04). Now I need to fetch data for la… --- ## [My\_weblog\_pipline Grok Error in Elastic Observability Engineer On Demand Course](https://discuss.elastic.co/t/my-weblog-pipline-grok-error-in-elastic-observability-engineer-on-demand-course/384235)
**Author:** [@jasonlevine](https://discuss.elastic.co/u/jasonlevine)\ **Replies:** 2\ **Last updated:** [December 24, 2025, 7:03pm UTC](https://discuss.elastic.co/t/my-weblog-pipline-grok-error-in-elastic-observability-engineer-on-demand-course/384235 "2025-12-24T19:03:32Z")
Course: Elastic Observability Engineer Version: On-Demand Question: I’m currently working through the labs in the Elastic Observability Engineer (On-Demand) course. I completed Labs 5.1 through 5.4, but ran into an er… --- ## [Struggling to set up multiple namespaces for a single Beats data stream](https://discuss.elastic.co/t/struggling-to-set-up-multiple-namespaces-for-a-single-beats-data-stream/383212)
**Author:** [@dot-mike](https://discuss.elastic.co/u/dot-mike)\ **Replies:** 2\ **Last updated:** [November 4, 2025, 4:27pm UTC](https://discuss.elastic.co/t/struggling-to-set-up-multiple-namespaces-for-a-single-beats-data-stream/383212 "2025-11-04T16:27:54Z")
Dear community In Elastic Fleet you can set a namespace for an integration so you can have multiple data streams for a single type of index template without having to duplicate settings (ILM policy, index template, comp… --- ## [Trouble Running a Second Pipeline in Logstash 8.x (Multiple Pipelines Not Working)](https://discuss.elastic.co/t/trouble-running-a-second-pipeline-in-logstash-8-x-multiple-pipelines-not-working/383956)
**Author:** [@Grzegosz](https://discuss.elastic.co/u/Grzegosz)\ **Replies:** 5\ **Last updated:** [December 11, 2025, 3:36pm UTC](https://discuss.elastic.co/t/trouble-running-a-second-pipeline-in-logstash-8-x-multiple-pipelines-not-working/383956 "2025-12-11T15:36:17Z")
Hello. Please help me understand why the second pipeline in Logstash is not working. I have Logstash 8+ installed. I added a second pipeline path in the pipelines.yml file as follows: - pipeline.id: audit path.config… --- ## [LENS and TSVB showing different result](https://discuss.elastic.co/t/lens-and-tsvb-showing-different-result/384110)
**Author:** [@Arshukla](https://discuss.elastic.co/u/Arshukla)\ **Replies:** 4\ **Last updated:** [December 16, 2025, 4:10pm UTC](https://discuss.elastic.co/t/lens-and-tsvb-showing-different-result/384110 "2025-12-16T16:10:15Z")
Hi team, Could you please help why TSVB is showing 0 values for same field and LENS is having values. Whereas in both scenarios aggregation is sum --- ## [Filebeat and Nanosecond Timestamps](https://discuss.elastic.co/t/filebeat-and-nanosecond-timestamps/389204)
**Author:** [@dawiro](https://discuss.elastic.co/u/dawiro)\ **Replies:** 1\ **Last updated:** [August 31, 2026, 3:55am UTC](https://discuss.elastic.co/t/filebeat-and-nanosecond-timestamps/389204 "2026-08-31T03:55:37Z")
Hi, Can I get some clarification around how filebeat handles an inbound timestamp field of nanosecond precision when it uses that field to set @timestamp? Also, can filebeat generate nanosecond timestamps? --- ## [Inquiry schedule: Backport concurrent-ruby 1.3.7 to Logstash 8.19.x for CVE-2026-54904(High)](https://discuss.elastic.co/t/inquiry-schedule-backport-concurrent-ruby-1-3-7-to-logstash-8-19-x-for-cve-2026-54904-high/389887)
**Author:** [@Della](https://discuss.elastic.co/u/Della)\ **Replies:** 1\ **Last updated:** [August 24, 2026, 4:12pm UTC](https://discuss.elastic.co/t/inquiry-schedule-backport-concurrent-ruby-1-3-7-to-logstash-8-19-x-for-cve-2026-54904-high/389887 "2026-08-24T16:12:13Z")
Dear Elastic Security & Logstash Team, We are running Logstash 8.19.19 in production environment. Security scanning (Docker Scout/Trivy) detects high vulnerability CVE-2026-54904 in embedded concurrent-ruby gem 1.1.9. T… --- ## [Intermittent log loss observed in a UDP-based Logstash architecture behind a load balancer, with ongoing investigation into possible packet drops, idle-timeout behavior, and UDP input tuning recommendations.](https://discuss.elastic.co/t/intermittent-log-loss-observed-in-a-udp-based-logstash-architecture-behind-a-load-balancer-with-ongoing-investigation-into-possible-packet-drops-idle-timeout-behavior-and-udp-input-tuning-recommendations/386494)
**Author:** [@Usha\_Nookala](https://discuss.elastic.co/u/Usha_Nookala)\ **Replies:** 1\ **Last updated:** [May 25, 2026, 5:02pm UTC](https://discuss.elastic.co/t/intermittent-log-loss-observed-in-a-udp-based-logstash-architecture-behind-a-load-balancer-with-ongoing-investigation-into-possible-packet-drops-idle-timeout-behavior-and-udp-input-tuning-recommendations/386494 "2026-05-25T17:02:03Z")
Hi everyone, We are currently troubleshooting intermittent log loss in a Logstash setup using the UDP input plugin and wanted to check if anyone in the community has faced similar behavior. Current setup (genericized): … --- ## [Scale ES from Single-node to Multi-node](https://discuss.elastic.co/t/scale-es-from-single-node-to-multi-node/386006)
**Author:** [@Raghava\_Yerubandi](https://discuss.elastic.co/u/Raghava_Yerubandi)\ **Replies:** 1\ **Last updated:** [April 24, 2026, 3:16am UTC](https://discuss.elastic.co/t/scale-es-from-single-node-to-multi-node/386006 "2026-04-24T03:16:53Z")
Hello guys, We have an Elasticsearch 8.18.4, which is running as a Docker container as a single-node. Now I want to add two or more nodes to it, and also I want to make them a multi-node cluster. Is there any way to sca… --- ## [Practical issues related to disk usage](https://discuss.elastic.co/t/practical-issues-related-to-disk-usage/386568)
**Author:** [@mloine](https://discuss.elastic.co/u/mloine)\ **Replies:** 2\ **Last updated:** [May 30, 2026, 8:42am UTC](https://discuss.elastic.co/t/practical-issues-related-to-disk-usage/386568 "2026-05-30T08:42:34Z")
Hello, I am encountering a situation now: Version: 6.8.1 Number of nodes: 20, of which 15 nodes are 500G and 5 nodes are 2000G Now the 500G disk must be filled up to trigger the water level configuration of the disk. … --- ## [Certification support team is unresponsive](https://discuss.elastic.co/t/certification-support-team-is-unresponsive/385461)
**Author:** [@riyaz3az](https://discuss.elastic.co/u/riyaz3az)\ **Replies:** 2\ **Last updated:** [March 17, 2026, 6:05am UTC](https://discuss.elastic.co/t/certification-support-team-is-unresponsive/385461 "2026-03-17T06:05:23Z")
I have purchased the Elastic Observability Engineer exam with my official email account and our email security team is blocking the emails from TrueAbility, in order to change the email address, I’m trying to reach certi… --- ## [Local develop project build error](https://discuss.elastic.co/t/local-develop-project-build-error/383736)
**Author:** [@youdation](https://discuss.elastic.co/u/youdation)\ **Replies:** 2\ **Last updated:** [November 27, 2025, 3:46pm UTC](https://discuss.elastic.co/t/local-develop-project-build-error/383736 "2025-11-27T15:46:35Z")
master latest code idea jdk 21 gradle 9.2.0 \`Build file 'D:\\project\\elasticsearch\\rest-api-spec\\build.gradle' line: 5 A problem occurred evaluating project ':rest-api-spec'. Failed to apply plugin class 'org.elasti… --- ## [How do I update advanced settings via Kibana API?](https://discuss.elastic.co/t/how-do-i-update-advanced-settings-via-kibana-api/383526)
**Author:** [@Dhruv\_Naik](https://discuss.elastic.co/u/Dhruv_Naik)\ **Replies:** 2\ **Last updated:** [November 19, 2025, 2:05pm UTC](https://discuss.elastic.co/t/how-do-i-update-advanced-settings-via-kibana-api/383526 "2025-11-19T14:05:25Z")
Hi, I want to know if there is a supported way to update Kibana Advanced Settings (specifically the defaultRoute attribute) using an API. I’m trying to automate this through Jenkins so that each Kibana space gets a cus… --- ## [Elastic siem and EDR architecture validation](https://discuss.elastic.co/t/elastic-siem-and-edr-architecture-validation/390884)
**Author:** [@chandrakt](https://discuss.elastic.co/u/chandrakt)\ **Replies:** 3\ **Last updated:** [October 7, 2026, 11:29am UTC](https://discuss.elastic.co/t/elastic-siem-and-edr-architecture-validation/390884 "2026-10-07T11:29:44Z")
please let me know isthis correct diagram for 50gb par day dat ingestion and i need DC and DR both --- ## [Anomaly Detection Jobs - Various warning messages](https://discuss.elastic.co/t/anomaly-detection-jobs-various-warning-messages/385501)
**Author:** [@Whoami1980](https://discuss.elastic.co/u/Whoami1980)\ **Replies:** 3\ **Last updated:** [March 18, 2026, 9:49am UTC](https://discuss.elastic.co/t/anomaly-detection-jobs-various-warning-messages/385501 "2026-03-18T09:49:02Z")
We are seeing various warning message below. Is there a guide to kickstart how we can kick start our troubleshooting? Warning datafeed is encountering errors submitting data for analysis exception while flushing jobs … --- ## [How to use sniffer capability in elasticsearch-java client tool?](https://discuss.elastic.co/t/how-to-use-sniffer-capability-in-elasticsearch-java-client-tool/385038)
**Author:** [@mloine](https://discuss.elastic.co/u/mloine)\ **Replies:** 3\ **Last updated:** [February 15, 2026, 3:05pm UTC](https://discuss.elastic.co/t/how-to-use-sniffer-capability-in-elasticsearch-java-client-tool/385038 "2026-02-15T15:05:13Z")
How to use sniffer capability in elasticsearch-java client tool? According to the documentation, it is not supported by default, and the dependencies are \ \co.elastic.clients\ \ **Author:** [@hdrkhls](https://discuss.elastic.co/u/hdrkhls)\ **Replies:** 0\ **Last updated:** [November 21, 2025, 8:13am UTC](https://discuss.elastic.co/t/elastic-agent-high-cpu-usage/383578 "2025-11-21T08:13:56Z") Hi there, Elastic Stack : 9.0.3 Elastic Agent: 9.04 Im already install elastic-agent standalone on my postgresql server using postgresql module integration on kibana, and there is high cpu usage, which is make my post… --- ## [Filter for specific field values and create another index to store for longterm storage](https://discuss.elastic.co/t/filter-for-specific-field-values-and-create-another-index-to-store-for-longterm-storage/385273)
**Author:** [@C\_Shah](https://discuss.elastic.co/u/C_Shah)\ **Replies:** 3\ **Last updated:** [May 5, 2026, 3:34pm UTC](https://discuss.elastic.co/t/filter-for-specific-field-values-and-create-another-index-to-store-for-longterm-storage/385273 "2026-05-05T15:34:55Z")
I have filebeat sending logs from multiple files into an elasticseash index. What is the best way for me to filter on those logs and only store those filtered logs in an index for longer time (longer ILM policy)? k8s po… --- ## [Dec 23rd, 2025: \[EN\] Enterprise Search in 2025: to crawl or not to crawl](https://discuss.elastic.co/t/dec-23rd-2025-en-enterprise-search-in-2025-to-crawl-or-not-to-crawl/383980)
**Author:** [@Artem\_Shelkovnikov](https://discuss.elastic.co/u/Artem_Shelkovnikov)\ **Replies:** 0\ **Last updated:** [December 23, 2025, 8:00am UTC](https://discuss.elastic.co/t/dec-23rd-2025-en-enterprise-search-in-2025-to-crawl-or-not-to-crawl/383980 "2025-12-23T08:00:56Z")
Search in Enterprise Systems in 2025: to crawl or not to crawl There are a lot of systems out there that are used by businesses: Github, Gitlab, Jira, Confluence, Sharepoint, Salesforce, Notion and many more. They hav… --- ## [Elasticsearch 8.12.2 Startup Failure: SIGILL Crash](https://discuss.elastic.co/t/elasticsearch-8-12-2-startup-failure-sigill-crash/383554)
**Author:** [@Pabendi](https://discuss.elastic.co/u/Pabendi)\ **Replies:** 3\ **Last updated:** [November 20, 2025, 7:14pm UTC](https://discuss.elastic.co/t/elasticsearch-8-12-2-startup-failure-sigill-crash/383554 "2025-11-20T19:14:52Z")
Hello everyone, thank you so much for taking the time to read this. I have a small problem with my Elastic server: My Elasticsearch 8.12.2 was running without issues for several months on multiple nodes in a Red Hat En… --- ## [Winlogbeat - Mismatched event.action for event.code](https://discuss.elastic.co/t/winlogbeat-mismatched-event-action-for-event-code/385735)
**Author:** [@coldmint](https://discuss.elastic.co/u/coldmint)\ **Replies:** 1\ **Last updated:** [April 2, 2026, 7:35am UTC](https://discuss.elastic.co/t/winlogbeat-mismatched-event-action-for-event-code/385735 "2026-04-02T07:35:31Z")
Hello, We’re running a clean install of Winlogbeat with a pretty barebones configuration, but unfortunately we’re noticing logged events transfer with incorrect event.action values for the respective event.code(Such as … --- ## [OTEL Traces not appearing in Observability-Services](https://discuss.elastic.co/t/otel-traces-not-appearing-in-observability-services/384004)
**Author:** [@Steve\_Foster](https://discuss.elastic.co/u/Steve_Foster)\ **Replies:** 1\ **Last updated:** [December 11, 2025, 10:29pm UTC](https://discuss.elastic.co/t/otel-traces-not-appearing-in-observability-services/384004 "2025-12-11T22:29:32Z")
Posted in Elastic Slack too.. I'm struggling to get OTEL traces from a python application, that are being send to a hosted elastic, to be displayed in observability-\>services.The application is running in AWS ECS and se… --- ## [Running Multiple Elasticsearch Nodes per VM to Bypass 32 GB Heap Limit Best Practice](https://discuss.elastic.co/t/running-multiple-elasticsearch-nodes-per-vm-to-bypass-32-gb-heap-limit-best-practice/383269)
**Author:** [@YousefNein](https://discuss.elastic.co/u/YousefNein)\ **Replies:** 1\ **Last updated:** [November 6, 2025, 1:14pm UTC](https://discuss.elastic.co/t/running-multiple-elasticsearch-nodes-per-vm-to-bypass-32-gb-heap-limit-best-practice/383269 "2025-11-06T13:14:39Z")
I understand that a single Elasticsearch node shouldn’t have more than ~32 GB of JVM heap, but can I run multiple Elasticsearch containers (Let’s say 2) on the same machine with their heap set to 32 GB whilst having the … --- ## [Unable to find job message fields in ".ml-anomalies\*" index](https://discuss.elastic.co/t/unable-to-find-job-message-fields-in-ml-anomalies-index/385537)
**Author:** [@Whoami1980](https://discuss.elastic.co/u/Whoami1980)\ **Replies:** 4\ **Last updated:** [March 23, 2026, 9:20am UTC](https://discuss.elastic.co/t/unable-to-find-job-message-fields-in-ml-anomalies-index/385537 "2026-03-23T09:20:57Z")
Machine Learning \>\> Anomaly Detection \>\> Jobs I am trying to come out with an ESQL query to consolidate all job messages that is non-info. warning or errors. Example of message Time Node Message 202X-XX-XX 16:24… --- ## [Kibana Sample Data Error](https://discuss.elastic.co/t/kibana-sample-data-error/384399)
**Author:** [@Piotr\_Zurowski](https://discuss.elastic.co/u/Piotr_Zurowski)\ **Replies:** 0\ **Last updated:** [January 6, 2026, 8:48pm UTC](https://discuss.elastic.co/t/kibana-sample-data-error/384399 "2026-01-06T20:48:18Z")
Course: Elastic Certified Observability Engineer Version: 9.2.3 Question: While trying to get sample data like in the course I get: onError@localhost:5601/4fac8383dfc0/bundles/plugin/searchHomepage/1.0.0/searchHomepage… --- ## [Csv filter parsing error](https://discuss.elastic.co/t/csv-filter-parsing-error/386766)
**Author:** [@carellevbt](https://discuss.elastic.co/u/carellevbt)\ **Replies:** 2\ **Last updated:** [June 10, 2026, 9:45am UTC](https://discuss.elastic.co/t/csv-filter-parsing-error/386766 "2026-06-10T09:45:20Z")
Hello, I have multiple csv files I need to ingest. Among the csv files I have 13 column header names variations. I would like to use the autodetect\_column\_names to avoid manually configuring these column names. Also ple… --- ## [Defend for Containers (D4C) integration with OPENSHIFT](https://discuss.elastic.co/t/defend-for-containers-d4c-integration-with-openshift/387268)
**Author:** [@Mohamed\_Nada](https://discuss.elastic.co/u/Mohamed_Nada)\ **Replies:** 1\ **Last updated:** [June 30, 2026, 1:31pm UTC](https://discuss.elastic.co/t/defend-for-containers-d4c-integration-with-openshift/387268 "2026-06-30T13:31:40Z")
I am looking for some insight into a hard kernel verifier rejection we are hitting with the Defend for Containers (D4C) integration. The Activity & Purpose We are deploying Elastic Agent (9.4.2) via Fleet on an OpenShif… --- ## [Kibana 8.19.9 – Multiple HIGH severity dependency vulnerabilities (npm & OS packages)](https://discuss.elastic.co/t/kibana-8-19-9-multiple-high-severity-dependency-vulnerabilities-npm-os-packages/384536)
**Author:** [@Shanmuga\_Sundaram\_Mu](https://discuss.elastic.co/u/Shanmuga_Sundaram_Mu)\ **Replies:** 1\ **Last updated:** [January 14, 2026, 10:13am UTC](https://discuss.elastic.co/t/kibana-8-19-9-multiple-high-severity-dependency-vulnerabilities-npm-os-packages/384536 "2026-01-14T10:13:21Z")
Product Details Product: Kibana Version: 8.19.9 Deployment: Self-managed / Community Build type: Official Elastic Docker / tar distribution Issue category: Third-party dependency vulnerabilities … --- ## [Ingestion pipeline: setting @timestamp](https://discuss.elastic.co/t/ingestion-pipeline-setting-timestamp/384804)
**Author:** [@Cristina\_Marletta\_Li](https://discuss.elastic.co/u/Cristina_Marletta_Li)\ **Replies:** 3\ **Last updated:** [January 30, 2026, 4:30pm UTC](https://discuss.elastic.co/t/ingestion-pipeline-setting-timestamp/384804 "2026-01-30T16:30:20Z")
Hi, I'd like to set the @timestamp field to the value of event.ingested. It doesn't seem to be possible. My ingestion pipeline: { "processors": \[ { "set": { "ignore\_empty\_value": true, "fiel… --- ## [.NET auto-instrumentation not working](https://discuss.elastic.co/t/net-auto-instrumentation-not-working/388966)
**Author:** [@Umut](https://discuss.elastic.co/u/Umut)\ **Replies:** 1\ **Last updated:** [August 4, 2026, 2:42pm UTC](https://discuss.elastic.co/t/net-auto-instrumentation-not-working/388966 "2026-08-04T14:42:42Z")
Kibana version: v 7.16.3 Elasticsearch version: v 7.16.3 APM Server version: v 7.16.3 Original install method (e.g. download page, yum, deb, from source, etc.) and version: GitHub - elastic/apm-agent-dotnet · GitHub I… --- ## [Can i use the same fleet server policy to enroll two fleet servers for HA?](https://discuss.elastic.co/t/can-i-use-the-same-fleet-server-policy-to-enroll-two-fleet-servers-for-ha/386106)
**Author:** [@Mansi\_Sharma1](https://discuss.elastic.co/u/Mansi_Sharma1)\ **Replies:** 1\ **Last updated:** [April 30, 2026, 9:32pm UTC](https://discuss.elastic.co/t/can-i-use-the-same-fleet-server-policy-to-enroll-two-fleet-servers-for-ha/386106 "2026-04-30T21:32:43Z")
Hello, I have two VMs where i want to setup my fleet servers. VM1 as Fleet1 and VM2 as Fleet2 I have a Load Balancer for that too. i am wondering if i can use the only one fleet server policy for enrolling both of th… --- ## [Elastic Open Crawler - Recent Container CVEs](https://discuss.elastic.co/t/elastic-open-crawler-recent-container-cves/385828)
**Author:** [@alongaks](https://discuss.elastic.co/u/alongaks)\ **Replies:** 1\ **Last updated:** [April 14, 2026, 5:59pm UTC](https://discuss.elastic.co/t/elastic-open-crawler-recent-container-cves/385828 "2026-04-14T17:59:55Z")
Hello, I have been using the Elastic Open Crawler for some time now. In general, it has been a nice, functional replacement for the deprecated Enterprise Search Crawler. When my Elastic Open Crawler container(s) launch… --- ## [Elasticsearch Alert Handling fields with dots](https://discuss.elastic.co/t/elasticsearch-alert-handling-fields-with-dots/384893)
**Author:** [@Elk\_huh](https://discuss.elastic.co/u/Elk_huh)\ **Replies:** 1\ **Last updated:** [February 3, 2026, 8:05pm UTC](https://discuss.elastic.co/t/elasticsearch-alert-handling-fields-with-dots/384893 "2026-02-03T20:05:11Z")
How do I reference a field with dots/periods in it like the 2 below SNMPv2-SMI::enterprises.99999.1.2 SNMPv2-SMI::enterprises.99999.1.5 {{#context.hits}} Source IP Address: {{\_source}}{{SNMPv2-SMI::enterprises.9999… --- ## [Adding Fleet/Agent to existing ECK managed cluster](https://discuss.elastic.co/t/adding-fleet-agent-to-existing-eck-managed-cluster/383556)
**Author:** [@smashley](https://discuss.elastic.co/u/smashley)\ **Replies:** 1\ **Last updated:** [November 20, 2025, 5:45pm UTC](https://discuss.elastic.co/t/adding-fleet-agent-to-existing-eck-managed-cluster/383556 "2025-11-20T17:45:15Z")
I’m having trouble trying to add Fleet and Agent to one of our existing elastic clusters (EDIT: es, kibana, agent all 9.1.5, in ECK managed cluster in an AWS EKS cluster). I was successfully able to do this on a newly bu… --- ## [How to correctly report VM hostname when Elastic Agent runs in a Podman container](https://discuss.elastic.co/t/how-to-correctly-report-vm-hostname-when-elastic-agent-runs-in-a-podman-container/383336)
**Author:** [@vasek](https://discuss.elastic.co/u/vasek)\ **Replies:** 1\ **Last updated:** [November 12, 2025, 11:56am UTC](https://discuss.elastic.co/t/how-to-correctly-report-vm-hostname-when-elastic-agent-runs-in-a-podman-container/383336 "2025-11-12T11:56:23Z")
Hi everyone, I’m trying to collect package installation/removal events using the system\_audit.package stream on Rocky Linux 9.6. I’m running Elastic Agent 9.1.3 (elastic-agent-complete) inside a Podman container, manag… [Previous page](https://discuss.elastic.co/top.md?page=18&per_page=50) [Next page](https://discuss.elastic.co/top.md?page=20&per_page=50)