# Top **URL:** https://discuss.elastic.co/top.md?page=20 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 21 --- ## [AI chat history retention](https://discuss.elastic.co/t/ai-chat-history-retention/389614)
**Author:** [@venkatkumar229](https://discuss.elastic.co/u/venkatkumar229)\ **Replies:** 2\ **Last updated:** [August 14, 2026, 11:03am UTC](https://discuss.elastic.co/t/ai-chat-history-retention/389614 "2026-08-14T11:03:30Z")
Hi Team, Could you please confirm how long the Elastic AI Assistant / Agent Builder chat history is retained by default? Is there any default retention period (e.g., 30/60/90 days), and can this retention period be con… --- ## [Unable to view rule detail. (Unable to load rule)](https://discuss.elastic.co/t/unable-to-view-rule-detail-unable-to-load-rule/385837)
**Author:** [@Whoami1980](https://discuss.elastic.co/u/Whoami1980)\ **Replies:** 2\ **Last updated:** [April 10, 2026, 6:19am UTC](https://discuss.elastic.co/t/unable-to-view-rule-detail-unable-to-load-rule/385837 "2026-04-10T06:19:53Z")
Alerts trigger. However unable to view rule detail. (Unable to load rule) --- ## [Linux System User Elasticsearch](https://discuss.elastic.co/t/linux-system-user-elasticsearch/384456)
**Author:** [@aurora](https://discuss.elastic.co/u/aurora)\ **Replies:** 2\ **Last updated:** [January 10, 2026, 11:39am UTC](https://discuss.elastic.co/t/linux-system-user-elasticsearch/384456 "2026-01-10T11:39:05Z")
I’m pretty sure I installed v9.0.2 from a tarball on an ubuntu fork, so I didn’t automatically get a no-login user created to run a systemd unit. Are there any elasticsearch specific things I need to know about creating … --- ## [What's the expected behaviour when a document is updated and deleted in the same bulk request?](https://discuss.elastic.co/t/whats-the-expected-behaviour-when-a-document-is-updated-and-deleted-in-the-same-bulk-request/383566)
**Author:** [@js\_herbert](https://discuss.elastic.co/u/js_herbert)\ **Replies:** 2\ **Last updated:** [November 21, 2025, 5:29pm UTC](https://discuss.elastic.co/t/whats-the-expected-behaviour-when-a-document-is-updated-and-deleted-in-the-same-bulk-request/383566 "2025-11-21T17:29:26Z")
Hi all, A quick question about bulk requests. We have some code that we suspect is occasionally including an index and a delete operation for the same document in the same bulk request. The order of the operations dicta… --- ## [Elasticsearch 8.12.2 Connector Weekly scheduling never triggers sync job](https://discuss.elastic.co/t/elasticsearch-8-12-2-connector-weekly-scheduling-never-triggers-sync-job/385214)
**Author:** [@apostolos.e](https://discuss.elastic.co/u/apostolos.e)\ **Replies:** 3\ **Last updated:** [March 2, 2026, 3:40pm UTC](https://discuss.elastic.co/t/elasticsearch-8-12-2-connector-weekly-scheduling-never-triggers-sync-job/385214 "2026-03-02T15:40:44Z")
Hi all, I am using ELK 8.12.2 along with Elastic PostgreSQL connector 8.12.2. Both have been setup/self-installed on premises. When configuring the connector to get executed on a Weekly schedule, sync jobs do not get c… --- ## [You are using a deprecated config setting "truststore" set in http. Deprecated settings will continue to work, but are scheduled for removal from logstash in the future. Use \`ssl\_truststore\_path\` instead](https://discuss.elastic.co/t/you-are-using-a-deprecated-config-setting-truststore-set-in-http-deprecated-settings-will-continue-to-work-but-are-scheduled-for-removal-from-logstash-in-the-future-use-ssl-truststore-path-instead/384071)
**Author:** [@Prateek\_Garg](https://discuss.elastic.co/u/Prateek_Garg)\ **Replies:** 3\ **Last updated:** [December 16, 2025, 4:45pm UTC](https://discuss.elastic.co/t/you-are-using-a-deprecated-config-setting-truststore-set-in-http-deprecated-settings-will-continue-to-work-but-are-scheduled-for-removal-from-logstash-in-the-future-use-ssl-truststore-path-instead/384071 "2025-12-16T16:45:47Z")
You are using a deprecated config setting "truststore" set in http. Deprecated settings will continue to work, but are scheduled for removal from logstash in the future. Use ssl\_truststore\_path instead If you have any qu… --- ## [BUG: xml\_query endlessly repeats same record in Winlogbeat 9.2.7+, 9.3](https://discuss.elastic.co/t/bug-xml-query-endlessly-repeats-same-record-in-winlogbeat-9-2-7-9-3/386112)
**Author:** [@lh317](https://discuss.elastic.co/u/lh317)\ **Replies:** 1\ **Last updated:** [April 30, 2026, 3:45pm UTC](https://discuss.elastic.co/t/bug-xml-query-endlessly-repeats-same-record-in-winlogbeat-9-2-7-9-3/386112 "2026-04-30T15:45:02Z")
I've run into an issue with newer versions of Winlogbeat that attempt to perform gap detection against the Windows channels. First, create any XML query that results in gaps in the record IDs (this should hopefully work… --- ## [Error loading data on graph analyzer](https://discuss.elastic.co/t/error-loading-data-on-graph-analyzer/384534)
**Author:** [@Alaeddine\_khadraoui](https://discuss.elastic.co/u/Alaeddine_khadraoui)\ **Replies:** 1\ **Last updated:** [April 7, 2026, 10:39am UTC](https://discuss.elastic.co/t/error-loading-data-on-graph-analyzer/384534 "2026-04-07T10:39:09Z")
Dear Elastic Community, Im checking the alerts on Security on Kibana and when i try to visualise the Graph Analyzer i got Error loading data, what can be the issue, and how to troubleshoot this issue Thanks --- ## [Anonymize and/or remove this account](https://discuss.elastic.co/t/anonymize-and-or-remove-this-account/384348)
**Author:** [@anon68795679](https://discuss.elastic.co/u/anon68795679)\ **Replies:** 1\ **Last updated:** [January 3, 2026, 3:55pm UTC](https://discuss.elastic.co/t/anonymize-and-or-remove-this-account/384348 "2026-01-03T15:55:05Z")
This account is long dead, would rather not have it associated anymore. Can a mod please anonymize and/or delete it? Thanks --- ## [Java Client: How to set \_source.exclude\_vectors: false when searching an index?](https://discuss.elastic.co/t/java-client-how-to-set-source-exclude-vectors-false-when-searching-an-index/383737)
**Author:** [@baekgwa](https://discuss.elastic.co/u/baekgwa)\ **Replies:** 1\ **Last updated:** [November 27, 2025, 2:31pm UTC](https://discuss.elastic.co/t/java-client-how-to-set-source-exclude-vectors-false-when-searching-an-index/383737 "2025-11-27T14:31:41Z")
Hello everyone, I am currently working with Elasticsearch server version 9.2.0. I would like to retrieve vector fields in search responses by specifying: "\_source": { "exclude\_vectors": false } However, when using… --- ## [Kibana Cross-Site Scripting Vulnerability - Unencoded Character in JSON Response](https://discuss.elastic.co/t/kibana-cross-site-scripting-vulnerability-unencoded-character-in-json-response/385041)
**Author:** [@Rakesh\_Bhalani](https://discuss.elastic.co/u/Rakesh_Bhalani)\ **Replies:** 1\ **Last updated:** [February 13, 2026, 1:42pm UTC](https://discuss.elastic.co/t/kibana-cross-site-scripting-vulnerability-unencoded-character-in-json-response/385041 "2026-02-13T13:42:59Z")
We have on-prime installation of kibana-8.14.0, It is being analyzed by the vulnerability detection tool Qualys, tool is reporting JSON response of following API as vulnerable to Cross-Site-Scripting Kibana API call ma… --- ## [A2A server authentication](https://discuss.elastic.co/t/a2a-server-authentication/390030)
**Author:** [@venkatkumar229](https://discuss.elastic.co/u/venkatkumar229)\ **Replies:** 1\ **Last updated:** [September 2, 2026, 5:03pm UTC](https://discuss.elastic.co/t/a2a-server-authentication/390030 "2026-09-02T17:03:35Z")
Hi Team, We have created a Custom AI Agent in Elasticsearch and are planning to access it from an external application through the A2A (Agent-to-Agent) Server. Currently, we understand that authentication to the A2A Se… --- ## [One Kibana for three clusters](https://discuss.elastic.co/t/one-kibana-for-three-clusters/387479)
**Author:** [@kkumar123](https://discuss.elastic.co/u/kkumar123)\ **Replies:** 1\ **Last updated:** [July 2, 2026, 4:23pm UTC](https://discuss.elastic.co/t/one-kibana-for-three-clusters/387479 "2026-07-02T16:23:31Z")
Based on the discussion threads I've reviewed and my understanding, Kibana can connect to only one Elasticsearch cluster. Even if Cross-Cluster Search (CCS) and Cross-Cluster Replication (CCR) are configured, Kibana stil… --- ## [Elastic Agent on Mac in failed state](https://discuss.elastic.co/t/elastic-agent-on-mac-in-failed-state/385255)
**Author:** [@HaydenB0101](https://discuss.elastic.co/u/HaydenB0101)\ **Replies:** 1\ **Last updated:** [February 26, 2026, 6:17pm UTC](https://discuss.elastic.co/t/elastic-agent-on-mac-in-failed-state/385255 "2026-02-26T18:17:22Z")
Hello, I am using the Custom macOS Unified Logs integration with elastic 8.18.8 in order to get logs from my mac device, and I getting errors from the agent elastic-agent status fleet status: (HEALTHY) Connected elas… --- ## [Winlogbeat 9.2.1 Fails to Ingest Specific Windows Application Event (Winlogon Event ID 6000)](https://discuss.elastic.co/t/winlogbeat-9-2-1-fails-to-ingest-specific-windows-application-event-winlogon-event-id-6000/383593)
**Author:** [@banksmt](https://discuss.elastic.co/u/banksmt)\ **Replies:** 1\ **Last updated:** [November 22, 2025, 8:37am UTC](https://discuss.elastic.co/t/winlogbeat-9-2-1-fails-to-ingest-specific-windows-application-event-winlogon-event-id-6000/383593 "2025-11-22T08:37:15Z")
We are experiencing an issue where Winlogbeat successfully ingests all Windows log channels (Application/System/Security/Sysmon) except for one very specific event type: Microsoft-Windows-Winlogon — Event ID 6000 ("The … --- ## [How to use Universal Profiling to minitor JBoss](https://discuss.elastic.co/t/how-to-use-universal-profiling-to-minitor-jboss/383395)
**Author:** [@edgarmat1964](https://discuss.elastic.co/u/edgarmat1964)\ **Replies:** 1\ **Last updated:** [November 12, 2025, 2:44pm UTC](https://discuss.elastic.co/t/how-to-use-universal-profiling-to-minitor-jboss/383395 "2025-11-12T14:44:57Z")
LS, at the moment we are using an additional javaagent argument on JBoss’ commandline to monitor it using apm. Which works but has (at least) one downside: to roll out a new version of the apm agent you have to restart … --- ## [Winlogbeat Kafka output not reading SSL certs with "wrong" line ends](https://discuss.elastic.co/t/winlogbeat-kafka-output-not-reading-ssl-certs-with-wrong-line-ends/385257)
**Author:** [@ciranor](https://discuss.elastic.co/u/ciranor)\ **Replies:** 3\ **Last updated:** [February 27, 2026, 10:41am UTC](https://discuss.elastic.co/t/winlogbeat-kafka-output-not-reading-ssl-certs-with-wrong-line-ends/385257 "2026-02-27T10:41:24Z")
I’m setting up Winlogbeat to output to Kafka with SSL certificates used to authenticate. The certificates will be generated, rotated and supplied automatically by another system. But when trying to configure it, winlogbe… --- ## [BUG: Ignore unmapped is not working in geo polygon query (ES 8.15.5)](https://discuss.elastic.co/t/bug-ignore-unmapped-is-not-working-in-geo-polygon-query-es-8-15-5/382878)
**Author:** [@ma\_br](https://discuss.elastic.co/u/ma_br)\ **Replies:** 3\ **Last updated:** [October 22, 2025, 3:27pm UTC](https://discuss.elastic.co/t/bug-ignore-unmapped-is-not-working-in-geo-polygon-query-es-8-15-5/382878 "2025-10-22T15:27:08Z")
my goal is to replace some deprecated geo\_polygon queries with geo\_shape queries. And because some of the geo shape can get big, i want to use indexed shapes old query: GET /entity\_\*/\_search { "query": { "nested"… --- ## [ES|QL LOOKUP JOIN between fields containing a list of values](https://discuss.elastic.co/t/es-ql-lookup-join-between-fields-containing-a-list-of-values/385960)
**Author:** [@smyttie](https://discuss.elastic.co/u/smyttie)\ **Replies:** 2\ **Last updated:** [April 21, 2026, 4:58am UTC](https://discuss.elastic.co/t/es-ql-lookup-join-between-fields-containing-a-list-of-values/385960 "2026-04-21T04:58:54Z")
Hi all, creating a LOOKUP JOIN query is working fine, but I am not getting results when I have to do it between 2 fields containing a list of values. For example : main index field = "sizes" : \["S", "M"\] lookup index… --- ## [Filebeat filestream input has inconsistent tag output when using "take\_over"](https://discuss.elastic.co/t/filebeat-filestream-input-has-inconsistent-tag-output-when-using-take-over/383900)
**Author:** [@mike.guthrie](https://discuss.elastic.co/u/mike.guthrie)\ **Replies:** 2\ **Last updated:** [December 9, 2025, 6:17pm UTC](https://discuss.elastic.co/t/filebeat-filestream-input-has-inconsistent-tag-output-when-using-take-over/383900 "2025-12-09T18:17:36Z")
We recently upgraded from beats 7.x and moved to beats 8.x. When we moved from input type of log to filestream, all of our logstash routing broke because the tags are inconsistent in the events. We are using the take\_ove… --- ## [Windows Event Logs Showing as Filebeat — Expected Winlogbeat](https://discuss.elastic.co/t/windows-event-logs-showing-as-filebeat-expected-winlogbeat/383746)
**Author:** [@shalev\_aviram](https://discuss.elastic.co/u/shalev_aviram)\ **Replies:** 2\ **Last updated:** [November 30, 2025, 3:40pm UTC](https://discuss.elastic.co/t/windows-event-logs-showing-as-filebeat-expected-winlogbeat/383746 "2025-11-30T15:40:20Z")
Hi everyone, new here (: I have a question regarding Windows logs collected via Elastic Agent + Fleet. In some integrations (like windows - sysmon..) where I expect to see agent.type = winlogbeat, I instead see agent.t… --- ## [Rule Scope field does not appear while editing Custom threshold rule](https://discuss.elastic.co/t/rule-scope-field-does-not-appear-while-editing-custom-threshold-rule/382864)
**Author:** [@marcelpineda](https://discuss.elastic.co/u/marcelpineda)\ **Replies:** 2\ **Last updated:** [October 27, 2025, 5:26pm UTC](https://discuss.elastic.co/t/rule-scope-field-does-not-appear-while-editing-custom-threshold-rule/382864 "2025-10-27T17:26:06Z")
I have an Elastic Instance running v8.18.0. When I go to Observability \> Alerts, then click ‘Manage Rules’ \> Create Rule and start creating a Custom Threshold rule, I see this option: After saving the rule and editin… --- ## [Ingesting Logs Without Integration Approach (SIEM)](https://discuss.elastic.co/t/ingesting-logs-without-integration-approach-siem/387666)
**Author:** [@jatin3101](https://discuss.elastic.co/u/jatin3101)\ **Replies:** 1\ **Last updated:** [July 7, 2026, 2:14pm UTC](https://discuss.elastic.co/t/ingesting-logs-without-integration-approach-siem/387666 "2026-07-07T14:14:35Z")
I have been taksed to ingest logs of APPS/WEBSITES which are hosted on cloud like SAP S/4 , paypac , tally etc etc (30+apps - mainly proprietary/internal apps like ) Q1. what approach should i be using each time i get … --- ## [How do you calculate the average document size in streams?](https://discuss.elastic.co/t/how-do-you-calculate-the-average-document-size-in-streams/385117)
**Author:** [@YousefNein](https://discuss.elastic.co/u/YousefNein)\ **Replies:** 1\ **Last updated:** [February 19, 2026, 4:08pm UTC](https://discuss.elastic.co/t/how-do-you-calculate-the-average-document-size-in-streams/385117 "2026-02-19T16:08:24Z")
Streams is a really great feature that you have added, which was really needed. Now for the question. As the title suggests. How does the daily average get calculated? I tried calculating the average document size by… --- ## [Testing APIs and Screenshots?](https://discuss.elastic.co/t/testing-apis-and-screenshots/383791)
**Author:** [@Peter\_Lambrechtsen](https://discuss.elastic.co/u/Peter_Lambrechtsen)\ **Replies:** 1\ **Last updated:** [December 14, 2025, 8:43am UTC](https://discuss.elastic.co/t/testing-apis-and-screenshots/383791 "2025-12-14T08:43:14Z")
I have seen various posts about testing APIs using a custom built nodejs script and not being able to get screenshots. Following the Synthetics and Playwright documentation this is the sort of thing I would like to do: i… --- ## [How to install the repository plug-in in a rolling upgrade to ensure that business reading and writing are not affected](https://discuss.elastic.co/t/how-to-install-the-repository-plug-in-in-a-rolling-upgrade-to-ensure-that-business-reading-and-writing-are-not-affected/385924)
**Author:** [@mloine](https://discuss.elastic.co/u/mloine)\ **Replies:** 4\ **Last updated:** [April 20, 2026, 9:43am UTC](https://discuss.elastic.co/t/how-to-install-the-repository-plug-in-in-a-rolling-upgrade-to-ensure-that-business-reading-and-writing-are-not-affected/385924 "2026-04-20T09:43:40Z")
Background: Because the business scenario does not allow downtime maintenance and there will be a large number of read and write operations during the period, only rolling installation of plug-ins can be considered The … --- ## [Search url Saved Objects by Title](https://discuss.elastic.co/t/search-url-saved-objects-by-title/385701)
**Author:** [@mikewillis](https://discuss.elastic.co/u/mikewillis)\ **Replies:** 4\ **Last updated:** [April 7, 2026, 3:35pm UTC](https://discuss.elastic.co/t/search-url-saved-objects-by-title/385701 "2026-04-07T15:35:43Z")
Kibana 7.17.28 (yes, I know.) In the Stack Management \> Saved Objects section there is a Search field. I want to search for objects of type url with a given Title, or even a given id attribute which I've extracted from … --- ## [Does doing a POST query via the devtools alter any elastic data or database?](https://discuss.elastic.co/t/does-doing-a-post-query-via-the-devtools-alter-any-elastic-data-or-database/385936)
**Author:** [@Whoami1980](https://discuss.elastic.co/u/Whoami1980)\ **Replies:** 2\ **Last updated:** [April 28, 2026, 4:07am UTC](https://discuss.elastic.co/t/does-doing-a-post-query-via-the-devtools-alter-any-elastic-data-or-database/385936 "2026-04-28T04:07:00Z")
Its been brought to my attention that my post query is updating the database. I would like to seek clarification that such queries like below are purely querying instead of altering or updating any data in the elastics e… --- ## [Read latest logs from a file](https://discuss.elastic.co/t/read-latest-logs-from-a-file/384957)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 1\ **Last updated:** [February 8, 2026, 10:06am UTC](https://discuss.elastic.co/t/read-latest-logs-from-a-file/384957 "2026-02-08T10:06:09Z")
Hello Folks, I have one log file and it is containing all logs since November 2025 to till now. For doing the parsing of logs i’ve copy-paste sample logs to test.log file and it worked. My question is How to read last… --- ## [Is a Webhook Connector possible to use for Elastic Assistant](https://discuss.elastic.co/t/is-a-webhook-connector-possible-to-use-for-elastic-assistant/384428)
**Author:** [@robert.bonagura](https://discuss.elastic.co/u/robert.bonagura)\ **Replies:** 1\ **Last updated:** [January 7, 2026, 10:44pm UTC](https://discuss.elastic.co/t/is-a-webhook-connector-possible-to-use-for-elastic-assistant/384428 "2026-01-07T22:44:25Z")
My enterprise does not hand out direct access to LLM API endpoints, all LLM API access is proxied through an internal tool to govern and manage LLM API calls at scale. That being said, if I do not have direct access to … --- ## [Missing metrics documentation](https://discuss.elastic.co/t/missing-metrics-documentation/383047)
**Author:** [@kim.ae](https://discuss.elastic.co/u/kim.ae)\ **Replies:** 1\ **Last updated:** [November 5, 2025, 4:57pm UTC](https://discuss.elastic.co/t/missing-metrics-documentation/383047 "2025-11-05T16:57:10Z")
I am trying to evaluate performance of filebeat instalation in a K8S, for that I was able to export filebeat metrics to prometheus. I was unable to find any comprehensive documentation regarding the metrics, so I am not… --- ## [AI Agent feedback](https://discuss.elastic.co/t/ai-agent-feedback/385435)
**Author:** [@juancamiloll](https://discuss.elastic.co/u/juancamiloll)\ **Replies:** 0\ **Last updated:** [March 12, 2026, 8:58pm UTC](https://discuss.elastic.co/t/ai-agent-feedback/385435 "2026-03-12T20:58:01Z")
Hello, I would like to share some feedback and also ask for guidance regarding the AI Agent feature in Elastic 9.x. First, I want to clarify that this is not intended as criticism. I’m sharing my experience after upgra… --- ## [Logstash ILM rollover alias unexpectedly treated as Data Stream after backing index deletion](https://discuss.elastic.co/t/logstash-ilm-rollover-alias-unexpectedly-treated-as-data-stream-after-backing-index-deletion/389295)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 2\ **Last updated:** [August 8, 2026, 7:21pm UTC](https://discuss.elastic.co/t/logstash-ilm-rollover-alias-unexpectedly-treated-as-data-stream-after-backing-index-deletion/389295 "2026-08-08T19:21:42Z")
Hello Folks, I am using Elastic Cloud v8.16. I am sending some data to Elasticsearch using Logstash.Below is the logstash configuration (output to elastic) elasticsearch { hosts =\> '${ELASTIC\_URL}' user =\> "${ELASTIC… --- ## [How to hide KQL Query Bar and Filter Bar while keeping the Global Time Filter?](https://discuss.elastic.co/t/how-to-hide-kql-query-bar-and-filter-bar-while-keeping-the-global-time-filter/385658)
**Author:** [@Vignesh2](https://discuss.elastic.co/u/Vignesh2)\ **Replies:** 2\ **Last updated:** [March 30, 2026, 12:01pm UTC](https://discuss.elastic.co/t/how-to-hide-kql-query-bar-and-filter-bar-while-keeping-the-global-time-filter/385658 "2026-03-30T12:01:25Z")
Hi everyone, I am building a custom dashboard experience for customers using the new Controls (Input Controls). I want my custom controls to be the primary way users interact with the data. To keep the UI clean, I need… --- ## [Should Master nodes only receive the traffic in an ES cluster?](https://discuss.elastic.co/t/should-master-nodes-only-receive-the-traffic-in-an-es-cluster/388916)
**Author:** [@Aditya\_Sugandhi](https://discuss.elastic.co/u/Aditya_Sugandhi)\ **Replies:** 3\ **Last updated:** [July 30, 2026, 9:19pm UTC](https://discuss.elastic.co/t/should-master-nodes-only-receive-the-traffic-in-an-es-cluster/388916 "2026-07-30T21:19:01Z")
Currently, I have 16 nodes (5 master + 11 data nodes) in my cluster and via Haproxy I am sending the requests to only the master nodes. Recently, due to some issue one of the master node was flapping and latency spiked … --- ## [Elasticsearch RAG - AI Playground - fix needed](https://discuss.elastic.co/t/elasticsearch-rag-ai-playground-fix-needed/384671)
**Author:** [@Musab\_Dogan](https://discuss.elastic.co/u/Musab_Dogan)\ **Replies:** 0\ **Last updated:** [January 21, 2026, 12:18pm UTC](https://discuss.elastic.co/t/elasticsearch-rag-ai-playground-fix-needed/384671 "2026-01-21T12:18:46Z")
Hello guys, Thanks for sharing this amazing Elasticsearch RAG playground. It’s well prepared and easy to follow the instructions. There is a small bug in the last step, Export code =\> Install code dependencies part. The… --- ## [Recommended Resources](https://discuss.elastic.co/t/recommended-resources/389231)
**Author:** [@Rahul\_Kumar8](https://discuss.elastic.co/u/Rahul_Kumar8)\ **Replies:** 1\ **Last updated:** [August 18, 2026, 7:45am UTC](https://discuss.elastic.co/t/recommended-resources/389231 "2026-08-18T07:45:29Z")
I could not find any public documentation stating recommended resources for my kibana, elastic and logstash. What would the resource guide be if i had 100GB/day logs ? --- ## [Elastic Agent 9.2.7 Error: failed to execute enroll command](https://discuss.elastic.co/t/elastic-agent-9-2-7-error-failed-to-execute-enroll-command/385818)
**Author:** [@Faza\_Syarof](https://discuss.elastic.co/u/Faza_Syarof)\ **Replies:** 1\ **Last updated:** [April 9, 2026, 6:35am UTC](https://discuss.elastic.co/t/elastic-agent-9-2-7-error-failed-to-execute-enroll-command/385818 "2026-04-09T06:35:28Z")
Hi, Please help me, I try to reinstall fleet server but got error I already uninstall with command : elastic-agent uninstall and remove folder under /opt/Elastic but still got error below \[ \] Failed to Enroll \[0s\]… --- ## [SIEM reports](https://discuss.elastic.co/t/siem-reports/384985)
**Author:** [@arcsons](https://discuss.elastic.co/u/arcsons)\ **Replies:** 1\ **Last updated:** [February 10, 2026, 9:21pm UTC](https://discuss.elastic.co/t/siem-reports/384985 "2026-02-10T21:21:08Z")
Hi all :slight\_smile: I don’t see any existing siem reports, and currently I have to manually export dashboards, including images and text. Is there a solution for automating this, or am I missing something? Thanks in … --- ## [Corrupted S3 Repository: 1.3M Metadata lines & snapshot\_missing\_exception (Cluster size: 6.5 TB)](https://discuss.elastic.co/t/corrupted-s3-repository-1-3m-metadata-lines-snapshot-missing-exception-cluster-size-6-5-tb/384970)
**Author:** [@Disha\_Vala](https://discuss.elastic.co/u/Disha_Vala)\ **Replies:** 1\ **Last updated:** [February 9, 2026, 12:31pm UTC](https://discuss.elastic.co/t/corrupted-s3-repository-1-3m-metadata-lines-snapshot-missing-exception-cluster-size-6-5-tb/384970 "2026-02-09T12:31:41Z")
Hi Elastic Team, I am facing a repository corruption issue on Elasticsearch 8.5.3 and would appreciate guidance on how to perform a "surgical" repair of our snapshot metadata. The Situation: Cluster Scale: Our live cl… --- ## [Advices & opinions on my Wazuh-Elastic Stack SIEM](https://discuss.elastic.co/t/advices-opinions-on-my-wazuh-elastic-stack-siem/384567)
**Author:** [@Ken\_1](https://discuss.elastic.co/u/Ken_1)\ **Replies:** 0\ **Last updated:** [January 15, 2026, 9:18pm UTC](https://discuss.elastic.co/t/advices-opinions-on-my-wazuh-elastic-stack-siem/384567 "2026-01-15T21:18:30Z")
Hello everyone, I want to build an open-source SIEM solution using Wazuh and the Elastic Stack to monitor roughly 300 hosts (Linux servers, firewalls, switches, Windows servers, Linux hosts, and Windows hosts). I’d appr… --- ## [Understanding how Elasticsearch segments, merges, and compacts its vector indexes](https://discuss.elastic.co/t/understanding-how-elasticsearch-segments-merges-and-compacts-its-vector-indexes/383796)
**Author:** [@sfmqrb](https://discuss.elastic.co/u/sfmqrb)\ **Replies:** 0\ **Last updated:** [December 2, 2025, 12:30am UTC](https://discuss.elastic.co/t/understanding-how-elasticsearch-segments-merges-and-compacts-its-vector-indexes/383796 "2025-12-02T00:30:01Z")
In Elasticsearch’s vector indexing pipeline, how exactly do segmenting and segment compaction work? Specifically, what compaction policy does Elasticsearch follow for segments and their vector indexes, and during compact… --- ## [Set Custom Agent as Default in Agent Selection](https://discuss.elastic.co/t/set-custom-agent-as-default-in-agent-selection/389809)
**Author:** [@venkatkumar229](https://discuss.elastic.co/u/venkatkumar229)\ **Replies:** 1\ **Last updated:** [August 20, 2026, 8:42pm UTC](https://discuss.elastic.co/t/set-custom-agent-as-default-in-agent-selection/389809 "2026-08-20T20:42:10Z")
Hi Elastic Team, We have created a custom agent using Elastic Agent Builder. Currently, when a user opens the Agent Builder chat, the Agent Selection is automatically set to “Elastic AI Agent”. Our requirement is to m… --- ## [Inference Endpoint Conflict - Multi Agent with LangGraph lab](https://discuss.elastic.co/t/inference-endpoint-conflict-multi-agent-with-langgraph-lab/383532)
**Author:** [@Steve\_McCurry](https://discuss.elastic.co/u/Steve_McCurry)\ **Replies:** 1\ **Last updated:** [November 19, 2025, 12:41pm UTC](https://discuss.elastic.co/t/inference-endpoint-conflict-multi-agent-with-langgraph-lab/383532 "2025-11-19T12:41:10Z")
I’m trying to follow the recent lab for Multi agent with Langgraph. I’m having many problems but the one I’m stuck on currently is an apparent conflict between the inference endpoint which seems to be created both when d… --- ## [Add the Valkey keys\_with\_volatile\_items keyspace metric](https://discuss.elastic.co/t/add-the-valkey-keys-with-volatile-items-keyspace-metric/389280)
**Author:** [@aglowienka](https://discuss.elastic.co/u/aglowienka)\ **Replies:** 2\ **Last updated:** [August 6, 2026, 3:05pm UTC](https://discuss.elastic.co/t/add-the-valkey-keys-with-volatile-items-keyspace-metric/389280 "2026-08-06T15:05:17Z")
Valkey ≥ 9.0 reports a per-database keys\_with\_volatile\_items counter in INFO keyspace that Metricbeat's redis.keyspace metricset does not collect. Please add it as redis.keyspace.keys\_with\_volatile\_items (long), alongs… --- ## [Timezone in watcher](https://discuss.elastic.co/t/timezone-in-watcher/387430)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 3\ **Last updated:** [July 1, 2026, 1:40pm UTC](https://discuss.elastic.co/t/timezone-in-watcher/387430 "2026-07-01T13:40:47Z")
I have created a watcher to send business dashboards to clients . Elasticsearch watcher supports UTC and the requirement is reports should receive at 8 am first day of every month. I forgot about UTC when creating below … --- ## [Cluster logs for errors in GUI (via filter) if not whatst the specific index to search](https://discuss.elastic.co/t/cluster-logs-for-errors-in-gui-via-filter-if-not-whatst-the-specific-index-to-search/385738)
**Author:** [@Whoami1980](https://discuss.elastic.co/u/Whoami1980)\ **Replies:** 3\ **Last updated:** [April 7, 2026, 10:46am UTC](https://discuss.elastic.co/t/cluster-logs-for-errors-in-gui-via-filter-if-not-whatst-the-specific-index-to-search/385738 "2026-04-07T10:46:11Z")
This morning we were having slowness on our web console. From the cluster overview page. There were many high CPU for nodes. https://XXXXXXXXX.aws.found.io/app/monitoring#/overview? When we zoom it we found that they … --- ## [License inquiry regarding CSPM](https://discuss.elastic.co/t/license-inquiry-regarding-cspm/383674)
**Author:** [@YousefNein](https://discuss.elastic.co/u/YousefNein)\ **Replies:** 3\ **Last updated:** [November 26, 2025, 4:56pm UTC](https://discuss.elastic.co/t/license-inquiry-regarding-cspm/383674 "2025-11-26T16:56:19Z")
I wanted to make sure if it was applicable or not to purchase individual features instead of the whole license. I was interested in trying CSPM integration only, without purchasing the whole Enterprise license. Thank yo… --- ## [Logstash packages missing in YUM repository](https://discuss.elastic.co/t/logstash-packages-missing-in-yum-repository/391010)
**Author:** [@Borut\_Lape](https://discuss.elastic.co/u/Borut_Lape)\ **Replies:** 9\ **Last updated:** [October 17, 2026, 7:04am UTC](https://discuss.elastic.co/t/logstash-packages-missing-in-yum-repository/391010 "2026-10-17T07:04:38Z")
Hi, last week we have installed logstash on 2 servers, following the official instructions on Installing Logstash | Logstash. In the last 2 days we are trying to perform the same but the logstash package is missing in … --- ## [Elasticsearch Search Results on My Website Become Increasingly Slow After the Index Runs for Several Days](https://discuss.elastic.co/t/elasticsearch-search-results-on-my-website-become-increasingly-slow-after-the-index-runs-for-several-days/389392)
**Author:** [@joeroot](https://discuss.elastic.co/u/joeroot)\ **Replies:** 1\ **Last updated:** [August 11, 2026, 7:53am UTC](https://discuss.elastic.co/t/elasticsearch-search-results-on-my-website-become-increasingly-slow-after-the-index-runs-for-several-days/389392 "2026-08-11T07:53:21Z")
Hello Elastic Community, I am currently facing one persistent performance issue with the search functionality on my website, which uses Elasticsearch to index and retrieve website content. The core problem is that searc… [Previous page](https://discuss.elastic.co/top.md?page=19&per_page=50) [Next page](https://discuss.elastic.co/top.md?page=21&per_page=50)