# Top **URL:** https://discuss.elastic.co/top.md?page=22 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 23 --- ## [Is it useless to have a hot, warm, and cold nodes running on the same server?](https://discuss.elastic.co/t/is-it-useless-to-have-a-hot-warm-and-cold-nodes-running-on-the-same-server/390977)
**Author:** [@YousefNein](https://discuss.elastic.co/u/YousefNein)\ **Replies:** 1\ **Last updated:** [October 13, 2026, 2:54pm UTC](https://discuss.elastic.co/t/is-it-useless-to-have-a-hot-warm-and-cold-nodes-running-on-the-same-server/390977 "2026-10-13T14:54:10Z")
Like the title suggests. I saw that in the ILM policy, it says that it's recommended to move the data to warm nodes. So I made a Docker container dedicated to a warm node to move my data into, but the hot data and th… --- ## [Field formatters in ES|QL table panels](https://discuss.elastic.co/t/field-formatters-in-es-ql-table-panels/390418)
**Author:** [@tallakh](https://discuss.elastic.co/u/tallakh)\ **Replies:** 1\ **Last updated:** [September 23, 2026, 8:07am UTC](https://discuss.elastic.co/t/field-formatters-in-es-ql-table-panels/390418 "2026-09-23T08:07:19Z")
Hi! We have started to use ES|QL a lot in our Kibana dashboards, and I love the flexibility it brings! One of the few missing features compared to Lens table panels is to set formatting on a text/keyword field. F ex a l… --- ## [Help in selecting the right Stack Monitoring Mode - Node vs Cluster?](https://discuss.elastic.co/t/help-in-selecting-the-right-stack-monitoring-mode-node-vs-cluster/386238)
**Author:** [@RalphDibney](https://discuss.elastic.co/u/RalphDibney)\ **Replies:** 1\ **Last updated:** [May 11, 2026, 1:23pm UTC](https://discuss.elastic.co/t/help-in-selecting-the-right-stack-monitoring-mode-node-vs-cluster/386238 "2026-05-11T13:23:32Z")
Hey everyone, we are still on version 8.x, since we still have selfmonitoring enabled, but we want to move to version 9 as soon as possible. For now we want to switch to agent based monitoring (AutoOps is a possibility… --- ## [Qualys VMDR Integration Missing Data](https://discuss.elastic.co/t/qualys-vmdr-integration-missing-data/385834)
**Author:** [@difi80211g](https://discuss.elastic.co/u/difi80211g)\ **Replies:** 1\ **Last updated:** [April 10, 2026, 5:49am UTC](https://discuss.elastic.co/t/qualys-vmdr-integration-missing-data/385834 "2026-04-10T05:49:10Z")
I have setup the Qualys VMDR integration and all checks seem to be fine, however i am not getting any asset or KB data, but i am getting the User activity logs. I verified permissions in qualys and api logs in qualys bu… --- ## [Is Elastic Endpoint immune to Zombie ZIP evasion?](https://discuss.elastic.co/t/is-elastic-endpoint-immune-to-zombie-zip-evasion/385438)
**Author:** [@Kenny-Yeh](https://discuss.elastic.co/u/Kenny-Yeh)\ **Replies:** 1\ **Last updated:** [March 16, 2026, 9:55am UTC](https://discuss.elastic.co/t/is-elastic-endpoint-immune-to-zombie-zip-evasion/385438 "2026-03-16T09:55:35Z")
“Zombie ZIP“ is a newly disclosed malware evasion technique where attackers manipulate ZIP archive headers to bypass antivirus and EDR scanning. Based on the test by the researcher, it works against most AV engines on Vi… --- ## [Migrating from beats to the agent - best approach?](https://discuss.elastic.co/t/migrating-from-beats-to-the-agent-best-approach/383822)
**Author:** [@rex656](https://discuss.elastic.co/u/rex656)\ **Replies:** 1\ **Last updated:** [December 2, 2025, 8:38pm UTC](https://discuss.elastic.co/t/migrating-from-beats-to-the-agent-best-approach/383822 "2025-12-02T20:38:27Z")
Greetings! I am somewhat new to Elasticsearch and have been tasked with migrating from beats to the Elastic agent. We just finished migrating to Elastic cloud so this is the next thing we want to tackle to modernize. Fo… --- ## [Looking for Zentity Replacement](https://discuss.elastic.co/t/looking-for-zentity-replacement/385510)
**Author:** [@Kavya\_2708](https://discuss.elastic.co/u/Kavya_2708)\ **Replies:** 0\ **Last updated:** [March 18, 2026, 8:19pm UTC](https://discuss.elastic.co/t/looking-for-zentity-replacement/385510 "2026-03-18T20:19:20Z")
We are currently on Elastic Search - Kibana version 8.17.4 and Zentity version 1.8.3. At present, we are facing security findings related to Kibana, and we are unable to upgrade it due to version compatibility constrai… --- ## [Inquiry About Quarantined Kibana Task Manager Index File](https://discuss.elastic.co/t/inquiry-about-quarantined-kibana-task-manager-index-file/388947)
**Author:** [@Frances\_Chu](https://discuss.elastic.co/u/Frances_Chu)\ **Replies:** 1\ **Last updated:** [August 3, 2026, 9:04am UTC](https://discuss.elastic.co/t/inquiry-about-quarantined-kibana-task-manager-index-file/388947 "2026-08-03T09:04:25Z")
We would like to raise a case regarding a quarantined file related to one of our Elasticsearch/Kibana indices. While checking the index UUID, we found that it appears to be related to the following Kibana index ".kiban… --- ## [How to rename missing values in visualizations in kibana 9.2](https://discuss.elastic.co/t/how-to-rename-missing-values-in-visualizations-in-kibana-9-2/386524)
**Author:** [@Ranakel](https://discuss.elastic.co/u/Ranakel)\ **Replies:** 1\ **Last updated:** [May 28, 2026, 3:03am UTC](https://discuss.elastic.co/t/how-to-rename-missing-values-in-visualizations-in-kibana-9-2/386524 "2026-05-28T03:03:11Z")
Hi all, In kibana 8.17 , I was used to renamimg missing values I wanted to show on charts like in this screen shot. With kibana lens in 9.2 , I can't find the equivalent . I only found how to show missing valiues… --- ## [Indicator Match rule not generating alerts (Basic license, self-managed 9.3.0)](https://discuss.elastic.co/t/indicator-match-rule-not-generating-alerts-basic-license-self-managed-9-3-0/385726)
**Author:** [@arav](https://discuss.elastic.co/u/arav)\ **Replies:** 1\ **Last updated:** [April 16, 2026, 7:27pm UTC](https://discuss.elastic.co/t/indicator-match-rule-not-generating-alerts-basic-license-self-managed-9-3-0/385726 "2026-04-16T19:27:09Z")
Hi all, I am running a self-managed Elastic Stack (v9.3.0) with a Basic license. I have ingested threat intelligence data from MISP using the official integration, and I am trying to create an Indicator Match rule in E… --- ## [Elastic Agent metric endpoint autodiscovery in Kubernetes](https://discuss.elastic.co/t/elastic-agent-metric-endpoint-autodiscovery-in-kubernetes/383640)
**Author:** [@ilyazh](https://discuss.elastic.co/u/ilyazh)\ **Replies:** 1\ **Last updated:** [November 27, 2025, 10:09am UTC](https://discuss.elastic.co/t/elastic-agent-metric-endpoint-autodiscovery-in-kubernetes/383640 "2025-11-27T10:09:45Z")
Hello everyone, we are looking into monitoring Kubernetes Clusters with Elastic Agents using the Kubernetes Integration. We are using Fleet to manage our Elastic Agents. We are able to collect metrics from kubelet api, … --- ## [Best practices for dashboards and rules](https://discuss.elastic.co/t/best-practices-for-dashboards-and-rules/386316)
**Author:** [@PatreKerier](https://discuss.elastic.co/u/PatreKerier)\ **Replies:** 0\ **Last updated:** [May 13, 2026, 6:42am UTC](https://discuss.elastic.co/t/best-practices-for-dashboards-and-rules/386316 "2026-05-13T06:42:46Z")
Good afternoon, colleagues! If it's not too much trouble, could you please share your ready-made correlation rules and dashboards that are really useful to you in practice. According to Best Practice. I will be very gra… --- ## [Is APM required for Elasticsearch 8.19.8?](https://discuss.elastic.co/t/is-apm-required-for-elasticsearch-8-19-8/385522)
**Author:** [@winter\_crescents](https://discuss.elastic.co/u/winter_crescents)\ **Replies:** 3\ **Last updated:** [March 20, 2026, 9:59am UTC](https://discuss.elastic.co/t/is-apm-required-for-elasticsearch-8-19-8/385522 "2026-03-20T09:59:36Z")
I am trying to reduce the number of modules to the minimum number required. However, I find that when apm module is being removed, I get an error that says “ERROR: Expected to find \[apm\] module” and this got me confused,… --- ## [ECE 4.0.3 installation fails on RHEL 9.7 with Podman 4.x / 5.x - compatibility error](https://discuss.elastic.co/t/ece-4-0-3-installation-fails-on-rhel-9-7-with-podman-4-x-5-x-compatibility-error/384672)
**Author:** [@Abdul\_Haseeb\_Q](https://discuss.elastic.co/u/Abdul_Haseeb_Q)\ **Replies:** 0\ **Last updated:** [January 21, 2026, 1:28pm UTC](https://discuss.elastic.co/t/ece-4-0-3-installation-fails-on-rhel-9-7-with-podman-4-x-5-x-compatibility-error/384672 "2026-01-21T13:28:12Z")
Hey Elastic folks, I need help deploying Elastic Cloud Enterprise (ECE) 4.0.3 on a local VM, but the installation consistently fails due to a compatibility error. Environment – OS: RHEL 9.7 (VM) – Container Runtime: … --- ## [GC occurred in the Elasticsearch cluster](https://discuss.elastic.co/t/gc-occurred-in-the-elasticsearch-cluster/390606)
**Author:** [@Siva\_Karan](https://discuss.elastic.co/u/Siva_Karan)\ **Replies:** 1\ **Last updated:** [September 28, 2026, 12:00pm UTC](https://discuss.elastic.co/t/gc-occurred-in-the-elasticsearch-cluster/390606 "2026-09-28T12:00:23Z")
Hi Team, \[2026-09-22T22:20:13,448\]\[WARN \]\[o.e.m.j.JvmGcMonitorService\] \[node2\] \[gc\]\[435482\] overhead, spent \[4s\] collecting in the last \[4.6s\]. we are faced the GC issue with low heap usage and also we are unable to ac… --- ## [Haproxy integration: failed fetching haproxy info: not supported](https://discuss.elastic.co/t/haproxy-integration-failed-fetching-haproxy-info-not-supported/386841)
**Author:** [@Florian\_Heigl](https://discuss.elastic.co/u/Florian_Heigl)\ **Replies:** 1\ **Last updated:** [June 12, 2026, 4:45pm UTC](https://discuss.elastic.co/t/haproxy-integration-failed-fetching-haproxy-info-not-supported/386841 "2026-06-12T16:45:09Z")
Hi, I'm looking at an issue with the haproxy integration. It came up after an update but in this case it might have already been broken before that. the error message I see is: elastic-pfsense-input | {"log.level":"e… --- ## [Dec 22nd, 2025: \[EN\] Scaling Bulk Indexing with Elastic Cloud Serverless](https://discuss.elastic.co/t/dec-22nd-2025-en-scaling-bulk-indexing-with-elastic-cloud-serverless/383970)
**Author:** [@json](https://discuss.elastic.co/u/json)\ **Replies:** 0\ **Last updated:** [December 22, 2025, 8:00am UTC](https://discuss.elastic.co/t/dec-22nd-2025-en-scaling-bulk-indexing-with-elastic-cloud-serverless/383970 "2025-12-22T08:00:22Z")
The split-tier architecture design of Elastic Cloud Serverless (ECS) keeps indexing tasks separate from search. It means indexing and search scale separately based on user demands of the system. On the backend, there … --- ## [Need help parsing XML and general strategy with logstash](https://discuss.elastic.co/t/need-help-parsing-xml-and-general-strategy-with-logstash/385787)
**Author:** [@Rx7TyreBurna](https://discuss.elastic.co/u/Rx7TyreBurna)\ **Replies:** 2\ **Last updated:** [April 7, 2026, 3:35am UTC](https://discuss.elastic.co/t/need-help-parsing-xml-and-general-strategy-with-logstash/385787 "2026-04-07T03:35:46Z")
I have XML output from a tool called nmap. I am wanting to pull the ports from this, but also want to take the scan information and either append that, or stick that in an Elastic index and hopefully get some unique ID … --- ## [Index/Datastream Daily ingest size](https://discuss.elastic.co/t/index-datastream-daily-ingest-size/384801)
**Author:** [@Elk\_huh](https://discuss.elastic.co/u/Elk_huh)\ **Replies:** 2\ **Last updated:** [February 3, 2026, 8:07pm UTC](https://discuss.elastic.co/t/index-datastream-daily-ingest-size/384801 "2026-02-03T20:07:35Z")
I need to find out our daily ingest rate how do you do this for Datastreams how do you do this for Indices --- ## [Filebeat 9.2.1multiline pattern not grouping MariaDB slow query logs](https://discuss.elastic.co/t/filebeat-9-2-1multiline-pattern-not-grouping-mariadb-slow-query-logs/383643)
**Author:** [@Amanuel\_Genetu](https://discuss.elastic.co/u/Amanuel_Genetu)\ **Replies:** 2\ **Last updated:** [December 3, 2025, 10:36am UTC](https://discuss.elastic.co/t/filebeat-9-2-1multiline-pattern-not-grouping-mariadb-slow-query-logs/383643 "2025-12-03T10:36:40Z")
I am trying to collect MariaDB slow query logs with Filebeat and group each query as a single event. My logs look like this: SET timestamp=1764062324; SELECT TABLE\_NAME FROM information\_schema.TABLES WHERE TABLE\_SCHE… --- ## [Free Elasticsearch MCP Server with a Semantic-to-Lexical layer for Business rules](https://discuss.elastic.co/t/free-elasticsearch-mcp-server-with-a-semantic-to-lexical-layer-for-business-rules/386456)
**Author:** [@rbeg](https://discuss.elastic.co/u/rbeg)\ **Replies:** 0\ **Last updated:** [May 22, 2026, 12:45pm UTC](https://discuss.elastic.co/t/free-elasticsearch-mcp-server-with-a-semantic-to-lexical-layer-for-business-rules/386456 "2026-05-22T12:45:44Z")
Hello guys, this is A generic Model Context Protocol (MCP) server that connects LLMs to Elasticsearch, with a Semantic-to-Lexical (S2L) layer that translates technical field names into business knowledge — without har… --- ## [Elasticsearch reindex with ELSER pipeline succeeds but only generates embeddings for fraction of documents - no failures reported](https://discuss.elastic.co/t/elasticsearch-reindex-with-elser-pipeline-succeeds-but-only-generates-embeddings-for-fraction-of-documents-no-failures-reported/386228)
**Author:** [@Roland-02](https://discuss.elastic.co/u/Roland-02)\ **Replies:** 2\ **Last updated:** [May 8, 2026, 2:02pm UTC](https://discuss.elastic.co/t/elasticsearch-reindex-with-elser-pipeline-succeeds-but-only-generates-embeddings-for-fraction-of-documents-no-failures-reported/386228 "2026-05-08T14:02:16Z")
I'm reindexing documents with an ELSER inference pipeline to generate embeddings, but only a fraction of documents (usually around half) end up with embeddings despite the reindex completing successfully with no failures… --- ## [Using LLM together Elastic SIEM](https://discuss.elastic.co/t/using-llm-together-elastic-siem/386464)
**Author:** [@arcsons](https://discuss.elastic.co/u/arcsons)\ **Replies:** 0\ **Last updated:** [May 24, 2026, 7:25am UTC](https://discuss.elastic.co/t/using-llm-together-elastic-siem/386464 "2026-05-24T07:25:46Z")
Hi all I have configured a local Mistral LLM with my Elastic Stack (version 9.3.3). I also have the full Enterprise license enabled. From a security perspective, I’m curious how others are using LLMs within Elastic. Ha… --- ## [Is querying elasticsearch directly from NextJS server-side a bad pattern?](https://discuss.elastic.co/t/is-querying-elasticsearch-directly-from-nextjs-server-side-a-bad-pattern/385747)
**Author:** [@harwin36548](https://discuss.elastic.co/u/harwin36548)\ **Replies:** 1\ **Last updated:** [April 7, 2026, 1:44pm UTC](https://discuss.elastic.co/t/is-querying-elasticsearch-directly-from-nextjs-server-side-a-bad-pattern/385747 "2026-04-07T13:44:29Z")
Hi everyone, I’m building a Next.js app (App Router) and trying to decide on the right way to integrate Elasticsearch. I know Next.js allows direct server-side data access without needing an API layer, which makes this… --- ## [Synthetic Rules - Active & recovered states - Incident Create & update](https://discuss.elastic.co/t/synthetic-rules-active-recovered-states-incident-create-update/383944)
**Author:** [@c.m](https://discuss.elastic.co/u/c.m)\ **Replies:** 1\ **Last updated:** [December 11, 2025, 9:24am UTC](https://discuss.elastic.co/t/synthetic-rules-active-recovered-states-incident-create-update/383944 "2025-12-11T09:24:43Z")
Hi, I am trying to capture ‘Active & Recovered ‘ events for a synthetic monitor so that i can update Incident in SNOW now. Setup: Have synthetic monioring setup for a website. Have a syntheric & uptime rule setup. Have… --- ## [Elastic Agent to Logstash - how to access pipeline metadata](https://discuss.elastic.co/t/elastic-agent-to-logstash-how-to-access-pipeline-metadata/382874)
**Author:** [@username456](https://discuss.elastic.co/u/username456)\ **Replies:** 1\ **Last updated:** [October 22, 2025, 12:27pm UTC](https://discuss.elastic.co/t/elastic-agent-to-logstash-how-to-access-pipeline-metadata/382874 "2025-10-22T12:27:50Z")
We’re setting up an Elastic Agent → Logstash → Elasticsearch architecture to leverage Logstash’s buffering capabilities, which ingest nodes don’t provide. Our goal is to route all Elastic Agent traffic through Logstash. … --- ## [Integration-level Outputs](https://discuss.elastic.co/t/integration-level-outputs/390582)
**Author:** [@jameswiggins](https://discuss.elastic.co/u/jameswiggins)\ **Replies:** 3\ **Last updated:** [September 22, 2026, 8:17pm UTC](https://discuss.elastic.co/t/integration-level-outputs/390582 "2026-09-22T20:17:35Z")
I'm trying to determine how to configure integration-level outputs: Set integration-level outputs | Elastic Docs I followed the instructions for configuring, but do not see the option. Can someone share a screenshot of… --- ## [ES 8.18.3 - ruby api: getting "\\>"](https://discuss.elastic.co/t/es-8-18-3-ruby-api-getting-elastic-net-readtimeout-with-tcpsocket-closed/383662)
**Author:** [@Russell\_Fulton](https://discuss.elastic.co/u/Russell_Fulton)\ **Replies:** 2\ **Last updated:** [December 1, 2025, 9:35pm UTC](https://discuss.elastic.co/t/es-8-18-3-ruby-api-getting-elastic-net-readtimeout-with-tcpsocket-closed/383662 "2025-12-01T21:35:37Z")
I have a ruby program that ingests data into ES (using bulk) I am seeing periodic failures on bulk uploads which raise exception \\> Thes… --- ## [How to handle ILM for managed system data streams (logs, metrics)](https://discuss.elastic.co/t/how-to-handle-ilm-for-managed-system-data-streams-logs-metrics/389330)
**Author:** [@rex656](https://discuss.elastic.co/u/rex656)\ **Replies:** 1\ **Last updated:** [August 8, 2026, 8:07pm UTC](https://discuss.elastic.co/t/how-to-handle-ilm-for-managed-system-data-streams-logs-metrics/389330 "2026-08-08T20:07:41Z")
I recently migrated from beats to fleet managed agents (about 500 servers total, mostly windows) and am wondering what best practice is for managing the system managed data streams for logs and metrics (logs-system\*, met… --- ## [Unique vs Multiple dense vectors](https://discuss.elastic.co/t/unique-vs-multiple-dense-vectors/385710)
**Author:** [@cilasmarques](https://discuss.elastic.co/u/cilasmarques)\ **Replies:** 1\ **Last updated:** [April 1, 2026, 12:58am UTC](https://discuss.elastic.co/t/unique-vs-multiple-dense-vectors/385710 "2026-04-01T00:58:30Z")
Hi there! I'm adding semantic search to my site's search functionality. I use Elasticsearch and my index is structured as follows: "title":{ "type":"text", "analyzer":"general\_analyzer", "fields": { "spell"… --- ## [ElasticSearch IPv6](https://discuss.elastic.co/t/elasticsearch-ipv6/383150)
**Author:** [@Peter\_Penzov](https://discuss.elastic.co/u/Peter_Penzov)\ **Replies:** 1\ **Last updated:** [November 1, 2025, 5:22pm UTC](https://discuss.elastic.co/t/elasticsearch-ipv6/383150 "2025-11-01T17:22:55Z")
I installed Elasticsearch 9.2.0 on Ubuntu VN hosted on Oracle OCI cloud. But I cannot connect outside. After listening the listening ports on the VM I see this: sudo netstat -ntlp Active Internet connections (only serv… --- ## [Cluster holds an odd number of shards](https://discuss.elastic.co/t/cluster-holds-an-odd-number-of-shards/385986)
**Author:** [@stefws](https://discuss.elastic.co/u/stefws)\ **Replies:** 2\ **Last updated:** [April 22, 2026, 7:29am UTC](https://discuss.elastic.co/t/cluster-holds-an-odd-number-of-shards/385986 "2026-04-22T07:29:39Z")
Hi Wondering about the number of shards in our v.8.19.9 cluster been odd like this when all shards ought to have exactly 1 replica: $ eshealth { "cluster\_name" : "pjp-es-epj", "status" : "green", "timed\_out" : fa… --- ## [How to connect to cassandra mTLS from logstash to source the data using keystore and truststore files?](https://discuss.elastic.co/t/how-to-connect-to-cassandra-mtls-from-logstash-to-source-the-data-using-keystore-and-truststore-files/383347)
**Author:** [@Venkata9](https://discuss.elastic.co/u/Venkata9)\ **Replies:** 2\ **Last updated:** [November 11, 2025, 7:24am UTC](https://discuss.elastic.co/t/how-to-connect-to-cassandra-mtls-from-logstash-to-source-the-data-using-keystore-and-truststore-files/383347 "2025-11-11T07:24:37Z")
Hi Team, Need help with connecting to Cassandra with mTLS connectivity using keystore and truststore certificates to source the data from Cassandra. --- ## [Kibana 8.19.9 bootstrap reports "Integrity check failed for @elastic/eui"](https://discuss.elastic.co/t/kibana-8-19-9-bootstrap-reports-integrity-check-failed-for-elastic-eui/384414)
**Author:** [@kbujold\_wr](https://discuss.elastic.co/u/kbujold_wr)\ **Replies:** 1\ **Last updated:** [April 23, 2026, 3:35pm UTC](https://discuss.elastic.co/t/kibana-8-19-9-bootstrap-reports-integrity-check-failed-for-elastic-eui/384414 "2026-04-23T15:35:45Z")
Hi, We have moved from ELK 8.18.3 to ELK 8.19.9. There appears to have been changes with bootstrap. I am getting this error BUILD\_TS\_REFS\_DISABLE=true yarn kbn bootstrap yarn run v1.22.22 $ node --no-experimental-requi… --- ## [Upgrade assistant can not migrate system indeces during upgrade from 8.18.10 to 9 version](https://discuss.elastic.co/t/upgrade-assistant-can-not-migrate-system-indeces-during-upgrade-from-8-18-10-to-9-version/384973)
**Author:** [@GyurkanMehmed](https://discuss.elastic.co/u/GyurkanMehmed)\ **Replies:** 1\ **Last updated:** [February 9, 2026, 9:20am UTC](https://discuss.elastic.co/t/upgrade-assistant-can-not-migrate-system-indeces-during-upgrade-from-8-18-10-to-9-version/384973 "2026-02-09T09:20:47Z")
I have two clusters which i am trying to upgade to 9.1.0 from 8.18.10, but migrate system indices throws async\_search: illegal\_state\_exception, so I can not proceed with the upgrade. Both cluster were originally 7v and … --- ## [How to create a network utilization of inbound traffic and outbound like solarwind](https://discuss.elastic.co/t/how-to-create-a-network-utilization-of-inbound-traffic-and-outbound-like-solarwind/383078)
**Author:** [@Syed\_Yaseen\_Arham](https://discuss.elastic.co/u/Syed_Yaseen_Arham)\ **Replies:** 2\ **Last updated:** [October 30, 2025, 8:07am UTC](https://discuss.elastic.co/t/how-to-create-a-network-utilization-of-inbound-traffic-and-outbound-like-solarwind/383078 "2025-10-30T08:07:03Z")
we have field called ifInOctets which incremental field and its values in bytes. ifSpeed is in GBPs polling inverval 120 seconds My Formula ((counter\_rate(max(ifInOctets))\*8)/60)/average(ifSpeed) i tried to this but… --- ## [Date\_Diff function not working as expeceted](https://discuss.elastic.co/t/date-diff-function-not-working-as-expeceted/385653)
**Author:** [@Whoami1980](https://discuss.elastic.co/u/Whoami1980)\ **Replies:** 4\ **Last updated:** [March 31, 2026, 6:09am UTC](https://discuss.elastic.co/t/date-diff-function-not-working-as-expeceted/385653 "2026-03-31T06:09:25Z")
Query works well without this "EVAL dd\_ms = DATE\_DIFF("day", last\_data, latest\_record)" last\_data | latest\_record 2026-03-05T04:58:55.453Z|2026-03-04T17:09:30.155Z| POST /\_query?format=txt { "query": """ FROM .ml… --- ## [Anonymize and/or remove this account](https://discuss.elastic.co/t/anonymize-and-or-remove-this-account/388620)
**Author:** [@luis](https://discuss.elastic.co/u/luis)\ **Replies:** 1\ **Last updated:** [July 22, 2026, 10:03am UTC](https://discuss.elastic.co/t/anonymize-and-or-remove-this-account/388620 "2026-07-22T10:03:41Z")
Hi, please delete this account and the data associated with it since I don't use it anymore. Thank you --- ## [Elastic Defend api/endpoint/metadata: Pagination stuck when more than pageSize endpoints share the same last\_checkin timestamp](https://discuss.elastic.co/t/elastic-defend-api-endpoint-metadata-pagination-stuck-when-more-than-pagesize-endpoints-share-the-same-last-checkin-timestamp/386844)
**Author:** [@d7d929022f550dc3d90e](https://discuss.elastic.co/u/d7d929022f550dc3d90e)\ **Replies:** 1\ **Last updated:** [June 13, 2026, 1:36am UTC](https://discuss.elastic.co/t/elastic-defend-api-endpoint-metadata-pagination-stuck-when-more-than-pagesize-endpoints-share-the-same-last-checkin-timestamp/386844 "2026-06-13T01:36:58Z")
We are paginating through all endpoints using the Kibana api/endpoint/metadata API. The API does not support PIT or search\_after, so we are using cursor-based pagination with sortField=last\_checkin, sortDirection=asc, a… --- ## [Migrate system indices failure](https://discuss.elastic.co/t/migrate-system-indices-failure/383756)
**Author:** [@kernelpanic](https://discuss.elastic.co/u/kernelpanic)\ **Replies:** 1\ **Last updated:** [November 28, 2025, 12:16pm UTC](https://discuss.elastic.co/t/migrate-system-indices-failure/383756 "2025-11-28T12:16:20Z")
Hello, I’m trying to migrate the system indices in preparation for upgrade from 8.19 to 9.x, however it is failing, any idea why? --- ## [Filebeat running as non-root user to read docker container logs](https://discuss.elastic.co/t/filebeat-running-as-non-root-user-to-read-docker-container-logs/383540)
**Author:** [@MrHedgehog](https://discuss.elastic.co/u/MrHedgehog)\ **Replies:** 0\ **Last updated:** [November 19, 2025, 4:23pm UTC](https://discuss.elastic.co/t/filebeat-running-as-non-root-user-to-read-docker-container-logs/383540 "2025-11-19T16:23:22Z")
Environment: Rocky Linux 9.6. Filebeat 8.19.7 (tar.gz install). Docker version 29.0.2 (API 1.52). SELinux enabled (but no difference with it in permissive mode) With filebeat (tar.gz install) running as a non-root user … --- ## [Do i need to use the ingest node instead of hot nodes in logstash output](https://discuss.elastic.co/t/do-i-need-to-use-the-ingest-node-instead-of-hot-nodes-in-logstash-output/387607)
**Author:** [@kkumar123](https://discuss.elastic.co/u/kkumar123)\ **Replies:** 2\ **Last updated:** [July 7, 2026, 11:50am UTC](https://discuss.elastic.co/t/do-i-need-to-use-the-ingest-node-instead-of-hot-nodes-in-logstash-output/387607 "2026-07-07T11:50:33Z")
Hello i have dedicated nodes of ml,coordinate, and ml and hot currently i am using the hot nodes in the out put of the logstash but i want to know shouldn't i remove the ingest role from hot and use ingest node in out o… --- ## [Metricbeat system.process.memory.rss.bytes is inflated](https://discuss.elastic.co/t/metricbeat-system-process-memory-rss-bytes-is-inflated/383523)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 2\ **Last updated:** [November 18, 2025, 10:27pm UTC](https://discuss.elastic.co/t/metricbeat-system-process-memory-rss-bytes-is-inflated/383523 "2025-11-18T22:27:42Z")
Metricbeat 8.5.3 is reporting rss.bytes almost three time of system installed memory. why is that? is there explanation about it? for example exactly at same time - system.memory.total = 540,665,892,864 and system.… --- ## [Kibana rule for detecting lost applicattions](https://discuss.elastic.co/t/kibana-rule-for-detecting-lost-applicattions/383475)
**Author:** [@juanmgarciaf](https://discuss.elastic.co/u/juanmgarciaf)\ **Replies:** 2\ **Last updated:** [November 18, 2025, 10:50am UTC](https://discuss.elastic.co/t/kibana-rule-for-detecting-lost-applicattions/383475 "2025-11-18T10:50:34Z")
Hello, I'm trying to create a rule in Kibana (v 8.18.7) to detect when an application has suddenly stop to inject documents in Kibana. My idea is to create a Kibana rule for that (without use transforms and Machine Lear… --- ## [Anomoly detection jobs. latest timestamp is updating but more than 2 months back](https://discuss.elastic.co/t/anomoly-detection-jobs-latest-timestamp-is-updating-but-more-than-2-months-back/385311)
**Author:** [@Whoami1980](https://discuss.elastic.co/u/Whoami1980)\ **Replies:** 3\ **Last updated:** [March 4, 2026, 5:15pm UTC](https://discuss.elastic.co/t/anomoly-detection-jobs-latest-timestamp-is-updating-but-more-than-2-months-back/385311 "2026-03-04T17:15:09Z")
Being a newbie to ML. Can anyone advice where I should start troubleshooting? job-name:noise-reduction-system-metrics-consolidated job state: opened. memory status: ok. latest timestamp is updating but more than 2 mo… --- ## [The transport thread cannot be executed by CPU for a long time due to node-level scheduling/resource contention in Elasticsearch cluster](https://discuss.elastic.co/t/the-transport-thread-cannot-be-executed-by-cpu-for-a-long-time-due-to-node-level-scheduling-resource-contention-in-elasticsearch-cluster/384060)
**Author:** [@arT1](https://discuss.elastic.co/u/arT1)\ **Replies:** 3\ **Last updated:** [December 15, 2025, 2:51pm UTC](https://discuss.elastic.co/t/the-transport-thread-cannot-be-executed-by-cpu-for-a-long-time-due-to-node-level-scheduling-resource-contention-in-elasticsearch-cluster/384060 "2025-12-15T14:51:55Z")
The transport thread cannot be executed by CPU for a long time due to node-level scheduling/resource contention in Elasticsearch cluster Environment: Elasticsearch version: v8.13.3 Deploy: tar.gz Service management: … --- ## [\[ERROR\]\[plugins.monitoring.monitoring\] Could not find license information for cluster = 'mylogging'. Please check the cluster's master node server logs for errors or warnings](https://discuss.elastic.co/t/error-plugins-monitoring-monitoring-could-not-find-license-information-for-cluster-mylogging-please-check-the-clusters-master-node-server-logs-for-errors-or-warnings/387415)
**Author:** [@zteddie](https://discuss.elastic.co/u/zteddie)\ **Replies:** 1\ **Last updated:** [June 30, 2026, 7:44pm UTC](https://discuss.elastic.co/t/error-plugins-monitoring-monitoring-could-not-find-license-information-for-cluster-mylogging-please-check-the-clusters-master-node-server-logs-for-errors-or-warnings/387415 "2026-06-30T19:44:16Z")
I am upgrading my elasticsearch stack hosted on an AKS cluster. The cluster is running with basic license. Everything seemed fine with 8.19.17. But after I upgraded to 9.4.2, kibana is throwing out following error (when … --- ## [Optimizing Elasticsearch Indexing and Search Performance for a Growing Morse Code Website with High-Volume Translation and Analytics Data](https://discuss.elastic.co/t/optimizing-elasticsearch-indexing-and-search-performance-for-a-growing-morse-code-website-with-high-volume-translation-and-analytics-data/387398)
**Author:** [@joeroot](https://discuss.elastic.co/u/joeroot)\ **Replies:** 1\ **Last updated:** [June 30, 2026, 6:51am UTC](https://discuss.elastic.co/t/optimizing-elasticsearch-indexing-and-search-performance-for-a-growing-morse-code-website-with-high-volume-translation-and-analytics-data/387398 "2026-06-30T06:51:50Z")
I run a Morse Code translator website that allows users to convert plain text into Morse code, decode Morse messages, browse educational articles, and use interactive learning tools. As the website has grown, I have also… --- ## [Missing PDF report generator](https://discuss.elastic.co/t/missing-pdf-report-generator/384434)
**Author:** [@maxxer](https://discuss.elastic.co/u/maxxer)\ **Replies:** 1\ **Last updated:** [January 12, 2026, 8:01am UTC](https://discuss.elastic.co/t/missing-pdf-report-generator/384434 "2026-01-12T08:01:21Z")
We enabled PDF report generation on our Kibana instance a few months back. We use Google login, and we map Google Workspace groups to Kibana Roles. This has been working fine for the members of this group, but out of a … --- ## [Logs parsing for multiline logs](https://discuss.elastic.co/t/logs-parsing-for-multiline-logs/384151)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 1\ **Last updated:** [December 17, 2025, 6:33pm UTC](https://discuss.elastic.co/t/logs-parsing-for-multiline-logs/384151 "2025-12-17T18:33:35Z")
Hello Team, Below is the sample logs | 2025-06-24 07:47:24 |ERROR| request-worker-13 | com.orsyp.central.ldap.MD5Login | Authentication Exception javax.naming.AuthenticationException: \[LDAP: error code 49 - 8009030C: L… [Previous page](https://discuss.elastic.co/top.md?page=21&per_page=50) [Next page](https://discuss.elastic.co/top.md?page=23&per_page=50)