# Top **URL:** https://discuss.elastic.co/top.md?page=23 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 24 --- ## [Feature Request: Native named pipe events in Elastic Defend (SMB beacon detection)](https://discuss.elastic.co/t/feature-request-native-named-pipe-events-in-elastic-defend-smb-beacon-detection/386595)
**Author:** [@labrend](https://discuss.elastic.co/u/labrend)\ **Replies:** 0\ **Last updated:** [May 31, 2026, 8:56pm UTC](https://discuss.elastic.co/t/feature-request-native-named-pipe-events-in-elastic-defend-smb-beacon-detection/386595 "2026-05-31T20:56:06Z")
Hi everyone, I've just submitted a feature request on GitHub to add native named pipe event collection to Elastic Defend: \[Elastic Defend\] Add native named pipe event collection (Sysmon EID 17/18 equivalent) · Issue #2… --- ## [Error connecting with local Package registry](https://discuss.elastic.co/t/error-connecting-with-local-package-registry/383442)
**Author:** [@Vishnu\_J](https://discuss.elastic.co/u/Vishnu_J)\ **Replies:** 0\ **Last updated:** [November 14, 2025, 10:59am UTC](https://discuss.elastic.co/t/error-connecting-with-local-package-registry/383442 "2025-11-14T10:59:10Z")
I am not able to connect Kibana with my locally deployed Elastic Package registry in an air gapped environment. I am getting this error in the kibana logs error: RegistryConnectionError: Error connecting to package regi… --- ## [Designing an Elasticsearch index for multiple domain models without field explosion](https://discuss.elastic.co/t/designing-an-elasticsearch-index-for-multiple-domain-models-without-field-explosion/386402)
**Author:** [@Mevevlin](https://discuss.elastic.co/u/Mevevlin)\ **Replies:** 2\ **Last updated:** [May 20, 2026, 4:16pm UTC](https://discuss.elastic.co/t/designing-an-elasticsearch-index-for-multiple-domain-models-without-field-explosion/386402 "2026-05-20T16:16:49Z")
I’m designing a search system where multiple SQL tables are synced into a single Elasticsearch index. The issue I’m running into is that the tables are not perfectly aligned in terms of contextual meaning. For example: … --- ## [The preprocessing for selecting values does not work in discover](https://discuss.elastic.co/t/the-preprocessing-for-selecting-values-does-not-work-in-discover/384951)
**Author:** [@Ruslan\_Hafizov](https://discuss.elastic.co/u/Ruslan_Hafizov)\ **Replies:** 2\ **Last updated:** [February 7, 2026, 8:00am UTC](https://discuss.elastic.co/t/the-preprocessing-for-selecting-values-does-not-work-in-discover/384951 "2026-02-07T08:00:02Z")
When selecting a field in the left menu, no selection is displayed by field. Despite the fact that the value itself is in the index. I couldn't find information in the documentation on how this function works to check wh… --- ## [Elastic defend (Automatic Response Action Isnt Working )](https://discuss.elastic.co/t/elastic-defend-automatic-response-action-isnt-working/390597)
**Author:** [@jatin3101](https://discuss.elastic.co/u/jatin3101)\ **Replies:** 1\ **Last updated:** [September 25, 2026, 9:17am UTC](https://discuss.elastic.co/t/elastic-defend-automatic-response-action-isnt-working/390597 "2026-09-25T09:17:29Z")
Hi , i came across this problem that my response action arent working & somehad the same issue but their was solved and i dont undertsand how detection rule- firewall disabled issue- want to run a script for enablin… --- ## [Need help indexing high-frequency manufacturing data from stamping processes in Elasticsearch](https://discuss.elastic.co/t/need-help-indexing-high-frequency-manufacturing-data-from-stamping-processes-in-elasticsearch/386107)
**Author:** [@jixcy](https://discuss.elastic.co/u/jixcy)\ **Replies:** 1\ **Last updated:** [May 2, 2026, 5:40am UTC](https://discuss.elastic.co/t/need-help-indexing-high-frequency-manufacturing-data-from-stamping-processes-in-elasticsearch/386107 "2026-05-02T05:40:01Z")
Hello everyone, I’m currently working on a real-time industrial data pipeline where we are capturing continuous machine-level outputs from stamping processes in a manufacturing environment. In our setup, we are dealing… --- ## [Why does /var/log/logstash\_flow\_stats.log appear by default in RPM installation?](https://discuss.elastic.co/t/why-does-var-log-logstash-flow-stats-log-appear-by-default-in-rpm-installation/385321)
**Author:** [@kuroro](https://discuss.elastic.co/u/kuroro)\ **Replies:** 1\ **Last updated:** [March 5, 2026, 2:16am UTC](https://discuss.elastic.co/t/why-does-var-log-logstash-flow-stats-log-appear-by-default-in-rpm-installation/385321 "2026-03-05T02:16:31Z")
Hi everyone, I’m running Logstash 8.17.6 installed via RPM, with Stack Monitoring enabled (xpack.monitoring.enabled: true). I noticed that a file named: /var/log/logstash\_flow\_stats.log is created automatically. Base… --- ## [Elasticsearch Indexing, Relevance Tuning, and Performance Issues in a Dynamic Restaurant Menu Website](https://discuss.elastic.co/t/elasticsearch-indexing-relevance-tuning-and-performance-issues-in-a-dynamic-restaurant-menu-website/385012)
**Author:** [@joeroot](https://discuss.elastic.co/u/joeroot)\ **Replies:** 1\ **Last updated:** [February 12, 2026, 6:37am UTC](https://discuss.elastic.co/t/elasticsearch-indexing-relevance-tuning-and-performance-issues-in-a-dynamic-restaurant-menu-website/385012 "2026-02-12T06:37:25Z")
I am managing a restaurant menu website that relies heavily on Elasticsearch to power search functionality across menu items, categories, ingredients, dietary tags, and promotional offers. The dataset includes hundreds o… --- ## [Where can I find Dutch word lists](https://discuss.elastic.co/t/where-can-i-find-dutch-word-lists/384649)
**Author:** [@jberkvens](https://discuss.elastic.co/u/jberkvens)\ **Replies:** 1\ **Last updated:** [January 25, 2026, 2:39am UTC](https://discuss.elastic.co/t/where-can-i-find-dutch-word-lists/384649 "2026-01-25T02:39:20Z")
I’m trying to make my pages searchable by indexing the page contents in Elasticsearch, but currently it can’t find a page that talks about “koffiekopjes” when I search for “koffie” (Dutch compound words). I found this ar… --- ## [How can I delay HNSW index construction until a segment reaches a target size?](https://discuss.elastic.co/t/how-can-i-delay-hnsw-index-construction-until-a-segment-reaches-a-target-size/383826)
**Author:** [@sfmqrb](https://discuss.elastic.co/u/sfmqrb)\ **Replies:** 1\ **Last updated:** [December 3, 2025, 7:38pm UTC](https://discuss.elastic.co/t/how-can-i-delay-hnsw-index-construction-until-a-segment-reaches-a-target-size/383826 "2025-12-03T19:38:50Z")
I’m trying to tune vector indexing behavior. Specifically, I want the first HNSW index for a segment to be built only after the segment reaches a certain size (e.g., X MB or Y vectors), instead of building small HNSW gra… --- ## [Add 'process.args\_count' to Windows Security ingest pipeline](https://discuss.elastic.co/t/add-process-args-count-to-windows-security-ingest-pipeline/382903)
**Author:** [@elkn00b](https://discuss.elastic.co/u/elkn00b)\ **Replies:** 1\ **Last updated:** [October 28, 2025, 12:26am UTC](https://discuss.elastic.co/t/add-process-args-count-to-windows-security-ingest-pipeline/382903 "2025-10-28T00:26:45Z")
Hello All, We’ve had this fix in place for a while, but I noticed when checking open issues that an enhancement request existed to add process.args\_count to the Elastic Agent integrations. I’ve reviewed the code for bo… --- ## [Kibana visualizations dont load upon opening from a formed URL via python and posted in slack](https://discuss.elastic.co/t/kibana-visualizations-dont-load-upon-opening-from-a-formed-url-via-python-and-posted-in-slack/385890)
**Author:** [@shinysap](https://discuss.elastic.co/u/shinysap)\ **Replies:** 3\ **Last updated:** [April 15, 2026, 11:17am UTC](https://discuss.elastic.co/t/kibana-visualizations-dont-load-upon-opening-from-a-formed-url-via-python-and-posted-in-slack/385890 "2026-04-15T11:17:37Z")
Kibana visualizations dont load upon opening from a formed URL via python and posted in slack Its a line chart visulization. But when i open the dashboard direct from the dashboards page and paste the KQL it works. --- ## [Tenable Security Center Integration API Issues](https://discuss.elastic.co/t/tenable-security-center-integration-api-issues/385400)
**Author:** [@AnakinWasRight](https://discuss.elastic.co/u/AnakinWasRight)\ **Replies:** 0\ **Last updated:** [March 11, 2026, 12:14am UTC](https://discuss.elastic.co/t/tenable-security-center-integration-api-issues/385400 "2026-03-11T00:14:09Z")
Self signed cert for Sec Center. The ssl side of the house seems to be fine as the agent is fully healthy. Generated the access/secret key in sec center with an administration account and enabled allow api keys in the gu… --- ## [LAB ENVIRONMENT](https://discuss.elastic.co/t/lab-environment/384439)
**Author:** [@Sriram\_D](https://discuss.elastic.co/u/Sriram_D)\ **Replies:** 0\ **Last updated:** [January 8, 2026, 2:23pm UTC](https://discuss.elastic.co/t/lab-environment/384439 "2026-01-08T14:23:10Z")
Hey , i am not able to access the lab environment, i am afraid the duration might be ended, is there any possibility that i can access and finish the course since the course ending date on jan 31st,2026 --- ## [On what version of logstash has fix for issue AIKIDO-2024-10428](https://discuss.elastic.co/t/on-what-version-of-logstash-has-fix-for-issue-aikido-2024-10428/383875)
**Author:** [@Saikiran\_Pulijala](https://discuss.elastic.co/u/Saikiran_Pulijala)\ **Replies:** 2\ **Last updated:** [December 10, 2025, 5:47am UTC](https://discuss.elastic.co/t/on-what-version-of-logstash-has-fix-for-issue-aikido-2024-10428/383875 "2025-12-10T05:47:00Z")
Hello there, Our internal container image scanning tool has flagged a vulnerability related to JRuby’s StringIO library bundled with Logstash 8.19.7. Issue Details A vulnerability was reported in StringIO, where the me… --- ## [Is \_refresh the same as internal periodic refresh?](https://discuss.elastic.co/t/is-refresh-the-same-as-internal-periodic-refresh/383858)
**Author:** [@Mo\_B](https://discuss.elastic.co/u/Mo_B)\ **Replies:** 2\ **Last updated:** [December 4, 2025, 9:05am UTC](https://discuss.elastic.co/t/is-refresh-the-same-as-internal-periodic-refresh/383858 "2025-12-04T09:05:17Z")
The documentation says that \_refresh is resource-intensive. But does calling \_refresh on an index have the same impact and cost as the automatic periodic refresh that is configurable via index.refresh\_interval? Is it pe… --- ## [Beats Input Logging](https://discuss.elastic.co/t/beats-input-logging/386116)
**Author:** [@dawiro](https://discuss.elastic.co/u/dawiro)\ **Replies:** 1\ **Last updated:** [May 1, 2026, 1:56pm UTC](https://discuss.elastic.co/t/beats-input-logging/386116 "2026-05-01T13:56:34Z")
Hi, Can anyone give me a steer regarding difference between logstash.input.beats and org.logstash.beats in the logging hierarchy? How do they relate to one another and how do they differ? Thx D --- ## [ES|QL Invoke-WebRequest how to](https://discuss.elastic.co/t/es-ql-invoke-webrequest-how-to/384848)
**Author:** [@a11](https://discuss.elastic.co/u/a11)\ **Replies:** 1\ **Last updated:** [February 5, 2026, 3:24pm UTC](https://discuss.elastic.co/t/es-ql-invoke-webrequest-how-to/384848 "2026-02-05T15:24:19Z")
Hello, I’m trying to send a webrequest with a powershell script: { "query": """ FROM packetbeat-tls | WHERE dnsdomain.keyword == "%domain%" AND @timestamp \> NOW() - 7days | KEEP host.name.keyword, source.ip.keyword … --- ## [Force synchronous refresh](https://discuss.elastic.co/t/force-synchronous-refresh/383535)
**Author:** [@Elastic04](https://discuss.elastic.co/u/Elastic04)\ **Replies:** 1\ **Last updated:** [November 27, 2025, 11:52am UTC](https://discuss.elastic.co/t/force-synchronous-refresh/383535 "2025-11-27T11:52:10Z")
We have this part of code in indexing job. turn off refresh\_interval before indexing. (set refresh\_interval to 0 or -1 through kibana) After indexing is done, we to do manual refresh so that indexed products will b… --- ## [No logs in discovery](https://discuss.elastic.co/t/no-logs-in-discovery/383044)
**Author:** [@NeedHelp](https://discuss.elastic.co/u/NeedHelp)\ **Replies:** 1\ **Last updated:** [October 29, 2025, 4:39am UTC](https://discuss.elastic.co/t/no-logs-in-discovery/383044 "2025-10-29T04:39:09Z")
Hello, I have installed the following on three VMs: Elasticsearch: 192.168.101.9 Kibana: 192.168.101.7 OPNsense: 192.168.101.8 Next, I started the Fleet Server and installed it on Kibana (192.168.101.7). I t… --- ## [Master node does not allow updating](https://discuss.elastic.co/t/master-node-does-not-allow-updating/384028)
**Author:** [@juancamiloll](https://discuss.elastic.co/u/juancamiloll)\ **Replies:** 3\ **Last updated:** [December 12, 2025, 7:10pm UTC](https://discuss.elastic.co/t/master-node-does-not-allow-updating/384028 "2025-12-12T19:10:45Z")
I am currently upgrading from the highest available version, v 8.19.3, to v 8.19.8. I successfully completed the process on two of the three servers in the cluster, but now I am having problems with the one that acts as… --- ## [Obtain “CVE ID” from Fortinet and correlate with Tenable](https://discuss.elastic.co/t/obtain-cve-id-from-fortinet-and-correlate-with-tenable/384153)
**Author:** [@juancamiloll](https://discuss.elastic.co/u/juancamiloll)\ **Replies:** 0\ **Last updated:** [December 17, 2025, 9:37pm UTC](https://discuss.elastic.co/t/obtain-cve-id-from-fortinet-and-correlate-with-tenable/384153 "2025-12-17T21:37:02Z")
Hello, I am currently receiving logs from Tenable where I can see the vulnerabilities and the associated CVE. At the same time, I am receiving logs from Fortinet where, in the IPS logs, I can see the signatures of the … --- ## [After upgrading to 8.19.5(?)+, Elastic Agent no longer uses the configured proxy, resulting in a 'no such host' error when trying to download binaries.](https://discuss.elastic.co/t/after-upgrading-to-8-19-5-elastic-agent-no-longer-uses-the-configured-proxy-resulting-in-a-no-such-host-error-when-trying-to-download-binaries/384126)
**Author:** [@JPPereira](https://discuss.elastic.co/u/JPPereira)\ **Replies:** 0\ **Last updated:** [December 16, 2025, 3:58pm UTC](https://discuss.elastic.co/t/after-upgrading-to-8-19-5-elastic-agent-no-longer-uses-the-configured-proxy-resulting-in-a-no-such-host-error-when-trying-to-download-binaries/384126 "2025-12-16T15:58:42Z")
Summary of Issue: Elastic Agent Binary Download Failing with DNS Error Since 8.19.5+ Environment Details Component Cluster 1 (Prod) Cluster 2 (Dev) Kibana Nodes 1 1 Data Nodes 9 (3 Hot/3 Warm/3 Cold) 4 (2 Hot/1… --- ## [Synthetics Monitors Frequency dropdown UI discrepancy](https://discuss.elastic.co/t/synthetics-monitors-frequency-dropdown-ui-discrepancy/390974)
**Author:** [@PeterDK](https://discuss.elastic.co/u/PeterDK)\ **Replies:** 1\ **Last updated:** [October 13, 2026, 4:51pm UTC](https://discuss.elastic.co/t/synthetics-monitors-frequency-dropdown-ui-discrepancy/390974 "2026-10-13T16:51:16Z")
Hello, I discovered that in Kibana 9.5.4 in the Synthetics Monitors UI the Frequency dropdown filter shows "Every 10 minutes" but it filters the monitors with frequency 10 seconds. So, the monitors frequency is set to … --- ## [Version conflict, document already exists when putting new documents](https://discuss.elastic.co/t/version-conflict-document-already-exists-when-putting-new-documents/386577)
**Author:** [@scip](https://discuss.elastic.co/u/scip)\ **Replies:** 1\ **Last updated:** [May 29, 2026, 12:37pm UTC](https://discuss.elastic.co/t/version-conflict-document-already-exists-when-putting-new-documents/386577 "2026-05-29T12:37:52Z")
For testing+learning purposes I created a new index and add new docs in a loop. I am using a cli tool for this, which I call in a simple shell loop: while :; do ts=$(date --iso-8601=second) msg=$(dicepwgen -c 6) e… --- ## [JSON Schema for DSL Query Language](https://discuss.elastic.co/t/json-schema-for-dsl-query-language/386415)
**Author:** [@aidin](https://discuss.elastic.co/u/aidin)\ **Replies:** 1\ **Last updated:** [May 20, 2026, 1:54am UTC](https://discuss.elastic.co/t/json-schema-for-dsl-query-language/386415 "2026-05-20T01:54:19Z")
Hi, Is there a JSON Schema definition for the DSL Query language? I found some old topics here without an answer. I was wondering if a schema has been created since then. There are definitions for the entire API, but … --- ## [Advice on snapshot and restore setup for elasticsearch DR scenario](https://discuss.elastic.co/t/advice-on-snapshot-and-restore-setup-for-elasticsearch-dr-scenario/385873)
**Author:** [@fffasttFGHb3t](https://discuss.elastic.co/u/fffasttFGHb3t)\ **Replies:** 1\ **Last updated:** [April 13, 2026, 6:55pm UTC](https://discuss.elastic.co/t/advice-on-snapshot-and-restore-setup-for-elasticsearch-dr-scenario/385873 "2026-04-13T18:55:09Z")
We currently have an elasticsearch cluster deployed on-prem kubernetes with the elastic operator. Our main goals are exactly as described in the documentation: Regularly back up a cluster with no downtime Recover data… --- ## [Kibana Alert Email - URL broken in SMTP email notifications](https://discuss.elastic.co/t/kibana-alert-email-url-broken-in-smtp-email-notifications/390797)
**Author:** [@Omar2](https://discuss.elastic.co/u/Omar2)\ **Replies:** 2\ **Last updated:** [October 2, 2026, 7:56am UTC](https://discuss.elastic.co/t/kibana-alert-email-url-broken-in-smtp-email-notifications/390797 "2026-10-02T07:56:01Z")
Hello, I'm experiencing an issue with Kibana alert emails sent through an SMTP connector. Kibana version: 9.4.3 Alert message: La règle Kibana {{rule.name}} s'est déclenchée: Nombre d'erreurs : {{context.value}} … --- ## [Synthetic agents ICMP monitors are all of sudden failing](https://discuss.elastic.co/t/synthetic-agents-icmp-monitors-are-all-of-sudden-failing/385541)
**Author:** [@Whoami1980](https://discuss.elastic.co/u/Whoami1980)\ **Replies:** 0\ **Last updated:** [March 20, 2026, 7:17am UTC](https://discuss.elastic.co/t/synthetic-agents-icmp-monitors-are-all-of-sudden-failing/385541 "2026-03-20T07:17:27Z")
Our Synthetic agents ICMP monitors are all of sudden failing. While looking through the agent logs. These are the message we see. #message Possible transient error during checkin with fleet-server, retrying #error.me… --- ## [I want to do the max of the sum doc\_count per second in line grpah visualization](https://discuss.elastic.co/t/i-want-to-do-the-max-of-the-sum-doc-count-per-second-in-line-grpah-visualization/387260)
**Author:** [@Goncalo\_Santos](https://discuss.elastic.co/u/Goncalo_Santos)\ **Replies:** 1\ **Last updated:** [June 29, 2026, 1:22am UTC](https://discuss.elastic.co/t/i-want-to-do-the-max-of-the-sum-doc-count-per-second-in-line-grpah-visualization/387260 "2026-06-29T01:22:58Z")
Hello. I'm trying to get the maximum value of the sum doc\_count but using a max\_bucket aggregation it either reaches the maximum number of buckets (error: "too\_many\_buckets\_exception"), or it ajusts the timerange to be … --- ## [Kibana Showing Only 5xx Errors for API Logs Despite of receving 200 Responses too in Analytics](https://discuss.elastic.co/t/kibana-showing-only-5xx-errors-for-api-logs-despite-of-receving-200-responses-too-in-analytics/386525)
**Author:** [@devapi](https://discuss.elastic.co/u/devapi)\ **Replies:** 1\ **Last updated:** [May 27, 2026, 6:46pm UTC](https://discuss.elastic.co/t/kibana-showing-only-5xx-errors-for-api-logs-despite-of-receving-200-responses-too-in-analytics/386525 "2026-05-27T18:46:40Z")
We have successfully set up and integrated Elasticsearch with the IBM Analytics subsystem to offload API logs into ELK. However, while applying a filter on the API-Name field in the Kibana UI for a specific valid timesta… --- ## [Alert re-triggering & limited context (recovery actions)](https://discuss.elastic.co/t/alert-re-triggering-limited-context-recovery-actions/386049)
**Author:** [@Actor01](https://discuss.elastic.co/u/Actor01)\ **Replies:** 1\ **Last updated:** [April 29, 2026, 7:42am UTC](https://discuss.elastic.co/t/alert-re-triggering-limited-context-recovery-actions/386049 "2026-04-29T07:42:31Z")
Hello, we are currently working with Kibana alerting in a production environment and ran into a couple of challenges. We would like to ask if there are recommended approaches or built-in solutions for the following scen… --- ## [Upgrading from ES 7.17.8 to 8.19.8](https://discuss.elastic.co/t/upgrading-from-es-7-17-8-to-8-19-8/385475)
**Author:** [@winter\_crescents](https://discuss.elastic.co/u/winter_crescents)\ **Replies:** 1\ **Last updated:** [March 17, 2026, 8:08am UTC](https://discuss.elastic.co/t/upgrading-from-es-7-17-8-to-8-19-8/385475 "2026-03-17T08:08:36Z")
I have recently tried to upgrade Elasticsearch from version 7.17.8 to 8.19.8. However, I am facing this error: java.io.EOFException at org.elasticsearch.common.io.stream.InputStreamStreamInput.readByte(InputStreamStre… --- ## [Trial extension request for Elastic ML features on on-premises](https://discuss.elastic.co/t/trial-extension-request-for-elastic-ml-features-on-on-premises/385155)
**Author:** [@abel1](https://discuss.elastic.co/u/abel1)\ **Replies:** 1\ **Last updated:** [February 23, 2026, 12:51pm UTC](https://discuss.elastic.co/t/trial-extension-request-for-elastic-ml-features-on-on-premises/385155 "2026-02-23T12:51:07Z")
Hello, I previously submitted a request to extend my Elastic trial license for 30 days to test Machine Learning features on my self-managed (on-premises) setup. I haven’t received a response yet and would appreciate any… --- ## [Upgrade to 9x preparation: migrate watches](https://discuss.elastic.co/t/upgrade-to-9x-preparation-migrate-watches/384793)
**Author:** [@CD9820](https://discuss.elastic.co/u/CD9820)\ **Replies:** 1\ **Last updated:** [January 29, 2026, 3:10pm UTC](https://discuss.elastic.co/t/upgrade-to-9x-preparation-migrate-watches/384793 "2026-01-29T15:10:21Z")
Hello I am going through the upgrade assistant on my QA cluster in preparation for the upgrade from 8.19.4 to 9.2.x The assistant marks the following index as critical block for the upgrade: .reindexed-v7-watches-6 T… --- ## [Guidance on language analyzers for non-native languages](https://discuss.elastic.co/t/guidance-on-language-analyzers-for-non-native-languages/384168)
**Author:** [@sibasish.palo](https://discuss.elastic.co/u/sibasish.palo)\ **Replies:** 1\ **Last updated:** [December 31, 2025, 6:53am UTC](https://discuss.elastic.co/t/guidance-on-language-analyzers-for-non-native-languages/384168 "2025-12-31T06:53:02Z")
i am trying to add some new locale support and looking for guidance on language analyzers to be added for the locales. i have gone through lang-analyzer page to find the appropriate analyzers for the locales which i am t… --- ## [Metricbeat 8.x – Why were os.cpu.load\_average.5m and 15m removed?](https://discuss.elastic.co/t/metricbeat-8-x-why-were-os-cpu-load-average-5m-and-15m-removed/384120)
**Author:** [@Suresh\_Ghatuwa](https://discuss.elastic.co/u/Suresh_Ghatuwa)\ **Replies:** 1\ **Last updated:** [December 17, 2025, 12:56pm UTC](https://discuss.elastic.co/t/metricbeat-8-x-why-were-os-cpu-load-average-5m-and-15m-removed/384120 "2025-12-17T12:56:52Z")
We observed a behavioral change between Metricbeat 7.17 and 8.x (tested with 8.13) regarding Elasticsearch node OS CPU load averages. In Metricbeat 7.17, metricset exported: node\_stats.os.cpu.load\_average.1m node\_… --- ## [Splitting an Elastic Enterprise License Across Multiple Clusters](https://discuss.elastic.co/t/splitting-an-elastic-enterprise-license-across-multiple-clusters/383543)
**Author:** [@gueguet57](https://discuss.elastic.co/u/gueguet57)\ **Replies:** 1\ **Last updated:** [November 20, 2025, 1:45am UTC](https://discuss.elastic.co/t/splitting-an-elastic-enterprise-license-across-multiple-clusters/383543 "2025-11-20T01:45:51Z")
Hello, I would like to know if it's possible to split an Enterprise license across multiple Elastic clusters. For example, my PROD cluster is consuming only 40 GB out of a 64 GB license. Is it possible to use the remai… --- ## [ES loses quorum every hour](https://discuss.elastic.co/t/es-loses-quorum-every-hour/384937)
**Author:** [@elastic\_noob1](https://discuss.elastic.co/u/elastic_noob1)\ **Replies:** 3\ **Last updated:** [February 6, 2026, 2:02pm UTC](https://discuss.elastic.co/t/es-loses-quorum-every-hour/384937 "2026-02-06T14:02:12Z")
We have our clusters running for a few years now on 7.17 with java8. Due to company requirements, I upgraded the cluster to use java17. We use our own java binary due to company policies. Once the cluster was on java17, … --- ## [Process Tree Analyzer from custom space issue](https://discuss.elastic.co/t/process-tree-analyzer-from-custom-space-issue/389894)
**Author:** [@adamsmesher](https://discuss.elastic.co/u/adamsmesher)\ **Replies:** 0\ **Last updated:** [August 24, 2026, 4:48pm UTC](https://discuss.elastic.co/t/process-tree-analyzer-from-custom-space-issue/389894 "2026-08-24T16:48:23Z")
The /api/endpoint/resolver/tree endpoint crashes when queried from within a custom Kibana Space (like sandbox), pointing to a backend routing or permissions bug. stack version - 9.5.1 /s/sandbox/api/endpoint/resolver/… --- ## [APM instrumentation for Classic ASP application on IIS](https://discuss.elastic.co/t/apm-instrumentation-for-classic-asp-application-on-iis/390900)
**Author:** [@AliLemaizi](https://discuss.elastic.co/u/AliLemaizi)\ **Replies:** 1\ **Last updated:** [October 9, 2026, 6:44am UTC](https://discuss.elastic.co/t/apm-instrumentation-for-classic-asp-application-on-iis/390900 "2026-10-09T06:44:14Z")
We are currently running an Elastic APM POC and would like your assistance with monitoring a legacy application based on Classic ASP running on Microsoft IIS. For the Classic ASP application, however, we understand that… --- ## [Filebeat with Salesforce input and batch](https://discuss.elastic.co/t/filebeat-with-salesforce-input-and-batch/390433)
**Author:** [@stephaniearce](https://discuss.elastic.co/u/stephaniearce)\ **Replies:** 1\ **Last updated:** [September 16, 2026, 5:59pm UTC](https://discuss.elastic.co/t/filebeat-with-salesforce-input-and-batch/390433 "2026-09-16T17:59:51Z")
Can anyone explain why I'm running into this issue? I copied the exact config from the docs here: Salesforce input | Beats Salesforce input: object.batch.enabled: true fails with "map has no entry for key batch\_start\_ti… --- ## [How to migrate Milvus data to Elasticsearch](https://discuss.elastic.co/t/how-to-migrate-milvus-data-to-elasticsearch/384775)
**Author:** [@midon\_king](https://discuss.elastic.co/u/midon_king)\ **Replies:** 1\ **Last updated:** [January 28, 2026, 3:32pm UTC](https://discuss.elastic.co/t/how-to-migrate-milvus-data-to-elasticsearch/384775 "2026-01-28T15:32:54Z")
I have a Milvus cluster. Now I want to transfer all the data within this Milvus cluster to Elasticsearch. What steps need to be taken for this? Are there any available migration tools or solutions that can be used? --- ## [How to get rid of dotted lines seen in Kibana maps](https://discuss.elastic.co/t/how-to-get-rid-of-dotted-lines-seen-in-kibana-maps/383240)
**Author:** [@ramenon](https://discuss.elastic.co/u/ramenon)\ **Replies:** 1\ **Last updated:** [November 6, 2025, 1:54pm UTC](https://discuss.elastic.co/t/how-to-get-rid-of-dotted-lines-seen-in-kibana-maps/383240 "2025-11-06T13:54:56Z")
Hello , Good day. I wanted to ask if there’s any way to remove the dotted line between the points that I have plotted in Kibana Maps , I tried toggling every option available for the Layers but it just doesn’t go away. … --- ## [Cofense Intelligence (ti integration)](https://discuss.elastic.co/t/cofense-intelligence-ti-integration/386065)
**Author:** [@walburton](https://discuss.elastic.co/u/walburton)\ **Replies:** 0\ **Last updated:** [April 27, 2026, 9:39pm UTC](https://discuss.elastic.co/t/cofense-intelligence-ti-integration/386065 "2026-04-27T21:39:25Z")
Creating this thread to request support for the Cofense Intelligence v2 (ThreatHQ) API which would provide the ability to natively pull Threat Intel from the Cofense feed into the Elastic TI product. This currently is no… --- ## [Docker logs integration with Fleet to a datastream - my experience](https://discuss.elastic.co/t/docker-logs-integration-with-fleet-to-a-datastream-my-experience/385549)
**Author:** [@dot-mike](https://discuss.elastic.co/u/dot-mike)\ **Replies:** 0\ **Last updated:** [March 20, 2026, 4:43pm UTC](https://discuss.elastic.co/t/docker-logs-integration-with-fleet-to-a-datastream-my-experience/385549 "2026-03-20T16:43:07Z")
Hi community, I'm sharing my experience here for ingesting docker logs with fleet agent-setup. My goal is to ingest docker logs for a specific application running on on-premises on a specific system to a custom datastre… --- ## [\[Custom API\] Integration via GUI](https://discuss.elastic.co/t/custom-api-integration-via-gui/384707)
**Author:** [@kulisiber](https://discuss.elastic.co/u/kulisiber)\ **Replies:** 0\ **Last updated:** [January 23, 2026, 8:50am UTC](https://discuss.elastic.co/t/custom-api-integration-via-gui/384707 "2026-01-23T08:50:37Z")
Hello community team, I am a newbie in elastic, and now I used elastic for security for SIEM in my company. I am confused to setting Custom Integration - Custom API via GUI, can you give me some example for format data… --- ## [Extending Tomcat integration to collect additional JMX metrics (e.g., java\_lang\_OperatingSystem, oracle\_ucp\_admin)](https://discuss.elastic.co/t/extending-tomcat-integration-to-collect-additional-jmx-metrics-e-g-java-lang-operatingsystem-oracle-ucp-admin/382984)
**Author:** [@DIPTOPOL](https://discuss.elastic.co/u/DIPTOPOL)\ **Replies:** 0\ **Last updated:** [October 26, 2025, 3:07pm UTC](https://discuss.elastic.co/t/extending-tomcat-integration-to-collect-additional-jmx-metrics-e-g-java-lang-operatingsystem-oracle-ucp-admin/382984 "2025-10-26T15:07:28Z")
I am currently exploring the Tomcat integration using the Elastic Agent. From my observations, the default metrics collected through the JMX Prometheus exporter do not include all available data. For example, metric sets… --- ## [Wrong process contacted by Metricbeat inside Docker container](https://discuss.elastic.co/t/wrong-process-contacted-by-metricbeat-inside-docker-container/382855)
**Author:** [@lucaCigarini](https://discuss.elastic.co/u/lucaCigarini)\ **Replies:** 0\ **Last updated:** [October 21, 2025, 7:29am UTC](https://discuss.elastic.co/t/wrong-process-contacted-by-metricbeat-inside-docker-container/382855 "2025-10-21T07:29:25Z")
Hello, recently I've upgraded a containerized version of Metricbeat from 9.1.3 to 9.1.5. Since then, unfortunately, I am experiencing errors while using the system module to fetch the host CPU usage.This is the docker-co… --- ## [Is there a workaround for view context which is not working post ugrade to 8.19.3](https://discuss.elastic.co/t/is-there-a-workaround-for-view-context-which-is-not-working-post-ugrade-to-8-19-3/383946)
**Author:** [@shinysap](https://discuss.elastic.co/u/shinysap)\ **Replies:** 2\ **Last updated:** [February 3, 2026, 9:13am UTC](https://discuss.elastic.co/t/is-there-a-workaround-for-view-context-which-is-not-working-post-ugrade-to-8-19-3/383946 "2026-02-03T09:13:41Z")
Is there a workaround for view context which is not working post ugrade to 8.19.3 [Previous page](https://discuss.elastic.co/top.md?page=22&per_page=50) [Next page](https://discuss.elastic.co/top.md?page=24&per_page=50)