# Top **URL:** https://discuss.elastic.co/top.md?page=24 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 25 --- ## [Case\_insensitive terms query on \_id field - Is this behavior a bug?](https://discuss.elastic.co/t/case-insensitive-terms-query-on-id-field-is-this-behavior-a-bug/384090)
**Author:** [@khatcher](https://discuss.elastic.co/u/khatcher)\ **Replies:** 1\ **Last updated:** [December 16, 2025, 1:04pm UTC](https://discuss.elastic.co/t/case-insensitive-terms-query-on-id-field-is-this-behavior-a-bug/384090 "2025-12-16T13:04:51Z")
I have an index with IDs that I manually set to product IDs from the database, and they get prefixed with AHC or CAT, depending on which catalog the products are from. In my general search, I include a terms query that l… --- ## [My Status of Fleet Agent doesn't change from Updating to Heathy](https://discuss.elastic.co/t/my-status-of-fleet-agent-doesnt-change-from-updating-to-heathy/384003)
**Author:** [@duy270101](https://discuss.elastic.co/u/duy270101)\ **Replies:** 1\ **Last updated:** [December 12, 2025, 6:47am UTC](https://discuss.elastic.co/t/my-status-of-fleet-agent-doesnt-change-from-updating-to-heathy/384003 "2025-12-12T06:47:11Z")
My case. I set up for may lab. Please help me. Status don't change to Heathy. when install i added –insecure -f in the tail of command. --- ## [Easier acces to information regarding the default fields sent by all the Beats](https://discuss.elastic.co/t/easier-acces-to-information-regarding-the-default-fields-sent-by-all-the-beats/383290)
**Author:** [@Jose\_E](https://discuss.elastic.co/u/Jose_E)\ **Replies:** 1\ **Last updated:** [November 7, 2025, 5:08pm UTC](https://discuss.elastic.co/t/easier-acces-to-information-regarding-the-default-fields-sent-by-all-the-beats/383290 "2025-11-07T17:08:19Z")
Hi there, I have a quick suggestion to improve the documentation of all the beats. Why don’t you add a section explaining the default fields that are expected of the beats, in the documentation? I don’t have to work of… --- ## [Processing Heterogeneous IoT Logs with Fluent Bit and Elasticsearch Ingest Pipelines](https://discuss.elastic.co/t/processing-heterogeneous-iot-logs-with-fluent-bit-and-elasticsearch-ingest-pipelines/390311)
**Author:** [@cchaussat](https://discuss.elastic.co/u/cchaussat)\ **Replies:** 0\ **Last updated:** [September 10, 2026, 4:26pm UTC](https://discuss.elastic.co/t/processing-heterogeneous-iot-logs-with-fluent-bit-and-elasticsearch-ingest-pipelines/390311 "2026-09-10T16:26:18Z")
I would like to report on the experience of developing a simple home automation data collection and processing pipeline able to work with data and metrics from Domoticz and from many other various IoT devices and scripts… --- ## [Unifi Syslog ECS Mapping](https://discuss.elastic.co/t/unifi-syslog-ecs-mapping/386089)
**Author:** [@AxelZoldik](https://discuss.elastic.co/u/AxelZoldik)\ **Replies:** 0\ **Last updated:** [April 29, 2026, 7:24am UTC](https://discuss.elastic.co/t/unifi-syslog-ecs-mapping/386089 "2026-04-29T07:24:33Z")
Hello everyone I hope you are all doing well, I'm wondering if someone has already a pipeline logstash for mapping Unifi firewall logs to ECS, It might be worth to create an integration directly in Kibana if I'm not al… --- ## [How to ensure the integrity of filebeat output data during network fluctuations？](https://discuss.elastic.co/t/how-to-ensure-the-integrity-of-filebeat-output-data-during-network-fluctuations/385625)
**Author:** [@h123123123](https://discuss.elastic.co/u/h123123123)\ **Replies:** 0\ **Last updated:** [March 26, 2026, 2:03am UTC](https://discuss.elastic.co/t/how-to-ensure-the-integrity-of-filebeat-output-data-during-network-fluctuations/385625 "2026-03-26T02:03:20Z")
The version of Filebeat I am using is 9.3.1. I set max\_retries=-1, expecting that during network fluctuations, all data can be sent to Kafka. The actual test result: data is still lost during network fluctuations. I trie… --- ## [Not able to connect](https://discuss.elastic.co/t/not-able-to-connect/384506)
**Author:** [@Fidele](https://discuss.elastic.co/u/Fidele)\ **Replies:** 0\ **Last updated:** [January 13, 2026, 5:00pm UTC](https://discuss.elastic.co/t/not-able-to-connect/384506 "2026-01-13T17:00:28Z")
Dear Team, I hope this email finds you well. I am currently unable to join the virtual training session. Kindly support me in accessing the session. The email address I used to register is: firstname.lastname@minaloc.… --- ## [Does doing a POST query via the devtools update index-pattern?](https://discuss.elastic.co/t/does-doing-a-post-query-via-the-devtools-update-index-pattern/389264)
**Author:** [@Whoami1980](https://discuss.elastic.co/u/Whoami1980)\ **Replies:** 1\ **Last updated:** [August 5, 2026, 4:03pm UTC](https://discuss.elastic.co/t/does-doing-a-post-query-via-the-devtools-update-index-pattern/389264 "2026-08-05T16:03:54Z")
Does doing a POST query likes these via the devtools update index-pattern? If the answer is yes. Does it impact the data in Elasticsearch? Or its purely visualization? POST /\_query?format=txt { "query": """ FROM … --- ## [Is it possible to Downsamp to a list of keyword values!](https://discuss.elastic.co/t/is-it-possible-to-downsamp-to-a-list-of-keyword-values/385393)
**Author:** [@A\_Abdellah](https://discuss.elastic.co/u/A_Abdellah)\ **Replies:** 1\ **Last updated:** [March 15, 2026, 3:37am UTC](https://discuss.elastic.co/t/is-it-possible-to-downsamp-to-a-list-of-keyword-values/385393 "2026-03-15T03:37:21Z")
Hello everyone, I have a time series data stream (TSDS) set up with downsampling configured via ILM (e.g. downsample to 1d intervals daily). The index template is correctly marked with time\_series\_dimension. My data in… --- ## [NodeJS FIPS enablement in Kibana](https://discuss.elastic.co/t/nodejs-fips-enablement-in-kibana/385384)
**Author:** [@Reviving9721](https://discuss.elastic.co/u/Reviving9721)\ **Replies:** 1\ **Last updated:** [March 9, 2026, 8:53pm UTC](https://discuss.elastic.co/t/nodejs-fips-enablement-in-kibana/385384 "2026-03-09T20:53:41Z")
The provided instructions from FIPS compliance for Kibana | Elastic Docs specify that this is a requirement: Delegating the implementation of these cryptographic algorithms to a NIST validated cryptographic module (ava… --- ## [Pending tasks accumulating with ES 8.17.3](https://discuss.elastic.co/t/pending-tasks-accumulating-with-es-8-17-3/383850)
**Author:** [@Phil\_Budne](https://discuss.elastic.co/u/Phil_Budne)\ **Replies:** 1\ **Last updated:** [December 4, 2025, 1:27pm UTC](https://discuss.elastic.co/t/pending-tasks-accumulating-with-es-8-17-3/383850 "2025-12-04T13:27:41Z")
We’ve seen this before, and has cleared up after the master nodes (self?) restarted ES: $ curl http://es.newsscribe.angwin:9209/ { "name" : "es02.newsscribe.angwin", "cluster\_name" : "mc\_es\_cluster", "cluster\_uuid… --- ## [Cluster.routing.allocation.balance.write\_load on free license](https://discuss.elastic.co/t/cluster-routing-allocation-balance-write-load-on-free-license/383390)
**Author:** [@Hieu\_Pham](https://discuss.elastic.co/u/Hieu_Pham)\ **Replies:** 1\ **Last updated:** [November 12, 2025, 12:31pm UTC](https://discuss.elastic.co/t/cluster-routing-allocation-balance-write-load-on-free-license/383390 "2025-11-12T12:31:40Z")
Hi team! Does cluster.routing.allocation.balance.write\_load take any effect on free x-pack license? According to this page: Subscriptions | Elastic Stack Products & Support | Elastic, only Advanced Cluster Balancing has… --- ## [Elastic-Agent -\> Logstash high EPS missing events](https://discuss.elastic.co/t/elastic-agent-logstash-high-eps-missing-events/385733)
**Author:** [@mamueh](https://discuss.elastic.co/u/mamueh)\ **Replies:** 0\ **Last updated:** [April 1, 2026, 2:05pm UTC](https://discuss.elastic.co/t/elastic-agent-logstash-high-eps-missing-events/385733 "2026-04-01T14:05:40Z")
Hi Everyone We have a rather large setup in which we’ve replaced rsyslog with Elastic Agents as log collectors. We’re running 8.19.8. Currently we have around 1200 devices forwarding mostly syslog to a load balancer th… --- ## [Console.plugin tries to connect to quickstart-es-http.default.svc:9200 even though theres is explicit configuration](https://discuss.elastic.co/t/console-plugin-tries-to-connect-to-quickstart-es-http-default-svc-9200-even-though-theres-is-explicit-configuration/385745)
**Author:** [@slowdown77](https://discuss.elastic.co/u/slowdown77)\ **Replies:** 1\ **Last updated:** [April 7, 2026, 2:18pm UTC](https://discuss.elastic.co/t/console-plugin-tries-to-connect-to-quickstart-es-http-default-svc-9200-even-though-theres-is-explicit-configuration/385745 "2026-04-07T14:18:24Z")
Hi everyone, I have a fresh installation of ECK 3.3.1 and I have deployed Kibana and pointed it to the Elasticsearch instance in the same namespace apiVersion: kibana.k8s.elastic.co/v1 kind: Kibana metadata: name: cm… --- ## [Kibana: Show ‘Access Denied’ instead of ‘Application Not Found’ for read-only users](https://discuss.elastic.co/t/kibana-show-access-denied-instead-of-application-not-found-for-read-only-users/385666)
**Author:** [@Santhosh\_3](https://discuss.elastic.co/u/Santhosh_3)\ **Replies:** 1\ **Last updated:** [March 28, 2026, 6:01am UTC](https://discuss.elastic.co/t/kibana-show-access-denied-instead-of-application-not-found-for-read-only-users/385666 "2026-03-28T06:01:44Z")
Hi, I would like to change the message displayed in Kibana from “Application Not Found” to “Access Denied” for users with viewer (read-only) access. Is it possible to customize or configure this behaviour? --- ## [Kibana embedded dashboard in iframe returns 401 Unauthorized loop - anonymous auth works directly but not in iframe](https://discuss.elastic.co/t/kibana-embedded-dashboard-in-iframe-returns-401-unauthorized-loop-anonymous-auth-works-directly-but-not-in-iframe/384815)
**Author:** [@Oscar\_NT](https://discuss.elastic.co/u/Oscar_NT)\ **Replies:** 1\ **Last updated:** [January 30, 2026, 7:58am UTC](https://discuss.elastic.co/t/kibana-embedded-dashboard-in-iframe-returns-401-unauthorized-loop-anonymous-auth-works-directly-but-not-in-iframe/384815 "2026-01-30T07:58:17Z")
Environment: Elastic Cloud (Hosted) Kibana version: 8.x (Cloud managed) Browser: Chrome / Safari Frontend: Next.js app running on https://localhost:3000 (HTTPS with mkcert) Problem: I'm trying to embed a Kibana dash… --- ## [Packaging quantity not searchable](https://discuss.elastic.co/t/packaging-quantity-not-searchable/384914)
**Author:** [@Elastic04](https://discuss.elastic.co/u/Elastic04)\ **Replies:** 2\ **Last updated:** [February 16, 2026, 10:05am UTC](https://discuss.elastic.co/t/packaging-quantity-not-searchable/384914 "2026-02-16T10:05:44Z")
We are currently getting zero results when searching with term along with quantity for example coke 1l. So, I want to index a new field packquantity which has values like 1 kg, 500 g, 2l. But my concern here is how to ha… --- ## [Elasticsearch Rule SMTP Action - How to include line breaks](https://discuss.elastic.co/t/elasticsearch-rule-smtp-action-how-to-include-line-breaks/384900)
**Author:** [@Elk\_huh](https://discuss.elastic.co/u/Elk_huh)\ **Replies:** 2\ **Last updated:** [February 5, 2026, 2:05pm UTC](https://discuss.elastic.co/t/elasticsearch-rule-smtp-action-how-to-include-line-breaks/384900 "2026-02-05T14:05:38Z")
{{#context.hits}} Source IP Address: {{\_source.src\_ip}} Message {{\_source.new\_port}} {{/context.hits}} I need spaces after every context entry , right now its all jammed together Source IP Address: Message Source … --- ## [Moment.js Vulnerability](https://discuss.elastic.co/t/moment-js-vulnerability/389932)
**Author:** [@ashish.jagtap](https://discuss.elastic.co/u/ashish.jagtap)\ **Replies:** 0\ **Last updated:** [August 26, 2026, 2:01pm UTC](https://discuss.elastic.co/t/moment-js-vulnerability/389932 "2026-08-26T14:01:42Z")
Hello, I am using Elasticsearch-Kibana version 7.17.2. In the security tests, it was observed that there was a vulnerability in moment.js software. moment.js 2.28.0 --\> CVE-2022-24785 Do we have remediation plan for … --- ## [Known Issue: Logstash 9.2.0 will not start with a Persistent Queue greater than 2GiB](https://discuss.elastic.co/t/known-issue-logstash-9-2-0-will-not-start-with-a-persistent-queue-greater-than-2gib/383079)
**Author:** [@RobBavey](https://discuss.elastic.co/u/RobBavey)\ **Replies:** 0\ **Last updated:** [October 29, 2025, 4:57pm UTC](https://discuss.elastic.co/t/known-issue-logstash-9-2-0-will-not-start-with-a-persistent-queue-greater-than-2gib/383079 "2025-10-29T16:57:59Z")
Logstash 9.2.0 has a known issue where Logstash will not start if a Persistent Queue has been defined with a size greater than 2 GiB. If you attempt to start Logstash 9.2.0 with any PQs where queue.max\_bytes has been se… --- ## [Optimizing Incident Triaging via Kibana Case Integration](https://discuss.elastic.co/t/optimizing-incident-triaging-via-kibana-case-integration/387480)
**Author:** [@reports](https://discuss.elastic.co/u/reports)\ **Replies:** 0\ **Last updated:** [July 2, 2026, 3:03pm UTC](https://discuss.elastic.co/t/optimizing-incident-triaging-via-kibana-case-integration/387480 "2026-07-02T15:03:22Z")
I have created security rules in Kibana and integrated the Cases action to enable auto-generated cases. Initially, I faced a limitation where I couldn't customize the case payload to extract critical alert details. This … --- ## [Eck-stack master, hot, warm and cold architecture](https://discuss.elastic.co/t/eck-stack-master-hot-warm-and-cold-architecture/386443)
**Author:** [@khteh](https://discuss.elastic.co/u/khteh)\ **Replies:** 0\ **Last updated:** [May 21, 2026, 12:21pm UTC](https://discuss.elastic.co/t/eck-stack-master-hot-warm-and-cold-architecture/386443 "2026-05-21T12:21:37Z")
Is there any documentation on the eck-stack example chart cloud-on-k8s/deploy/eck-stack/examples/elasticsearch/hot-warm-cold.yaml at main · elastic/cloud-on-k8s · GitHub ? In particular, what are the master, hot, warm an… --- ## [High RAM usage with Active Directory Entity Analytics integration on a 4GB RAM server](https://discuss.elastic.co/t/high-ram-usage-with-active-directory-entity-analytics-integration-on-a-4gb-ram-server/386780)
**Author:** [@PatreKerier](https://discuss.elastic.co/u/PatreKerier)\ **Replies:** 1\ **Last updated:** [June 10, 2026, 6:26am UTC](https://discuss.elastic.co/t/high-ram-usage-with-active-directory-entity-analytics-integration-on-a-4gb-ram-server/386780 "2026-06-10T06:26:11Z")
Hello everyone, I’ve run into an issue with excessive resource consumption by the Elastic Agent and am looking for advice on optimizing policies and limits. Context: A customer has a server with very modest hardware sp… --- ## [Elastic agent is not sending data to elasticsearch cluster](https://discuss.elastic.co/t/elastic-agent-is-not-sending-data-to-elasticsearch-cluster/384080)
**Author:** [@kuldeep\_gupta](https://discuss.elastic.co/u/kuldeep_gupta)\ **Replies:** 1\ **Last updated:** [December 18, 2025, 7:59am UTC](https://discuss.elastic.co/t/elastic-agent-is-not-sending-data-to-elasticsearch-cluster/384080 "2025-12-18T07:59:50Z")
Hello All, I recently upgraded elasticsearch cluster from 8.12 \> 8.19. Subsequently i also upgraded elastic-agent (fleet-server) to 8.19 which is healthy. But when i try to enroll new agent into it, it is in updating s… --- ## [Cannot access Elasticsearch outside](https://discuss.elastic.co/t/cannot-access-elasticsearch-outside/383153)
**Author:** [@Peter\_Penzov](https://discuss.elastic.co/u/Peter_Penzov)\ **Replies:** 1\ **Last updated:** [November 2, 2025, 2:06am UTC](https://discuss.elastic.co/t/cannot-access-elasticsearch-outside/383153 "2025-11-02T02:06:35Z")
I have a Oracle Cloud(OCI) machine on which I installed ElastciSearch 9.2.0 but I can access it only internally. root@instance-20253022-1222:/var/log/elasticsearch# curl -k --user elastic:zzzzzzz -X GET "https://localho… --- ## [Deploying an External Fleet Server with an ECK-Managed Elastic Stack](https://discuss.elastic.co/t/deploying-an-external-fleet-server-with-an-eck-managed-elastic-stack/388380)
**Author:** [@Zaryab\_Shaikh](https://discuss.elastic.co/u/Zaryab_Shaikh)\ **Replies:** 0\ **Last updated:** [July 16, 2026, 1:42pm UTC](https://discuss.elastic.co/t/deploying-an-external-fleet-server-with-an-eck-managed-elastic-stack/388380 "2026-07-16T13:42:22Z")
Hi everyone, I hope you're doing well. I have an Elastic Stack deployment running on Kubernetes using the ECK Operator. Elasticsearch, Kibana, and Fleet Server are all deployed successfully and working as expected with… --- ## [Kibana FATAL log](https://discuss.elastic.co/t/kibana-fatal-log/386352)
**Author:** [@blacknight1019](https://discuss.elastic.co/u/blacknight1019)\ **Replies:** 0\ **Last updated:** [May 15, 2026, 2:09am UTC](https://discuss.elastic.co/t/kibana-fatal-log/386352 "2026-05-15T02:09:22Z")
I am currently upgrading my ELK stack from version 8.19.14 to version 9.3.3. After setting up Windows Task Scheduler to start the services automatically, I found that Kibana reports the following error in kibana.log. Ho… --- ## [Filebeat filestream offset mismatch when using include\_message with multiline](https://discuss.elastic.co/t/filebeat-filestream-offset-mismatch-when-using-include-message-with-multiline/386057)
**Author:** [@sem1308](https://discuss.elastic.co/u/sem1308)\ **Replies:** 0\ **Last updated:** [April 27, 2026, 7:26pm UTC](https://discuss.elastic.co/t/filebeat-filestream-offset-mismatch-when-using-include-message-with-multiline/386057 "2026-04-27T19:26:47Z")
Version 8.18.4 Operating System macOS (build & test) Steps to Reproduce 1. Configuration filebeat.inputs: - type: filestream id: filebeat-test paths: - /path/to/log/\* parsers: - include\_message.patterns:… --- ## [Can't create support technical cases](https://discuss.elastic.co/t/cant-create-support-technical-cases/383707)
**Author:** [@isuru-sentry](https://discuss.elastic.co/u/isuru-sentry)\ **Replies:** 0\ **Last updated:** [November 27, 2025, 5:38am UTC](https://discuss.elastic.co/t/cant-create-support-technical-cases/383707 "2025-11-27T05:38:55Z")
I want access to the technical support in Elastic Search. I am Organisational owner but not able to access to the technical support. I have only access to account or billing. --- ## [Elasticsearch Indexing](https://discuss.elastic.co/t/elasticsearch-indexing/386724)
**Author:** [@akmoharana](https://discuss.elastic.co/u/akmoharana)\ **Replies:** 1\ **Last updated:** [June 5, 2026, 7:29am UTC](https://discuss.elastic.co/t/elasticsearch-indexing/386724 "2026-06-05T07:29:33Z")
Hi Team, I am using the ELK stack along with Filebeat for a monitoring project. Currently, Filebeat is collecting logs from a specific directory, and the log files follow a defined naming pattern. We also perform weekl… --- ## [Threat Intelligence View Not Using securitySolution:defaultThreatIndex](https://discuss.elastic.co/t/threat-intelligence-view-not-using-securitysolution-defaultthreatindex/385403)
**Author:** [@logalicious](https://discuss.elastic.co/u/logalicious)\ **Replies:** 1\ **Last updated:** [March 12, 2026, 2:30pm UTC](https://discuss.elastic.co/t/threat-intelligence-view-not-using-securitysolution-defaultthreatindex/385403 "2026-03-12T14:30:00Z")
I am working on developing threat intelligence integrations and have noticed that most integrations use the logs-ti\_\* naming format for both the original index (e.g., logs-ti\_crowdstrike.ioc-default) and the transform de… --- ## [How to apply ILM to ML indices? If not possible what,s the workaround?](https://discuss.elastic.co/t/how-to-apply-ilm-to-ml-indices-if-not-possible-what-s-the-workaround/385310)
**Author:** [@Whoami1980](https://discuss.elastic.co/u/Whoami1980)\ **Replies:** 1\ **Last updated:** [March 3, 2026, 7:31pm UTC](https://discuss.elastic.co/t/how-to-apply-ilm-to-ml-indices-if-not-possible-what-s-the-workaround/385310 "2026-03-03T19:31:37Z")
Understand that ILM cannot be used on ML results indices. ILM is used on the ML state index out-of-the-box. Seems like this is a long open enhancement. \[ML\] Add an ML results index rollover endpoint · Issue #29946 · el… --- ## [Elasticsearch trial license downgraded to basic after pod recreation on Kubernetes](https://discuss.elastic.co/t/elasticsearch-trial-license-downgraded-to-basic-after-pod-recreation-on-kubernetes/384885)
**Author:** [@djeannerod](https://discuss.elastic.co/u/djeannerod)\ **Replies:** 1\ **Last updated:** [February 5, 2026, 4:55pm UTC](https://discuss.elastic.co/t/elasticsearch-trial-license-downgraded-to-basic-after-pod-recreation-on-kubernetes/384885 "2026-02-05T16:55:28Z")
I have deployed a ES stack on Kubernetes with the operator (ECK). Just ES + Kibana, and it is Ok. I’m trying to test some enterprise functions, and activate a trial licence, but elasticsearch reverts to a basic license … --- ## [Elastic Defend Endpoint Protection Complete message](https://discuss.elastic.co/t/elastic-defend-endpoint-protection-complete-message/389934)
**Author:** [@jpedersm](https://discuss.elastic.co/u/jpedersm)\ **Replies:** 0\ **Last updated:** [August 26, 2026, 2:48pm UTC](https://discuss.elastic.co/t/elastic-defend-endpoint-protection-complete-message/389934 "2026-08-26T14:48:20Z")
In a lab, I am trying to make a switch on the settings in Elastic Defend. The default is set to protect and notify on items from Malware to ransomware. When changing the settings from Protect to Detect and disabling no… --- ## [Elastic Agent Go update to v0.52.0](https://discuss.elastic.co/t/elastic-agent-go-update-to-v0-52-0/388334)
**Author:** [@rdmorris1914](https://discuss.elastic.co/u/rdmorris1914)\ **Replies:** 0\ **Last updated:** [July 14, 2026, 2:59pm UTC](https://discuss.elastic.co/t/elastic-agent-go-update-to-v0-52-0/388334 "2026-07-14T14:59:05Z")
There are several CVE's covered in the May 22 release of Go v0.52.0 which are not covered in the latest agent. When will Go be updated? The following CVEs are all present in the Linux Agent 9.4.3: CVE-2026-46595 CVE-20… --- ## [Reading Auth Logs on Mac devices](https://discuss.elastic.co/t/reading-auth-logs-on-mac-devices/385269)
**Author:** [@HaydenB0101](https://discuss.elastic.co/u/HaydenB0101)\ **Replies:** 0\ **Last updated:** [February 27, 2026, 5:19pm UTC](https://discuss.elastic.co/t/reading-auth-logs-on-mac-devices/385269 "2026-02-27T17:19:30Z")
I want to get auth. logs from my mac devices and am struggling to find a working integration to use. I have been using the Custom macOS Unified Logs integration to try and get this data from the devices since it’s the o… --- ## [When using s3-compatible service as inputs, path\_style is un-useful](https://discuss.elastic.co/t/when-using-s3-compatible-service-as-inputs-path-style-is-un-useful/384709)
**Author:** [@luxin88](https://discuss.elastic.co/u/luxin88)\ **Replies:** 0\ **Last updated:** [January 23, 2026, 9:33am UTC](https://discuss.elastic.co/t/when-using-s3-compatible-service-as-inputs-path-style-is-un-useful/384709 "2026-01-23T09:33:30Z")
filebeat: inputs: - type: aws-s3 endpoint: "http://obs.cn-north-4.myhuaweicloud.com" access\_key\_id: "###" secret\_access\_key: "###" non\_aws\_bucket\_name: log-parse path\_style: false … --- ## [Filebeat Bug: journal remote directory unhandled](https://discuss.elastic.co/t/filebeat-bug-journal-remote-directory-unhandled/384467)
**Author:** [@log1](https://discuss.elastic.co/u/log1)\ **Replies:** 0\ **Last updated:** [January 11, 2026, 12:17am UTC](https://discuss.elastic.co/t/filebeat-bug-journal-remote-directory-unhandled/384467 "2026-01-11T00:17:48Z")
Filebeat version: 8.19.9 OS: Debian 13 Documentation here Journald input | Beats, states: For example, this configuration will ingest all journals and correctly handle the journald rotation: - type: journald id: jo… --- ## [Dec 21st, 2025: \[ES\] Investiga tus trazas en Discover con rapidez y claridad](https://discuss.elastic.co/t/dec-21st-2025-es-investiga-tus-trazas-en-discover-con-rapidez-y-claridad/383616)
**Author:** [@irene\_blanco](https://discuss.elastic.co/u/irene_blanco)\ **Replies:** 0\ **Last updated:** [December 21, 2025, 8:00am UTC](https://discuss.elastic.co/t/dec-21st-2025-es-investiga-tus-trazas-en-discover-con-rapidez-y-claridad/383616 "2025-12-21T08:00:30Z")
This post also exists in English. Investiga tus trazas en Discover con rapidez y claridad ¿Problemas con endpoints lentos y no sabes por dónde empezar? Ahora, en Discover, cuando la Solution View del espacio está co… --- ## [Having 2 allocation IDs in in\_sync\_allocations when there are no replicas](https://discuss.elastic.co/t/having-2-allocation-ids-in-in-sync-allocations-when-there-are-no-replicas/385174)
**Author:** [@winter\_crescents](https://discuss.elastic.co/u/winter_crescents)\ **Replies:** 2\ **Last updated:** [February 24, 2026, 10:23am UTC](https://discuss.elastic.co/t/having-2-allocation-ids-in-in-sync-allocations-when-there-are-no-replicas/385174 "2026-02-24T10:23:14Z")
Hi I am facing this issue where I had an index with an initial replication of 1. However, one year ago, due to disk storage issues I reduced the replication to 0. One year later, I now run this operation: GET /\_cluster… --- ## [Kibana: Cannot update rule](https://discuss.elastic.co/t/kibana-cannot-update-rule/382845)
**Author:** [@Cristian\_Pereyra](https://discuss.elastic.co/u/Cristian_Pereyra)\ **Replies:** 2\ **Last updated:** [October 21, 2025, 11:54am UTC](https://discuss.elastic.co/t/kibana-cannot-update-rule/382845 "2025-10-21T11:54:55Z")
Hello everyone, I hope you're doing well. I'm creating a rule of type "Elasticsearch query" that uses a connector to a Python microservice, which then sends an email. The rule works fine. However, when I try to update … --- ## [Kibana 9.5.4 / Node 24 V8Worker triggers Linux kernel NULL pointer dereference and RCU stall](https://discuss.elastic.co/t/kibana-9-5-4-node-24-v8worker-triggers-linux-kernel-null-pointer-dereference-and-rcu-stall/390830)
**Author:** [@Beta](https://discuss.elastic.co/u/Beta)\ **Replies:** 1\ **Last updated:** [October 5, 2026, 1:28pm UTC](https://discuss.elastic.co/t/kibana-9-5-4-node-24-v8worker-triggers-linux-kernel-null-pointer-dereference-and-rcu-stall/390830 "2026-10-05T13:28:48Z")
I'm experiencing a recurring kernel crash on a Debian 13 VM running Kibana 9.5.4 (I have had this issue for a while now and have upgraded Kibana and the Linux kernel multiple times). The crash occurs in the Linux kernel … --- ## [Custom user guide - Link](https://discuss.elastic.co/t/custom-user-guide-link/386104)
**Author:** [@Vignesh2](https://discuss.elastic.co/u/Vignesh2)\ **Replies:** 1\ **Last updated:** [April 30, 2026, 9:37am UTC](https://discuss.elastic.co/t/custom-user-guide-link/386104 "2026-04-30T09:37:53Z")
Hi, I have a custom user guide (PDF) that explains how to use our dashboards, alerts, and other features. I’d like to know if there’s a way to integrate or attach this guide directly within the Kibana UI—something like… --- ## [Autodiscover with filters not working](https://discuss.elastic.co/t/autodiscover-with-filters-not-working/383716)
**Author:** [@kifkoman](https://discuss.elastic.co/u/kifkoman)\ **Replies:** 1\ **Last updated:** [December 1, 2025, 3:42pm UTC](https://discuss.elastic.co/t/autodiscover-with-filters-not-working/383716 "2025-12-01T15:42:40Z")
Hi, I am trying to set filebeat with autodiscover based on labels present in the pod. Below is my config \`\`yaml logging.level: debug logging.selectors: \["autodiscover", "kubernetes", "container"\] filebeat.autodiscov… --- ## [Неработающая политика в Еластик](https://discuss.elastic.co/t/topic/384977)
**Author:** [@nazok123](https://discuss.elastic.co/u/nazok123)\ **Replies:** 0\ **Last updated:** [February 9, 2026, 12:54pm UTC](https://discuss.elastic.co/t/topic/384977 "2026-02-09T12:54:09Z")
Здравствуйте, подскажите, пожалуйста. Есть несколько Agent Policies в Fleet. В некоторых политиках логи не приходят, при этом интеграции настроены идентично рабочим политикам. Если перенести тот же источник (агент) на … --- ## [How to apply logical operators to search query in golang?](https://discuss.elastic.co/t/how-to-apply-logical-operators-to-search-query-in-golang/386536)
**Author:** [@scip](https://discuss.elastic.co/u/scip)\ **Replies:** 2\ **Last updated:** [May 28, 2026, 12:57pm UTC](https://discuss.elastic.co/t/how-to-apply-logical-operators-to-search-query-in-golang/386536 "2026-05-28T12:57:13Z")
Hi, how can I specify if I want a query to use the AND or OR operator? For a SimpleQuery this is easy, just call DefaultOperator(operator.Operator{"AND"}). But how Do I specify this with a BoolQuery? What I found is, t… --- ## [Guidance for running Elastic Defend on ECE hosts](https://discuss.elastic.co/t/guidance-for-running-elastic-defend-on-ece-hosts/385617)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 0\ **Last updated:** [March 25, 2026, 8:48pm UTC](https://discuss.elastic.co/t/guidance-for-running-elastic-defend-on-ece-hosts/385617 "2026-03-25T20:48:11Z")
Hello, Is it supported to run Elastic Agent with the Defend integration (ofc first in detect mode initially) on ECE hosts? Should we configure Trusted Applications? If so, which ones? Best regards, Willem --- ## [Cryptic error trying to test a PROD-ready query proxy](https://discuss.elastic.co/t/cryptic-error-trying-to-test-a-prod-ready-query-proxy/385029)
**Author:** [@DaManDOH](https://discuss.elastic.co/u/DaManDOH)\ **Replies:** 0\ **Last updated:** [February 12, 2026, 9:45pm UTC](https://discuss.elastic.co/t/cryptic-error-trying-to-test-a-prod-ready-query-proxy/385029 "2026-02-12T21:45:29Z")
Greetings again, Stretchy-lookers! I’ve run into a problem trying to derive my use case from the following tutorial: Note: I’m not looking to do any User Behavior Insights (UBI), so I’ve trimmed the example down a lo… --- ## [Kibana error](https://discuss.elastic.co/t/kibana-error/390521)
**Author:** [@vanhung0709](https://discuss.elastic.co/u/vanhung0709)\ **Replies:** 1\ **Last updated:** [September 18, 2026, 4:17am UTC](https://discuss.elastic.co/t/kibana-error/390521 "2026-09-18T04:17:51Z")
I have set up elasticsearch and kibana. All steps have been done. Although i can curl es from kibana pod, kibana doesn’t put request to create index .kibana. When searching logs in pod kibana, it loop curl get nodes, but… --- ## [Discover fails with "content length bigger than max allowed string" on index with large text field](https://discuss.elastic.co/t/discover-fails-with-content-length-bigger-than-max-allowed-string-on-index-with-large-text-field/388911)
**Author:** [@Mouly\_Infy](https://discuss.elastic.co/u/Mouly_Infy)\ **Replies:** 1\ **Last updated:** [July 30, 2026, 5:23pm UTC](https://discuss.elastic.co/t/discover-fails-with-content-length-bigger-than-max-allowed-string-on-index-with-large-text-field/388911 "2026-07-30T17:23:27Z")
Hello Connections, We're facing an issue when trying to retrieve documents in Discover, and wanted to get community input on the best long-term fix. Environment: Elastic Stack version: \[8.19.3\] Deployment: self-manag… [Previous page](https://discuss.elastic.co/top.md?page=23&per_page=50) [Next page](https://discuss.elastic.co/top.md?page=25&per_page=50)