# Top **URL:** https://discuss.elastic.co/top.md?page=248&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 249 --- ## [Shard Reallocation While Indexing](https://discuss.elastic.co/t/shard-reallocation-while-indexing/380779)
**Author:** [@nchalise](https://discuss.elastic.co/u/nchalise)\ **Replies:** 14\ **Last updated:** [August 6, 2025, 6:29pm UTC](https://discuss.elastic.co/t/shard-reallocation-while-indexing/380779 "2025-08-06T18:29:30Z")
We have 20 indexes with 490 shards. The shards size are vary from 35GB to 180GB and the ES cluster size is 35 data nodes. Each data node has 5 disk each disk has size 500GB. While indexing we noticed that shards are star… --- ## [Courses on Elastic.Clients.Elasticsearch](https://discuss.elastic.co/t/courses-on-elastic-clients-elasticsearch/386125)
**Author:** [@xef](https://discuss.elastic.co/u/xef)\ **Replies:** 12\ **Last updated:** [June 15, 2026, 1:27pm UTC](https://discuss.elastic.co/t/courses-on-elastic-clients-elasticsearch/386125 "2026-06-15T13:27:55Z")
We need to upgrade from NEST to the new API and are DESPARATELY looking for courses (paid or unpaid) to guide us through this process. Can anyone help? Thanks --- ## [Elastic-agent output connection refuse error while setting up mutual TLS for fleet](https://discuss.elastic.co/t/elastic-agent-output-connection-refuse-error-while-setting-up-mutual-tls-for-fleet/380497)
**Author:** [@jack\_a](https://discuss.elastic.co/u/jack_a)\ **Replies:** 10\ **Last updated:** [August 9, 2025, 6:00am UTC](https://discuss.elastic.co/t/elastic-agent-output-connection-refuse-error-while-setting-up-mutual-tls-for-fleet/380497 "2025-08-09T06:00:21Z")
First let me start by explaining what i am trying to achieve. I have a cluster of 3 nodes (kibana is also installed on the same VM with one of the nodes) -each of 3 nodes have all the roles- with mutual TLS between clust… --- ## [Are the Self Signed Certs bound by IP / Hostname](https://discuss.elastic.co/t/are-the-self-signed-certs-bound-by-ip-hostname/377147)
**Author:** [@Umang\_Pachaury](https://discuss.elastic.co/u/Umang_Pachaury)\ **Replies:** 11\ **Last updated:** [April 21, 2025, 11:23pm UTC](https://discuss.elastic.co/t/are-the-self-signed-certs-bound-by-ip-hostname/377147 "2025-04-21T23:23:17Z")
Hi, We have a cluster in which we have enabled TLS security. To enable the security we used the elastic cert utility to generate the cert and CA. While generation of the certs or the CA any of the prompts did not ask us… --- ## [GeoIP - Elasticsearch](https://discuss.elastic.co/t/geoip-elasticsearch/363035)
**Author:** [@DFIR\_Cap](https://discuss.elastic.co/u/DFIR_Cap)\ **Replies:** 10\ **Last updated:** [July 12, 2024, 2:18pm UTC](https://discuss.elastic.co/t/geoip-elasticsearch/363035 "2024-07-12T14:18:55Z")
Hi: I have an Elasticsearch installed in Ubuntu. What are the proper steps to setup Geoip so that every time I ingest data it is enriched with geolocation data? Thanks --- ## [Logstash error Cpu.cfs\_period\_us cannot be found](https://discuss.elastic.co/t/logstash-error-cpu-cfs-period-us-cannot-be-found/349515)
**Author:** [@Lena\_Yoon](https://discuss.elastic.co/u/Lena_Yoon)\ **Replies:** 9\ **Last updated:** [December 18, 2023, 11:43am UTC](https://discuss.elastic.co/t/logstash-error-cpu-cfs-period-us-cannot-be-found/349515 "2023-12-18T11:43:11Z")
Hello, I have been working with Logstash this week but stuck with below error. The error occurs when retrieving data from Oracle DB using the JDBC input plugin, filtering it in the pipeline, and despite the index being… --- ## [Field remapping for backward compatibility](https://discuss.elastic.co/t/field-remapping-for-backward-compatibility/376209)
**Author:** [@davetayl](https://discuss.elastic.co/u/davetayl)\ **Replies:** 15\ **Last updated:** [March 24, 2025, 4:43am UTC](https://discuss.elastic.co/t/field-remapping-for-backward-compatibility/376209 "2025-03-24T04:43:20Z")
I have an environment that is a bit older, ES7.7.3, LS6.8.23 and FB6.8.23 all working correctly with the older OS versions the client is using. As part of a new build we need to upgrade the FB version to 8.17 if possible… --- ## [Create snapshot](https://discuss.elastic.co/t/create-snapshot/363915)
**Author:** [@dsagent](https://discuss.elastic.co/u/dsagent)\ **Replies:** 15\ **Last updated:** [July 28, 2024, 5:49pm UTC](https://discuss.elastic.co/t/create-snapshot/363915 "2024-07-28T17:49:03Z")
I have a node1, node2, node3 contract in several places and I want to make a snapshot of a specific indicator that is available for example in node2 I made the path.repo in the configuration file for each node and when… --- ## [Ctrl+F search behavior in elastic](https://discuss.elastic.co/t/ctrl-f-search-behavior-in-elastic/371028)
**Author:** [@Arie\_Youlus](https://discuss.elastic.co/u/Arie_Youlus)\ **Replies:** 17\ **Last updated:** [November 26, 2024, 5:24pm UTC](https://discuss.elastic.co/t/ctrl-f-search-behavior-in-elastic/371028 "2024-11-26T17:24:55Z")
We are aiming to implement a naive search in Elasticsearch that functions exactly like a Ctrl+F search. Specifically, a query like "rd1 wo" should match "word1 word2" because it is a partial match in sequence. The searc… --- ## [Next APM Agent?](https://discuss.elastic.co/t/next-apm-agent/99900)
**Author:** [@kseneker](https://discuss.elastic.co/u/kseneker)\ **Replies:** 5\ **Last updated:** [October 18, 2017, 6:53am UTC](https://discuss.elastic.co/t/next-apm-agent/99900 "2017-10-18T06:53:52Z")
Based on the announcement thread, I'd like to pose a question to the Elastic community about which languages they'd like to see an APM agent created for next (currently only Node.JS and Python are in the works). Please … --- ## [Elasticsearch's Docuements count dosen't match the exact number of input log lines](https://discuss.elastic.co/t/elasticsearchs-docuements-count-dosent-match-the-exact-number-of-input-log-lines/348217)
**Author:** [@Dokh\_Ahmed](https://discuss.elastic.co/u/Dokh_Ahmed)\ **Replies:** 9\ **Last updated:** [November 29, 2023, 3:01pm UTC](https://discuss.elastic.co/t/elasticsearchs-docuements-count-dosent-match-the-exact-number-of-input-log-lines/348217 "2023-11-29T15:01:30Z")
have a log file containing 2044 lines, but after indexing into Elasticsearch using Logstash, I find only 2043 documents. I suspect that an empty line in the log file might have been skipped by Logstash during indexing. I… --- ## [Kibana memory consumption growing linearly until it crashes](https://discuss.elastic.co/t/kibana-memory-consumption-growing-linearly-until-it-crashes/383618)
**Author:** [@Fabio\_Hecht](https://discuss.elastic.co/u/Fabio_Hecht)\ **Replies:** 14\ **Last updated:** [December 17, 2025, 7:23am UTC](https://discuss.elastic.co/t/kibana-memory-consumption-growing-linearly-until-it-crashes/383618 "2025-12-17T07:23:24Z")
Hi there! I have an issue with a simple Elastic / Kibana deployment on OpenShift. Even with no data being ingested in Elastic and virtually no users (just me testing), Kibana’s memory consumption grows linearly until the… --- ## [Unable to delete added search to kibana dashboard](https://discuss.elastic.co/t/unable-to-delete-added-search-to-kibana-dashboard/377043)
**Author:** [@vahagg1](https://discuss.elastic.co/u/vahagg1)\ **Replies:** 12\ **Last updated:** [April 18, 2025, 10:09am UTC](https://discuss.elastic.co/t/unable-to-delete-added-search-to-kibana-dashboard/377043 "2025-04-18T10:09:54Z")
Using Kibana version 8.17.3 and added a search result to the one of my dashboard but currently want to remove the search from dashboard which is not possible there is a one pencil logo which goes to Discover to do some e… --- ## [Duplicate records in Elasticsearch](https://discuss.elastic.co/t/duplicate-records-in-elasticsearch/380625)
**Author:** [@SamehSaeed](https://discuss.elastic.co/u/SamehSaeed)\ **Replies:** 12\ **Last updated:** [August 10, 2025, 11:31am UTC](https://discuss.elastic.co/t/duplicate-records-in-elasticsearch/380625 "2025-08-10T11:31:09Z")
Hello I'm facing an issue with duplicate records in my index on rollover. I thought using rollover alias would let only one index to be "write" index which is supposed to not let any batch of records being indexed t… --- ## [Logtssh Grok for Cisco ISE](https://discuss.elastic.co/t/logtssh-grok-for-cisco-ise/382057)
**Author:** [@Elk\_huh](https://discuss.elastic.co/u/Elk_huh)\ **Replies:** 11\ **Last updated:** [October 16, 2025, 10:59am UTC](https://discuss.elastic.co/t/logtssh-grok-for-cisco-ise/382057 "2025-10-16T10:59:32Z")
I have this Filter and its not parsing correctly , filter { match =\> { "message" =\> "\<%{INT:syslog\_pri}\>%{SYSLOGTIMESTAMP:syslog\_ts} %{HOSTNAME:host} %{WORD:module} %{INT:session\_id} %{INT:severity} %{INT:msg\_i… --- ## [Field \_size on data stream](https://discuss.elastic.co/t/field-size-on-data-stream/384982)
**Author:** [@Cristina\_Marletta\_Li](https://discuss.elastic.co/u/Cristina_Marletta_Li)\ **Replies:** 15\ **Last updated:** [February 18, 2026, 10:18am UTC](https://discuss.elastic.co/t/field-size-on-data-stream/384982 "2026-02-18T10:18:30Z")
Hi,I'd like to set the \_size field on a data stream associated with an integration. How can I do this? The data stream has a custom index template associated with it: GET \_index\_template/logs-thales\_udp.log-custom { "… --- ## [Is it correct to response to HEAD req from elastic API with empty "transfer-encoding: chunked"?](https://discuss.elastic.co/t/is-it-correct-to-response-to-head-req-from-elastic-api-with-empty-transfer-encoding-chunked/372941)
**Author:** [@pencakj](https://discuss.elastic.co/u/pencakj)\ **Replies:** 14\ **Last updated:** [January 30, 2025, 8:07am UTC](https://discuss.elastic.co/t/is-it-correct-to-response-to-head-req-from-elastic-api-with-empty-transfer-encoding-chunked/372941 "2025-01-30T08:07:24Z")
Hello, we're troubleshooting issue in communication between client and elastic 8.13 in between with HAProxy. Is it correct to response to HEAD request with EMPTY "transfer-encoding: chunked"? In other words - to HEAD re… --- ## [Grok pattern](https://discuss.elastic.co/t/grok-pattern/375613)
**Author:** [@arcsons](https://discuss.elastic.co/u/arcsons)\ **Replies:** 9\ **Last updated:** [March 14, 2025, 8:17am UTC](https://discuss.elastic.co/t/grok-pattern/375613 "2025-03-14T08:17:46Z")
Hello everyone, I have an error in my logs. I have created a grok pattern and added it to the agent policy, but it still doesn't work. I have tested the grok pattern with just a few fields \<%{NUMBER:syslog\_pri}\>%… --- ## [Property \[name\] is missing for plugin \[plugin-descriptor.properties\] while starting](https://discuss.elastic.co/t/property-name-is-missing-for-plugin-plugin-descriptor-properties-while-starting/370525)
**Author:** [@AlexeiKlimenko](https://discuss.elastic.co/u/AlexeiKlimenko)\ **Replies:** 11\ **Last updated:** [November 14, 2024, 2:36pm UTC](https://discuss.elastic.co/t/property-name-is-missing-for-plugin-plugin-descriptor-properties-while-starting/370525 "2024-11-14T14:36:09Z")
Hello. Installed ES ii elasticsearch 8.15.2 amd64 Distributed RESTful search engine built for the cloud When configured as a first node for future cluster: cluster.name: … --- ## [Read performance issues for index using parent child relationship](https://discuss.elastic.co/t/read-performance-issues-for-index-using-parent-child-relationship/365693)
**Author:** [@Neha\_Agarwal1](https://discuss.elastic.co/u/Neha_Agarwal1)\ **Replies:** 9\ **Last updated:** [August 29, 2024, 7:23am UTC](https://discuss.elastic.co/t/read-performance-issues-for-index-using-parent-child-relationship/365693 "2024-08-29T07:23:21Z")
The index uses parent child relationship. On an average a parent can have 2 children. Worst case is 10 children.All fields are indexed. Whenever we have a query that uses "has\_child" or "has\_parent" the query takes mi… --- ## [Conditional processing of "date" processor when empty value](https://discuss.elastic.co/t/conditional-processing-of-date-processor-when-empty-value/366418)
**Author:** [@zebu14](https://discuss.elastic.co/u/zebu14)\ **Replies:** 10\ **Last updated:** [September 18, 2024, 12:51pm UTC](https://discuss.elastic.co/t/conditional-processing-of-date-processor-when-empty-value/366418 "2024-09-18T12:51:54Z")
Hello, My logs are parsed with a dissect processor which works flawlessly. Then I have some processors to enrich my data. One of these processors is a "date" on a field calle "date\_begin" which takes a string value an… --- ## [Trouble syncing from Confluence connector](https://discuss.elastic.co/t/trouble-syncing-from-confluence-connector/371421)
**Author:** [@robert.bonagura](https://discuss.elastic.co/u/robert.bonagura)\ **Replies:** 10\ **Last updated:** [December 5, 2024, 9:20pm UTC](https://discuss.elastic.co/t/trouble-syncing-from-confluence-connector/371421 "2024-12-05T21:20:27Z")
Hello, I just did a make clean install and run using Elasticsearch 8.16.1 and am running into issues syncing from Confluence Cloud. this is what my local running make run returned: \[FMWK\]\[20:34:58\]\[INFO\] \[Connector id:… --- ## [Not able to read the data from external json file in logstash config](https://discuss.elastic.co/t/not-able-to-read-the-data-from-external-json-file-in-logstash-config/349257)
**Author:** [@subash\_k](https://discuss.elastic.co/u/subash_k)\ **Replies:** 10\ **Last updated:** [December 14, 2023, 1:26pm UTC](https://discuss.elastic.co/t/not-able-to-read-the-data-from-external-json-file-in-logstash-config/349257 "2023-12-14T13:26:32Z")
I'm trying to search the host value from current event and looking for same value in json file. If Json block has the host value I'm just converting the block into struct value and inserting as a new column in index. ou… --- ## [Parent data too large?](https://discuss.elastic.co/t/parent-data-too-large/385254)
**Author:** [@linkerc](https://discuss.elastic.co/u/linkerc)\ **Replies:** 12\ **Last updated:** [March 5, 2026, 10:21am UTC](https://discuss.elastic.co/t/parent-data-too-large/385254 "2026-03-05T10:21:45Z")
I am getting the below error on a shard assignment. org.elasticsearch.common.breaker.CircuitBreakingException: \[parent\] Data too large, data for \[internal:index/shard/recovery/translog\_ops\] would be \[28701173408/26.7gb\]… --- ## [LOGSTASH - wrong pipeline processor Pipeline](https://discuss.elastic.co/t/logstash-wrong-pipeline-processor-pipeline/376423)
**Author:** [@Echo\_01](https://discuss.elastic.co/u/Echo_01)\ **Replies:** 11\ **Last updated:** [April 2, 2025, 2:27pm UTC](https://discuss.elastic.co/t/logstash-wrong-pipeline-processor-pipeline/376423 "2025-04-02T14:27:32Z")
Having update a three node Elasticsearch cluster from 8.12.1 to 8.17.3 Logstash is generating error logs containing the following: , :error=\>{"type"=\>"illegal\_state\_exception", "reason"=\>"Pipeline processor configured f… --- ## [Moving From 1.7.5 to 7.10.2 - DLS Changes](https://discuss.elastic.co/t/moving-from-1-7-5-to-7-10-2-dls-changes/362235)
**Author:** [@djfrodo](https://discuss.elastic.co/u/djfrodo)\ **Replies:** 13\ **Last updated:** [June 29, 2024, 1:42am UTC](https://discuss.elastic.co/t/moving-from-1-7-5-to-7-10-2-dls-changes/362235 "2024-06-29T01:42:07Z")
I've used an ancient (1.7.5) version of Elasticsearch for years and it's been great. The initial setup was a bit difficult, but when completed it has always been rock solid. Unfortunately my Elasticsearch provider wants… --- ## [Kibana does not load in brower](https://discuss.elastic.co/t/kibana-does-not-load-in-brower/385546)
**Author:** [@riahc3](https://discuss.elastic.co/u/riahc3)\ **Replies:** 9\ **Last updated:** [May 12, 2026, 2:00pm UTC](https://discuss.elastic.co/t/kibana-does-not-load-in-brower/385546 "2026-05-12T14:00:17Z")
Hello I upgraded Kibana 8 to 9 (obviously everything else) but it does not load in my browser. I see this in the logs: tail -f /data/kibana/logs/kibana.log | jq { "service": { "node": { "roles": \[ "background\_tasks… --- ## [Porter stem applying stemmer](https://discuss.elastic.co/t/porter-stem-applying-stemmer/358177)
**Author:** [@Mohan\_T](https://discuss.elastic.co/u/Mohan_T)\ **Replies:** 9\ **Last updated:** [May 3, 2024, 7:17am UTC](https://discuss.elastic.co/t/porter-stem-applying-stemmer/358177 "2024-05-03T07:17:27Z")
Porter stem gives the result below. Keyword: 1. hospital 2. hospitality in \_analyze { "tokenizer": "standard", "filter": \[ "porter\_stem" \], "text": "hospitality" } an getting the result as b… --- ## [Exact match Query: ex: When I am trying to search for marble flooring the following matches should be fetched](https://discuss.elastic.co/t/exact-match-query-ex-when-i-am-trying-to-search-for-marble-flooring-the-following-matches-should-be-fetched/352589)
**Author:** [@Mohan\_T](https://discuss.elastic.co/u/Mohan_T)\ **Replies:** 9\ **Last updated:** [February 6, 2024, 11:54am UTC](https://discuss.elastic.co/t/exact-match-query-ex-when-i-am-trying-to-search-for-marble-flooring-the-following-matches-should-be-fetched/352589 "2024-02-06T11:54:39Z")
When I am trying to search for marble flooring the following matches should be fetched marble flooring marbles flooring flooring marble flooring marbles marble floor marbles floor marble marbles flooring floor { "si… --- ## [Logstash Java Errors](https://discuss.elastic.co/t/logstash-java-errors/368038)
**Author:** [@dfir](https://discuss.elastic.co/u/dfir)\ **Replies:** 12\ **Last updated:** [October 17, 2024, 5:20pm UTC](https://discuss.elastic.co/t/logstash-java-errors/368038 "2024-10-17T17:20:46Z")
HI All: Is anyone familiar with the below logstash error? I am trying to run a basic Combined apache log GROK Filter. match =\> { "message" =\> "%{COMBINEDAPACHELOG}" } \[2024-09-30T20:13:10,962\]\[WARN \]\[filewatch.readmo… --- ## [Standalone Elastic Agent Winlog System Input](https://discuss.elastic.co/t/standalone-elastic-agent-winlog-system-input/381693)
**Author:** [@s.buksa](https://discuss.elastic.co/u/s.buksa)\ **Replies:** 11\ **Last updated:** [September 7, 2025, 11:10pm UTC](https://discuss.elastic.co/t/standalone-elastic-agent-winlog-system-input/381693 "2025-09-07T23:10:38Z")
I am trying to collect System logs from Windows Servers with Standalone Elastic Agent. While necessary System logs are being correctly picked up and indexed into Elasticsearch with Winlogbeat, Elastic Agent causes some i… --- ## [Logstash not parsing eventhub logs](https://discuss.elastic.co/t/logstash-not-parsing-eventhub-logs/366816)
**Author:** [@vaibhavu](https://discuss.elastic.co/u/vaibhavu)\ **Replies:** 10\ **Last updated:** [October 9, 2024, 6:16am UTC](https://discuss.elastic.co/t/logstash-not-parsing-eventhub-logs/366816 "2024-10-09T06:16:59Z")
Hi Everyone , I am working on parsing the logs from Azure eventhub to Elasticsearch and trying to use logstash filter for this but getting \_jsonparsing error for the logs. the logs structure is someting like below: {"… --- ## [Logstash.outputs.elasticsearch - Failed to perform request: Connection refused](https://discuss.elastic.co/t/logstash-outputs-elasticsearch-failed-to-perform-request-connection-refused/385421)
**Author:** [@JimJ](https://discuss.elastic.co/u/JimJ)\ **Replies:** 11\ **Last updated:** [March 20, 2026, 1:25pm UTC](https://discuss.elastic.co/t/logstash-outputs-elasticsearch-failed-to-perform-request-connection-refused/385421 "2026-03-20T13:25:13Z")
I am using an on-prem 8.11.3 elastic+logstash stack. logstash uses elasticsearch output plugin to post events to elastic. current set-up uses 2 servers. elasticsearch { hosts =\> \[ "srv1:9200", "srv2:9200" \] data\_str… --- ## [Enabling ILM for indices created by UPSERT logstash pipeline](https://discuss.elastic.co/t/enabling-ilm-for-indices-created-by-upsert-logstash-pipeline/364104)
**Author:** [@Souvik\_Das](https://discuss.elastic.co/u/Souvik_Das)\ **Replies:** 11\ **Last updated:** [August 6, 2024, 6:10am UTC](https://discuss.elastic.co/t/enabling-ilm-for-indices-created-by-upsert-logstash-pipeline/364104 "2024-08-06T06:10:07Z")
Hi Folks, I need your guidance on the following scenario for ILM Policy implementation - There is a data source for which I am using the UPSERT logstash pipeline because the documents need to be updated based on the tr… --- ## [5.6 License time testing/running out](https://discuss.elastic.co/t/5-6-license-time-testing-running-out/366677)
**Author:** [@Chenko](https://discuss.elastic.co/u/Chenko)\ **Replies:** 10\ **Last updated:** [September 20, 2024, 9:49am UTC](https://discuss.elastic.co/t/5-6-license-time-testing-running-out/366677 "2024-09-20T09:49:43Z")
Hello, I want to test what happens when my license runs out on 5.6. We currently have a prospect whose license will run out soon so I thought a good way to simulate this was to locally set up an Elastic 5.6 environment… --- ## [ILM problem](https://discuss.elastic.co/t/ilm-problem/373646)
**Author:** [@Mehran\_Noorani](https://discuss.elastic.co/u/Mehran_Noorani)\ **Replies:** 12\ **Last updated:** [January 26, 2025, 1:06am UTC](https://discuss.elastic.co/t/ilm-problem/373646 "2025-01-26T01:06:30Z")
hello all . I'm using ELK 8.17.1 and have ILM configured with a Hot phase. my problem is : my policy : name = policy\_ipas age = 2min size = 5mb and my indexes : also index2 : No logs are thrown inside it. ===… --- ## [DB mapping list fliter](https://discuss.elastic.co/t/db-mapping-list-fliter/359932)
**Author:** [@bp365d](https://discuss.elastic.co/u/bp365d)\ **Replies:** 12\ **Last updated:** [May 22, 2024, 11:08am UTC](https://discuss.elastic.co/t/db-mapping-list-fliter/359932 "2024-05-22T11:08:36Z")
Team- can you help me in filter sections code, index name is :-esp\_test. input is sql table(esp\_details) and field names are hostname , BDS\_name. hostname BDS\_name --------------------------------------- hostnam… --- ## [Azure snapshot error: Unable to find client with name \[abc\]](https://discuss.elastic.co/t/azure-snapshot-error-unable-to-find-client-with-name-abc/364231)
**Author:** [@pjd](https://discuss.elastic.co/u/pjd)\ **Replies:** 9\ **Last updated:** [August 8, 2024, 7:45pm UTC](https://discuss.elastic.co/t/azure-snapshot-error-unable-to-find-client-with-name-abc/364231 "2024-08-08T19:45:27Z")
Running elasticsearch as a kubernetes pod. Here are the steps followed. added keystore entries ./bin/elasticsearch-keystore add azure.client.default.account ./bin/elasticsearch-keystore add azure.client.default.key … --- ## [APM FileSystemAlreadyExistsException](https://discuss.elastic.co/t/apm-filesystemalreadyexistsexception/381337)
**Author:** [@jrf](https://discuss.elastic.co/u/jrf)\ **Replies:** 9\ **Last updated:** [September 3, 2025, 9:09am UTC](https://discuss.elastic.co/t/apm-filesystemalreadyexistsexception/381337 "2025-09-03T09:09:50Z")
APM Server version: 8.18.2 APM Agent language and version: Java 1.55.0 Is there anything special in your setup? This is a Scala application running on Kubernetes with embedded Jetty server. Entrypoint for the container… --- ## [\_DataId Health Monitoring](https://discuss.elastic.co/t/dataid-health-monitoring/385914)
**Author:** [@saratsekhar](https://discuss.elastic.co/u/saratsekhar)\ **Replies:** 12\ **Last updated:** [April 22, 2026, 6:45am UTC](https://discuss.elastic.co/t/dataid-health-monitoring/385914 "2026-04-22T06:45:46Z")
Looking to build a logic which alerts whenever there is a log stoppage detected on Elastic through \_dataId. I appreciate any suggestions here. --- ## [Pipeline with id \[packetbeat-8.15.2-routing\] does not exist, dropping event!](https://discuss.elastic.co/t/pipeline-with-id-packetbeat-8-15-2-routing-does-not-exist-dropping-event/368135)
**Author:** [@jimB100](https://discuss.elastic.co/u/jimB100)\ **Replies:** 11\ **Last updated:** [October 4, 2024, 1:14pm UTC](https://discuss.elastic.co/t/pipeline-with-id-packetbeat-8-15-2-routing-does-not-exist-dropping-event/368135 "2024-10-04T13:14:34Z")
Hi, I'm testing out packetbeat to ship dns data to our self-hosted elastic server, I have tried version x64 windows 8.15.2 and 8.15.0 and neither version created the routing pipeline {"log.level":"warn","@timestamp":"20… --- ## [Logstash - %{+YYYY} returns a year two years behind around year boundary – how is this possible?](https://discuss.elastic.co/t/logstash-yyyy-returns-a-year-two-years-behind-around-year-boundary-how-is-this-possible/384359)
**Author:** [@josh\_tran](https://discuss.elastic.co/u/josh_tran)\ **Replies:** 12\ **Last updated:** [January 15, 2026, 9:46am UTC](https://discuss.elastic.co/t/logstash-yyyy-returns-a-year-two-years-behind-around-year-boundary-how-is-this-possible/384359 "2026-01-15T09:46:00Z")
I have a Logstash pipeline where I build a timestamp string manually and then parse it into event.timestamp because we do not have a year value in the log message, there are just day and month in the file name. Environm… --- ## [Ingest Azure Siginin logs array of json object using http\_poller](https://discuss.elastic.co/t/ingest-azure-siginin-logs-array-of-json-object-using-http-poller/375720)
**Author:** [@O\_O\_O](https://discuss.elastic.co/u/O_O_O)\ **Replies:** 10\ **Last updated:** [March 11, 2025, 8:30pm UTC](https://discuss.elastic.co/t/ingest-azure-siginin-logs-array-of-json-object-using-http-poller/375720 "2025-03-11T20:30:48Z")
I am trying to use the logstash http\_poller input plugin to ingest Azure Signin Logs (without an eventhub), then pass each document to logs-azure.signinlogs-1.22.0 ingest pipeline for proper parsing. My current logstash… --- ## [How do I migrate Elasticsearch Data Nodes by Moving Virtual Disks Between VMs](https://discuss.elastic.co/t/how-do-i-migrate-elasticsearch-data-nodes-by-moving-virtual-disks-between-vms/379539)
**Author:** [@KimuDesign](https://discuss.elastic.co/u/KimuDesign)\ **Replies:** 9\ **Last updated:** [August 7, 2025, 1:06pm UTC](https://discuss.elastic.co/t/how-do-i-migrate-elasticsearch-data-nodes-by-moving-virtual-disks-between-vms/379539 "2025-08-07T13:06:24Z")
Hi all, I have a production Elasticsearch cluster v 7.10.2 with 4 data nodes and 3 master nodes. Most of our indices have 4 shards and 1 replica. We perform a rollup of indices nightly at 3 AM. I’m planning to migrate … --- ## [Advanced Watcher to send alert of condition has been met for more than 1 hour](https://discuss.elastic.co/t/advanced-watcher-to-send-alert-of-condition-has-been-met-for-more-than-1-hour/349247)
**Author:** [@ChrisKelly](https://discuss.elastic.co/u/ChrisKelly)\ **Replies:** 9\ **Last updated:** [December 14, 2023, 1:08pm UTC](https://discuss.elastic.co/t/advanced-watcher-to-send-alert-of-condition-has-been-met-for-more-than-1-hour/349247 "2023-12-14T13:08:02Z")
I want to create an advanced Watcher that will only send an alert email out if my conditions have been met more over an hour. Essentially, I am monitoring specific servers and watching if their CPU exceeds 50%. If it go… --- ## [Fleet server enrolllment error](https://discuss.elastic.co/t/fleet-server-enrolllment-error/379047)
**Author:** [@nerd](https://discuss.elastic.co/u/nerd)\ **Replies:** 10\ **Last updated:** [June 10, 2025, 7:21pm UTC](https://discuss.elastic.co/t/fleet-server-enrolllment-error/379047 "2025-06-10T19:21:52Z")
Hey team am getting stuck on enrollment of fleet server am trying hard to debug but am get EOF and later --- ## [Enable Geo data in kibana without Logstash?](https://discuss.elastic.co/t/enable-geo-data-in-kibana-without-logstash/372818)
**Author:** [@elastirroot](https://discuss.elastic.co/u/elastirroot)\ **Replies:** 10\ **Last updated:** [January 6, 2025, 3:48am UTC](https://discuss.elastic.co/t/enable-geo-data-in-kibana-without-logstash/372818 "2025-01-06T03:48:49Z")
I found this tutorial regarding how to configure logstash to include geo data. But per what I was recommended, to try filebeat directly to Elasticsearch which is now working for my new setup, I do not have Logstash. I… --- ## [Ecs metrics](https://discuss.elastic.co/t/ecs-metrics/371727)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 17\ **Last updated:** [December 17, 2024, 10:41pm UTC](https://discuss.elastic.co/t/ecs-metrics/371727 "2024-12-17T22:41:39Z")
I have a metricbeat running on one place which is generating following metrics host.network.ingress.bytes but at different place (same version metricbeat) but different elastic cluster is not producting this metric. Ho… --- ## [Not all logs from strongswan available](https://discuss.elastic.co/t/not-all-logs-from-strongswan-available/387402)
**Author:** [@leprovokateur](https://discuss.elastic.co/u/leprovokateur)\ **Replies:** 11\ **Last updated:** [July 1, 2026, 9:58am UTC](https://discuss.elastic.co/t/not-all-logs-from-strongswan-available/387402 "2026-07-01T09:58:49Z")
Hi, I have StrongSwan installed on a debian 13 machine. The logs are written to the journal. I use elastic-agent in version 9.3.3 trying to read this logs, the stack is in version 9.3.3, too. journalctl -u strongswan sh… --- ## [Filebeats creating duplicates on SMB logfile sources](https://discuss.elastic.co/t/filebeats-creating-duplicates-on-smb-logfile-sources/370800)
**Author:** [@j.koopmann](https://discuss.elastic.co/u/j.koopmann)\ **Replies:** 12\ **Last updated:** [December 11, 2024, 4:19pm UTC](https://discuss.elastic.co/t/filebeats-creating-duplicates-on-smb-logfile-sources/370800 "2024-12-11T16:19:26Z")
Hi, I am faced with this challenge. The logfiles I want to watch with filebeats and then send to graylog are accessible via a SMB mount only. I already mounted with cache=none,actimeo=0 What I am seeing is that when t… [Previous page](https://discuss.elastic.co/top.md?page=247&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=249&per_page=50&period=all)