# Top **URL:** https://discuss.elastic.co/top.md?page=249&period=all [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 250 --- ## [Long-term snapshot compatibility across major versions (10+ year archive use case)](https://discuss.elastic.co/t/long-term-snapshot-compatibility-across-major-versions-10-year-archive-use-case/385068)
**Author:** [@jiriNovotny](https://discuss.elastic.co/u/jiriNovotny)\ **Replies:** 9\ **Last updated:** [February 16, 2026, 8:01pm UTC](https://discuss.elastic.co/t/long-term-snapshot-compatibility-across-major-versions-10-year-archive-use-case/385068 "2026-02-16T20:01:31Z")
Hello, I’m looking for clarification regarding the functionality described in the documentation about reading indices from older Elasticsearch versions: Currently, our process is as follows: We store indices as sna… --- ## [How do i get AWS cloudwatch metrics to elastic for serverless](https://discuss.elastic.co/t/how-do-i-get-aws-cloudwatch-metrics-to-elastic-for-serverless/372669)
**Author:** [@rpeynado1](https://discuss.elastic.co/u/rpeynado1)\ **Replies:** 9\ **Last updated:** [January 8, 2025, 5:26pm UTC](https://discuss.elastic.co/t/how-do-i-get-aws-cloudwatch-metrics-to-elastic-for-serverless/372669 "2025-01-08T17:26:51Z")
Hello, I am trying to push cloudwatch metrics via sqs to elastic. How do i go about doing this? these are for multiple servers and serverless applications --- ## [Fortigate Integration - Separation of logs datastream based on a field value](https://discuss.elastic.co/t/fortigate-integration-separation-of-logs-datastream-based-on-a-field-value/380767)
**Author:** [@Knight7](https://discuss.elastic.co/u/Knight7)\ **Replies:** 10\ **Last updated:** [August 6, 2025, 7:10pm UTC](https://discuss.elastic.co/t/fortigate-integration-separation-of-logs-datastream-based-on-a-field-value/380767 "2025-08-06T19:10:38Z")
Hello, We have integrated Fortinet Fortigate Firewall logs to our SIEM ELK using the Elastic Agent integration. We created also a custom ingest pipeline that separates the logs (for example forward) and send them to a d… --- ## [Can not modify my fleet server and agent configuration on ECK](https://discuss.elastic.co/t/can-not-modify-my-fleet-server-and-agent-configuration-on-eck/384265)
**Author:** [@NiceAgent](https://discuss.elastic.co/u/NiceAgent)\ **Replies:** 12\ **Last updated:** [December 30, 2025, 3:42am UTC](https://discuss.elastic.co/t/can-not-modify-my-fleet-server-and-agent-configuration-on-eck/384265 "2025-12-30T03:42:12Z")
I deployed eck-operator on my microk8s system. Then I used eck-operator to deploy Elasticsearch and Kibana. Next, I wanted to deploy Fleet and its agent. I added the configuration to Kibana (as shown in Figure 1). A… --- ## [Troubleshooting performance and load](https://discuss.elastic.co/t/troubleshooting-performance-and-load/385292)
**Author:** [@Whoami1980](https://discuss.elastic.co/u/Whoami1980)\ **Replies:** 16\ **Last updated:** [March 5, 2026, 7:23am UTC](https://discuss.elastic.co/t/troubleshooting-performance-and-load/385292 "2026-03-05T07:23:57Z")
Is there a centralise repository or knowledge base that we can start for general troubelshooting. For scenrios not limiting to below. Elastic fleet server Health Check. What are the things to watch out for? Overlo… --- ## [Filebeat Event Publishing Delay to Kafka](https://discuss.elastic.co/t/filebeat-event-publishing-delay-to-kafka/385064)
**Author:** [@Thirupathi](https://discuss.elastic.co/u/Thirupathi)\ **Replies:** 9\ **Last updated:** [February 24, 2026, 8:52am UTC](https://discuss.elastic.co/t/filebeat-event-publishing-delay-to-kafka/385064 "2026-02-24T08:52:30Z")
From the logs, we can see that the logger timestamp indicates a noticeable time gap between event processing and event publishing to Kafka. Due to this delay, events are not being pushed to Kafka in real-time as expected… --- ## [Scaling tips for ElasticAgent - Elasticsearch - Kibana setup](https://discuss.elastic.co/t/scaling-tips-for-elasticagent-elasticsearch-kibana-setup/380172)
**Author:** [@mike123](https://discuss.elastic.co/u/mike123)\ **Replies:** 13\ **Last updated:** [July 18, 2025, 1:35pm UTC](https://discuss.elastic.co/t/scaling-tips-for-elasticagent-elasticsearch-kibana-setup/380172 "2025-07-18T13:35:59Z")
I am having a trouble scaling Elasticsearch setup. The setup consist of over 2500 elastic agents forwarding logs to elasticsearch cluster. All elastic agents are managed by a single fleet server and is assigned to a sing… --- ## [ES6 Cluster , with mult-NIC(Each node has more than two ips) bindip to 0.0.0.0 successfully . But Same with ES8 does not work](https://discuss.elastic.co/t/es6-cluster-with-mult-nic-each-node-has-more-than-two-ips-bindip-to-0-0-0-0-successfully-but-same-with-es8-does-not-work/376447)
**Author:** [@Varinder](https://discuss.elastic.co/u/Varinder)\ **Replies:** 13\ **Last updated:** [April 2, 2025, 1:12pm UTC](https://discuss.elastic.co/t/es6-cluster-with-mult-nic-each-node-has-more-than-two-ips-bindip-to-0-0-0-0-successfully-but-same-with-es8-does-not-work/376447 "2025-04-02T13:12:48Z")
ES6 Cluster , with mult-NIC(Each node has more than two ips) bindip to 0.0.0.0 successfully . But Same with ES8 does not work. ES 8.15.2 Cluster throws and error in installation of two or more servers with (Each server… --- ## [Write to TSDS index via python](https://discuss.elastic.co/t/write-to-tsds-index-via-python/361001)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 9\ **Last updated:** [June 7, 2024, 7:53pm UTC](https://discuss.elastic.co/t/write-to-tsds-index-via-python/361001 "2024-06-07T19:53:42Z")
I create ILM/Template and Index when I try to write via python it errors but same record works via dev tool POST sachin\_test/\_doc { "@timestamp": "2024-06-06T19:21:15.000Z", --\> this part I did manually "system\_ty… --- ## [Why does \`--path.settings\` delete events? Why does \`-f\` work perfectly?](https://discuss.elastic.co/t/why-does-path-settings-delete-events-why-does-f-work-perfectly/354592)
**Author:** [@learningelastic](https://discuss.elastic.co/u/learningelastic)\ **Replies:** 9\ **Last updated:** [March 3, 2024, 7:07pm UTC](https://discuss.elastic.co/t/why-does-path-settings-delete-events-why-does-f-work-perfectly/354592 "2024-03-03T19:07:35Z")
When I start logstash with -f, everything works perfectly. If I start logstash with --path.settings, logstash deletes events received from the input. Does anyone know why? Here's how to reproduce the issue...i start w… --- ## [Rename fields name with Logstash](https://discuss.elastic.co/t/rename-fields-name-with-logstash/380861)
**Author:** [@yelinaung](https://discuss.elastic.co/u/yelinaung)\ **Replies:** 11\ **Last updated:** [August 8, 2025, 9:30am UTC](https://discuss.elastic.co/t/rename-fields-name-with-logstash/380861 "2025-08-08T09:30:48Z")
How to rename for clarity Can someone kindly help with this? Thank you. filter { mutate { rename =\> { "\[test\]\[rex-platform"\\\\" \]" =\> "\[test\]\[rex-platform\]" } } } Output Di… --- ## [New ELK 9.x cluster and Kibana HA](https://discuss.elastic.co/t/new-elk-9-x-cluster-and-kibana-ha/383780)
**Author:** [@d.silwon](https://discuss.elastic.co/u/d.silwon)\ **Replies:** 13\ **Last updated:** [December 15, 2025, 1:19pm UTC](https://discuss.elastic.co/t/new-elk-9-x-cluster-and-kibana-ha/383780 "2025-12-15T13:19:19Z")
Dears, I need your advice on installing a new ELK 9.x cluster. The cluster will be set up on VMs in the following configuration: 3 x MASTER node 8 x DATA node 2 x Kibana node 2 x Logstash node If I configure two se… --- ## [Type is missing in BulkRequest in elastic search java client version 7.17.20](https://discuss.elastic.co/t/type-is-missing-in-bulkrequest-in-elastic-search-java-client-version-7-17-20/370325)
**Author:** [@Radha\_G](https://discuss.elastic.co/u/Radha_G)\ **Replies:** 11\ **Last updated:** [November 14, 2024, 12:24pm UTC](https://discuss.elastic.co/t/type-is-missing-in-bulkrequest-in-elastic-search-java-client-version-7-17-20/370325 "2024-11-14T12:24:39Z")
Hi Team, We are using Elasticsearch database version 7.10.2 and also Elasticsearch java client - 7.17.20 in pom.xml Implemented BulkRequest using the new Elasticsearch java client as below: BulkRequest.Builder bulkReq… --- ## [Split grok-pattern into multiple lines](https://discuss.elastic.co/t/split-grok-pattern-into-multiple-lines/381366)
**Author:** [@sthorn](https://discuss.elastic.co/u/sthorn)\ **Replies:** 11\ **Last updated:** [August 28, 2025, 12:47pm UTC](https://discuss.elastic.co/t/split-grok-pattern-into-multiple-lines/381366 "2025-08-28T12:47:18Z")
Hi, Is it possible to split a grok-pattern into multiple lines instead of have one big? grok { pattern\_definitions =\> { "CM" =\> "\[/.\\-\\w\\s\]\*" } match =\> {"syslog\_message" =\> "%{CM:unknown\_id} %{IP:this\_ip},%{… --- ## [Enrich IP address with custom mmdb database using ingest pipeline](https://discuss.elastic.co/t/enrich-ip-address-with-custom-mmdb-database-using-ingest-pipeline/379102)
**Author:** [@kuldeep\_gupta](https://discuss.elastic.co/u/kuldeep_gupta)\ **Replies:** 10\ **Last updated:** [June 12, 2025, 3:50pm UTC](https://discuss.elastic.co/t/enrich-ip-address-with-custom-mmdb-database-using-ingest-pipeline/379102 "2025-06-12T15:50:07Z")
I have below document in elasticsearch { "\_index": "test", "\_id": "guv6X5cBSvotes9C4gZS", "\_score": 1, "\_source": { "name": "Alice", "source.ip": "172.22.1.11" … --- ## [Upsert large amount of documents based on the property value](https://discuss.elastic.co/t/upsert-large-amount-of-documents-based-on-the-property-value/362494)
**Author:** [@CTO\_Servefast](https://discuss.elastic.co/u/CTO_Servefast)\ **Replies:** 10\ **Last updated:** [July 24, 2024, 7:52pm UTC](https://discuss.elastic.co/t/upsert-large-amount-of-documents-based-on-the-property-value/362494 "2024-07-24T19:52:19Z")
Is it possible to use Bulk API to upsert large number of documents 100, 1000 ... but i want them to be inserted based on a query for example based on my userId property Use case for this is that we need to handle thousa… --- ## [Filebeat occasionally loses logs: Dropping event: no topic could be selected (Kubernetes + Kafka)](https://discuss.elastic.co/t/filebeat-occasionally-loses-logs-dropping-event-no-topic-could-be-selected-kubernetes-kafka/383685)
**Author:** [@ruizengyang](https://discuss.elastic.co/u/ruizengyang)\ **Replies:** 9\ **Last updated:** [December 8, 2025, 4:01pm UTC](https://discuss.elastic.co/t/filebeat-occasionally-loses-logs-dropping-event-no-topic-could-be-selected-kubernetes-kafka/383685 "2025-12-08T16:01:51Z")
Hi everyone, I’ve been troubleshooting an issue for the last few days and would like to confirm whether this behavior is expected or if there is a workaround. Problem When Filebeat starts on a Kubernetes node (DaemonS… --- ## [Kibana Index Pattern Configuration Problem](https://discuss.elastic.co/t/kibana-index-pattern-configuration-problem/386854)
**Author:** [@Pacous](https://discuss.elastic.co/u/Pacous)\ **Replies:** 12\ **Last updated:** [June 19, 2026, 6:00pm UTC](https://discuss.elastic.co/t/kibana-index-pattern-configuration-problem/386854 "2026-06-19T18:00:59Z")
I configured Logstash as follows: input { file { path =\> "/var/log/apache2/access.log" } } filter { grok { match =\> { "message" =\> "%{COMBINEDAPACHELOG}" } } date { match =\> \[ "timestamp", "dd/MMM/yyyy:HH:mm:ss Z"… --- ## [.NET W3C format webserver access logs on Linux](https://discuss.elastic.co/t/net-w3c-format-webserver-access-logs-on-linux/382178)
**Author:** [@taprove](https://discuss.elastic.co/u/taprove)\ **Replies:** 9\ **Last updated:** [October 30, 2025, 1:34pm UTC](https://discuss.elastic.co/t/net-w3c-format-webserver-access-logs-on-linux/382178 "2025-10-30T13:34:00Z")
Before I go down the path of creating something custom to bring in W3C format access logs generated from .NET https server apps on Linux, I wanted to make sure there wasn’t some easier way to do it with an existing integ… --- ## [Getting error when indices getting rollover with ILM policy](https://discuss.elastic.co/t/getting-error-when-indices-getting-rollover-with-ilm-policy/366410)
**Author:** [@Rajeev\_Aminbhavi](https://discuss.elastic.co/u/Rajeev_Aminbhavi)\ **Replies:** 9\ **Last updated:** [September 12, 2024, 6:32am UTC](https://discuss.elastic.co/t/getting-error-when-indices-getting-rollover-with-ilm-policy/366410 "2024-09-12T06:32:01Z")
Hi there, I am getting ILM errors on all of my indexes. For example: stack\_trace" : "java.lang.IllegalArgumentException: index.lifecycle.rollover\_alias \[jaeger-span\] does not point to index \[jaeger-span-2024-08-02\]\\n\\t… --- ## [Logstash duplicate](https://discuss.elastic.co/t/logstash-duplicate/375381)
**Author:** [@AVMOps](https://discuss.elastic.co/u/AVMOps)\ **Replies:** 12\ **Last updated:** [March 17, 2025, 12:30pm UTC](https://discuss.elastic.co/t/logstash-duplicate/375381 "2025-03-17T12:30:48Z")
Hello, I'm facing a duplicate data issue with Elasticsearch (3 nodes v8.5.2 - green state), coupled with Logstash (1 node v 8.5.2). So basically we have multiple apps servers sending logs with NLog to Logstash on port … --- ## [Filebeat: connection to Elasticsearch OK but no documents indexed](https://discuss.elastic.co/t/filebeat-connection-to-elasticsearch-ok-but-no-documents-indexed/382285)
**Author:** [@decibel83](https://discuss.elastic.co/u/decibel83)\ **Replies:** 9\ **Last updated:** [October 2, 2025, 2:57pm UTC](https://discuss.elastic.co/t/filebeat-connection-to-elasticsearch-ok-but-no-documents-indexed/382285 "2025-10-02T14:57:11Z")
Hi everyone, I’m facing an issue with Filebeat 8.19.3 on Debian 12 (Bookworm). Symptoms Filebeat starts without errors and connects successfully to Elasticsearch: Connection to backoff(elasticsearch(https://\… --- ## [2 server 2 node each architecture for elastic not working](https://discuss.elastic.co/t/2-server-2-node-each-architecture-for-elastic-not-working/369284)
**Author:** [@Amol\_Nagotkar](https://discuss.elastic.co/u/Amol_Nagotkar)\ **Replies:** 12\ **Last updated:** [October 28, 2024, 8:45am UTC](https://discuss.elastic.co/t/2-server-2-node-each-architecture-for-elastic-not-working/369284 "2024-10-28T08:45:22Z")
Hi all, server 1- 10.40.7.134 ----------------docker-compose.yml file---------------- version: '2.2' services: elasticsearch-1: image: docker.elastic.co/elasticsearch/elasticsearch:7.17.1 container\_name: ela… --- ## [Howto config winlogbeat + logstash + elasticsearch?](https://discuss.elastic.co/t/howto-config-winlogbeat-logstash-elasticsearch/374393)
**Author:** [@Lynn\_Karllo](https://discuss.elastic.co/u/Lynn_Karllo)\ **Replies:** 13\ **Last updated:** [February 14, 2025, 12:26am UTC](https://discuss.elastic.co/t/howto-config-winlogbeat-logstash-elasticsearch/374393 "2025-02-14T00:26:10Z")
Config winlogbeat: winlogbeat.event\_logs: - name: Application ignore\_older: 72h - name: System - name: Security - name: Microsoft-Windows-Sysmon/Operational - name: Windows PowerShell event\_id: 400, 403… --- ## [The search for full words or terms does not work correctly](https://discuss.elastic.co/t/the-search-for-full-words-or-terms-does-not-work-correctly/363527)
**Author:** [@Rainbow\_Sprinkles](https://discuss.elastic.co/u/Rainbow_Sprinkles)\ **Replies:** 14\ **Last updated:** [July 27, 2024, 11:59am UTC](https://discuss.elastic.co/t/the-search-for-full-words-or-terms-does-not-work-correctly/363527 "2024-07-27T11:59:35Z")
Dear talents, I hope everyone is doing well. Could you kindly review the statement below and suggest possible fixes? The keyword is "alt legal". Currently, the search engine is expected to display titles that either c… --- ## [Syncing Tables from Microsoft SQL Server to Elastic using Logstash](https://discuss.elastic.co/t/syncing-tables-from-microsoft-sql-server-to-elastic-using-logstash/386309)
**Author:** [@Mevevlin](https://discuss.elastic.co/u/Mevevlin)\ **Replies:** 9\ **Last updated:** [May 15, 2026, 12:23am UTC](https://discuss.elastic.co/t/syncing-tables-from-microsoft-sql-server-to-elastic-using-logstash/386309 "2026-05-15T00:23:14Z")
I'm trying to sync my SQL server database to my elasticsearch database. I've got the following input setup now: input { jdbc { jdbc\_driver\_library =\> "/usr/share/logstash/drivers/mssql-jdbc.jre8.jar" jdbc\_driv… --- ## [Apm data timestamps wrong =\> high load and slow responses](https://discuss.elastic.co/t/apm-data-timestamps-wrong-high-load-and-slow-responses/387329)
**Author:** [@nb71](https://discuss.elastic.co/u/nb71)\ **Replies:** 13\ **Last updated:** [June 30, 2026, 2:41pm UTC](https://discuss.elastic.co/t/apm-data-timestamps-wrong-high-load-and-slow-responses/387329 "2026-06-30T14:41:12Z")
We have an Elastic Cloud installation running version 9.4.0. Overall, it is quite heavily loaded. We have multiple dashboards that use APM and RUM data. We started noticing that the dashboards were becoming slower and … --- ## [Logstash remains in running state](https://discuss.elastic.co/t/logstash-remains-in-running-state/371323)
**Author:** [@Ritik\_Loomba](https://discuss.elastic.co/u/Ritik_Loomba)\ **Replies:** 13\ **Last updated:** [December 4, 2024, 12:25pm UTC](https://discuss.elastic.co/t/logstash-remains-in-running-state/371323 "2024-12-04T12:25:11Z")
Hi , I want to setup a logstash pipeline which will read data from Elasticsearch and load it to s3. For time being i am creating a test pipeline which reads data from one file and create a output file from it (creating … --- ## [Multiple Log Paths With Multiple Index](https://discuss.elastic.co/t/multiple-log-paths-with-multiple-index/365253)
**Author:** [@oseker](https://discuss.elastic.co/u/oseker)\ **Replies:** 9\ **Last updated:** [August 27, 2024, 3:42pm UTC](https://discuss.elastic.co/t/multiple-log-paths-with-multiple-index/365253 "2024-08-27T15:42:48Z")
Many log files are stored on the system in various locations. I'm attempting to use filestream input type to read log files and then send them straight to Elasticsearch. "Error loading template: error creating template i… --- ## [Kibana 9.3.1 dashboard loads slow](https://discuss.elastic.co/t/kibana-9-3-1-dashboard-loads-slow/387206)
**Author:** [@mittal\_rawal](https://discuss.elastic.co/u/mittal_rawal)\ **Replies:** 9\ **Last updated:** [June 25, 2026, 2:18pm UTC](https://discuss.elastic.co/t/kibana-9-3-1-dashboard-loads-slow/387206 "2026-06-25T14:18:38Z")
Hi Team, i have recently migrated elk from 8.16 to 9.3.1 i notice slowness in dashboard load. time take to loads 1-2 minutes for all panels in dashboard i want to load that within 10sec below i am sharing my cluster d… --- ## [The cluster never changes the assigned master node](https://discuss.elastic.co/t/the-cluster-never-changes-the-assigned-master-node/379777)
**Author:** [@Emiliano\_Baum](https://discuss.elastic.co/u/Emiliano_Baum)\ **Replies:** 12\ **Last updated:** [July 4, 2025, 6:30pm UTC](https://discuss.elastic.co/t/the-cluster-never-changes-the-assigned-master-node/379777 "2025-07-04T18:30:39Z")
The cluster never changes the assigned master node Elasticsearch version 6.8. I have a cluster with 6 data nodes, 3 ingest nodes, and 5 masters (masters only). Over the last few days, the master nodes have been cascadi… --- ## [Can't get licence trial extension and can't pay for subscription](https://discuss.elastic.co/t/cant-get-licence-trial-extension-and-cant-pay-for-subscription/369264)
**Author:** [@kingsley.ohia](https://discuss.elastic.co/u/kingsley.ohia)\ **Replies:** 10\ **Last updated:** [July 2, 2025, 12:21pm UTC](https://discuss.elastic.co/t/cant-get-licence-trial-extension-and-cant-pay-for-subscription/369264 "2025-07-02T12:21:59Z")
Hello everyone. I need some assistance with my licence, please. We are currently trialling the Platinum licence, which is due to expire in one hour. I have been trying to contact Elastic since last Thursday to request an… --- ## [High network usage by master node](https://discuss.elastic.co/t/high-network-usage-by-master-node/380102)
**Author:** [@rara01](https://discuss.elastic.co/u/rara01)\ **Replies:** 9\ **Last updated:** [July 22, 2025, 1:40pm UTC](https://discuss.elastic.co/t/high-network-usage-by-master-node/380102 "2025-07-22T13:40:19Z")
Hello, We have self-hosted Elasticsearch, used primarily for logs. Cluster is made of 3 nodes + one is only fleet-server. We have encountered very high network usage, now download is over 1 GiB/s, upload nearing tha… --- ## [Elasticsearch cannot access keys although they are available](https://discuss.elastic.co/t/elasticsearch-cannot-access-keys-although-they-are-available/381476)
**Author:** [@Salvatore\_Milano](https://discuss.elastic.co/u/Salvatore_Milano)\ **Replies:** 10\ **Last updated:** [September 8, 2025, 11:07am UTC](https://discuss.elastic.co/t/elasticsearch-cannot-access-keys-although-they-are-available/381476 "2025-09-08T11:07:51Z")
Hello, recently I have been running into an issue with elastic. I have a single node Elasticsearch-Container running in Docker. Sometimes it seems that Elasticsearch is not running as it should so I have tried to debu… --- ## [Lifecycle Policy](https://discuss.elastic.co/t/lifecycle-policy/381211)
**Author:** [@GiorgioS13](https://discuss.elastic.co/u/GiorgioS13)\ **Replies:** 10\ **Last updated:** [August 22, 2025, 10:08pm UTC](https://discuss.elastic.co/t/lifecycle-policy/381211 "2025-08-22T22:08:22Z")
I created a lifecycle policy in Kibana and attached it to a data stream, for example: logs-system.syslog-default However, the indices it created, such as: .ds-logs-system.syslog-default-2025.08.21-000001 are still sh… --- ## [Filebeat OOM (Out Of Memory) Error](https://discuss.elastic.co/t/filebeat-oom-out-of-memory-error/383768)
**Author:** [@Thirupathi](https://discuss.elastic.co/u/Thirupathi)\ **Replies:** 9\ **Last updated:** [December 12, 2025, 7:25am UTC](https://discuss.elastic.co/t/filebeat-oom-out-of-memory-error/383768 "2025-12-12T07:25:47Z")
harvester\_buffer\_size: 5368709120 message\_max\_bytes: 5368709120 multiline.max\_lines: 5368709120 i configured above configuration in filebet after am getting below issue mp":"2025-11-30T05:04:30.546-0500","log.logger":"… --- ## [Error running kibana 8.14 in AL 2023 ARM](https://discuss.elastic.co/t/error-running-kibana-8-14-in-al-2023-arm/374336)
**Author:** [@Tara\_John](https://discuss.elastic.co/u/Tara_John)\ **Replies:** 9\ **Last updated:** [February 11, 2025, 5:20pm UTC](https://discuss.elastic.co/t/error-running-kibana-8-14-in-al-2023-arm/374336 "2025-02-11T17:20:35Z")
Seeing an error during the install: /usr/share/kibana/bin/kibana-keystore: line 29: 374498 Illegal instruction (core dumped) NODE\_OPTIONS="$KBN\_NODE\_OPTS $NODE\_OPTIONS" NODE\_ENV=production "${NODE}" "${DIR}/src/cli\_… --- ## [Logstash--Exception caught in json filter](https://discuss.elastic.co/t/logstash-exception-caught-in-json-filter/364174)
**Author:** [@Bhanu\_Praveen](https://discuss.elastic.co/u/Bhanu_Praveen)\ **Replies:** 9\ **Last updated:** [August 6, 2024, 3:35pm UTC](https://discuss.elastic.co/t/logstash-exception-caught-in-json-filter/364174 "2024-08-06T15:35:05Z")
Logstash--Exception caught in json filter Below is my json log string: { "traceId": "o0uyveRU/8BkjL+lbpDlnQ==", "spanId": "73rmqIRmo34=", "operationName": "ProcessWorkItem", "startTime": "2024-07-22T06:07:12.650881… --- ## [Discrepancy in Log Filtering in Logstash](https://discuss.elastic.co/t/discrepancy-in-log-filtering-in-logstash/374821)
**Author:** [@ErGeek](https://discuss.elastic.co/u/ErGeek)\ **Replies:** 12\ **Last updated:** [February 20, 2025, 7:07pm UTC](https://discuss.elastic.co/t/discrepancy-in-log-filtering-in-logstash/374821 "2025-02-20T19:07:05Z")
Hi All, We are currently using the filter below in Logstash to process logs. Filter - filter { # Parse the JSON string from the message field into "parsed\_msg" json { source =\> "message" target =\> "parsed\_… --- ## [FSCrawler 2.10-SNAPSHOT not indexing PDF content](https://discuss.elastic.co/t/fscrawler-2-10-snapshot-not-indexing-pdf-content/384593)
**Author:** [@DaManDOH](https://discuss.elastic.co/u/DaManDOH)\ **Replies:** 11\ **Last updated:** [January 22, 2026, 12:33am UTC](https://discuss.elastic.co/t/fscrawler-2-10-snapshot-not-indexing-pdf-content/384593 "2026-01-22T00:33:45Z")
TL;DR: Under a full ES v9.2 stack running under Docker Compose, FSCrawler v2.10-SNAPSHOT only returns TesseractOCRParser timeout errors when trying to ingest any PDFs. Full details I’m currently building a local Elasti… --- ## [Logstash pushing event to older index](https://discuss.elastic.co/t/logstash-pushing-event-to-older-index/373730)
**Author:** [@devops\_training](https://discuss.elastic.co/u/devops_training)\ **Replies:** 10\ **Last updated:** [January 28, 2025, 8:37pm UTC](https://discuss.elastic.co/t/logstash-pushing-event-to-older-index/373730 "2025-01-28T20:37:29Z")
\[2025-01-27T11:17:59,721\]\[INFO \]\[logstash.outputs.elastic\]\[main\]\[160e296c5399e510649e9432dfb7810d3b2916f58b5ee2e872c7b33dd0983a64\] Retrying failed action {:status=\>429, :action=\>\["index", {:\_id=\>"a01a2730453bbd683e5db277… --- ## [How to clear cache of keyword field in elastic search?](https://discuss.elastic.co/t/how-to-clear-cache-of-keyword-field-in-elastic-search/366026)
**Author:** [@Bhavyagc](https://discuss.elastic.co/u/Bhavyagc)\ **Replies:** 9\ **Last updated:** [November 5, 2024, 9:43am UTC](https://discuss.elastic.co/t/how-to-clear-cache-of-keyword-field-in-elastic-search/366026 "2024-11-05T09:43:41Z")
Hi , I am facing cache issue with keyword field in Elastic. I have a document with keyword field which is indexed with some value example : abc later the same document is reindexed again with some value abcd, old value … --- ## [Primary shards for search](https://discuss.elastic.co/t/primary-shards-for-search/384310)
**Author:** [@Elastic04](https://discuss.elastic.co/u/Elastic04)\ **Replies:** 10\ **Last updated:** [January 20, 2026, 5:56am UTC](https://discuss.elastic.co/t/primary-shards-for-search/384310 "2026-01-20T05:56:30Z")
I a currently using 3 primary shards and 2 replica shards. How reducing number of primary shards affects search and what’s the impact on cluster? --- ## [ILMs in cluster not performing rollover when conditions are met](https://discuss.elastic.co/t/ilms-in-cluster-not-performing-rollover-when-conditions-are-met/383369)
**Author:** [@Natalia\_Mellino](https://discuss.elastic.co/u/Natalia_Mellino)\ **Replies:** 9\ **Last updated:** [November 18, 2025, 6:30pm UTC](https://discuss.elastic.co/t/ilms-in-cluster-not-performing-rollover-when-conditions-are-met/383369 "2025-11-18T18:30:29Z")
Hello! We have an Elasticsearch cluster running 8.19.3 version (master, hot, cold and coordinating nodes) and we’re seeing some issues regarding our ILM policies. We are using data streams so we’ve configured several IL… --- ## [Elastic APM PHP Agent](https://discuss.elastic.co/t/elastic-apm-php-agent/229373)
**Author:** [@Neha\_Duggal](https://discuss.elastic.co/u/Neha_Duggal)\ **Replies:** 0\ **Last updated:** [April 23, 2020, 3:29am UTC](https://discuss.elastic.co/t/elastic-apm-php-agent/229373 "2020-04-23T03:29:58Z")
We have some exciting news to share! We are working on a brand new APM agent for PHP, a complete open source solution for monitoring your PHP applications using Elastic APM. We'd love to hear more about your use case and… --- ## [Query regarding "cluster.initial\_master\_nodes"](https://discuss.elastic.co/t/query-regarding-cluster-initial-master-nodes/379318)
**Author:** [@mike123](https://discuss.elastic.co/u/mike123)\ **Replies:** 9\ **Last updated:** [July 18, 2025, 11:27am UTC](https://discuss.elastic.co/t/query-regarding-cluster-initial-master-nodes/379318 "2025-07-18T11:27:17Z")
i am having a cluster in which i have configured master node IPs in "cluster.initial\_master\_nodes" (ex: cluster.initial\_master\_nodes:\["172.12.12.2:9300","172.12.12.3:9300","172.12.12.4:9300"\]) and it worked perfectly. no… --- ## [Logstash does not load data into elastic](https://discuss.elastic.co/t/logstash-does-not-load-data-into-elastic/364313)
**Author:** [@peter170805](https://discuss.elastic.co/u/peter170805)\ **Replies:** 10\ **Last updated:** [August 9, 2024, 3:04am UTC](https://discuss.elastic.co/t/logstash-does-not-load-data-into-elastic/364313 "2024-08-09T03:04:17Z")
Good afternoon friends, I have a question, I have Kibana version 7.5.1, the same as Elastic. I created an index to monitor a weblogic log. Before creating the index I tested the logstash configuration file (v 7.1.1), wh… --- ## [Index sorting would cause indexed data movement?](https://discuss.elastic.co/t/index-sorting-would-cause-indexed-data-movement/359978)
**Author:** [@chrwhy](https://discuss.elastic.co/u/chrwhy)\ **Replies:** 9\ **Last updated:** [May 22, 2024, 2:02pm UTC](https://discuss.elastic.co/t/index-sorting-would-cause-indexed-data-movement/359978 "2024-05-22T14:02:32Z")
Anybody know that index-sorting data is physically or logically sorted on disk? here is my question: if there are existing sorted data, when inserting a new record into the index, how will the new index-sorting data be … --- ## [Easy question for you experts - need help with a query](https://discuss.elastic.co/t/easy-question-for-you-experts-need-help-with-a-query/381990)
**Author:** [@HaroldMelamed](https://discuss.elastic.co/u/HaroldMelamed)\ **Replies:** 9\ **Last updated:** [September 17, 2025, 7:52pm UTC](https://discuss.elastic.co/t/easy-question-for-you-experts-need-help-with-a-query/381990 "2025-09-17T19:52:16Z")
I’m trying to do a search on multiple fields in collection. This is what I tried. How do I fix this? search\_query = { "query": { "match": { "RunID": RunID, "host": host\_name … --- ## [Need help with Visualisation - highest percentage of PQ current size FOR THE LAST 60 mins](https://discuss.elastic.co/t/need-help-with-visualisation-highest-percentage-of-pq-current-size-for-the-last-60-mins/385462)
**Author:** [@Whoami1980](https://discuss.elastic.co/u/Whoami1980)\ **Replies:** 15\ **Last updated:** [March 19, 2026, 9:10am UTC](https://discuss.elastic.co/t/need-help-with-visualisation-highest-percentage-of-pq-current-size-for-the-last-60-mins/385462 "2026-03-19T09:10:15Z")
We need help in the following. This is what we have configure below. However how can we see the top 10 records in a table ORDER BY highest percentage of PQ current size FOR THE LAST 60 mins Data View Records host.hos… [Previous page](https://discuss.elastic.co/top.md?page=248&per_page=50&period=all) [Next page](https://discuss.elastic.co/top.md?page=250&per_page=50&period=all)