# Top **URL:** https://discuss.elastic.co/top.md?page=25 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 26 --- ## [Anomaly Scores Differ on Same UI](https://discuss.elastic.co/t/anomaly-scores-differ-on-same-ui/383251)
**Author:** [@erikg](https://discuss.elastic.co/u/erikg)\ **Replies:** 1\ **Last updated:** [November 9, 2025, 6:38am UTC](https://discuss.elastic.co/t/anomaly-scores-differ-on-same-ui/383251 "2025-11-09T06:38:33Z")
Hello, I've been leveraging the Anomaly Detection jobs in Elastic. I think this might be a visual bug but I see an influencer with an anomaly score of 98: But down at the bottom it reveals a score of 77: Even th… --- ## [KNN search on filtered nested document](https://discuss.elastic.co/t/knn-search-on-filtered-nested-document/386096)
**Author:** [@Renjith\_R](https://discuss.elastic.co/u/Renjith_R)\ **Replies:** 0\ **Last updated:** [April 29, 2026, 1:58pm UTC](https://discuss.elastic.co/t/knn-search-on-filtered-nested-document/386096 "2026-04-29T13:58:59Z")
Document in my index represents various books. All the paragraphs of a book are stored under nested document "texts" "texts": { "type": "nested", "properties": { "part": { "type": "… --- ## [Load balancing method](https://discuss.elastic.co/t/load-balancing-method/384829)
**Author:** [@jojsf](https://discuss.elastic.co/u/jojsf)\ **Replies:** 0\ **Last updated:** [January 30, 2026, 10:19am UTC](https://discuss.elastic.co/t/load-balancing-method/384829 "2026-01-30T10:19:31Z")
Hello, I want to do a poll and se how many of you can say witch load balancing method you use in front of the proxys in ECE. We have an large deployment today with several use cases sutch as search, APM, log ingest etc… --- ## [Elastic Agent/Fleet - Winlog input missing security events](https://discuss.elastic.co/t/elastic-agent-fleet-winlog-input-missing-security-events/389452)
**Author:** [@Stephen\_P](https://discuss.elastic.co/u/Stephen_P)\ **Replies:** 1\ **Last updated:** [August 12, 2026, 12:47pm UTC](https://discuss.elastic.co/t/elastic-agent-fleet-winlog-input-missing-security-events/389452 "2026-08-12T12:47:07Z")
Hey all I'm working on deploying a Elastic stac POC but have hit a strange issue with collecting windows security event logs Environment Elasticsearch/Kibana/Fleet Server: 9.5.1 Tested Elastic Agent: 9.5.1 and 9.… --- ## [Search highlights a non-matched field if query contains a nested query](https://discuss.elastic.co/t/search-highlights-a-non-matched-field-if-query-contains-a-nested-query/388844)
**Author:** [@Mehis](https://discuss.elastic.co/u/Mehis)\ **Replies:** 1\ **Last updated:** [July 28, 2026, 1:35pm UTC](https://discuss.elastic.co/t/search-highlights-a-non-matched-field-if-query-contains-a-nested-query/388844 "2026-07-28T13:35:54Z")
Hello, I am having trouble with the highlight-feature highlighting fields that should not be. This problem only occurs if the search contains a nested query. I have set require\_field\_match to true in my search and my ES… --- ## [ELK - SAS drivers](https://discuss.elastic.co/t/elk-sas-drivers/385754)
**Author:** [@PatreKerier](https://discuss.elastic.co/u/PatreKerier)\ **Replies:** 1\ **Last updated:** [April 4, 2026, 1:58pm UTC](https://discuss.elastic.co/t/elk-sas-drivers/385754 "2026-04-04T13:58:33Z")
Colleagues, good afternoon! Please tell me about the following issue. We plan to consider the possibility of deploying Elastic in our infrastructure, however, at the moment the main available storage is SAS disks. The… --- ## [Remote transport exception .. nested repository verification exception.. nested io exception could not obtain block](https://discuss.elastic.co/t/remote-transport-exception-nested-repository-verification-exception-nested-io-exception-could-not-obtain-block/382944)
**Author:** [@Swathi\_Rajendran](https://discuss.elastic.co/u/Swathi_Rajendran)\ **Replies:** 1\ **Last updated:** [October 24, 2025, 8:49am UTC](https://discuss.elastic.co/t/remote-transport-exception-nested-repository-verification-exception-nested-io-exception-could-not-obtain-block/382944 "2025-10-24T08:49:54Z")
Issue with Snapshot Remote transport exception .. nested repository verification exception.. nested io exception could not obtain block --- ## [Filebeat 9.3.1 slow to shutdown, takes \> 50s, using type: filestream,](https://discuss.elastic.co/t/filebeat-9-3-1-slow-to-shutdown-takes-50s-using-type-filestream/386789)
**Author:** [@Alex\_Rune\_Berg](https://discuss.elastic.co/u/Alex_Rune_Berg)\ **Replies:** 0\ **Last updated:** [June 10, 2026, 9:01am UTC](https://discuss.elastic.co/t/filebeat-9-3-1-slow-to-shutdown-takes-50s-using-type-filestream/386789 "2026-06-10T09:01:30Z")
Our filebeat does not stop quickly after changing it to use the 'type: filestream', we used 'type: log' before and it stopped immediately. We stop filebeat by sending it a -TERM, using pkill -TERM filebeat It normally… --- ## [Dec 11th, 2025: \[FR\] Création d'un système de détection de phishing basé sur l'IA](https://discuss.elastic.co/t/dec-11th-2025-fr-creation-dun-systeme-de-detection-de-phishing-base-sur-lia/383299)
**Author:** [@Julien\_Martin](https://discuss.elastic.co/u/Julien_Martin)\ **Replies:** 0\ **Last updated:** [December 11, 2025, 8:00am UTC](https://discuss.elastic.co/t/dec-11th-2025-fr-creation-dun-systeme-de-detection-de-phishing-base-sur-lia/383299 "2025-12-11T08:00:32Z")
This post also exists in English. Construction d'un système de détection de phishing par email avec n8n et Elastic Agent Builder Les attaques de phishing continuent de dominer le paysage des menaces en cybersécurité,… --- ## [Dec 9th, 2025: \[EN\] Use the Node.js Elasticsearch client to index large CSV files](https://discuss.elastic.co/t/dec-9th-2025-en-use-the-node-js-elasticsearch-client-to-index-large-csv-files/382901)
**Author:** [@joshmock](https://discuss.elastic.co/u/joshmock)\ **Replies:** 0\ **Last updated:** [December 9, 2025, 8:00am UTC](https://discuss.elastic.co/t/dec-9th-2025-en-use-the-node-js-elasticsearch-client-to-index-large-csv-files/382901 "2025-12-09T08:00:33Z")
Indexing a large number of documents into Elasticsearch is made straightforward using the bulk API: transform your data records into JSON documents, interleaved with instructions for which index they should be added t… --- ## [TLS handshake failure between Logstash-LB and log drops in Logstash server](https://discuss.elastic.co/t/tls-handshake-failure-between-logstash-lb-and-log-drops-in-logstash-server/383469)
**Author:** [@Subhanwita\_Mullick](https://discuss.elastic.co/u/Subhanwita_Mullick)\ **Replies:** 0\ **Last updated:** [November 16, 2025, 5:24pm UTC](https://discuss.elastic.co/t/tls-handshake-failure-between-logstash-lb-and-log-drops-in-logstash-server/383469 "2025-11-16T17:24:26Z")
My architecture is Sources –\> Load balancer –\> Logstash server (8 CPU, 16 GB) –\> Azure Sentinel. For the store logs, we just did an extensive traffic analysis as well. In the connectivity between LB and Logstash cluster… --- ## [Only One Scheduled Osquery Query Pack Runs in Agent Policy](https://discuss.elastic.co/t/only-one-scheduled-osquery-query-pack-runs-in-agent-policy/388792)
**Author:** [@Viktor\_Movita](https://discuss.elastic.co/u/Viktor_Movita)\ **Replies:** 0\ **Last updated:** [July 26, 2026, 12:33pm UTC](https://discuss.elastic.co/t/only-one-scheduled-osquery-query-pack-runs-in-agent-policy/388792 "2026-07-26T12:33:00Z")
Hello, I am using Elastic Agent 8.19.14 and collecting systemd unit information through the Osquery Manager integration. Recently, I have encountered an issue where, if I configure two query packs within the same Agent… --- ## [Duplicate Elastic Agent metrics → 409 conflicts in Logstash (.metrics-\* only)](https://discuss.elastic.co/t/duplicate-elastic-agent-metrics-409-conflicts-in-logstash-metrics-only/386672)
**Author:** [@username456](https://discuss.elastic.co/u/username456)\ **Replies:** 0\ **Last updated:** [June 3, 2026, 7:40am UTC](https://discuss.elastic.co/t/duplicate-elastic-agent-metrics-409-conflicts-in-logstash-metrics-only/386672 "2026-06-03T07:40:53Z")
Hello, We are currently experiencing an issue with Fleet-managed Elastic Agent where metrics are being sent twice, resulting in 409 version conflict errors in Logstash. We have not been able to identify the cause of thi… --- ## [Montée de version v5 vers v6](https://discuss.elastic.co/t/montee-de-version-v5-vers-v6/384889)
**Author:** [@melastic](https://discuss.elastic.co/u/melastic)\ **Replies:** 0\ **Last updated:** [February 3, 2026, 3:25pm UTC](https://discuss.elastic.co/t/montee-de-version-v5-vers-v6/384889 "2026-02-03T15:25:17Z")
Je veux faire une montée de version d’un cluster Elasticsearch en version 5.5.3 vers une version 6.8.23. J’ai vu sur un blog qu’il fallait d’abord faire une montée de version mineure vers la version 5.6.16, est-ce vraime… --- ## [Want to understand how we can integrate metricbeat with amazon ecs ec2 launch type?](https://discuss.elastic.co/t/want-to-understand-how-we-can-integrate-metricbeat-with-amazon-ecs-ec2-launch-type/383217)
**Author:** [@rutz19](https://discuss.elastic.co/u/rutz19)\ **Replies:** 0\ **Last updated:** [November 4, 2025, 5:16pm UTC](https://discuss.elastic.co/t/want-to-understand-how-we-can-integrate-metricbeat-with-amazon-ecs-ec2-launch-type/383217 "2025-11-04T17:16:40Z")
If any one has integrated metricbeat with aws ecs ec2. It would be really helpful if you can share the details on how to achieve it. --- ## [Missing Export button for custom role despite enabling "Generate PDF or PNG report" privilege (v8.19.11)](https://discuss.elastic.co/t/missing-export-button-for-custom-role-despite-enabling-generate-pdf-or-png-report-privilege-v8-19-11/390775)
**Author:** [@WANASANAN815](https://discuss.elastic.co/u/WANASANAN815)\ **Replies:** 1\ **Last updated:** [October 1, 2026, 12:02am UTC](https://discuss.elastic.co/t/missing-export-button-for-custom-role-despite-enabling-generate-pdf-or-png-report-privilege-v8-19-11/390775 "2026-10-01T00:02:38Z")
Hi everyone, I’m currently having an issue creating a custom role in Elastic SIEM. I am trying to create a role that allows users to export dashboards as PDFs. Environment: Elastic Version: 8.19.11 License: Enter… --- ## [Unable to register secondary azure snapshot repo. Elasticsearch says client not found](https://discuss.elastic.co/t/unable-to-register-secondary-azure-snapshot-repo-elasticsearch-says-client-not-found/385806)
**Author:** [@dfinn](https://discuss.elastic.co/u/dfinn)\ **Replies:** 1\ **Last updated:** [April 7, 2026, 7:44pm UTC](https://discuss.elastic.co/t/unable-to-register-secondary-azure-snapshot-repo-elasticsearch-says-client-not-found/385806 "2026-04-07T19:44:04Z")
I’m trying to add a secondary snapshot repo repo to a cluster to migrate data. I’ve added the account info and key into the elasticsearch keystore, you can see them here: elasticsearch-keystore list azure.client.defau… --- ## [DLQ setup issue for specific application in Logstash pipeline](https://discuss.elastic.co/t/dlq-setup-issue-for-specific-application-in-logstash-pipeline/385059)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 1\ **Last updated:** [February 15, 2026, 4:57pm UTC](https://discuss.elastic.co/t/dlq-setup-issue-for-specific-application-in-logstash-pipeline/385059 "2026-02-15T16:57:05Z")
We have a single Logstash pipeline that listens on port 5044 and receives data from multiple Beats sources. Filebeat is installed on one of the source servers, and we want to configure a Dead Letter Queue (DLQ) only for … --- ## [Rechearch project: integration the llm in elasticsearch for semantic search](https://discuss.elastic.co/t/rechearch-project-integration-the-llm-in-elasticsearch-for-semantic-search/383387)
**Author:** [@Yemboaro](https://discuss.elastic.co/u/Yemboaro)\ **Replies:** 1\ **Last updated:** [November 16, 2025, 5:17am UTC](https://discuss.elastic.co/t/rechearch-project-integration-the-llm-in-elasticsearch-for-semantic-search/383387 "2025-11-16T05:17:23Z")
Hello, I have a Master's 2 academic research project. I would like to research the integration of LLMs into Elasticsearch for semantic search. My question is, I wanted to ask you for guidelines on the research project … --- ## [mTLS configuration confusion between Elasticsearch & Kibana](https://discuss.elastic.co/t/mtls-configuration-confusion-between-elasticsearch-kibana/385105)
**Author:** [@Reviving9721](https://discuss.elastic.co/u/Reviving9721)\ **Replies:** 2\ **Last updated:** [February 19, 2026, 2:38am UTC](https://discuss.elastic.co/t/mtls-configuration-confusion-between-elasticsearch-kibana/385105 "2026-02-19T02:38:32Z")
Currently attempting to configure mTLS between Elasticsearch & Kibana, but I am getting this error… (stack 9.3.0) \[2026-02-18T15:25:30,182\]\[WARN \]\[o.e.h.AbstractHttpServerTransport\] \[testelastic.internal\] caught excepti… --- ## [Supporting private channels and direct messages documents from slack](https://discuss.elastic.co/t/supporting-private-channels-and-direct-messages-documents-from-slack/383830)
**Author:** [@kenseii](https://discuss.elastic.co/u/kenseii)\ **Replies:** 2\ **Last updated:** [December 4, 2025, 12:59am UTC](https://discuss.elastic.co/t/supporting-private-channels-and-direct-messages-documents-from-slack/383830 "2025-12-04T00:59:03Z")
Hello, The current slack connector does not support reading documents from private channels and direct messages when crawling the data into elastic. Elastic Slack connector reference | Reference Is there a plan to prov… --- ## [Using winlogbeat 9.2.0 to import event logs from a client for analysis. The Dashboard fields are not matching the records](https://discuss.elastic.co/t/using-winlogbeat-9-2-0-to-import-event-logs-from-a-client-for-analysis-the-dashboard-fields-are-not-matching-the-records/383583)
**Author:** [@mmopwcdk](https://discuss.elastic.co/u/mmopwcdk)\ **Replies:** 2\ **Last updated:** [November 21, 2025, 1:19pm UTC](https://discuss.elastic.co/t/using-winlogbeat-9-2-0-to-import-event-logs-from-a-client-for-analysis-the-dashboard-fields-are-not-matching-the-records/383583 "2025-11-21T13:19:16Z")
Hi there. I am trying to analyze some Windows security logs (as that is all I was given) from a client, using Elastic Stack and the security features and dashboards it provides. I have managed to have winlogbeat create… --- ## [Can't Install Elastic Agent On Windows Server](https://discuss.elastic.co/t/cant-install-elastic-agent-on-windows-server/389779)
**Author:** [@mureeb](https://discuss.elastic.co/u/mureeb)\ **Replies:** 0\ **Last updated:** [August 19, 2026, 10:17am UTC](https://discuss.elastic.co/t/cant-install-elastic-agent-on-windows-server/389779 "2026-08-19T10:17:48Z")
Environment Context: OS: Windows (x86\_64) Elastic Agent Version: 9.5.1 Deployment: Fleet-managed (On-Prem/Self-Managed Fleet Server) Endpoint Protection: Kaspersky EDR (Disabled during troubleshooting) Iss… --- ## [Secops-es-benchmark: an open benchmark for AI security agents on real Elasticsearch telemetry](https://discuss.elastic.co/t/secops-es-benchmark-an-open-benchmark-for-ai-security-agents-on-real-elasticsearch-telemetry/388910)
**Author:** [@azmatjan139](https://discuss.elastic.co/u/azmatjan139)\ **Replies:** 0\ **Last updated:** [July 30, 2026, 4:13pm UTC](https://discuss.elastic.co/t/secops-es-benchmark-an-open-benchmark-for-ai-security-agents-on-real-elasticsearch-telemetry/388910 "2026-07-30T16:13:07Z")
secops-es-benchmark: an open benchmark for AI agents that investigate breaches in Elasticsearch Real, labeled attack telemetry in Elasticsearch — measure your own agent against ground truth. Today I'm open-sourcing seco… --- ## [Elasticsearch alerts don't show source.ip](https://discuss.elastic.co/t/elasticsearch-alerts-dont-show-source-ip/386763)
**Author:** [@komposektoras](https://discuss.elastic.co/u/komposektoras)\ **Replies:** 0\ **Last updated:** [June 8, 2026, 4:54pm UTC](https://discuss.elastic.co/t/elasticsearch-alerts-dont-show-source-ip/386763 "2026-06-08T16:54:16Z")
I have built a project lab with following tools: Component Tool Hypervisor VirtualBox Attacker VM Kali Linux Victim VM Ubuntu Server 22.04 SIEM VM Ubuntu Server 22.04 Log shipper (Linux) Filebeat … --- ## [Write Request Data flow ECK](https://discuss.elastic.co/t/write-request-data-flow-eck/383297)
**Author:** [@kim.ae](https://discuss.elastic.co/u/kim.ae)\ **Replies:** 0\ **Last updated:** [November 7, 2025, 4:58pm UTC](https://discuss.elastic.co/t/write-request-data-flow-eck/383297 "2025-11-07T16:58:55Z")
Currently I have a ECK Cluster running on a AKS cluster. The configuration is 3 master nodes, 5 hot data nodes that also are ingest nodes and 7 warm/cold nodes. We are having performance issues (filebeat is showing write… --- ## [Kaspersky Logs for SOC](https://discuss.elastic.co/t/kaspersky-logs-for-soc/386695)
**Author:** [@breno.bazaga](https://discuss.elastic.co/u/breno.bazaga)\ **Replies:** 0\ **Last updated:** [June 3, 2026, 1:49pm UTC](https://discuss.elastic.co/t/kaspersky-logs-for-soc/386695 "2026-06-03T13:49:51Z")
Hello everyone, I currently work in a SOC environment and I am working on a use case involving monitoring and ingestion of Kaspersky logs into Elastic for managed security services. During the integration process, I no… --- ## [Elastic Cloud Enterprise (ECE) deployment issue](https://discuss.elastic.co/t/elastic-cloud-enterprise-ece-deployment-issue/383979)
**Author:** [@Amir\_Trigui](https://discuss.elastic.co/u/Amir_Trigui)\ **Replies:** 0\ **Last updated:** [December 11, 2025, 9:26am UTC](https://discuss.elastic.co/t/elastic-cloud-enterprise-ece-deployment-issue/383979 "2025-12-11T09:26:59Z")
Hello, I am working on Elastic Cloud Enterprise (ECE), but I keep encountering an issue: the installation is interrupted always at this stage. I am using the script https://download.elastic.co/cloud/elastic-cloud-enter… --- ## [How do you replicate tagging in metricbeat/filebeat with the agent?](https://discuss.elastic.co/t/how-do-you-replicate-tagging-in-metricbeat-filebeat-with-the-agent/383937)
**Author:** [@rex656](https://discuss.elastic.co/u/rex656)\ **Replies:** 2\ **Last updated:** [December 12, 2025, 2:35pm UTC](https://discuss.elastic.co/t/how-do-you-replicate-tagging-in-metricbeat-filebeat-with-the-agent/383937 "2025-12-12T14:35:40Z")
I am in the process of migrating ~450 windows servers from using beats to the agent. All of these servers have metricbeat only and about 120 of those also have filebeat (doing some custom parsing that will be replicated … --- ## [Elastic AI: Preconfigured LLM models data exposure](https://discuss.elastic.co/t/elastic-ai-preconfigured-llm-models-data-exposure/385605)
**Author:** [@venkatkumar229](https://discuss.elastic.co/u/venkatkumar229)\ **Replies:** 1\ **Last updated:** [March 25, 2026, 12:57pm UTC](https://discuss.elastic.co/t/elastic-ai-preconfigured-llm-models-data-exposure/385605 "2026-03-25T12:57:07Z")
Hi Team, We are currently exploring the AI Assistant feature in our ELK stack (version 9.3.1) and plan to use the preconfigured LLM model connectors. We would like to understand whether using these preconfigured LLM mo… --- ## [I need a docker image with enrollment token disabled](https://discuss.elastic.co/t/i-need-a-docker-image-with-enrollment-token-disabled/385027)
**Author:** [@Shivu007](https://discuss.elastic.co/u/Shivu007)\ **Replies:** 1\ **Last updated:** [February 12, 2026, 9:02pm UTC](https://discuss.elastic.co/t/i-need-a-docker-image-with-enrollment-token-disabled/385027 "2026-02-12T21:02:57Z")
Hi team, I’m currently working on the elasticsearch and kibana Docker image for the snowflake SPCS container. However, I’m unable to generate the enrollment token and the logs also do not display the token or password w… --- ## [Date\_histogram supports 1M, 1Y but not 3M or 6M. Any ways to achieve the same](https://discuss.elastic.co/t/date-histogram-supports-1m-1y-but-not-3m-or-6m-any-ways-to-achieve-the-same/384687)
**Author:** [@mike123](https://discuss.elastic.co/u/mike123)\ **Replies:** 1\ **Last updated:** [January 22, 2026, 7:53am UTC](https://discuss.elastic.co/t/date-histogram-supports-1m-1y-but-not-3m-or-6m-any-ways-to-achieve-the-same/384687 "2026-01-22T07:53:09Z")
3M or 3Y cannot be achieved using fixed interval. While calendar interval only supports 1M, 1Y. Is there any ways to achieve date histogram over 3M or 6M. --- ## [Eland-imported naver/splade-v3 text\_expansion produces much smaller sparse vectors and worse ranking than local SentenceTransformers SparseEncoder](https://discuss.elastic.co/t/eland-imported-naver-splade-v3-text-expansion-produces-much-smaller-sparse-vectors-and-worse-ranking-than-local-sentencetransformers-sparseencoder/386819)
**Author:** [@alrolo3](https://discuss.elastic.co/u/alrolo3)\ **Replies:** 0\ **Last updated:** [June 11, 2026, 9:39pm UTC](https://discuss.elastic.co/t/eland-imported-naver-splade-v3-text-expansion-produces-much-smaller-sparse-vectors-and-worse-ranking-than-local-sentencetransformers-sparseencoder/386819 "2026-06-11T21:39:41Z")
Eland-imported naver/splade-v3 text\_expansion produces much smaller sparse vectors and worse ranking than local SentenceTransformers SparseEncoder Environment Elasticsearch version: 9.4.2 Eland Docker image used: docke… --- ## [The Agents Health is not stable](https://discuss.elastic.co/t/the-agents-health-is-not-stable/386202)
**Author:** [@5037\_DHIVAGAR\_S](https://discuss.elastic.co/u/5037_DHIVAGAR_S)\ **Replies:** 0\ **Last updated:** [May 7, 2026, 5:09am UTC](https://discuss.elastic.co/t/the-agents-health-is-not-stable/386202 "2026-05-07T05:09:08Z")
Hi Everyone, We are using Elastic Cloud (SaaS) with Fleet-managed Elastic Agents on Windows servers. Some of our agents are intermittently switching between Healthy and Unhealthy states, and the status is not stable. I… --- ## [Kibana 8.19.9 plugin build errors](https://discuss.elastic.co/t/kibana-8-19-9-plugin-build-errors/384516)
**Author:** [@kbujold\_wr](https://discuss.elastic.co/u/kbujold_wr)\ **Replies:** 0\ **Last updated:** [January 13, 2026, 5:18pm UTC](https://discuss.elastic.co/t/kibana-8-19-9-plugin-build-errors/384516 "2026-01-13T17:18:04Z")
Hi, how can I resolve this build issue with Kibana 8.19.9? yarn build yarn run v1.22.22 $ yarn plugin-helpers build --debug --verbose $ node ../../scripts/plugin\_helpers build --debug --verbose \[baseline-browser-mapping… --- ## [It is possible to autoratate datastream at Kibana?](https://discuss.elastic.co/t/it-is-possible-to-autoratate-datastream-at-kibana/384171)
**Author:** [@alastor](https://discuss.elastic.co/u/alastor)\ **Replies:** 2\ **Last updated:** [December 19, 2025, 3:30pm UTC](https://discuss.elastic.co/t/it-is-possible-to-autoratate-datastream-at-kibana/384171 "2025-12-19T15:30:22Z")
Hello, i would like to share this issue: i got a kibana and filebeat reported to elasticsearch inside K8s, but that by default creates a datastream called .ds-filebeat-8.5.1-2025.12.14-000001, it is possible to make a r… --- ## [No line breaks in strings within Data Lens Table](https://discuss.elastic.co/t/no-line-breaks-in-strings-within-data-lens-table/383445)
**Author:** [@edgarcloud](https://discuss.elastic.co/u/edgarcloud)\ **Replies:** 2\ **Last updated:** [November 15, 2025, 9:46am UTC](https://discuss.elastic.co/t/no-line-breaks-in-strings-within-data-lens-table/383445 "2025-11-15T09:46:18Z")
Hello everyone, I have a problem with line breaks in strings. In the Discovery view, the line breaks are displayed correctly. Unfortunately, in the Lens Data Table, the line breaks are not displayed. Everything is writte… --- ## [Removing empty fields from an event (2026 edition!)](https://discuss.elastic.co/t/removing-empty-fields-from-an-event-2026-edition/389831)
**Author:** [@Supermathie](https://discuss.elastic.co/u/Supermathie)\ **Replies:** 0\ **Last updated:** [August 20, 2026, 3:02pm UTC](https://discuss.elastic.co/t/removing-empty-fields-from-an-event-2026-edition/389831 "2026-08-20T15:02:02Z")
Continuing the discussion from Removing empty fields from an event (2024 edition!): It now removes any empty objects left over after removing empty fields: filter { ruby { id =\> "remove empty fields" path =\> … --- ## [ECK AWS Pod Identity instead of iam user/secret key pair](https://discuss.elastic.co/t/eck-aws-pod-identity-instead-of-iam-user-secret-key-pair/386418)
**Author:** [@khteh](https://discuss.elastic.co/u/khteh)\ **Replies:** 0\ **Last updated:** [May 20, 2026, 5:21am UTC](https://discuss.elastic.co/t/eck-aws-pod-identity-instead-of-iam-user-secret-key-pair/386418 "2026-05-20T05:21:57Z")
I used to add the AWS credentials into elasticsearch (ECK) keystore to backup to AWS S3. And then I was told that this is not a recommended good practice but should use pod identity or environment variables injected by i… --- ## [Add node need permission on scalling elasticsearch chapter](https://discuss.elastic.co/t/add-node-need-permission-on-scalling-elasticsearch-chapter/386376)
**Author:** [@hardiyan46](https://discuss.elastic.co/u/hardiyan46)\ **Replies:** 0\ **Last updated:** [May 18, 2026, 7:25am UTC](https://discuss.elastic.co/t/add-node-need-permission-on-scalling-elasticsearch-chapter/386376 "2026-05-18T07:25:12Z")
Course: Elastic Certified Engineer self paced learning plan Version: Scaling Elasticsearch chapter Question: When adding a node using the \`kubectl\` command, permissions are required, I don't see any credentials provide… --- ## [AI Assistant - Need to add a new LLM to Elastic](https://discuss.elastic.co/t/ai-assistant-need-to-add-a-new-llm-to-elastic/385506)
**Author:** [@venkatkumar229](https://discuss.elastic.co/u/venkatkumar229)\ **Replies:** 0\ **Last updated:** [March 18, 2026, 1:02pm UTC](https://discuss.elastic.co/t/ai-assistant-need-to-add-a-new-llm-to-elastic/385506 "2026-03-18T13:02:47Z")
Hi Team, We are currently using Elasticsearch within our ELK platform to reconcile data received from multiple source systems. This is implemented using Elasticsearch transforms, where we compare data across multiple sy… --- ## [Palo Alto Ingest Pipeline: Audit Logs](https://discuss.elastic.co/t/palo-alto-ingest-pipeline-audit-logs/385588)
**Author:** [@6igwig](https://discuss.elastic.co/u/6igwig)\ **Replies:** 1\ **Last updated:** [March 23, 2026, 9:49pm UTC](https://discuss.elastic.co/t/palo-alto-ingest-pipeline-audit-logs/385588 "2026-03-23T21:49:36Z")
The 2 Grok patterns supplied in the PANW ingest pipelines are not sufficient for parsing audit logs. I have created the grok pattern required to parse PANW audit logs and even submitted a merge request, but no one ever l… --- ## [Wildcard phrases with slop using string query](https://discuss.elastic.co/t/wildcard-phrases-with-slop-using-string-query/385418)
**Author:** [@S-Dragon0302](https://discuss.elastic.co/u/S-Dragon0302)\ **Replies:** 1\ **Last updated:** [March 12, 2026, 8:29am UTC](https://discuss.elastic.co/t/wildcard-phrases-with-slop-using-string-query/385418 "2026-03-12T08:29:31Z")
Is this kind of query still not supported. This won't work. "query\_string": { "fields": \[ "nickname" \], "query": "content:\\"hello\\" AND \\"Rodan Fields?\\"", "default\_operator": "AND" } Writing "slop" like this w… --- ## [Can't generate reports - Error: Unable to grant an API Key, request does not contain an authorization header](https://discuss.elastic.co/t/cant-generate-reports-error-unable-to-grant-an-api-key-request-does-not-contain-an-authorization-header/383385)
**Author:** [@stmx38](https://discuss.elastic.co/u/stmx38)\ **Replies:** 1\ **Last updated:** [November 12, 2025, 11:31am UTC](https://discuss.elastic.co/t/cant-generate-reports-error-unable-to-grant-an-api-key-request-does-not-contain-an-authorization-header/383385 "2025-11-12T11:31:50Z")
Hello, We recently observed that we can’t generate reports in Kibana and get the following error Unable to create report Unable to grant an API Key, request does not contain an authorization header We are using… --- ## [In oracle integration, The sysmetric dataset is not being populated ? Could it be because of the oracle db being a PDB instead of CDB?](https://discuss.elastic.co/t/in-oracle-integration-the-sysmetric-dataset-is-not-being-populated-could-it-be-because-of-the-oracle-db-being-a-pdb-instead-of-cdb/387344)
**Author:** [@Mansi\_Sharma1](https://discuss.elastic.co/u/Mansi_Sharma1)\ **Replies:** 0\ **Last updated:** [June 26, 2026, 9:08am UTC](https://discuss.elastic.co/t/in-oracle-integration-the-sysmetric-dataset-is-not-being-populated-could-it-be-because-of-the-oracle-db-being-a-pdb-instead-of-cdb/387344 "2026-06-26T09:08:02Z")
Hi, I integrated a oracle db using elastic agent oracle integration, the rest of the datastream\_datasets are populating all of the fields execept for the SYSMETRIC one. I even checked with the DB team and they have gra… --- ## [Dec 6th, 2025: \[FR\] Discutez avec votre AutoOps](https://discuss.elastic.co/t/dec-6th-2025-fr-discutez-avec-votre-autoops/383720)
**Author:** [@val](https://discuss.elastic.co/u/val)\ **Replies:** 0\ **Last updated:** [December 6, 2025, 8:00am UTC](https://discuss.elastic.co/t/dec-6th-2025-fr-discutez-avec-votre-autoops/383720 "2025-12-06T08:00:47Z")
Cet article est aussi disponible en anglais. AutoOps vous aide à diagnostiquer les problèmes de votre cluster Elasticsearch en collectant, analysant et corrélant des centaines de métriques en temps réel, fournissant … --- ## [Announcing London Search Week](https://discuss.elastic.co/t/announcing-london-search-week/383200)
**Author:** [@Charlie\_Hull1](https://discuss.elastic.co/u/Charlie_Hull1)\ **Replies:** 0\ **Last updated:** [November 4, 2025, 10:00am UTC](https://discuss.elastic.co/t/announcing-london-search-week/383200 "2025-11-04T10:00:00Z")
Hi everyone - I’m excited to announce London Search Week (londonsearchweek dot com) between 24th-28th November - we have a BarCamp for Search Product Managers, a Search & Information Retrieval Meetup, the Search Solution… --- ## [SASL\_PLAINTEXT AND SASL\_SSL ISSUE](https://discuss.elastic.co/t/sasl-plaintext-and-sasl-ssl-issue/383043)
**Author:** [@Thirupathi](https://discuss.elastic.co/u/Thirupathi)\ **Replies:** 0\ **Last updated:** [October 28, 2025, 10:32am UTC](https://discuss.elastic.co/t/sasl-plaintext-and-sasl-ssl-issue/383043 "2025-10-28T10:32:16Z")
Kafka Output Configuration (unified for both sources) output.kafka: hosts: \["xxxxxxx:19094"\] # Updated to use the SSL-enabled broker topic: 'npc-raw-msg' key: '%{\[UUID\]}' codec.format: string: '%{\[message\]}' parti… --- ## [Unexpected behavior when using match\_bool\_prefix with synonyms](https://discuss.elastic.co/t/unexpected-behavior-when-using-match-bool-prefix-with-synonyms/383755)
**Author:** [@gs\_elastic](https://discuss.elastic.co/u/gs_elastic)\ **Replies:** 2\ **Last updated:** [December 1, 2025, 7:15am UTC](https://discuss.elastic.co/t/unexpected-behavior-when-using-match-bool-prefix-with-synonyms/383755 "2025-12-01T07:15:25Z")
I'm experiencing unexpected behavior when using match\_bool\_prefix together with a synonym\_graph filter on the search analyzer. I found a similar topic previously asked: Prefix query not matching any documents — I used … --- ## [Clarification on shard allocation with 4 nodes across 3 zones using awareness](https://discuss.elastic.co/t/clarification-on-shard-allocation-with-4-nodes-across-3-zones-using-awareness/386077)
**Author:** [@yago82](https://discuss.elastic.co/u/yago82)\ **Replies:** 1\ **Last updated:** [April 29, 2026, 6:15am UTC](https://discuss.elastic.co/t/clarification-on-shard-allocation-with-4-nodes-across-3-zones-using-awareness/386077 "2026-04-29T06:15:10Z")
Hi, I’d like to clarify how shard allocation behaves in a specific setup using shard allocation awareness. Cluster setup: 4 data nodes 3 zones (AZ-A, AZ-B, AZ-C) AZ-A: 2 nodes AZ-B: 1 node AZ-C: 1 node … [Previous page](https://discuss.elastic.co/top.md?page=24&per_page=50) [Next page](https://discuss.elastic.co/top.md?page=26&per_page=50)