# Top **URL:** https://discuss.elastic.co/top.md?page=26 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 27 --- ## [Understand the impact on the document writing process after setting index.translog.durability=true](https://discuss.elastic.co/t/understand-the-impact-on-the-document-writing-process-after-setting-index-translog-durability-true/385517)
**Author:** [@mloine](https://discuss.elastic.co/u/mloine)\ **Replies:** 1\ **Last updated:** [March 19, 2026, 6:17am UTC](https://discuss.elastic.co/t/understand-the-impact-on-the-document-writing-process-after-setting-index-translog-durability-true/385517 "2026-03-19T06:17:51Z")
After setting index.translog.durability=true, the time to successfully respond to the client is whether to respond to the client as long as the primary shard is successful without shutting down the replicas, or to respon… --- ## [Completion Suggester Sorting](https://discuss.elastic.co/t/completion-suggester-sorting/384873)
**Author:** [@Pathwax](https://discuss.elastic.co/u/Pathwax)\ **Replies:** 1\ **Last updated:** [February 9, 2026, 8:15pm UTC](https://discuss.elastic.co/t/completion-suggester-sorting/384873 "2026-02-09T20:15:18Z")
Hi, I created an index that only contains the suggest property: PUT /test { "mappings": { "properties": { "suggest": { "type": "completion", "analyzer": "standard", "preserve\_separat… --- ## [Problems Correlating Data with Rules Created for Detecting Access to Forbidden Websites](https://discuss.elastic.co/t/problems-correlating-data-with-rules-created-for-detecting-access-to-forbidden-websites/386197)
**Author:** [@Matheusreis12](https://discuss.elastic.co/u/Matheusreis12)\ **Replies:** 0\ **Last updated:** [May 6, 2026, 7:57pm UTC](https://discuss.elastic.co/t/problems-correlating-data-with-rules-created-for-detecting-access-to-forbidden-websites/386197 "2026-05-06T19:57:29Z")
Hello friends Good morning I hope you are all well. I recently encountered a question regarding a client's request involving the creation of a rule to detect access to certain IP addresses. The client has some rules … --- ## [Elastic Security for SIEM lab 7-3 timeline correlation tab in timeline doesn't work](https://discuss.elastic.co/t/elastic-security-for-siem-lab-7-3-timeline-correlation-tab-in-timeline-doesnt-work/383239)
**Author:** [@Gloom](https://discuss.elastic.co/u/Gloom)\ **Replies:** 0\ **Last updated:** [November 5, 2025, 12:21pm UTC](https://discuss.elastic.co/t/elastic-security-for-siem-lab-7-3-timeline-correlation-tab-in-timeline-doesnt-work/383239 "2025-11-05T12:21:55Z")
Course: Elastic Security for SIEM Question: When attempting to do lab 7-3, at step 7-2 clicking the correlation tab in timeline doesn’t do anything I just remain on the query tab. Is there some other setting I need to c… --- ## [How to break down (terms aggregation) in Kibana Lens by a sub-key of a flattened field (other than a runtime field)](https://discuss.elastic.co/t/how-to-break-down-terms-aggregation-in-kibana-lens-by-a-sub-key-of-a-flattened-field-other-than-a-runtime-field/388352)
**Author:** [@shojiiii](https://discuss.elastic.co/u/shojiiii)\ **Replies:** 0\ **Last updated:** [July 15, 2026, 4:43am UTC](https://discuss.elastic.co/t/how-to-break-down-terms-aggregation-in-kibana-lens-by-a-sub-key-of-a-flattened-field-other-than-a-runtime-field/388352 "2026-07-15T04:43:38Z")
Environment Elasticsearch / Kibana: 8.14.0 ~several million to ~10 million documents per index (daily indices) What I want to do In Kibana Lens, I want to break down (Top values / terms aggregation) by the value of a… --- ## [Dec 20th, 2025: \[PT-BR\] O paradoxo da performance: quando um código mais lento não te atrasa](https://discuss.elastic.co/t/dec-20th-2025-pt-br-o-paradoxo-da-performance-quando-um-codigo-mais-lento-nao-te-atrasa/384150)
**Author:** [@AndersonQ](https://discuss.elastic.co/u/AndersonQ)\ **Replies:** 0\ **Last updated:** [December 20, 2025, 8:00am UTC](https://discuss.elastic.co/t/dec-20th-2025-pt-br-o-paradoxo-da-performance-quando-um-codigo-mais-lento-nao-te-atrasa/384150 "2025-12-20T08:00:37Z")
This post is also available in English. Bem vindo ao dia 20 do nosso Calendário do Advento! Atras da porta de de hoje não encontrarems whisky (como eu geralmente encontro), mas algo melhor para um engneheiro de softw… --- ## [Dec 18th, 2025: \[ES\] Búsqueda Vectorial con ES|QL](https://discuss.elastic.co/t/dec-18th-2025-es-busqueda-vectorial-con-es-ql/384026)
**Author:** [@Carlos\_D](https://discuss.elastic.co/u/Carlos_D)\ **Replies:** 0\ **Last updated:** [December 18, 2025, 8:00am UTC](https://discuss.elastic.co/t/dec-18th-2025-es-busqueda-vectorial-con-es-ql/384026 "2025-12-18T08:00:18Z")
This post is also available in English. Búsqueda Vectorial con ES|QL Hoy descubrimos una de las incorporaciones más interesantes en ES|QL: Soporte nativo para campos dense\_vector, y las funciones para buscar en ellos… --- ## [Trace is not showing full information, out of a billion event on websphere java app](https://discuss.elastic.co/t/trace-is-not-showing-full-information-out-of-a-billion-event-on-websphere-java-app/383179)
**Author:** [@Serak\_Shiferaw](https://discuss.elastic.co/u/Serak_Shiferaw)\ **Replies:** 0\ **Last updated:** [November 3, 2025, 10:44am UTC](https://discuss.elastic.co/t/trace-is-not-showing-full-information-out-of-a-billion-event-on-websphere-java-app/383179 "2025-11-03T10:44:24Z")
Trace is not showing full information on trace page, out half a billion event on websphere java app, but i am able to see a lot of those details on discover index, not sure why everything is aggregated into one transacti… --- ## [Elasticsearch coordinating node OOM/crash under sustained ingest (60k docs/min) with high shard count (~800)](https://discuss.elastic.co/t/elasticsearch-coordinating-node-oom-crash-under-sustained-ingest-60k-docs-min-with-high-shard-count-800/386710)
**Author:** [@Osmel\_Pillot](https://discuss.elastic.co/u/Osmel_Pillot)\ **Replies:** 1\ **Last updated:** [June 4, 2026, 3:53am UTC](https://discuss.elastic.co/t/elasticsearch-coordinating-node-oom-crash-under-sustained-ingest-60k-docs-min-with-high-shard-count-800/386710 "2026-06-04T03:53:49Z")
I have an Elasticsearch cluster with 3 master nodes (6 GB RAM each), 2 data nodes (16 GB RAM each), 1 ingest node (8 GB RAM), 1 coordinating node (16 GB RAM), and 1 transform node (6 GB RAM). Additionally, I have 1 Kiban… --- ## [Params.\_interval in LENS](https://discuss.elastic.co/t/params-interval-in-lens/384065)
**Author:** [@Arshukla](https://discuss.elastic.co/u/Arshukla)\ **Replies:** 1\ **Last updated:** [December 15, 2025, 12:13pm UTC](https://discuss.elastic.co/t/params-interval-in-lens/384065 "2025-12-15T12:13:14Z")
Hi I am using params.\_interval in TSVB, and want to use the same interval thing in LENS. What is the way to do the same in LENS? As in denominator I want to use the interval in LENS, for preparing a tabular dashboard --- ## [Elastic POC Sizing & Architecture](https://discuss.elastic.co/t/elastic-poc-sizing-architecture/386669)
**Author:** [@Sharmon](https://discuss.elastic.co/u/Sharmon)\ **Replies:** 0\ **Last updated:** [June 3, 2026, 3:58am UTC](https://discuss.elastic.co/t/elastic-poc-sizing-architecture/386669 "2026-06-03T03:58:56Z")
Hello Everyone, I recently joined in a Distributor for elastic and now we have to do POC, I am fairly new to Elastic and my main concern is if we have an estimated ingest of around 400 GB/Day how do we design the archi… --- ## [After reindexing. what needs to be done for alerts and dashboard?](https://discuss.elastic.co/t/after-reindexing-what-needs-to-be-done-for-alerts-and-dashboard/385599)
**Author:** [@Whoami1980](https://discuss.elastic.co/u/Whoami1980)\ **Replies:** 0\ **Last updated:** [March 25, 2026, 6:59am UTC](https://discuss.elastic.co/t/after-reindexing-what-needs-to-be-done-for-alerts-and-dashboard/385599 "2026-03-25T06:59:32Z")
We are re-indexing our indices and giving it a new name lets say "indicies\_name\_v2" I suppose this will have impact to our alerts and dashboard Correct me if i am wrong. For alerts i suppose this is what we need to do … --- ## [Can't disable Kibana calls to 169.254.169.254](https://discuss.elastic.co/t/cant-disable-kibana-calls-to-169-254-169-254/385018)
**Author:** [@fentom](https://discuss.elastic.co/u/fentom)\ **Replies:** 0\ **Last updated:** [February 12, 2026, 10:01am UTC](https://discuss.elastic.co/t/cant-disable-kibana-calls-to-169-254-169-254/385018 "2026-02-12T10:01:40Z")
I’m running Kibana and Elasticsearch using ECK Operator on an air gapped K8s cluster which also uses Cilium to configure network policies. In the Hubble UI provided by Cilium I can see that requests from Elasticsearch a… --- ## [Deployment methods other than using ECK for logstash](https://discuss.elastic.co/t/deployment-methods-other-than-using-eck-for-logstash/384991)
**Author:** [@yossib](https://discuss.elastic.co/u/yossib)\ **Replies:** 0\ **Last updated:** [February 10, 2026, 9:52am UTC](https://discuss.elastic.co/t/deployment-methods-other-than-using-eck-for-logstash/384991 "2026-02-10T09:52:45Z")
I’m looking for alternatives of deploying logstash on openshift other than using ECK operator --- ## [Some agent API keys get invalidated then deleted](https://discuss.elastic.co/t/some-agent-api-keys-get-invalidated-then-deleted/383631)
**Author:** [@rugenl](https://discuss.elastic.co/u/rugenl)\ **Replies:** 0\ **Last updated:** [November 25, 2025, 4:00am UTC](https://discuss.elastic.co/t/some-agent-api-keys-get-invalidated-then-deleted/383631 "2025-11-25T04:00:50Z")
I noticed errors “Unable to authenticate - apikey not found”. For a few apikeys. They are frequently repeated. This is an Elastic cloud hosted stack. These seem to have started with the prior version update, then mor… --- ## [Weird recall trend with HNSW int8 quantization: Smaller indices show worse recall](https://discuss.elastic.co/t/weird-recall-trend-with-hnsw-int8-quantization-smaller-indices-show-worse-recall/384322)
**Author:** [@viperv](https://discuss.elastic.co/u/viperv)\ **Replies:** 1\ **Last updated:** [December 31, 2025, 4:03pm UTC](https://discuss.elastic.co/t/weird-recall-trend-with-hnsw-int8-quantization-smaller-indices-show-worse-recall/384322 "2025-12-31T16:03:59Z")
Hi, ​I am performing recall tests on indices containing CLIP vectors of varying sizes (ranging from 500,000 to 4,500,000 vectors). I am using HNSW (with the default parameters) with int8 quantization, and each index has… --- ## [Password required for Sudo install](https://discuss.elastic.co/t/password-required-for-sudo-install/384141)
**Author:** [@sharona](https://discuss.elastic.co/u/sharona)\ **Replies:** 1\ **Last updated:** [December 17, 2025, 12:26pm UTC](https://discuss.elastic.co/t/password-required-for-sudo-install/384141 "2025-12-17T12:26:59Z")
I’m using the Strigo environment and it keeps prompting for the elastic password. I tried using the training access password and it doesn’t work. --- ## [Generate PDF puts timing in light grey](https://discuss.elastic.co/t/generate-pdf-puts-timing-in-light-grey/382887)
**Author:** [@jorism-ict](https://discuss.elastic.co/u/jorism-ict)\ **Replies:** 1\ **Last updated:** [October 23, 2025, 10:10am UTC](https://discuss.elastic.co/t/generate-pdf-puts-timing-in-light-grey/382887 "2025-10-23T10:10:54Z")
When creating a PDF Report from a dashboard, using “Generate PDF”, the PDF is generated, but the title of the report, including the selected timeframe (top -center of the generated pdf) is printed in light grey. We had c… --- ## [Collect Kubernetes audit logs from local files only if node label exists via fleet](https://discuss.elastic.co/t/collect-kubernetes-audit-logs-from-local-files-only-if-node-label-exists-via-fleet/386344)
**Author:** [@AndrewDatTeranet](https://discuss.elastic.co/u/AndrewDatTeranet)\ **Replies:** 0\ **Last updated:** [May 14, 2026, 6:10pm UTC](https://discuss.elastic.co/t/collect-kubernetes-audit-logs-from-local-files-only-if-node-label-exists-via-fleet/386344 "2026-05-14T18:10:16Z")
While trying to set up the "Collect Kubernetes audit logs from local files" with the Kubernetes integration in fleet, I was trying to add a condition to only collect logs if the node label kubernetes.labels.node-role\_kub… --- ## [\[Elastic Log Driver\] Structured JSON logs breaks when Docker splits large log lines](https://discuss.elastic.co/t/elastic-log-driver-structured-json-logs-breaks-when-docker-splits-large-log-lines/385448)
**Author:** [@empee](https://discuss.elastic.co/u/empee)\ **Replies:** 0\ **Last updated:** [March 14, 2026, 2:10am UTC](https://discuss.elastic.co/t/elastic-log-driver-structured-json-logs-breaks-when-docker-splits-large-log-lines/385448 "2026-03-14T02:10:11Z")
Summary When using the Elastic Docker Logging Plugin, applications that already emit structured JSON logs cannot reliably ingest them into Elasticsearch because Docker may split large log lines before they reach the logg… --- ## [Kibana Lens/Time Series Chart Incorrectly Splits Documents That Fall Exactly on a Minute Boundary](https://discuss.elastic.co/t/kibana-lens-time-series-chart-incorrectly-splits-documents-that-fall-exactly-on-a-minute-boundary/390125)
**Author:** [@sebastian31231](https://discuss.elastic.co/u/sebastian31231)\ **Replies:** 0\ **Last updated:** [September 2, 2026, 9:03am UTC](https://discuss.elastic.co/t/kibana-lens-time-series-chart-incorrectly-splits-documents-that-fall-exactly-on-a-minute-boundary/390125 "2026-09-02T09:03:59Z")
Hi, I’m having an issue with data visualization in Kibana on a time series chart. It appears that documents whose timestamps fall very close to the start of a full minute - e.g., \`12:15:00.03\` - aren’t always assigned t… --- ## [Hot and warm STS stuck and no pods created & helmfile apply or sync doesn't update STS replicas count](https://discuss.elastic.co/t/hot-and-warm-sts-stuck-and-no-pods-created-helmfile-apply-or-sync-doesnt-update-sts-replicas-count/386441)
**Author:** [@khteh](https://discuss.elastic.co/u/khteh)\ **Replies:** 0\ **Last updated:** [May 21, 2026, 11:55am UTC](https://discuss.elastic.co/t/hot-and-warm-sts-stuck-and-no-pods-created-helmfile-apply-or-sync-doesnt-update-sts-replicas-count/386441 "2026-05-21T11:55:09Z")
$ k logs -n elastic-system -l control-plane=elastic-operator No resources found in elastic-system namespace. $ k get all -n elastic-system NAME READY STATUS RESTARTS AGE pod/elastic-operato… --- ## [Collect Application Data learning module failing at second section - Edit APM Integration settings](https://discuss.elastic.co/t/collect-application-data-learning-module-failing-at-second-section-edit-apm-integration-settings/385529)
**Author:** [@Jes](https://discuss.elastic.co/u/Jes)\ **Replies:** 0\ **Last updated:** [March 19, 2026, 2:51pm UTC](https://discuss.elastic.co/t/collect-application-data-learning-module-failing-at-second-section-edit-apm-integration-settings/385529 "2026-03-19T14:51:59Z")
Course: Collect Application Data Version: Version on Elastic learning site 19/03/26 Question: In the second section - Edit APM Integration settings, the integration is not returning any data as expected after following… --- ## [Elastic Engineer On Demand - Module 7 video loading forever and break up constantly](https://discuss.elastic.co/t/elastic-engineer-on-demand-module-7-video-loading-forever-and-break-up-constantly/384535)
**Author:** [@eglantine.mallinger](https://discuss.elastic.co/u/eglantine.mallinger)\ **Replies:** 0\ **Last updated:** [January 14, 2026, 9:12am UTC](https://discuss.elastic.co/t/elastic-engineer-on-demand-module-7-video-loading-forever-and-break-up-constantly/384535 "2026-01-14T09:12:59Z")
Hi everyone, Best wishes as it’s still january ! Course: Elastic Engineer On Demand Version: module 7 - course that is supposed to be retired at the end of the month. (was hoping to be finished by that date) Question:… --- ## [Stack monitoring understanding](https://discuss.elastic.co/t/stack-monitoring-understanding/385140)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 1\ **Last updated:** [February 24, 2026, 7:05am UTC](https://discuss.elastic.co/t/stack-monitoring-understanding/385140 "2026-02-24T07:05:53Z")
Hi, Community, I am trying to understand this stack monitoring one of my busy index’s advance monitoring show this is this means total 888 search request came in and combine it tool 918.49ms ? or is it just one searc… --- ## [Using ignore\_malformed in dynamic template doesn't seems to work](https://discuss.elastic.co/t/using-ignore-malformed-in-dynamic-template-doesnt-seems-to-work/384647)
**Author:** [@yquirion](https://discuss.elastic.co/u/yquirion)\ **Replies:** 1\ **Last updated:** [January 20, 2026, 5:40pm UTC](https://discuss.elastic.co/t/using-ignore-malformed-in-dynamic-template-doesnt-seems-to-work/384647 "2026-01-20T17:40:49Z")
Dear Community! I’m having a strange problem while trying to implement ignore\_malformed to avoid documents being dropped when a field contains invalid data. From my Logstash logs, I often see messages like this: \[...\]… --- ## [Logstash split one JSON document into multiple events](https://discuss.elastic.co/t/logstash-split-one-json-document-into-multiple-events/383935)
**Author:** [@eoszej](https://discuss.elastic.co/u/eoszej)\ **Replies:** 1\ **Last updated:** [December 9, 2025, 8:40pm UTC](https://discuss.elastic.co/t/logstash-split-one-json-document-into-multiple-events/383935 "2025-12-09T20:40:25Z")
Would you please help split a single JSON document being sent to Logstash into multiple events? There are some fields that are shared across the events but the fields that have a trailing number, such as "\_0001", are un… --- ## [I want to use Elastic "Cloud Hosted" in Azure. Where infrastructure is hosted in Microsoft or Elastic Datacenter?](https://discuss.elastic.co/t/i-want-to-use-elastic-cloud-hosted-in-azure-where-infrastructure-is-hosted-in-microsoft-or-elastic-datacenter/383785)
**Author:** [@Karol\_Leszczynski](https://discuss.elastic.co/u/Karol_Leszczynski)\ **Replies:** 1\ **Last updated:** [December 1, 2025, 2:58pm UTC](https://discuss.elastic.co/t/i-want-to-use-elastic-cloud-hosted-in-azure-where-infrastructure-is-hosted-in-microsoft-or-elastic-datacenter/383785 "2025-12-01T14:58:31Z")
Hi, Sorry if this is a trivial question, but I can’t find a clear answer. My company wants to use Elasticsearch, and we have strict governance policies. If we choose the managed Elasticsearch offering from Azure, where … --- ## ["precondition failed: EOF" error in apm-server logs on kubernetes](https://discuss.elastic.co/t/precondition-failed-eof-error-in-apm-server-logs-on-kubernetes/383196)
**Author:** [@amritansh](https://discuss.elastic.co/u/amritansh)\ **Replies:** 0\ **Last updated:** [November 4, 2025, 9:16am UTC](https://discuss.elastic.co/t/precondition-failed-eof-error-in-apm-server-logs-on-kubernetes/383196 "2025-11-04T09:16:57Z")
Hi I am facing a "precondition failed: EOF" error on my elastic setup on kubernetes while configuring elastic java apm agent. I checked the service connectivity and it seems to be fine. Attaching the apm-server logs … --- ## [POST /\_fleet/maintenance/cleanup?](https://discuss.elastic.co/t/post-fleet-maintenance-cleanup/385355)
**Author:** [@Juan\_de\_Dios\_Macias1](https://discuss.elastic.co/u/Juan_de_Dios_Macias1)\ **Replies:** 1\ **Last updated:** [March 6, 2026, 4:48am UTC](https://discuss.elastic.co/t/post-fleet-maintenance-cleanup/385355 "2026-03-06T04:48:58Z")
Hi, I have a cluster with a single node where I’m seeing some indices that I can’t delete because Elasticsearch tells me that my elastic user needs superuser permissions. I found the API request POST /\_fleet/maintenance/… --- ## [No of buckets creation for composite aggregation](https://discuss.elastic.co/t/no-of-buckets-creation-for-composite-aggregation/383350)
**Author:** [@KrishnaVardhan\_Reddy](https://discuss.elastic.co/u/KrishnaVardhan_Reddy)\ **Replies:** 1\ **Last updated:** [November 21, 2025, 5:25pm UTC](https://discuss.elastic.co/t/no-of-buckets-creation-for-composite-aggregation/383350 "2025-11-21T17:25:08Z")
lets say, I have 40000 unique buckets, can i use composite aggregation to fetch 1000 buckets at once, repeat the call until i fetch all the buckets --- ## [Intervalsクエリで、同一文字列を指定した場合の挙動に違和感](https://discuss.elastic.co/t/intervals/387934)
**Author:** [@2e65f6a209d2626883a5](https://discuss.elastic.co/u/2e65f6a209d2626883a5)\ **Replies:** 0\ **Last updated:** [July 9, 2026, 5:18am UTC](https://discuss.elastic.co/t/intervals/387934 "2026-07-09T05:18:10Z")
お世話になっております。 当方、elasticsearch9.4で動作確認を行っております。 intervalsクエリで、同一の文字列（複数トークン）を指定したときの距離のカウント方法に違和感があるのですが、どのようなカウントになっているのかご教示いただければ幸いです。 ■インデックス設定、データ投入 PUT test\_intervals { "settings": { "analysis": { "to… --- ## [LAG() LEAD() Functions in ES|QL](https://discuss.elastic.co/t/lag-lead-functions-in-es-ql/386589)
**Author:** [@YousefNein](https://discuss.elastic.co/u/YousefNein)\ **Replies:** 0\ **Last updated:** [May 31, 2026, 12:27am UTC](https://discuss.elastic.co/t/lag-lead-functions-in-es-ql/386589 "2026-05-31T00:27:12Z")
Will there be an addition for LAG() or LEAD() functions that are in SQL added to ES|QL in the future? --- ## [Prometheus support](https://discuss.elastic.co/t/prometheus-support/383869)
**Author:** [@ilyazh](https://discuss.elastic.co/u/ilyazh)\ **Replies:** 0\ **Last updated:** [December 4, 2025, 4:14pm UTC](https://discuss.elastic.co/t/prometheus-support/383869 "2025-12-04T16:14:24Z")
Hello, when I was at the ElasticON in Munich on Nov 6th 2025 there was a short presentation “A new era for Metrics in Elastic: Performance, Prometheus, and more” where the presenter talked about Elasticsearch being able… --- ## [Embedding Kibana Dashboards with multiple anon accounts](https://discuss.elastic.co/t/embedding-kibana-dashboards-with-multiple-anon-accounts/385905)
**Author:** [@HermanDev](https://discuss.elastic.co/u/HermanDev)\ **Replies:** 1\ **Last updated:** [April 16, 2026, 7:27am UTC](https://discuss.elastic.co/t/embedding-kibana-dashboards-with-multiple-anon-accounts/385905 "2026-04-16T07:27:59Z")
Here is my use case: We built 4 analytics dashboards, and would like to have those 4 dashboards embedded into our site. I have managed to get this working using anonymous accounts. The problem we are facing is that ou… --- ## [I have ES on a 5 Windows machines](https://discuss.elastic.co/t/i-have-es-on-a-5-windows-machines/385781)
**Author:** [@stanimir\_kirilov](https://discuss.elastic.co/u/stanimir_kirilov)\ **Replies:** 1\ **Last updated:** [April 8, 2026, 4:07pm UTC](https://discuss.elastic.co/t/i-have-es-on-a-5-windows-machines/385781 "2026-04-08T16:07:42Z")
Hello, I’m running Elasticsearch on five Windows virtual machines, and applying Windows updates to them is extremely time‑consuming.Each time I have to stop the shard allocation then proceed with the Windows updates, mak… --- ## [Syslogs are missing in Kibana](https://discuss.elastic.co/t/syslogs-are-missing-in-kibana/385209)
**Author:** [@pratiksha\_khalkar](https://discuss.elastic.co/u/pratiksha_khalkar)\ **Replies:** 1\ **Last updated:** [February 28, 2026, 6:20am UTC](https://discuss.elastic.co/t/syslogs-are-missing-in-kibana/385209 "2026-02-28T06:20:59Z")
Hi , I am forwarding syslogs from Entuity to ELK. However, in Kibana a few logs appear to be missing. For example, when I forward the same message 10 times from Entuity to ELK, Kibana shows only 8 or 9. Could you please… --- ## [How can we do elasticsearch and stack migration to new hardware, retaining all old data?](https://discuss.elastic.co/t/how-can-we-do-elasticsearch-and-stack-migration-to-new-hardware-retaining-all-old-data/383950)
**Author:** [@Aditya\_M](https://discuss.elastic.co/u/Aditya_M)\ **Replies:** 1\ **Last updated:** [December 10, 2025, 9:40am UTC](https://discuss.elastic.co/t/how-can-we-do-elasticsearch-and-stack-migration-to-new-hardware-retaining-all-old-data/383950 "2025-12-10T09:40:16Z")
We actually have single node cluster for now. Server is about to expire, so we have to shift this existing stack to new server. But now we dont want to rely on single node cluster, we have 3 new nodes, which will be our … --- ## [TCP output codec json not working in Logstash (data not sending)](https://discuss.elastic.co/t/tcp-output-codec-json-not-working-in-logstash-data-not-sending/383927)
**Author:** [@powary1415](https://discuss.elastic.co/u/powary1415)\ **Replies:** 1\ **Last updated:** [December 9, 2025, 8:08pm UTC](https://discuss.elastic.co/t/tcp-output-codec-json-not-working-in-logstash-data-not-sending/383927 "2025-12-09T20:08:39Z")
Hello Team, I am using Logstash to forward events using the TCP output plugin. When I configure the output with JSON codec, data is not being sent to the receiver. output { tcp { host =\> "hostName" port =\> 1415 cod… --- ## [Kibana 8.17.3 – Malware Detection of security\_labs Knowledge Base File (TROJ\_FRS.VSNTIA26)](https://discuss.elastic.co/t/kibana-8-17-3-malware-detection-of-security-labs-knowledge-base-file-troj-frs-vsntia26/390482)
**Author:** [@shiva3](https://discuss.elastic.co/u/shiva3)\ **Replies:** 0\ **Last updated:** [September 16, 2026, 10:21pm UTC](https://discuss.elastic.co/t/kibana-8-17-3-malware-detection-of-security-labs-knowledge-base-file-troj-frs-vsntia26/390482 "2026-09-16T22:21:06Z")
Hello Elastic Team, We are investigating a security alert involving the Kibana 8.17.3 Docker image deployed in our OpenShift environment. Our endpoint security product detected the following file as: Detection: TROJ\_F… --- ## [Using Elastic dashboards to monitor video export/upload workflow performance?](https://discuss.elastic.co/t/using-elastic-dashboards-to-monitor-video-export-upload-workflow-performance/386341)
**Author:** [@alishawinson](https://discuss.elastic.co/u/alishawinson)\ **Replies:** 0\ **Last updated:** [May 14, 2026, 3:08pm UTC](https://discuss.elastic.co/t/using-elastic-dashboards-to-monitor-video-export-upload-workflow-performance/386341 "2026-05-14T15:08:36Z")
I’ve been experimenting with using the Elastic Stack to monitor a small video editing workflow and wanted to ask if anyone here has done something similar. The idea is to collect logs and system metrics from editing/ren… --- ## [Operating system version when running inside Kubernetes daemonset](https://discuss.elastic.co/t/operating-system-version-when-running-inside-kubernetes-daemonset/385099)
**Author:** [@melkamar](https://discuss.elastic.co/u/melkamar)\ **Replies:** 0\ **Last updated:** [February 18, 2026, 4:36pm UTC](https://discuss.elastic.co/t/operating-system-version-when-running-inside-kubernetes-daemonset/385099 "2026-02-18T16:36:36Z")
Hello, I am running metricbeat inside a Kubernetes cluster as a DaemonSet based on the manifest yaml https://raw.githubusercontent.com/elastic/beats/8.19/deploy/kubernetes/metricbeat-kubernetes.yaml . However, the outp… --- ## [Unable to load a trained model on ML node with sufficient memory](https://discuss.elastic.co/t/unable-to-load-a-trained-model-on-ml-node-with-sufficient-memory/383252)
**Author:** [@gueri](https://discuss.elastic.co/u/gueri)\ **Replies:** 0\ **Last updated:** [November 5, 2025, 5:52pm UTC](https://discuss.elastic.co/t/unable-to-load-a-trained-model-on-ml-node-with-sufficient-memory/383252 "2025-11-05T17:52:09Z")
Hello Here is the scenario. I have 2 ML nodes with 8 procs/64 Gb on Elastic 8.15.3. I start by loading a large bge\_m3 model with 1 allocation and 1 thread. :slight\_smile: As you can see on picture, one node had a … --- ## [Terms Aggregation vs Field Collapse for Search Suggestions at Scale (100K+ unique values)](https://discuss.elastic.co/t/terms-aggregation-vs-field-collapse-for-search-suggestions-at-scale-100k-unique-values/383182)
**Author:** [@Yousif\_Alneamy](https://discuss.elastic.co/u/Yousif_Alneamy)\ **Replies:** 0\ **Last updated:** [November 3, 2025, 11:54am UTC](https://discuss.elastic.co/t/terms-aggregation-vs-field-collapse-for-search-suggestions-at-scale-100k-unique-values/383182 "2025-11-03T11:54:55Z")
I'm building a search suggestion feature and need help choosing between terms aggregation and field collapse for my use case. My Dataset: 3 million items in the index 100,000+ unique product names (\`brandName\` in … --- ## [False Positive](https://discuss.elastic.co/t/false-positive/390842)
**Author:** [@JasperHedge](https://discuss.elastic.co/u/JasperHedge)\ **Replies:** 0\ **Last updated:** [October 5, 2026, 1:15pm UTC](https://discuss.elastic.co/t/false-positive/390842 "2026-10-05T13:15:41Z")
Hi there, I know I should report false positives through the form. And I did, but nothing happened. No response and it still keeps flagging as malicious. We've got it with almost all our software, somehow. And we don't … --- ## [The select time range does not include the entire bucket it may contain partial data](https://discuss.elastic.co/t/the-select-time-range-does-not-include-the-entire-bucket-it-may-contain-partial-data/388927)
**Author:** [@Ricardo\_Alves](https://discuss.elastic.co/u/Ricardo_Alves)\ **Replies:** 0\ **Last updated:** [July 31, 2026, 2:28pm UTC](https://discuss.elastic.co/t/the-select-time-range-does-not-include-the-entire-bucket-it-may-contain-partial-data/388927 "2026-07-31T14:28:56Z")
I want the graph to show just one day, and it shows me 2 days, with this message "The select time range does not include the entire bucket it may contain partial data". In attached I will send you the graph and the adva… --- ## [High Filebeat Disk I/O After Reboot With Ubuntu 24.04](https://discuss.elastic.co/t/high-filebeat-disk-i-o-after-reboot-with-ubuntu-24-04/388881)
**Author:** [@harrelst](https://discuss.elastic.co/u/harrelst)\ **Replies:** 0\ **Last updated:** [July 30, 2026, 3:32am UTC](https://discuss.elastic.co/t/high-filebeat-disk-i-o-after-reboot-with-ubuntu-24-04/388881 "2026-07-30T03:32:40Z")
We use a Filebeat DaemonSet to collect container logs from nodes in our Kubernetes cluster. I recently added some Ubuntu 24.04 nodes to the cluster, and when Filebeat restarts after a reboot generates around 150 MB/s of … --- ## [Question about certificates and auto-generating configuration](https://discuss.elastic.co/t/question-about-certificates-and-auto-generating-configuration/385318)
**Author:** [@hairless\_mess](https://discuss.elastic.co/u/hairless_mess)\ **Replies:** 0\ **Last updated:** [March 3, 2026, 9:59am UTC](https://discuss.elastic.co/t/question-about-certificates-and-auto-generating-configuration/385318 "2026-03-03T09:59:36Z")
Hello everyone! I have some questions regarding the certificates used when deploying elasticsearch. Elasticsearch auto generates certificates for http and transport which work out of the box, however from my understand… --- ## [Is reindexing much heavier than initial indexing?](https://discuss.elastic.co/t/is-reindexing-much-heavier-than-initial-indexing/385177)
**Author:** [@some](https://discuss.elastic.co/u/some)\ **Replies:** 0\ **Last updated:** [February 24, 2026, 11:46am UTC](https://discuss.elastic.co/t/is-reindexing-much-heavier-than-initial-indexing/385177 "2026-02-24T11:46:39Z")
I have single server with ES 9.2.5. It has 40cores/256GB RAM/12TB of SSD. Thers are 2 aliases, ILM is rotating indices at 200GB (10 shards per index). Everything works fine in terms of indexing/search speed, but I can… --- ## [Elastic Serverless: Agent deployment when using both Observability and Security](https://discuss.elastic.co/t/elastic-serverless-agent-deployment-when-using-both-observability-and-security/384673)
**Author:** [@Abdul\_Haseeb\_Q](https://discuss.elastic.co/u/Abdul_Haseeb_Q)\ **Replies:** 0\ **Last updated:** [January 21, 2026, 1:49pm UTC](https://discuss.elastic.co/t/elastic-serverless-agent-deployment-when-using-both-observability-and-security/384673 "2026-01-21T13:49:49Z")
Hey folks, We currently have Elastic Cloud (managed) deployed, where Observability, Security, and other Elastic features are available within a single deployment. In this setup, we install one Elastic Agent per host, an… [Previous page](https://discuss.elastic.co/top.md?page=25&per_page=50) [Next page](https://discuss.elastic.co/top.md?page=27&per_page=50)