# Top **URL:** https://discuss.elastic.co/top.md?page=27 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 28 --- ## [ES|QL Basic Help](https://discuss.elastic.co/t/es-ql-basic-help/383107)
**Author:** [@erikg](https://discuss.elastic.co/u/erikg)\ **Replies:** 0\ **Last updated:** [October 30, 2025, 6:21pm UTC](https://discuss.elastic.co/t/es-ql-basic-help/383107 "2025-10-30T18:21:15Z")
Hello, I did a STATS count = COUNT\_DISTINCT(event.outcome) by host.name. And it works, the only issue I wish I could keep the metadata information about the host? Is there a way to do this?? --- ## [Using gMSA account to create API key for Elasticsearch ingestion](https://discuss.elastic.co/t/using-gmsa-account-to-create-api-key-for-elasticsearch-ingestion/385445)
**Author:** [@Vishal\_Reddy\_P](https://discuss.elastic.co/u/Vishal_Reddy_P)\ **Replies:** 1\ **Last updated:** [March 14, 2026, 12:49am UTC](https://discuss.elastic.co/t/using-gmsa-account-to-create-api-key-for-elasticsearch-ingestion/385445 "2026-03-14T00:49:50Z")
Earlier we used a service account to log into Kibana and create an API key for log ingestion or reading events. Now we are moving to a gMSA (Group Managed Service Account) which is passwordless and cannot log in interac… --- ## [Fastest way to retrieve all unique terms in batches](https://discuss.elastic.co/t/fastest-way-to-retrieve-all-unique-terms-in-batches/385057)
**Author:** [@srishtii](https://discuss.elastic.co/u/srishtii)\ **Replies:** 1\ **Last updated:** [February 15, 2026, 9:47pm UTC](https://discuss.elastic.co/t/fastest-way-to-retrieve-all-unique-terms-in-batches/385057 "2026-02-15T21:47:17Z")
I’m looking for the fastest and safest way to retrieve all unique values of a field for a given time range, in batches. My requirements are: :white\_check\_mark: Retrieve 100% of unique terms (no missing buckets) … --- ## [Kibana visulaisatiion](https://discuss.elastic.co/t/kibana-visulaisatiion/384876)
**Author:** [@akmoharana](https://discuss.elastic.co/u/akmoharana)\ **Replies:** 1\ **Last updated:** [February 3, 2026, 11:23am UTC](https://discuss.elastic.co/t/kibana-visulaisatiion/384876 "2026-02-03T11:23:29Z")
Hi Everyone I want to create a Paid-to-Billed ratio visualization expressed as a percentage. Could someone please explain how to create this and what fields are required in the dataview? Thanks --- ## [Stable analysis plugin with native library fails entitlements in Elasticsearch 8.19.12](https://discuss.elastic.co/t/stable-analysis-plugin-with-native-library-fails-entitlements-in-elasticsearch-8-19-12/386411)
**Author:** [@dbenito](https://discuss.elastic.co/u/dbenito)\ **Replies:** 0\ **Last updated:** [May 19, 2026, 3:34pm UTC](https://discuss.elastic.co/t/stable-analysis-plugin-with-native-library-fails-entitlements-in-elasticsearch-8-19-12/386411 "2026-05-19T15:34:36Z")
Stable analysis plugin with native library fails entitlements in Elasticsearch 8.19.12 We are building a stable-analysis plugin that registers a custom TokenFilter via the stable plugin API. The plugin needs to load a bu… --- ## [Further enhance TOP ES|QL function please](https://discuss.elastic.co/t/further-enhance-top-es-ql-function-please/384898)
**Author:** [@RainTown](https://discuss.elastic.co/u/RainTown)\ **Replies:** 0\ **Last updated:** [February 3, 2026, 7:50pm UTC](https://discuss.elastic.co/t/further-enhance-top-es-ql-function-please/384898 "2026-02-03T19:50:22Z")
Now that 9.3.0 is out, I notice this added (and very useful) ES|QL feature: Support extra field (outputField) in TOP function. Values of outputField will be returned instead of values of field , as discussed here and t… --- ## [Logstash at Tenant end or server end?](https://discuss.elastic.co/t/logstash-at-tenant-end-or-server-end/390608)
**Author:** [@searchwithme](https://discuss.elastic.co/u/searchwithme)\ **Replies:** 1\ **Last updated:** [September 25, 2026, 10:59pm UTC](https://discuss.elastic.co/t/logstash-at-tenant-end-or-server-end/390608 "2026-09-25T22:59:52Z")
I’m trying to design an architecture where multiple tenants ingest their logs into Elastic. My understanding is that if the requirement is primarily log collection, I can use Elastic Agent, and if additional enrichment,… --- ## [Creating MSSP setup for lab (no license)](https://discuss.elastic.co/t/creating-mssp-setup-for-lab-no-license/386163)
**Author:** [@jatin3101](https://discuss.elastic.co/u/jatin3101)\ **Replies:** 1\ **Last updated:** [May 5, 2026, 1:07pm UTC](https://discuss.elastic.co/t/creating-mssp-setup-for-lab-no-license/386163 "2026-05-05T13:07:07Z")
Hi There!! i was just tasked with making a lab of mssp setup without cluster (we will have 4 users ) Users:- CustA - windows logs and only alerts of windows (can only see this ) CustB - linux logs and its alerts sup… --- ## [Removing alias fields from index but making sure dashboards are not broken](https://discuss.elastic.co/t/removing-alias-fields-from-index-but-making-sure-dashboards-are-not-broken/384797)
**Author:** [@MH2026](https://discuss.elastic.co/u/MH2026)\ **Replies:** 1\ **Last updated:** [January 30, 2026, 3:45am UTC](https://discuss.elastic.co/t/removing-alias-fields-from-index-but-making-sure-dashboards-are-not-broken/384797 "2026-01-30T03:45:12Z")
I have to remove alias fields from Index but those are being used in different dashboards, so how would I ensure that the dashboards don't break with my plan of removing alias fields --- ## [Multiple Machine Learning Alerts by Influencer Field failing Unknown column \[job\_id\]](https://discuss.elastic.co/t/multiple-machine-learning-alerts-by-influencer-field-failing-unknown-column-job-id/389743)
**Author:** [@willemdh](https://discuss.elastic.co/u/willemdh)\ **Replies:** 0\ **Last updated:** [August 18, 2026, 7:29am UTC](https://discuss.elastic.co/t/multiple-machine-learning-alerts-by-influencer-field-failing-unknown-column-job-id/389743 "2026-08-18T07:29:47Z")
Hello, I am seeing the prebuilt rule Multiple Machine Learning Alerts by Influencer Field fail with: verification\_exception Unknown column \[job\_id\] Unknown column \[influencers.influencer\_field\_name\] Unknown column \[inf… --- ## [Cloudwatch Integration State File Conflict](https://discuss.elastic.co/t/cloudwatch-integration-state-file-conflict/386904)
**Author:** [@andreaskapfer](https://discuss.elastic.co/u/andreaskapfer)\ **Replies:** 0\ **Last updated:** [June 19, 2026, 1:38pm UTC](https://discuss.elastic.co/t/cloudwatch-integration-state-file-conflict/386904 "2026-06-19T13:38:26Z")
Hello, we have registered an agent running on AWS ECS to collect our Kubernetes logs from AWS Cloudwatch. We are using start\_position: lastSync and a persistent AWS EFS volume for the agent's state. We are fetching two… --- ## [Clarification about frozen data on k8s](https://discuss.elastic.co/t/clarification-about-frozen-data-on-k8s/385397)
**Author:** [@Cario](https://discuss.elastic.co/u/Cario)\ **Replies:** 0\ **Last updated:** [March 10, 2026, 3:51pm UTC](https://discuss.elastic.co/t/clarification-about-frozen-data-on-k8s/385397 "2026-03-10T15:51:13Z")
Hello everyone, I am new to the forum and basically self-taught, so I apologize in advance if I lack some basic knowledge. Thank you for your understanding. The elastic cluster works on a k8s cluster as pods, but readi… --- ## [\[elastic-agent\]\[beats\] Problem when running as a non-root randomized UID](https://discuss.elastic.co/t/elastic-agent-beats-problem-when-running-as-a-non-root-randomized-uid/385353)
**Author:** [@AlexBaranowski](https://discuss.elastic.co/u/AlexBaranowski)\ **Replies:** 0\ **Last updated:** [March 5, 2026, 3:38pm UTC](https://discuss.elastic.co/t/elastic-agent-beats-problem-when-running-as-a-non-root-randomized-uid/385353 "2026-03-05T15:38:18Z")
The OpenShift environment has a security policy that requires containers to run with a randomized UID. This causes issues when running the Elastic Agent. Typically, a standard solution is to ensure the user belongs to gr… --- ## [Unable to connect the logtash](https://discuss.elastic.co/t/unable-to-connect-the-logtash/383628)
**Author:** [@Kyu\_Kazami](https://discuss.elastic.co/u/Kyu_Kazami)\ **Replies:** 0\ **Last updated:** [November 24, 2025, 6:38pm UTC](https://discuss.elastic.co/t/unable-to-connect-the-logtash/383628 "2025-11-24T18:38:35Z")
Hi, im kinda new in this ELK Stack things, i’do have a problem with connectiong nginx to logstash =\> ES. the ELK stack is perfectly run but when im running the logstash to connect logstash and ES it just like this kyuka… --- ## [Send Meta Data with RUM for APM](https://discuss.elastic.co/t/send-meta-data-with-rum-for-apm/383250)
**Author:** [@learningelastic](https://discuss.elastic.co/u/learningelastic)\ **Replies:** 0\ **Last updated:** [November 5, 2025, 3:28pm UTC](https://discuss.elastic.co/t/send-meta-data-with-rum-for-apm/383250 "2025-11-05T15:28:18Z")
I am testing out a few of the Agent API in RUM with Elasticsearch APM as shown in this documentation here: Agent API | APM RUM JavaScript agent So far I got most things working like getting span information, traces, tra… --- ## [Elasticsearch Search Results Become Incomplete When My Website Applies Multiple Filters to the Same Query](https://discuss.elastic.co/t/elasticsearch-search-results-become-incomplete-when-my-website-applies-multiple-filters-to-the-same-query/390994)
**Author:** [@joeroot](https://discuss.elastic.co/u/joeroot)\ **Replies:** 0\ **Last updated:** [October 14, 2026, 3:52pm UTC](https://discuss.elastic.co/t/elasticsearch-search-results-become-incomplete-when-my-website-applies-multiple-filters-to-the-same-query/390994 "2026-10-14T15:52:56Z")
Hi All, I am having a problem with the search functionality on my website, which uses Elasticsearch to retrieve records based on visitors' search terms and selected filters. The basic search works correctly when a user … --- ## [Unable to get keyspace metrics for Redis Integration](https://discuss.elastic.co/t/unable-to-get-keyspace-metrics-for-redis-integration/388123)
**Author:** [@Mansi\_Sharma1](https://discuss.elastic.co/u/Mansi_Sharma1)\ **Replies:** 0\ **Last updated:** [July 10, 2026, 1:06pm UTC](https://discuss.elastic.co/t/unable-to-get-keyspace-metrics-for-redis-integration/388123 "2026-07-10T13:06:45Z")
Hello, I integrated Redis Integration my Elastic Stack version is 9.1.2. For 1 service every dataset is coming. but for rest 3 the keyspace dataset is not populating anything. i cant even see the redis.keyspace datas… --- ## [Managing Ammunition Link Inventory Data with Search and Analytics Systems](https://discuss.elastic.co/t/managing-ammunition-link-inventory-data-with-search-and-analytics-systems/387712)
**Author:** [@gamerlook](https://discuss.elastic.co/u/gamerlook)\ **Replies:** 0\ **Last updated:** [July 7, 2026, 2:03pm UTC](https://discuss.elastic.co/t/managing-ammunition-link-inventory-data-with-search-and-analytics-systems/387712 "2026-07-07T14:03:56Z")
Hello everyone, I am exploring how large technical inventories can be organized and searched efficiently using modern data platforms. In industries where components such as ammunition links, connectors, or mechanical pa… --- ## [About elk log issues](https://discuss.elastic.co/t/about-elk-log-issues/386790)
**Author:** [@Vtm](https://discuss.elastic.co/u/Vtm)\ **Replies:** 0\ **Last updated:** [June 10, 2026, 9:09am UTC](https://discuss.elastic.co/t/about-elk-log-issues/386790 "2026-06-10T09:09:52Z")
Hello everyone, Need help with Elasticsearch cluster metadata recovery. We originally had a 3-node cluster, but after a restart/patching activity the cluster failed master election. We later rebuilt the cluster and all… --- ## [Elasticsearch And Kibana Dashboard Ideas for a Hotel Booking and Guest Analytics System](https://discuss.elastic.co/t/elasticsearch-and-kibana-dashboard-ideas-for-a-hotel-booking-and-guest-analytics-system/386301)
**Author:** [@Jixcy001](https://discuss.elastic.co/u/Jixcy001)\ **Replies:** 0\ **Last updated:** [May 12, 2026, 9:21am UTC](https://discuss.elastic.co/t/elasticsearch-and-kibana-dashboard-ideas-for-a-hotel-booking-and-guest-analytics-system/386301 "2026-05-12T09:21:32Z")
Hello Elastic Community, I’m exploring how Elasticsearch and Kibana can be used for a hospitality/travel project related to a luxury budget hotel in Varanasi called Hotel KB Palace. The idea is to build a small hotel an… --- ## [Winlogbeat supports for TPM Windows certificates store](https://discuss.elastic.co/t/winlogbeat-supports-for-tpm-windows-certificates-store/386098)
**Author:** [@MiguelN](https://discuss.elastic.co/u/MiguelN)\ **Replies:** 0\ **Last updated:** [April 29, 2026, 2:57pm UTC](https://discuss.elastic.co/t/winlogbeat-supports-for-tpm-windows-certificates-store/386098 "2026-04-29T14:57:01Z")
I want to deploy per-device client certificates to Windows workstations via Intune SCEP, with the private key generated and bound to the TPM (Microsoft Platform Crypto Provider, non-exportable). Winlogbeat would then use… --- ## [Request: ecommerce-search-catalog-embedding-128 dataset used in ES 9.3 vs OS 3.5 vector search benchmark](https://discuss.elastic.co/t/request-ecommerce-search-catalog-embedding-128-dataset-used-in-es-9-3-vs-os-3-5-vector-search-benchmark/386023)
**Author:** [@chulong89u](https://discuss.elastic.co/u/chulong89u)\ **Replies:** 0\ **Last updated:** [April 24, 2026, 1:04pm UTC](https://discuss.elastic.co/t/request-ecommerce-search-catalog-embedding-128-dataset-used-in-es-9-3-vs-os-3-5-vector-search-benchmark/386023 "2026-04-24T13:04:23Z")
Hi everyone, I'm looking for the dataset used in the competitive benchmarking study: "Elasticsearch 9.3 vs OpenSearch 3.5: Vector Search Performance" Blog post: OpenSearch vs. Elasticsearch: Throughput for filtered ve… --- ## [Palo Alto logs not being Ingested](https://discuss.elastic.co/t/palo-alto-logs-not-being-ingested/384882)
**Author:** [@diego.roldan](https://discuss.elastic.co/u/diego.roldan)\ **Replies:** 0\ **Last updated:** [February 3, 2026, 12:02pm UTC](https://discuss.elastic.co/t/palo-alto-logs-not-being-ingested/384882 "2026-02-03T12:02:00Z")
Hi, I’m using Elastic Serverless and trying to ingest Palo Alto Next-Gen Firewall logs using the official Palo Alto integration. The issue appears when using an Elastic Agent on Rocky Linux. The integration is configur… --- ## [Missing Export button for custom role despite enabling "Generate PDF or PNG report" privilege (v8.19.11)](https://discuss.elastic.co/t/missing-export-button-for-custom-role-despite-enabling-generate-pdf-or-png-report-privilege-v8-19-11/390774)
**Author:** [@WANASANAN815](https://discuss.elastic.co/u/WANASANAN815)\ **Replies:** 1\ **Last updated:** [September 30, 2026, 2:25pm UTC](https://discuss.elastic.co/t/missing-export-button-for-custom-role-despite-enabling-generate-pdf-or-png-report-privilege-v8-19-11/390774 "2026-09-30T14:25:19Z")
Hi everyone, I’m currently having an issue creating a custom role in Elastic SIEM. I am trying to create a role that allows users to export dashboards as PDFs. Environment: Elastic Version: 8.19.11 License: Enter… --- ## [Race between ThreadContext.close() and context access may throw IllegalStateException](https://discuss.elastic.co/t/race-between-threadcontext-close-and-context-access-may-throw-illegalstateexception/386792)
**Author:** [@denyjohn](https://discuss.elastic.co/u/denyjohn)\ **Replies:** 1\ **Last updated:** [June 11, 2026, 3:43pm UTC](https://discuss.elastic.co/t/race-between-threadcontext-close-and-context-access-may-throw-illegalstateexception/386792 "2026-06-11T15:43:39Z")
In v6.4.2, ThreadContext stores request-specific headers and transient values in the shared field threadLocal, whose concrete type is ThreadContext.ContextThreadLocal. There appears to be a race between ThreadContext.cl… --- ## [BUG: Heartbeat goes into a state of writing billions of error logs](https://discuss.elastic.co/t/bug-heartbeat-goes-into-a-state-of-writing-billions-of-error-logs/386726)
**Author:** [@up2neck](https://discuss.elastic.co/u/up2neck)\ **Replies:** 0\ **Last updated:** [June 5, 2026, 6:10am UTC](https://discuss.elastic.co/t/bug-heartbeat-goes-into-a-state-of-writing-billions-of-error-logs/386726 "2026-06-05T06:10:21Z")
Hello, Since version 9.3.1 of our deployment, that now uses 9.4.2 we observe the following behaviour in Heartbeat: Heartbeat is deployed with Elastic Agent, that controlled by the ECK operator Heartbeat is used for ru… --- ## [Looking for AI solutions that will be able to access our Private Elastic](https://discuss.elastic.co/t/looking-for-ai-solutions-that-will-be-able-to-access-our-private-elastic/384447)
**Author:** [@HaroldMelamed](https://discuss.elastic.co/u/HaroldMelamed)\ **Replies:** 0\ **Last updated:** [January 9, 2026, 1:12am UTC](https://discuss.elastic.co/t/looking-for-ai-solutions-that-will-be-able-to-access-our-private-elastic/384447 "2026-01-09T01:12:30Z")
Not sure what this would be under, but we have Elastic inhouse and are looking for an AI solution that would use our data housed in Elastic. I did see a demonstration offered on 1/13, but its in Europe and the time wo… --- ## [APM data stream reroutes and custom ILM policies](https://discuss.elastic.co/t/apm-data-stream-reroutes-and-custom-ilm-policies/383499)
**Author:** [@wbjls](https://discuss.elastic.co/u/wbjls)\ **Replies:** 0\ **Last updated:** [November 18, 2025, 3:44am UTC](https://discuss.elastic.co/t/apm-data-stream-reroutes-and-custom-ilm-policies/383499 "2025-11-18T03:44:21Z")
Hi There, I’m a newbie to Elastic and looking to solve an issue that I am having trouble with. Essentially I am looking to set up a Telemetry stack across various apps we maintain, and am trialing an approach for a sin… --- ## [How to ingest paginated API data into Elasticsearch?](https://discuss.elastic.co/t/how-to-ingest-paginated-api-data-into-elasticsearch/386648)
**Author:** [@1o1o](https://discuss.elastic.co/u/1o1o)\ **Replies:** 1\ **Last updated:** [June 2, 2026, 7:51pm UTC](https://discuss.elastic.co/t/how-to-ingest-paginated-api-data-into-elasticsearch/386648 "2026-06-02T19:51:25Z")
Hi everyone, I’m trying to ingest data from a web application API into an Elasticsearch index. Context: The API is HTTP-based and returns JSON data It supports pagination cursor-based I need to regularly fetch… --- ## [Unified Multilingual search](https://discuss.elastic.co/t/unified-multilingual-search/385388)
**Author:** [@cptX](https://discuss.elastic.co/u/cptX)\ **Replies:** 1\ **Last updated:** [April 21, 2026, 2:28pm UTC](https://discuss.elastic.co/t/unified-multilingual-search/385388 "2026-04-21T14:28:16Z")
UPDATE: Sorry for posting it here, it was meant for magento 2, smile/elasticsuite. I’ll keep it here for reference if somebody wants to shed some light on my problems. Hi, several years now I’m facing the following prob… --- ## [Migration 5.x to 9.x](https://discuss.elastic.co/t/migration-5-x-to-9-x/383997)
**Author:** [@ppat](https://discuss.elastic.co/u/ppat)\ **Replies:** 1\ **Last updated:** [December 11, 2025, 8:36pm UTC](https://discuss.elastic.co/t/migration-5-x-to-9-x/383997 "2025-12-11T20:36:06Z")
I am migrating gtom 5.x to 9.x, match\_all returns all documents but ith query it does return no documents even though there is a match. same application code works for develop 9.x elastic but qa 9.x it doesnt. Checked th… --- ## [Can you group endpoint.events.\* event.datasets when creating visualizations?](https://discuss.elastic.co/t/can-you-group-endpoint-events-event-datasets-when-creating-visualizations/383520)
**Author:** [@meatwad](https://discuss.elastic.co/u/meatwad)\ **Replies:** 1\ **Last updated:** [November 19, 2025, 6:16am UTC](https://discuss.elastic.co/t/can-you-group-endpoint-events-event-datasets-when-creating-visualizations/383520 "2025-11-19T06:16:10Z")
Hi there! I’m trying to create an “area stacked” visualization that shows event.dataset over the last 90 days. Is there a way to group the endpoint.events.network, endpoint.events.process, and events.events.file logs int… --- ## [Changing global setting "Autocomplete value suggestion method" not working](https://discuss.elastic.co/t/changing-global-setting-autocomplete-value-suggestion-method-not-working/388394)
**Author:** [@PeterDK](https://discuss.elastic.co/u/PeterDK)\ **Replies:** 0\ **Last updated:** [July 17, 2026, 12:23pm UTC](https://discuss.elastic.co/t/changing-global-setting-autocomplete-value-suggestion-method-not-working/388394 "2026-07-17T12:23:13Z")
Hello, There is a global Kibana setting called "Autocomplete value suggestion method" (autocomplete:valueSuggestionMethod) which defaults to "terms\_enum and with the following remark: The method used for querying sugge… --- ## [Agent Policy Checkin Storm after activating version specifig policy](https://discuss.elastic.co/t/agent-policy-checkin-storm-after-activating-version-specifig-policy/391016)
**Author:** [@kgorskowski](https://discuss.elastic.co/u/kgorskowski)\ **Replies:** 1\ **Last updated:** [October 16, 2026, 12:24pm UTC](https://discuss.elastic.co/t/agent-policy-checkin-storm-after-activating-version-specifig-policy/391016 "2026-10-16T12:24:35Z")
Hi community. I have a question about the behavior of Elastic Agents that are/were stuck in a policy acknowledgement storm/loop against a fleet server. PSA I am a system/platform engineer not an elastic specialist but … --- ## [Question About OOS Closure for Elasticsearch Deployment on es.io](https://discuss.elastic.co/t/question-about-oos-closure-for-elasticsearch-deployment-on-es-io/385303)
**Author:** [@Attacker\_Tester](https://discuss.elastic.co/u/Attacker_Tester)\ **Replies:** 1\ **Last updated:** [March 2, 2026, 3:16pm UTC](https://discuss.elastic.co/t/question-about-oos-closure-for-elasticsearch-deployment-on-es-io/385303 "2026-03-02T15:16:06Z")
I noticed that my report regarding a potential DoS bug in the instant Elasticsearch deployment on es.io was marked as out-of-scope (OOS). Could you please clarify why this deployment/domain is considered OOS? I want to m… --- ## [Vision One Integration Policy - Agent](https://discuss.elastic.co/t/vision-one-integration-policy-agent/384720)
**Author:** [@juancamiloll](https://discuss.elastic.co/u/juancamiloll)\ **Replies:** 1\ **Last updated:** [January 23, 2026, 5:00pm UTC](https://discuss.elastic.co/t/vision-one-integration-policy-agent/384720 "2026-01-23T17:00:51Z")
Hello everyone, I have a question. I would appreciate it if you could help me and explain it to me, as I am confused. I need the Trend Micro Vision One logs. I have already added the integration. The Vision One admin… --- ## [Alert rule using an ES QL query with fork branches and email action on conditional fork1 result](https://discuss.elastic.co/t/alert-rule-using-an-es-ql-query-with-fork-branches-and-email-action-on-conditional-fork1-result/389616)
**Author:** [@mape](https://discuss.elastic.co/u/mape)\ **Replies:** 0\ **Last updated:** [August 14, 2026, 11:11am UTC](https://discuss.elastic.co/t/alert-rule-using-an-es-ql-query-with-fork-branches-and-email-action-on-conditional-fork1-result/389616 "2026-08-14T11:11:46Z")
Hi. I want to create an Alert Rule using the elasticsearch query which contains an ES QL query with 4 fork branches, each fork running a different query and collecting STATS on different fields. This works all well. N… --- ## [Elastic Agent Poll time adjusting](https://discuss.elastic.co/t/elastic-agent-poll-time-adjusting/385882)
**Author:** [@etrevino-lumificyber](https://discuss.elastic.co/u/etrevino-lumificyber)\ **Replies:** 0\ **Last updated:** [April 14, 2026, 2:39pm UTC](https://discuss.elastic.co/t/elastic-agent-poll-time-adjusting/385882 "2026-04-14T14:39:29Z")
Hello everyone, I have a client who would like an option to adjust the amount of web requests going outbound from the elastic agent. I recommended adding filters on their end to drop those logs in Cisco Umbrella. Is the… --- ## [Kibana permissions - different behavior between read and custom privileges](https://discuss.elastic.co/t/kibana-permissions-different-behavior-between-read-and-custom-privileges/385112)
**Author:** [@Ror](https://discuss.elastic.co/u/Ror)\ **Replies:** 1\ **Last updated:** [February 19, 2026, 1:50pm UTC](https://discuss.elastic.co/t/kibana-permissions-different-behavior-between-read-and-custom-privileges/385112 "2026-02-19T13:50:58Z")
I recently migrated from elastic cloud to elastic cloud on kubernetes. In order to migrate, I restored a snapshot with all the users and roles. I wanted to make a change to a custom role I created to allow a user to crea… --- ## [Graylog + Metricbeat + IIS](https://discuss.elastic.co/t/graylog-metricbeat-iis/384950)
**Author:** [@Lev\_Anni](https://discuss.elastic.co/u/Lev_Anni)\ **Replies:** 0\ **Last updated:** [February 6, 2026, 7:20pm UTC](https://discuss.elastic.co/t/graylog-metricbeat-iis/384950 "2026-02-06T19:20:40Z")
Guys, I want to get IIS performance metrics from my IIS servers to use them in Graylog. Metribeat has this nice IIS module but it can not retrieve CPU usage per site, only globally. I can get per site application pool c… --- ## [Windows and Linux Integration to collect inventory data for Defend coverage (and CMDB)](https://discuss.elastic.co/t/windows-and-linux-integration-to-collect-inventory-data-for-defend-coverage-and-cmdb/384117)
**Author:** [@pimthu](https://discuss.elastic.co/u/pimthu)\ **Replies:** 0\ **Last updated:** [December 16, 2025, 2:33pm UTC](https://discuss.elastic.co/t/windows-and-linux-integration-to-collect-inventory-data-for-defend-coverage-and-cmdb/384117 "2025-12-16T14:33:58Z")
We are an MSSP for many organisations and would like to produce Elastic Defend coverage figures. Currently, we need to collect through various cumbersome ways the AD or inventory data from Windows, Mac and Linux clients … --- ## [APM transaction not found](https://discuss.elastic.co/t/apm-transaction-not-found/382970)
**Author:** [@mossnana](https://discuss.elastic.co/u/mossnana)\ **Replies:** 0\ **Last updated:** [October 25, 2025, 2:57pm UTC](https://discuss.elastic.co/t/apm-transaction-not-found/382970 "2025-10-25T14:57:19Z")
Kibana version: 9.2.0 Elasticsearch version: 9.2.0 APM Server version: 9.2.0 APM Agent language and version: 1.18.0 Browser version: Chrome 141.0.7390.123 Steps to reproduce: I want to use apm with my golang api. S… --- ## [Can't deploy model on ML node due to insufficient memory](https://discuss.elastic.co/t/cant-deploy-model-on-ml-node-due-to-insufficient-memory/387871)
**Author:** [@Giorgi\_Jambazishvili](https://discuss.elastic.co/u/Giorgi_Jambazishvili)\ **Replies:** 0\ **Last updated:** [July 8, 2026, 11:23am UTC](https://discuss.elastic.co/t/cant-deploy-model-on-ml-node-due-to-insufficient-memory/387871 "2026-07-08T11:23:02Z")
I am using Elasticsearch cloud. I currently host the free-tier ML node, but the same behavior occurs on the next available tier (node w/ 2GB of memory). I am trying to deploy the E5 embedding model, preferably base, but… --- ## [Netflow Fleet integration problem](https://discuss.elastic.co/t/netflow-fleet-integration-problem/385965)
**Author:** [@BenoitSERRA](https://discuss.elastic.co/u/BenoitSERRA)\ **Replies:** 0\ **Last updated:** [April 20, 2026, 3:34pm UTC](https://discuss.elastic.co/t/netflow-fleet-integration-problem/385965 "2026-04-20T15:34:47Z")
Hi all, Not sure if the category is the right one here, but here goes. I've deployed an ELK stack on a server of mine and deployed Fleet and several agents. I've deployed Fleet's Netflow integration and set up my OPNse… --- ## [ML rules How to handle timezone (UTC GMT-3) and alert duration in notifications?](https://discuss.elastic.co/t/ml-rules-how-to-handle-timezone-utc-gmt-3-and-alert-duration-in-notifications/384089)
**Author:** [@sguerrero](https://discuss.elastic.co/u/sguerrero)\ **Replies:** 0\ **Last updated:** [December 15, 2025, 5:55pm UTC](https://discuss.elastic.co/t/ml-rules-how-to-handle-timezone-utc-gmt-3-and-alert-duration-in-notifications/384089 "2025-12-15T17:55:27Z")
Hello community, We are currently using kibana machine learning anomaly detection alerts (anomaly detection jobs) with email actions triggered “for each alert \> on status change”. We have two related requirements regar… --- ## [Can ELSER generate Elasticsearch aggregation queries from natural-language input?](https://discuss.elastic.co/t/can-elser-generate-elasticsearch-aggregation-queries-from-natural-language-input/382962)
**Author:** [@Mohan\_Kumar\_Reddy\_Ak](https://discuss.elastic.co/u/Mohan_Kumar_Reddy_Ak)\ **Replies:** 0\ **Last updated:** [October 24, 2025, 6:10pm UTC](https://discuss.elastic.co/t/can-elser-generate-elasticsearch-aggregation-queries-from-natural-language-input/382962 "2025-10-24T18:10:53Z")
Hi team, I’m exploring a hybrid setup where LLMs (like GPT-4 or GPT-5) convert natural-language questions into Elasticsearch DSL queries — including aggregations such as avg, terms, and date\_histogram. However, I’m fac… --- ## [Elastic Netflow integration (discrepancies with Nfsen)](https://discuss.elastic.co/t/elastic-netflow-integration-discrepancies-with-nfsen/384502)
**Author:** [@duckasylum](https://discuss.elastic.co/u/duckasylum)\ **Replies:** 0\ **Last updated:** [January 13, 2026, 10:59am UTC](https://discuss.elastic.co/t/elastic-netflow-integration-discrepancies-with-nfsen/384502 "2026-01-13T10:59:04Z")
I have a few Netflow collectors running pmacctd to collect netflow traffic. I send v9 to Nfsen and v10 (IPFIX) to an elastic agent with a configured netflow integration. My problem is that Nfsen shows close to 10 times m… --- ## [Dashboard anomaly score is not what we wanted](https://discuss.elastic.co/t/dashboard-anomaly-score-is-not-what-we-wanted/385336)
**Author:** [@Whoami1980](https://discuss.elastic.co/u/Whoami1980)\ **Replies:** 1\ **Last updated:** [March 4, 2026, 5:38pm UTC](https://discuss.elastic.co/t/dashboard-anomaly-score-is-not-what-we-wanted/385336 "2026-03-04T17:38:49Z")
We create a dashboard which return a single column to show actual, typical, anomaly score Apparently, the actual is the highest(actual) the typical is the highest(typical) The anomaly score is calculated based on the t… --- ## [Encountering Elasticsearch Server Error while Percolating in 8.19.6](https://discuss.elastic.co/t/encountering-elasticsearch-server-error-while-percolating-in-8-19-6/384859)
**Author:** [@mserrato](https://discuss.elastic.co/u/mserrato)\ **Replies:** 1\ **Last updated:** [February 2, 2026, 4:44pm UTC](https://discuss.elastic.co/t/encountering-elasticsearch-server-error-while-percolating-in-8-19-6/384859 "2026-02-02T16:44:02Z")
Hello! After upgrading my cluster from 7.17 to 8.19, I’ve started encountering an intermittent server error: java.util.NoSuchElementException when performing percolation. I’ve opened up an issue on the elasticsearch rep… --- ## [Reporting job is still pending despite having killed previous job](https://discuss.elastic.co/t/reporting-job-is-still-pending-despite-having-killed-previous-job/384714)
**Author:** [@RRecio](https://discuss.elastic.co/u/RRecio)\ **Replies:** 0\ **Last updated:** [January 23, 2026, 12:09pm UTC](https://discuss.elastic.co/t/reporting-job-is-still-pending-despite-having-killed-previous-job/384714 "2026-01-23T12:09:25Z")
Hi. I’m experiencing the same issue as this Closed ticket, which seemingly didn’t have a resolution: Need to stop all Pending jobs in reporting I accidentally hit “Download CSV” in a report that was far too big to be do… [Previous page](https://discuss.elastic.co/top.md?page=26&per_page=50) [Next page](https://discuss.elastic.co/top.md?page=28&per_page=50)