# Top **URL:** https://discuss.elastic.co/top.md?page=28 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 29 --- ## [Ingesting daily health data into Logstash pipeline for time-series monitoring](https://discuss.elastic.co/t/ingesting-daily-health-data-into-logstash-pipeline-for-time-series-monitoring/386059)
**Author:** [@jesscia](https://discuss.elastic.co/u/jesscia)\ **Replies:** 1\ **Last updated:** [April 28, 2026, 4:58am UTC](https://discuss.elastic.co/t/ingesting-daily-health-data-into-logstash-pipeline-for-time-series-monitoring/386059 "2026-04-28T04:58:50Z")
Hello everyone, I am working on a Logstash pipeline to ingest and process daily health monitoring data from a home BP device. The context of this data is post-operative recovery after a medical procedure (DIEP flap bre… --- ## [Lens Table is always sorted on "oldest" / leftmost column - need to sort on "newest" / rightmost column](https://discuss.elastic.co/t/lens-table-is-always-sorted-on-oldest-leftmost-column-need-to-sort-on-newest-rightmost-column/385015)
**Author:** [@Erik\_Reuter](https://discuss.elastic.co/u/Erik_Reuter)\ **Replies:** 1\ **Last updated:** [February 15, 2026, 11:16am UTC](https://discuss.elastic.co/t/lens-table-is-always-sorted-on-oldest-leftmost-column-need-to-sort-on-newest-rightmost-column/385015 "2026-02-15T11:16:41Z")
I have created a Table, where I would like for it to automatically sort records on the column having the newest date, but it defaults to sorting on the oldest date… we use this on a overhead screen showing general status… --- ## [Kibana Service Infrastructure tab displays some empty fields](https://discuss.elastic.co/t/kibana-service-infrastructure-tab-displays-some-empty-fields/383571)
**Author:** [@IvanovOleg](https://discuss.elastic.co/u/IvanovOleg)\ **Replies:** 1\ **Last updated:** [November 20, 2025, 9:26pm UTC](https://discuss.elastic.co/t/kibana-service-infrastructure-tab-displays-some-empty-fields/383571 "2025-11-20T21:26:15Z")
Observability → APM → Service Name → Infrastructure This tab in kibana displays some empty fields f.e # of CPU, Memory Total, Memory usage. Same fields in the Observability → Infrastructure → Infrastructure Inventory → … --- ## [Elastic Connectors Is Not Connecting to Elasticsearch with SSL](https://discuss.elastic.co/t/elastic-connectors-is-not-connecting-to-elasticsearch-with-ssl/390845)
**Author:** [@jsingleton71](https://discuss.elastic.co/u/jsingleton71)\ **Replies:** 0\ **Last updated:** [October 5, 2026, 4:25pm UTC](https://discuss.elastic.co/t/elastic-connectors-is-not-connecting-to-elasticsearch-with-ssl/390845 "2026-10-05T16:25:00Z")
Hey everyone, I have a standard ELK deployment on a single VM. I am trying to setup and configure the Elastic Connectors as described here: Content connectors | Elasticsearch Reference I am hitting an issue where the i… --- ## [Alerting during Penetration tests?](https://discuss.elastic.co/t/alerting-during-penetration-tests/384718)
**Author:** [@Gloom](https://discuss.elastic.co/u/Gloom)\ **Replies:** 0\ **Last updated:** [January 23, 2026, 2:28pm UTC](https://discuss.elastic.co/t/alerting-during-penetration-tests/384718 "2026-01-23T14:28:31Z")
Is there anyway for all alerts generated by a list of hosts / ips / users to all be added to one case automatically? The idea being that during a pentest we don’t want to have to triage the alerts at that time, but don’t… --- ## [Trial Extension Needed for Self-Hosted ML POC](https://discuss.elastic.co/t/trial-extension-needed-for-self-hosted-ml-poc/383202)
**Author:** [@EUphorik](https://discuss.elastic.co/u/EUphorik)\ **Replies:** 0\ **Last updated:** [November 4, 2025, 10:24am UTC](https://discuss.elastic.co/t/trial-extension-needed-for-self-hosted-ml-poc/383202 "2025-11-04T10:24:37Z")
Hello Elastic Team, We are mid-way through an urgent Proof of Concept (POC) involving a self-hosted deployment, specifically focusing on validating the Kibana Machine Learning (ML) module. Our trial license for Elastic… --- ## [Agent processor dissect question](https://discuss.elastic.co/t/agent-processor-dissect-question/383995)
**Author:** [@rugenl](https://discuss.elastic.co/u/rugenl)\ **Replies:** 1\ **Last updated:** [December 11, 2025, 5:25pm UTC](https://discuss.elastic.co/t/agent-processor-dissect-question/383995 "2025-12-11T17:25:19Z")
I have an integration using Custom Logs with a processor using this dissect: - dissect: tokenizer: "%{date} %{time} %{action} %{protocol} %{src-ip} %{dst-ip} %{src-port} %{dst-port} %{size} %{tcpflags} %{tcpsyn} %{tc… --- ## [Unable to remove extra fields when using filebeat](https://discuss.elastic.co/t/unable-to-remove-extra-fields-when-using-filebeat/383579)
**Author:** [@Zhi\_Yang](https://discuss.elastic.co/u/Zhi_Yang)\ **Replies:** 1\ **Last updated:** [November 21, 2025, 6:43pm UTC](https://discuss.elastic.co/t/unable-to-remove-extra-fields-when-using-filebeat/383579 "2025-11-21T18:43:16Z")
so i had a very simple ELK install with a very simple filebeat install as well elk works fine, however with filebeat i get a bunch of fields that i do not want like nginx.error.message mongodb.log.message and a bunch… --- ## [ElasticSearch in kubernetes is failling with Bad\_certificate](https://discuss.elastic.co/t/elasticsearch-in-kubernetes-is-failling-with-bad-certificate/384959)
**Author:** [@senbe](https://discuss.elastic.co/u/senbe)\ **Replies:** 0\ **Last updated:** [February 8, 2026, 1:27pm UTC](https://discuss.elastic.co/t/elasticsearch-in-kubernetes-is-failling-with-bad-certificate/384959 "2026-02-08T13:27:31Z")
We setup a Elasticsearch using the eck-stack github repo and let elasticsearch creates its own CA transport certificate. within sometimes, we see the Elasticsearch is moving from green to yellow On analysis, we observed… --- ## [Running XGBoost Re-Rank Models in Elasticsearch Ingest Pipelines](https://discuss.elastic.co/t/running-xgboost-re-rank-models-in-elasticsearch-ingest-pipelines/383054)
**Author:** [@Shell\_Dias](https://discuss.elastic.co/u/Shell_Dias)\ **Replies:** 0\ **Last updated:** [October 28, 2025, 5:59pm UTC](https://discuss.elastic.co/t/running-xgboost-re-rank-models-in-elasticsearch-ingest-pipelines/383054 "2025-10-28T17:59:11Z")
How can I run re-ranking models within ingest pipelines to create a custom field containing the classification result? For example: I have an XGBoost model that uses the predict method. I’d like to apply it to each doc… --- ## [ILM unable to delete old index since upgrade to 8.19.20](https://discuss.elastic.co/t/ilm-unable-to-delete-old-index-since-upgrade-to-8-19-20/390601)
**Author:** [@numpty-boy](https://discuss.elastic.co/u/numpty-boy)\ **Replies:** 0\ **Last updated:** [September 23, 2026, 8:58am UTC](https://discuss.elastic.co/t/ilm-unable-to-delete-old-index-since-upgrade-to-8-19-20/390601 "2026-09-23T08:58:47Z")
Morning Team, Since upgrading to 8.19.20, I've started getting these errors: policy \[.fleet-actions-results-ilm-policy\] for index \[.ds-.fleet-actions-results-2026.05.02-000014\] on an error step due to a transient error… --- ## [Installing es-kb-stack via helm overriding nodeSelector](https://discuss.elastic.co/t/installing-es-kb-stack-via-helm-overriding-nodeselector/389620)
**Author:** [@lesio999](https://discuss.elastic.co/u/lesio999)\ **Replies:** 0\ **Last updated:** [August 14, 2026, 12:26pm UTC](https://discuss.elastic.co/t/installing-es-kb-stack-via-helm-overriding-nodeselector/389620 "2026-08-14T12:26:01Z")
Hi, I'm fighting installation es-kb-stack installation via helm in cluster when I have Windows and Linux node. I can fix post installation by adding nodeSelector on running statefulset and deployment but could not get i… --- ## [Cost of E5 model usage](https://discuss.elastic.co/t/cost-of-e5-model-usage/388115)
**Author:** [@MR\_INTENSE\_GAMING](https://discuss.elastic.co/u/MR_INTENSE_GAMING)\ **Replies:** 0\ **Last updated:** [July 10, 2026, 10:51am UTC](https://discuss.elastic.co/t/cost-of-e5-model-usage/388115 "2026-07-10T10:51:27Z")
I reviewed the documentation for the E5 embedding model and found that it is available with the Enterprise subscription. However, upon further reading, I noticed that deploying the model requires an ML node, which incurs… --- ## [Workflows/fields actions](https://discuss.elastic.co/t/workflows-fields-actions/386190)
**Author:** [@proclick](https://discuss.elastic.co/u/proclick)\ **Replies:** 0\ **Last updated:** [May 6, 2026, 1:52pm UTC](https://discuss.elastic.co/t/workflows-fields-actions/386190 "2026-05-06T13:52:36Z")
Hey team, The workflows are pretty useful, but you still need to do a lot of extra steps to, for example, check the hash from the alert (without using Trigger Alert and On Alert). Is it planned to add an option to run t… --- ## [Elastic External Connector Question](https://discuss.elastic.co/t/elastic-external-connector-question/385470)
**Author:** [@vpolius](https://discuss.elastic.co/u/vpolius)\ **Replies:** 0\ **Last updated:** [March 16, 2026, 4:06pm UTC](https://discuss.elastic.co/t/elastic-external-connector-question/385470 "2026-03-16T16:06:19Z")
I was wondering if there was a way to prevent the external connector from adding a link back to the case in elastic when creating a connection with ServiceNow. --- ## [Check if Observability Case was viewed](https://discuss.elastic.co/t/check-if-observability-case-was-viewed/384488)
**Author:** [@GlebCA](https://discuss.elastic.co/u/GlebCA)\ **Replies:** 0\ **Last updated:** [January 12, 2026, 4:44pm UTC](https://discuss.elastic.co/t/check-if-observability-case-was-viewed/384488 "2026-01-12T16:44:42Z")
Hi, Is there any way to check that an Observability case was at least opened by User / viewed? Like to to notify Assignee if Case was not at least reviewed and provide stat how often Observability Cases are really open… --- ## [Export Elasticsearch Data](https://discuss.elastic.co/t/export-elasticsearch-data/383692)
**Author:** [@DVD\_MNC](https://discuss.elastic.co/u/DVD_MNC)\ **Replies:** 0\ **Last updated:** [November 26, 2025, 4:17pm UTC](https://discuss.elastic.co/t/export-elasticsearch-data/383692 "2025-11-26T16:17:34Z")
Hello guys, i’m working on a solution which use Elasticsearch as DataLake and export data on an external SIEM. As first requirement I want leverage elasticsearch capabilities as integration and enrichment, so I cannot … --- ## [Does .ml shared and custom falls under system indices](https://discuss.elastic.co/t/does-ml-shared-and-custom-falls-under-system-indices/385547)
**Author:** [@residual-07](https://discuss.elastic.co/u/residual-07)\ **Replies:** 1\ **Last updated:** [March 20, 2026, 1:08pm UTC](https://discuss.elastic.co/t/does-ml-shared-and-custom-falls-under-system-indices/385547 "2026-03-20T13:08:06Z")
Hi, I would like to get some help about understanding hidden and system indices. In our company we are using elasticsearch and kibana 8.19.9. We ended up in dilemma whether the .ml-anomalies-custom and .ml-anomalies-sh… --- ## [Slowness on while running playwright script](https://discuss.elastic.co/t/slowness-on-while-running-playwright-script/390930)
**Author:** [@Aniket\_Pant](https://discuss.elastic.co/u/Aniket_Pant)\ **Replies:** 0\ **Last updated:** [October 9, 2026, 7:29am UTC](https://discuss.elastic.co/t/slowness-on-while-running-playwright-script/390930 "2026-10-09T07:29:13Z")
Hello Team, I won't show the playwright script here.I am using elastic cloud v8.19 for my project and i am running a playwright script on Elastic Synthetic to perform user-journey. I have set 1hr interval to run script … --- ## [How to enrich logs with the EDOT Java?](https://discuss.elastic.co/t/how-to-enrich-logs-with-the-edot-java/383286)
**Author:** [@nilsen](https://discuss.elastic.co/u/nilsen)\ **Replies:** 0\ **Last updated:** [November 7, 2025, 9:08am UTC](https://discuss.elastic.co/t/how-to-enrich-logs-with-the-edot-java/383286 "2025-11-07T09:08:09Z")
I'm using the EDOT Java agent, which automatically generates and exports logs/metrics/tracing from my Java application to Elastic. However, I'm having a hard time enriching the log documents. The goal is to be able to q… --- ## [Issue with Hashicorp Vault/Elastic agent integration](https://discuss.elastic.co/t/issue-with-hashicorp-vault-elastic-agent-integration/385550)
**Author:** [@rex656](https://discuss.elastic.co/u/rex656)\ **Replies:** 0\ **Last updated:** [March 20, 2026, 6:32pm UTC](https://discuss.elastic.co/t/issue-with-hashicorp-vault-elastic-agent-integration/385550 "2026-03-20T18:32:09Z")
I have the Hashicorp Vault integration assigned to all of my Vault servers. I seem to be collecting the operational and audit logs with no issue, but there are gaps in the metric data. For example, the agent is not pick… --- ## [See Fleet Policies and Agents across all Spaces](https://discuss.elastic.co/t/see-fleet-policies-and-agents-across-all-spaces/384806)
**Author:** [@cconard.kcsr](https://discuss.elastic.co/u/cconard.kcsr)\ **Replies:** 0\ **Last updated:** [January 29, 2026, 6:12pm UTC](https://discuss.elastic.co/t/see-fleet-policies-and-agents-across-all-spaces/384806 "2026-01-29T18:12:23Z")
We have a number of Kibana Spaces defined for our users, including Fleet Agents defined by Spaces. This is great functionality to allow our users some access to their agents. However, as general admins and SMEs (Subject … --- ## [Logs from elasticsearch agents](https://discuss.elastic.co/t/logs-from-elasticsearch-agents/384361)
**Author:** [@TheJ](https://discuss.elastic.co/u/TheJ)\ **Replies:** 0\ **Last updated:** [January 5, 2026, 11:29am UTC](https://discuss.elastic.co/t/logs-from-elasticsearch-agents/384361 "2026-01-05T11:29:19Z")
Hi, I have an Elasticsearch cluster that keeps logs from services within a year. I have also connected 30 elasticagents and logs from these agents exist on the cluster forever. During debug, I realize that data streams … --- ## [Collector \[cluster\_stats\] timed out when collecting data](https://discuss.elastic.co/t/collector-cluster-stats-timed-out-when-collecting-data/383847)
**Author:** [@zahojianxin](https://discuss.elastic.co/u/zahojianxin)\ **Replies:** 1\ **Last updated:** [December 3, 2025, 7:12pm UTC](https://discuss.elastic.co/t/collector-cluster-stats-timed-out-when-collecting-data/383847 "2025-12-03T19:12:28Z")
\[2025-12-03T12:21:35,854\]\[ERROR\]\[o.e.x.m.c.c.ClusterStatsCollector\] \[YZH-SC-ILMS-ES1\] collector \[cluster\_stats\] timed out when collecting data \[2025-12-03T12:21:57,037\]\[ERROR\]\[o.e.x.m.c.c.ClusterStatsCollector\] \[YZH-SC-… --- ## [Trouble Connecting to Windows Endpoint in Lab 7.3 (Elastic Security for SIEM)](https://discuss.elastic.co/t/trouble-connecting-to-windows-endpoint-in-lab-7-3-elastic-security-for-siem/383675)
**Author:** [@saman3](https://discuss.elastic.co/u/saman3)\ **Replies:** 0\ **Last updated:** [November 26, 2025, 10:24am UTC](https://discuss.elastic.co/t/trouble-connecting-to-windows-endpoint-in-lab-7-3-elastic-security-for-siem/383675 "2025-11-26T10:24:31Z")
Hi everyone, I’m working on Lab 7.3 in the Elastic Security for SIEM course and need to generate data for a detection rule. The problem is that I can’t connect to the Windows endpoint provided in the lab environment. T… --- ## [Create a canvas page per document](https://discuss.elastic.co/t/create-a-canvas-page-per-document/383455)
**Author:** [@jfsardon](https://discuss.elastic.co/u/jfsardon)\ **Replies:** 0\ **Last updated:** [November 14, 2025, 10:02pm UTC](https://discuss.elastic.co/t/create-a-canvas-page-per-document/383455 "2025-11-14T22:02:21Z")
I would like to create a Canvas with one page (\< 50 pages per canvas ) for each row (1 row = 1 agent name) of my datastream, all pages being based on the same template with by example a filter based on the agent name . I… --- ## [Can I sort a sematic query based on a field containing a value or not?](https://discuss.elastic.co/t/can-i-sort-a-sematic-query-based-on-a-field-containing-a-value-or-not/383906)
**Author:** [@bwagner](https://discuss.elastic.co/u/bwagner)\ **Replies:** 1\ **Last updated:** [December 6, 2025, 11:37am UTC](https://discuss.elastic.co/t/can-i-sort-a-sematic-query-based-on-a-field-containing-a-value-or-not/383906 "2025-12-06T11:37:19Z")
I am new to elastic an Elasticsearch and I guess this is a fairly simple, beginner type quesation. I have an index that contains information from websites and pdf documents. The index is used in a chat bot on an a websi… --- ## [Recall Stage vs LTR: am I duplicating logic or losing good results in Elasticsearch?](https://discuss.elastic.co/t/recall-stage-vs-ltr-am-i-duplicating-logic-or-losing-good-results-in-elasticsearch/383630)
**Author:** [@Shell\_Dias](https://discuss.elastic.co/u/Shell_Dias)\ **Replies:** 1\ **Last updated:** [December 3, 2025, 8:04pm UTC](https://discuss.elastic.co/t/recall-stage-vs-ltr-am-i-duplicating-logic-or-losing-good-results-in-elasticsearch/383630 "2025-12-03T20:04:40Z")
Hey folks, I’m building a search pipeline using Elasticsearch + Vector Search + LTR, and I’ve hit a conceptual conflict. Classic pipeline: Recall (BM25 / Vector / Hybrid) LTR (rerank top-K) Pagination All g… --- ## [Nest to the new API](https://discuss.elastic.co/t/nest-to-the-new-api/386742)
**Author:** [@xef](https://discuss.elastic.co/u/xef)\ **Replies:** 0\ **Last updated:** [June 6, 2026, 10:08pm UTC](https://discuss.elastic.co/t/nest-to-the-new-api/386742 "2026-06-06T22:08:30Z")
We used to be able to build filters incrementally as below. How do we do it in the new API. Thanks internal static List\\> BuildFilter(SearchCriteria searchCriteria, string c… --- ## [Sensor endgame WebSocket validation](https://discuss.elastic.co/t/sensor-endgame-websocket-validation/385836)
**Author:** [@Omar\_Tawfik\_kandil](https://discuss.elastic.co/u/Omar_Tawfik_kandil)\ **Replies:** 0\ **Last updated:** [April 9, 2026, 11:39pm UTC](https://discuss.elastic.co/t/sensor-endgame-websocket-validation/385836 "2026-04-09T23:39:35Z")
Hi all, I’m troubleshooting an Elastic Endgame / SMP issue and wanted to check whether anyone has seen this before. Environment: SMP Platform 3.52.3 Generated Windows sensor version 3.65.2 Windows 10 fresh VM … --- ## [Does Logstash Kafka Plugin support Azure Managed Identity Authentication](https://discuss.elastic.co/t/does-logstash-kafka-plugin-support-azure-managed-identity-authentication/383776)
**Author:** [@dmj0013](https://discuss.elastic.co/u/dmj0013)\ **Replies:** 0\ **Last updated:** [December 1, 2025, 8:24am UTC](https://discuss.elastic.co/t/does-logstash-kafka-plugin-support-azure-managed-identity-authentication/383776 "2025-12-01T08:24:04Z")
Currently, does the Logstash Kafka Plugin support Azure Managed Identity Authentication for Event Hubs Kafka Endpoint? According to this article https://www.elastic.co/blog/ingest-data-azure-event-hub-entra-id?ref=dailyd… --- ## [Panic: runtime error: makeslice: cap out of range](https://discuss.elastic.co/t/panic-runtime-error-makeslice-cap-out-of-range/384887)
**Author:** [@whanklee](https://discuss.elastic.co/u/whanklee)\ **Replies:** 0\ **Last updated:** [February 3, 2026, 2:00pm UTC](https://discuss.elastic.co/t/panic-runtime-error-makeslice-cap-out-of-range/384887 "2026-02-03T14:00:55Z")
Packetbeat 9.3.0 crashes with Go panic in DHCPv4 parser (makeslice: cap out of range) on Ubuntu 24 Environment • OS: Ubuntu Server 24.04 LTS (amd64) • Packetbeat version: packetbeat version 9.3.0 (amd64) libbeat 9… --- ## [PQ Size - growth by xx % in xx mins](https://discuss.elastic.co/t/pq-size-growth-by-xx-in-xx-mins/385627)
**Author:** [@Whoami1980](https://discuss.elastic.co/u/Whoami1980)\ **Replies:** 1\ **Last updated:** [March 29, 2026, 1:35am UTC](https://discuss.elastic.co/t/pq-size-growth-by-xx-in-xx-mins/385627 "2026-03-29T01:35:24Z")
We currently have an EQL query that is able to calculate PQ usage percentage. However now we have a new requirement. If there is a sudden increase in the "PQ Size - growth" by let say 10% in 30 mins. we need it to be aw… --- ## [Downsampling non-dimension labels to last value is misleading](https://discuss.elastic.co/t/downsampling-non-dimension-labels-to-last-value-is-misleading/390779)
**Author:** [@pmcc](https://discuss.elastic.co/u/pmcc)\ **Replies:** 0\ **Last updated:** [September 30, 2026, 11:36am UTC](https://discuss.elastic.co/t/downsampling-non-dimension-labels-to-last-value-is-misleading/390779 "2026-09-30T11:36:22Z")
I'm upgrading from v7 to 9.5 - lots of great new features! For my application, TSDS look ideal, and downsampling will be a major improvement. There appears to be one flaw with downsampling for my use cases. Keyword fiel… --- ## [Support for metrics for kafka consumer group using new Consumer Rebalance Protocol](https://discuss.elastic.co/t/support-for-metrics-for-kafka-consumer-group-using-new-consumer-rebalance-protocol/390766)
**Author:** [@rakesh.iitism95](https://discuss.elastic.co/u/rakesh.iitism95)\ **Replies:** 0\ **Last updated:** [September 29, 2026, 8:29pm UTC](https://discuss.elastic.co/t/support-for-metrics-for-kafka-consumer-group-using-new-consumer-rebalance-protocol/390766 "2026-09-29T20:29:36Z")
We are currently using elastic agent to collect kafka consumer group metric. After a consumer group was configured to use the new consumer rebalance protocol available in Kafka 4.0 , the agent was not collecting the metr… --- ## [Filebeat performance, 430 containers](https://discuss.elastic.co/t/filebeat-performance-430-containers/390622)
**Author:** [@zerkms](https://discuss.elastic.co/u/zerkms)\ **Replies:** 0\ **Last updated:** [September 24, 2026, 5:18am UTC](https://discuss.elastic.co/t/filebeat-performance-430-containers/390622 "2026-09-24T05:18:13Z")
I'm migrating from quite an old ES+fluentbit configuration (logging solution for a small kubernetes cluster). And this is quite simple yet inefficient (?) config I came up with (this file is generated by ECK using the B… --- ## [Why is the operator run as a statefulset?](https://discuss.elastic.co/t/why-is-the-operator-run-as-a-statefulset/390605)
**Author:** [@Frederic\_PEGE](https://discuss.elastic.co/u/Frederic_PEGE)\ **Replies:** 0\ **Last updated:** [September 23, 2026, 11:37am UTC](https://discuss.elastic.co/t/why-is-the-operator-run-as-a-statefulset/390605 "2026-09-23T11:37:14Z")
Hi, Why is the operator run as a STS ? I'm talking about the ES cluster, but the actual operator ? --- ## [Compound sort with \`missing: "\_last"\` silently drops/substitutes hits when every document ties on the leading field](https://discuss.elastic.co/t/compound-sort-with-missing-last-silently-drops-substitutes-hits-when-every-document-ties-on-the-leading-field/387834)
**Author:** [@Kent-Kuan](https://discuss.elastic.co/u/Kent-Kuan)\ **Replies:** 0\ **Last updated:** [July 8, 2026, 3:26am UTC](https://discuss.elastic.co/t/compound-sort-with-missing-last-silently-drops-substitutes-hits-when-every-document-ties-on-the-leading-field/387834 "2026-07-08T03:26:18Z")
We found a correctness bug: sorting by two fields where the leading field is missing on every matching document returns a wrong, incomplete top-N — even though the result should be mathematically identical to sorting by … --- ## [Sql\_last\_value is updated only once](https://discuss.elastic.co/t/sql-last-value-is-updated-only-once/383194)
**Author:** [@chiel](https://discuss.elastic.co/u/chiel)\ **Replies:** 0\ **Last updated:** [November 4, 2025, 8:40am UTC](https://discuss.elastic.co/t/sql-last-value-is-updated-only-once/383194 "2025-11-04T08:40:29Z")
Hi, I’m using sql\_last\_value, last\_run\_metadata\_path, tracking\_column etc. for tracking the most recent value of a given column of my query. When I restart logstash, the value is updated correct in the tracking file (la… --- ## [Synthetics elastic-agent-complete High Availability](https://discuss.elastic.co/t/synthetics-elastic-agent-complete-high-availability/382890)
**Author:** [@Craig\_Sharp](https://discuss.elastic.co/u/Craig_Sharp)\ **Replies:** 0\ **Last updated:** [October 22, 2025, 2:03pm UTC](https://discuss.elastic.co/t/synthetics-elastic-agent-complete-high-availability/382890 "2025-10-22T14:03:06Z")
I am currently operating the elastic-agent-complete container within a single-node Docker environment. Due to the critical nature and volume of monitoring we perform, it is imperative that we transition this deployment t… --- ## [Integration with omega-scan](https://discuss.elastic.co/t/integration-with-omega-scan/390677)
**Author:** [@wessorh](https://discuss.elastic.co/u/wessorh)\ **Replies:** 0\ **Last updated:** [September 25, 2026, 8:07am UTC](https://discuss.elastic.co/t/integration-with-omega-scan/390677 "2026-09-25T08:07:24Z")
I'm interested in testing a opensource sample scanner called omega-scan and am looking for documentation on what capabilities there are for calling 3rd party file scanners. A pointer would be greatly appreciated. --- ## [Issue on Dependency Operations Beta Page](https://discuss.elastic.co/t/issue-on-dependency-operations-beta-page/384202)
**Author:** [@Serak\_Shiferaw](https://discuss.elastic.co/u/Serak_Shiferaw)\ **Replies:** 0\ **Last updated:** [December 19, 2025, 2:46pm UTC](https://discuss.elastic.co/t/issue-on-dependency-operations-beta-page/384202 "2025-12-19T14:46:00Z")
Observability \> APM \> Dependencies \> db2/FEPRODDB \> Operations i have observed the below things 1st from java monitoring agent or the display its not good with multiline format sql statments , it just shows SELECT 2nd… --- ## [Eck-elasticsearch helm chart - how to properly set path.repo](https://discuss.elastic.co/t/eck-elasticsearch-helm-chart-how-to-properly-set-path-repo/383278)
**Author:** [@Scott\_Weller](https://discuss.elastic.co/u/Scott_Weller)\ **Replies:** 0\ **Last updated:** [November 6, 2025, 11:38pm UTC](https://discuss.elastic.co/t/eck-elasticsearch-helm-chart-how-to-properly-set-path-repo/383278 "2025-11-06T23:38:14Z")
I have installed an ES cluster and kibana instance on k8s and verified both are working correctly. I am currently attempting to link a snapshot repository created for our prod cluster to my dev cluster which was provisio… --- ## [Compatibility of Java Low Level REST Client 8.3.0 with ES 5.x and ES 7.x](https://discuss.elastic.co/t/compatibility-of-java-low-level-rest-client-8-3-0-with-es-5-x-and-es-7-x/385639)
**Author:** [@hxx](https://discuss.elastic.co/u/hxx)\ **Replies:** 0\ **Last updated:** [March 26, 2026, 4:28pm UTC](https://discuss.elastic.co/t/compatibility-of-java-low-level-rest-client-8-3-0-with-es-5-x-and-es-7-x/385639 "2026-03-26T16:28:30Z")
Hi, We're upgrading the Elasticsearch Java Low Level REST Client from 6.2.4 to 8.3.0, and we need to continue accessing both ES 5.x and ES 7.x clusters (cluster upgrades are not on the table for now). Since we're using… --- ## [System logs not collected on some Elastic Agent policies](https://discuss.elastic.co/t/system-logs-not-collected-on-some-elastic-agent-policies/384426)
**Author:** [@nazok123](https://discuss.elastic.co/u/nazok123)\ **Replies:** 0\ **Last updated:** [January 7, 2026, 6:20pm UTC](https://discuss.elastic.co/t/system-logs-not-collected-on-some-elastic-agent-policies/384426 "2026-01-07T18:20:00Z")
Hi everyone, We use Elastic as a SIEM. I have several Elastic Agent policies, and the same agents are assigned to multiple policies. However, on some of the policies, system logs from the sources are not being collecte… --- ## [Does querystring supports spannotquery?](https://discuss.elastic.co/t/does-querystring-supports-spannotquery/383328)
**Author:** [@vsop\_479](https://discuss.elastic.co/u/vsop_479)\ **Replies:** 0\ **Last updated:** [November 10, 2025, 7:32am UTC](https://discuss.elastic.co/t/does-querystring-supports-spannotquery/383328 "2025-11-10T07:32:02Z")
Does querystring supports spannotquery? Does querystring like below supported by ES? spanNot(title:united, title:states, 1, true) --- ## [Best way to analyze secure document activity logs in Elasticsearch?](https://discuss.elastic.co/t/best-way-to-analyze-secure-document-activity-logs-in-elasticsearch/390834)
**Author:** [@George4](https://discuss.elastic.co/u/George4)\ **Replies:** 0\ **Last updated:** [October 5, 2026, 8:14am UTC](https://discuss.elastic.co/t/best-way-to-analyze-secure-document-activity-logs-in-elasticsearch/390834 "2026-10-05T08:14:44Z")
I’m exploring how to structure document activity data in Elasticsearch for a secure document-sharing / virtual data room workflow. One of the platforms I’m looking at is SendNow. The activity data includes document ope… --- ## [Kibana 9 - Detail dialog also shows "Truncated string" as configured for the overview](https://discuss.elastic.co/t/kibana-9-detail-dialog-also-shows-truncated-string-as-configured-for-the-overview/390551)
**Author:** [@poifir](https://discuss.elastic.co/u/poifir)\ **Replies:** 0\ **Last updated:** [September 21, 2026, 11:49am UTC](https://discuss.elastic.co/t/kibana-9-detail-dialog-also-shows-truncated-string-as-configured-for-the-overview/390551 "2026-09-21T11:49:22Z")
In the new Kibana 9 UI it's possible to customize the column visualization with "Edit data view field". This allows to e.g. enable to truncate a field to the first x characters so it only needs a reasonable size i… --- ## [New .Net API](https://discuss.elastic.co/t/new-net-api/386806)
**Author:** [@xef](https://discuss.elastic.co/u/xef)\ **Replies:** 0\ **Last updated:** [June 10, 2026, 10:51pm UTC](https://discuss.elastic.co/t/new-net-api/386806 "2026-06-10T22:51:48Z")
Thanks. Also we used to be able to build filters incrementally as below. How do we do it in the new API. Thanks internal static List\\> BuildFilter(SearchCriteria searchCrite… --- ## [Find Related documents in graph/ES](https://discuss.elastic.co/t/find-related-documents-in-graph-es/385553)
**Author:** [@shambar](https://discuss.elastic.co/u/shambar)\ **Replies:** 0\ **Last updated:** [March 20, 2026, 7:55pm UTC](https://discuss.elastic.co/t/find-related-documents-in-graph-es/385553 "2026-03-20T19:55:01Z")
I have a technical question about elasticsearch and graph. Given the 2 documents below I have a couple of questions: Would graph find the second document if someone only searched on the phone number? Is there a regu… [Previous page](https://discuss.elastic.co/top.md?page=27&per_page=50) [Next page](https://discuss.elastic.co/top.md?page=29&per_page=50)