# Top **URL:** https://discuss.elastic.co/top.md?page=29 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 30 --- ## [Is it safe to upgrade on cloud using upgrade button from console](https://discuss.elastic.co/t/is-it-safe-to-upgrade-on-cloud-using-upgrade-button-from-console/385077)
**Author:** [@Elastic04](https://discuss.elastic.co/u/Elastic04)\ **Replies:** 0\ **Last updated:** [February 17, 2026, 11:10am UTC](https://discuss.elastic.co/t/is-it-safe-to-upgrade-on-cloud-using-upgrade-button-from-console/385077 "2026-02-17T11:10:58Z")
I am upgrading from v8.9 to v8.19.x to v9.3.0. we are currently using java HLR 7.17. So, I want to move to server v8.19.x first and then deploy java REST v8.19 and then upgrade server to v9.3.0. Is it ok to use upgrade … --- ## [Gitops: Building Logstash Plugin via gitlab runner?](https://discuss.elastic.co/t/gitops-building-logstash-plugin-via-gitlab-runner/384724)
**Author:** [@teopatl](https://discuss.elastic.co/u/teopatl)\ **Replies:** 0\ **Last updated:** [January 23, 2026, 9:44pm UTC](https://discuss.elastic.co/t/gitops-building-logstash-plugin-via-gitlab-runner/384724 "2026-01-23T21:44:40Z")
Anyone successfully building logstash java plugins as artifacts via gitlab runners? I’ve attempted a multi-stage docker build with the following gitlab-ci.yml, from which fails with the error A problem was found with… --- ## [Improving ElasticSearch relevance with better normalization (beyond stemming)](https://discuss.elastic.co/t/improving-elasticsearch-relevance-with-better-normalization-beyond-stemming/385966)
**Author:** [@tonyj](https://discuss.elastic.co/u/tonyj)\ **Replies:** 0\ **Last updated:** [April 20, 2026, 4:11pm UTC](https://discuss.elastic.co/t/improving-elasticsearch-relevance-with-better-normalization-beyond-stemming/385966 "2026-04-20T16:11:20Z")
Hi everyone, In several Elasticsearch projects we’ve seen stemming introduce noise early in the analysis pipeline, especially in multilingual setups. For example: “organization” → “organ” “news” → “new” “united” → “u… --- ## [Do Explicit Sort Fields Imply A Filter Context?](https://discuss.elastic.co/t/do-explicit-sort-fields-imply-a-filter-context/384377)
**Author:** [@vanschelven](https://discuss.elastic.co/u/vanschelven)\ **Replies:** 0\ **Last updated:** [January 5, 2026, 7:56pm UTC](https://discuss.elastic.co/t/do-explicit-sort-fields-imply-a-filter-context/384377 "2026-01-05T19:56:06Z")
\[A\] This page explains the differences between query and filtered context quite well: When there's no need for query context (e.g. because sorting on something else explicitly) filtered context has many advantages. \[… --- ## [Exporting logs from Azure storage account to Logstash using Filebeat in Kubernetes](https://discuss.elastic.co/t/exporting-logs-from-azure-storage-account-to-logstash-using-filebeat-in-kubernetes/382926)
**Author:** [@ramakoteswar](https://discuss.elastic.co/u/ramakoteswar)\ **Replies:** 0\ **Last updated:** [October 23, 2025, 2:45pm UTC](https://discuss.elastic.co/t/exporting-logs-from-azure-storage-account-to-logstash-using-filebeat-in-kubernetes/382926 "2025-10-23T14:45:20Z")
I wan to export the logs from Azure storage account to a Logstash. Seems like ELK doesn’t provide any plugin to export data from storage account to Logstash directly. They provide only Filebeat plugin. Because filebeat r… --- ## [Palo alto (pan Metrics) integration tips](https://discuss.elastic.co/t/palo-alto-pan-metrics-integration-tips/385943)
**Author:** [@a.elbacha](https://discuss.elastic.co/u/a.elbacha)\ **Replies:** 0\ **Last updated:** [April 19, 2026, 7:04pm UTC](https://discuss.elastic.co/t/palo-alto-pan-metrics-integration-tips/385943 "2026-04-19T19:04:27Z")
I am trying to integrate PAN with ELK to fetch metrics and later on enable anomaly detection to proactively detect any connections failure or packet drops. Moreover, is it supported in service Maps to visualize the traf… --- ## [(Email) Notifications for Agent Status Change](https://discuss.elastic.co/t/email-notifications-for-agent-status-change/385528)
**Author:** [@RalphDibney](https://discuss.elastic.co/u/RalphDibney)\ **Replies:** 0\ **Last updated:** [March 19, 2026, 2:50pm UTC](https://discuss.elastic.co/t/email-notifications-for-agent-status-change/385528 "2026-03-19T14:50:38Z")
Elastic Onprem 8.19.12 We are currently preparing to rollout Elastic Defend on all our systems. Since this makes the Elastic installation on the agent absolutly security critical, we want to be informed about the status… --- ## [How to implement RAG with index mapping](https://discuss.elastic.co/t/how-to-implement-rag-with-index-mapping/385095)
**Author:** [@kirancchand](https://discuss.elastic.co/u/kirancchand)\ **Replies:** 0\ **Last updated:** [February 18, 2026, 12:22pm UTC](https://discuss.elastic.co/t/how-to-implement-rag-with-index-mapping/385095 "2026-02-18T12:22:39Z")
I need to create a RAG application which use mappings of my index to create query and execute and then response back.can i get any idea to do this? does vectorise and implement RAG or my query which would be better to im… --- ## [Create custom token filter](https://discuss.elastic.co/t/create-custom-token-filter/384497)
**Author:** [@sginer](https://discuss.elastic.co/u/sginer)\ **Replies:** 0\ **Last updated:** [January 13, 2026, 8:34am UTC](https://discuss.elastic.co/t/create-custom-token-filter/384497 "2026-01-13T08:34:08Z")
Elasticsearch version : 8.19.9 Elasticsearch version : 9.2.2 Hello, I try to create a custom TokenFilter who is able to cypher index content. I create the class who cypher tokens and extends TokenFilter class and I… --- ## [Request for enhancement: Messages like "Authentication using apikey failed" need source IP address](https://discuss.elastic.co/t/request-for-enhancement-messages-like-authentication-using-apikey-failed-need-source-ip-address/383629)
**Author:** [@rugenl](https://discuss.elastic.co/u/rugenl)\ **Replies:** 0\ **Last updated:** [November 24, 2025, 6:42pm UTC](https://discuss.elastic.co/t/request-for-enhancement-messages-like-authentication-using-apikey-failed-need-source-ip-address/383629 "2025-11-24T18:42:28Z")
It’s difficult to find where these bad API keys are coming from. The only suggestion is to enable audit, which is overkill and uses a lot of resources logging 99% of the audit events that are good. If the x\_forwarded\_f… --- ## [K8s Integration custom configuration](https://discuss.elastic.co/t/k8s-integration-custom-configuration/382832)
**Author:** [@M311ow](https://discuss.elastic.co/u/M311ow)\ **Replies:** 0\ **Last updated:** [October 20, 2025, 9:58am UTC](https://discuss.elastic.co/t/k8s-integration-custom-configuration/382832 "2025-10-20T09:58:51Z")
Hi All, How do I custom a configuration for Integration to support a old Filebeat configuration? Ex. - id: kube-logs-logstash-multiline data\_stream: dataset: kubernetes.container\_logs condition: … --- ## [Crowdstrike Integration Degraded](https://discuss.elastic.co/t/crowdstrike-integration-degraded/385312)
**Author:** [@4l13v](https://discuss.elastic.co/u/4l13v)\ **Replies:** 0\ **Last updated:** [March 3, 2026, 8:27am UTC](https://discuss.elastic.co/t/crowdstrike-integration-degraded/385312 "2026-03-03T08:27:00Z")
I have integrated Crowdstrike to Fleet Successfully, It maintains almost 1 month successfully. But due today I got an error. What is the exact issue here --- ## [Is it possible to add additional fields to the elastic serverless forwarder config?](https://discuss.elastic.co/t/is-it-possible-to-add-additional-fields-to-the-elastic-serverless-forwarder-config/385215)
**Author:** [@Lasra\_Bilaj](https://discuss.elastic.co/u/Lasra_Bilaj)\ **Replies:** 0\ **Last updated:** [February 25, 2026, 12:51pm UTC](https://discuss.elastic.co/t/is-it-possible-to-add-additional-fields-to-the-elastic-serverless-forwarder-config/385215 "2026-02-25T12:51:29Z")
In the config.yml for Elastics serverless forwarder, is it possible to do something like this. outputs: - type: elasticsearch args: cloud\_id: ${ELASTIC\_CLOUD\_ID} api\_key: ${ELASTIC\_API\_… --- ## [Remove semantic duplicates in retrieval](https://discuss.elastic.co/t/remove-semantic-duplicates-in-retrieval/385456)
**Author:** [@alexander.korkhov](https://discuss.elastic.co/u/alexander.korkhov)\ **Replies:** 0\ **Last updated:** [March 15, 2026, 5:30pm UTC](https://discuss.elastic.co/t/remove-semantic-duplicates-in-retrieval/385456 "2026-03-15T17:30:22Z")
ElasticSeach indexes poster events retrieved from different sources. The same event (for example, a performance) can be retrieved from different sources. Is it possible to somehow organize the data retrieval so that only… --- ## [\`agent.logging.to\_eventlog: true\` fails with "appName cannot be empty" even when running as Windows service](https://discuss.elastic.co/t/agent-logging-to-eventlog-true-fails-with-appname-cannot-be-empty-even-when-running-as-windows-service/385096)
**Author:** [@vasek](https://discuss.elastic.co/u/vasek)\ **Replies:** 0\ **Last updated:** [February 18, 2026, 12:39pm UTC](https://discuss.elastic.co/t/agent-logging-to-eventlog-true-fails-with-appname-cannot-be-empty-even-when-running-as-windows-service/385096 "2026-02-18T12:39:48Z")
Environment: Elastic Agent: 9.1.10 (build: 45f734) OS: Windows Server 2022 Mode: Standalone (no Fleet) Problem: Setting agent.logging.to\_eventlog: true in elastic-agent.yml causes agent to fail on startup with: elas… --- ## [How should logstash connect to ECK created TLS encrypted elasticsearch in kubernets](https://discuss.elastic.co/t/how-should-logstash-connect-to-eck-created-tls-encrypted-elasticsearch-in-kubernets/384586)
**Author:** [@VOCTERMA](https://discuss.elastic.co/u/VOCTERMA)\ **Replies:** 0\ **Last updated:** [January 16, 2026, 3:26pm UTC](https://discuss.elastic.co/t/how-should-logstash-connect-to-eck-created-tls-encrypted-elasticsearch-in-kubernets/384586 "2026-01-16T15:26:13Z")
How should logstash connect to ECK created TLS encrypted elasticsearch in kubernets --- ## [Suggested approach for avoiding stale access token with ApiProxyConnector?](https://discuss.elastic.co/t/suggested-approach-for-avoiding-stale-access-token-with-apiproxyconnector/383392)
**Author:** [@mansn](https://discuss.elastic.co/u/mansn)\ **Replies:** 0\ **Last updated:** [November 12, 2025, 12:36pm UTC](https://discuss.elastic.co/t/suggested-approach-for-avoiding-stale-access-token-with-apiproxyconnector/383392 "2025-11-12T12:36:49Z")
Hi, I’m using @elastic/search-ui-elasticsearch-connector/api-proxy to create a connector for my backend (and the backend implements the ElasticsearchAPIConnector). My backend endpoints requires an Bearer token to be pas… --- ## [HighLevelRestClient7.17.5 date\_histogram offset is unexpected](https://discuss.elastic.co/t/highlevelrestclient7-17-5-date-histogram-offset-is-unexpected/383208)
**Author:** [@ZLEternity](https://discuss.elastic.co/u/ZLEternity)\ **Replies:** 0\ **Last updated:** [November 4, 2025, 12:35pm UTC](https://discuss.elastic.co/t/highlevelrestclient7-17-5-date-histogram-offset-is-unexpected/383208 "2025-11-04T12:35:57Z")
DateHistogramAggregationBuilder dateHistogramAggregationBuilder = AggregationBuilders .dateHistogram(AggValueEnum.TIME\_INTERVAL.getAggName()).field(AggValueEnum.TIME\_INTERVAL.getField()).minDocCount(0).extendedBo… --- ## [Kibana needs more memory to generate this report. Check RAM requirements](https://discuss.elastic.co/t/kibana-needs-more-memory-to-generate-this-report-check-ram-requirements/384934)
**Author:** [@francescoa](https://discuss.elastic.co/u/francescoa)\ **Replies:** 0\ **Last updated:** [February 5, 2026, 5:15pm UTC](https://discuss.elastic.co/t/kibana-needs-more-memory-to-generate-this-report-check-ram-requirements/384934 "2026-02-05T17:15:29Z")
Hi everyone :slight\_smile: We have Kibana v8.13.4 exposed on an AWS EC2 instance. It’s the only one Kibana instance we have. When I try to create a report, the section Management \> Alerts and Insights \> Reporting somet… --- ## [Problems matching synonyms after stemming](https://discuss.elastic.co/t/problems-matching-synonyms-after-stemming/388548)
**Author:** [@hmpalmeida](https://discuss.elastic.co/u/hmpalmeida)\ **Replies:** 0\ **Last updated:** [July 21, 2026, 5:09pm UTC](https://discuss.elastic.co/t/problems-matching-synonyms-after-stemming/388548 "2026-07-21T17:09:09Z")
Hello! I'm currently having some problems trying to use a synonym\_graph filter after applying a stemmer. My problem can be replicated with the following "\_analyze" request: \`\`\` { "tokenizer": "whitespace", "filter"… --- ## [Is this a bug at DateHistogram aggregation?](https://discuss.elastic.co/t/is-this-a-bug-at-datehistogram-aggregation/383069)
**Author:** [@vicety](https://discuss.elastic.co/u/vicety)\ **Replies:** 0\ **Last updated:** [October 29, 2025, 10:20am UTC](https://discuss.elastic.co/t/is-this-a-bug-at-datehistogram-aggregation/383069 "2025-10-29T10:20:46Z")
I was reading the source code of histogram aggregation and found this. // server/src/main/java/org/elasticsearch/search/aggregations/bucket/histogram/InternalDateHistogram.java // (line 358) private void addEmptyB… --- ## [ Switching Elasticsearch from HTTP to HTTPS with Active Fleet Agents](https://discuss.elastic.co/t/switching-elasticsearch-from-http-to-https-with-active-fleet-agents/386339)
**Author:** [@saeedelfiky](https://discuss.elastic.co/u/saeedelfiky)\ **Replies:** 0\ **Last updated:** [May 14, 2026, 3:08pm UTC](https://discuss.elastic.co/t/switching-elasticsearch-from-http-to-https-with-active-fleet-agents/386339 "2026-05-14T15:08:18Z")
Hey everyone, I currently have a self-managed Elastic Stack environment running over HTTP with: Elasticsearch Kibana Fleet Around 20 connected Elastic Agent instances I want to migrate Elasticsearch from … --- ## [Histogram zoom-out status](https://discuss.elastic.co/t/histogram-zoom-out-status/383733)
**Author:** [@jkavalik](https://discuss.elastic.co/u/jkavalik)\ **Replies:** 0\ **Last updated:** [November 27, 2025, 12:39pm UTC](https://discuss.elastic.co/t/histogram-zoom-out-status/383733 "2025-11-27T12:39:23Z")
What is the current status of previous/next button zoom in/ zoom out for a more convenient data exploration · Issue #54103 · elastic/kibana · GitHub ? It is marked as “completed” for almost two years and I cannot see it… --- ## [Adding registered\_domain processor on fortinet module - what's the best way to do this?](https://discuss.elastic.co/t/adding-registered-domain-processor-on-fortinet-module-whats-the-best-way-to-do-this/383130)
**Author:** [@artschooldropout](https://discuss.elastic.co/u/artschooldropout)\ **Replies:** 0\ **Last updated:** [October 31, 2025, 3:32pm UTC](https://discuss.elastic.co/t/adding-registered-domain-processor-on-fortinet-module-whats-the-best-way-to-do-this/383130 "2025-10-31T15:32:17Z")
I'm trying to add the registered\_domain processor to extract the registered domain from destination.address in my Fortinet firewall logs (e.g., extract d-zone.ca from ns2-firewall.d-zone.ca). Environment: Filebeat: 8… --- ## [How to use opentelemetry for search analytics](https://discuss.elastic.co/t/how-to-use-opentelemetry-for-search-analytics/385509)
**Author:** [@Elastic04](https://discuss.elastic.co/u/Elastic04)\ **Replies:** 0\ **Last updated:** [March 18, 2026, 4:29pm UTC](https://discuss.elastic.co/t/how-to-use-opentelemetry-for-search-analytics/385509 "2026-03-18T16:29:48Z")
How to use opentelemetry for search analytics with java client --- ## [How to add labels to sql span?](https://discuss.elastic.co/t/how-to-add-labels-to-sql-span/383901)
**Author:** [@VictoRK](https://discuss.elastic.co/u/VictoRK)\ **Replies:** 0\ **Last updated:** [December 5, 2025, 5:02pm UTC](https://discuss.elastic.co/t/how-to-add-labels-to-sql-span/383901 "2025-12-05T17:02:55Z")
I need to add labels to my autogenerated sql span details in my .NET Web Application. My agent is started in global.asax and i have the following code: Dim AgentComponents = ElasticApmModule.CreateAgentComponents() Ag… --- ## [We are loading kibana dashboards in angular application using iframe and we found dashboards are taking more time for loading in iframe](https://discuss.elastic.co/t/we-are-loading-kibana-dashboards-in-angular-application-using-iframe-and-we-found-dashboards-are-taking-more-time-for-loading-in-iframe/383715)
**Author:** [@Maneesha](https://discuss.elastic.co/u/Maneesha)\ **Replies:** 0\ **Last updated:** [November 27, 2025, 7:39am UTC](https://discuss.elastic.co/t/we-are-loading-kibana-dashboards-in-angular-application-using-iframe-and-we-found-dashboards-are-taking-more-time-for-loading-in-iframe/383715 "2025-11-27T07:39:58Z")
we are loading kibana dashboards in angular application using iframe, and we found dashboards are taking more time for loading in iframe. Is there any approaches for reducing the dashboard loading time? any approaches f… [Previous page](https://discuss.elastic.co/top.md?page=28&per_page=50)