👋 Thanks for checking out our Elastic Docs v3 POC. Have feedback? Reach out here. Thanks!

Elastic Elastic Elastic
  • Elastic Docs v3
    • Search Build custom applications with your data using Elasticsearch.
    • Observability Monitor applications and systems with Elastic Observability.
    • Security Detect, investigate, and respond to threats with Elastic Security.
    • Elastic Cloud Deploy instances of the Elastic Stack in the cloud, with the provider of your choice.
    • Elastic Cloud Enterprise Deploy Elastic Cloud on public or private clouds, virtual machines, or your own premises.
    • Elastic Cloud on Kubernetes Deploy Elastic Cloud on Kubernetes.
    • Self managed Install, configure, and run Elastic products on your own premises.
    • API Reference Description.
    • Configuration Reference Description.
    • Troubleshooting Description.
  • What's New
/

Elastic Docs Guide

  • Get started
    • The stack
    • Deployment options
    • Use cases
    • Contribute
  • Solutions and use cases
    • Observability
      • Get started
        • What is Elastic Observability
        • Create an Observability project
        • Quickstart: Monitor hosts with Elastic Agent
        • Quickstart: Monitor your Kubernetes cluster with Elastic Agent
        • Quickstart: Monitor hosts with OpenTelemetry
        • Quickstart: Unified Kubernetes Observability with Elastic Distributions of OpenTelemetry (EDOT)
        • Quickstart: Collect data with AWS Firehose
        • Add data from Splunk
        • Get started with dashboards
      • Applications and services
        • Application performance monitoring (APM)
          • Get started with APM
            • Fleet-managed APM Server
            • APM Server binary
          • Learn about application data types
            • Spans
            • Transactions
              • Transaction sampling
            • Traces
            • Errors
            • Metrics
            • Metadata
          • Collect application data
            • Elastic APM agents
              • Centrally configure APM agents in Kibana
              • Real User Monitoring (RUM)
              • Create and upload source maps (RUM)
            • Use OpenTelemetry with APM
              • Upstream OpenTelemetry Collectors and language SDKs
              • Collect metrics
              • Limitations
              • Resource Atrributes
            • Kubernetes
            • Monitoring AWS Lambda Functions
            • Jaeger (deprecated)
          • View and analyze data
            • Overviews
              • Services
              • Traces
              • Dependencies
              • Service map
              • Service overview
              • Mobile service overview
            • Inventory
            • Drill down into data
              • Transactions
              • Trace sample timeline
              • Errors
              • Metrics
              • Infrastructure
              • Logs
            • Filter and search application data
              • Filter application data
              • Use advanced queries on your application data
              • Cross-cluster search
            • Interpret application data
              • Find transaction latency and failure correlations
              • Track deployments with annotations
              • Explore mobile sessions with Discover
              • Observe Lambda functions
            • Integrate with machine learning
            • Identify deployment details for APM agents
            • Applications UI settings
          • Act on data
            • Create APM rules and alerts
            • Create custom links
          • Use APM securely
            • Secure data
              • Control access to APM data
              • Built-in data filters
              • Custom filters
              • Delete sensitive data
            • Secure communication with APM agents
              • APM agent TLS communication
              • API keys
              • Secret token
              • Anonymous authentication
            • Secure communication with the Elastic Stack
              • Use feature roles
              • Grant access using API keys
            • Secure access to the Applications UI
              • Create an APM reader user
              • Create an annotation user
              • Create an API user
              • Create a central config user
              • Create a storage explorer user
          • Manage storage
            • Storage Explorer
            • Data streams
            • Index lifecycle management
            • View the Elasticsearch index template
            • Parse data using ingest pipelines
            • Storage and sizing guide
            • Reduce storage
            • Explore data in Elasticsearch
          • Configure APM server
            • General configuration options
            • Anonymous authentication
            • APM agent authorization
            • APM agent central configuration
            • Instrumentation
            • {{kib}} endpoint
            • Logging
            • Output
              • {{ess}}
              • {{es}}
              • {{ls}}
              • Kafka
              • Redis
              • Console
            • Project paths
            • Real User Monitoring (RUM)
            • SSL/TLS settings
              • SSL/TLS output settings
              • SSL/TLS input settings
            • Tail-based sampling
            • Use environment variables in the configuration
            • Advanced setup
              • Installation layout
              • Secrets keystore
              • Command reference
              • Tune data ingestion
              • High Availability
              • APM Server and systemd
          • Monitor APM Server
            • Fleet-managed
            • APM Server binary
              • Use internal collection
              • Use {{metricbeat}} collection
              • Use local collection
          • APM APIs
            • APM UI API
              • Agent Configuration API
              • Annotation API
              • RUM source map API
              • APM agent Key API
              • Managed intake service event API
            • APM Server API
              • APM Server information API
              • Elastic APM events intake API
              • Elastic APM agent configuration API
              • OpenTelemetry intake API
              • Jaeger event intake
            • Common problems
            • What happens when APM Server or Elasticsearch is down?
            • APM Server response codes
            • Processing and performance
            • APM Server binary debugging
            • APM Server performance diagnostic
          • Upgrade
            • APM agent compatibility
            • Upgrade to version 8.x
              • Self-installation standalone
              • Self-installation APM integration
              • {{ecloud}} standalone
              • {{ecloud}} APM integration
            • Switch to the Elastic APM integration
              • Switch a self-installation
              • Switch an {{ecloud}} cluster
        • Synthetic monitoring
          • Get started
            • Create monitors with Project monitors
            • Create monitors in the Synthetics app
          • Scripting browser monitors
            • Write a synthetic test
            • Configure individual browser monitors
            • Use the Synthetics Recorder
          • Configure lightweight monitors
          • Manage monitors
          • Work with params and secrets
          • Analyze data from synthetic monitors
          • Monitor resources on private networks
          • Use the Synthetics CLI
          • Configure Synthetics projects
          • Multi-factor Authentication (MFA) for browser monitors
          • Configure Synthetics settings
          • Grant users access to secured resources
            • Setup role
            • Writer role
            • Reader role
          • Manage data retention
          • Use Synthetics with traffic filters
          • Migrate from the Elastic Synthetics integration
          • Scale and architect a Synthetics deployment
          • Synthetics support matrix
          • Synthetics Encryption and Security
        • Real user monitoring
        • Uptime monitoring (deprecated)
          • Get started
          • Analyze
            • View monitor status
            • Analyze monitors
            • Inspect uptime duration anomalies
          • Configure settings
        • Tutorial: Monitor a Java application
      • CI/CD
      • Cloud
        • AWS
          • Ingestion options
          • Monitor {{aws}} with {{agent}}
            • EC2
            • Kinesis data streams
            • S3
            • SQS
          • Monitor {{aws}} with {{beats}}
          • Monitor {{aws}} with Amazon Data Firehose
            • VPC Flow Logs
            • CloudTrail logs
            • Network Firewall logs
            • WAF logs
            • CloudWatch logs
          • Monitor {{aws}} with Elastic Serverless Forwarder
        • Azure
          • Monitor Microsoft Azure with Elastic Agent
          • Monitor Microsoft Azure with Beats
          • Monitor Microsoft Azure with the Azure Native ISV Service
          • Monitor Microsoft Azure OpenAI
        • GCP
          • GCP Dataflow templates
      • Infrastructure and hosts
        • Analyze infrastructure and host metrics
          • Get started with system metrics
          • View infrastructure metrics by resource type
          • Explore infrastructure metrics over time
          • Analyze and compare hosts
          • Detect metric anomalies
          • Configure settings
        • Universal Profiling
          • Get started
          • Manage data storage
            • Index lifecycle management
            • Configure probabilistic profiling
          • Advanced configuration
            • Tag data for querying
            • Add symbols for native frames
            • Use a proxy
            • Override kernel version check
            • Environment variables to configure the Universal Profiling Agent
            • Configuration file of the Universal Profiling Agent
          • Upgrade
          • Self-hosted infrastructure
          • Install the backend
            • Step 1: Update the stack
            • Step 2: Enable Universal Profiling in Kibana
            • Step 3: Set up Universal Profiling in Kibana
            • Step 4: Run the backend applications
            • Step 5: Next steps
          • Operate the backend
          • Universal Profiling issues
        • Tutorial: Observe your Kubernetes deployments
        • Tutorial: Observe your nginx instances
          • Understanding "no results found" message
      • Logs
        • Get started with system logs
        • Stream any log file
        • Stream application logs
          • Plaintext application logs
          • ECS formatted application logs
          • APM agent log sending
        • Parse and route logs
        • Filter and aggregate logs
        • Explore logs
          • Logs Explorer
          • Categorize log entries
          • Inspect log anomalies
          • Configure data sources
          • Logs Stream
        • Run a pattern analysis on log data
        • Add a service name to logs
      • Incident management
        • Alerting
          • Create and manage rules
            • Anomaly detection
            • Create an APM anomaly rule
            • Create a custom threshold rule
            • Elasticsearch query
            • Create an error count threshold rule
            • Create a failed transaction rate threshold rule
          • Create an inventory rule
            • Create a latency threshold rule
            • Log threshold
            • Metric threshold
            • Create a monitor status rule
            • TLS certificate
            • Uptime duration anomaly
            • Create an SLO burn rate rule
          • Aggregation options
            • Rate aggregation
          • View alerts
            • Triage SLO burn rate breaches
            • Triage threshold breaches
          • Cases
            • Configure access to cases
            • Create and manage cases
            • Configure case settings
          • Service-level objectives (SLOs)
            • Configure SLO access
            • Create an SLO
      • Data set quality monitoring
      • Observability AI Assistant
      • Tools and APIs
      • Unknown Bucket
        • View monitor status
        • Monitor {{aws}} with Amazon Data Firehose
        • Serverless observability limitations
        • Host metrics
        • Container metrics
        • Kubernetes pod metrics
        • AWS metrics
        • Logs index template reference
    • Security
      • Elastic Security
      • Get started
        • Elastic Security requirements
        • Create a Security project
        • Elastic Security UI
        • Ingest data to Elastic Security
          • Enable threat intelligence integrations
          • Automatic import
          • Agentless integrations
        • Spaces and Elastic Security
        • Data views and Elastic Security
        • Create runtime fields in Elastic Security
        • Configure advanced settings
      • AI for security
        • AI Assistant
          • AI Assistant Knowledge Base
        • Attack Discovery
        • Set up connectors for large language models (LLM)
          • Large language model performance matrix
          • Connect to Azure OpenAI
          • Connect to Amazon Bedrock
          • Connect to OpenAI
          • Connect to Google Vertex
          • Connect to your own local LLM
        • Use cases
          • Triage alerts
          • Identify, investigate, and document threats
          • Generate, customize, and learn about ES|QL queries
      • Detections and alerts
        • Detections requirements
        • Using logsdb index mode with Elastic Security
        • About detection rules
        • Create a detection rule
          • Cross-cluster search and detection rules
          • Launch Timeline from investigation guides
          • Exclude cold and frozen data from individual rules
        • Install and manage Elastic prebuilt rules
        • Manage detection rules
        • Monitor rule executions
        • Rule exceptions
          • Create and manage value lists
          • Add and manage exceptions
          • Create and manage shared exception lists
        • About building block rules
        • MITRE ATT&CK® coverage
        • Manage detection alerts
          • Visualize detection alerts
          • View detection alert details
          • Add detection alerts to cases
          • Suppress detection alerts
        • Reduce notifications and alerts
        • Query alert indices
        • Tune detection rules
      • Configure endpoint protection with Elastic Defend
        • Elastic Defend requirements
        • Install Elastic Defend
          • Enable access for macOS Monterey
          • Enable access for macOS Ventura and higher
          • Deploy on macOS with MDM
          • Prevent Elastic Agent uninstallation
        • Elastic Defend feature privileges
        • Configure an integration policy for Elastic Defend
          • Configure updates for protection artifacts
          • Turn off diagnostic data for Elastic Defend
          • Configure self-healing rollback for Windows endpoints
          • Configure Linux file system monitoring
          • Configure data volume for Elastic Endpoint
          • Create an Elastic Defend policy using API
        • Configure offline endpoints and air-gapped environments
        • Uninstall Elastic Agent
      • Manage Elastic Defend
        • Endpoints
        • Policies
        • Trusted applications
        • Event filters
        • Host isolation exceptions
        • Blocklist
        • Optimize Elastic Defend
        • Event capture and Elastic Defend
        • Endpoint protection rules
        • Identify antivirus software on your hosts
        • Allowlist Elastic Endpoint in third-party antivirus apps
        • Elastic Endpoint self-protection features
      • Endpoint response actions
        • Automated response actions
        • Isolate a host
        • Response actions history
        • Third-party response actions
        • Configure third-party response actions
      • Cloud Security
        • Security posture management overview
        • Enable cloud security features
        • Cloud security posture management
          • Get started with CSPM for AWS
          • Get started with CSPM for GCP
          • Get started with CSPM for Azure
          • CSPM privilege requirements
          • Findings page
          • Benchmarks
          • Cloud Security Posture dashboard
          • Frequently asked questions (FAQ)
        • Kubernetes security posture management
          • Get started with KSPM
          • Findings page
          • Benchmarks
          • Cloud Security Posture dashboard
          • Frequently asked questions (FAQ)
        • Cloud native vulnerability management
          • Get started with CNVM
          • Findings page
          • Cloud Native Vulnerability Management Dashboard
          • Frequently asked questions (FAQ)
        • Cloud workload protection for Kubernetes
          • Get started with CWP for Kubernetes
          • Container workload protection policies
          • Kubernetes dashboard
        • Cloud workload protection for VMs
          • Capture environment variables
        • Ingest third-party cloud security data
          • Ingest CNCF Falco data
          • Ingest AWS Security Hub data
          • Ingest Wiz data
      • Investigation tools
        • Timeline
          • Timeline templates
        • Visual event analyzer
        • Session view
        • Osquery
          • Manage the integration
          • Osquery FAQ
          • Add Osquery Response Actions
          • Run Osquery from investigation guides
          • Run Osquery from alerts
          • Examine Osquery results
          • Use placeholder fields in Osquery queries
        • Notes
        • Indicators of compromise
        • Cases
          • Cases requirements
          • Open and manage cases
          • Configure case settings
      • Dashboards
        • Overview dashboard
        • Detection & Response dashboard
        • Kubernetes dashboard
        • Cloud Security Posture dashboard
        • Entity Analytics dashboard
        • Data Quality dashboard
        • Cloud Native Vulnerability Management Dashboard
        • Detection rule monitoring dashboard
      • Explore
        • Hosts page
        • Network page
          • Configure network map data
        • Users page
      • Advanced Entity Analytics
        • Entity risk scoring
          • Entity risk scoring requirements
          • Turn on the risk scoring engine
          • Asset criticality
          • Entity store
          • View and analyze risk score data
        • Advanced behavioral detections
          • Machine learning job and rule requirements
          • Anomaly detection
          • Optimizing anomaly results
          • Behavioral detection use cases
      • Asset management
      • APIs and tools
    • Search
      • Get started
      • Search approaches
        • Long-running searches
        • Near real-time search
      • Query languages for search
      • Inference API
        • Elastic Inference Service (EIS)
        • AlibabaCloud AI Search inference integration
        • Amazon Bedrock inference integration
        • Anthropic inference integration
        • Azure AI studio inference integration
        • Azure OpenAI inference integration
        • Chat completion inference API
        • Cohere inference integration
        • Elasticsearch inference integration
        • ELSER inference integration
        • Google AI Studio inference integration
        • Google Vertex AI inference integration
        • HuggingFace inference integration
        • JinaAI inference integration
        • Mistral inference integration
        • OpenAI inference integration
        • Watsonx inference integration
      • Building search in your app or site
      • Search templates
      • Ingest for search
      • Full-text search
        • Search with synonyms
        • Text analysis during search
      • Vector search
        • Dense vector
          • KNN
        • Semantic search with ELSER
      • Hybrid search with semantic_text
      • Semantic search
        • Semantic search with semantic_text
        • Hybrid search with semantic_text
        • Semantic search with the {{infer}} API
        • Semantic search with ELSER
        • Using Cohere with {{es}}
        • Semantic search with deployed model
        • Bring your own dense vectors
      • Ranking and reranking
        • Semantic reranking
        • Learning To Rank (LTR)
          • Deploy and manage LTR models
          • Search using LTR
      • RAG
        • Playground
          • Optimize model context
          • View and modify queries
          • Troubleshooting
      • Auto-complete
      • Spelling correction
      • Cross-cluster search
        • Advantages of using this endpoint before a {{ccs}}
      • Integrating search into your site or app
        • Clients
        • What is Search UI?
        • Behavioral analytics
          • Get started
          • Set up CORs
          • View events
          • Events reference
          • API overview
      • Search Applications
        • Search API and templates
        • Security
        • Search Application client guide
      • Examples
        • Mixing exact search with stemming
        • Getting consistent scoring
        • Incorporating static relevance signals into the score
      • APIs and tools
    • Other use cases
  • Manage data
    • The Elasticsearch data store
      • Index basics
      • Index types
        • Data streams
          • Set up a data stream
          • Use a data stream
          • Modify a data stream
          • Time series data stream (TSDS)
            • Set up a TSDS
            • Downsampling a time series data stream
            • Run downsampling with ILM
            • Run downsampling manually
            • Run downsampling using data stream lifecycle
            • Reindex a TSDS
          • Logs data stream
        • logsdb
        • tsdb
        • vectordb
      • Mapping
        • Dynamic mapping
          • Dynamic field mapping
          • Dynamic templates
        • Explicit mapping
        • Runtime fields
          • Map a runtime field
          • Define runtime fields in a search request
          • Override field values at query time
          • Retrieve a runtime field
          • Index a runtime field
          • Explore your data with runtime fields
        • Removal of mapping types
      • Text analysis
        • Concepts
          • Anatomy of an analyzer
          • Index and search analysis
          • Stemming
          • Token graphs
        • Configure text analysis
          • Test an analyzer
          • Configuring built-in analyzers
          • Create a custom analyzer
          • Specify an analyzer
      • Templates
        • Simulate multi-component templates
        • Config ignore_missing_component_templates
        • Index management in the UI
      • Aliases
      • Manage data from the command line
    • Ingestion
      • Ingesting timeseries data
      • Ingesting data for Elastic solutions
      • Ingesting data from applications
        • Ingest data with Node.js on Elasticsearch Service
        • Ingest data with Python on Elasticsearch Service
        • Ingest data from Beats to Elasticsearch Service with Logstash as a proxy
        • Ingest data from a relational database into Elasticsearch Service
        • Ingest logs from a Python application using Filebeat
        • Ingest logs from a Node.js web application using Filebeat
      • Ingest reference architectures
        • Ingest architectures
        • Elastic Agent to Elasticsearch
          • Elastic Agent to Elasticsearch: Agent installed
          • Elastic Agent to Elasticsearch: APIs for collection
        • Elastic Agent to Logstash to Elasticsearch
          • Elastic Agent to Logstash (for enrichment) to Elasticsearch
          • Elastic Agent to Logstash to Elasticsearch: Logstash Persistent Queue (PQ) for buffering
          • Elastic Agent to Logstash to Elasticsearch: Logstash as a proxy
          • Elastic Agent to Logstash for routing to multiple Elasticsearch clusters and additional destinations
        • Elastic Agent to proxy to Elasticsearch
        • Elastic Agent to Elasticsearch with Kafka as middleware message queue
          • Elastic Agent to Logstash to Kafka to Logstash to Elasticsearch: Kafka as middleware message queue
          • Elastic Agent to Logstash to Kafka to Kafka ES Sink to Elasticsearch: Kafka as middleware message queue
        • Logstash to Elasticsearch
        • Elastic air-gapped architectures
          • Elastic Agent to Elasticsearch: Air-gapped environment
          • Elastic Agent to Logstash: Air-gapped environment
      • Sample data
      • Transform and enrich data
        • Ingest pipelines
          • Example
        • Logstash pipelines
        • Data enrichment
          • Set up an enrich processor
          • Example: Enrich your data based on geolocation
          • Example: Enrich your data based on exact values
          • Example: Enrich your data by matching a value to a range
        • Index mapping and text analysis
      • Ingest tools overview
        • Upload data files
    • Data lifecycle
      • Data tiers
      • Index lifecycle management
        • Tutorial
        • Tutorial
        • Index management in Kibana
        • Concepts
          • Index lifecycle
          • Rollover
          • Policy updates
        • Configure a lifecycle policy
        • Migrate index allocation filters to node roles
        • Start and stop index lifecycle management
        • Manage existing indices
        • Skip rollover
        • Restore a managed data stream or index
      • Data stream lifecycle
        • Tutorial: Create a data stream with a lifecycle
        • Tutorial: Update existing data stream
        • Tutorial: Data stream retention
        • Tutorial: Migrate ILM managed data stream to data stream lifecycle
      • Rollup
        • Getting started
        • Understanding groups
        • Rollup aggregation limitations
        • Rollup search limitations
        • Migrating to downsampling
      • Curator
    • Migrate data between Elasticsearch clusters
      • Migrate from a self-managed cluster with a self-signed certificate using remote reindex
      • Migrate internal indices
    • Use case: use Elasticsearch to manage time series data
  • Explore and analyze
    • Kibana quickstart
      • Accessibility
    • Querying and filtering
      • Query languages
        • QueryDSL
        • ES|QL
          • REST API
          • Using {{esql}} in {{kib}}
          • Using {{esql}} in {{elastic-sec}}
          • Using {{esql}} to query multiple indices
          • Using {{esql}} across clusters
          • Task management
        • SQL
          • Overview
          • Getting Started with SQL
          • Conventions and Terminology
            • Mapping concepts across SQL and Elasticsearch
          • Security
          • SQL REST API
            • Overview
            • Response Data Formats
            • Paginating through a large response
            • Filtering using Elasticsearch Query DSL
            • Columnar results
            • Passing parameters to a query
            • Use runtime fields
            • Run an async SQL search
          • SQL Translate API
          • SQL CLI
          • SQL JDBC
            • API usage
          • SQL ODBC
            • Driver installation
            • Configuration
          • SQL Client Applications
            • DBeaver
            • DbVisualizer
            • Microsoft Excel
            • Microsoft Power BI Desktop
            • Microsoft PowerShell
            • MicroStrategy Desktop
            • Qlik Sense Desktop
            • SQuirreL SQL
            • SQL Workbench/J
            • Tableau Desktop
            • Tableau Server
          • SQL Language
            • Lexical Structure
            • SQL Commands
            • DESCRIBE TABLE
            • SELECT
            • SHOW CATALOGS
            • SHOW COLUMNS
            • SHOW FUNCTIONS
            • SHOW TABLES
            • Data Types
            • Index patterns
            • Frozen Indices
          • Functions and Operators
            • Comparison Operators
            • Logical Operators
            • Math Operators
            • Cast Operators
            • LIKE and RLIKE Operators
            • Aggregate Functions
            • Grouping Functions
            • Date/Time and Interval Functions and Operators
            • Full-Text Search Functions
            • Mathematical Functions
            • String Functions
            • Type Conversion Functions
            • Geo Functions
            • Conditional Functions And Expressions
            • System Functions
          • Reserved keywords
          • SQL Limitations
        • EQL
          • Example: Detect threats with EQL
        • KQL
        • Lucene query syntax
      • Query tools
        • Saved queries
        • Console
        • Search profiler
        • Grok debugger
        • Playground
      • Filtering in Kibana
    • Scripting
      • Painless scripting language
      • How to write scripts
        • Scripts, caching, and search speed
        • Dissecting data
        • Grokking grok
      • Access fields in a document
      • Common scripting use cases
        • Field extraction
      • Accessing document fields and special variables
      • Scripting and security
      • Lucene expressions language
      • Advanced scripts using script engines
      • Painless lab
    • Aggregations
      • Basics
    • Geospatial analysis
    • Transforms
      • Overview
      • Setup
      • When to use transforms
      • Generating alerts for transforms
      • {{transforms-cap}} at scale
      • How checkpoints work
      • API quick reference
      • Tutorial: Transforming the eCommerce sample data
      • Examples
      • Painless examples
      • Limitations
    • Machine learning
      • Setup and security
      • Machine learning in Kibana
        • Anomaly detection
        • Data frame analytics
        • AIOps Labs
      • Anomaly detection
        • Finding anomalies
          • Plan your analysis
          • Run a job
          • View the results
          • Forecast future behavior
        • Tutorial
        • Advanced concepts
          • Anomaly detection algorithms
          • Anomaly score explanation
          • Job types
          • Working with anomaly detection at scale
          • Handling delayed data
        • API quick reference
        • How-tos
          • Generating alerts for anomaly detection jobs
          • Aggregating data for faster performance
          • Altering data in your datafeed with runtime fields
          • Customizing detectors with custom rules
          • Detecting anomalous categories of data
          • Reverting to a model snapshot
          • Detecting anomalous locations in geographic data
          • Mapping anomalies by location
          • Adding custom URLs to machine learning results
          • {{anomaly-jobs-cap}} from visualizations
          • Exporting and importing {{ml}} jobs
        • Resources
          • Limitations
          • Function reference
          • Supplied configurations
          • Troubleshooting and FAQ
      • Data frame analytics
        • Overview
        • Finding outliers
        • Predicting numerical values with regression
        • Predicting classes with classification
        • Advanced concepts
          • How {{dfanalytics-jobs}} work
          • Working with data frame analytics at scale
          • Adding custom URLs to data frame analytics jobs
          • Feature encoding
          • Feature processors
          • Feature importance
          • Loss functions for regression analyses
          • Hyperparameter optimization
          • Trained models
        • API quick reference
        • Resources
          • Limitations
      • NLP
        • Overview
          • Extract information
          • Classify text
          • Search and compare text
        • Deploy trained models
          • Select a trained model
          • Import the trained model and vocabulary
          • Deploy the model in your cluster
          • Try it out
        • Trained model autoscaling
        • Add NLP inference to ingest pipelines
        • API quick reference
        • Built-in NLP models
          • ELSER
          • Elastic Rerank
          • E5
          • Language identification
        • Compatible third party models
        • Examples
          • Named entity recognition
          • Text embedding and semantic search
        • Limitations
        • Inference processing
          • NLP tutorial
      • AIOps Labs
        • Detect anomalies
          • Tune your anomaly detection job
          • Forecast future behavior
        • Analyze log spikes and drops
        • Detect change points
    • AI assistant
    • Discover
      • Explore fields and data with Discover
      • Customize the Discover view
      • Search for relevance
      • Save a search for reuse
      • View field statistics
      • Run a pattern analysis on your log data
      • Run a search session in the background
      • Using ES|QL
    • Dashboards
      • Using
      • Building
        • Create a dashboard
        • Edit a dashboard
        • Add filter controls
        • Add drilldowns
        • Organize dashboard panels
        • Duplicate dashboards
        • Import dashboards
      • Managing
      • Sharing
      • Tutorials
        • Create a simple dashboard to monitor website logs
        • Create a dashboard with time series charts
    • Panels and visualizations
      • Supported chart types
      • Manage panels
      • Visualize Library
      • Lens
      • ES|QL
      • Field statistics
      • Custom visualizations with Vega
      • Text panels
      • Image panels
      • Link panels
      • Canvas
        • Edit workpads
        • Present your workpad
        • Tutorial: Create a workpad for monitoring sales
        • Canvas function reference
          • TinyMath functions
      • Maps
        • Build a map to compare metrics by country or region
        • Track, visualize, and alert on assets in real time
        • Map custom regions with reverse geocoding
        • Heat map layer
        • Tile layer
        • Vector layer
          • Vector styling
          • Vector style properties
          • Vector tooltips
        • Plot big data
          • Clusters
          • Display the most relevant documents per entity
          • Point to point
          • Term join
        • Search geographic data
          • Create filters from a map
          • Filter a single layer
          • Search across multiple indices
        • Configure map settings
        • Connect to Elastic Maps Service
        • Import geospatial data
          • Clean your data
          • Tutorial: Index GeoJSON data
        • Troubleshoot
      • Graph
        • Configure Graph
        • Troubleshooting and limitations
      • Legacy editors
    • Find and organize content
      • Data views
      • Saved objects
      • Files
      • Reports
      • Tags
      • What is Kibana?
    • Reporting and sharing
      • Automatically generate reports
      • Troubleshooting
        • CSV
        • PDF/PNG
    • Alerts and cases
      • Kibana alerts
        • Set up
        • Create and manage rules
        • View alerts
        • Rule types
          • Index threshold
          • {{es}} query
          • Tracking containment
        • Rule action variables
        • Troubleshooting and limitations
          • Common Issues
          • Event log index
          • Test connectors
        • Maintenance windows
      • Watcher
        • Getting started with Watcher
        • How Watcher works
        • Encrypting sensitive data in Watcher
        • Inputs
          • Simple input
          • Search input
          • HTTP input
          • Chain input
        • Triggers
          • Schedule trigger
        • Conditions
          • Always condition
          • Never condition
          • Compare condition
          • Array compare condition
          • Script condition
        • Actions
          • Running an action for each element in an array
          • Adding conditions to actions
          • Email action
          • Webhook action
          • Index action
          • Logging action
          • Slack action
          • PagerDuty action
          • Jira action
        • Transforms
          • Search {{watcher-transform}}
          • Script {{watcher-transform}}
          • Chain {{watcher-transform}}
        • Managing watches
        • Example watches
          • Watching the status of an Elasticsearch cluster
        • Limitations
      • Cases
        • Configure access to cases
        • Open and manage cases
        • Configure case settings
    • Numeral formatting
  • Deploy and manage
    • Distributed architecture
      • Clusters, nodes, and shards
        • Node roles
      • Reading and writing documents
      • Shard allocation, relocation, and recovery
        • Shard allocation awareness
        • Index-level shard allocation
          • Delaying allocation when a node leaves
      • Discovery and cluster formation
        • Discovery
        • Quorum-based decision making
        • Voting configurations
        • Bootstrapping a cluster
        • Cluster state
        • Cluster fault detection
      • Kibana tasks management
    • Deploy
      • Elastic Cloud
        • Create an organization
          • Subscribe from a marketplace
            • AWS Marketplace
              • Create a monthly pay-as-you-go subscription on AWS Marketplace
            • Azure Native ISV Service
              • Azure Marketplace pricing
            • Google Cloud Platform Marketplace
              • Create a monthly pay-as-you-go subscription on GCP Marketplace
            • Heroku
              • Introducing Elasticsearch Add-On for Heroku
                • Install the add-on
                  • Install a specific version and plugins
                  • Remove the add-on
                • Migrate between plans
                • Access the console
                  • Access Kibana
                • Manage data from the command line
                • Access the Elasticsearch API console
                • Next steps
                • Migrate your Elasticsearch data
                  • Migrate internal indices
              • About
                • Subscription levels
                • Version policy
                • Elasticsearch Add-On for Heroku hardware
                  • Elasticsearch Add-On for Heroku GCP instance configurations
                  • Elasticsearch Add-On for Heroku GCP default provider instance configurations
                  • Elasticsearch Add-On for Heroku AWS instance configurations
                  • Elasticsearch Add-On for Heroku AWS default provider instance configurations
                  • Elasticsearch Add-On for Heroku Azure instance configurations
                  • Elasticsearch Add-On for Heroku Azure default provider instance configurations
                • Elasticsearch Add-On for Heroku regions
                • Service status
                  • Subscribe to Individual Regions/Components
                  • Service Status API
                • Getting help
                • Restrictions and known problems
                • What���s new with the Elastic Stack
        • Serverless
          • Serverless differences
          • Create a serverless project
          • Regions
          • Project settings
        • Cloud Hosted
          • Create an Elastic Cloud Hosted deployment
            • Available stack versions
          • Access Kibana
          • Manage deployments
            • Configure
              • Change your configuration
                • What deployment settings are available?
                • Change hardware profiles
                • How can I customize the components of my deployment?
              • Configure your deployment
                • What deployment settings are available?
                • How can I customize the components of my deployment?
              • Edit stack settings
              • Add plugins and extensions
                • Add plugins provided with Elastic Cloud Hosted
                • Upload custom plugins and bundles
                • Manage plugins and extensions through the API
              • Custom endpoint aliases
            • Manage your Integrations server
              • Switch from APM to Integrations Server payload
            • Find your Cloud ID
          • Change hardware
          • Manage deployments using the Elastic Cloud API
          • Keep track of deployment activity
        • Tools and APIs
        • Restrictions and known problems
      • Elastic Cloud Enterprise
        • Service-oriented architecture
        • Services as Docker containers
        • Prepare your environment
          • Hardware prerequisites
          • Software prerequisites
          • System configuration
          • Networking prerequisites
          • High availability
          • Separation of roles
          • Load balancers
          • Users and permissions prerequisites
          • JVM heap size
          • Wildcard DNS record
          • Manage your installation capacity
        • Deploy an orchestrator
          • Install
            • Identify the deployment scenario
            • Install ECE on a Public Cloud
              • Configure your operating system cloud
                • Configure host Ubuntu cloud
                • Configure host RHEL cloud
                • Configure host SUSE cloud
              • Install ECE cloud
                • Deploy a small installation cloud
                • Deploy a medium installation cloud
                • Deploy a large installation cloud
                • Fresh installation of ECE using Podman hosts cloud
            • Install ECE on your own premises
              • Configure your operating system onprem
                • Configure host Ubuntu onprem
                • Configure host RHEL onprem
                • Configure host SUSE onprem
              • Install ECE onprem
                • Deploy a small installation onprem
                • Deploy a medium installation onprem
                • Deploy a large installation onprem
                • Fresh installation of ECE using Podman hosts onprem
            • Alternative: Install ECE with Ansible
            • Log into the Cloud UI
            • Install ECE on additional hosts
              • Generate roles tokens
            • Migrate ECE to Podman hosts
            • Post-installation steps
            • Statistics collected by Elastic Cloud Enterprise
          • Air gapped install
            • With your private Docker registry
            • Without a private Docker registry
            • Available Docker images
          • Configure
            • Assign roles to hosts
            • System deployments configuration
              • Default system deployment versions
            • Configure deployment templates
              • Tag your allocators
              • Edit instance configurations
              • Create instance configurations
              • Create deployment templates
              • Configure system deployment templates
              • Configure index management for templates
              • Updating custom templates to support node_roles and autoscaling
              • Updating custom templates to support Integrations Server
              • Default instance configurations
              • Include additional Kibana plugins
            • Change the ECE API URL
            • Change endpoint URLs
            • Enable custom endpoint aliases
              • Custom endpoint aliases
            • Configure allocator affinity
            • Change allocator disconnect timeout
            • Manage Elastic Stack versions
            • Migrate ECE on Podman hosts to SELinux enforce
        • Working with deployments
          • Deployment templates
          • Create a deployment
          • Edit stack settings
          • Customize your deployment
          • Resize deployment
            • Resource overrides
          • Manage your integrations server
            • Switch from APM to Integrations Server payload
          • Find your Cloud ID
          • Find your endpoint URL
          • Advanced cluster configuration
          • Search and filter deployments
          • Keep track of deployment activity
        • Tools and APIs
      • Elastic Cloud on Kubernetes
        • Deploy an orchestrator
          • Install
            • Install using YAML manifest (quickstart)
            • Install using a Helm chart
            • Deploy ECK on Openshift
              • Deploy the operator
              • Deploy an Elasticsearch instance with a route
              • Deploy a Kibana instance with a route
              • Deploy Docker images with anyuid SCC
              • Grant privileged permissions to Beats
              • Grant host access permission to Elastic Agent
            • Deploy ECK on GKE Autopilot
              • Ensuring virtual memory kernel settings
              • Installing the ECK Operator
              • Deploy an Elasticsearch instance
              • Deploy a standalone Elastic Agent and/or Beats
            • Deploy a FIPS compatible version of ECK
          • Air gapped install
          • Configure
            • Configure ECK
            • Required RBAC permissions
            • Configure the validating webhook
            • Restrict cross-namespace resource associations
            • Create custom images
            • Service meshes
              • Istio
              • Linkerd
            • Network policies
              • Prerequisites
            • Webhook namespace selectors
        • Manage deployments
          • Elasticsearch deployment quickstart
          • Kibana instance quickstart
          • Managing deployments using a Helm chart
          • Update your deployments
          • Accessing services
          • Configure deployments
            • Elasticsearch configuration
              • Node configuration
              • Volume claim templates
              • Storage recommendations
              • Transport settings
              • Virtual memory
              • Settings managed by ECK
              • Custom configuration files and plugins
              • Init containers for plugin downloads
              • Update strategy
              • Pod disruption budget
              • Nodes orchestration
              • Advanced Elasticsearch node scheduling
              • Readiness probe
              • Pod PreStop hook
              • Security context
            • Kibana configuration
              • Connect to an Elasticsearch cluster
              • Advanced configuration
              • Secure settings
              • HTTP configuration
              • Install Kibana plugins
            • TLS Certificates
            • Recipes
            • Requests routing to Elasticsearch nodes
            • Customize pods
            • Manage compute resources
            • Elastic Stack configuration policies
            • Connect to external Elastic resources
        • Orchestrate other Elastic applications
          • APM server
            • Use an Elasticsearch cluster managed by ECK
            • Advanced configuration
            • Connect to the APM Server
          • Standalone Elastic Agent
            • Quickstart
            • Configuration
            • Configuration examples
          • Fleet-managed Elastic Agent
            • Quickstart
            • Configuration
            • Configuration Examples
            • Known limitations
          • Elastic Maps Server
            • Deploy Elastic Maps Server
            • Map data
            • Advanced configuration
            • HTTP configuration
          • Enterprise Search
            • Quickstart
            • Configuration
            • Troubleshooting
          • Beats
            • Quickstart
            • Configuration
            • Configuration Examples
            • Troubleshooting
          • Logstash
            • Quickstart
            • Configuration
            • Securing Logstash API
            • Logstash plugins
            • Configuration examples
            • Update Strategy
            • Advanced configuration
        • Tools and APIs
      • Self-managed cluster
        • Deploy the cluster
          • Important System configuration
            • Configuring system settings
            • Disable swapping
            • File Descriptors
            • Virtual memory
            • Number of threads
            • DNS cache settings
            • Ensure JNA temporary directory permits executables
            • TCP retransmission timeout
          • Installing Elasticsearch
            • Install Elasticsearch from archive on Linux or MacOS
            • Install Elasticsearch with .zip on Windows
            • Install Elasticsearch with Debian Package
            • Install Elasticsearch with RPM
            • Install Elasticsearch with Docker
          • Run {{es}} locally
          • Bootstrap Checks
            • Heap size check
            • File descriptor check
            • Memory lock check
            • Maximum number of threads check
            • Max file size check
            • Maximum size virtual memory check
            • Maximum map count check
            • Client JVM check
            • Use serial collector check
            • System call filter check
            • OnError and OnOutOfMemoryError checks
            • Early-access check
            • All permission check
            • Discovery configuration check
        • Configure Elasticsearch
          • Important settings configuration
          • Other configuration settings
          • Plugins
        • Install Kibana
          • Install from archive on Linux or macOS
          • Install on Windows
          • Install with Debian package
          • Install with RPM
          • Install with Docker
          • Configure
          • Access
        • Air gapped install
        • Tools and APIs
      • Kibana reporting configuration
    • Production guidance
      • Getting ready for production (Elasticsearch)
      • Production considerations
      • Plan for production (Elastic Cloud)
      • Availability and resilience
        • Resilience in small clusters
        • Resilience in larger clusters
      • Elasticsearch performance optimizations
        • Indexing speed
        • Search speed
        • Approximate kNN search
        • Disk usage
        • Size your shards
      • Kibana task manager scaling considerations
      • Alerting
      • General recommendations
    • Reference architectures
      • Hot/Frozen - High Availability
    • Backup, high availability, and resilience tools
      • Snapshot and restore
        • Manage snapshot repositories
          • Register a repository
            • Azure repository
            • Google Cloud Storage repository
            • S3 repository
            • Shared file system repository
            • Read-only URL repository
            • Source-only repository
          • Elastic Cloud Hosted
            • Snapshot and restore with custom repositories
              • Configure a snapshot repository using AWS S3
              • Configure a snapshot repository using GCS
              • Configure a snapshot repository using Azure Blob storage
            • Snapshot and restore with custom repositories
              • Configure a snapshot repository using AWS S3
              • Configure a snapshot repository using GCS
              • Configure a snapshot repository using Azure Blob storage
            • Access isolation for the found-snapshots repository
              • Repository isolation on Azure
              • Repository isolation on AWS and GCP
          • Elastic Cloud Enterprise
            • Google Cloud Storage (GCS) repository
            • Azure Storage repository
            • Minio on-premise repository
          • Elastic Cloud on Kubernetes
        • Create snapshots
        • Restore a snapshot
          • Restore a snapshot across clusters
            • Restore snapshot into a new deployment
            • Restore snapshot into an existing deployment
            • Restore snapshots containing searchable snapshots indices across clusters
        • Searchable snapshots
      • Cross-cluster replication
        • Set up {{ccr}}
          • Prerequisites
          • Connect to a remote cluster
          • Configure privileges for cross-cluster replication
          • Create a follower index to replicate a specific index
          • Create an auto-follow pattern to replicate time series indices
        • Manage cross-cluster replication
          • Inspect replication statistics
          • Pause and resume replication
          • Recreate a follower index
          • Terminate replication
        • Manage auto-follow patterns
          • Create auto-follow patterns
          • Retrieve auto-follow patterns
          • Pause and resume auto-follow patterns
          • Delete auto-follow patterns
        • Upgrading clusters
          • Uni-directional index following
          • Bi-directional index following
        • Uni-directional disaster recovery
          • Prerequisites
          • Failover when clusterA is down
          • Failback when clusterA comes back
        • Bi-directional disaster recovery
          • Initial setup
          • Failover when clusterA is down
          • Failback when clusterA comes back
          • Perform update or delete by query
    • Autoscaling
      • Deployment autoscaling
        • Autoscaling example
      • Deployment autoscaling
        • Autoscaling example
        • Autoscaling through the API
      • Deployment autoscaling
        • Autoscaling example
        • Autoscaling through the API
      • Autoscaling stateless applications on ECK
      • Deployments autoscaling on ECK
      • Autoscaling deciders
      • Trained model autoscaling
    • Remote clusters
      • Enable cross-cluster search and cross-cluster replication
        • Access other deployments of the same Elasticsearch Service organization
        • Access deployments of another Elasticsearch Service organization
        • Access deployments of an Elastic Cloud Enterprise environment
        • Access clusters of a self-managed environment
        • Enabling CCS/R between Elasticsearch Service and ECK
        • Edit or remove a trusted environment
        • Migrate the cross-cluster search deployment template
      • Enable cross-cluster search and cross-cluster replication
        • Access other deployments of the same Elastic Cloud Enterprise environment
        • Access deployments of another Elastic Cloud Enterprise environment
        • Access deployments of an Elasticsearch Service organization
        • Access clusters of a self-managed environment
        • Enabling CCS/R between Elastic Cloud Enterprise and ECK
        • Edit or remove a trusted environment
        • Migrate the cross-cluster search deployment template
      • Remote clusters (self-managed)
        • Add remote clusters using API key authentication
        • Add remote clusters using TLS certificate authentication
        • Migrate from certificate to API key authentication
        • Remote cluster settings
        • Troubleshooting
      • ECK remote clusters
    • Security
      • Secure your Elastic Cloud Enterprise installation
        • Manage security certificates
        • Allow x509 Certificates Signed with SHA-1
        • Configure the TLS version
      • Secure your cluster or deployment
        • Secure endpoints
          • Secure HTTP communications
          • Traffic filtering
            • IP traffic filtering
            • Private link traffic filters
              • AWS PrivateLink traffic filters
              • Azure Private Link traffic filters
              • GCP Private Service Connect traffic filters
              • Claim traffic filter link ID ownership through the API
            • Manage traffic filtering through the API
          • Elastic Cloud Static IPs
        • Kibana session management
        • Secure cluster communications
          • Security certificates and keys
            • Updating certificates
              • With the same CA
              • With a different CA
        • Secure clients and integrations
          • HTTP/REST clients and security
        • Encrypt your deployment
          • Encrypt your deployment with a customer-managed encryption key
        • Secure your settings
        • Secure saved objects
        • Manually configure security in a self-managed cluster
          • Set up minimal security
          • Set up basic security
          • Set up basic security plus HTTPS
        • Enabling cipher suites for stronger encryption
        • Supported SSL/TLS versions by JDK version
        • FIPS 140-2
    • Access
      • Elastic Cloud Enterprise orchestrator users
        • Manage system passwords
        • Manage users and roles
          • Native user authentication
          • Active Directory
          • LDAP
          • SAML
        • Configure SSO for deployments
      • Cloud organization users
        • Manage users
        • User roles
        • Configure {{ecloud}} SAML SSO
          • Register Elastic Cloud SAML in Okta
          • Register Elastic Cloud SAML in Microsoft Entra ID
      • Cluster or deployment auth
        • Quickstart
        • User authentication
          • Authentication realms
            • Realm chains
            • Security domains
          • Internal authentication
            • Native
            • File-based
          • External authentication
            • Active directory
            • JWT
            • Kerberos
            • LDAP
            • OpenID Connect
            • SAML
            • PKI
            • Custom
          • Built-in users
          • User profiles
          • Access agreement
          • Anonymous access
          • Manage authentication for multiple clusters
          • Token-based authentication services
          • Service accounts
          • Internal users
          • Operator privileges
            • Configure operator privileges
            • Operator-only functionality
            • Operator privileges for snapshot and restore
          • Looking up users without authentication
          • Controlling the user cache
        • User roles
          • Defining roles
            • Granting privileges for data streams and aliases
            • Role restriction
          • Built-in roles
          • Elasticsearch privileges
          • Kibana privileges
          • Mapping users and groups to roles
          • Authorization delegation
          • Authorization plugins
          • Controlling access at the document and field level
          • Submitting requests on behalf of other users
    • Manage spaces
    • Manage API keys
      • Elasticsearch API keys
      • Serverless project API keys
      • Elastic Cloud API keys
      • Elastic Cloud Enterprise API keys
    • Manage connectors
    • Monitoring
      • Monitoring overview
      • AutoOps
        • How to access AutoOps
        • AutoOps events
        • Overview
        • Deployment
        • Nodes
        • Indices
        • Shards
        • Template Optimizer
        • Notifications settings
        • Events Settings
        • Dismiss Events
        • AutoOps regions
        • AutoOps FAQ
      • Stack Monitoring
        • Stack Monitoring on Elastic Cloud deployments
        • Enable stack monitoring on ECK deployments
          • Connect to an external monitoring Elasticsearch cluster
          • When to use it
          • How it works
          • Audit logging
          • Override the Beats Pod Template
        • Enable stack monitoring on ECE deployments
          • Restrictions and limitations
        • Elasticsearch monitoring self-managed
          • Collecting monitoring data with {{agent}}
          • Collecting monitoring data with {{metricbeat}}
          • Collecting log data with {{filebeat}}
          • Legacy collection methods
            • Collectors
            • Exporters
            • Local exporters
            • HTTP exporters
            • Pausing data collection
        • Configure monitoring
          • Collect monitoring data with {{agent}}
          • Collect monitoring data with {{metricbeat}}
          • View monitoring data
          • Legacy collection methods
      • Monitoring Orchestrators
        • ECK metrics configuration
          • Enabling the metrics endpoint
          • Securing the metrics endpoint
          • Prometheus requirements
        • ECE platform monitoring
          • Access logs and metrics
          • Proxy Log Fields
          • Set the retention period for logging and metrics indices
      • Managing monitoring data
        • Visualizing monitoring data
          • Beats Metrics
          • {{es}} Metrics
          • Kibana alerts
          • {{kib}} Metrics
          • Logstash Metrics
          • Troubleshooting
        • Access performance metrics on Elastic Cloud
          • Access performance metrics
            • JVM memory pressure indicator
            • vCPU boosting and credits
          • Access performance metrics
            • JVM memory pressure indicator
            • vCPU boosting and credits
        • Configure Stack monitoring alerts
        • Configuring data streams/indices for monitoring
          • Configuring data streams created by Elastic Agent
          • Configuring data streams created by Metricbeat 8
          • Configuring indices created by Metricbeat 7 or internal collection
      • Health monitoring
      • Logging configuration
        • Elasticsearch log4j configuration (self-managed)
        • Update Elasticsearch logging levels
        • Elasticsearch deprecation logs
        • Kibana logging
          • Examples
          • Cli configuration
        • Security event audit logging
          • Enabling elasticsearch audit logs
            • Elasticsearch audit events
            • Logfile audit output
            • Logfile audit events ignore policies
            • Auditing search queries
          • Enabling Kibana audit logs
          • Enabling audit logs in orchestrated deployments
          • Correlating Kibana and Elasticsearch audit logs
    • Manage your Cloud organization
      • Billing
        • Cloud hosted deployment billing dimensions
        • Serverless project billing dimensions
          • Elastic Observability billing dimensions
          • Elasticsearch billing dimensions
          • Security billing dimensions
        • Billing models
        • Monitor and analyze usage
        • View billing history
        • Add your billing details
        • Update billing and operational contacts
        • Billing FAQ
        • Stop charges for a project or deployment
        • Manage your subscription
      • Operational emails
      • Service status
      • Tools and APIs
    • Manage your license
      • Manage your license in ECK
      • Manage your license in ECE
      • Manage your license in self-managed cluster
    • Maintenance
      • ECE maintenance
        • Deployments maintenance
          • Start and stop routing requests
          • Pause instance
        • Maintenance activities
          • Enable maintenance mode
          • Scale out your installation
          • Move nodes or instances from allocators
          • Perform ECE hosts maintenance
          • Delete ECE hosts
      • Start and stop services
        • Start and stop Elasticsearch
        • Start and stop Kibana
        • Restart a Cloud Hosted deployment
        • Restart an ECE deployment
        • Full Cluster restart and rolling restart procedures
      • Add and Remove Elasticsearch nodes
    • Upgrade
      • Prepare to upgrade
        • Upgrade Assistant
        • Index compatibility
      • Upgrade your orchestrator
        • Upgrade Elastic Cloud Enterprise
        • Upgrade Elastic Cloud on Kubernetes
      • Upgrade your deployment or cluster
        • Archived settings
          • Reading indices from older Elasticsearch versions
      • Internal upgrade processes
        • Saved object migrations
    • Uninstall
      • Uninstall Elastic Cloud Enterprise
      • Uninstall Elastic Cloud on Kubernetes
      • Uninstall a self-managed cluster
      • Delete a cloud deployment
  • Cloud account
    • Join or leave an organization
    • Update your email address
    • Change your password
    • Add a login method
    • Multifactor authentication
  • Troubleshoot
    • Troubleshoot
    • Elasticsearch
      • Fix common cluster issues
        • Watermark errors
        • Circuit breaker errors
        • High CPU usage
        • High JVM memory pressure
        • Red or yellow cluster health status
        • Rejected requests
        • Task queue backlog
        • Mapping explosion
        • Hot spotting
      • Diagnose unassigned shards
      • Add a missing tier to the system
      • Allow Elasticsearch to allocate the data in the system
      • Allow Elasticsearch to allocate the index
      • Indices mix index allocation filters with data tiers node roles to move through data tiers
      • Not enough nodes to allocate all shard replicas
      • Total number of shards for an index on a single node exceeded
      • Total number of shards per node has been reached
      • Troubleshooting corruption
      • Fix data nodes out of disk
        • Increase the disk capacity of data nodes
        • Decrease the disk usage of data nodes
      • Fix master nodes out of disk
      • Fix other role nodes out of disk
      • Start index lifecycle management
      • Start Snapshot Lifecycle Management
      • Restore from snapshot
      • Troubleshooting broken repositories
        • Diagnosing corrupted repositories
        • Diagnosing unknown repositories
        • Diagnosing invalid repositories
      • Addressing repeated snapshot policy failures
      • Troubleshooting an unstable cluster
      • Troubleshooting discovery
      • Troubleshooting monitoring
      • Troubleshooting transforms
      • Troubleshooting Watcher
      • Troubleshooting searches
      • Troubleshooting shards capacity health issues
      • Troubleshooting an unbalanced cluster
      • Capture diagnostics
      • Troubleshooting
        • Some settings are not returned via the nodes settings API
        • Authorization exceptions
        • Users command fails due to extra arguments
        • Users are frequently locked out of Active Directory
        • Certificate verification fails for curl on Mac
        • SSLHandshakeException causes connections to fail
        • Common SSL/TLS exceptions
        • Common Kerberos exceptions
        • Common SAML issues
        • Internal Server Error in Kibana
        • Setup-passwords command fails due to connection failure
        • Failures due to relocation of the configuration files
      • Troubleshooting
      • Index lifecycle management errors
      • Clients
        • Java
          • Missing required property
          • Error: No such method
          • Apache errors
          • Typed keys serialization
        • .NET
          • Logging
          • Logging with OnRequestCompleted
          • Logging with Fiddler
          • Debugging
            • Audit trail
            • Debug information
            • Debug mode
        • Node.js
        • Ruby
      • Elasticsearch for Apache Hadoop
    • Kibana
      • Using Kibana server logs
      • Trace Elasticsearch query to the origin in Kibana
      • Capture diagnostics
      • Access
      • Error: Server not ready
      • Migration failures
      • Troubleshooting
      • Troubleshoot
      • Troubleshooting
      • Troubleshooting and limitations
      • Alerts
      • Troubleshooting
    • Deployments
      • Serverless
      • Elastic Cloud
        • Monitoring
      • Elastic Cloud Enterprise
        • Common issues
        • Use the emergency roles token
        • Remove Elastic Cloud Enterprise
        • Verify ZooKeeper Sync Status
        • Rebuilding a broken Zookeeper quorum
        • Troubleshooting container engines
        • Run ECE diagnostics tool
        • Ask for help
        • Finding deployments, finding problems
        • Heap dumps
        • Thread dumps
      • Kubernetes
        • Common problems
        • Troubleshooting methods
        • Run eck-diagnostics
        • JVM heap dumps
      • Troubleshooting
    • Monitoring
      • AutoOps
      • Unavailable nodes
      • Unavailable shards
      • Performance
      • High memory pressure
      • High availability
      • Cluster response time
      • Node moves and outages
      • Deployment health warnings
      • Node bootlooping
    • Ingest tools
      • Logstash
        • Plugins
          • Kafka
          • Azure Event Hub
        • Health report pipelines
      • Fleet and Elastic Agent
        • Common problems
        • Frequently asked questions
      • Elastic Logging Plugin for Docker
    • Security
      • Detection rules
      • {{elastic-defend}}
      • Indicators of compromise
      • Agentless integrations
    • Observability
      • Explore data
      • Inspect
      • Synthetics
      • Troubleshoot mapping issues
      • Logs
      • APM
        • Common problems
        • What happens when APM Server or Elasticsearch is down?
        • APM Server response codes
        • Processing and performance
        • APM Server binary debugging
        • APM Server performance diagnostic
        • APM Go Agent
        • APM iOS Agent
        • APM Java Agent
        • APM .NET agent
        • APM Node.js Agent
        • APM PHP Agent
          • Agent is not instrumenting code
          • Collection of diagnostic information
        • APM Python Agent
        • APM Ruby Agent
        • APM Real User Monitoring JavaScript Agent
        • Known issues
      • Amazon Data Firehose
      • Universal Profiling
        • Troubleshoot the backend
      • Infrastructure monitoring
        • Understanding "no results found" message
      • SLOs
  • Content to pull from
    • APM Android agent
      • Release notes
    • APM iOS agent
      • v1.0.0
      • v1.0.1
    • APM Ruby agent
      • Ruby Agent version 4.x
    • Elastic Cloud on k8s
      • Audit logging
      • Installation
      • Learn more about ECK
      • Access Elastic Stack services
      • Advanced topics
      • Running in air-gapped environments
      • Custom HTTP certificate
      • Deploy ECK in your Kubernetes cluster
      • Secure settings
      • Deploy a FIPS compatible version of ECK
      • Install ECK using the YAML manifests
      • Install ECK
      • Nodes orchestration
      • Overview
      • Access the Elasticsearch endpoint
      • Rotate auto-generated credentials
      • SAML Authentication
      • Secure the Elastic Stack
      • Security
      • Services
      • Supported versions
      • TLS certificates
      • Upgrade the Elastic Stack version
      • Users and roles
    • Elastic Cloud Enterprise
      • Optional settings
      • Re-running the ECE upgrade
      • Sign outgoing SAML messages
      • Access Kibana
      • Add custom bundles and plugins to your deployment
      • Add Elasticsearch user settings
      • Administering deployments
      • Administering your installation
      • Access the Elasticsearch API console
      • Deployment autoscaling
      • Change your deployment configuration
      • How do I resolve node bootlooping?
      • Secure your settings
      • Create a hosted deployment
      • Delete a deployment
      • How do I resolve deployment health warnings?
      • Disable an Elasticsearch data tier
      • Enable auditing
      • Finding deployments, finding problems
      • Generate roles tokens
      • Ingest data with Node.js on Elastic Cloud Enterprise
      • Ingest data with Python on Elastic Cloud Enterprise
      • Ingest data from Beats to Elastic Cloud Enterprise with {{ls}} as a proxy
      • Ingest data from a relational database into Elastic Cloud Enterprise
      • Ingest logs from a Node.js web application using Filebeat
      • Ingest logs from a Python application using Filebeat
      • Ingesting data from your application
      • Install ECE offline
      • Enable Integrations Server through the API
      • Request routing
      • Add APM user settings
      • Add Enterprise Search user settings
      • Manage your Integrations Server
      • Add Kibana user settings
      • Manage your Kibana instance
      • Migrate to index lifecycle management
      • Migrating data
      • Keep your clusters healthy
      • Reset the password for the elastic user
      • Secure your settings
      • Restore a snapshot across clusters
      • Restore a deployment
      • Revoke roles tokens
      • Secure your clusters with Kerberos
      • Secure your clusters with OpenID Connect
      • Secure your clusters with Active Directory
      • Secure your clusters with JWT
      • Secure your clusters with LDAP
      • Secure your clusters with SAML
      • Secure your clusters
      • Securing your installation
      • Work with snapshots
      • Working with deployments
      • Terminate a deployment
      • Traffic Filtering
      • IP traffic filters
      • Manage traffic filtering through the API
      • Troubleshooting
      • Upgrade versions
      • Upgrade your installation
      • Manage data from the command line
      • Editing your user settings
      • Introducing Elastic Cloud Enterprise
    • Elastic Cloud Heroku
      • About
      • Access Kibana
      • Keep track of deployment activity
      • Edit {{es}} user settings
      • Add plugins provided with Elasticsearch Add-On for Heroku
      • Add plugins and extensions
      • Analyze unassigned shards using the {{es}} API
      • Analyze unassigned shards using the Kibana UI
      • Deployment autoscaling
      • How do I resolve node bootlooping?
      • Configure your deployment
      • Configuring your deployment
      • Secure your settings
      • CPU usage exceeds the allowed threshold on master nodes
      • Upload custom plugins and bundles
      • Snapshot and restore with custom repositories
      • Delete your deployment
      • How do I resolve deployment health warnings?
      • Edit your user settings
      • Enable Kibana
      • Enable logging and monitoring
      • Introducing Elasticsearch Add-On for Heroku
      • JVM heap usage exceeds the allowed threshold on master nodes
      • Edit APM user settings
      • Edit Kibana user settings
      • How does high memory pressure affect performance?
      • Migrate internal indices
      • Migrate your Elasticsearch data
      • How to set up monitoring
      • Monitoring your deployment
      • Full disk on multiple-nodes deployment
      • Some nodes are unavailable and are displayed as missing
      • Reset the elastic user password
      • Plan for production
      • Custom endpoint aliases
      • Remediate common issues returned by the cluster allocation explain API
      • Work with snapshots
      • Restrictions and limitations
      • Access performance metrics
      • Secure your clusters with Kerberos
      • Secure your clusters with OpenID Connect
      • Secure your clusters with JWT
      • Secure your clusters with SAML
      • Securing your deployment
      • Full disk on single-node deployment
      • Snapshot and restore
      • Traffic Filtering
      • IP traffic filters
      • GCP Private Service Connect traffic filters
      • Azure Private Link traffic filters
      • AWS PrivateLink traffic filters
      • Upgrade versions
      • Is my cluster really highly available?
      • Why are my cluster response times suddenly so much worse?
      • Why are my shards unavailable?
      • Diagnose unavailable nodes
      • Why is performance degrading over time?
      • Sign outgoing SAML messages
    • Elastic Cloud
      • Service Status API
      • Subscribe to Individual Regions/Components
      • About Elasticsearch Service
      • Access Kibana
      • Monitor and analyze your account usage
      • Edit user account settings
      • Keep track of deployment activity
      • Edit {{es}} user settings
      • Other deployment operations
      • Organization operations
      • Deployment autoscaling
      • Using Elastic Consumption Units for billing
      • Check your billing history
      • Billing models
      • Stop charges for a deployment
      • Your account and billing
      • Adding data to Elasticsearch
      • How do I resolve node bootlooping?
      • Configure index management
      • Secure your settings
      • Upload custom plugins and bundles
      • Snapshot and restore with custom repositories
      • Change your configuration
      • Delete your deployment
      • How do I resolve deployment health warnings?
      • Disable an Elasticsearch data tier
      • Edit your user settings
      • Enable logging and monitoring
      • Elasticsearch Service FAQ
      • Technical FAQ
      • Getting help
      • Sign up using an existing email address
      • Ingest data with Node.js on Elasticsearch Service
      • Ingest data with Python on Elasticsearch Service
      • Ingest data from Beats to Elasticsearch Service with {{ls}} as a proxy
      • Ingest data from a relational database into Elasticsearch Service
      • Ingest logs from a Node.js web application using Filebeat
      • Ingest logs from a Python application using Filebeat
      • How do I sign up?
      • Introducing Elasticsearch Service
      • Ingesting data from your application
      • Invite members to your organization
      • Request routing
      • Edit APM user settings
      • Add App Search user settings
      • Add Enterprise Search user settings
      • Edit Kibana user settings
      • How does high memory pressure affect performance?
      • Migrate internal indices
      • Migrate to index lifecycle management
      • Migrating data
      • How to set up monitoring
      • Monitoring your deployment
      • Notifications domain allowlist
      • Reset the elastic user password
      • Plan for production
      • Preparing a deployment for production
      • Custom endpoint aliases
      • Restart your deployment
      • Restore a snapshot across clusters
      • Work with snapshots
      • Access performance metrics
      • Is my cluster really highly available?
      • Why are my cluster response times suddenly so much worse?
      • Why are my shards unavailable?
      • Diagnose unavailable nodes
      • Why is performance degrading over time?
      • Secure your clusters with Kerberos
      • Secure your clusters with OpenID Connect
      • Secure your clusters with JWT
      • Set up OpenID Connect with Azure, Google, or Okta
      • Set up SAML with Microsoft Entra ID
      • Secure your clusters with SAML
      • Securing your deployment
      • Choose a subscription level
      • Service status
      • Sign outgoing SAML messages
      • Snapshot and restore
      • Check your subscription overview
      • Traffic Filtering
      • IP traffic filters
      • GCP Private Service Connect traffic filters
      • Manage traffic filtering through the API
      • Azure Private Link traffic filters
      • AWS PrivateLink traffic filters
      • Upgrade versions
      • User roles and privileges
      • Enable Watcher
      • Manage data from the command line
    • Elasticsearch Curator
      • About
      • Curator and Index Lifecycle Management
    • Serverless
      • Cloud Native Vulnerability Management dashboard
      • {{connectors-app}}
      • Agentless integrations FAQ
      • AI Assistant Knowledge Base
      • Applications and services
      • Attack Discovery
      • Quickstart: Collect data with AWS Firehose
      • Connect to your own local LLM
      • CSPM privilege requirements
      • Custom roles
      • {{data-sources-cap}}
      • Using logsdb index mode with {{sec-serverless}}
      • Client libraries
      • Connect to your endpoint
      • Developer tools
      • Serverless differences
      • Explore your data
      • Get started
      • REST APIs
      • Upload a file
      • Ingest data through API
      • Ingest your data
      • k-nearest neighbor (kNN) search
      • Performance and general settings
      • Playground
      • Semantic search
      • The search API
      • Search your data
      • Endpoint protection rules
      • Check your billing history
      • Stop charges for a project
      • Check your subscription
      • Billing
      • Manage users and roles
      • Trained model autoscaling
      • Monitor your account usage
      • Monitor serverless status
      • Sign up for Elastic Cloud
      • Update your user profile
      • Incident management
      • Index management
      • Infrastructure and hosts
      • Ingest AWS Security Hub data
      • Ingest CNCF Falco data
      • {{ingest-pipelines-cap}}
      • Ingest third-party cloud security data
      • Ingest Wiz data
      • Elastic Cloud Serverless
      • {{ml-cap}}
      • {{maint-windows-cap}}
      • {{maps-app}}
      • Quickstart: Unified Kubernetes Observability with Elastic Distributions of OpenTelemetry (EDOT)
      • Add a service name to logs
      • Aggregation options
      • {{observability}} AI Assistant
      • Alerting
      • Analyze and compare hosts
      • Act on data
      • AWS Lambda functions
      • APM agents
      • Collect metrics
      • Limitations
      • Upstream OpenTelemetry Collectors and language SDKs
      • Resource attributes
      • OpenTelemetry
      • Create rules and alerts
      • Span compression
      • Create custom links
      • Learn about data types
      • Dependencies
      • Distributed tracing
      • Errors
      • Filter and search data
      • Filters
      • Find transaction latency and failure correlations
      • Get started with traces and APM
      • Infrastructure
      • Integrate with machine learning
      • Interpret data
      • Use APM securely
      • Settings
      • Logs
      • Metrics
      • Observe Lambda functions
      • Advanced queries
      • Reduce storage
      • Collect application data
      • Service map
      • Service Overview
      • Services
      • Trace sample timeline
      • Traces
      • Track deployments with annotations
      • Transaction sampling
      • Transactions
      • Troubleshooting
      • Drill down into data
      • Overviews
      • View and analyze data
      • Application performance monitoring (APM)
      • Configure case settings
      • Cases
      • Configure settings
      • Stream application logs
      • Create and manage cases
      • Create an SLO
      • APM anomaly
      • Custom threshold
      • Error count threshold
      • Failed transaction rate threshold
      • Inventory
      • Latency threshold
      • Create and manage rules
      • SLO burn rate
      • Detect metric anomalies
      • Explore logs
      • ECS formatted application logs
      • Filter and aggregate logs
      • Get started with system metrics
      • Get started
      • Understanding "no results found" message
      • Analyze infrastructure and host metrics
      • Logs
      • Machine learning
      • Data set quality
      • Synthetic monitor status
      • Synthetic monitoring
      • Parse and route logs
      • Plaintext application logs
      • Quickstart: Monitor your Kubernetes cluster with Elastic Agent
      • Quickstart: Monitor hosts with {{agent}}
      • Rate aggregation
      • {{apm-agent}} log sending
      • Observability overview
      • Service-level objectives (SLOs)
      • Stream any log file
      • Analyze monitor data
      • Use the CLI
      • Configure a Synthetics project
      • Write a synthetic test
      • Grant users access to secured resources
      • Use a Synthetics project
      • Use the Synthetics UI
      • Get started
      • Scripting browser monitors
      • Configure lightweight monitors
      • Manage monitors
      • Manage data retention
      • Multifactor Authentication for browser monitors
      • Configure individual monitors
      • Work with params and secrets
      • Monitor resources on private networks
      • Use the Synthetics Recorder
      • Scale and architect a deployment
      • Synthetics Encryption and Security
      • Configure Synthetics settings
      • Troubleshooting
      • SLO burn rate breaches
      • Threshold breaches
      • Troubleshoot logs
      • Troubleshooting
      • View alerts
      • View infrastructure metrics by resource type
      • Manage your project
      • Data
      • Alerts and insights
      • Content
      • Quickstart: Monitor hosts with OpenTelemetry
      • {{rules-app}}
      • Saved objects
      • Rules
      • Add and manage exceptions
      • Notes
      • Advanced behavioral detections
      • Advanced Entity Analytics
      • Advanced settings
      • Prevent {{agent}} uninstallation
      • Agentless integrations
      • Generate, customize, and learn about {{esql}} queries
      • Elastic AI Assistant
      • AI for Security
      • Use cases
      • Identify, investigate, and document threats
      • Suppress alerts
      • Alerts
      • Run Osquery from alerts
      • Monitor and troubleshoot rule executions
      • Allowlist {{elastic-endpoint}} in third-party antivirus apps
      • View risk score data
      • Asset criticality
      • Automated response actions
      • Automatic Import
      • Behavioral detection use cases
      • Benchmarks
      • Benchmarks
      • Blocklist
      • Use building block rules
      • Create and manage cases
      • Cases
      • Cases requirements
      • Configure case settings
      • Cloud Security
      • Cloud Security Posture
      • Cloud Security Posture
      • Cloud Security Posture
      • Cloud workload protection for VMs
      • Configure network map data
      • Configure an integration policy for {{elastic-defend}}
      • Connect to Azure OpenAI
      • Connect to Amazon Bedrock
      • Connect to Google Vertex AI
      • Connect to OpenAI
      • Findings page
      • Findings page
      • Get started with CSPM for Azure
      • Get started with CSPM for GCP
      • Get started with CSPM for AWS
      • Frequently asked questions (FAQ)
      • Cloud security posture management
      • Dashboards
      • Data Quality
      • {{data-sources-cap}} in Elastic Security
      • Enable access for macOS Ventura and higher
      • Deploy on macOS with MDM
      • Detection engine overview
      • Entity Analytics
      • Detection & Response
      • Detections requirements
      • {{elastic-defend}} requirements
      • Configure data volume
      • Turn off diagnostic data for {{elastic-defend}}
      • Event capture and {{elastic-defend}}
      • {{elastic-defend}} feature privileges
      • Configure endpoint protection with {{elastic-defend}}
      • {{elastic-endpoint}} self-protection features
      • Endpoints
      • Entity risk scoring
      • Capture environment variables
      • Entity risk scoring requirements
      • Event filters
      • Examine Osquery results
      • Explore your data
      • Get started with KSPM
      • Host isolation exceptions
      • Hosts page
      • Indicators of compromise
      • Ingest data
      • Install Elastic Defend
      • Enable access for macOS Monterey
      • Launch Timeline from investigation guides
      • Run Osquery from investigation guides
      • Investigation tools
      • Isolate a host
      • Kubernetes security posture management
      • File system monitoring (Linux)
      • LLM connector guides
      • Large language model performance matrix
      • Detect anomalies
      • Manage {{elastic-defend}}
      • {{ml-cap}} job and rule requirements
      • Network page
      • Optimize {{elastic-defend}}
      • Use placeholder fields in Osquery queries
      • Add Osquery Response Actions
      • Overview
      • {{elastic-sec}} overview
      • Policies
      • Frequently asked questions (FAQ)
      • Security posture management overview
      • Use Elastic prebuilt rules
      • Configure protection updates
      • Query alert indices
      • Osquery
      • Reduce notifications and alerts
      • {{elastic-sec}} requirements
      • Configure third-party response actions
      • Response actions history
      • Endpoint response actions
      • Rule exceptions
      • Detection rule monitoring
      • MITRE ATT&CK® coverage
      • Create a detection rule
      • Manage detection rules
      • Create runtime fields
      • Self-healing rollback (Windows)
      • Session View
      • Create and manage shared exception lists
      • Add alerts to cases
      • Spaces and {{elastic-sec}}
      • Third-party response actions
      • Enable threat intelligence integrations
      • Timeline templates
      • Timeline
      • Triage alerts
      • Elastic Defend
      • Trusted applications
      • Detection rules
      • Tune detection rules
      • Optimizing anomaly results
      • Turn on risk scoring
      • Elastic Security UI
      • Uninstall {{agent}}
      • Users page
      • Create and manage value lists
      • View alert details
      • Visual event analyzer
      • Visualize alerts
      • Cloud Native Vulnerability Management dashboard
      • Frequently asked questions (FAQ)
      • Get started with CNVM
      • Cloud native vulnerability management
      • Troubleshoot SLOs
      • Spaces
      • {{tags-app}}
      • {{transforms-app}}
      • {{es}}
      • Elastic Observability
    • Elasticsearch Hadoop
      • Documentation sections
    • Elasticsearch
      • Usage example
      • Active Directory user authentication
      • Overview
      • Text analysis
      • Autoscaling deciders
      • Fixed decider
      • Frozen existence decider
      • Frozen shards decider
      • Frozen storage decider
      • Machine learning decider
      • Proactive storage decider
      • Reactive storage decider
      • Bootstrap Checks for {{xpack}}
      • Bootstrap Checks
      • Built-in roles
      • Built-in users
      • Setting passwords for native and built-in users
      • Start the {{stack}} with security enabled automatically
      • Data management
      • Roll up or transform your data
      • Data streams
      • Data tiers
      • Defining roles
      • Document level security
      • Indices and documents
      • Run {{es}}
      • Add data to {{es}}
      • {{es}} security principles
      • Examples
      • Getting started
      • Using {{esql}}
      • {{esql}}
      • Setting up field and document level security
      • Field level security
      • File-based user authentication
      • FIPS 140-2
      • Basics: Full-text search and filtering
      • Basics: Index and search using APIs
      • How it works
      • Config ignore_missing_component_templates
      • {{ilm-init}}: Manage the index lifecycle
      • Index management in {{kib}}
      • Index Shard Allocation
      • Analysis
      • Mapper
      • Enrich your data
      • Ingest pipelines in Search
      • Ingest pipelines
      • Installing Elasticsearch
      • Restricting connections with IP filtering
      • JWT authentication
      • Kerberos authentication
      • kNN search
      • LDAP user authentication
      • Mapping users and groups to roles
      • Mapping
      • Monitor a cluster
      • Overview
      • Monitoring in a production environment
      • Native user authentication
      • Configuring single sign-on to the {{stack}} using OpenID Connect
      • OpenID Connect authentication
      • Overview
      • Query DSL
      • Query and filter context
      • Index recovery prioritization
      • Retrievers
      • Role mapping resources
      • Overview
      • Run {{es}} locally
      • Configuring SAML single-sign-on on the {{stack}}
      • SAML authentication
      • Get ready for production
      • Search and analyze data
      • Search your data
      • Search with synonyms
      • The search API
      • Secure the {{stack}}
      • Monitoring and security
      • Secure settings
      • Set up basic security plus HTTPS
      • Set up basic security
      • Security files
      • Limitations
      • Semantic search with the {{infer}} API
      • Semantic search
      • User authentication
      • Set up {{es}}
      • Index-level shard allocation filtering
      • The shard request cache
      • Snapshot and restore
      • Restore a snapshot
      • Starting Elasticsearch
      • Stopping Elasticsearch
      • Transforming data
      • Watcher
      • Autoscaling
      • Rolling up historical data
    • Fleet and Elastic Agent
      • {{beats}} and {{agent}} capabilities
      • Restrictions for {{serverless-full}}
      • Quick starts
    • Ingest overview
      • Ingesting data into {{es}}
    • Kibana
      • Connectors
      • Alerting
      • APM settings
      • Add data
      • Run API requests with Console
      • Rollup Jobs
      • Create a {{data-source}}
      • Mutual TLS with {{es}}
      • {{esql}}
      • Quick start
      • Inference endpoints UI
      • Install {{kib}}
      • What is Kibana?
      • Authentication
      • {{kib}} concepts
      • {{kib}} role management
      • Logging settings
      • Maintenance windows
      • Stack Management
      • Manage data views
      • Manage saved objects
      • Tags
      • Maps
      • Osquery
      • Playground
      • Reporting and sharing
      • Reporting
      • Role mappings
      • Installing sample data
      • Save a query
      • Saved Object IDs
      • AI Assistant
      • Connection details
      • Configure reporting
      • Secure settings
      • Security
      • Set the time range
      • Set up
      • Securing access to {{kib}}
      • Roll back to a previous version of {{kib}}
      • Upgrade {{kib}}
      • Configure security
      • Watcher
      • AIOps Labs
      • {{anomaly-detect-cap}}
      • {{dfanalytics-cap}}
      • Granting access to {{kib}}
      • FIPS 140-2
      • Security
      • Spaces
    • Logstash
      • Health Report Pipeline Flow: Worker Utilization
      • Health Report Pipeline Status
      • Troubleshooting
      • Troubleshooting {{ls}}
    • Observability
      • Add a service name to logs
      • Aggregation options
      • Analyze and compare hosts
      • Act on data
      • Advanced queries
      • APM agents
      • Create rules and alerts
      • APM Anomaly
      • Collect application data
      • Common problems
      • Configure APM Server
      • Find transaction latency and failure correlations
      • Create custom links
      • Spans
      • Traces
      • Learn about data types
      • Dependencies
      • Error count threshold
      • Errors
      • Failed transaction rate threshold
      • Filter and search data
      • Filters
      • Get started
      • Infrastructure
      • Interpret data
      • Observe Lambda functions
      • Latency threshold
      • Logs
      • Integrate with machine learning
      • Metrics
      • AWS Lambda Functions
      • Collect metrics
      • Upstream OpenTelemetry Collectors and language SDKs
      • Limitations
      • Resource attributes
      • OpenTelemetry
      • Reduce storage
      • Transaction sampling
      • Use APM securely
      • Service Map
      • Service overview
      • Services
      • Settings
      • Trace sample timeline
      • Traces
      • Track deployments with annotations
      • Transactions
      • Drill down into data
      • Overviews
      • View and analyze data
      • Application performance monitoring (APM)
      • Applications and services
      • Stream application logs
      • Quickstart: Collect data with AWS Firehose
      • Configure settings
      • Create and manage rules
      • Alerting
      • Cases
      • Custom threshold
      • Logs Explorer
      • Understanding "no results found" message
      • Incident management
      • Infrastructure and hosts
      • Inventory
      • Detect metric anomalies
      • Logs
      • ECS formatted application logs
      • Filter and aggregate logs
      • Get started with system metrics
      • Parse and organize logs
      • Plaintext application logs
      • {{apm-agent}} log sending
      • Stream any log file
      • Troubleshoot logs
      • Configure case settings
      • Open and manage new cases
      • Data set quality
      • Analyze infrastructure and host metrics
      • Quickstart: Monitor your Kubernetes cluster with {{agent}}
      • Quickstart: Unified Kubernetes Observability with Elastic Distributions of OpenTelemetry (EDOT)
      • Monitor status
      • Synthetic monitoring
      • Observability AI Assistant
      • Get started
      • What is Elastic {{observability}}?
      • Quickstart: Monitor hosts with {{agent}}
      • Quickstart: Monitor hosts with OpenTelemetry
      • Rate aggregation
      • SLO burn rate
      • Create an SLO
      • Troubleshoot SLOs
      • Service-level objectives (SLOs)
      • Analyze monitor data
      • Use the CLI
      • Configure projects
      • Write a synthetic test
      • Grant users access to secured resources
      • Use {{project-monitors-cap}}
      • Use the {{synthetics-app}}
      • Get started
      • Scripting browser monitors
      • Configure lightweight monitors
      • Manage monitors
      • Manage data retention
      • Multi-factor Authentication
      • Configure individual monitors
      • Work with params and secrets
      • Monitor resources on private networks
      • Use the Synthetics Recorder
      • Scale and architect a deployment
      • Synthetics Encryption and Security
      • Configure Synthetics settings
      • Troubleshooting
      • SLO burn rate breaches
      • Threshold breaches
      • Troubleshooting
      • View infrastructure metrics by resource type
      • View alerts
    • Security
      • About detection rules
      • Add and manage exceptions
      • Notes
      • Endpoints
      • Advanced behavioral detections
      • Advanced Entity Analytics
      • Configure advanced settings
      • Prevent {{agent}} uninstallation
      • Agentless integrations
      • AI Assistant Knowledge Base
      • AI for Security
      • Suppress detection alerts
      • Run Osquery from alerts
      • Manage detection alerts
      • Monitor and troubleshoot rule executions
      • Allowlist {{elastic-endpoint}} in third-party antivirus apps
      • View and analyze risk score data
      • Configure updates for protection artifacts
      • Asset criticality
      • Connect to Azure OpenAI
      • Connect to Amazon Bedrock
      • Connect to OpenAI
      • Triage alerts
      • Use cases
      • Identify, investigate, and document threats
      • Attack Discovery
      • Automated response actions
      • Automatic import
      • Behavioral detection use cases
      • Benchmarks
      • Blocklist
      • About building block rules
      • Cases requirements
      • Configure case settings
      • Open and manage cases
      • Cases
      • Cloud Security Posture dashboard
      • Cloud Security
      • Cloud Security Posture dashboard
      • Cloud workload protection for VMs
      • Configure network map data
      • Configure an integration policy for {{elastic-defend}}
      • Connect to your own local LLM
      • Connect to Google Vertex
      • Benchmarks
      • Findings page
      • Get started with CSPM for Azure
      • Get started with CSPM for GCP
      • Get started with CSPM for AWS
      • Cloud Security Posture dashboard
      • CSPM privilege requirements
      • Frequently asked questions (FAQ)
      • Cloud security posture management
      • Dashboards
      • Data Quality dashboard
      • {{data-sources-cap}} in Elastic Security
      • Enable access for macOS Ventura and higher
      • Enable access for macOS Monterey
      • Deploy on macOS with MDM
      • Detections and alerts
      • Entity Analytics dashboard
      • Detection & Response dashboard
      • Using logsdb index mode with {{elastic-sec}}
      • Detections requirements
      • Rule exceptions
      • {{elastic-defend}} requirements
      • Optimize {{elastic-defend}}
      • Configure data volume
      • Turn off diagnostic data for {{elastic-defend}}
      • Event capture and {{elastic-defend}}
      • {{elastic-defend}} feature privileges
      • Configure endpoint protection with {{elastic-defend}}
      • Endpoint protection rules
      • {{elastic-endpoint}} self-protection features
      • Entity risk scoring
      • Capture environment variables
      • Entity risk scoring requirements
      • {{elastic-sec}} overview
      • Enable threat intelligence integrations
      • Elastic Security UI
      • Generate, customize, and learn about {{esql}} queries
      • Event filters
      • Findings page
      • Get started with KSPM
      • Host isolation exceptions
      • Isolate a host
      • Hosts page
      • Indicators of compromise
      • Ingest AWS Security Hub data
      • Ingest data to Elastic Security
      • Ingest CNCF Falco data
      • Ingest third-party cloud security data
      • Ingest Wiz data
      • Install {{elastic-defend}}
      • Launch Timeline from investigation guides
      • Run Osquery from investigation guides
      • Investigation tools
      • Kubernetes security posture management
      • Configure Linux file system monitoring
      • Set up connectors for large language models (LLM)
      • Large language model performance matrix
      • Anomaly detection
      • Machine learning job and rule requirements
      • Network page
      • Use placeholder fields in Osquery queries
      • Add Osquery Response Actions
      • Overview dashboard
      • Policies
      • Install and manage Elastic prebuilt rules
      • Query alert indices
      • Reduce notifications and alerts
      • Configure third-party response actions
      • Response actions history
      • Endpoint response actions
      • Detection rule monitoring dashboard
      • MITRE ATT&CK® coverage
      • Create a detection rule
      • Manage detection rules
      • Create runtime fields in {{elastic-sec}}
      • Explore
      • Manage {{elastic-defend}}
      • {{elastic-sec}} requirements
      • AI Assistant
      • Frequently asked questions (FAQ)
      • Security posture management overview
      • Spaces and {{elastic-sec}}
      • Configure self-healing rollback for Windows endpoints
      • Session View
      • Create and manage shared exception lists
      • Add detection alerts to cases
      • Third-party response actions
      • Timeline templates
      • Timeline
      • Trusted applications
      • Detection rules
      • {{elastic-defend}}
      • Optimizing anomaly results
      • Tune detection rules
      • Turn on the risk scoring engine
      • Uninstall {{agent}}
      • Osquery
      • Users page
      • Create and manage value lists
      • View detection alert details
      • Examine Osquery results
      • Visual event analyzer
      • Visualize detection alerts
      • Cloud Native Vulnerability Management Dashboard
      • Cloud Native Vulnerability Management Dashboard
      • Frequently asked questions (FAQ)
      • Get started with CNVM
      • Cloud native vulnerability management
    • Elastic Stack
      • Installing in an air-gapped environment
      • Tutorial 2: Securing a self-managed {{stack}}
      • Installing the Elastic Stack
      • Tutorial 1: Installing a self-managed {{stack}}
      • Overview
      • Upgrade on Elastic Cloud
      • Upgrade Elastic on-prem
      • Upgrade to Elastic 9.0.0-beta1
      • Upgrade {{es}}
      • Upgrade {{kib}}
    • Machine learning
      • What is Elastic {{ml-app}}?
      • {{anomaly-detect-cap}}
      • {{dfanalytics-cap}}
    • Starting with the Elasticsearch Platform and its Solutions
      • Get Elastic
      • Getting help
      • An overview of the {{stack}}
      • Troubleshooting and FAQs

On this page

  • Elastic Support
  • Discussion forum
Edit this page
  1. Elastic /
  2. Elastic documentation!!!! /
  3. Content to pull from /
  4. Observability /

Troubleshooting

Learn how to troubleshoot common issues on your own or ask for help.

  • Understanding "no results found" message

Elastic Support ¶

We offer a support experience unlike any other. Our team of professionals speak human and code and love making your day. Learn more about subscriptions.

Discussion forum ¶

For other questions and feature requests, visit our discussion forum.

Previous
Threshold breaches
Next
View infrastructure metrics by resource type

2024, Elasticsearch B.V. All Rights Reserved.

Made with Elastic.Markdown and Shibuya theme.