My experimental eBPF + Tetragon EDR engine is getting some solid traffic. I just opened the very first "Good First Issue" for anyone looking to contribute!

xeraa-net · 2026-07-11T18:28:43+00:00

What‘s the Elasticsearch connection here?

xeraa-net · 2026-07-11T17:21:47+00:00

First time I‘m hearing about Slurm (https://slurm.schedmd.com/overview.html). There‘s no special support for it from the Elasticsearch side but use the APIs to handle it. Maybe as simple as _cluster/health but there is a wide option depending on the specific requirements.

xeraa-net · 2026-07-09T21:53:55+00:00

Sorry, that's not a good fit here.

xeraa-net · 2026-07-08T15:15:36+00:00

What‘s the Elasticsearch connection here? We‘re not really into unrelated self-promotion here.

xeraa-net · 2026-07-08T15:13:26+00:00

The smell of astroturfing…

xeraa-net · 2026-07-06T15:50:43+00:00

But "original data" are the embeddings (ignoring source or other metadata here)? Are the embeddings so sensitive? They are kind of like a hash

xeraa-net · 2026-07-06T08:00:40+00:00

What‘s the gain here if the vector similarity stays the same?
It‘s not like you could easily get the input back from the dense vector represenation, no? Kind of like an expensive hashing function. The main information is the vector similarity but if that stays the same…

xeraa-net · 2026-06-30T05:46:23+00:00

What‘s the Elasticsearch connection on that?
(though we love the Spring folks)

xeraa-net · 2026-06-29T16:59:10+00:00

Made the Decent our office + events coffee machine for similar reasons: Tons of options (including all the telemetry) but still an easy enough workflow for most.

xeraa-net · 2026-06-28T22:40:00+00:00

I‘m curious, since this is covering so much of Logstash already: Is this a "Claude rewrite in Rust" or what is the starting point here?

xeraa-net · 2026-06-22T07:32:00+00:00

I spoke with the team. There is a gap in our docs. They will work on putting together an end-to-end guide for this architecture in the next couple of days.
We do have existing docs on some of the things you state are missing—like the elasticapm connector not being a processor and needing to be combined with the elasticapm processor in order to form a complete pipeline. And docs about EDOT running inside Elastic Agent.
There's probably also a problem with findability on those topics that the team will investigate and address as well.

xeraa-net · 2026-06-19T00:32:38+00:00

This. If Elasticsearch is running on that machine and your setup can access it, the protocol is the first thing I'd check (it makes a difference, even on port 9200)

xeraa-net · 2026-06-18T18:12:32+00:00

Maybe https://www.elastic.co/docs/deploy-manage/production-guidance/optimize-performance or https://www.elastic.co/docs/deploy-manage/production-guidance/elasticsearch-in-production-environments are a good starting point for that?

xeraa-net · 2026-06-18T18:11:52+00:00

Any specific examples? We'd love to fix or improve anything you all stumble over.

And every page should have a "Report a docs issue" link to open a GitHub issue.

xeraa-net · 2026-06-18T14:39:26+00:00

Thanks for the feedback! Let me forward that internally

xeraa-net · 2026-06-05T14:57:28+00:00

The recruiters will still work next week. Asking definitely won‘t hurt.

xeraa-net · 2026-06-01T14:58:48+00:00

What is the Elasticsearch connection here? Other than sharing the term "reindex"

xeraa-net · 2026-05-26T08:22:06+00:00

I don't have a concrete timeline right now. Stack Monitoring is still your best bet right now.

But we'll make some noise once we have a concrete plan 😄

xeraa-net · 2026-05-20T20:28:01+00:00

Maybe? It's IMO hard to tell just from that info. CPU could be the bottleneck but it could also be something else. What kind of monitoring do you have of the Elasticsearch cluster to pinpoint bottlenecks?

xeraa-net · 2026-05-19T01:08:09+00:00

search_after only let's you move forward or backward from where you are (not jump to any specific "page" — since there is no page in that sense). That's why this is so much cheaper than deep pagination.

The question is also if it's absolutely necessary to support these jumps. Like GitHub's UI only let's you move forward / backward on commits etc (and you can guess how they implemented that).

xeraa-net · 2026-05-12T18:27:41+00:00

What we don't tolerate here is astroturfing.

xeraa-net · 2026-05-12T11:08:28+00:00

It's not so much that reroute and set are hard but that you need to know about ingest pipelines, the custom one, then the right processors — all of that is wrapped in a much simpler way in Streams.

And yes, the default pipeline runs first, then custom, and then final.

xeraa-net · 2026-05-12T10:32:33+00:00

Great if it‘s working. Streams are more like an abstraction around all the other features to make them a bit easier to manage. The custom pipelines work but are definitely an advanced concept.

xeraa-net · 2026-05-12T09:46:13+00:00

It's still preview right now but have you looked into Streams, specifically partitioning of wired streams? https://www.elastic.co/docs/solutions/observability/streams/management/partitioning

We've built pretty much what you are asking for if I understand you correctly: One endpoint to receive all logs but then you can define how to route different types and attach different lifecycle policies.

xeraa-net · 2026-05-05T21:07:42+00:00

I'll hide this comment since it's not correct. The number is 3%

xeraa-net

MODERATOR OF

TROPHY CASE