After upgrade to 8.15.2 - csv export not working

Elastic Stack Kibana
1

Hello All,

I have saved search which i am trying to export to csv.
But i got error:

document_parsing_exception Caused by: illegal_argument_exception: Expected text at 1:623 but found START_OBJECT Root causes: document_parsing_exception: [1:726] failed to parse field [payload.searchSource.filter.query.range.@timestamp] of type [date] in document with id '02f59028-923f-4d17-840e-1a63a7dbf1df'. Preview of field's value: '{format=strict_date_optional_time, gte=2024-06-30T22:00:00.000Z, lte=2024-07-31T23:00:00.000Z}'

image

My @timestamp field is in type date.

And data are from datastream.

Also added format to timestamp field :
dd.MM.yyyy HH:mm:ss

What is the issue?

2

These are my mappings :
Tried everyone none is working.

".ds-winlogbeat-8.13.1-2024.10.17-000049": {
    "mappings": {
      "@timestamp": {
        "full_name": "@timestamp",
        "mapping": {
          "@timestamp": {
            "type": "date",
            "format": "strict_date_optional_time||epoch_millis||strict_date"
          }
        }
      }
    }
  },
  ".ds-winlogbeat-8.13.1-2024.10.08-000042": {
    "mappings": {
      "@timestamp": {
        "full_name": "@timestamp",
        "mapping": {
          "@timestamp": {
            "type": "date"
          }
        }
      }
    }
  },
  ".ds-winlogbeat-8.13.1-2024.10.16-000043": {
    "mappings": {
      "@timestamp": {
        "full_name": "@timestamp",
        "mapping": {
          "@timestamp": {
            "type": "date",
            "format": "strict_date_optional_time||epoch_millis||dd.MM.yyyy HH:mm:ss"
          }
        }
      }
    }
  },
3

Any hints what can cause issue?

4

I still cannot export data, is there someone who could help me with this? Someone from supprot team?

5

this is the range i am using :

 "query": {
    "bool": {
      "must": [
        {
          "query_string": {
            "query": "user.domain: (hq OR HQ OR HQ.COM) ",
            "analyze_wildcard": true,
            "time_zone": "Europe/Bratislava"
          }
        }
      ],
      "filter": [
        {
          "range": {
            "@timestamp": {
              "format": "strict_date_optional_time",
              "gte": "2024-07-31T22:00:00.000Z",
              "lte": "2024-10-31T23:00:00.000Z"
            }
6

Could you please confirm if you still have issues or it is fixed?

7

Hello @Tortoise,
Thanks for reaching out, i am still experiencing the issue it is happening in every index in every export not only winlogbeat.