# ES|QL "Unknown column \[process.name\]" after upgrading to 8.17 **URL:** \ **Category:** Elastic Search\ **Tags:** esql\ **Created:** [January 10, 2025, 9:51pm UTC](https://discuss.elastic.co/t/es-ql-unknown-column-process-name-after-upgrading-to-8-17/373083 "2025-01-10T21:51:54Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![isugg](https://avatars.discourse-cdn.com/v4/letter/i/8797f3/32.png) [@isugg](https://discuss.elastic.co/u/isugg)\ **Post date:** [January 10, 2025, 9:51pm UTC](https://discuss.elastic.co/t/es-ql-unknown-column-process-name-after-upgrading-to-8-17/373083/1 "2025-01-10T21:51:54Z")
After upgrading our Elastic stack to 8.17, we have began having issues with our ES|QL queries. When searching for process.name or process.command\_line in all logs, we receive the error "Unknown column [process.name]" even though this key is present and populated in several documents. When switching to `from logs-*powershell*` the key is able to be queried, however, process.name is always empty, when it previously had been powershell.exe. What is broken? ![image](https://us1.discourse-cdn.com/elastic/original/3X/c/b/cbb7f8e306a1e56cea5bf44329e2aa2aad389024.png) ![image](https://us1.discourse-cdn.com/elastic/original/3X/e/9/e98d8e6c0d5679785d14d642a70e378d81a9a3be.png) ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [January 12, 2025, 5:31pm UTC](https://discuss.elastic.co/t/es-ql-unknown-column-process-name-after-upgrading-to-8-17/373083/2 "2025-01-12T17:31:18Z")
Hi @isugg The first example is `process.command_line` The 2nd is `process.name` Can you try the ESQL with `process.command_line` Also are you sure they are there in the time range? Also try using the same logs selector > [@isugg](#): > > process.name is always empty, when it previously had been powershell.exe. Also did you upgrade the agent or beats? What version did you upgrade from? What are you using to collect the logs? validate the same in Discover ---
**Author:** ![isugg](https://avatars.discourse-cdn.com/v4/letter/i/8797f3/32.png) [@isugg](https://discuss.elastic.co/u/isugg)\ **Post date:** [January 13, 2025, 5:04pm UTC](https://discuss.elastic.co/t/es-ql-unknown-column-process-name-after-upgrading-to-8-17/373083/3 "2025-01-13T17:04:01Z")
Hello Stephen, I am having issues with process.command\_line and process.name being missing or un-queryable, in multiple different index matching patterns, and the most generic `from logs-*` although I am able to query these fields in certain indices. These indices are not matching a similar collection pattern like endpoint or system security logs. The matching indices are from random UIDS representing different data collection points. We upgraded the Elastic stack and kibana version from 8.11 to 8.17, the agents are various versions of 8.XX. I am having these issues in Discover when using ES|QL in Kibana. When getting the metadata of each document, and switching to KQL in Discover and finding these documents, the data is matching. I.e. process.name is there when it is available in ES|QL or not there in KQL when it is not available in ES|QL. Thank you! ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [January 13, 2025, 5:54pm UTC](https://discuss.elastic.co/t/es-ql-unknown-column-process-name-after-upgrading-to-8-17/373083/4 "2025-01-13T17:54:05Z")
Hi @isugg I am not sure what the issue is. What I suggest is to go to Discover and do a very strict query on a specific index and field .... you can find the index in the document. Example `_index: .ds-metrics-system.process-default-2025.01.10-001243 and process.name : *` Then replicate that in ESQL ... ```auto FROM .ds-metrics-system.process-default-2025.01.10-001243 | WHERE process.name IS NOT NULL ``` Let me know if that works... I suspect perhaps there are conflicts in your data views that are causing the issue. It is possible there is a bug... If so you will need to provide a repeatable case so that an Issue can be drafted... ---
**Author:** ![isugg](https://avatars.discourse-cdn.com/v4/letter/i/8797f3/32.png) [@isugg](https://discuss.elastic.co/u/isugg)\ **Post date:** [January 13, 2025, 6:34pm UTC](https://discuss.elastic.co/t/es-ql-unknown-column-process-name-after-upgrading-to-8-17/373083/5 "2025-01-13T18:34:10Z")
Hello @stephenb I appreciate the follow up, and recommendation. We have a ticket open with Elastic support and I will try to update with the resolution/issue if able. Thank you! ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [February 4, 2025, 3:19am UTC](https://discuss.elastic.co/t/es-ql-unknown-column-process-name-after-upgrading-to-8-17/373083/6 "2025-02-04T03:19:58Z")
@isugg Are you on 8.17.0 or 8.17.1? 8.17.1 ```auto FROM logs-* | WHERE process.name == "svchost.exe" | LIMIT 10 ``` ![Screenshot 2025-02-03 at 7.17.49 PM](https://us1.discourse-cdn.com/elastic/original/3X/f/8/f8f9f9b52c4f8fd9b3dae2f651e19c9b8076abc5.png) ---
**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\ **Post date:** [February 4, 2025, 5:02pm UTC](https://discuss.elastic.co/t/es-ql-unknown-column-process-name-after-upgrading-to-8-17/373083/7 "2025-02-04T17:02:09Z")
Heya @isugg I think I found it and I think it is a bug... can you you go to Discover and do the KQL query ..... then get the `data_stream.dataset` from one of the resulting documents Then try the FROM clause with specific datastream `logs--*` NOTE that is different than what you have... Please provide text not screenshot... I think it is perhaps this bug... > > > \### Description > > For this mapping > > \`\`\` > { > "mappings": { > "properties": {… > "Responses": { > "properties": { > "process": { > "type": "nested", > "properties": { > "pid": { > "type": "long" > } > } > } > } > }, > "process": { > "properties": { > "parent": { > "properties": { > "command\_line": { > "type": "wildcard", > "fields": { > "text": { > "type": "text" > } > } > } > } > } > } > } > } > } > } > \`\`\` > > and query that is using \`process.parent.command\_line\` - \`from test | sort process.parent.command\_line\` or \`from test | where process.parent.command\_line == "test string"\` results in \`Unknown column \[process.parent.command\_line\]\` which is incorrect. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [March 4, 2025, 5:02pm UTC](https://discuss.elastic.co/t/es-ql-unknown-column-process-name-after-upgrading-to-8-17/373083/8 "2025-03-04T17:02:41Z")
Closed on March 4, 2025, 5:02pm UTC This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.