# Field \[gcp.audit.response.status.conditions.lastHeartbeatTime\] of type \[flattened\] doesn't support formats

**URL:** <https://discuss.elastic.co/t/field-gcp-audit-response-status-conditions-lastheartbeattime-of-type-flattened-doesnt-support-formats/315028>\
**Category:** Kibana\
**Created:** [September 23, 2022, 3:25pm UTC](https://discuss.elastic.co/t/field-gcp-audit-response-status-conditions-lastheartbeattime-of-type-flattened-doesnt-support-formats/315028 "2022-09-23T15:25:22Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![AndreiRD](https://avatars.discourse-cdn.com/v4/letter/a/9fc348/32.png) [@AndreiRD](https://discuss.elastic.co/u/AndreiRD)\
**Post date:** [September 23, 2022, 3:25pm UTC](https://discuss.elastic.co/t/field-gcp-audit-response-status-conditions-lastheartbeattime-of-type-flattened-doesnt-support-formats/315028/1 "2022-09-23T15:25:22Z")

</div>

So, I have enabled GCP Audit logs collection using the GCP integration from Elastic Agent 8.3.3.  
I've had no problems so far running searches in this dataset, but as of today the next error keeps appearing, and now I can no longer searcg through the gcp.audit logs in Kibana Discover:

```auto
{
  "took": 827,
  "timed_out": false,
  "_shards": {
    "total": 256,
    "successful": 255,
    "skipped": 245,
    "failed": 1,
    "failures": [
      {
        "shard": 0,
        "index": ".ds-logs-gcp.audit-2022.09.xx-0000xx",
        "node": "256AwbrySDuevtredacted",
        "reason": {
          "type": "illegal_argument_exception",
          "reason": "error fetching [gcp.audit.response.status.conditions.lastHeartbeatTime]: Field [gcp.audit.response.status.conditions.lastHeartbeatTime] of type [flattened] doesn't support formats.",
          "caused_by": {
            "type": "illegal_argument_exception",
            "reason": "Field [gcp.audit.response.status.conditions.lastHeartbeatTime] of type [flattened] doesn't support formats."
          }
        }
      }
    ]
  },
  "hits": {
    "max_score": null,
    "hits": []
  }
}

```

It looks like some one else had a similar issue with aws logs: [Illegal\_argument\_exception](https://discuss.elastic.co/t/illegal-argument-exception/311847)  
Any idea on what can be done to fix these issues?

---

<div class="post-metadata">

**Author:** ![AndreiRD](https://avatars.discourse-cdn.com/v4/letter/a/9fc348/32.png) [@AndreiRD](https://discuss.elastic.co/u/AndreiRD)\
**Post date:** [September 23, 2022, 4:17pm UTC](https://discuss.elastic.co/t/field-gcp-audit-response-status-conditions-lastheartbeattime-of-type-flattened-doesnt-support-formats/315028/2 "2022-09-23T16:17:17Z")

</div>

I did try to disable the `Set Format` option for this particular field, but the setting is not persistent. It gets reverted immediately after I press `Save`.

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/4/e/4edc77dd47e04f954f2b09c42d5530455a06bc97.png)

---

<div class="post-metadata">

**Author:** ![AndreiRD](https://avatars.discourse-cdn.com/v4/letter/a/9fc348/32.png) [@AndreiRD](https://discuss.elastic.co/u/AndreiRD)\
**Post date:** [September 26, 2022, 9:08am UTC](https://discuss.elastic.co/t/field-gcp-audit-response-status-conditions-lastheartbeattime-of-type-flattened-doesnt-support-formats/315028/4 "2022-09-26T09:08:46Z")

</div>

If anyone comes across this, my temporary solution was to add `gcp.audit.response.status.conditions.lastHeartbeatTime` to `Field filters` tab in the Data View that I used.

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/0/8/0857f0a64dbe30d927737e5be11360955f94c232.png)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 24, 2022, 9:09am UTC](https://discuss.elastic.co/t/field-gcp-audit-response-status-conditions-lastheartbeattime-of-type-flattened-doesnt-support-formats/315028/5 "2022-10-24T09:09:08Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.