So, I have enabled GCP Audit logs collection using the GCP integration from Elastic Agent 8.3.3. I've had no problems so far running searches in this dataset, but as of today the next error keeps appearing, and now I can no longer searcg through the gcp.audit logs in Kibana Discover: { "took": 8…

Field [gcp.audit.response.status.conditions.lastHeartbeatTime] of type [flattened] doesn't support formats

AndreiRD September 26, 2022, 9:08am 4

If anyone comes across this, my temporary solution was to add gcp.audit.response.status.conditions.lastHeartbeatTime to Field filters tab in the Data View that I used.

Topic		Replies	Views
Google GCP Audit Logs Mapping Issue Elasticsearch	2	570	August 14, 2019
Mismatch in field type Logstash	7	772	August 19, 2018
Encounter error "Saved field "timeStamp" of data view "index-name" is invalid for use with the "Date Histogram" aggregation. Please select a new field Logstash	1	309	October 23, 2023
.JSON Conf File for Logstash Logstash	20	551	October 23, 2023
Observability Overview - Logs not shown as log source Elastic Observability ecs-elastic-common-schema	23	219	October 17, 2024

Field [gcp.audit.response.status.conditions.lastHeartbeatTime] of type [flattened] doesn't support formats

Related topics