# Kibana infra/logs displaying "undefined" for ECS-formatted events **URL:** \ **Category:** Logs\ **Created:** [April 1, 2020, 11:32pm UTC](https://discuss.elastic.co/t/kibana-infra-logs-displaying-undefined-for-ecs-formatted-events/226137 "2020-04-01T23:32:32Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![ceekay](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ceekay/32/5687_2.png) [@ceekay](https://discuss.elastic.co/u/ceekay)\ **Post date:** [April 1, 2020, 11:32pm UTC](https://discuss.elastic.co/t/kibana-infra-logs-displaying-undefined-for-ecs-formatted-events/226137/1 "2020-04-01T23:32:32Z")
I've spent quite a while reworking my apache/nginx Logstash filter to be ECS-compliant, mostly using the `url` and `http` field sets. The newly-formated events are indexing correctly and look fine in Kibana Discover, but in the Infra/Logs interface most of the message field displays "undefined". E.g., pre-ECS: `11:26:48.752 127.0.0.1 - - [01/Apr/2020:22:26:48 +0000] "get /something" 400 173 "-" "-" "-"` Event: [https://gist.github.com/ceeeekay/2c036cf67d782b0b036e8379e9b91927](https://gist.github.com/ceeeekay/2c036cf67d782b0b036e8379e9b91927) ECS-formatted: `10:40:46.582 [undefined][access] undefined undefined "GET /?undefined HTTP/undefined" 200 undefined` Event: [https://gist.github.com/ceeeekay/79706bc726ff2b071c9f918a165b4499](https://gist.github.com/ceeeekay/79706bc726ff2b071c9f918a165b4499). I'm really not sure what's going on here. I assumed the logs interface would just display the message field but it seems to be trying to parse some other fields in the event. The settings in the Logs interface are pretty standard. Just a customised index name (which it can read fine) and some columns. The only thing of note is that this is in a particular user's space, but it's the only place we currently have http events. How do I fix this, and continue using ECS fields for my events? At the moment I've had to roll back to my old filters which doesn't bode well for converting the rest of my pipeline to ECS. Thanks! ---
**Author:** ![weltenwort](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/weltenwort/32/53885_2.png) [@weltenwort](https://discuss.elastic.co/u/weltenwort)\ **Post date:** [April 2, 2020, 6:19pm UTC](https://discuss.elastic.co/t/kibana-infra-logs-displaying-undefined-for-ecs-formatted-events/226137/2 "2020-04-02T18:19:11Z")
Hi @ceekay, I think it's great that you're aiming for ECS-compatibility. 👏 And thanks for providing such helpful examples for debugging. In this case you're falling victim to some peculiarities of the Log UI's message formatting, which we introduced to stay compatible with old versions of various filebeat access log modules. The filebeat modules used to leave out the message field, which is why we try to reconstruct it from certain pre-parsed fields if they're available. - The first `undefined` you're seeing is the `event.module` field, which you could set to something informative like `apache` or `nginx` or whatever your source is. - The `/?undefined` means that the `url.path` is correctly represented ("`/`" here), but the `url.query` is not set. - The `HTTP/undefined` indicates that `http.version` is not set. - The last `undefined` is due to the lack of `http.response.body.bytes`. You can look at the [corresponding rule](https://github.com/elastic/kibana/blob/d6587d7f5b121e6f7a982dc6847be9d62841324f/x-pack/plugins/infra/server/lib/domains/log_entries_domain/builtin_rules/generic_webserver.ts) yourself if you're interested. Obviously we've not done a great job supporting partial documents and this is something we should improve. I've created [https://github.com/elastic/kibana/issues/39575](https://github.com/elastic/kibana/issues/39575) a while ago to allow overriding the heuristics. Please feel free to weigh in with your perspective. I'll think about whether we can do something more immediate in the short term. ---
**Author:** ![ceekay](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ceekay/32/5687_2.png) [@ceekay](https://discuss.elastic.co/u/ceekay)\ **Post date:** [April 3, 2020, 2:01am UTC](https://discuss.elastic.co/t/kibana-infra-logs-displaying-undefined-for-ecs-formatted-events/226137/3 "2020-04-03T02:01:53Z")
Hi @weltenwort, That was all very helpful, especially `generic_webserver.ts` as it showed I was incorrectly using `client.ip` instead of `source.ip` in my filter. One thing that is still a problem though is infra/logs is still expecting `url.query` to contain a value, which isn't always the case. In this case it will still print `?undefined` even for a plain URL, e.g., `GET /`. `14:50:54.936 [http][access] 127.0.0.1 - "GET /?undefined HTTP/1.1" 200 612` The filter I'm using will resolve `url.query` if a query is present in the URL, but there isn't one here so the field doesn't exist. Is there any value I can set to avoid this, or is it a limitation of the interface? [edit] As a work-around I've taken out the `ecs.version` field so the message formatting isn't invoked, and we have "normal" http log messages again. Hopefully there's a nicer way to resolve this though. ---
**Author:** ![weltenwort](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/weltenwort/32/53885_2.png) [@weltenwort](https://discuss.elastic.co/u/weltenwort)\ **Post date:** [April 3, 2020, 9:58am UTC](https://discuss.elastic.co/t/kibana-infra-logs-displaying-undefined-for-ecs-formatted-events/226137/4 "2020-04-03T09:58:51Z")
Glad to hear you're making progress. Would it be possible to set an empty string for `url.query` in the document source instead of not setting the field at all? ---
**Author:** ![ceekay](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ceekay/32/5687_2.png) [@ceekay](https://discuss.elastic.co/u/ceekay)\ **Post date:** [April 3, 2020, 2:42pm UTC](https://discuss.elastic.co/t/kibana-infra-logs-displaying-undefined-for-ecs-formatted-events/226137/5 "2020-04-03T14:42:45Z")
I've tried setting it to `""`, but that displays `?""` in the UI. I also tried setting it to null with a ruby filter but that displays `?undefined` again. ---
**Author:** ![weltenwort](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/weltenwort/32/53885_2.png) [@weltenwort](https://discuss.elastic.co/u/weltenwort)\ **Post date:** [April 14, 2020, 4:01pm UTC](https://discuss.elastic.co/t/kibana-infra-logs-displaying-undefined-for-ecs-formatted-events/226137/6 "2020-04-14T16:01:40Z")
That's not ideal - we should definitely be smarter about that. 😬 Unfortunately I can't think of anything I could offer as an immediate solution beyond what you already figured out. Maybe we can manage to introduce a quick way to disable the message reconstruction during upcoming releases. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [May 12, 2020, 4:01pm UTC](https://discuss.elastic.co/t/kibana-infra-logs-displaying-undefined-for-ecs-formatted-events/226137/7 "2020-05-12T16:01:44Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.