# Log.original field lost with upgrade 8.6.1 from 1.5.3

**URL:** <https://discuss.elastic.co/t/log-original-field-lost-with-upgrade-8-6-1-from-1-5-3/348363>\
**Category:** Elasticsearch\
**Tags:** ecs-elastic-common-schema\
**Created:** [November 30, 2023, 7:33pm UTC](https://discuss.elastic.co/t/log-original-field-lost-with-upgrade-8-6-1-from-1-5-3/348363 "2023-11-30T19:33:41Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![ridvandev](https://avatars.discourse-cdn.com/v4/letter/r/8edcca/32.png) [@ridvandev](https://discuss.elastic.co/u/ridvandev)\
**Post date:** [November 30, 2023, 7:33pm UTC](https://discuss.elastic.co/t/log-original-field-lost-with-upgrade-8-6-1-from-1-5-3/348363/1 "2023-11-30T19:33:41Z")

</div>

We used to use the `log.original` field a lot for our searches in Kibana, but since the upgrade of `Elastic.CommonSchema.Nlog` package, I can't seem to find this field anymore. Also, it looks like the log template we depend on isn't being logged now.

Has anyone else faced this? Am I missing something, or is there a new way to access these features after the upgrade? Any tips or suggestions would be really helpful.

Thanks in advance!

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [November 30, 2023, 8:08pm UTC](https://discuss.elastic.co/t/log-original-field-lost-with-upgrade-8-6-1-from-1-5-3/348363/2 "2023-11-30T20:08:18Z")

</div>

Hi @ridvandev Welcome to the community.

Cool you have been using Elasticsearch for so long, However, from 1.5.3 there have been many many changes...

What are you using to ingest your logs?

Probably the closest to what you are looking for is the `event.original` field, but whether that is available for every logs that is not necessarily the case.

You might be able to use a field alias or runtime field to "recreate/access" `log.original`

It also depends if that field was `text` field or `keyword`

---

<div class="post-metadata">

**Author:** ![ridvandev](https://avatars.discourse-cdn.com/v4/letter/r/8edcca/32.png) [@ridvandev](https://discuss.elastic.co/u/ridvandev)\
**Post date:** [November 30, 2023, 11:17pm UTC](https://discuss.elastic.co/t/log-original-field-lost-with-upgrade-8-6-1-from-1-5-3/348363/3 "2023-11-30T23:17:14Z")

</div>

Hi @stephenb, thank you for the quick reply!

I think I couldn't explain myself quite right.  
We updated the `Elastic.CommonSchema.Nlog` package version from 1.5.3 to 8.6.1.  
With this upgrade, we lost the field `log.original`, but we got `log.origin.file.name` and `log.origin.function` instead which are always empty.  
There is no `event.original` field, unfortunately.

We are using `Nlog.Targets.ElasticSearch` package to ingest logs to elastic-stack.

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [November 30, 2023, 11:25pm UTC](https://discuss.elastic.co/t/log-original-field-lost-with-upgrade-8-6-1-from-1-5-3/348363/4 "2023-11-30T23:25:06Z")

</div>

> [@ridvandev](#):
>
> 1.5.3

Hmm, I am probably not the right person to answer that I will ping someone.

> <https://github.com/elastic/ecs-dotnet/tree/1.6/src/Elastic.CommonSchema.NLog>
>
> //github.com/elastic/ecs-dotnet/tree/1.6/src/Elastic.CommonSchema.NLog

I see version 1.6 etc, for the NLog and 8.6.1 is the Version of the Stack not NLog (I am guessing)

When I look at the page I see the layout still contains...

```auto
   },
   "log":{
      "logger":"Elastic.CommonSchema.NLog",
      "original":"Info {ValueX} {SomeY}"
   },

```

I will see if I can ping someone

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 28, 2023, 11:25pm UTC](https://discuss.elastic.co/t/log-original-field-lost-with-upgrade-8-6-1-from-1-5-3/348363/5 "2023-12-28T23:25:41Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.