Logstash plugins still displaying ECS v8 warnings

Elastic Stack Logstash
1

I noticed that several plugins (grok and outputs.elasticsearchmonitoring to name a few) are still displaying warning messages like the following:

[WARN][logstash.filters.grok][<pipeline_redacted] ECS v8 support is a preview of the unreleased ECS v8, and uses the v1 patterns. When Version 8 of the Elastic Common Schema becomes available, this plugin will need to be updated

Since we are currently at ECS v8.6, ECS v8.0 became available Februari 2022 and ECS v8 is enabled in Logstash by default , I think we can remove these warnings.

2

No, the latest release of logstash is 8.6.1, but the latest version of ECS is 8.0.

3

Are these not the release notes of ECS with version numbers?

Or did you mean that the version included in Logstash is older than current? If so, can you point me to a place where I can find which version is implemented?

4

Yes, you are right. I was mistaken.

5

Badger, you are still right :slight_smile: In the documentation is 8.6.1, however in config params is v8 like geoip or v1 as param for 1.12.
RN describes changes in 8.x versions. Every new version ECS will add new fields, no dramatic changes.

Oddly, causes of those are warnings are explained here

6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.