# Logstash plugins still displaying ECS v8 warnings

**URL:** <https://discuss.elastic.co/t/logstash-plugins-still-displaying-ecs-v8-warnings/324030>\
**Category:** Logstash\
**Created:** [January 26, 2023, 2:37pm UTC](https://discuss.elastic.co/t/logstash-plugins-still-displaying-ecs-v8-warnings/324030 "2023-01-26T14:37:34Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Oddly](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/oddly/32/116433_2.png) [@Oddly](https://discuss.elastic.co/u/Oddly)\
**Post date:** [January 26, 2023, 2:37pm UTC](https://discuss.elastic.co/t/logstash-plugins-still-displaying-ecs-v8-warnings/324030/1 "2023-01-26T14:37:34Z")

</div>

I noticed that several plugins (grok and outputs.elasticsearchmonitoring to name a few) are still displaying warning messages like the following:

`[WARN][logstash.filters.grok][<pipeline_redacted] ECS v8 support is a preview of the unreleased ECS v8, and uses the v1 patterns. When Version 8 of the Elastic Common Schema becomes available, this plugin will need to be updated`

Since we are currently at ECS v8.6, ECS v8.0 became available Februari 2022 and ECS v8 is enabled in Logstash by default , I think we can remove these warnings.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [January 26, 2023, 6:31pm UTC](https://discuss.elastic.co/t/logstash-plugins-still-displaying-ecs-v8-warnings/324030/2 "2023-01-26T18:31:30Z")

</div>

> [@Oddly](#):
>
> we are currently at ECS v8.6

No, the latest release of logstash is 8.6.1, but the latest version of ECS is 8.0.

---

<div class="post-metadata">

**Author:** ![Oddly](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/oddly/32/116433_2.png) [@Oddly](https://discuss.elastic.co/u/Oddly)\
**Post date:** [January 26, 2023, 7:21pm UTC](https://discuss.elastic.co/t/logstash-plugins-still-displaying-ecs-v8-warnings/324030/3 "2023-01-26T19:21:28Z")

</div>

Are these not the release notes of ECS with version numbers?

> **[8.6.0 | Elastic Common Schema (ECS) Reference \[8.6\] | Elastic](https://www.elastic.co/guide/en/ecs/current/ecs-release-notes-8.6.0.html)**

Or did you mean that the version included in Logstash is older than current? If so, can you point me to a place where I can find which version is implemented?

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [January 26, 2023, 8:25pm UTC](https://discuss.elastic.co/t/logstash-plugins-still-displaying-ecs-v8-warnings/324030/4 "2023-01-26T20:25:40Z")

</div>

> [@Oddly](#):
>
> Are these not the release notes of ECS with version numbers?

Yes, you are right. I was mistaken.

---

<div class="post-metadata">

**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\
**Post date:** [January 26, 2023, 10:18pm UTC](https://discuss.elastic.co/t/logstash-plugins-still-displaying-ecs-v8-warnings/324030/5 "2023-01-26T22:18:20Z")

</div>

Badger, you are still right 🙂 In the documentation is 8.6.1, however in config params is v8 like [geoip](https://www.elastic.co/guide/en/logstash/current/plugins-filters-geoip.html#plugins-filters-geoip-ecs_compatibility) or v1 as param for 1.12.  
[RN](https://www.elastic.co/guide/en/ecs/8.6/ecs-release-notes-8.6.0.html) describes changes in 8.x versions. Every new version ECS will add new fields, no dramatic changes.

Oddly, causes of those are warnings are explained [here](https://www.elastic.co/guide/en/logstash/current/plugins-filters-grok.html#plugins-filters-grok-ecs_compatibility)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 23, 2023, 10:18pm UTC](https://discuss.elastic.co/t/logstash-plugins-still-displaying-ecs-v8-warnings/324030/6 "2023-02-23T22:18:24Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.