LogsUI in kibana 7.4.0 getting error when trying to look at the logs with date_nanos

[Alex-St (Alex Strigelskiy)]

open logs UI - configure to use SourceTime which is in date_nanos instead of @timestamp field, logsUI tries to load data for several seconds, then displays graphics on the left side (timeline), and briefly shows the logs, but almost immediately causes the following error:

Invariant Violation: Minified React error #185; visit https://reactjs.org/docs/error-decoder.html?invariant=185 for the full message or use the non-minified dev environment for full errors and additional helpful warnings.
at ba (http://somehost:5601/built_assets/dlls/vendors.bundle.dll.js:200:315)
at x (http://somehost:5601/built_assets/dlls/vendors.bundle.dll.js:200:584)
at qf (http://somehost:5601/built_assets/dlls/vendors.bundle.dll.js:200:96685)
at Object.enqueueSetState (http://somehost:5601/built_assets/dlls/vendors.bundle.dll.js:200:48105)
at DatePicker.E.setState (http://somehost:5601/built_assets/dlls/vendors.bundle.dll.js:192:1610)
at DatePicker.componentDidUpdate (http://somehost:5601/built_assets/dlls/vendors.bundle.dll.js:184:64661)
at Vh (http://somehost:5601/built_assets/dlls/vendors.bundle.dll.js:200:85102)
at Zh (http://somehost:5601/built_assets/dlls/vendors.bundle.dll.js:200:86620)
at http://somehost:5601/built_assets/dlls/vendors.bundle.dll.js:200:99742
at Object.exports.unstable_runWithPriority (http://somehost:5601/built_assets/dlls/vendors.bundle.dll.js:151:3314)

[weltenwort (Felix Stürmer)]

Hi @Alex-St,

thanks for pointing that out. The Logs UI currently requires the documents to adhere to ECS, which specifies the @timestamp field to be a date. I'll investigate whether supporting date_nano would be feasible.

(From the stack trace it looks like the datepicker causes the failure.)

[Alex-St (Alex Strigelskiy)]

I see. I like the idea of ECS and will put it on the roadmap. However, I am not convinced that if I switch to @timestamp now and keep date_nanos format will fix LogsUI for me. It look like the LogsUI allows user to select a different field as input and is trying to display something on the time graph, it fails a little bit after that. I am thinking that this is related to the date_nanos which is relatively new feature and still not very stable.

[weltenwort (Felix Stürmer)]

Indeed, the date_nanos type is not yet universally supported throughout the stack. If you already ingest your data in nanosecond resolution I would recommend to keep doing that in a dedicated field and duplicate the value with a millisecond resolution in the @timestamp field. That way you might be able to reindex or alias historical data more easily once the high-resolution timestamp is supported everywhere.