# SlowLogs Info Missing in 8.6 - "event.duration"

**URL:** <https://discuss.elastic.co/t/slowlogs-info-missing-in-8-6-event-duration/329040>\
**Category:** Elastic Observability\
**Created:** [March 31, 2023, 10:43am UTC](https://discuss.elastic.co/t/slowlogs-info-missing-in-8-6-event-duration/329040 "2023-03-31T10:43:32Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![moni15moni](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/moni15moni/32/42311_2.png) [@moni15moni](https://discuss.elastic.co/u/moni15moni)\
**Post date:** [March 31, 2023, 10:43am UTC](https://discuss.elastic.co/t/slowlogs-info-missing-in-8-6-event-duration/329040/1 "2023-03-31T10:43:32Z")

</div>

Hi Team,

Previously we used elasticcloud 7.17 , where we configured the observability in the different es cluster (7.17), When the slow logs are triggered the following events are captured in the slowllog.

```auto

"event": {
            "duration": 5000000,
            "ingested": "2023-03-31T10:03:19.695789547Z",
            "created": "2023-03-31T10:03:14.491Z",
            "kind": "event",
            "module": "elasticsearch",
            "category": "database",
            "type": "info",
            "dataset": "elasticsearch.slowlog"
          }

```

After upgrading both data and observability to 8.6 the "event.duration" is missing in the new version, We used this to create the Rules for the threshold. Now it's missing in 8.6  
Any one aware on this.

```auto
  "event": {
            "ingested": "2023-03-31T08:50:16.295839879Z",
            "created": "2023-03-31T08:50:10.291Z",
            "kind": "event",
            "module": "elasticsearch",
            "category": "database",
            "type": "info",
            "dataset": "elasticsearch.slowlog"
          }

```

---

<div class="post-metadata">

**Author:** ![coenwarmer](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/coenwarmer/32/110063_2.png) [@coenwarmer](https://discuss.elastic.co/u/coenwarmer)\
**Post date:** [March 31, 2023, 12:47pm UTC](https://discuss.elastic.co/t/slowlogs-info-missing-in-8-6-event-duration/329040/2 "2023-03-31T12:47:50Z")

</div>

Hey there,

Just wanted to verify: you are using the Log Threshold rule?

---

<div class="post-metadata">

**Author:** ![moni15moni](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/moni15moni/32/42311_2.png) [@moni15moni](https://discuss.elastic.co/u/moni15moni)\
**Post date:** [March 31, 2023, 2:01pm UTC](https://discuss.elastic.co/t/slowlogs-info-missing-in-8-6-event-duration/329040/3 "2023-03-31T14:01:34Z")

</div>

Hi @coenwarmer I am using metric threshold ,

the issue here is the "event.duration" is not indexed with the elastic-cloud-logs-8 index.

To use it in metric aggregation it should be integer to perform aggregation on a number .

I have added the screenshot which we are using in 7.17 rule config

 ![Screenshot 2023-03-31 192817](https://us1.discourse-cdn.com/elastic/original/3X/2/6/2672a4be8f241344368fa39e09a66c6677678623.png)

---

<div class="post-metadata">

**Author:** ![coenwarmer](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/coenwarmer/32/110063_2.png) [@coenwarmer](https://discuss.elastic.co/u/coenwarmer)\
**Post date:** [April 3, 2023, 9:24am UTC](https://discuss.elastic.co/t/slowlogs-info-missing-in-8-6-event-duration/329040/4 "2023-04-03T09:24:32Z")

</div>

Hey there,

I'm still investigating this for you, thank you for your patience.

Best,

Coen

---

<div class="post-metadata">

**Author:** ![moni15moni](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/moni15moni/32/42311_2.png) [@moni15moni](https://discuss.elastic.co/u/moni15moni)\
**Post date:** [April 4, 2023, 10:51am UTC](https://discuss.elastic.co/t/slowlogs-info-missing-in-8-6-event-duration/329040/5 "2023-04-04T10:51:53Z")

</div>

@coenwarmer Thanks for looking this.

---

<div class="post-metadata">

**Author:** ![moni15moni](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/moni15moni/32/42311_2.png) [@moni15moni](https://discuss.elastic.co/u/moni15moni)\
**Post date:** [April 24, 2023, 2:52pm UTC](https://discuss.elastic.co/t/slowlogs-info-missing-in-8-6-event-duration/329040/6 "2023-04-24T14:52:08Z")

</div>

@coenwarmer Please share if you have any updates