# Some alert rules are in error after upgrading Kibana from 7.17 to 8.6

**URL:** <https://discuss.elastic.co/t/some-alert-rules-are-in-error-after-upgrading-kibana-from-7-17-to-8-6/325292>\
**Category:** Elastic Observability\
**Tags:** elastic-stack-alerting\
**Created:** [February 10, 2023, 7:54pm UTC](https://discuss.elastic.co/t/some-alert-rules-are-in-error-after-upgrading-kibana-from-7-17-to-8-6/325292 "2023-02-10T19:54:56Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![polyedre](https://avatars.discourse-cdn.com/v4/letter/p/dc4da7/32.png) [@polyedre](https://discuss.elastic.co/u/polyedre)\
**Post date:** [February 10, 2023, 7:54pm UTC](https://discuss.elastic.co/t/some-alert-rules-are-in-error-after-upgrading-kibana-from-7-17-to-8-6/325292/1 "2023-02-10T19:54:56Z")

</div>

Since the upgrade of my ELK stack from 7.17 to 8.6, our alert rules of type "Uptime monitor status", "Log threshold" and "Metric threshold" fail with the following message:

```auto
ResponseError: search_phase_execution_exception: [illegal_argument_exception] Reason: collapse is not supported for the field [kibana.alert.uuid] of the type [text]
 at KibanaTransport.request (/usr/share/kibana/node_modules/@elastic/transport/lib/Transport.js:476:27)
 at runMicrotasks (<anonymous>)
 at processTicksAndRejections (node:internal/process/task_queues:96:5)
 at KibanaTransport.request (/usr/share/kibana/node_modules/@kbn/core-elasticsearch-client-server-internal/target_node/src/create_transport.js:51:16)
 at ClientTraced.SearchApi [as search] (/usr/share/kibana/node_modules/@elastic/elasticsearch/lib/api/api/search.js:66:12)
 at Object.search (/usr/share/kibana/x-pack/plugins/rule_registry/server/rule_data_client/rule_data_client.js:81:18)
 at fetchAlertsForStates (/usr/share/kibana/x-pack/plugins/rule_registry/server/utils/fetch_existing_alerts.js:45:7)
 at async Promise.all (index 0)
 at fetchExistingAlerts (/usr/share/kibana/x-pack/plugins/rule_registry/server/utils/fetch_existing_alerts.js:49:19)
 at Object.executor (/usr/share/kibana/x-pack/plugins/rule_registry/server/utils/create_lifecycle_executor.js:102:20)
 at /usr/share/kibana/x-pack/plugins/alerting/server/task_runner/task_runner.js:226:24
 at TaskRunnerTimer.runWithTimer (/usr/share/kibana/x-pack/plugins/alerting/server/task_runner/task_runner_timer.js:49:20)
 at TaskRunner.runRule (/usr/share/kibana/x-pack/plugins/alerting/server/task_runner/task_runner.js:193:9)
 at TaskRunner.run (/usr/share/kibana/x-pack/plugins/alerting/server/task_runner/task_runner.js:517:49)
 at TaskManagerRunner.run (/usr/share/kibana/x-pack/plugins/task_manager/server/task_running/task_runner.js:266:22)"},"service":{"node":{"roles":["background_tasks","ui"]}},"ecs":{"version":"8.4.0"},"@timestamp":"2023-02-10T19:44:41.289+00:00","message":"Executing Rule default:xpack.uptime.alerts.monitorStatus:5187ec40-a97a-11ed-a3f1-b19cb54a7af3 has resulted in Error: search_phase_execution_exception: [illegal_argument_exception] Reason: collapse is not supported for the field [kibana.alert.uuid] of the type [text], caused by: \"collapse is not supported for the field [kibana.alert.uuid] of the type [text],collapse is not supported for the field [kibana.alert.uuid] of the type [text]\" - ResponseError: search_phase_execution_exception: [illegal_argument_exception] Reason: collapse is not supported for the field [kibana.alert.uuid] of the type [text]
 at KibanaTransport.request (/usr/share/kibana/node_modules/@elastic/transport/lib/Transport.js:476:27)
 at runMicrotasks (<anonymous>)
 at processTicksAndRejections (node:internal/process/task_queues:96:5)
 at KibanaTransport.request (/usr/share/kibana/node_modules/@kbn/core-elasticsearch-client-server-internal/target_node/src/create_transport.js:51:16)
 at ClientTraced.SearchApi [as search] (/usr/share/kibana/node_modules/@elastic/elasticsearch/lib/api/api/search.js:66:12)
 at Object.search (/usr/share/kibana/x-pack/plugins/rule_registry/server/rule_data_client/rule_data_client.js:81:18)
 at fetchAlertsForStates (/usr/share/kibana/x-pack/plugins/rule_registry/server/utils/fetch_existing_alerts.js:45:7)
 at async Promise.all (index 0)
 at fetchExistingAlerts (/usr/share/kibana/x-pack/plugins/rule_registry/server/utils/fetch_existing_alerts.js:49:19)
 at Object.executor (/usr/share/kibana/x-pack/plugins/rule_registry/server/utils/create_lifecycle_executor.js:102:20)
 at /usr/share/kibana/x-pack/plugins/alerting/server/task_runner/task_runner.js:226:24
 at TaskRunnerTimer.runWithTimer (/usr/share/kibana/x-pack/plugins/alerting/server/task_runner/task_runner_timer.js:49:20)
 at TaskRunner.runRule (/usr/share/kibana/x-pack/plugins/alerting/server/task_runner/task_runner.js:193:9)
 at TaskRunner.run (/usr/share/kibana/x-pack/plugins/alerting/server/task_runner/task_runner.js:517:49)
 at TaskManagerRunner.run (/usr/share/kibana/x-pack/plugins/task_manager/server/task_running/task_runner.js:266:22)

```

There is only one node on the cluster.

Can someone explain what is wrong here ?

---

<div class="post-metadata">

**Author:** ![polyedre](https://avatars.discourse-cdn.com/v4/letter/p/dc4da7/32.png) [@polyedre](https://discuss.elastic.co/u/polyedre)\
**Post date:** [February 17, 2023, 6:46pm UTC](https://discuss.elastic.co/t/some-alert-rules-are-in-error-after-upgrading-kibana-from-7-17-to-8-6/325292/2 "2023-02-17T18:46:25Z")

</div>

I spend few hours on this problem. Finally, I recreated the index .internal.alerts-observability.uptime.alerts-default-000001 with the field kibana.alert.uuid of type keyword.