Spammed by deprication warnings on scripted fields

Elastic Stack Kibana
1

We' getting spammed in kibana dashboards with following deprecation messages

Warning: 299 Elasticsearch-7.15.0-79d65f6e357953a5b3cbcc5e2c7c21073d89aa29 "[script][1:1019] Deprecated field [inline] used, expected [source] instead", 299 Elasticsearch-7.15.0-79d65f6e357953a5b3cbcc5e2c7c21073d89aa29 "Use of the joda time method [getMillis()] is deprecated. Use [toInstant().toEpochMilli()] instead."
It seems to popup for each search request done by the deadhboard.

We figure these two are related to a scripted field we've implemented to get the local time in hours

LocalDateTime.ofInstant(Instant.ofEpochMilli(doc['@timestamp'].value.millis), ZoneId.of('Europe/Paris')).getHour()

We expected this would go away using LocalDateTime.ofInstant(Instant.ofEpochMilli(doc['@timestamp'].value.toInstant().toEpochMilli()),ZoneId.of('Europe/Paris')).getHour() instead, but the deprication warning keeps making the dashboards unusable.

Any tips on how to resolve this?

The Deprecated field [inline] used, expected [source] instead we have no clue what to do with... any tips on this is also apreciated

2

Hi flalar!

Two questions:

  1. With the change to the script are you only receiving
    Deprecated field [inline] used, expected [source] instead
    deprecation warning now? Or are you still seeing both deprecation messages?

  2. Is your Kibana version older than 7.15?

-- Jack

3
  1. I can confirm both deprication warnings are showing after updating the scripts.
  2. Complete stack updated to 7.15. This is when the deprication warnings started getting very bad
4

Hi flalar,

I tried the specified scripts using the dev tools console in Kibana. Note I replaced @timestamp with dt in this test. I ran the following:

PUT /my-index-test
{
  "mappings": {
    "properties": {
      "dt": {
        "type": "date"
      }
    }
  }
}

POST /_scripts/painless/_execute
{
  "script": {
    "inline": "LocalDateTime.ofInstant(
                       Instant.ofEpochMilli(doc['dt'].value.millis), 
                       ZoneId.of('Europe/Paris')).getHour()"
  },
  "context": "score",
  "context_setup": {
    "index": "my-index-test",
    "document": {
      "dt": 1633563238
    }
  }
}

This gives me two deprecation warnings and the result as the following:

#! [script][3:15] Deprecated field [inline] used, 
                  expected [source] instead
#! Use of the joda time method [getMillis()] is deprecated. 
   Use [toInstant().toEpochMilli()] instead.
{
  "result" : 22.0
}

I modified this where I changed inline to source as part of the script DSL structure and used the second specified script.

POST /_scripts/painless/_execute
{
  "script": {
    "source": "LocalDateTime.ofInstant(
                       Instant.ofEpochMilli(
                       doc['dt'].value.toInstant().toEpochMilli()), 
                       ZoneId.of('Europe/Paris')).getHour()"
  },
  "context": "score",
  "context_setup": {
    "index": "my-index-test",
    "document": {
      "dt": 1633563238
    }
  }
}

This removes both deprecations and gives the following result:

{
  "result" : 22.0
}

Is it possible there are other scripts that could causing the deprecation warnings to appear or that your script wasn't updated as part of the visualization?

--Jack

5

Thanks for your reply @Jack_Conradson

We are basic users of Elastic stack so I assume the dashboards have been built and then the scripted field has been added to provide an option to split the chars and segment the data on hourly basis. This has all been done through standard Kibana interface, no custom query scripting. Dashboard is using some saved queries though... Might that be the reason shomehow?

Tried to delete the scripted field and then the warinings went away, then I created it again with the updated script and now both errors were back :thinking:

I saw a notice that scripted fields in general was depricated as well, so will give runtime fields a go as that should provide the same functionality

6

Converting the scripted field to a runtime field and applying that to all indexes, then updating the dashboards to use that and lastly removing the scripted field did the trick.

Thanks your input @Jack_Conradson

7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.