EQL throws number_format_exception when using fields API #74582
Description
Elasticsearch version (bin/elasticsearch --version):
8.0.0 (master)
Plugins installed: []
None
JVM version (java -version):
openjdk version "11.0.2" 2019-01-15
OpenJDK Runtime Environment 18.9 (build 11.0.2+9)
OpenJDK 64-Bit Server VM 18.9 (build 11.0.2+9, mixed mode)
OS version (uname -a if on a Unix-like system):
Darwin MacBook-Pro.local 20.5.0 Darwin Kernel Version 20.5.0: Sat May 8 05:10:33 PDT 2021; root:xnu-7195.121.3~9/RELEASE_X86_64 x86_64
Description of the problem including expected versus actual behavior:
When using the fields request API with EQL, it throws a "number_format_exception"
Steps to reproduce:
- Go to dev tools and create and index and document which has a
@timestampwhich is ISO8601. - Query it like below. I have a
host.namefromauditbeatbut anything should work:
POST /auditbeat-8.0.0/_eql/search?allow_no_indices=true
{
"size": 100,
"query": "sequence by host.name [any where true] [any where true]",
"fields": [
{
"field": "*"
}
]
}See this error
{
"error" : {
"root_cause" : [
{
"type" : "number_format_exception",
"reason" : "For input string: \"2021-06-24T21:17:01.661Z\""
}
],
"type" : "number_format_exception",
"reason" : "For input string: \"2021-06-24T21:17:01.661Z\""
},
"status" : 400
}Workaround is to specify that your @timestamp is epoch_millis:
POST /auditbeat-8.0.0/_eql/search?allow_no_indices=true
{
"size": 100,
"query": "sequence by host.name [any where true] [any where true]",
"fields": [
{
"field": "*"
},
{
"field": "@timestamp",
"format": "epoch_millis"
}
]
}Careful though as fields returns epoch_millis as a string and not a number. However, it does this for all queries and not just EQL. That might be just a different bug or intentional.
"fields" : {
"@timestamp" : [
"1622743523778"
]
}