5.1.1: Discover error

[dawiro]

Hi,
I'm getting errors in kibana after configuring against new elasticsearch 5.1.1 cluster:

Saved "field" parameter is now invalid. Please select a new field.
Discover: "field" is a required parameter

The only data being indexed to elasticsearch atm is logstash heartbeat data...

Regards,
David

[jbudz (Jon Budzenski)]

This looks like it's a bug, we have an open issue for it here. Do you have any other index patterns in kibana? Are you using a template with your elasticsearch output?

[Sushil_Singh1 (Sushil Singh)]

Hi,

I'm also getting same error.
Elasticsearch and kibana latest (5.1.1) downloaded and installed as per docs.

[dawiro]

Hi,
I have only one index pattern and yes, am using a template for our logs.

Regards,
David

[dawiro]

What may be a factor here is that we are using the mapper-size plugin. So, each document is being indexed with an '_size' field. Kibana sees this as type 'unknown' and so i presume that is the trigger for what I'm seeing?

[dawiro]

Hi,
I think I've resolved this. I had fields in my template, including @timestamp which were set to:

"index" : "not_analyzed"

Reading the 5.x docs more closely i realised that while types have changed to mapping definitions for field analysis have changed as a result. So, changing that to true, ensuring that string type mapping were set correctly (keyword/text) and then recreating the index and kibana index pattern allowed the discover interface to start working.