5.1.1: Discover error


I'm getting errors in kibana after configuring against new elasticsearch 5.1.1 cluster:

Saved "field" parameter is now invalid. Please select a new field.
Discover: "field" is a required parameter

The only data being indexed to elasticsearch atm is logstash heartbeat data...


(Jon Budzenski) #2

This looks like it's a bug, we have an open issue for it here. Do you have any other index patterns in kibana? Are you using a template with your elasticsearch output?

(Sushil Singh) #3


I'm also getting same error.
Elasticsearch and kibana latest (5.1.1) downloaded and installed as per docs.


I have only one index pattern and yes, am using a template for our logs.



What may be a factor here is that we are using the mapper-size plugin. So, each document is being indexed with an '_size' field. Kibana sees this as type 'unknown' and so i presume that is the trigger for what I'm seeing?


I think I've resolved this. I had fields in my template, including @timestamp which were set to:

"index" : "not_analyzed"

Reading the 5.x docs more closely i realised that while types have changed to mapping definitions for field analysis have changed as a result. So, changing that to true, ensuring that string type mapping were set correctly (keyword/text) and then recreating the index and kibana index pattern allowed the discover interface to start working.

(system) #7

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.