I'm getting errors in kibana after configuring against new elasticsearch 5.1.1 cluster:
Saved "field" parameter is now invalid. Please select a new field.
Discover: "field" is a required parameter
The only data being indexed to elasticsearch atm is logstash heartbeat data...
This looks like it's a bug, we have an open issue for it here. Do you have any other index patterns in kibana? Are you using a template with your elasticsearch output?
I'm also getting same error.
Elasticsearch and kibana latest (5.1.1) downloaded and installed as per docs.
I have only one index pattern and yes, am using a template for our logs.
What may be a factor here is that we are using the mapper-size plugin. So, each document is being indexed with an '_size' field. Kibana sees this as type 'unknown' and so i presume that is the trigger for what I'm seeing?
I think I've resolved this. I had fields in my template, including @timestamp which were set to:
"index" : "not_analyzed"
Reading the 5.x docs more closely i realised that while types have changed to mapping definitions for field analysis have changed as a result. So, changing that to true, ensuring that string type mapping were set correctly (keyword/text) and then recreating the index and kibana index pattern allowed the discover interface to start working.
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.