# Discover: "field" is a required parameter

**URL:** <https://discuss.elastic.co/t/discover-field-is-a-required-parameter/90146>\
**Category:** Kibana\
**Created:** [June 20, 2017, 7:03pm UTC](https://discuss.elastic.co/t/discover-field-is-a-required-parameter/90146 "2017-06-20T19:03:52Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![DanMa](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/danma/32/18970_2.png) [@DanMa](https://discuss.elastic.co/u/DanMa)\
**Post date:** [June 20, 2017, 7:03pm UTC](https://discuss.elastic.co/t/discover-field-is-a-required-parameter/90146/1 "2017-06-20T19:03:52Z")

</div>

Hello,

i want to see my logs, but i get everytime this messages:

 ![](https://us1.discourse-cdn.com/elastic/original/3X/5/e/5ed90f9285229fe6d3676ab679739755206a3fb1.png)

Perhaps my filter clearifies it?

```
filter {
      if [type] == "cisco-asa" {
         grok {
          match => ["message", "%{CISCO_TAGGED_SYSLOG} %{GREEDYDATA:cisco_message}"]
        }

         syslog_pri { }

         date {
          match => ["timestamp",
            "MMM dd HH:mm:ss",
            "MMM d HH:mm:ss",
            "MMM dd yyyy HH:mm:ss",
            "MMM d yyyy HH:mm:ss"
          ]
          timezone => "Europe/Berlin"
        }

         if "_grokparsefailure" not in [tags] {
          mutate {
            rename => ["cisco_message", "message"]
            remove_field => ["timestamp"]
          }
        }

         grok {
          match => [
            "message", "%{CISCOFW106001}",
            "message", "%{CISCOFW106006_106007_106010}",
            "message", "%{CISCOFW106014}",
            "message", "%{CISCOFW106015}",
            "message", "%{CISCOFW106021}",
            "message", "%{CISCOFW106023}",
            "message", "%{CISCOFW106100}",
            "message", "%{CISCOFW110002}",
            "message", "%{CISCOFW302010}",
            "message", "%{CISCOFW302013_302014_302015_302016}",
            "message", "%{CISCOFW302020_302021}",
            "message", "%{CISCOFW305011}",
            "message", "%{CISCOFW313001_313004_313008}",
            "message", "%{CISCOFW313005}",
            "message", "%{CISCOFW402117}",
            "message", "%{CISCOFW402119}",
            "message", "%{CISCOFW419001}",
            "message", "%{CISCOFW419002}",
            "message", "%{CISCOFW500004}",
            "message", "%{CISCOFW602303_602304}",
            "message", "%{CISCOFW710001_710002_710003_710005_710006}",
            "message", "%{CISCOFW713172}",
            "message", "%{CISCOFW733100}"
          ]
        }
      }
    }

```

I hope anyone has a idea to fix it. 🙂

Best Regards

Daniel

---

<div class="post-metadata">

**Author:** ![bhavyarm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/bhavyarm/32/22392_2.png) [@bhavyarm](https://discuss.elastic.co/u/bhavyarm)\
**Post date:** [June 20, 2017, 8:02pm UTC](https://discuss.elastic.co/t/discover-field-is-a-required-parameter/90146/2 "2017-06-20T20:02:18Z")

</div>

Hi Daniel,

what happens if you click ok on the error? Also can you go to management and click refresh on this index pattern's page?

Thanks,  
Bhavya

---

<div class="post-metadata">

**Author:** ![DanMa](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/danma/32/18970_2.png) [@DanMa](https://discuss.elastic.co/u/DanMa)\
**Post date:** [June 21, 2017, 5:09am UTC](https://discuss.elastic.co/t/discover-field-is-a-required-parameter/90146/3 "2017-06-21T05:09:27Z")

</div>

Hey Bhavya,

nothing happens if i click on one of the failure banners.

I've already removed and recreated all stored index patterns in Kibana.😕

And i've already stopped logstash deleted all elasticsearch (Logstash and Kibana) indices and started logstash again which collects the syslog messages.

If i click on the one selected predefined field \_source then i get this message:  
 ![](https://us1.discourse-cdn.com/elastic/original/3X/9/b/9bdb95a9ac2d3c364ce0f5ce366f39207991f3db.png)

Best Regards

Daniel

---

<div class="post-metadata">

**Author:** ![DanMa](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/danma/32/18970_2.png) [@DanMa](https://discuss.elastic.co/u/DanMa)\
**Post date:** [June 22, 2017, 7:24am UTC](https://discuss.elastic.co/t/discover-field-is-a-required-parameter/90146/4 "2017-06-22T07:24:00Z")

</div>

Has nobody a idea?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 20, 2017, 7:24am UTC](https://discuss.elastic.co/t/discover-field-is-a-required-parameter/90146/5 "2017-07-20T07:24:01Z")

</div>

Closed on July 20, 2017, 7:24am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.