Kibana : field event_id not available in bucket (from winlogbeat)

Elastic Stack Kibana
1

hello,
I try to create a graph but field is not available in the field section... I use winlogbeat (7.4) and I would like to count some specific event_id

image

2

Hi @icirco,

Could it be that eventId field is not aggregatable?
To be able to make visualisations on it, you have to make sure it is aggregatable.

You could check that in Management -> Index Patterns section

If this is the case, here are useful threads on "how to make a field aggregatable":

Hope this is helpful.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.