# Kibana : field event\_id not available in bucket (from winlogbeat)

**URL:** <https://discuss.elastic.co/t/kibana-field-event-id-not-available-in-bucket-from-winlogbeat/228828>\
**Category:** Kibana\
**Created:** [April 20, 2020, 9:38am UTC](https://discuss.elastic.co/t/kibana-field-event-id-not-available-in-bucket-from-winlogbeat/228828 "2020-04-20T09:38:27Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![icirco](https://avatars.discourse-cdn.com/v4/letter/i/dec6dc/32.png) [@icirco](https://discuss.elastic.co/u/icirco)\
**Post date:** [April 20, 2020, 9:38am UTC](https://discuss.elastic.co/t/kibana-field-event-id-not-available-in-bucket-from-winlogbeat/228828/1 "2020-04-20T09:38:27Z")

</div>

hello,  
I try to create a graph but field is not available in the field section... I use winlogbeat (7.4) and I would like to count some specific event\_id

![image](https://us1.discourse-cdn.com/elastic/original/3X/9/8/980aacd43fd8cc93b1d6d9d952fde46d68c95083.png)

---

<div class="post-metadata">

**Author:** ![dosant](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dosant/32/64489_2.png) [@dosant](https://discuss.elastic.co/u/dosant)\
**Post date:** [April 20, 2020, 10:31am UTC](https://discuss.elastic.co/t/kibana-field-event-id-not-available-in-bucket-from-winlogbeat/228828/2 "2020-04-20T10:31:43Z")

</div>

Hi @icirco,

Could it be that `eventId` field is not `aggregatable`?  
To be able to make visualisations on it, you have to make sure it is `aggregatable`.

You could check that in `Management -> Index Patterns` section

If this is the case, here are useful threads on "how to make a field aggregatable":

> [@How to make a field aggregatable in Kibana](https://discuss.elastic.co/t/how-to-make-a-field-aggregatable-in-kibana/90470):
>
> I am running the latest versions of Kibana, Logstash and Elasticsearch. I am unsure how to make my logMessage field aggregatable. I have searched on the forums for a solid answer but can't seem to find a definitive one. Here is my mappings. [image] "mappings": { "prnformat": { "properties":{ "@timestamp": { "type": "date", "format": "strict\_date\_optional\_time||epoch\_millis" }, "hostName": { "type": "string", "index": "not\_analyzed" }, "processName"…

> [@Unable to make a field aggregatable in kibana](https://discuss.elastic.co/t/unable-to-make-a-field-aggregatable-in-kibana/161912):
>
> I have a field called "message" . I need to make it as aggregatable. I am unable to do so . Can someone please suggest how to achieve that. [Capture\_kibana\_aggregation]

Hope this is helpful.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 18, 2020, 10:31am UTC](https://discuss.elastic.co/t/kibana-field-event-id-not-available-in-bucket-from-winlogbeat/228828/3 "2020-05-18T10:31:53Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.