Kibana : field event_id not available in bucket (from winlogbeat)

Elastic Stack Kibana
2

Hi @icirco,

Could it be that eventId field is not aggregatable?
To be able to make visualisations on it, you have to make sure it is aggregatable.

You could check that in Management -> Index Patterns section

If this is the case, here are useful threads on "how to make a field aggregatable":

Hope this is helpful.