# Kibana : field event\_id not available in bucket (from winlogbeat) **URL:** \ **Category:** Kibana\ **Created:** [April 20, 2020, 9:38am UTC](https://discuss.elastic.co/t/kibana-field-event-id-not-available-in-bucket-from-winlogbeat/228828 "2020-04-20T09:38:27Z")\ **Posts on this page:** 1\ **Showing post:** 2
**Author:** ![dosant](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/dosant/32/64489_2.png) [@dosant](https://discuss.elastic.co/u/dosant)\ **Post date:** [April 20, 2020, 10:31am UTC](https://discuss.elastic.co/t/kibana-field-event-id-not-available-in-bucket-from-winlogbeat/228828/2 "2020-04-20T10:31:43Z")
Hi @icirco, Could it be that `eventId` field is not `aggregatable`? To be able to make visualisations on it, you have to make sure it is `aggregatable`. You could check that in `Management -> Index Patterns` section If this is the case, here are useful threads on "how to make a field aggregatable": > [@How to make a field aggregatable in Kibana](https://discuss.elastic.co/t/how-to-make-a-field-aggregatable-in-kibana/90470): > > I am running the latest versions of Kibana, Logstash and Elasticsearch. I am unsure how to make my logMessage field aggregatable. I have searched on the forums for a solid answer but can't seem to find a definitive one. Here is my mappings. [image] "mappings": { "prnformat": { "properties":{ "@timestamp": { "type": "date", "format": "strict\_date\_optional\_time||epoch\_millis" }, "hostName": { "type": "string", "index": "not\_analyzed" }, "processName"… > [@Unable to make a field aggregatable in kibana](https://discuss.elastic.co/t/unable-to-make-a-field-aggregatable-in-kibana/161912): > > I have a field called "message" . I need to make it as aggregatable. I am unable to do so . Can someone please suggest how to achieve that. [Capture\_kibana\_aggregation] Hope this is helpful. --- _[View the full topic](https://discuss.elastic.co/t/kibana-field-event-id-not-available-in-bucket-from-winlogbeat/228828)._