[Kibana7.0.1] Error: "field" is a required parameter is returned when viewing the data in discover tab which is ingested by Machine Learning->Data Visualizer tool

[cheriemilk]

Hi Team,

I ingested data in a csv file by Kibana->Machine Learning->Data Visualizer.

Then I go to discover tab and select index "testbe*" to view data, but I got below error

Discover: "field" is a required parameter

Error: "field" is a required parameter
      FieldParamType.prototype.write@http://localhost:5601/bundles/commons.bundle.js:3:1444004
AggParams.prototype.write/<@http://localhost:5601/bundles/commons.bundle.js:3:398674
AggParams.prototype.write@http://localhost:5601/bundles/commons.bundle.js:3:398628
write@http://localhost:5601/bundles/commons.bundle.js:3:251146
toDsl@http://localhost:5601/bundles/commons.bundle.js:3:252234
toDsl/<@http://localhost:5601/bundles/commons.bundle.js:3:246742
toDsl@http://localhost:5601/bundles/commons.bundle.js:3:246520
_callee8$/<@http://localhost:5601/bundles/kibana.bundle.js:2:2959243
_mergeProp@http://localhost:5601/bundles/commons.bundle.js:3:1342909
ittr@http://localhost:5601/bundles/commons.bundle.js:3:1344198
baseMap/<@http://localhost:5601/built_assets/dlls/vendors.bundle.dll.js:21:24627
createBaseFor/<@http://localhost:5601/built_assets/dlls/vendors.bundle.dll.js:21:35129
baseForOwn@http://localhost:5601/built_assets/dlls/vendors.bundle.dll.js:21:21718
createBaseEach/<@http://localhost:5601/built_assets/dlls/vendors.bundle.dll.js:21:34676
baseMap@http://localhost:5601/built_assets/dlls/vendors.bundle.dll.js:21:24560
map@http://localhost:5601/built_assets/dlls/vendors.bundle.dll.js:21:64545
ittr@http://localhost:5601/bundles/commons.bundle.js:3:1344058
_flatten@http://localhost:5601/bundles/commons.bundle.js:3:1344356
_getFlattenedSource@http://localhost:5601/bundles/commons.bundle.js:3:1361716
before/<@http://localhost:5601/built_assets/dlls/vendors.bundle.dll.js:21:67785
getFetchParams@http://localhost:5601/bundles/commons.bundle.js:3:1359144
Promise.try@http://localhost:5601/bundles/commons.bundle.js:3:1065861
getAllFetchParams/<@http://localhost:5601/bundles/commons.bundle.js:4:322912
Promise.try@http://localhost:5601/bundles/commons.bundle.js:3:1065792
Promise.map/<@http://localhost:5601/bundles/commons.bundle.js:3:1065158
Promise.map@http://localhost:5601/bundles/commons.bundle.js:3:1065119

As above 3 screenshots shows, every step is correct and no error. why there's error when viewing the data in Discover tab?

Thanks,
Cherie

[richcollier]

One thing that is clear from your screenshots is that the @timestamp field from the CSV isn't being properly recognized.

There is a known limitation as to the formats that get recognized. You can see from the docs that the following date formats are supported:

dd/MMM/YYYY:HH:mm:ss Z
EEE MMM dd HH:mm zzz YYYY
EEE MMM dd HH:mm:ss YYYY
EEE MMM dd HH:mm:ss zzz YYYY
EEE MMM dd YYYY HH:mm zzz
EEE MMM dd YYYY HH:mm:ss zzz
EEE, dd MMM YYYY HH:mm Z
EEE, dd MMM YYYY HH:mm ZZ
EEE, dd MMM YYYY HH:mm:ss Z
EEE, dd MMM YYYY HH:mm:ss ZZ
ISO8601
MMM d HH:mm:ss
MMM d HH:mm:ss,SSS
MMM d YYYY HH:mm:ss
MMM dd HH:mm:ss
MMM dd HH:mm:ss,SSS
MMM dd YYYY HH:mm:ss
MMM dd, YYYY h:mm:ss a
TAI64N
UNIX
UNIX_MS
YYYY-MM-dd HH:mm:ss
YYYY-MM-dd HH:mm:ss,SSS
YYYY-MM-dd HH:mm:ss,SSS Z

Your timestamp format in your file looks like September 6th, 2019 07:46:32.940. Unfortunately, that's not one of the formats and Java doesn't support time formats with days with th , nd , st , rd on the end.

You can see that the @timestamp is just being treated as a keyword type - which is not what you want.

So, you'll need to modify your input file and change the format of your time stamp field so that it conforms to one of the supported formats.

Version 7.3 is more flexible - allowing for custom time stamp formats (however, still doesn't support those that have days with th , nd , st , rd on the end.)