Minimal interval = auto error


I am ingesting Cisco ASA logs via filebeats to logstash. I am now trying to convert the ASA Dashboard to my index. The format is in ECS and if I have modified the ASA querys to use my Index.

Issue is now the visualizations error, the error is related to the minimal interval been set to auto, if i edit the minimal interval i cannot see auto as an option, selecting a period of time such as a month it works.

Any ideas why i am getting this? If it helps i have only just got the logstash parsing correctly in the past 30 minutes or so, i have set the search period to only 15 minutes.

This is the error that appears (well part if it)
{"type":"illegal_argument_exception","reason":"Invalid interval specified, must be non-null and non-empty"}},

The "auto" interval can only be used for the default time field of the index pattern. Make sure the index pattern use are using for your visualization has the field your are using for the date histogram on your x axis set as default time field.

Perfect thank you, in the testing phase and didnt pay enough attention when setting up the index pattern. All working now.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.