Refresh doesn't help with question marks

Elastic Stack Kibana
1

I renamed winlogbeat fields in logstash

filter {
    if [event_id] == 4624 {
      # https://github.com/MicrosoftDocs/windows-itpro- 
  docs/blob/master/windows/security/threat-protection/auditing/event-4624.md
          mutate {
            rename => {
              "[event_data][SubjectUserSid]" => "user_reporter_sid"
              "[event_data][SubjectUserName]" => "user_reporter_name"
              "[event_data][SubjectDomainName]" => "user_reporter_domain"
              "[event_data][SubjectLogonId]" => "reporter_logon_id"
              "[event_data][TargetLogonId]" => "user_logon_id"
              "[event_data][LogonType]" => "logon_type"

***Roberto Rodriguez is the man!!!!! @ Cyb3rWard0g

Buuuuut I keep getting ? in Kibana for the renamed fields

image
image.png769×305 21.3 KB

No matter how many times I refresh ...
image

Anything I can do... thanks!

2

Close it... way too impatient sometimes.

Thanks!