# Sample Dashboards broken with ES 5.2

**URL:** <https://discuss.elastic.co/t/sample-dashboards-broken-with-es-5-2/73854>\
**Category:** Beats\
**Tags:** winlogbeat\
**Created:** [February 3, 2017, 1:10pm UTC](https://discuss.elastic.co/t/sample-dashboards-broken-with-es-5-2/73854 "2017-02-03T13:10:46Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![jochen\_st](https://avatars.discourse-cdn.com/v4/letter/j/c0e974/32.png) [@jochen\_st](https://discuss.elastic.co/u/jochen_st)\
**Post date:** [February 3, 2017, 1:10pm UTC](https://discuss.elastic.co/t/sample-dashboards-broken-with-es-5-2/73854/1 "2017-02-03T13:10:46Z")

</div>

After upgradeing KIbana and Elasticsearch 5.2 from 5.1.2, the sample winlogbeat dashboards / visualizations provided from [https://artifacts.elastic.co/downloads/beats/beats-dashboards/beats-dashboards-5.1.2.zip](https://artifacts.elastic.co/downloads/beats/beats-dashboards/beats-dashboards-5.1.2.zip) do not work anymore.

Kibana displays the following error:

```
Error: [illegal_argument_exception] [terms] exclude doesn't support values of type: START_OBJECT
ErrorAbstract@http://andrews.el.wdw-elab.de:5601/bundles/kibana.bundle.js?v=14695:13:30086
StatusCodeError@http://andrews.el.wdw-elab.de:5601/bundles/kibana.bundle.js?v=14695:14:571
respond@http://andrews.el.wdw-elab.de:5601/bundles/kibana.bundle.js?v=14695:14:6928
checkRespForFailure@http://andrews.el.wdw-elab.de:5601/bundles/kibana.bundle.js?v=14695:14:6156
AngularConnector.prototype.request/<@http://andrews.el.wdw-elab.de:5601/bundles/kibana.bundle.js?v=14695:1:24745
processQueue@http://andrews.el.wdw-elab.de:5601/bundles/commons.bundle.js?v=14695:38:23621
scheduleProcessQueue/<@http://andrews.el.wdw-elab.de:5601/bundles/commons.bundle.js?v=14695:38:23888
$RootScopeProvider/this.$get</Scope.prototype.$eval@http://andrews.el.wdw-elab.de:5601/bundles/commons.bundle.js?v=14695:39:4607
$RootScopeProvider/this.$get</Scope.prototype.$digest@http://andrews.el.wdw-elab.de:5601/bundles/commons.bundle.js?v=14695:39:2343
$RootScopeProvider/this.$get</Scope.prototype.$apply@http://andrews.el.wdw-elab.de:5601/bundles/commons.bundle.js?v=14695:39:5026
done@http://andrews.el.wdw-elab.de:5601/bundles/commons.bundle.js?v=14695:37:25016
completeRequest@http://andrews.el.wdw-elab.de:5601/bundles/commons.bundle.js?v=14695:37:28702
createHttpBackend/</xhr.onload@http://andrews.el.wdw-elab.de:5601/bundles/commons.bundle.js?v=14695:37:29634

```

It looks like the query part from visualization Event-Levels is no longer compatible:

```
"aggs": {
"2": {
  "terms": {
    "field": "source_name",
    "exclude": {
      "pattern": "\"\""
    },
    "size": 7,
    "order": {
      "_count": "desc"
    }
  }

```

Downloading and installing the latest beats-dashboards-5.2.0.zip did not help either.

Kindly suggest. Regards  
Jochen

---

<div class="post-metadata">

**Author:** ![jochen\_st](https://avatars.discourse-cdn.com/v4/letter/j/c0e974/32.png) [@jochen\_st](https://discuss.elastic.co/u/jochen_st)\
**Post date:** [February 6, 2017, 8:24am UTC](https://discuss.elastic.co/t/sample-dashboards-broken-with-es-5-2/73854/2 "2017-02-06T08:24:32Z")

</div>

Issue seems to be caused by [https://github.com/elastic/elasticsearch/issues/22933](https://github.com/elastic/elasticsearch/issues/22933)

Fix is to replace

```
"exclude": {"pattern": "\"\""},

```

with

```
"exclude": "\"\"",

```

in the affeccted visualisations (Event-Levels.json and Evolution-of-the-CPU-times-per-process.json)

---

<div class="post-metadata">

**Author:** ![monica](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/monica/32/3696_2.png) [@monica](https://discuss.elastic.co/u/monica)\
**Post date:** [February 6, 2017, 8:43am UTC](https://discuss.elastic.co/t/sample-dashboards-broken-with-es-5-2/73854/3 "2017-02-06T08:43:42Z")

</div>

Thank you for investigating the problem. We were also able to reproduce it for Winlogbeat. Can you please open an issue in [GitHub](https://github.com/elastic/beats/issues) as this will affect all 5.2 releases?

---

<div class="post-metadata">

**Author:** ![jochen\_st](https://avatars.discourse-cdn.com/v4/letter/j/c0e974/32.png) [@jochen\_st](https://discuss.elastic.co/u/jochen_st)\
**Post date:** [February 6, 2017, 8:54am UTC](https://discuss.elastic.co/t/sample-dashboards-broken-with-es-5-2/73854/4 "2017-02-06T08:54:50Z")

</div>

opened [https://github.com/elastic/beats/issues/3533](https://github.com/elastic/beats/issues/3533), thank you @monica

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 6, 2017, 8:55am UTC](https://discuss.elastic.co/t/sample-dashboards-broken-with-es-5-2/73854/5 "2017-03-06T08:55:30Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.