Save field parameter is not valid

Elastic Stack Beats
1

I am using elk 6.3
i have downloaded dashboard to test environment and i get save field parameter is not valid throws .

I checked the individual visualization and actual field name is not listed.
issue is in index patterns all fields have duplicates with suffix keyword
for eg
it has

beat.name => string , searchable
beat.name.keywork => string , searchable, aggregatable

due to this existing visualization are invalid as aggregate field beat.name in dashboard is not valid now and only you can use beat.name.keyword in aggregation .

How can i resolve this ? recreated index patterns still have same issue

2

hi @vijay_kaali, what version of beat are you running in this case? When you mean you downloaded the dashboard, what were the steps? Is this a built in dashboard or a custom one?
Also is the actual message "Saved "field" parameter is now invalid. " instead of " Save field parameter is not valid"?
Can you just replace beat.name with beat.name.keyword in the visualization? Does this fix the issue for you? If so, you can update the visualization as a workaround.

3

i solved my modifying my index template .

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.