"Saved 'field' parameter is now invalid" for SSH login attempts


(Josef Norlin) #1

Hi,

I'm very new to ELK and followed this guide:

It all went relatively smooth until I got the stack running. The imported dashboards is not working. I get the logs but all the preloaded dashboards give me a: "Saved 'field' parameter is now invalid" error.

The logs are there but the dashboards are not working. Have I imported a old versions of dashboards? How to remove and install new ones?

Or how do I proceed otherwise?

I've recently updated everything to the latest version. 6.5.1. Running on Ubuntu 18.04.


(Noémi Ványi) #2

There is an open issue with this problem: https://github.com/elastic/beats/issues/6489

I have found a possible workaround on the forum:


(Josef Norlin) #3

Thanks. But I only have filebeat, not metricbeat. Can I do the same procedure for filebeat? And if so, how?


(Josef Norlin) #4

I deleted the indexes from filebeat using curl -XDELETE http://localhost:9200/*

Then I loaded the template again:
sudo filebeat setup --template -E output.logstash.enabled=false -E 'output.elasticsearch.hosts=["localhost:9200"]'

And then finally loaded dashboards again with
sudo filebeat setup -e -E output.logstash.enabled=false -E output.elasticsearch.hosts=['localhost:9200'] -E setup.kibana.host=localhost:5601

That solved it. However, now I only get new logs (created after I created the new indexes. How do I fix that?