I am using Dockerized Elastic (v 6.6.0) for my use and everything was working fine until I ran into this new problem. After looking at the same error in various forums I am yet to solve this issue. I am running Filebeat, Logstash and Elasticsearch. I enabled system module in filebeat to index them in ES and visualise in Kibana. I followed the recommended steps of loading the pipeline.json in ingest node of ES, setting up dashboard templates in kibana before I modified my filebeat.yml to output to Logstash. On running the docker-compose, I can see the logs correctly indexed in the "Discover" tab of Kibana and the "Logs" tab. However, on opening the dashboard for [Filebeat System] I get the error
Saved "field" parameter is now invalid. Please select a new field
Please see the screenshot below:
I followed various advice of the experts in the threads and understood that some of the fields are not
aggregatable and hence the problem arises. Please see the image below for the same.
I am not able to understand the reason as to why certain fields are not
aggregatablewhen there is data on that field in some of the logs. I am also confused as to why
system.syslog.hostname.keywordis aggregatable where as
system.syslog.hostnameis not. Please help me solve the problem.
NOTE:- Running Elastic stack without docker (in standalone mode) with the same flow on my machine, I am able to see the visualize the Syslog dashboard properly and the fields are shown aggregatable for the index pattern