# Saved "field" parameter is now invalid. Please select a new field **URL:** \ **Category:** Kibana\ **Created:** [November 23, 2020, 10:01pm UTC](https://discuss.elastic.co/t/saved-field-parameter-is-now-invalid-please-select-a-new-field/256413 "2020-11-23T22:01:31Z")\ **Posts on this page:** 17\ **Page:** 1
**Author:** ![ManuelF](https://avatars.discourse-cdn.com/v4/letter/m/e99b99/32.png) [@ManuelF](https://discuss.elastic.co/u/ManuelF)\ **Post date:** [November 23, 2020, 10:01pm UTC](https://discuss.elastic.co/t/saved-field-parameter-is-now-invalid-please-select-a-new-field/256413/1 "2020-11-23T22:01:32Z")
Hi, Currently using ELK 7.9.2. I have been using Winlogbeat for a while now. I created some custom visualizations and dashboards that read from `winlogbeat-*` indexes. Everything was working fine just a few days ago, until now that many visualizations are showing the error message `Saved "field" parameter is now invalid. Please select a new field`..... I have read many posts related to this issue, that seems to be very common and almost sure related to wrong indexing, where ILM may be involved. I have tried everything, including removing indexes, templates, ILM policies, and even removing the beat from the host, then start from scratch, but the issue persist. Logstash is not part of the chain as the beat ships data directly to ES Steps - Stopped Winlogbeat service - Uninstalled service - Removed installation folder - Closed/removed all Winlogbeat indexes - Removed Winlogbeat index template - Removed Winlogbeat ILM policy - Removed Winlogbeat index pattern - Made sure a new index it is not being created automatically due to an endpoint sending data - Reinstalled Winlogbeat following documented steps - Ran command winlogbeat setup. Command is always successful - Confirmed Index, index template, index pattern, ILM policy was added - Started Winlogbeat service I could share part of my Winlogbeat config, but there is not a single line related to ILM (not to setting or modifying anything), as I prefer the auto-config to do all changes for me. I am using the basic beat settings, but connecting via ssl (which is working fine). I have spent hours breaking my brain trying to locate where the root issue is, so I can fix this. I would appreciate some help here since I am stuck! Thanks ---
**Author:** ![matw](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/matw/32/13913_2.png) [@matw](https://discuss.elastic.co/u/matw)\ **Post date:** [November 24, 2020, 8:19am UTC](https://discuss.elastic.co/t/saved-field-parameter-is-now-invalid-please-select-a-new-field/256413/2 "2020-11-24T08:19:14Z")
The error message sounds a bit like in this issue: > [@What is excluded column in kibana index pattern?](https://discuss.elastic.co/t/what-is-excluded-column-in-kibana-index-pattern/252667/10): > > Steps to reproduce: Create index pattern from filebeat-7.9.2 index (doesn't matter if I designate @timestamp as time-filter or not) Wait about 5 minutes (index pattern will work during this time and not have source filter present or @timestamp field marked as excluded) View index pattern in Discover tab, receive following error: [error1] FieldParamType/\_this.deserialize@https://some.url.com/33984/bundles/plugin/data/data.plugin.js:9:345453 setParams/\<@https://some.url.com/33984/bundles/plu… So there is an issue with your index pattern, I think you're refreshed the fields in the index pattern management? Which version of Winlogbeat are you using? Thx & Best, Matthias ---
**Author:** ![ManuelF](https://avatars.discourse-cdn.com/v4/letter/m/e99b99/32.png) [@ManuelF](https://discuss.elastic.co/u/ManuelF)\ **Post date:** [November 24, 2020, 2:13pm UTC](https://discuss.elastic.co/t/saved-field-parameter-is-now-invalid-please-select-a-new-field/256413/3 "2020-11-24T14:13:58Z")
Hi @matw, Thank you for jump in to assist me on this issue. Winlogbeat match ELK version. Both are v7.9.2. I am destroying everything I could find that is related to Winlogbeat: index, index template, index pattern, ILM policy, so I can have a fresh start from scratch. Can you please tell if I am missing anything else? Before removing the index I stop Winlogbeat in the endpoint, then on ES I refresh the index, clean index cache, and close the index. What would you recommend me to try next? Thank you ---
**Author:** ![matw](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/matw/32/13913_2.png) [@matw](https://discuss.elastic.co/u/matw)\ **Post date:** [November 24, 2020, 2:47pm UTC](https://discuss.elastic.co/t/saved-field-parameter-is-now-invalid-please-select-a-new-field/256413/4 "2020-11-24T14:47:58Z")
Could you export the index pattern saved object of `winlogbeat-*`, and paste the JSON here? many thx! Best, Matthias ---
**Author:** ![ManuelF](https://avatars.discourse-cdn.com/v4/letter/m/e99b99/32.png) [@ManuelF](https://discuss.elastic.co/u/ManuelF)\ **Post date:** [November 24, 2020, 3:05pm UTC](https://discuss.elastic.co/t/saved-field-parameter-is-now-invalid-please-select-a-new-field/256413/5 "2020-11-24T15:05:48Z")
I cleaned up everything one more time. Ran command winlogbeat setup from the endpoint (no errors): ![Setup Winlogbeat](https://us1.discourse-cdn.com/elastic/original/3X/0/d/0d3df758b5a84ec6799029e47224817505a60453.png) Went to check `winlogbeat-*` in Kibana/Saved Objects ![Winlogbeat Saved Object](https://us1.discourse-cdn.com/elastic/original/3X/2/6/2661a5d3e838923c07f6cab714872929fe59f4ba.png) Pulled out Winlogbeat mapping data from Dev Console ![Winlogbeat mapping](https://us1.discourse-cdn.com/elastic/original/3X/7/2/7213d6f08d6ac87db21414b21d16428ae93acb26.png) Winlogbeat index is also empty ![Winlogbeat index](https://us1.discourse-cdn.com/elastic/original/3X/b/e/be4e67b6efe778b9e886d2c3c89cd9c7078cdc12.png) **ndjson file** ``` {"attributes":{"fieldFormatMap":"{\"client.bytes\":{\"id\":\"bytes\",\"params\":{\"parsedUrl\":{\"origin\":\"https://192.168.1.190:5601\",\"pathname\":\"/app/dashboards\",\"basePath\":\"\"}}},\"client.nat.port\":{\"id\":\"string\",\"params\":{\"parsedUrl\":{\"origin\":\"https://192.168.1.190:5601\",\"pathname\":\"/app/dashboards\",\"basePath\":\"\"}}},\"client.port\":{\"id\":\"string\",\"params\":{\"parsedUrl\":{\"origin\":\"https://192.168.1.190:5601\",\"pathname\":\"/app/dashboards\",\"basePath\":\"\"}}},\"destination.bytes\":{\"id\":\"bytes\",\"params\":{\"parsedUrl\":{\"origin\":\"https://192.168.1.190:5601\",\"pathname\":\"/app/dashboards\",\"basePath\":\"\"}}},\"destination.nat.port\":{\"id\":\"string\",\"params\":{\"parsedUrl\":{\"origin\":\"https://192.168.1.190:5601\",\"pathname\":\"/app/dashboards\",\"basePath\":\"\"}}},\"destination.port\":{\"id\":\"string\",\"params\":{\"parsedUrl\":{\"origin\":\"https://192.168.1.190:5601\",\"pathname\":\"/app/dashboards\",\"basePath\":\"\"}}},\"event.duration\":{\"id\":\"duration\",\"params\":{\"parsedUrl\":{\"origin\":\"https://192.168.1.190:5601\",\"pathname\":\"/app/dashboards\",\"basePath\":\"\"},\"inputFormat\":\"nanoseconds\",\"outputFormat\":\"asMilliseconds\",\"outputPrecision\":1}},\"event.sequence\":{\"id\":\"string\",\"params\":{\"parsedUrl\":{\"origin\":\"https://192.168.1.190:5601\",\"pathname\":\"/app/dashboards\",\"basePath\":\"\"}}},\"event.severity\":{\"id\":\"string\",\"params\":{\"parsedUrl\":{\"origin\":\"https://192.168.1.190:5601\",\"pathname\":\"/app/dashboards\",\"basePath\":\"\"}}},\"http.request.body.bytes\":{\"id\":\"bytes\",\"params\":{\"parsedUrl\":{\"origin\":\"https://192.168.1.190:5601\",\"pathname\":\"/app/dashboards\",\"basePath\":\"\"}}},\"http.request.bytes\":{\"id\":\"bytes\",\"params\":{\"parsedUrl\":{\"origin\":\"https://192.168.1.190:5601\",\"pathname\":\"/app/dashboards\",\"basePath\":\"\"}}},\"http.response.body.bytes\":{\"id\":\"bytes\",\"params\":{\"parsedUrl\":{\"origin\":\"https://192.168.1.190:5601\",\"pathname\":\"/app/dashboards\",\"basePath\":\"\"}}},\"http.response.bytes\":{\"id\":\"bytes\",\"params\":{\"parsedUrl\":{\"origin\":\"https://192.168.1.190:5601\",\"pathname\":\"/app/dashboards\",\"basePath\":\"\"}}},\"http.response.status_code\":{\"id\":\"string\",\"params\":{\"parsedUrl\":{\"origin\":\"https://192.168.1.190:5601\",\"pathname\":\"/app/dashboards\",\"basePath\":\"\"}}},\"log.syslog.facility.code\":{\"id\":\"string\",\"params\":{\"parsedUrl\":{\"origin\":\"https://192.168.1.190:5601\",\"pathname\":\"/app/dashboards\",\"basePath\":\"\"}}},\"log.syslog.priority\":{\"id\":\"string\",\"params\":{\"parsedUrl\":{\"origin\":\"https://192.168.1.190:5601\",\"pathname\":\"/app/dashboards\",\"basePath\":\"\"}}},\"network.bytes\":{\"id\":\"bytes\",\"params\":{\"parsedUrl\":{\"origin\":\"https://192.168.1.190:5601\",\"pathname\":\"/app/dashboards\",\"basePath\":\"\"}}},\"package.size\":{\"id\":\"string\",\"params\":{\"parsedUrl\":{\"origin\":\"https://192.168.1.190:5601\",\"pathname\":\"/app/dashboards\",\"basePath\":\"\"}}},\"process.parent.pgid\":{\"id\":\"string\",\"params\":{\"parsedUrl\":{\"origin\":\"https://192.168.1.190:5601\",\"pathname\":\"/app/dashboards\",\"basePath\":\"\"}}},\"process.parent.pid\":{\"id\":\"string\",\"params\":{\"parsedUrl\":{\"origin\":\"https://192.168.1.190:5601\",\"pathname\":\"/app/dashboards\",\"basePath\":\"\"}}},\"process.parent.ppid\":{\"id\":\"string\",\"params\":{\"parsedUrl\":{\"origin\":\"https://192.168.1.190:5601\",\"pathname\":\"/app/dashboards\",\"basePath\":\"\"}}},\"process.parent.thread.id\":{\"id\":\"string\",\"params\":{\"parsedUrl\":{\"origin\":\"https://192.168.1.190:5601\",\"pathname\":\"/app/dashboards\",\"basePath\":\"\"}}},\"process.pgid\":{\"id\":\"string\",\"params\":{\"parsedUrl\":{\"origin\":\"https://192.168.1.190:5601\",\"pathname\":\"/app/dashboards\",\"basePath\":\"\"}}},\"process.pid\":{\"id\":\"string\",\"params\":{\"parsedUrl\":{\"origin\":\"https://192.168.1.190:5601\",\"pathname\":\"/app/dashboards\",\"basePath\":\"\"}}},\"process.ppid\":{\"id\":\"string\",\"params\":{\"parsedUrl\":{\"origin\":\"https://192.168.1.190:5601\",\"pathname\":\"/app/dashboards\",\"basePath\":\"\"}}},\"process.thread.id\":{\"id\":\"string\",\"params\":{\"parsedUrl\":{\"origin\":\"https://192.168.1.190:5601\",\"pathname\":\"/app/dashboards\",\"basePath\":\"\"}}},\"server.bytes\":{\"id\":\"bytes\",\"params\":{\"parsedUrl\":{\"origin\":\"https://192.168.1.190:5601\",\"pathname\":\"/app/dashboards\",\"basePath\":\"\"}}},\"server.nat.port\":{\"id\":\"string\",\"params\":{\"parsedUrl\":{\"origin\":\"https://192.168.1.190:5601\",\"pathname\":\"/app/dashboards\",\"basePath\":\"\"}}},\"server.port\":{\"id\":\"string\",\"params\":{\"parsedUrl\":{\"origin\":\"https://192.168.1.190:5601\",\"pathname\":\"/app/dashboards\",\"basePath\":\"\"}}},\"source.bytes\":{\"id\":\"bytes\",\"params\":{\"parsedUrl\":{\"origin\":\"https://192.168.1.190:5601\",\"pathname\":\"/app/dashboards\",\"basePath\":\"\"}}},\"source.nat.port\":{\"id\":\"string\",\"params\":{\"parsedUrl\":{\"origin\":\"https://192.168.1.190:5601\",\"pathname\":\"/app/dashboards\",\"basePath\":\"\"}}},\"source.port\":{\"id\":\"string\",\"params\":{\"parsedUrl\":{\"origin\":\"https://192.168.1.190:5601\",\"pathname\":\"/app/dashboards\",\"basePath\":\"\"}}},\"url.port\":{\"id\":\"string\",\"params\":{\"parsedUrl\":{\"origin\":\"https://192.168.1.190:5601\",\"pathname\":\"/app/dashboards\",\"basePath\":\"\"}}}}","fields":"[{\"name\":\"_id\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":false,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"_index\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":false,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"_score\",\"type\":\"number\",\"count\":0,\"scripted\":false,\"searchable\":false,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"_source\",\"type\":\"_source\",\"count\":0,\"scripted\":false,\"searchable\":false,\"aggregatable\":false,\"readFromDocValues\":false},{\"name\":\"_type\",\"type\":\"string\",\"count\":0,\"scripted\":false,\"searchable\":false,\"aggregatable\":false,\"readFromDocValues\":false}]","timeFieldName":"@timestamp","title":"winlogbeat-*"},"id":"winlogbeat-*","migrationVersion":{"index-pattern":"7.6.0"},"references":[],"type":"index-pattern","updated_at":"2020-11-24T14:52:35.546Z","version":"WzQ3MDU0MjEsNTld"} {"exportedCount":1,"missingRefCount":0,"missingReferences":[]} ``` So this seems to be the issue. Winlogbeat is not experiencing a wrong mapping, but instead is not mapping at all. `Setup` command is failing? ---
**Author:** ![ManuelF](https://avatars.discourse-cdn.com/v4/letter/m/e99b99/32.png) [@ManuelF](https://discuss.elastic.co/u/ManuelF)\ **Post date:** [November 24, 2020, 5:03pm UTC](https://discuss.elastic.co/t/saved-field-parameter-is-now-invalid-please-select-a-new-field/256413/6 "2020-11-24T17:03:04Z")
Hi @matw, I enabled Winlogbeat at the endpoint to have some sample data. Mappings is now showing more fields, but most are classified as `"text"`, which I am not sure is the expected result. Here you can check the [mapping fields](https://pastebin.com/XK5WMma9). Text is too big to post it here I tried to recreate one of the visualizations from scratch, but all terms are now available only in the `.keyword` form. In another ELK node I have for testing I don't have to use `.keyword` values to have working the same visualization. So, where could be the issue? In the index template, or perhaps the data is is not arriving in the right format? Just in case I downloaded a fresh copy of Winlogbeat 7.9.2 and did the deployment from scratch, but the issue persist. ---
**Author:** ![ManuelF](https://avatars.discourse-cdn.com/v4/letter/m/e99b99/32.png) [@ManuelF](https://discuss.elastic.co/u/ManuelF)\ **Post date:** [November 24, 2020, 5:49pm UTC](https://discuss.elastic.co/t/saved-field-parameter-is-now-invalid-please-select-a-new-field/256413/7 "2020-11-24T17:49:00Z")
@matw, I think the Dynamic Mapping is taking precedence over the regular mapping. Perhaps because from the start not all the fields are correctly mapped, and then all the fields are classified as new/unknown fields. I think the last couple of times I deployed Winlogbeat, I found around 800 fields ready to receive data and now I have less than 250, even sending data. ---
**Author:** ![ManuelF](https://avatars.discourse-cdn.com/v4/letter/m/e99b99/32.png) [@ManuelF](https://discuss.elastic.co/u/ManuelF)\ **Post date:** [November 24, 2020, 9:36pm UTC](https://discuss.elastic.co/t/saved-field-parameter-is-now-invalid-please-select-a-new-field/256413/8 "2020-11-24T21:36:40Z")
After several hours troubleshooting without being able to resolve this issue, I am sure the problem is still wrong indexing, but I can't find where or when is happening..... ---
**Author:** ![matw](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/matw/32/13913_2.png) [@matw](https://discuss.elastic.co/u/matw)\ **Post date:** [November 25, 2020, 5:07am UTC](https://discuss.elastic.co/t/saved-field-parameter-is-now-invalid-please-select-a-new-field/256413/9 "2020-11-25T05:07:00Z")
think you're right, that's the issue, will ask around if this is a known issue or new. and how to fix it. ---
**Author:** ![ManuelF](https://avatars.discourse-cdn.com/v4/letter/m/e99b99/32.png) [@ManuelF](https://discuss.elastic.co/u/ManuelF)\ **Post date:** [November 25, 2020, 1:49pm UTC](https://discuss.elastic.co/t/saved-field-parameter-is-now-invalid-please-select-a-new-field/256413/10 "2020-11-25T13:49:57Z")
Hi @matw, Where you able to find anything? Honestly I have no clue. I am experiencing the same behavior on v7.9.2 and v7.10. I was hopping that Winlogbeat 7.10 and its infrastructure would not have this issue, but I was wrong. The v7.10 it is not a fresh install, but an upgrade from v7.9.2, so it might be inheriting whatever the issue is. If you need further information about my node config, please let me know. I hope you and your team can help me to resolve this issue. Thanks ---
**Author:** ![matw](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/matw/32/13913_2.png) [@matw](https://discuss.elastic.co/u/matw)\ **Post date:** [November 25, 2020, 2:54pm UTC](https://discuss.elastic.co/t/saved-field-parameter-is-now-invalid-please-select-a-new-field/256413/11 "2020-11-25T14:54:44Z")
Hi Can you check if the winlogbeat index pattern is installed? E.g, here: ![Bildschirmfoto 2020-11-25 um 15.49.17](https://us1.discourse-cdn.com/elastic/original/3X/a/e/aeb14b05245d435da6277f42f184b605e9d734f4.png) Normally this should be installed when you run the setup command, but let's check if it's there Best, Matthias ---
**Author:** ![ManuelF](https://avatars.discourse-cdn.com/v4/letter/m/e99b99/32.png) [@ManuelF](https://discuss.elastic.co/u/ManuelF)\ **Post date:** [November 25, 2020, 3:18pm UTC](https://discuss.elastic.co/t/saved-field-parameter-is-now-invalid-please-select-a-new-field/256413/12 "2020-11-25T15:18:45Z")
Both **Index Template** and **Index Pattern** are installed after running the `setup` command from PowerShell console. As I posted earlier, the Index Pattern is created with only 5 fields. The Index Pattern is added with the expected exported fileds. > [@ManuelF](#): > > Went to check `winlogbeat-*` in Kibana/Saved Objects > > ![Winlogbeat Saved Object](https://us1.discourse-cdn.com/elastic/original/3X/2/6/2661a5d3e838923c07f6cab714872929fe59f4ba.png) ---
**Author:** ![matw](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/matw/32/13913_2.png) [@matw](https://discuss.elastic.co/u/matw)\ **Post date:** [November 25, 2020, 3:51pm UTC](https://discuss.elastic.co/t/saved-field-parameter-is-now-invalid-please-select-a-new-field/256413/13 "2020-11-25T15:51:39Z")
Ok thanks, keep on asking (this is more a Beats question than a Kibana one, which is my territory ). What you could do is opening an issue in the beats repository > **[Build software better, together](https://github.com/elastic/beats/issues/new/choose)** > > GitHub is where people build software. More than 50 million people use GitHub to discover, fork, and contribute to over 100 million projects. You've already done very good research, it certainly sounds like a bug, that was maybe not reported There is something about ilm that creates invalid mappings: > > > Running setup with setup.ilm.check\_exists: false creates invalid mappings (text for keyword fields), effecting the Security app > Version: 7.9, 7.10 BC1 > Operating System: Windows... It may be related to it? Best, Matthias ---
**Author:** ![ManuelF](https://avatars.discourse-cdn.com/v4/letter/m/e99b99/32.png) [@ManuelF](https://discuss.elastic.co/u/ManuelF)\ **Post date:** [November 25, 2020, 4:45pm UTC](https://discuss.elastic.co/t/saved-field-parameter-is-now-invalid-please-select-a-new-field/256413/14 "2020-11-25T16:45:14Z")
Hi @matw, Thank you for staying. So, summarizing: there's no solution for this issue at the moment? I agree with you. I'm almost sure the wrong mapping involves ILM somehow, as I already had similar issue sometime ago. In fact very close to the issue described above. I also had to remove `setup.ilm.check_exists: false` from my config file, which I added due to the same PowerShell output after `setup` command. I though that issue was resolved by now. What is weird is that due to the previous experience, I am not including `setup.ilm.check_exists: false` in my configs anymore, but still the issue appeared. If there's nothing else you or your team can do for me at this moment, I will submit a bug report. If we can test/try anything else in the meantime, please let me know. Thank you ---
**Author:** ![ManuelF](https://avatars.discourse-cdn.com/v4/letter/m/e99b99/32.png) [@ManuelF](https://discuss.elastic.co/u/ManuelF)\ **Post date:** [November 25, 2020, 4:52pm UTC](https://discuss.elastic.co/t/saved-field-parameter-is-now-invalid-please-select-a-new-field/256413/15 "2020-11-25T16:52:08Z")
Hi @matw, If you can, please invite a beat or Winlogbeat expert to this thread so he/she can help me narrow this issue. Perhaps a deep check to my steps or configs. Thank you ---
**Author:** ![matw](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/matw/32/13913_2.png) [@matw](https://discuss.elastic.co/u/matw)\ **Post date:** [November 26, 2020, 5:00pm UTC](https://discuss.elastic.co/t/saved-field-parameter-is-now-invalid-please-select-a-new-field/256413/16 "2020-11-26T17:00:55Z")
Thx for opening the issue, just linking this here as a follow up! > > > Please post all questions and issues on https://discuss.elastic.co/c/beats > before opening a Github Issue. Your questions will reach a wider audience there, > and if... ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [November 4, 2022, 8:18am UTC](https://discuss.elastic.co/t/saved-field-parameter-is-now-invalid-please-select-a-new-field/256413/17 "2022-11-04T08:18:17Z")