Saved "field" parameter is now invalid. Please select a new field

Elastic Stack Kibana
1

I am attempting to reload sample dashboards (in this case for Winlogbeat) associated with our custom index patterns - as opposed to the default winlogbeat-*. Here are the steps I followed:

  1. Exported the target index pattern to ndjson file and verified the index ID.
  2. Imported the sample dashboards as-is using the winlogbeat.exe setup command (no problem here - the dashboards and visualizations show up in Kibana just fine).
  3. Exported the new visualizations to ndjson file, then replaced the "id" field with the id in step #1.
  4. Imported the edited visualizations using "Automatically overwrite all saved objects" setting
  5. Re-exported the visualization to verify that the overwrite actually happened
  6. Refreshed fields in the target index pattern

I also tried re-creating the index pattern with "Show advanced options" > and creating a Custom index pattern ID, then using that in the visualization file instead of the long, auto-generated ID. However, when I attempt to open the edited visualization in Kibana, it fails with the following warning:

Saved "field" parameter is now invalid. Please select a new field

I have my Kibana logs set to "verbose" but do not see this error in the logs - only in the Kibana UI. So part of my question is where to find more log info on this warning.

2

Which version of Kibana are you using? It seem like the new index pattern you created has different mappings than the default winlogbeat indices which are required by the visualization. Please note that in recent versions it's necessary there is at least one index in your specified index pattern, otherwise visualizations won't work.

Can you share the saved objects for the broken visualization and the index pattern you created?

3

Just wanted to follow-up in case others run across this. I believe the root cause was using a different version of Winlogbeat (7.9.3) than Elasticsearch (7.9.1). At any rate, I reached out to @ManuelF who had a similar issue and he gave me great advice. When I exported the visualizations I needed to also append .keyword to the fieldnames. Once I had done that and re-imported the visualization, I no longer got the "Saved 'field' parameter is now invalid."
(Thank you @flash1293 for your reply - sorry for not getting back faster.)

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.