# Saved "field" parameter is now invalid. Please select a new field **URL:** \ **Category:** Kibana\ **Created:** [March 28, 2021, 4:33pm UTC](https://discuss.elastic.co/t/saved-field-parameter-is-now-invalid-please-select-a-new-field/268598 "2021-03-28T16:33:36Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![Tim\_Mobley](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tim_mobley/32/94741_2.png) [@Tim\_Mobley](https://discuss.elastic.co/u/Tim_Mobley)\ **Post date:** [March 28, 2021, 4:33pm UTC](https://discuss.elastic.co/t/saved-field-parameter-is-now-invalid-please-select-a-new-field/268598/1 "2021-03-28T16:33:36Z")
I am attempting to reload sample dashboards (in this case for Winlogbeat) associated with our custom index patterns - as opposed to the default **winlogbeat-** \*. Here are the steps I followed: 1. Exported the target index pattern to ndjson file and verified the index ID. 2. Imported the sample dashboards as-is using the winlogbeat.exe setup command (no problem here - the dashboards and visualizations show up in Kibana just fine). 3. Exported the new visualizations to ndjson file, then replaced the "id" field with the id in step #1. 4. Imported the edited visualizations using "Automatically overwrite all saved objects" setting 5. Re-exported the visualization to verify that the overwrite actually happened 6. Refreshed fields in the target index pattern I also tried re-creating the index pattern with "Show advanced options" \> and creating a Custom index pattern ID, then using that in the visualization file instead of the long, auto-generated ID. However, when I attempt to open the edited visualization in Kibana, it fails with the following warning: > Saved "field" parameter is now invalid. Please select a new field I have my Kibana logs set to "verbose" but do not see this error in the logs - only in the Kibana UI. So part of my question is where to find more log info on this warning. ---
**Author:** ![flash1293](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/flash1293/32/41227_2.png) [@flash1293](https://discuss.elastic.co/u/flash1293)\ **Post date:** [March 30, 2021, 2:28pm UTC](https://discuss.elastic.co/t/saved-field-parameter-is-now-invalid-please-select-a-new-field/268598/2 "2021-03-30T14:28:26Z")
Which version of Kibana are you using? It seem like the new index pattern you created has different mappings than the default winlogbeat indices which are required by the visualization. Please note that in recent versions it's necessary there is at least one index in your specified index pattern, otherwise visualizations won't work. Can you share the saved objects for the broken visualization and the index pattern you created? ---
**Author:** ![Tim\_Mobley](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tim_mobley/32/94741_2.png) [@Tim\_Mobley](https://discuss.elastic.co/u/Tim_Mobley)\ **Post date:** [April 22, 2021, 8:38pm UTC](https://discuss.elastic.co/t/saved-field-parameter-is-now-invalid-please-select-a-new-field/268598/3 "2021-04-22T20:38:09Z")
Just wanted to follow-up in case others run across this. I believe the root cause was using a different version of Winlogbeat (7.9.3) than Elasticsearch (7.9.1). At any rate, I reached out to @ManuelF who had a [similar issue](https://discuss.elastic.co/t/saved-field-parameter-is-now-invalid-please-select-a-new-field/256413) and he gave me great advice. When I exported the visualizations I needed to also append **.keyword** to the fieldnames. Once I had done that and re-imported the visualization, I no longer got the "Saved 'field' parameter is now invalid." (Thank you @flash1293 for your reply - sorry for not getting back faster.) ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [May 20, 2021, 8:38pm UTC](https://discuss.elastic.co/t/saved-field-parameter-is-now-invalid-please-select-a-new-field/268598/4 "2021-05-20T20:38:39Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.