Timelion error [illegal_argument_exception] field name is null or empty

[cobra]

Version: 6.3.1
I get this error on clicking the timelion tab:

I have a second es cluster (v 6.3.1 again) where timelion works fine.
Please help

[Brandon_Kobel]

@cobra, it looks like the error is being thrown by cell #4, can you share the timelion query for that cell?

[cobra]

The query is .es(*). In fact, the same error is displayed no matter what query. For simplicity, I have deleted the other cells and only kept cell #1 (and now getting error for that cell). Here's Kibana stdout logs:
{"type":"log","@timestamp":"2018-10-01T18:46:18Z","tags":["timelion","error"],"pid":19737,"message":"Error: in cell #1: [illegal_argument_exception] field name is null or empty: Error: in cell #1: [illegal_argument_exception] field name is null or empty\n at throwWithCell (/root/kibana-6.3.1-linux-x86_64/src/core_plugins/timelion/server/handlers/chain_runner.js:48:11)\n at /root/kibana-6.3.1-linux-x86_64/src/core_plugins/timelion/server/handlers/chain_runner.js:178:13\n at arrayEach (/root/kibana-6.3.1-linux-x86_64/node_modules/lodash/index.js:1289:13)\n at Function.<anonymous> (/root/kibana-6.3.1-linux-x86_64/node_modules/lodash/index.js:3345:13)\n at /root/kibana-6.3.1-linux-x86_64/src/core_plugins/timelion/server/handlers/chain_runner.js:170:24\n at bound (domain.js:301:14)\n at runBound (domain.js:314:12)\n at tryCatcher (/root/kibana-6.3.1-linux-x86_64/node_modules/bluebird/js/main/util.js:26:23)\n at Promise._settlePromiseFromHandler (/root/kibana-6.3.1-linux-x86_64/node_modules/bluebird/js/main/promise.js:503:31)\n at Promise._settlePromiseAt (/root/kibana-6.3.1-linux-x86_64/node_modules/bluebird/js/main/promise.js:577:18)\n at Promise._settlePromises (/root/kibana-6.3.1-linux-x86_64/node_modules/bluebird/js/main/promise.js:693:14)\n at Async._drainQueue (/root/kibana-6.3.1-linux-x86_64/node_modules/bluebird/js/main/async.js:123:16)\n at Async._drainQueues (/root/kibana-6.3.1-linux-x86_64/node_modules/bluebird/js/main/async.js:133:10)\n at Immediate.Async.drainQueues (/root/kibana-6.3.1-linux-x86_64/node_modules/bluebird/js/main/async.js:15:14)\n at runCallback (timers.js:810:20)\n at tryOnImmediate (timers.js:768:5)\n at processImmediate [as _immediateCallback] (timers.js:745:5)"}

[Brandon_Kobel]

If you go to Manamement -> Advanced Settings, what values do you have for timelion:es.timefield and timelion:es.default_index?

Also, can you include the mappings for the value of timelion:es.default_index by running a query in DevTools similar to the following:

GET logstash-*/_mapping

[cobra]

timelion:es.timefield @timestamp

timelion:es.default_index _all

GET _all/_mapping output is huge, hence shared here.

[Brandon_Kobel]

@cobra, can you try changing the timelion:es.default_index to the indices that you're wishing to use timelion with to see if you still get that error?

[cobra]

Tried that with a few individual indices (like s-logstash-2018.10.01 and pf_logs*) but still getting the same error unfortunately.

[cobra]

Got it "resolved" by deleting the .kibana index on elasticsearch. Of course, saved charts and other kibana settings were gone and had to be recreated.