Visualization / Dashboard error: Saved "field" parameter is now invalid

[Camilo_Diaz (Camilo Díaz)]

I have a clean install of Elastic stack + Filebeat

Filetbeats 7.5 --> Logstash --> Elasticsearch 7.5

From Filebeats client I have loaded the Suricata Module and have manually loaded the ingest pipelines (all completed without errors)

filebeat setup --pipelines --modules suricata
filebeat setup --dashboard

I can visualize data on the discovery tab but when I open any Suricata Visualization or Dashboard I've got the following error.
"Saved "field" parameter is now invalid. Please select a new field."

I can't find anything in the kibana/Elasticsearch logs, as to what is wrong. Any help will be much appreciatted. I had the exactly same problem using haproxy modules and dashboards and i've recreated the indexes and reloaded the modules/dashboard several times and kept having the same issues.

[Camilo_Diaz (Camilo Díaz)]

ok so it looks the problem are the visualizations, so I'll have to manually modify them to match the keyword value. It would be nice that these dashboards worked out the box. This can be closed/resolved.
This seems to have been happening for a while in kibana, as per https://github.com/elastic/kibana/issues/9571
Cheers,
Camilo.

[Bargs (Matt Bargar)]

@Camilo_Diaz there might be an issue with the mappings template or the index pattern beats is auto creating for this module, would you mind filing an issue on the Beats Github repo?

Build software better, together