Visualization / Dashboard error: Saved "field" parameter is now invalid

Elastic Stack Kibana
1

I have a clean install of Elastic stack + Filebeat

Filetbeats 7.5 --> Logstash --> Elasticsearch 7.5

From Filebeats client I have loaded the Suricata Module and have manually loaded the ingest pipelines (all completed without errors)

filebeat setup --pipelines --modules suricata
filebeat setup --dashboard

I can visualize data on the discovery tab but when I open any Suricata Visualization or Dashboard I've got the following error.
"Saved "field" parameter is now invalid. Please select a new field."

Kibana_Visualization
Kibana_Visualization1865×896 110 KB

I can't find anything in the kibana/Elasticsearch logs, as to what is wrong. Any help will be much appreciatted. I had the exactly same problem using haproxy modules and dashboards and i've recreated the indexes and reloaded the modules/dashboard several times and kept having the same issues.

2

ok so it looks the problem are the visualizations, so I'll have to manually modify them to match the keyword value. It would be nice that these dashboards worked out the box. This can be closed/resolved.
This seems to have been happening for a while in kibana, as per https://github.com/elastic/kibana/issues/9571
Cheers,
Camilo.

3

@Camilo_Diaz there might be an issue with the mappings template or the index pattern beats is auto creating for this module, would you mind filing an issue on the Beats Github repo?

4

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.