# "Visualize: "field" is a required parameter" error **URL:** \ **Category:** Kibana\ **Created:** [December 20, 2016, 9:03am UTC](https://discuss.elastic.co/t/visualize-field-is-a-required-parameter-error/69536 "2016-12-20T09:03:18Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![zacesa](https://avatars.discourse-cdn.com/v4/letter/z/d07c76/32.png) [@zacesa](https://discuss.elastic.co/u/zacesa)\ **Post date:** [December 20, 2016, 9:03am UTC](https://discuss.elastic.co/t/visualize-field-is-a-required-parameter-error/69536/1 "2016-12-20T09:03:18Z")
Hi all, I'm new to ELK Stack, I have it installed on Ubuntu 16.04 and I'm also using packetbeat. I have packetbeat capture data through a tap and then, send it to logstash, then to elasticsearch. The data is coming in nicely but, I'm getting this error on my Kibana and the Packetbeat dashboard isn't showing anything. Not really sure what the issue is. ![](https://us1.discourse-cdn.com/elastic/original/2X/f/f206d834729c5cad212ff1820c775d9d7bc19d25.png) Is it because my packet capture doesn't have all the required data? Thanks in advance! ---
**Author:** ![Stacey\_Gammon](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stacey_gammon/32/14025_2.png) [@Stacey\_Gammon](https://discuss.elastic.co/u/Stacey_Gammon)\ **Post date:** [December 20, 2016, 2:44pm UTC](https://discuss.elastic.co/t/visualize-field-is-a-required-parameter-error/69536/2 "2016-12-20T14:44:46Z")
What version of Kibana and elasticsearch are you using? ---
**Author:** ![Stacey\_Gammon](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stacey_gammon/32/14025_2.png) [@Stacey\_Gammon](https://discuss.elastic.co/u/Stacey_Gammon)\ **Post date:** [December 20, 2016, 3:25pm UTC](https://discuss.elastic.co/t/visualize-field-is-a-required-parameter-error/69536/3 "2016-12-20T15:25:31Z")
Just successfully repro'ed in master. Filed an issue so you can track further progress here: [https://github.com/elastic/kibana/issues/9571](https://github.com/elastic/kibana/issues/9571) ---
**Author:** ![Stacey\_Gammon](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stacey_gammon/32/14025_2.png) [@Stacey\_Gammon](https://discuss.elastic.co/u/Stacey_Gammon)\ **Post date:** [December 20, 2016, 8:19pm UTC](https://discuss.elastic.co/t/visualize-field-is-a-required-parameter-error/69536/4 "2016-12-20T20:19:51Z")
Hi @zacesa, This issue could be if your packetbeat index has no data, which is why I was seeing it. As soon as data started coming in, I refreshed the packetbeat field list and everything works as expected. If you are still seeing this issue, let me know if refreshing the field list in `Management` helps, and if all fields have a type assigned to them. ---
**Author:** ![zacesa](https://avatars.discourse-cdn.com/v4/letter/z/d07c76/32.png) [@zacesa](https://discuss.elastic.co/u/zacesa)\ **Post date:** [December 21, 2016, 4:40am UTC](https://discuss.elastic.co/t/visualize-field-is-a-required-parameter-error/69536/5 "2016-12-21T04:40:15Z")
@Stacey_Gammon I have data coming in, I've also refreshed the field list but, I'm still getting the error. ![](https://us1.discourse-cdn.com/elastic/original/2X/0/007d735e2f60053dd0646d5a5e2aa25c9daaef65.png) ---
**Author:** ![zacesa](https://avatars.discourse-cdn.com/v4/letter/z/d07c76/32.png) [@zacesa](https://discuss.elastic.co/u/zacesa)\ **Post date:** [December 21, 2016, 7:38am UTC](https://discuss.elastic.co/t/visualize-field-is-a-required-parameter-error/69536/6 "2016-12-21T07:38:07Z")
I deleted my index pattern from Kibana, thinking I could readd it back and hopefully fix this issue but I just made it worse, now when I click management, all I get is a blank page. ![](https://us1.discourse-cdn.com/elastic/original/2X/a/aaf8258072af2f24a237a2934e6c4e2205e296df.png) ---
**Author:** ![zacesa](https://avatars.discourse-cdn.com/v4/letter/z/d07c76/32.png) [@zacesa](https://discuss.elastic.co/u/zacesa)\ **Post date:** [December 21, 2016, 8:15am UTC](https://discuss.elastic.co/t/visualize-field-is-a-required-parameter-error/69536/7 "2016-12-21T08:15:48Z")
After I deleted the index pattern from kibana, a new index came up in my elastic search when I ran, `curl -XGET localhost:9200/_cat/indices` `yellow open %{[@metadata][beat]}-2016.12.21 GqdmtZmhS4mZ5zyfTCNH2g 5 1 183613 0 67.9mb 67.9mb` I can't seem to delete this index since there's curly brackets in the name of the index. **UPDATE** : Managed to delete the index with `curl -XDELETE localhost:9200/*metadata*` but, I'm still getting blank pages on Kibana. The pages I get blank are, Discover, Visualize, Dashboard, Dev Tools, Management. **UPDATE 2** : Deleting packetbeat-\* and \*metadata\* using curl didn't fix the issue, but running `curl -XDELETE localhost:9200/_all` fixed the blank screens. Will be trying to get data back in again. ---
**Author:** ![zacesa](https://avatars.discourse-cdn.com/v4/letter/z/d07c76/32.png) [@zacesa](https://discuss.elastic.co/u/zacesa)\ **Post date:** [December 22, 2016, 4:19am UTC](https://discuss.elastic.co/t/visualize-field-is-a-required-parameter-error/69536/8 "2016-12-22T04:19:18Z")
I didn't touch my ELK for a day and when I come back, it suddenly created two other indexes again. ![](https://us1.discourse-cdn.com/elastic/original/2X/3/3a6dc1234478d244040f45a687883b01275865c7.png) Not sure what the issue is. **UPDATE** : I had to change the index for output from my logstash from `%{[@metadata][beat]}-%{+YYYY-MM-DD}` to `packetbeat-%{+YYYY.MM.dd}` to stop it from create the metadata index. ---
**Author:** ![zacesa](https://avatars.discourse-cdn.com/v4/letter/z/d07c76/32.png) [@zacesa](https://discuss.elastic.co/u/zacesa)\ **Post date:** [December 23, 2016, 1:30am UTC](https://discuss.elastic.co/t/visualize-field-is-a-required-parameter-error/69536/9 "2016-12-23T01:30:33Z")
When I refresh the field list from management, the Packetbeat Dashboard which used to work, will cease to work. ---
**Author:** ![Stacey\_Gammon](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stacey_gammon/32/14025_2.png) [@Stacey\_Gammon](https://discuss.elastic.co/u/Stacey_Gammon)\ **Post date:** [December 27, 2016, 8:55pm UTC](https://discuss.elastic.co/t/visualize-field-is-a-required-parameter-error/69536/10 "2016-12-27T20:55:01Z")
> [@zacesa](#): > > %{[@metadata][beat]}-%{+YYYY-MM-DD} Did you manually add that to your logstash config? I don't think the import\_dashboards script would have created that index. I did find that pattern [in our beats codebase](https://github.com/elastic/beats/blob/master/testing/environments/docker/logstash/logstash.conf.tmpl) but it looks like it's only for testing purposes. Are you running any tests? Next time you get a blank page, let me know if you see any error output in the developer console of your browser. I suspect the issue was because you deleted your default index. You have to go to Management and select another index as the default. There have been some reported issues that sound similar to yours around this scenario (see [Allow to redefine the default index when not found · Issue #9028 · elastic/kibana · GitHub](https://github.com/elastic/kibana/issues/9028) and [Kibana does not open well if the default index does not exist · Issue #8702 · elastic/kibana · GitHub](https://github.com/elastic/kibana/issues/8702)). I'm still not sure why the packetbeat dashboard wouldn't work after refreshing the field list. Which version of the stack are you running? 5.1.1? ---
**Author:** ![Stacey\_Gammon](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stacey_gammon/32/14025_2.png) [@Stacey\_Gammon](https://discuss.elastic.co/u/Stacey_Gammon)\ **Post date:** [December 28, 2016, 2:21pm UTC](https://discuss.elastic.co/t/visualize-field-is-a-required-parameter-error/69536/11 "2016-12-28T14:21:43Z")
@zacesa I suspect that a field in one of the visualizations in the dashboard is missing it's type. If you go to `Management` and sort by type, do you have any fields missing a type? If so, are any of these fields being used in the visualizations on the dashboard that is throwing the error? ![](https://us1.discourse-cdn.com/elastic/original/2X/3/3451c84d2f8b414dcc3211a22c32808b597ce3e2.png) If you click `edit` to edit the field, then choose the appropriate type for the field, and save it, I think that should force the type field to be filled in. Let me know if that helps at all. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [January 25, 2017, 2:22pm UTC](https://discuss.elastic.co/t/visualize-field-is-a-required-parameter-error/69536/12 "2017-01-25T14:22:12Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.