Visualize: "field" is a required parameter

[Jukocross]

Hi, i understand that this is a known problem. I'm really new to ELKstack and would like to receive helps on this matter.

Error:
TypeError: "field" is a required parameter
at FieldParamTypeProvider.FieldParamType.write (http://192.168.218.135:5601/bundles/commons.bundle.js?v=16627:1:1266731)
at http://192.168.218.135:5601/bundles/commons.bundle.js?v=16627:1:229815
at AggParams.forEach ()
at AggParams.AggTypesAggParamsProvider.AggParams.write (http://192.168.218.135:5601/bundles/commons.bundle.js?v=16627:1:229773)
at AggConfig.VisAggConfigProvider.AggConfig.write (http://192.168.218.135:5601/bundles/commons.bundle.js?v=16627:1:50265)
at AggConfig.VisAggConfigProvider.AggConfig.toDsl (http://192.168.218.135:5601/bundles/commons.bundle.js?v=16627:1:51200)
at http://192.168.218.135:5601/bundles/commons.bundle.js?v=16627:1:1456184
at arrayMap (http://192.168.218.135:5601/bundles/vendors.bundle.js?v=16627:30:625146)
at map (http://192.168.218.135:5601/bundles/vendors.bundle.js?v=16627:30:669593)
at interceptor (http://192.168.218.135:5601/bundles/vendors.bundle.js?v=16627:30:710866)

TypeError: "field" is a required parameter
at FieldParamTypeProvider.FieldParamType.write (http://192.168.218.135:5601/bundles/commons.bundle.js?v=16627:1:1266731)
at http://192.168.218.135:5601/bundles/commons.bundle.js?v=16627:1:229815
at AggParams.forEach ()
at AggParams.AggTypesAggParamsProvider.AggParams.write (http://192.168.218.135:5601/bundles/commons.bundle.js?v=16627:1:229773)
at AggConfig.VisAggConfigProvider.AggConfig.write (http://192.168.218.135:5601/bundles/commons.bundle.js?v=16627:1:50265)
at AggConfig.VisAggConfigProvider.AggConfig.toDsl (http://192.168.218.135:5601/bundles/commons.bundle.js?v=16627:1:51200)
at http://192.168.218.135:5601/bundles/commons.bundle.js?v=16627:1:1456497
at Array.forEach ()
at AggConfigs.VisAggConfigsProvider.AggConfigs.toDsl (http://192.168.218.135:5601/bundles/commons.bundle.js?v=16627:1:1456280)
at http://192.168.218.135:5601/bundles/commons.bundle.js?v=16627:1:419792

Filebeat.yml

filebeat.modules
- module: apache2
  access:
    enabled: true
    var.paths: ["/var/log/testlog/access.log*"]
  error:
     enabled: true
     var.paths: ["/var/log/testlog/error.log*"]
output.logstash:
  hosts: "logstash:5044"
setup.kibana.host: "kibana:5601"
setup.dashboards.enabled: true

[tylersmalley]

You mentioned this is a known problem. Can you point to an issue representing this?

What version of Kibana are you on, and what do you do to encounter this issue?

[thomasneirynck]

@Jukocross

are you referring to https://github.com/elastic/kibana/issues/9571?

[Jukocross]

Hi, i believe is similar to https://github.com/elastic/kibana/issues/9571 as pointed out above.

My ELK stack are running on version 6.2.4. I followed the documentation which uses the filebeat.modules to read the apache2 logs and which output to logstash. Following i uses the apache2's configuration example provided here: https://www.elastic.co/guide/en/logstash/current/logstash-config-for-filebeat-modules.html

Currently i'm able to search the logs example and there isnt any grok parse error. However, when accessing the visualize and dashboard, the mentioned error will show up.