Skip to content

Filebeat audit resource name visualization uses an invalid field #24899

@pmusa

Description

@pmusa

Version: 7.12.0 (it was also in 7.10.1, did not test any other versions)

Steps to Reproduce

  • install and setup filebeat
  • navigate to Dashboard -> [Filebeat GCP] Audit
  • One of the visualizations will show an error:

Could not locate that index-pattern-field (id: gcp.audit.resource_name)

Screenshot 2021-04-01 at 15 14 51

Steps to quickly fix it

  • Inspect the visualization saved object (Audit Resource Name [Filebeat GCP])
  • Update the visState to use googlecloud.audit.resource_name instead of gcp.audit.resource_name

I think the issue is related to the rename that happened here

Metadata

Metadata

Assignees

Labels

Type

No type
No fields configured for issues without a type.

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions