# Combining metricbeat and winlogbeat
**URL:** https://discuss.elastic.co/t/combining-metricbeat-and-winlogbeat/131177
**Category:** Beats
**Created:** [May 9, 2018, 1:52pm UTC](https://discuss.elastic.co/t/combining-metricbeat-and-winlogbeat/131177 "2018-05-09T13:52:36Z")
**Posts on this page:** 11
**Page:** 1
### Author:  [@varun1992](https://discuss.elastic.co/u/varun1992)
#### Post date: [May 9, 2018, 1:52pm UTC](https://discuss.elastic.co/t/combining-metricbeat-and-winlogbeat/131177/1 "2018-05-09T13:52:37Z")
Is it possible to save winlogbeat output and metricbeat output to same index in elasticsearch ?
if yes, what do i need to do for that ?
---
### Author:  [@ruflin](https://discuss.elastic.co/u/ruflin)
#### Post date: [May 11, 2018, 7:10am UTC](https://discuss.elastic.co/t/combining-metricbeat-and-winlogbeat/131177/2 "2018-05-11T07:10:23Z")
Yes, you can do that by defining the same index in the Elasticsearch output for both Beats. But I would strongly recommend against it as the two could have conflicting data fields.
Can you share a bit more what you are trying to do? If it's just querying the data together, you can do that without having them in the same index.
---
### Author:  [@varun1992](https://discuss.elastic.co/u/varun1992)
#### Post date: [May 11, 2018, 11:16am UTC](https://discuss.elastic.co/t/combining-metricbeat-and-winlogbeat/131177/3 "2018-05-11T11:16:52Z")
i want to monitor beat output using elasticsearch and java api. for that i want to simplify the querying. for that thinking to combine to single index. So no need to create multiple query for each index
---
### Author:  [@ruflin](https://discuss.elastic.co/u/ruflin)
#### Post date: [May 11, 2018, 11:30am UTC](https://discuss.elastic.co/t/combining-metricbeat-and-winlogbeat/131177/4 "2018-05-11T11:30:56Z")
You can run a single query against multiple indices. So there should be no need to combine both.
---
### Author:  [@varun1992](https://discuss.elastic.co/u/varun1992)
#### Post date: [May 11, 2018, 12:12pm UTC](https://discuss.elastic.co/t/combining-metricbeat-and-winlogbeat/131177/5 "2018-05-11T12:12:42Z")
i didnt know that how can i do that ?
how to get all data from 2 indices together ?
for 1 query it's like below. i know that
GET metricbeat/\_search
{
"query": {
"match\_all": {}
}
}
---
### Author:  [@ruflin](https://discuss.elastic.co/u/ruflin)
#### Post date: [May 11, 2018, 1:27pm UTC](https://discuss.elastic.co/t/combining-metricbeat-and-winlogbeat/131177/6 "2018-05-11T13:27:29Z")
Try
```auto
GET *beat/_search
{
"query": {
"match_all": {}
}
}
```
---
### Author:  [@varun1992](https://discuss.elastic.co/u/varun1992)
#### Post date: [May 11, 2018, 1:51pm UTC](https://discuss.elastic.co/t/combining-metricbeat-and-winlogbeat/131177/7 "2018-05-11T13:51:18Z")
i tried
post \*beat/\_search
{ "size":9999,"query" :
{ "bool": { "must": [{ "range": { "@timestamp": { "gte": "05-11-2018 08-09", "lte": "05-11-2018 08-09", "format": "MM-dd-yyyy HH-mm" } }}] }}
}}
but i get only metricbeat index data. i didn't get winlogbeat data
---
### Author:  [@ruflin](https://discuss.elastic.co/u/ruflin)
#### Post date: [May 14, 2018, 11:08am UTC](https://discuss.elastic.co/t/combining-metricbeat-and-winlogbeat/131177/8 "2018-05-14T11:08:01Z")
Can you past the list of indices here running cat: [https://www.elastic.co/guide/en/elasticsearch/reference/current/cat-indices.html](https://www.elastic.co/guide/en/elasticsearch/reference/current/cat-indices.html) ?
Can you try to run the above query without the range part but just match all and see if you get results?
---
### Author:  [@varun1992](https://discuss.elastic.co/u/varun1992)
#### Post date: [May 14, 2018, 12:39pm UTC](https://discuss.elastic.co/t/combining-metricbeat-and-winlogbeat/131177/9 "2018-05-14T12:39:19Z")
yellow open winlogbeat sYKj8XUfTCSbOy1auHcojQ 5 1 33788 0 32.5mb 32.5mb
green open .kibana bs2HrAO8Q3WBSI3KtoE4sw 1 0 3 0 38.5kb 38.5kb
yellow open metricbeat 2E9LxwXvSmixetmtb3tbOA 5 1 1395669 0 620.2mb 620.2mb
it's my cat indices result.
i checked without range, buy calling get all record. still i didn't get data from winlogbeat
---
### Author:  [@ruflin](https://discuss.elastic.co/u/ruflin)
#### Post date: [May 15, 2018, 11:59am UTC](https://discuss.elastic.co/t/combining-metricbeat-and-winlogbeat/131177/10 "2018-05-15T11:59:41Z")
This is strange. Can you share a result output? Did you check all results or only the first top x?
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 12, 2018, 1:59pm UTC](https://discuss.elastic.co/t/combining-metricbeat-and-winlogbeat/131177/11 "2018-06-12T13:59:54Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.