# Dasboards and dataviews

**URL:** <https://discuss.elastic.co/t/dasboards-and-dataviews/382274>\
**Category:** Kibana\
**Created:** [September 29, 2025, 7:46am UTC](https://discuss.elastic.co/t/dasboards-and-dataviews/382274 "2025-09-29T07:46:58Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Buzz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/buzz/32/57377_2.png) [@Buzz](https://discuss.elastic.co/u/Buzz)\
**Post date:** [September 29, 2025, 7:46am UTC](https://discuss.elastic.co/t/dasboards-and-dataviews/382274/1 "2025-09-29T07:46:58Z")

</div>

Hello,

i have a question about dashboards delivered with Windows integration. I have created multiple new indexes and assign separate policies. example:

agent-security-logs-yyyy.mm.dd - retention 365days  
agent-application-logs-yyyy.mm.dd - retention 90days  
agent-system-logs-yyyy.mm.dd - retention 90days

unifi-firewall-yyyy.mm.dd - retention 365days  
unifi-logs-yyyy.mm.dd - retension 90days

etc…

i wanted to use windows dasboards that are delivered with windows integration but problem is that those dashboards are pointed propably on logs-_\*_

I tried to edit data view logs- to this: agent-security-logs-\*,logs-\* but it didnt worked.

Can someone help me with this?

Thanks

Jan

---

<div class="post-metadata">

**Author:** ![Musab\_Dogan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/musab_dogan/32/70691_2.png) [@Musab\_Dogan](https://discuss.elastic.co/u/Musab_Dogan)\
**Post date:** [September 29, 2025, 9:40am UTC](https://discuss.elastic.co/t/dasboards-and-dataviews/382274/2 "2025-09-29T09:40:34Z")

</div>

Adding an alias can help.

> **[Aliases | Elastic Docs](https://www.elastic.co/docs/manage-data/data-store/aliases)**
>
> An alias points to one or more indices or data streams. Most Elasticsearch APIs accept an alias in place of a data stream or index name. Aliases enable...

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [September 30, 2025, 1:26pm UTC](https://discuss.elastic.co/t/dasboards-and-dataviews/382274/3 "2025-09-30T13:26:45Z")

</div>

You can clone the dashboards and edit each visualization to change the data view.

But those dashboards expect some fields to exist, are the fields on the indices you created the same?