I'm running Elastic, Kibana, and Winlogbeat 7.8 on a single server with Winlogbeat on my clients, as well. Everything is currently working properly, but I noticed duplicate winlogbeat-* index patterns in Kibana. The default winlogbeat-* index pattern has a standard format id (5 groups of letters/numbers separated by hyphens). The non-default pattern has an id of winlogbeat-*. I believe the non-default index pattern showed up when I ran the 'winlogbeat.exe setup --dashboards' command. Opening the json, it has references to the Kibana URL, while the json for the default index pattern does not. I've seen a few articles regarding manual ways to delete duplicates (exporting/modifying json files, deleting the duplicate index pattern, importing the modified json files). However, I'm hesitant to delete either index pattern due to how different their json content is. I'm wondering if it's relatively normal to have multiple index patterns with the same name, specifically for beat configurations, and if there's any negative impact of leaving them as is (disk usage, etc.)? Thank you
Welcome to our community! 
Can you share an image of the patterns you are seeing in Kibana?
Thanks for the response Mark! Here's what I see under index patterns. Both reference the same fields, but have differences in json content. As mentioned, what stuck out the most were the references to the Kibana site in the json file for the non-default index pattern, which weren't in the default.
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.