Hi.
All index for winlogbeat looks like
with no data.
But logstash and auditbeat looks well with source and all fields data.
I Try to remove and recreate winlogbeat index but it's not work.
than I thy to remove winlogbeat pattern not wonrk too.
Hi.
All index for winlogbeat looks like
I Try to remove and recreate winlogbeat index but it's not work.
than I thy to remove winlogbeat pattern not wonrk too.
I use this.
PUT /_template/winlogbeat*
{
"index_patterns" : ["winlogbeat-*"],
"order" : 1,
"settings" : {
"number_of_shards" : 2
},
"mappings" : {
"type1" : {
"_source" : { "enabled" : true }
}
}
}
than
recreate pattent winlogbeat.
thanks.
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
© 2020. All Rights Reserved - Elasticsearch
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.