How I can change source for index winlogbeat


(Serhiy H V) #1

Hi.

All index for winlogbeat looks like


with no data.
But logstash and auditbeat looks well with source and all fields data.

I Try to remove and recreate winlogbeat index but it's not work.
than I thy to remove winlogbeat pattern not wonrk too.


(Serhiy H V) #2

I use this.

PUT /_template/winlogbeat*
{
"index_patterns" : ["winlogbeat-*"],
"order" : 1,
"settings" : {
"number_of_shards" : 2
},
"mappings" : {
"type1" : {
"_source" : { "enabled" : true }
}
}
}
than
recreate pattent winlogbeat.
thanks.


(system) #3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.