# How to generate month instead of weekly indexes in winlogbeat? **URL:** \ **Category:** Beats\ **Tags:** winlogbeat\ **Created:** [April 11, 2016, 7:49pm UTC](https://discuss.elastic.co/t/how-to-generate-month-instead-of-weekly-indexes-in-winlogbeat/47037 "2016-04-11T19:49:00Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![anhlqn](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/anhlqn/32/5454_2.png) [@anhlqn](https://discuss.elastic.co/u/anhlqn)\ **Post date:** [April 11, 2016, 7:49pm UTC](https://discuss.elastic.co/t/how-to-generate-month-instead-of-weekly-indexes-in-winlogbeat/47037/1 "2016-04-11T19:49:00Z")
Hi all, If I use winlogbeat to send Windows log directly to ES, what is the config syntax in `winlogbeat.yml` to generate monthly indexes? I have tried the syntax below but it did not work ```auto index: "[winlogbeat-]YYYY.MM" ``` Thanks, ---
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [April 11, 2016, 8:05pm UTC](https://discuss.elastic.co/t/how-to-generate-month-instead-of-weekly-indexes-in-winlogbeat/47037/2 "2016-04-11T20:05:45Z")
This is currently not possible with beats. There is an open enhancement request: [https://github.com/elastic/beats/issues/921](https://github.com/elastic/beats/issues/921) You need to send the data through Logstash if you want to use monthly indexes. ---
**Author:** ![anhlqn](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/anhlqn/32/5454_2.png) [@anhlqn](https://discuss.elastic.co/u/anhlqn)\ **Post date:** [April 11, 2016, 9:50pm UTC](https://discuss.elastic.co/t/how-to-generate-month-instead-of-weekly-indexes-in-winlogbeat/47037/3 "2016-04-11T21:50:45Z")
Thanks, being able to generate monthly or weekly indexes would be great because I want to limit the number of indexes and shards in a cluster. ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [April 12, 2016, 12:36am UTC](https://discuss.elastic.co/t/how-to-generate-month-instead-of-weekly-indexes-in-winlogbeat/47037/4 "2016-04-12T00:36:22Z")
You can do some of that if you modify the template for beats. ---
**Author:** ![anhlqn](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/anhlqn/32/5454_2.png) [@anhlqn](https://discuss.elastic.co/u/anhlqn)\ **Post date:** [April 12, 2016, 5:53am UTC](https://discuss.elastic.co/t/how-to-generate-month-instead-of-weekly-indexes-in-winlogbeat/47037/5 "2016-04-12T05:53:59Z")
I'm having 2 shards for 2 data nodes and 1 replica now. Should I even go for 1 shard and 1 replica? I have winlogbeat write to both ES data nodes. ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [April 12, 2016, 5:59am UTC](https://discuss.elastic.co/t/how-to-generate-month-instead-of-weekly-indexes-in-winlogbeat/47037/6 "2016-04-12T05:59:55Z")
Sure, that'd work fine. ---
**Author:** ![anhlqn](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/anhlqn/32/5454_2.png) [@anhlqn](https://discuss.elastic.co/u/anhlqn)\ **Post date:** [April 12, 2016, 6:04am UTC](https://discuss.elastic.co/t/how-to-generate-month-instead-of-weekly-indexes-in-winlogbeat/47037/7 "2016-04-12T06:04:36Z")
Will it somewhat affect indexing because data will be written to the ES instance that hosts the primary shard? ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [April 12, 2016, 6:08am UTC](https://discuss.elastic.co/t/how-to-generate-month-instead-of-weekly-indexes-in-winlogbeat/47037/8 "2016-04-12T06:08:25Z")
No because it needs to write to the replica anyway. ---
**Author:** ![anhlqn](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/anhlqn/32/5454_2.png) [@anhlqn](https://discuss.elastic.co/u/anhlqn)\ **Post date:** [April 13, 2016, 6:25pm UTC](https://discuss.elastic.co/t/how-to-generate-month-instead-of-weekly-indexes-in-winlogbeat/47037/9 "2016-04-13T18:25:22Z")
Yes, but index request must reach a primary shard first and then a replica to be considered completed. So in a setup of 2 data nodes with 1 primary shard and 1 replica, if I have logstash write to both data nodes in the configuration, Logstash will actually write to only the one node the hold the primary shard. Compared to 2 primary shards and 1 replica, in which each node hosts a primary shards, then Logstash can send data to both node simultaneously. I'm just not sure if it really makes any difference. ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [April 13, 2016, 8:54pm UTC](https://discuss.elastic.co/t/how-to-generate-month-instead-of-weekly-indexes-in-winlogbeat/47037/10 "2016-04-13T20:54:41Z")
> [@anhlqn](#): > > Logstash will actually write to only the one node the hold the primary shard And then ES sends the exact same thing to the replica. The two shards do the same amount of work, and that would be the same if you have 1 or two primaries with replicas ---
**Author:** ![anhlqn](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/anhlqn/32/5454_2.png) [@anhlqn](https://discuss.elastic.co/u/anhlqn)\ **Post date:** [April 13, 2016, 9:46pm UTC](https://discuss.elastic.co/t/how-to-generate-month-instead-of-weekly-indexes-in-winlogbeat/47037/11 "2016-04-13T21:46:09Z")
Thanks, ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [May 4, 2016, 9:46pm UTC](https://discuss.elastic.co/t/how-to-generate-month-instead-of-weekly-indexes-in-winlogbeat/47037/12 "2016-05-04T21:46:11Z")
This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.