# How to visualize the Winlogbeat data in Kibana Dashboard **URL:** \ **Category:** Beats\ **Tags:** winlogbeat\ **Created:** [December 26, 2016, 6:42am UTC](https://discuss.elastic.co/t/how-to-visualize-the-winlogbeat-data-in-kibana-dashboard/69975 "2016-12-26T06:42:53Z")\ **Posts on this page:** 14\ **Page:** 1
**Author:** ![prakash1243](https://avatars.discourse-cdn.com/v4/letter/p/35a633/32.png) [@prakash1243](https://discuss.elastic.co/u/prakash1243)\ **Post date:** [December 26, 2016, 6:42am UTC](https://discuss.elastic.co/t/how-to-visualize-the-winlogbeat-data-in-kibana-dashboard/69975/1 "2016-12-26T06:42:53Z")
Hi- Am able to run the Winlogbeat successfully and able to create the .winlogbeat.yml file and logs shows succesffully sending the data to Elastic Search pointing to [http://localhost:9200](http://localhost:9200) Would you please let me know, how to check whether the data has received to Elastic Search. ? When i open the Kibana, am able to add the Index, but couldn't see any data, says no data found. Am having the setup on a Windows-7 machine, Could some one please help. Thanks ! ---
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [December 26, 2016, 3:11pm UTC](https://discuss.elastic.co/t/how-to-visualize-the-winlogbeat-data-in-kibana-dashboard/69975/2 "2016-12-26T15:11:58Z")
What does the output of this command return? It should show what indices have been created and the number of documents in each index. `curl -XGET "http://localhost:9200/_cat/indices?v"` ---
**Author:** ![prakash1243](https://avatars.discourse-cdn.com/v4/letter/p/35a633/32.png) [@prakash1243](https://discuss.elastic.co/u/prakash1243)\ **Post date:** [December 26, 2016, 4:19pm UTC](https://discuss.elastic.co/t/how-to-visualize-the-winlogbeat-data-in-kibana-dashboard/69975/3 "2016-12-26T16:19:09Z")
Am having my set-up on Windows-7, I believe, CURL is a Linux command to execute. Would you please let me know, If we have any other windows command to check. I had executed GET winlogbeat-\*/\_count on the Console in Kiabna, shows up Nil results. { "count": 0, "\_shards": { "total": 0, "successful": 0, "failed": 0 } } But, My Winlogbeats service is running fine, Got logs in C:/ProgramData/Logs along with .winlogbeat.yml file. Please help. **Setup-Details:** Elastic Search - 5.1.1 Kibana - 5.1.1 X-Pack Installed and logging in with given credentials, "kibana" and "changeme" ---
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [December 26, 2016, 4:29pm UTC](https://discuss.elastic.co/t/how-to-visualize-the-winlogbeat-data-in-kibana-dashboard/69975/4 "2016-12-26T16:29:57Z")
You can make the equivalent request using `GET _cat/indices?v` from the console in Kibana. Or on Windows there is the [Invoke-WebRequest](https://msdn.microsoft.com/en-us/powershell/reference/5.1/microsoft.powershell.utility/invoke-webrequest) powershell cmdlet that you can use to make queries on the command line. Or you can just make the request from your browser. Can you post the logs from Winlogbeat? ---
**Author:** ![prakash1243](https://avatars.discourse-cdn.com/v4/letter/p/35a633/32.png) [@prakash1243](https://discuss.elastic.co/u/prakash1243)\ **Post date:** [December 26, 2016, 4:34pm UTC](https://discuss.elastic.co/t/how-to-visualize-the-winlogbeat-data-in-kibana-dashboard/69975/5 "2016-12-26T16:34:56Z")
I've executed the command given " GET \_cat/indices?v" Here is the snippet: health status index uuid pri rep docs.count docs.deleted store.size pri.store.size yellow open .monitoring-kibana-2-2016.12.23 i\_Jx79t-TH61DKWaanuWeg 1 1 yellow open .monitoring-es-2-2016.12.25 mQG72hfEThmMM6GQL-e3FQ 1 1 yellow open .monitoring-es-2-2016.12.26 SeOi9QQsSs2tY572SIbLGA 1 1 yellow open metricbeat JXJyAZKkQt-81JVciM6qFQ 5 1 yellow open winlogbeat y3pGYdUSTqmfV4fWE\_\_qYw 5 1 yellow open .monitoring-kibana-2-2016.12.26 RqaZuyBrTHam-lD9AlRn-w 1 1 yellow open .monitoring-data-2 38kEy7P7SDWTSBSuNprX\_w 1 1 yellow open .kibana SRqTMWgQSCOBbFl\_Xad8Sg 1 1 8 1 29.3kb 29.3kb yellow open .monitoring-kibana-2-2016.12.25 580AyMCaS0KEAcbQPBg7hQ 1 1 yellow open .monitoring-es-2-2016.12.23 AmzC3-BtTUiFhKm9ZliJwQ 1 1 I couldn't upload the text files, so I took a snippet of logs and attached as png files. ![](https://us1.discourse-cdn.com/elastic/original/2X/0/04c8f38d72f449bdb6378c1bcc567c8300f4e65b.PNG) ![](https://us1.discourse-cdn.com/elastic/original/2X/5/5a902f0a122dc7614f563f2365f9e036ed9aead7.PNG) ---
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [December 26, 2016, 4:37pm UTC](https://discuss.elastic.co/t/how-to-visualize-the-winlogbeat-data-in-kibana-dashboard/69975/6 "2016-12-26T16:37:35Z")
> [@prakash1243](#): > > ```auto > yellow open metricbeat JXJyAZKkQt-81JVciM6qFQ 5 1 > yellow open winlogbeat y3pGYdUSTqmfV4fWE__qYw 5 1 > > ``` How did you indices created that do not contain dates? Please post the configuration that you are using. ---
**Author:** ![prakash1243](https://avatars.discourse-cdn.com/v4/letter/p/35a633/32.png) [@prakash1243](https://discuss.elastic.co/u/prakash1243)\ **Post date:** [December 26, 2016, 4:41pm UTC](https://discuss.elastic.co/t/how-to-visualize-the-winlogbeat-data-in-kibana-dashboard/69975/7 "2016-12-26T16:41:52Z")
Sorry, am pretty new to the Elastic Stack, I get started with the limited resources I had and found it very much interesting. I don't think, I had created Indexes as such and I've attached the snippet of the winogbeat.yml file I had created. Could you please let me know, how do I create the indexes with the Timestamps as you mentioned? ![](https://us1.discourse-cdn.com/elastic/original/2X/e/eb2ac13f1ca0e939268ffc68e5f5d460bb7138fd.PNG) ---
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [December 26, 2016, 4:45pm UTC](https://discuss.elastic.co/t/how-to-visualize-the-winlogbeat-data-in-kibana-dashboard/69975/8 "2016-12-26T16:45:08Z")
You configured Winlogbeat to write to `index: winlogbeat` so all of your data is going to the `winlogbeat` index instead of a daily index. Stop Winlogbeat, delete the registry file, remove the `index: winlogbeat` line, and restart. See the documenation for [`index`](https://www.elastic.co/guide/en/beats/winlogbeat/current/elasticsearch-output.html#_index). ---
**Author:** ![prakash1243](https://avatars.discourse-cdn.com/v4/letter/p/35a633/32.png) [@prakash1243](https://discuss.elastic.co/u/prakash1243)\ **Post date:** [December 26, 2016, 5:07pm UTC](https://discuss.elastic.co/t/how-to-visualize-the-winlogbeat-data-in-kibana-dashboard/69975/9 "2016-12-26T17:07:03Z")
I had added the Index in the winlogbeat.yml config as "index: ## "winlogbeat-%{+yyyy.MM.dd}" And I ran the command in the console devtools:(GET \_cat/indices?v) yellow open winlogbeat y3pGYdUSTqmfV4fWE\_\_qYw 5 1 yellow open winlogbeat-2016.12.26 Mknuj-QRRFS4BERiqXYgMA 5 1 Is this the right approach for Winlogbeats Config ? Please correct me if am wrong. Thanks ! ---
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [December 26, 2016, 5:08pm UTC](https://discuss.elastic.co/t/how-to-visualize-the-winlogbeat-data-in-kibana-dashboard/69975/10 "2016-12-26T17:08:29Z")
Yes, that looks correct. ---
**Author:** ![prakash1243](https://avatars.discourse-cdn.com/v4/letter/p/35a633/32.png) [@prakash1243](https://discuss.elastic.co/u/prakash1243)\ **Post date:** [December 26, 2016, 5:13pm UTC](https://discuss.elastic.co/t/how-to-visualize-the-winlogbeat-data-in-kibana-dashboard/69975/11 "2016-12-26T17:13:59Z")
But, still I don't see any data on Kibana: GET winlogbeat-2016.12.26-\*/\_count { "count": 0, "\_shards": { "total": 0, "successful": 0, "failed": 0 } } And I tried creating Index like winlogbeat-2016.12.26-\*, but Kibana couldn't identify the pattern. Please help me out. Thanks ! ---
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [December 26, 2016, 5:25pm UTC](https://discuss.elastic.co/t/how-to-visualize-the-winlogbeat-data-in-kibana-dashboard/69975/12 "2016-12-26T17:25:41Z")
Try a query like `GET winlogbeat-*/_count`. ---
**Author:** ![prakash1243](https://avatars.discourse-cdn.com/v4/letter/p/35a633/32.png) [@prakash1243](https://discuss.elastic.co/u/prakash1243)\ **Post date:** [December 27, 2016, 4:39am UTC](https://discuss.elastic.co/t/how-to-visualize-the-winlogbeat-data-in-kibana-dashboard/69975/13 "2016-12-27T04:39:06Z")
Thanks so so much you. I logged in as elastic user, I do see the data now. 🙂 Finally I made it with the help of you. I was trying with the Kibana user, so I couldn't get any data. 🙂 Thank you very much for your support. You guys rock. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [January 24, 2017, 4:39am UTC](https://discuss.elastic.co/t/how-to-visualize-the-winlogbeat-data-in-kibana-dashboard/69975/14 "2017-01-24T04:39:22Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.