# Index Mismatch

**URL:** <https://discuss.elastic.co/t/index-mismatch/118303>\
**Category:** Kibana\
**Created:** [February 3, 2018, 9:32am UTC](https://discuss.elastic.co/t/index-mismatch/118303 "2018-02-03T09:32:27Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![danni](https://avatars.discourse-cdn.com/v4/letter/d/ba8739/32.png) [@danni](https://discuss.elastic.co/u/danni)\
**Post date:** [February 3, 2018, 9:32am UTC](https://discuss.elastic.co/t/index-mismatch/118303/1 "2018-02-03T09:32:27Z")

</div>

I am having an issue with kibana. My setup is a little like this:

1. Windows Logs from a WEC server
2. Linux logs including apache and weblogic
3. Winlogbeat and filebeat with filebeat-\* index and winevnt-\* index and being ingested on different ports

My problem is that when i upgraded to elastic 6.1.3 from 6.0.0, filebeat-\* index is full of windows event logs even and to see the actual logs for filebeat-\* index, i am forced to use filters and queries. Is this a bug or are my configurations all weirdly setup?

---

<div class="post-metadata">

**Author:** ![rashmi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rashmi/32/16391_2.png) [@rashmi](https://discuss.elastic.co/u/rashmi)\
**Post date:** [February 5, 2018, 4:43pm UTC](https://discuss.elastic.co/t/index-mismatch/118303/2 "2018-02-05T16:43:36Z")

</div>

Hi

Can you please paste your config here( sans the sensitive data) . We may help you debug if its a wrong config . It sounds like winlogbeat logs are going to filebeat-_?  
Anyways either way it's a misconfiguration somewhere - either kibana has an index pattern that's matching all indices (_) or winlogbeat and filebeat are configured to point to the wrong indices.

Thanks  
Rashmi

---

<div class="post-metadata">

**Author:** ![danni](https://avatars.discourse-cdn.com/v4/letter/d/ba8739/32.png) [@danni](https://discuss.elastic.co/u/danni)\
**Post date:** [February 6, 2018, 5:07pm UTC](https://discuss.elastic.co/t/index-mismatch/118303/3 "2018-02-06T17:07:42Z")

</div>

Attached is a screen shot and the config for both windows and linux  
apache host.

Thanks

 ![](https://us1.discourse-cdn.com/elastic/original/3X/e/4/e4564ba56e2dfd0f2e88c780411a0bda70d486d0.png)

---

<div class="post-metadata">

**Author:** ![rashmi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rashmi/32/16391_2.png) [@rashmi](https://discuss.elastic.co/u/rashmi)\
**Post date:** [February 6, 2018, 6:39pm UTC](https://discuss.elastic.co/t/index-mismatch/118303/4 "2018-02-06T18:39:08Z")

</div>

The config was not posted here. Can you re-post it ?

Thanks  
Rashmi

---

<div class="post-metadata">

**Author:** ![danni](https://avatars.discourse-cdn.com/v4/letter/d/ba8739/32.png) [@danni](https://discuss.elastic.co/u/danni)\
**Post date:** [February 6, 2018, 10:33pm UTC](https://discuss.elastic.co/t/index-mismatch/118303/5 "2018-02-06T22:33:46Z")

</div>

Here is the text config:

====================================WINLOG  
CONFIG=========================

input {  
tcp {  
port =\> 6051  
codec =\> json  
tags =\> ["json"]  
}

# stdin { }

}  
filter {  
if "json" in [tags] {  
mutate {  
#add\_tag =\> ["conf\_file\_0001"]  
}  
}  
}  
output {  
elasticsearch {  
hosts =\> ["localhost:9200"]  
index =\> "winevent-%{+YYYY.MM.dd}"  
}  
}

==============================APACHE  
CONFIG===============================  
input {  
beats {  
port =\> 5044  
}  
}

filter {  
if [fileset][name] == "access" {  
grok {  
match =\> { "message" =\> "%{IP:client} - -  
[%{HTTPDATE:apache\_timestamp}] "(?:%{WORD:method}  
%{URIPATH:request}(?:?%{NOTSPACE:query\_string})?(?:  
HTTP/%{NUMBER:httpversion})?|%{DATA:rawrequest})" %{NUMBER:response}  
%{WORD:bytes}" }  
}  
}  
else if [fileset][name] == "error" {  
grok {  
match =\> { "message" =\> "[%{DATA:apache\_timestamp}]  
[%{WORD:type}] [client %{IP:client}] %{GREEDYDATA:log\_message}" }  
}  
date {  
match =\> ["apache\_timestamp" , "EEE MMM dd HH:mm:ss yyyy"]  
}  
}  
}

output {  
elasticsearch {  
hosts =\> ["localhost:9200"]  
manage\_template =\> false  
index =\> "apachebeat-%{+YYYY.MM.dd}"  
}  
}

---

<div class="post-metadata">

**Author:** ![danni](https://avatars.discourse-cdn.com/v4/letter/d/ba8739/32.png) [@danni](https://discuss.elastic.co/u/danni)\
**Post date:** [February 6, 2018, 10:35pm UTC](https://discuss.elastic.co/t/index-mismatch/118303/6 "2018-02-06T22:35:42Z")

</div>

They are different configs btw. One if for recieving windows logs and  
the other one is for recieving linux and other application logs  
especially apache and others am having. But when i select the  
apachebeat\* index from the discover console, it displays windows logs  
instead which is very odd

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 6, 2018, 10:36pm UTC](https://discuss.elastic.co/t/index-mismatch/118303/7 "2018-03-06T22:36:01Z")

</div>

Closed on March 6, 2018, 10:36pm UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.