# Не появляется индекс в index pattern

**URL:** <https://discuss.elastic.co/t/index-pattern/299303>\
**Category:** Вопросы на русском языке\
**Created:** [March 10, 2022, 8:10am UTC](https://discuss.elastic.co/t/index-pattern/299303 "2022-03-10T08:10:17Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![holpa](https://avatars.discourse-cdn.com/v4/letter/h/9de0a6/32.png) [@holpa](https://discuss.elastic.co/u/holpa)\
**Post date:** [March 10, 2022, 8:10am UTC](https://discuss.elastic.co/t/index-pattern/299303/1 "2022-03-10T08:10:17Z")

</div>

Здравствуйте. Подскажите куда копать. Уже переустановил kibana elastic и logstash. А началось все с того что захотел очистить базу (индексы) и освободить место.  
В общем не могу добавить свой индекс в виндовс сервера.  
Мои настройки  
winlogbeat:

```auto
winlogbeat.event_logs:
- name: ForwardedEvents
  forwarded: true
 # ignore_older: 72h
tags: ["winsrvad"]
output.logstash:
  hosts: ["10.50.2.2:5044"]
#logging.level: info
#logging.to_files: true
logging.files:
  path: C:\Program Files\winlogbeat

```

В кибане только  
server.host: "10.50.2.2"

logstash:  
filter

```auto
filter {
    if "winsrvad" in [tags] {
	if [winlog][event_id] != "5136" and [winlog][event_id] != "5139" and [winlog][event_id] != "5141" and [winlog][event_id] != "5137" and [winlog][event_id] != "4741" and [winlog][event_id] != "4742" and [winlog][event_id] != "4743" and [winlog][event_id] != "4720" and [winlog][event_id] != "4721" and [winlog][event_id] != "4722" and [winlog][event_id] != "4723" and [winlog][event_id] != "4724" and [winlog][event_id] != "4725" and [winlog][event_id] != "4726" and [winlog][event_id] != "4738" and [winlog][event_id] != "4740" and [winlog][event_id] != "4767" and [winlog][event_id] != "4781" and [winlog][event_id] != "4794" and [winlog][event_id] != "1102" and [winlog][event_id] != "4744" and [winlog][event_id] != "4744" and [winlog][event_id] != "4745" and [winlog][event_id] != "4746" and [winlog][event_id] != "4747" and [winlog][event_id] != "4748" and [winlog][event_id] != "4749" and [winlog][event_id] != "4750" and [winlog][event_id] != "4751" and [winlog][event_id] != "4752" and [winlog][event_id] != "4753" and [winlog][event_id] != "4759" and [winlog][event_id] != "4760" and [winlog][event_id] != "4761" and [winlog][event_id] != "4762" and [winlog][event_id] != "4727" and [winlog][event_id] != "4728" and [winlog][event_id] != "4729" and [winlog][event_id] != "4730" and [winlog][event_id] != "4731" and [winlog][event_id] != "4732" and [winlog][event_id] != "4733" and [winlog][event_id] != "4734" and [winlog][event_id] != "4735" and [winlog][event_id] != "4736" and [winlog][event_id] != "4737" and [winlog][event_id] != "4754" and [winlog][event_id] != "4755" and [winlog][event_id] != "4756" and [winlog][event_id] != "4757" and [winlog][event_id] != "4758" and [winlog][event_id] != "4764" and [winlog][event_id] != "4776" and [winlog][event_id] != "4625" {
	drop { }
	}
    }
}

```

input:

```auto
input {
beats {
port => 5044
      }

```

filter:

```auto
output {
    else if "winsrvad" in [tags] {
        elasticsearch {
            hosts => "localhost:9200"
            index => "winsrvad-%{+YYYY.MM.dd}"
            user => Logstash
            password => xxxxxxxx
        }
    }
}

```

Вроде все стандратно.  
Должен быть winsrvad\*

 ![1](https://us1.discourse-cdn.com/elastic/original/3X/e/1/e1e21bbaefe637b2dbc6d899def2e0097dee71bd.png)

 ![2](https://us1.discourse-cdn.com/elastic/original/3X/c/3/c367227710d0d321b581d40510d94e758af21bac.png)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 7, 2022, 8:11am UTC](https://discuss.elastic.co/t/index-pattern/299303/2 "2022-04-07T08:11:12Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.