# Issue shipping Winlogbeat 5.x to Elasticsearch 2.x **URL:** https://discuss.elastic.co/t/issue-shipping-winlogbeat-5-x-to-elasticsearch-2-x/47301 **Category:** Beats **Tags:** winlogbeat **Created:** [April 13, 2016, 6:34pm UTC](https://discuss.elastic.co/t/issue-shipping-winlogbeat-5-x-to-elasticsearch-2-x/47301 "2016-04-13T18:34:44Z") **Posts on this page:** 1 **Showing post:** 6
### Author: ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh) #### Post date: [April 14, 2016, 3:43pm UTC](https://discuss.elastic.co/t/issue-shipping-winlogbeat-5-x-to-elasticsearch-2-x/47301/6 "2016-04-14T15:43:46Z")
It looks like you are using the Winlogbeat 5.0.0-alpha1 with Elasticsearch 1.x or 2.x? There is an incompatibility with the `winlogbeat.template.json` index template provided in Winlogbeat v5 and earlier versions of Elasticsearch because the template uses the `text` keyword that was introduced in ES v5. To continue to use Winlogbeat 5.x with ES 1.x or 2.x you'll need to grab the index template provided in Winlogbeat 1.x and install it to ES. Cleanup: 1. Stop Winlogbeat. 2. Delete the .winlogbeat.yml registry file so that it reindexes your data when it restarts. 3. Delete any data in your index. `curl -XDELETE http://es:9200/winlogbeat-*` 4. Delete the current mapping. `curl -XDELETE http://es:9200/_template/winlogbeat` Install 1.x index template: 1. Replace the file you have at `F:/Winlogbeat/Winlogbeat/winlogbeat.template.json` with the [file from Winlogbeat 1.X](https://raw.githubusercontent.com/elastic/beats/1.2/winlogbeat/etc/winlogbeat.template.json). 2. Start Winlogbeat and it should install the template to ES for you. In your config I would set `overwrite: false`. I think it's better for you to be in control of changes to the index template. --- _[View the full topic](https://discuss.elastic.co/t/issue-shipping-winlogbeat-5-x-to-elasticsearch-2-x/47301)._