# Issue with winlogbeat data in visualizations/dashboards

**URL:** <https://discuss.elastic.co/t/issue-with-winlogbeat-data-in-visualizations-dashboards/124182>\
**Category:** Beats\
**Tags:** winlogbeat\
**Created:** [March 16, 2018, 12:18am UTC](https://discuss.elastic.co/t/issue-with-winlogbeat-data-in-visualizations-dashboards/124182 "2018-03-16T00:18:24Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Malachi](https://avatars.discourse-cdn.com/v4/letter/m/8e8cbc/32.png) [@Malachi](https://discuss.elastic.co/u/Malachi)\
**Post date:** [March 16, 2018, 12:18am UTC](https://discuss.elastic.co/t/issue-with-winlogbeat-data-in-visualizations-dashboards/124182/1 "2018-03-16T00:18:24Z")

</div>

Hello,

I seem to have an issue with recent data not being available for visualizations or dashboards in Kibana. I have winlogbeats data from several servers that goes into my ELK stack. I have saved searches for this data that work fine and I can see/search the logs up to the minute.

However, when I try to create any visualizations using these saved searches, any data within about 3 days is not visible. If I use the timescale and put the range within 3 days I get no results found. If I move the time scale back to greater than 3 days I can see data.

I am able to search in the discovery tab using the fields that I am using for the visualizations so it seems like the fields are correct. This is a very weird issue and I am only having it with beats data. All my syslog, netflow, etc. works fine.

my environment:  
2 - centos 7 ES nodes 6.2.2-1  
1 - centos 7 ES client node 6.2.2-1 with kibana 6.2.2-1  
1 - centos 7 logstash 6.2.2-1

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [March 16, 2018, 12:37am UTC](https://discuss.elastic.co/t/issue-with-winlogbeat-data-in-visualizations-dashboards/124182/2 "2018-03-16T00:37:58Z")

</div>

It's easier for us to assist you if you post a single thread, otherwise it can be hard to track who's doing what and in which place. Let's keep the discussion in [Recent data missing in dashboard/visualizations](https://discuss.elastic.co/t/recent-data-missing-in-dashboard-visualizations/124119) going 🙂

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [March 16, 2018, 12:38am UTC](https://discuss.elastic.co/t/issue-with-winlogbeat-data-in-visualizations-dashboards/124182/3 "2018-03-16T00:38:00Z")

</div>


