New index pattern does not have ability to select time range

I have created a new sysmon-* index pattern for my Sysmon logs. The Sysmon logs were previously grouped in my winlogbeat-* index pattern and I had no issues. However now the new sysmon-* doesn't seem to have a Time assigned to it (Kibana doesn't have the Time field automatically showing like other patterns, and the calendar button to select a time range isn't available, nor is the bar graph showing the logs over time viewable). I am wondering if it is related to the new sysmon-* template not having the same settings and mappings as the winlogbeat-* template (I have just copied the settings over from the winlogbeat to the sysmon but not the mappings because it seems more cumbersome). Also my ElastAlert doesn't seem to be working with the new pattern (could be related to the field values now be different).

Any advice on how to fix this situation?

Kibana by default relies on the @timestamp field being present and set. Does your sysmon-* indices not have this? What are you using to index this data?

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.