# New index pattern does not have ability to select time range

**URL:** <https://discuss.elastic.co/t/new-index-pattern-does-not-have-ability-to-select-time-range/356023>\
**Category:** Elasticsearch\
**Created:** [March 23, 2024, 2:40am UTC](https://discuss.elastic.co/t/new-index-pattern-does-not-have-ability-to-select-time-range/356023 "2024-03-23T02:40:09Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![roman-tasi](https://avatars.discourse-cdn.com/v4/letter/r/7ea924/32.png) [@roman-tasi](https://discuss.elastic.co/u/roman-tasi)\
**Post date:** [March 23, 2024, 2:40am UTC](https://discuss.elastic.co/t/new-index-pattern-does-not-have-ability-to-select-time-range/356023/1 "2024-03-23T02:40:09Z")

</div>

I have created a new `sysmon-*` index pattern for my Sysmon logs. The Sysmon logs were previously grouped in my `winlogbeat-*` index pattern and I had no issues. However now the new `sysmon-*` doesn't seem to have a Time assigned to it (Kibana doesn't have the Time field automatically showing like other patterns, and the calendar button to select a time range isn't available, nor is the bar graph showing the logs over time viewable). I am wondering if it is related to the new `sysmon-*` template not having the same settings and mappings as the `winlogbeat-*` template (I have just copied the settings over from the winlogbeat to the sysmon but not the mappings because it seems more cumbersome). Also my ElastAlert doesn't seem to be working with the new pattern (could be related to the field values now be different).

Any advice on how to fix this situation?

---

<div class="post-metadata">

**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\
**Post date:** [March 24, 2024, 7:15am UTC](https://discuss.elastic.co/t/new-index-pattern-does-not-have-ability-to-select-time-range/356023/2 "2024-03-24T07:15:03Z")

</div>

Kibana by default relies on the `@timestamp` field being present and set. Does your `sysmon-*` indices not have this? What are you using to index this data?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 21, 2024, 7:15am UTC](https://discuss.elastic.co/t/new-index-pattern-does-not-have-ability-to-select-time-range/356023/3 "2024-04-21T07:15:53Z")

</div>

Closed on April 21, 2024, 7:15am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.