# No matching indices found: No indices match pattern "winlogbeat-\*"

**URL:** <https://discuss.elastic.co/t/no-matching-indices-found-no-indices-match-pattern-winlogbeat/174750>\
**Category:** Beats\
**Tags:** winlogbeat\
**Created:** [April 1, 2019, 9:44am UTC](https://discuss.elastic.co/t/no-matching-indices-found-no-indices-match-pattern-winlogbeat/174750 "2019-04-01T09:44:29Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![WarriorHarb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warriorharb/32/43201_2.png) [@WarriorHarb](https://discuss.elastic.co/u/WarriorHarb)\
**Post date:** [April 1, 2019, 9:44am UTC](https://discuss.elastic.co/t/no-matching-indices-found-no-indices-match-pattern-winlogbeat/174750/1 "2019-04-01T09:44:29Z")

</div>

Hello ,  
So i installed winlogbeat as a service and it is running fine, when i check in Kibana i get that error:  
**No matching indices found: No indices match pattern "winlogbeat-\*"**  
-Logsash was configured to receive data from **Filebeat** and **Winlogbeat**.  
-Winlogbeat **output** is configured **to Logstash** and i commented the elastic output.  
-Logstash was configured to recieve data from port 5044.  
Here is the **winlogbeat** configuration:

```
#-------------------------- Elasticsearch output ------------------------------
#output.elasticsearch:
  # Array of hosts to connect to.
  #hosts: ["localhost:9200"]
#----------------------------- Logstash output --------------------------------
output.logstash:
  # The Logstash hosts
  hosts: ["localhost:5044"]

```

Here is the **Logstash** configuration:

```
input {
 beats {
port => 5044
}
}

```

Please note that i'm using a grok filter that is working fine with parsing data received from filebeat.  
Any help will be apperciated.

---

<div class="post-metadata">

**Author:** ![Michal\_Pristas](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/michal_pristas/32/46639_2.png) [@Michal\_Pristas](https://discuss.elastic.co/u/Michal_Pristas)\
**Post date:** [April 1, 2019, 11:53am UTC](https://discuss.elastic.co/t/no-matching-indices-found-no-indices-match-pattern-winlogbeat/174750/2 "2019-04-01T11:53:56Z")

</div>

Can you provide more details about how your Logstash is configured. You should also configure output `Logstash -> ElasticSearch`

Please see this page [Configuring input beats](https://www.elastic.co/guide/en/logstash/current/plugins-inputs-beats.html) to see the example of output config.

---

<div class="post-metadata">

**Author:** ![WarriorHarb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warriorharb/32/43201_2.png) [@WarriorHarb](https://discuss.elastic.co/u/WarriorHarb)\
**Post date:** [April 1, 2019, 12:47pm UTC](https://discuss.elastic.co/t/no-matching-indices-found-no-indices-match-pattern-winlogbeat/174750/3 "2019-04-01T12:47:28Z")

</div>

@Michal_Pristas hello Michal thanks for the quick response. yes it was done and note that it had worked fine with filebeat. here is the logstash configuration :

```
output {
elasticsearch {
hosts => "localhost:9200"
manage_template => false
index => "%{[@metadata][beat]}-%{+YYYY.MM}"
document_type => "%{[@metadata][type]}"
}
}

```

please let me know if i could provide you with more info about the configuration or logs.

---

<div class="post-metadata">

**Author:** ![WarriorHarb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warriorharb/32/43201_2.png) [@WarriorHarb](https://discuss.elastic.co/u/WarriorHarb)\
**Post date:** [April 1, 2019, 1:48pm UTC](https://discuss.elastic.co/t/no-matching-indices-found-no-indices-match-pattern-winlogbeat/174750/4 "2019-04-01T13:48:05Z")

</div>

The problem was solved, my mistake, the grok filter was dropping down the lines coming from winlogbeat (the "if grokparse\_failure drop" condition). Now it is working fine . Thanks @Michal_Pristas

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 29, 2019, 1:48pm UTC](https://discuss.elastic.co/t/no-matching-indices-found-no-indices-match-pattern-winlogbeat/174750/5 "2019-04-29T13:48:05Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.