# Packetbeat index template clone

**URL:** <https://discuss.elastic.co/t/packetbeat-index-template-clone/277437>\
**Category:** Beats\
**Tags:** packetbeat\
**Created:** [June 30, 2021, 9:21am UTC](https://discuss.elastic.co/t/packetbeat-index-template-clone/277437 "2021-06-30T09:21:21Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![TheHunter1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/thehunter1/32/80190_2.png) [@TheHunter1](https://discuss.elastic.co/u/TheHunter1)\
**Post date:** [June 30, 2021, 9:21am UTC](https://discuss.elastic.co/t/packetbeat-index-template-clone/277437/1 "2021-06-30T09:21:21Z")

</div>

Hello,

I would like to run packetbeat in 2 machines, and I would like to create 2 users, where the user 1 can see only logs of the first machine and user 2 can see only the logs of 2nd machine.

To do so, I began by cloning the `packetbeat-7.13.2` template, and named it `packetbeat-7.13.2-test`

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/0/4/043b6a96e7814729805d5ffc859ba1750da3b971.png)

Then I have configured my 1st packetbeat to use the default `packetbeat` template and the 2nd one to use the `packetbeat-7.13.2-test` template:

```auto
output.elasticsearch.index: "packetbeat-test-%{[agent.version]}-%{+yyyy.MM.dd}"
setup.template.name: "packetbeat-7.13.2-test"
setup.template.pattern: "packetbeat-7.13.2-test-*"
setup.ilm.enabled: false

```

and then run `setup` command :

```auto
packetbeat setup -e

```

This makes me get warning in the `Discover Tab` in some fields:

```auto
This field is defined as several types (string, integer, etc) across the indices that match this pattern. You may still be able to use this conflicting field, but it will be unaivailable for functions that require Kibana to know their type. Correcting this issue will require reindexing your data

```

This warning resulting the fail of multuple dashboards

So my questions are :

1- Is what I am doing the best way to disable user 2 to access logs of user 1 ? or there is another simple way.  
2- What I am doing wrong to get those warninig and how can I resolve that without reindixing (as it's a test I can delete the index and recreate it)  
3- If it's the best way to achieve what I want to do, How can I manage my indices as the ILM should be disabled ?

Thanks for your answer  
Best regards

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 28, 2021, 11:21am UTC](https://discuss.elastic.co/t/packetbeat-index-template-clone/277437/2 "2021-07-28T11:21:35Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.