# Sample Dashboard Errors? **URL:** \ **Category:** Beats\ **Tags:** winlogbeat\ **Created:** [June 29, 2018, 4:07pm UTC](https://discuss.elastic.co/t/sample-dashboard-errors/138003 "2018-06-29T16:07:05Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![gavin.mcmenemy](https://avatars.discourse-cdn.com/v4/letter/g/58f4c7/32.png) [@gavin.mcmenemy](https://discuss.elastic.co/u/gavin.mcmenemy)\ **Post date:** [June 29, 2018, 4:07pm UTC](https://discuss.elastic.co/t/sample-dashboard-errors/138003/1 "2018-06-29T16:07:05Z")
Hi Everyone, I'm building a proof of concept using ELK + Winlogbeat to provide us with tools analysing data from Windows Event logs. In this environment I have 2 servers: log server + ELK server It looks like everything is working. Events are being sent form the Logserver to ELK. I have an index pattern working... However I have 2 questions: 1. I did have some prior test data in he ELK and I'd pushed the sample dashboards to it. This was so that I could demonstrate the idea to my manager. I have since cleared the old index and created a new one. However the dashboard are all broken. The index has the same name "Winlogbeat-\*" On the dashboard in Kibana it says "click here to fix" but it's not clickable. So I am totally confused. 1. I have many weeks of events in the log ForwardedEvents however the Index is only showing events from a couple of days. How do I get it to go back further. Note that I have the following entry in my config: > winlogbeat.event\_logs: > > - name: ForwardedEvents > ignore\_older: 8760h > > # ignore\_older: 72h > > # - name: Application > > # - name: Security > > # - name: System ---
**Author:** ![pierhugues](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pierhugues/32/48383_2.png) [@pierhugues](https://discuss.elastic.co/u/pierhugues)\ **Post date:** [June 29, 2018, 4:30pm UTC](https://discuss.elastic.co/t/sample-dashboard-errors/138003/2 "2018-06-29T16:30:35Z")
Hello @gavin.mcmenemy What version of Winlogbeat, Elasticsearch and Kibana are you running? I am asking that because we don't need to push dashboard with the latest version it is done by the agent on first start. Concerning 2, You should be able to change the time period using the time picker which is located at the top right of Kibana. ---
**Author:** ![gavin.mcmenemy](https://avatars.discourse-cdn.com/v4/letter/g/58f4c7/32.png) [@gavin.mcmenemy](https://discuss.elastic.co/u/gavin.mcmenemy)\ **Post date:** [July 2, 2018, 8:32am UTC](https://discuss.elastic.co/t/sample-dashboard-errors/138003/3 "2018-07-02T08:32:48Z")
HI Pier, Thanks for the reply. I'm very new to ELK and Winlogbeat. I followed the getting started section of the documentation. In answer to your question: Everything is the latest version. I'm following the latest edition of your documentation. Forgive my ignorance but does this section not push dashoards? [https://www.elastic.co/guide/en/beats/winlogbeat/current/load-kibana-dashboards.html](https://www.elastic.co/guide/en/beats/winlogbeat/current/load-kibana-dashboards.html) As I say, the sample dashboards were working until the index was deleted. I'm not sure how I bring them back. ![Capture](https://us1.discourse-cdn.com/elastic/original/3X/7/9/79dff6a69d59772276d95bd2505fa696d9134f49.JPG) ---
**Author:** ![adrisr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adrisr/32/25423_2.png) [@adrisr](https://discuss.elastic.co/u/adrisr)\ **Post date:** [July 2, 2018, 12:56pm UTC](https://discuss.elastic.co/t/sample-dashboard-errors/138003/4 "2018-07-02T12:56:43Z")
Hi @gavin.mcmenemy, Which index pattern shows up in Kibana when you go to Management -\> Index Pattern ? Is it set as default? Also paste the result of running `GET /_cat/indices` in Dev Tools ---
**Author:** ![gavin.mcmenemy](https://avatars.discourse-cdn.com/v4/letter/g/58f4c7/32.png) [@gavin.mcmenemy](https://discuss.elastic.co/u/gavin.mcmenemy)\ **Post date:** [July 2, 2018, 1:24pm UTC](https://discuss.elastic.co/t/sample-dashboard-errors/138003/5 "2018-07-02T13:24:13Z")
Hi Adrian: Under Management -\> Index pattern I see the following: ![Capture](https://us1.discourse-cdn.com/elastic/original/3X/b/9/b926948bddc60ef80f1019a8ab9c73684c29ca8b.JPG) There's only the one index - to is it not set as default? I can see the star there. The Get /\_cat/indices shows the following > yellow open winlogbeat-6.2.4-2018.07.01 T1f2DAPDTjKHwlRxnBs3ew 3 1 111783 0 92.6mb 92.6mb > yellow open winlogbeat-6.2.4-2018.06.29 ezqsbVgySLKi8iOsZ5-R4w 3 1 102056 0 86.3mb 86.3mb > yellow open winlogbeat-6.2.4-2018.06.30 Gd2c0\_METym\_PYx6GnnTYg 3 1 114268 0 94.7mb 94.7mb > yellow open winlogbeat-6.2.4-2018.07.02 7U-3kTXJTjePtynZ5Dg7cQ 3 1 82487 0 75.3mb 75.3mb > green open .kibana MSO-JBOKRDuPICFbqkg7Uw 1 0 8 2 39.7kb 39.7kb ---
**Author:** ![gavin.mcmenemy](https://avatars.discourse-cdn.com/v4/letter/g/58f4c7/32.png) [@gavin.mcmenemy](https://discuss.elastic.co/u/gavin.mcmenemy)\ **Post date:** [July 2, 2018, 1:24pm UTC](https://discuss.elastic.co/t/sample-dashboard-errors/138003/6 "2018-07-02T13:24:48Z")
I think the "yellow" is a config issue. ---
**Author:** ![adrisr](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/adrisr/32/25423_2.png) [@adrisr](https://discuss.elastic.co/u/adrisr)\ **Post date:** [July 2, 2018, 2:02pm UTC](https://discuss.elastic.co/t/sample-dashboard-errors/138003/7 "2018-07-02T14:02:32Z")
Can you try installing the dashboards again? Run `winlogbeat.exe --setup` ---
**Author:** ![gavin.mcmenemy](https://avatars.discourse-cdn.com/v4/letter/g/58f4c7/32.png) [@gavin.mcmenemy](https://discuss.elastic.co/u/gavin.mcmenemy)\ **Post date:** [July 2, 2018, 3:56pm UTC](https://discuss.elastic.co/t/sample-dashboard-errors/138003/8 "2018-07-02T15:56:28Z")
Hey Adrian, Thanks! That appears to have fixed the dashboards. I'll have to remember to do that in the future. I know it only fixes the sample dashboards (and I have a lot more work to do there) it at least allowed me to get a visualisation of our existing data. I am still unsure why the data isn't looking correct. Perhaps my Event Forwarding infrastructure has a problem? Who knows I can at least see there's an issue! ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 30, 2018, 3:56pm UTC](https://discuss.elastic.co/t/sample-dashboard-errors/138003/9 "2018-07-30T15:56:28Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.