# Separate process setup and write winlogbeat

**URL:** <https://discuss.elastic.co/t/separate-process-setup-and-write-winlogbeat/231733>\
**Category:** Beats\
**Created:** [May 8, 2020, 1:26pm UTC](https://discuss.elastic.co/t/separate-process-setup-and-write-winlogbeat/231733 "2020-05-08T13:26:50Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![orsa](https://avatars.discourse-cdn.com/v4/letter/o/5daacb/32.png) [@orsa](https://discuss.elastic.co/u/orsa)\
**Post date:** [May 8, 2020, 1:26pm UTC](https://discuss.elastic.co/t/separate-process-setup-and-write-winlogbeat/231733/1 "2020-05-08T13:26:50Z")

</div>

Hi  
I probably do not understand correctly what parameters should be in the configuration files when separating the installation process and writing data.

Please help me understand how it works correctly

my setup YML file

```auto
setup.ilm.enabled: true
setup.template.enabled: true
setup.template.settings:
  index.number_of_shards: 1
  index.number_of_replicas: 0
setup.dashboards.enabled: true
setup.ilm.check_exists: true
setup.ilm.overwrite: true

output.elasticsearch:
  username: "beats_setup"
  password: "pass1"
  protocol: http
  hosts: ["10.2.2.149:9200"]

```

i run  
`.\winlogbeat.exe setup --index-management -c .\setup.yml -v`

process create template - winlogbeat-7.6.2  
ILM policy - winlogbeat  
and empty index - winlogbeat-7.6.2-2020.05.08-000001

it`s fine.  
correct?

next step run write process  
firs i modify ILM policy in Kibana for my setting  
and start winlogbeat service

My write config

```auto
setup.ilm.enabled: false
setup.template.enabled: false
setup.dashboards.enabled: false
setup.ilm.check_exists: false
setup.ilm.overwrite: false

output.elasticsearch:
  username: "beats_write"
  password: "pass2"
  protocol: http
  hosts: ["10.2.2.149:9200"]

```

in ES will create index with name  
winlobeat-7.6.2-2020.05.08  
without last number

it`s not correct.

may be i not understand correctly doc.  
i think on setup step we upload template and ILM on server  
edit it if need

on write step we put event to server, ans ES use exist template and ILM for index  
in my write config i disable rewrite server policy beats policy and template.

Or i not right?

---

<div class="post-metadata">

**Author:** ![orsa](https://avatars.discourse-cdn.com/v4/letter/o/5daacb/32.png) [@orsa](https://discuss.elastic.co/u/orsa)\
**Post date:** [May 9, 2020, 9:57pm UTC](https://discuss.elastic.co/t/separate-process-setup-and-write-winlogbeat/231733/2 "2020-05-09T21:57:09Z")

</div>

i found where error  
in write yml

```auto
setup.ilm.enabled: false

```

i fix it to

```auto
setup.ilm.enabled: true

```

and all work fine

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 6, 2020, 11:57pm UTC](https://discuss.elastic.co/t/separate-process-setup-and-write-winlogbeat/231733/3 "2020-06-06T23:57:12Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.