# SOLVED Index pattern field (LogonType)

**URL:** <https://discuss.elastic.co/t/solved-index-pattern-field-logontype/60604>\
**Category:** Elasticsearch\
**Created:** [September 15, 2016, 12:31pm UTC](https://discuss.elastic.co/t/solved-index-pattern-field-logontype/60604 "2016-09-15T12:31:31Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![NFA](https://avatars.discourse-cdn.com/v4/letter/n/7c8e57/32.png) [@NFA](https://discuss.elastic.co/u/NFA)\
**Post date:** [September 15, 2016, 12:31pm UTC](https://discuss.elastic.co/t/solved-index-pattern-field-logontype/60604/1 "2016-09-15T12:31:31Z")

</div>

Hello

I'm trying to import a premade visualization from [https://www.elastic.co/blog/monitoring-windows-logons-with-winlogbeat](https://www.elastic.co/blog/monitoring-windows-logons-with-winlogbeat)

The thing is when i import this object i get the follow error:  
Saved Objects: Could not locate that index-pattern-field (id: event\_data.LogonType)

Before trying to import this object i used this:  
curl -XPUT '[http://localhost:9200/\_template/winlogbeat?pretty](http://localhost:9200/_template/winlogbeat?pretty)' -d@winlogbeat.template.json  
and got "acknowledged" : true

winlogbeat.template.json is the template from the same article:

> **[Monitoring Windows Logons with Winlogbeat
	  	 | Elastic](https://www.elastic.co/blog/monitoring-windows-logons-with-winlogbeat)**
>
> Windows event logs can provide invaluable insight into your Windows based infrastructure. The Windows operating system has many event log channels, each dedicated to a specific category of events. In ...

Can someone help me with this error?

---

<div class="post-metadata">

**Author:** ![NFA](https://avatars.discourse-cdn.com/v4/letter/n/7c8e57/32.png) [@NFA](https://discuss.elastic.co/u/NFA)\
**Post date:** [September 16, 2016, 7:48am UTC](https://discuss.elastic.co/t/solved-index-pattern-field-logontype/60604/2 "2016-09-16T07:48:47Z")

</div>

I used:  
curl -XPUT '[https://localhost:9200/\_template/winlogbeat\_1](https://localhost:9200/_template/winlogbeat_1)' -d@winlogbeat.template.json

Now it works 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 5, 2017, 10:19pm UTC](https://discuss.elastic.co/t/solved-index-pattern-field-logontype/60604/3 "2017-07-05T22:19:47Z")

</div>


