Trying to add windows winlogbeat and the standard dashboards, but dashboards are empty

Elastic Stack Beats
1

Hi All
After rebuilding the entire elastic stack to 7.16.3 currently, I wanted to expand the elastic to also monitor our windows servers.

I have a winlogbeat config that looks like this:

winlogbeat.event_logs:
  - name: Security
    fields:
      logtype: winlogbeat
  - name: Application
    fields:
      logtype: winlogbeat
  - name: System
    fields:
      logtype: winlogbeat

setup.template.settings:
  index.number_of_shards: 2

output.logstash:
  hosts: ["logstash.onead.dk:5000"]

My logstash pipeline config looks like this:

input {
        beats {
                port => 5000
                ecs_compatibility => disabled
        }
        syslog {
        }
}

#############################################
#  Winlogbeat does not require processing   #
#############################################
...
output {
  elasticsearch {
    hosts => "https://elasticsearch:9200"
      index => "%{[fields][logtype]}-%{[@metadata][version]}-%{+YYYY.MM}"
      document_type => "%{[@metadata][type]}"
      cacert => "/usr/share/logstash/config/certs/ca/ca.crt"
      user => XXX
      password => XXX
  }
}

I can see data flowing nicely into elastic

billede
billede253×1116 50.3 KB

but when I open the dashboards that are installed as per default, most of them are empty.
What did I do wrong?

2

Hello @fribse

Please execute this below command to load the default dashboards

./winlogbeat setup --dashboards

For more information, refer this below link

3

Hello @fribse

is the default dashboards loaded now with the beats data using the above command

4

Hello @fribse

Able to load the standard dashboards with your inputs??

Keep Posted !!! Thanks !!!

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.