# Using Winlogbeat 7.2.0 with ILM enabled - Winlogbeat does not synchronize old logs. just todays logs

**URL:** <https://discuss.elastic.co/t/using-winlogbeat-7-2-0-with-ilm-enabled-winlogbeat-does-not-synchronize-old-logs-just-todays-logs/194291>\
**Category:** Beats\
**Tags:** ilm-index-lifecycle-management, winlogbeat\
**Created:** [August 7, 2019, 4:50pm UTC](https://discuss.elastic.co/t/using-winlogbeat-7-2-0-with-ilm-enabled-winlogbeat-does-not-synchronize-old-logs-just-todays-logs/194291 "2019-08-07T16:50:21Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![jeetthakkar](https://avatars.discourse-cdn.com/v4/letter/j/9dc877/32.png) [@jeetthakkar](https://discuss.elastic.co/u/jeetthakkar)\
**Post date:** [August 7, 2019, 4:50pm UTC](https://discuss.elastic.co/t/using-winlogbeat-7-2-0-with-ilm-enabled-winlogbeat-does-not-synchronize-old-logs-just-todays-logs/194291/1 "2019-08-07T16:50:21Z")

</div>

Hello,  
I can't import the older logs into elasticsearch even though the following options have been specified into winlogbeat.yml.

```auto
winlogbeat.event_logs:
  - name: Application
    ignore_older: 720h
  - name: System
    ignore_older: 720h
  - name: Security
    ignore_older: 720h
    tags: ["security", "elastic1"]
winlogbeat.shutdown_timeout: 30s

```

The ILM settings are shown below:

```auto
# ILM and template settings
setup.template.overwrite: true
setup.ilm.enabled: true
setup.ilm.rollover_alias: "elastic1"
setup.ilm.pattern: "{now/d}-000001"
setup.ilm.policy_file: "ilm_policy.json"
setup.ilm.policy_name: "elastic1"
setup.ilm.overwrite: true

```

ilm\_policy.json

```json
{
  "policy": {
    "phases": {
      "hot": {
        "actions": {
          "rollover": {
            "max_age": "7d",
            "max_size": "10G"
          }
        }
      },
      "warm": {
        "min_age": "7d",
        "actions": {
          "forcemerge": {
            "max_num_segments": 6
          },
          "shrink": {
            "number_of_shards": 6
          },
          "allocate": {
            "number_of_replicas": 1
          }
        }
      },
      "cold": {
        "min_age": "30d",
        "actions": {
          "allocate": {
            "require": {
              "type": "cold"
            }
          }
        }
      },
      "delete": {
        "min_age": "90d",
        "actions": {
          "delete": {}
        }
      }
    }
  }
}

```

---

<div class="post-metadata">

**Author:** ![rugenl](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rugenl/32/12887_2.png) [@rugenl](https://discuss.elastic.co/u/rugenl)\
**Post date:** [August 7, 2019, 5:54pm UTC](https://discuss.elastic.co/t/using-winlogbeat-7-2-0-with-ilm-enabled-winlogbeat-does-not-synchronize-old-logs-just-todays-logs/194291/2 "2019-08-07T17:54:59Z")

</div>

Prior to ILM, logs from a past date, say 2019.01.01, would be placed into an index with the same name. With ILM, they go into the current writing index. But, the @timestamp should have the 2019.01.01 date.

Are you looking at the index name or the @timestamp?

---

<div class="post-metadata">

**Author:** ![rugenl](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rugenl/32/12887_2.png) [@rugenl](https://discuss.elastic.co/u/rugenl)\
**Post date:** [August 7, 2019, 5:58pm UTC](https://discuss.elastic.co/t/using-winlogbeat-7-2-0-with-ilm-enabled-winlogbeat-does-not-synchronize-old-logs-just-todays-logs/194291/3 "2019-08-07T17:58:17Z")

</div>

I just happened to install and start winlogbeat on a system sending to a test stack yesterday. I just checked and I have logs back to May, about the time the windows system was installed.

My winlogbeat version is 7.3.0, so close.

---

<div class="post-metadata">

**Author:** ![jeetthakkar](https://avatars.discourse-cdn.com/v4/letter/j/9dc877/32.png) [@jeetthakkar](https://discuss.elastic.co/u/jeetthakkar)\
**Post date:** [August 7, 2019, 7:53pm UTC](https://discuss.elastic.co/t/using-winlogbeat-7-2-0-with-ilm-enabled-winlogbeat-does-not-synchronize-old-logs-just-todays-logs/194291/4 "2019-08-07T19:53:28Z")

</div>

This is my mistake. The password in the Keystore had not been updated even though the password had been updated in kibana - Which for some reason was causing an indeterminate number of log entries to go through, which is strange.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 4, 2019, 7:53pm UTC](https://discuss.elastic.co/t/using-winlogbeat-7-2-0-with-ilm-enabled-winlogbeat-does-not-synchronize-old-logs-just-todays-logs/194291/5 "2019-09-04T19:53:34Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.