Hello, I can't import the older logs into elasticsearch even though the following options have been specified into winlogbeat.yml. winlogbeat.event_logs: - name: Application ignore_older: 720h - name: System ignore_older: 720h - name: Security ignore_older: 720h tags: ["secur…

Prior to ILM, logs from a past date, say 2019.01.01, would be placed into an index with the same name. With ILM, they go into the current writing index. But, the @timestamp should have the 2019.01.01 date. Are you looking at the index name or the @timestamp?

Discuss the Elastic Stack

Using Winlogbeat 7.2.0 with ILM enabled - Winlogbeat does not synchronize old logs. just todays logs

Elastic Stack Beats

system (system) Closed September 4, 2019, 7:53pm 5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.

Topic		Replies	Views
Winlogbeat ILM and logstash Beats	3	472	December 31, 2019
Winlogbeat creates indexes based on dates from the past Beats winlogbeat	5	1557	October 28, 2016
Change loaded index name Beats winlogbeat	7	1051	May 8, 2020
Winlogbeat default age to ingest Beats winlogbeat	5	551	November 5, 2018
Winlogbeat configuration for index rollover Beats winlogbeat	2	168	May 9, 2024

Elasticsearch is a trademark of Elasticsearch BV, registered in the U.S. and in other countries
Trademarks
Terms
Privacy
Brand
Code of Conduct

Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant logo are trademarks of the Apache Software Foundation in the United States and/or other countries.

Using Winlogbeat 7.2.0 with ILM enabled - Winlogbeat does not synchronize old logs. just todays logs

Related topics