# Where do these OLD Indexes come from?

**URL:** <https://discuss.elastic.co/t/where-do-these-old-indexes-come-from/77532>\
**Category:** Beats\
**Created:** [March 6, 2017, 3:40pm UTC](https://discuss.elastic.co/t/where-do-these-old-indexes-come-from/77532 "2017-03-06T15:40:27Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![kopacko](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kopacko/32/10733_2.png) [@kopacko](https://discuss.elastic.co/u/kopacko)\
**Post date:** [March 6, 2017, 3:40pm UTC](https://discuss.elastic.co/t/where-do-these-old-indexes-come-from/77532/1 "2017-03-06T15:40:27Z")

</div>

Looking at my cluster, I am seeing some clusters with dates back to (logstash-2007.02.26). How on earth did these get created?

Is some sending devices data/time off?

---

<div class="post-metadata">

**Author:** ![kopacko](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kopacko/32/10733_2.png) [@kopacko](https://discuss.elastic.co/u/kopacko)\
**Post date:** [March 6, 2017, 5:25pm UTC](https://discuss.elastic.co/t/where-do-these-old-indexes-come-from/77532/2 "2017-03-06T17:25:42Z")

</div>

Found a Windows server, that winlogbeat decided to go back to the first log and started piping in logs from 2007.

---

<div class="post-metadata">

**Author:** ![kopacko](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kopacko/32/10733_2.png) [@kopacko](https://discuss.elastic.co/u/kopacko)\
**Post date:** [March 6, 2017, 5:25pm UTC](https://discuss.elastic.co/t/where-do-these-old-indexes-come-from/77532/3 "2017-03-06T17:25:59Z")

</div>

Even though the winlogbeat config was set to 72h.

---

<div class="post-metadata">

**Author:** ![kopacko](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kopacko/32/10733_2.png) [@kopacko](https://discuss.elastic.co/u/kopacko)\
**Post date:** [March 6, 2017, 6:56pm UTC](https://discuss.elastic.co/t/where-do-these-old-indexes-come-from/77532/4 "2017-03-06T18:56:29Z")

</div>

Sooooo,  
We started pushing out winlogbeat to all our Windows servers and I am systematically finding more and more servers who are logging SYSTEM event logs prior to the 72h option. Is this a bug?

---

<div class="post-metadata">

**Author:** ![kopacko](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kopacko/32/10733_2.png) [@kopacko](https://discuss.elastic.co/u/kopacko)\
**Post date:** [March 7, 2017, 9:10pm UTC](https://discuss.elastic.co/t/where-do-these-old-indexes-come-from/77532/5 "2017-03-07T21:10:45Z")

</div>

Anyone have any insight or seen this?

It appears that logs older than 72 hours in the System log and the Security logs are getting sent.

---

<div class="post-metadata">

**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\
**Post date:** [March 10, 2017, 11:18pm UTC](https://discuss.elastic.co/t/where-do-these-old-indexes-come-from/77532/6 "2017-03-10T23:18:15Z")

</div>

Did you remove the registry file between restarts? Try to stop Winlogbeat, remove the registry file and start it again to see if it correctly ignores the events.

Do you send data through LS? Can you share your config for LS and FB?

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [March 10, 2017, 11:57pm UTC](https://discuss.elastic.co/t/where-do-these-old-indexes-come-from/77532/7 "2017-03-10T23:57:44Z")

</div>

Did you modify the config file to add `ignore_older` for all logs that you are monitoring? Each event log has it's own configuration block.

```auto
winlogbeat.event_logs:
- name: X
  ignore_older: 168h
- name: Y
  ignore_older: 168h

```

---

<div class="post-metadata">

**Author:** ![kopacko](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kopacko/32/10733_2.png) [@kopacko](https://discuss.elastic.co/u/kopacko)\
**Post date:** [March 16, 2017, 8:25pm UTC](https://discuss.elastic.co/t/where-do-these-old-indexes-come-from/77532/8 "2017-03-16T20:25:08Z")

</div>

I don't even see that in the config template.

I will add that now.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 27, 2017, 3:40pm UTC](https://discuss.elastic.co/t/where-do-these-old-indexes-come-from/77532/9 "2017-03-27T15:40:55Z")

</div>

This topic was automatically closed after 21 days. New replies are no longer allowed.