Hello all. After recovering my ELK server back to normal operation after I increased disk space and deleted one of my main winlogbeat indices which was 650gb, I can now see a new winlogbeat-7-12-1 growing in size. I have now put a lifecycle policy on this index.
My question is, why has my Winlogbeat Dashboard gone to pot now. I have loads of errors on there. I get an error saying no matching indices match pattern winlogbeat7.12.0 but I have deleted that and it is now called winlogbeat-7.12.1. Previously I could see all my AD logs on here.
Saved field "user.name" of index pattern "winlogbeat-*" is invalid for use with the "Terms" aggregation. Please select a new field
cheers