# Winlogbeat Dashboards mullered **URL:** \ **Category:** Elasticsearch\ **Created:** [July 27, 2021, 6:59am UTC](https://discuss.elastic.co/t/winlogbeat-dashboards-mullered/279688 "2021-07-27T06:59:59Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![insurin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/insurin/32/81969_2.png) [@insurin](https://discuss.elastic.co/u/insurin)\ **Post date:** [July 27, 2021, 6:59am UTC](https://discuss.elastic.co/t/winlogbeat-dashboards-mullered/279688/1 "2021-07-27T06:59:59Z")
Hello all. After recovering my ELK server back to normal operation after I increased disk space and deleted one of my main winlogbeat indices which was 650gb, I can now see a new winlogbeat-7-12-1 growing in size. I have now put a lifecycle policy on this index. My question is, why has my Winlogbeat Dashboard gone to pot now. I have loads of errors on there. I get an error saying no matching indices match pattern winlogbeat7.12.0 but I have deleted that and it is now called winlogbeat-7.12.1. Previously I could see all my AD logs on here. Saved field "[user.name](http://user.name/)" of index pattern "winlogbeat-\*" is invalid for use with the "Terms" aggregation. Please select a new field ![logs1](https://us1.discourse-cdn.com/elastic/original/3X/7/6/76a6ad8da8ba13152139eb2497f1d1002de2ff34.png) ![logs3](https://us1.discourse-cdn.com/elastic/original/3X/f/b/fb0e7ba7ef681f1ed8a1214cbbca2d030756440d.png) ![logs2](https://us1.discourse-cdn.com/elastic/original/3X/2/d/2de24266bf5fd00535d56a5bede9f5155619f6c1.png) cheers ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [August 24, 2021, 7:00am UTC](https://discuss.elastic.co/t/winlogbeat-dashboards-mullered/279688/2 "2021-08-24T07:00:55Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.