Winlogbeat data missing

[HTM (Tom)]

Hi All,
New Elastic user here:)
My setup:
Ubuntu 22.04 LTS Server, running ELK Stack.

My kibana.yml:

My Elasticsearch.yml:

I Have added our Sophos firewall using the Sophos Filebeat module. I can read all logs nicely.
So far so good. However, today I started adding Windows Servers:

1. Install Sysmon.
2. Install Winlogbeat.
   My Winlogbeat.yml:
   
   
   
   
   

All went OK. Services are all running.
The only thing that I cant figure out:
Within Elastic-->Security-->hosts, I can see the host, and it is connecting fine. I can See events, and I can expand specific Events. All readable and parsed.
However, if I go to Analytics-->Discover, only Syslog Firewall events are being shown.
One thing I did notice was that I probably miss a Winlogbeat Index?

Can Anyone help me solve this issue?

[warkolm (Mark Walkom)]

Welcome to our community!

Please don't post pictures of text, logs or code. They are difficult to read, impossible to search and replicate (if it's code), and some people may not be even able to see them

[andrewkroh]

I think the simplest fix in Kibana is to go to Stack Management -> Data Views -> Create data view. Enter "winlogbeat-*" and select @timestamp. Then click "Create data view".

[HTM (Tom)]

I am sorry for posting pictures. My idea was to provide as much information as possible:)

[HTM (Tom)]

Your solution works like a charm! Thanks for the quick support!

[warkolm (Mark Walkom)]

No worries, you can post the actual config/code itself in future