# Winlogbeat data missing **URL:** \ **Category:** Beats\ **Tags:** winlogbeat\ **Created:** [July 20, 2022, 12:35pm UTC](https://discuss.elastic.co/t/winlogbeat-data-missing/310148 "2022-07-20T12:35:27Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![HTM](https://avatars.discourse-cdn.com/v4/letter/h/d9b06d/32.png) [@HTM](https://discuss.elastic.co/u/HTM)\ **Post date:** [July 20, 2022, 12:35pm UTC](https://discuss.elastic.co/t/winlogbeat-data-missing/310148/1 "2022-07-20T12:35:27Z")
Hi All, New Elastic user here:) My setup: Ubuntu 22.04 LTS Server, running ELK Stack. My kibana.yml: ![image](https://us1.discourse-cdn.com/elastic/original/3X/9/f/9fe1209a2c8b8317a8bb398521731f516285495c.png) My Elasticsearch.yml: ![image](https://us1.discourse-cdn.com/elastic/original/3X/b/5/b55bd9f298182fbd25624856313ce4944bd157db.png) ![image](https://us1.discourse-cdn.com/elastic/original/3X/f/c/fc2fcb464f4ce2b6b2bc67b318287f062307dc83.png) ![image](https://us1.discourse-cdn.com/elastic/original/3X/4/b/4bba1a071bd69db2675fe2c04b0c78e70b88f429.png) I Have added our Sophos firewall using the Sophos Filebeat module. I can read all logs nicely. So far so good. However, today I started adding Windows Servers: 1. Install Sysmon. 2. Install Winlogbeat. My Winlogbeat.yml: ![image](https://us1.discourse-cdn.com/elastic/original/3X/2/8/281c0be58b646aa32993320b91ebe90de9687f06.png) ![image](https://us1.discourse-cdn.com/elastic/original/3X/b/a/ba857c4ebe5a3acee66d80a496f9ef9be4723d12.png) All went OK. Services are all running. The only thing that I cant figure out: Within Elastic--\>Security--\>hosts, I can see the host, and it is connecting fine. I can See events, and I can expand specific Events. All readable and parsed. However, if I go to Analytics--\>Discover, only Syslog Firewall events are being shown. One thing I did notice was that I probably miss a Winlogbeat Index? ![image](https://us1.discourse-cdn.com/elastic/original/3X/8/1/812e3bf3cda739f898e4a562efff0da8406db4f4.png) Can Anyone help me solve this issue? ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [July 20, 2022, 10:17pm UTC](https://discuss.elastic.co/t/winlogbeat-data-missing/310148/2 "2022-07-20T22:17:08Z")
Welcome to our community! 😃 Please don't post pictures of text, logs or code. They are difficult to read, impossible to search and replicate (if it's code), and some people may not be even able to see them 🙂 ---
**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\ **Post date:** [July 20, 2022, 11:19pm UTC](https://discuss.elastic.co/t/winlogbeat-data-missing/310148/3 "2022-07-20T23:19:17Z")
I think the simplest fix in Kibana is to go to Stack Management -\> Data Views -\> Create data view. Enter "winlogbeat-\*" and select `@timestamp`. Then click "Create data view". ---
**Author:** ![HTM](https://avatars.discourse-cdn.com/v4/letter/h/d9b06d/32.png) [@HTM](https://discuss.elastic.co/u/HTM)\ **Post date:** [July 21, 2022, 6:02am UTC](https://discuss.elastic.co/t/winlogbeat-data-missing/310148/4 "2022-07-21T06:02:40Z")
I am sorry for posting pictures. My idea was to provide as much information as possible:) ---
**Author:** ![HTM](https://avatars.discourse-cdn.com/v4/letter/h/d9b06d/32.png) [@HTM](https://discuss.elastic.co/u/HTM)\ **Post date:** [July 21, 2022, 6:03am UTC](https://discuss.elastic.co/t/winlogbeat-data-missing/310148/5 "2022-07-21T06:03:10Z")
Your solution works like a charm! Thanks for the quick support! ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [July 21, 2022, 6:05am UTC](https://discuss.elastic.co/t/winlogbeat-data-missing/310148/6 "2022-07-21T06:05:44Z")
No worries, you can post the actual config/code itself in future 🙂 ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [August 18, 2022, 6:05am UTC](https://discuss.elastic.co/t/winlogbeat-data-missing/310148/7 "2022-08-18T06:05:56Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.