# Winlogbeat doesn't create custom index-patterns but Elasticsearch does create custom index names, so everything is broken

**URL:** <https://discuss.elastic.co/t/winlogbeat-doesnt-create-custom-index-patterns-but-elasticsearch-does-create-custom-index-names-so-everything-is-broken/248555>\
**Category:** Beats\
**Tags:** metricbeat, winlogbeat\
**Created:** [September 14, 2020, 3:55pm UTC](https://discuss.elastic.co/t/winlogbeat-doesnt-create-custom-index-patterns-but-elasticsearch-does-create-custom-index-names-so-everything-is-broken/248555 "2020-09-14T15:55:09Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![syunusic](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/syunusic/32/4131_2.png) [@syunusic](https://discuss.elastic.co/u/syunusic)\
**Post date:** [September 14, 2020, 3:55pm UTC](https://discuss.elastic.co/t/winlogbeat-doesnt-create-custom-index-patterns-but-elasticsearch-does-create-custom-index-names-so-everything-is-broken/248555/1 "2020-09-14T15:55:09Z")

</div>

Let’s say I want to have winlogbeat and metricbeat in windows machines for two areas of my company… so I created two spaces in Kibana: “foo” and “bar”.

I want to have different indices for each space.. so, instead of winlogbeat-7.9.1-\* , I want to have it as **foo** -winlogbeat-7.9.1-\* and **bar** -winlogbeat-7.9.1-\* and the same for the metricbeat case…  
I achieve that in **metricbeat** , but winlogbeat does't create the correct index-pattern, so the visualizations are pointing to the default index (winlogbeat-_) instead the one I need (foo-winlogbeat-_).

My guess is something is wrong/different in winlogbeat vs metricbeat about his point.  
the relevant configuration in metricbeat was:

```auto
setup.template.pattern: "foo-metricbeat-*"
setup.ilm.rollover_alias: "foo-metricbeat"
setup.dashboards.enabled: true
setup.dashboards.index: "foo-metricbeat-*"
setup.kibana:
host: "1.1.1.1:5601"
space.id: "foo"
output.elasticsearch:
hosts: ["1.1.1.1:9200"]
protocol: "https"
ssl.certificate_authorities: ['C:\certs\ca\ca.crt']
username: "elastic"
password: "password"
output.elasticsearch.index: "foo-metricbeat-%{[agent.version]}-%{+yyyy.MM.dd}"

```

With pretty much the same configuration (in that section) with winlogbeat, doesn't create the correct index-pattern nor visualizations. It just ignores this part (but in Elasticsearch the index is created as foo-winlogbeat\*)

---

<div class="post-metadata">

**Author:** ![shaunak](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/shaunak/32/6643_2.png) [@shaunak](https://discuss.elastic.co/u/shaunak)\
**Post date:** [September 14, 2020, 9:03pm UTC](https://discuss.elastic.co/t/winlogbeat-doesnt-create-custom-index-patterns-but-elasticsearch-does-create-custom-index-names-so-everything-is-broken/248555/2 "2020-09-14T21:03:55Z")

</div>

Hmmm, this is strange. The code that handles index pattern creation is common across all Beats. Can you try running `winlogbeat setup` and see if that creates the correct index pattern?

---

<div class="post-metadata">

**Author:** ![syunusic](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/syunusic/32/4131_2.png) [@syunusic](https://discuss.elastic.co/u/syunusic)\
**Post date:** [September 15, 2020, 2:50am UTC](https://discuss.elastic.co/t/winlogbeat-doesnt-create-custom-index-patterns-but-elasticsearch-does-create-custom-index-names-so-everything-is-broken/248555/3 "2020-09-15T02:50:43Z")

</div>

What I run is **"winlogbeat setup -e -c winlogbeat.yml"** and **"metricbeat setup -e -c metricbeat.yml"**. When I ran metricbeat's, it creates the correct index (foo-metricbeat-\* ) in ES, the correct index pattern in Kibana (foo-metricbeat-\* ), and all visualizations points to this index patterns.

When I do the same but in winlogbeat, it creates the correct index, installs the correct index template, correct mappings... but incorrect index pattern (it says just winlogbeat-\* instead of foo-winlogbeat-\*).

The workaround I made (thanks to a suggestion), is to create the my custom part of the name as a suffix instead of a prefix, so, even when the index pattern is wrong, it will work anyways because it will take winlogbeat-\* as a correct pattern, because my index is contained in that pattern (metricbeat-foo in this case).

Still... I think this should be fixed.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 13, 2020, 4:50am UTC](https://discuss.elastic.co/t/winlogbeat-doesnt-create-custom-index-patterns-but-elasticsearch-does-create-custom-index-names-so-everything-is-broken/248555/4 "2020-10-13T04:50:45Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.