# Winlogbeat ILM and logstash

**URL:** <https://discuss.elastic.co/t/winlogbeat-ilm-and-logstash/210404>\
**Category:** Beats\
**Created:** [December 3, 2019, 5:21pm UTC](https://discuss.elastic.co/t/winlogbeat-ilm-and-logstash/210404 "2019-12-03T17:21:58Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![tomrade](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tomrade/32/26626_2.png) [@tomrade](https://discuss.elastic.co/u/tomrade)\
**Post date:** [December 3, 2019, 5:21pm UTC](https://discuss.elastic.co/t/winlogbeat-ilm-and-logstash/210404/1 "2019-12-03T17:21:58Z")

</div>

Hey everyone ive been having issues getting ILM to work with winlogbeat and logstash

I don't have ES access for winlogbeat and I dont want to create a seperate windows vm (in my container lab) just to setup ILM

First thing I did was export the winlogbeat template and ilm from winlog. via the export command. I also forced ILM in the winlogbeat.yml to make sure it was on prior to export(i didnt trust auto as i had no elasticsearch output enabled)

Then added them to ES using curl. I can see them in kibana and they look fine. My winlogbeat talks to logstash over beats protocol and my output config is as follows. The top "if" is for filebeat modules (which works I used a temp container to setup).

```auto
if [@metadata][pipeline] {
        elasticsearch {
            hosts => ["01","02"]
            manage_template => false
            index => "%{[@metadata][beat]}-%{[@metadata][version]}"
            pipeline => "%{[@metadata][pipeline]}"
            user => 'logstash_ingest'
            password => "${LOGSTASH_PASSWORD}" # read password from logstash.keystore
            ssl => true
            cacert => '/usr/share/logstash/config/certs/ca/ca.crt'
        }
    # If no pipeline exists but beats meta data is present use it
    } else if [@metadata] {
        elasticsearch {
            hosts => ["01","02"]
            index => "%{[@metadata][beat]}-%{[@metadata][version]}"
            manage_template => false
            user => 'logstash_ingest'
            password => "${LOGSTASH_PASSWORD}" # read password from logstash.keystore
            ssl => true
            cacert => '/usr/share/logstash/config/certs/ca/ca.crt'
        }
}

```

I get an index called winlogbeat-7.4.0 created (which matches the index template so gets the mappings) but logstash should be creating winlogbeat-7.4.0-etc "with the rollover alias". My winlogbeat index templates looks the same as my filebeat one

winlogbeat template snippet

```auto
    "lifecycle": {
      "name": "winlogbeat-7.4.0",
      "rollover_alias": "winlogbeat-7.4.0"
    },

```

filebeat template snippet

```auto
    "lifecycle": {
      "name": "filebeat-7.4.0",
      "rollover_alias": "filebeat-7.4.0"
    },

```

when I look at the indexes themselves I can see the "provided\_name" by logstash is incorrect and does not contain the rollover alias.

---

<div class="post-metadata">

**Author:** ![tomrade](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tomrade/32/26626_2.png) [@tomrade](https://discuss.elastic.co/u/tomrade)\
**Post date:** [December 3, 2019, 5:40pm UTC](https://discuss.elastic.co/t/winlogbeat-ilm-and-logstash/210404/2 "2019-12-03T17:40:38Z")

</div>

Hey ive now tried setting the index as

```auto
index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}-000001"

```

to see if this works I will update when I hit my ILM limit. im guessing this might be question for logstash on if they want to be able to auto add on "-%{+YYYY.MM.dd}-000001" when manage\_template is set to false

---

<div class="post-metadata">

**Author:** ![tomrade](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tomrade/32/26626_2.png) [@tomrade](https://discuss.elastic.co/u/tomrade)\
**Post date:** [December 3, 2019, 6:25pm UTC](https://discuss.elastic.co/t/winlogbeat-ilm-and-logstash/210404/3 "2019-12-03T18:25:07Z")

</div>

that didnt work I get

```auto
illegal_argument_exception: index.lifecycle.rollover_alias [winlogbeat-7.4.0] does not point to index [winlogbeat-7.4.0-2019.12.03-000001]

```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 31, 2019, 8:25pm UTC](https://discuss.elastic.co/t/winlogbeat-ilm-and-logstash/210404/4 "2019-12-31T20:25:15Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.