I am having the following issue Query Help search for $
I have loaded the default winlogbeat template (I'm using v5 Alpha 4 agents)
Any ideas as to what the impact may be to this change ? Or any other work arounds ?
Are you not using the index template provided with Winlogbeat? Why? By default the all of the
event_data.* fields are not_analyzed strings.
This blog post might be of interest to you based on what you are querying: Monitoring Windows Logons with Winlogbeat
As far as I know I am using the index template from winlogbeat, from winlogbeat.template.json (pretty sure this was done to cover another issue I had)
How can I confirm this ?
To clarify I'm not loading the index it from the agents, I loaded it at the server side, from memory
This will return the index template:
This will return the mapping used for today's index. The data types should match whats in the index template.
You can paste the data to http://pastebin.com and share the link because it's probably too big to post directly on here.
Ok. I was sure I had loaded that template, but it doesn't look like it was. I have now done so and I am getting better results
Will continue working through my issues.
Sorry for taking up your time
This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.