# Winlogbeat to Logstash - Dashboard Issue

**URL:** <https://discuss.elastic.co/t/winlogbeat-to-logstash-dashboard-issue/41434>\
**Category:** Beats\
**Tags:** winlogbeat\
**Created:** [February 10, 2016, 8:27pm UTC](https://discuss.elastic.co/t/winlogbeat-to-logstash-dashboard-issue/41434 "2016-02-10T20:27:46Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![shanecentreedu](https://avatars.discourse-cdn.com/v4/letter/s/a6a055/32.png) [@shanecentreedu](https://discuss.elastic.co/u/shanecentreedu)\
**Post date:** [February 10, 2016, 8:27pm UTC](https://discuss.elastic.co/t/winlogbeat-to-logstash-dashboard-issue/41434/1 "2016-02-10T20:27:46Z")

</div>

I'm testing the new Winlogbeat and I've been able to get events in my test ELK. I loaded the beats-dashboards-master using the load command from the readme and pieces succeeded with "created":true. I can see the dashboard, but all visualizations say "No Results found".

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [February 10, 2016, 9:57pm UTC](https://discuss.elastic.co/t/winlogbeat-to-logstash-dashboard-issue/41434/2 "2016-02-10T21:57:26Z")

</div>

I just re-tested them to make sure they are working. I didn't find any issues.

In the Kibana Discover tab, do you see data in the winlogbeat-\* index?

The dashboards are just looking for data in indices matching winlogbeat-\*. Maybe try using a larger time window. In the upper right change to something like Last 30 Days.

---

<div class="post-metadata">

**Author:** ![shanecentreedu](https://avatars.discourse-cdn.com/v4/letter/s/a6a055/32.png) [@shanecentreedu](https://discuss.elastic.co/u/shanecentreedu)\
**Post date:** [February 11, 2016, 3:00am UTC](https://discuss.elastic.co/t/winlogbeat-to-logstash-dashboard-issue/41434/3 "2016-02-11T03:00:24Z")

</div>

That's the problem, I have to appologize I'm very new to the whole ELK stack. All of the events are coming into the logstash-\* index.

I'm using logstash and not sending the events straight to elasticsearch. Is it the config for logstash or winlogbeat I need to update? I found a commented entry for index under the winlogbeat config. I uncommented and restarted, but new events are still coming in the logstash-\* index.

---

<div class="post-metadata">

**Author:** ![shanecentreedu](https://avatars.discourse-cdn.com/v4/letter/s/a6a055/32.png) [@shanecentreedu](https://discuss.elastic.co/u/shanecentreedu)\
**Post date:** [February 11, 2016, 3:45am UTC](https://discuss.elastic.co/t/winlogbeat-to-logstash-dashboard-issue/41434/4 "2016-02-11T03:45:34Z")

</div>

I figured it out, it was my logstash config for beats, I found a better example config and it worked. Thanks for your help!

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [February 11, 2016, 3:58am UTC](https://discuss.elastic.co/t/winlogbeat-to-logstash-dashboard-issue/41434/5 "2016-02-11T03:58:29Z")

</div>

Glad you got it working. There is also an example in the docs of how to use Beats with Logstash:  
[https://www.elastic.co/guide/en/beats/libbeat/current/logstash-installation.html#logstash-setup](https://www.elastic.co/guide/en/beats/libbeat/current/logstash-installation.html#logstash-setup)

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [April 12, 2016, 1:39pm UTC](https://discuss.elastic.co/t/winlogbeat-to-logstash-dashboard-issue/41434/6 "2016-04-12T13:39:58Z")

</div>