IMPORTANT: No additional bug fixes or documentation updates will be released for this version. For the latest information, see the current release documentation.
« Change the index name Use environment variables in the configuration »
Elastic Docs ›Winlogbeat Reference [7.9] ›How to guides

Load Kibana dashboards

edit

Load Kibana dashboards

edit

Winlogbeat comes packaged with example Kibana dashboards, visualizations, and searches for visualizing Winlogbeat data in Kibana. Before you can use the dashboards, you need to create the index pattern, winlogbeat-*, and load the dashboards into Kibana. To do this, you can either run the setup command (as described here) or configure dashboard loading in the winlogbeat.yml config file.

This requires a Kibana endpoint configuration. If you didn’t already configure a Kibana endpoint, see Kibana endpoint.

Make sure Kibana is running before you perform this step. If you are accessing a secured Kibana instance, make sure you’ve configured credentials as described in the Quick start: installation and configuration.

To set up the Kibana dashboards for Winlogbeat, use the appropriate command for your system. The command shown here loads the dashboards from the Winlogbeat package. For more options, such as loading customized dashboards, see Importing Existing Beat Dashboards in the Beats Developer Guide. If you’ve configured the Logstash output, see Load dashboards for Logstash output.

Open a PowerShell prompt as an Administrator (right-click the PowerShell icon and select Run As Administrator).

From the PowerShell prompt, change to the directory where you installed Winlogbeat, and run:

PS > .\winlogbeat.exe setup --dashboards

Load dashboards for Logstash output

edit

During dashboard loading, Winlogbeat connects to Elasticsearch to check version information. To load dashboards when the Logstash output is enabled, you need to temporarily disable the Logstash output and enable Elasticsearch. To connect to a secured Elasticsearch cluster, you also need to pass Elasticsearch credentials.

The example shows a hard-coded password, but you should store sensitive values in the secrets keystore.

Open a PowerShell prompt as an Administrator (right-click the PowerShell icon and select Run As Administrator).

From the PowerShell prompt, change to the directory where you installed Winlogbeat, and run:

PS > .\winlogbeat.exe setup -e `
  -E output.logstash.enabled=false `
  -E output.elasticsearch.hosts=['localhost:9200'] `
  -E output.elasticsearch.username=winlogbeat_internal `
  -E output.elasticsearch.password=YOUR_PASSWORD `
  -E setup.kibana.host=localhost:5601
« Change the index name Use environment variables in the configuration »