Step 4: Loading the Index Template in Elasticsearch

edit

Step 4: Loading the Index Template in Elasticsearch

edit

Before starting Winlogbeat, you need to load the index template, which lets Elasticsearch know which fields should be analyzed in which way.

The recommended template file is installed by the Winlogbeat packages. Load it with the following command:

PS C:\Program Files\Winlogbeat> Invoke-WebRequest -Method Put -InFile winlogbeat.template.json -Uri http://localhost:9200/_template/winlogbeat?pretty

where localhost:9200 is the IP and port where Elasticsearch is listening.