# Apache, Filebeat, Kibana 8.3.3

**URL:** https://discuss.elastic.co/t/apache-filebeat-kibana-8-3-3/312696
**Category:** Beats
**Tags:** filebeat
**Created:** [August 23, 2022, 11:14am UTC](https://discuss.elastic.co/t/apache-filebeat-kibana-8-3-3/312696 "2022-08-23T11:14:19Z")
**Posts on this page:** 7
**Page:** 1

<div class="post-metadata">

### Author: ![Gunnar](https://avatars.discourse-cdn.com/v4/letter/g/ed655f/32.png) [@Gunnar](https://discuss.elastic.co/u/Gunnar)
#### Post date: [August 23, 2022, 11:14am UTC](https://discuss.elastic.co/t/apache-filebeat-kibana-8-3-3/312696/1 "2022-08-23T11:14:19Z")

</div>

Hello, I'm new to Filebeat and Kibana.

I'm having a strange issue, I'm sending apache logfiles to Elasticsearch using the apache module. On Kibana logfile shows like this:

```auto
13:06:23.462
www.xxx.de 185.191.171.22 - - [23/Aug/2022:13:06:21 +0200] "GET /de/.html HTTP/1.1" 200 19761 "-" "Mozilla/5.0 (compatible; SemrushBot/7~bl; +http://www.semrush.com/bot.html)"
13:06:23.462
www.xxx.de 66.249.64.64 - - [23/Aug/2022:13:06:22 +0200] "GET /de/93.html HTTP/1.1" 200 12127 "-" "Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.79 Mobile Safari/537.36 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
13:06:23.462
www.xxx.de 10.xxx.xxx.xxx - - [23/Aug/2022:13:06:22 +0200] "GET /apiv2/metadata/ HTTP/1.1" 200 52 "-" "Lucee (CFML Engine)"
13:06:24.000
apache.access
[apache][access] 40.77.167.xxx - "GET /de/xxx.html? HTTP/1.1" 200 14655
13:06:24.000
apache.access
[apache][access] 10.xxx.xxx.xxx - "GET /apiv2/xxx

```

My issue is that **event.dataset** isn't tagged correctly all entries for one timestamp are either matched correctly or not. (Matching alternates, so first entries match, next don't, next do... etc)

Any ideas what to look for? Thanks for your help.

---

<div class="post-metadata">

### Author: ![jsoriano](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jsoriano/32/27920_2.png) [@jsoriano](https://discuss.elastic.co/u/jsoriano)
#### Post date: [August 25, 2022, 9:10am UTC](https://discuss.elastic.co/t/apache-filebeat-kibana-8-3-3/312696/2 "2022-08-25T09:10:05Z")

</div>

Hi,

I think I don't understand the problem, could you please share an screenshot of Kibana that illustrates the problem?

---

<div class="post-metadata">

### Author: ![Gunnar](https://avatars.discourse-cdn.com/v4/letter/g/ed655f/32.png) [@Gunnar](https://discuss.elastic.co/u/Gunnar)
#### Post date: [August 25, 2022, 1:43pm UTC](https://discuss.elastic.co/t/apache-filebeat-kibana-8-3-3/312696/3 "2022-08-25T13:43:38Z")

</div>

Hi, thanks for taking a look, here is a screenshot from Observability\>Logs\>Stream I hope it makes the issue more clear.

 ![Bildschirmfoto 2022-08-25 um 15.38.42](https://us1.discourse-cdn.com/elastic/original/3X/1/1/1105f87b19dda1c04b54fdf626bf2108cce35773.png)

---

<div class="post-metadata">

### Author: ![jsoriano](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jsoriano/32/27920_2.png) [@jsoriano](https://discuss.elastic.co/u/jsoriano)
#### Post date: [August 25, 2022, 5:04pm UTC](https://discuss.elastic.co/t/apache-filebeat-kibana-8-3-3/312696/4 "2022-08-25T17:04:44Z")

</div>

Is it possible that you have also some filebeat input enabled? `event.dataset` is only included in events coming from modules, not for events coming from inputs.

---

<div class="post-metadata">

### Author: ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)
#### Post date: [August 25, 2022, 9:41pm UTC](https://discuss.elastic.co/t/apache-filebeat-kibana-8-3-3/312696/5 "2022-08-25T21:41:55Z")

</div>

Can you confirm whether or not you are using the Apache module?

Also I'm a bit confused. Some of those Do not look like the common Apache log format.

You would have to provide samples of your Apache logs.

---

<div class="post-metadata">

### Author: ![Gunnar](https://avatars.discourse-cdn.com/v4/letter/g/ed655f/32.png) [@Gunnar](https://discuss.elastic.co/u/Gunnar)
#### Post date: [August 26, 2022, 8:38am UTC](https://discuss.elastic.co/t/apache-filebeat-kibana-8-3-3/312696/6 "2022-08-26T08:38:26Z")

</div>

Thanks a lot, you are right, the apache module and as well filebeat input was enabled. After disabling filebeat, everything looks correct!

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 23, 2022, 10:39am UTC](https://discuss.elastic.co/t/apache-filebeat-kibana-8-3-3/312696/7 "2022-09-23T10:39:08Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
