# Can't see journal logs in kibana **URL:** \ **Category:** Beats\ **Tags:** journalbeat\ **Created:** [February 25, 2019, 3:16pm UTC](https://discuss.elastic.co/t/cant-see-journal-logs-in-kibana/169862 "2019-02-25T15:16:40Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![DiogoB](https://avatars.discourse-cdn.com/v4/letter/d/df788c/32.png) [@DiogoB](https://discuss.elastic.co/u/DiogoB)\ **Post date:** [February 25, 2019, 3:16pm UTC](https://discuss.elastic.co/t/cant-see-journal-logs-in-kibana/169862/1 "2019-02-25T15:16:40Z")
Hello, I am new to ELK and I'm using elastic cloud on the free trial. I have setup filebeats on an EC2 machine and 2 log files were available instantly on kibana, which I can filter with fields I have setup on the filebeats.yml for the different files. I have tried doing the same with journalbeats, on the same machine, but after many tries I am unsuccessful. I have read that logs UI doesn't automatically show the [journalbeat indexes](https://www.elastic.co/guide/en/beats/journalbeat/current/view-kibana-dashboards.html), I have tried adding the suggested configuration to my elastic cloud deployment but I get an error because this configuration [is not allowed](https://www.elastic.co/guide/en/cloud/current/ec-manage-kibana-settings.html) . Since I was unable to have the index be listed, I have tried changing the index on the journalbeat.yml, by adding the following: setup.template.name: "filebeat" setup.template.pattern: "filebeat-\*" (under output.elasticsearch) index: "filebeat-%{[agent.version]}-%{+yyyy.MM.dd}" [full journalbeat.yml](https://gist.github.com/Misirlou/d2352b47aeeae11c246192e2bcf5cbab) I have fiddled a bit with template.name/pattern values since I wasn't sure after reading the documentation to what they should be set. Am I doing something wrong or is this beat just not supported on the elastic cloud yet? More information: Ubuntu 18.04.1 > filebeat version > filebeat version 6.6.1 (amd64), libbeat 6.6.1 [928f5e3f35fe28c1bd73513ff1cc89406eb212a6 built 2019-02-13 16:12:26 +0000 UTC] > journalbeat version > journalbeat version 6.6.1 (amd64), libbeat 6.6.1 [928f5e3f35fe28c1bd73513ff1cc89406eb212a6 built 2019-02-13 16:17:25 +0000 UTC] > journalctl --version > systemd 237 > +PAM +AUDIT +SELINUX +IMA +APPARMOR +SMACK +SYSVINIT +UTMP +LIBCRYPTSETUP +GCRYPT +GNUTLS +ACL +XZ +LZ4 +SECCOMP +BLKID +ELFUTILS +KMOD -IDN2 +IDN -PCRE2 default-hierarchy=hybrid Also from reading other topics/issues, I have tried looking at the output of `lsof | grep beat` but I only see filebeat entries ---
**Author:** ![kvch](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kvch/32/72058_2.png) [@kvch](https://discuss.elastic.co/u/kvch)\ **Post date:** [February 25, 2019, 3:34pm UTC](https://discuss.elastic.co/t/cant-see-journal-logs-in-kibana/169862/2 "2019-02-25T15:34:22Z")
Could you please share the debug logs of Journalbeat? Also, which version are you using? ---
**Author:** ![DiogoB](https://avatars.discourse-cdn.com/v4/letter/d/df788c/32.png) [@DiogoB](https://discuss.elastic.co/u/DiogoB)\ **Post date:** [February 25, 2019, 4:15pm UTC](https://discuss.elastic.co/t/cant-see-journal-logs-in-kibana/169862/3 "2019-02-25T16:15:50Z")
log file, since my last sudo service journalbeat restart this morning: [https://gist.github.com/Misirlou/9a7ba73f0b0e18b8ade2534dfc8f8491](https://gist.github.com/Misirlou/9a7ba73f0b0e18b8ade2534dfc8f8491) assuming you asked for the file /var/log/journalbeat/journalbeat , if it's something else please point me in the right direction journalbeat version journalbeat version 6.6.1 (amd64), libbeat 6.6.1 [928f5e3f35fe28c1bd73513ff1cc89406eb212a6 built 2019-02-13 16:17:25 +0000 UTC] ---
**Author:** ![DiogoB](https://avatars.discourse-cdn.com/v4/letter/d/df788c/32.png) [@DiogoB](https://discuss.elastic.co/u/DiogoB)\ **Post date:** [February 25, 2019, 4:18pm UTC](https://discuss.elastic.co/t/cant-see-journal-logs-in-kibana/169862/4 "2019-02-25T16:18:27Z")
I am also able to read the service logs: journalctl -u consumer\_delivery -f -- Logs begin at Wed 2019-01-30 16:05:54 UTC. -- Feb 25 16:16:30 ip-172-31-0-76 python[26211]: {"evt\_name": "DeliveryStockStatusChanged", "event": "firing event...", "logger": "delivery\_service.application.signals.handlers.delivery\_events\_publisher", "level": "info", "timestamp": "2019-02-25T16:16:30.698793Z"} ---
**Author:** ![kvch](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kvch/32/72058_2.png) [@kvch](https://discuss.elastic.co/u/kvch)\ **Post date:** [February 25, 2019, 5:25pm UTC](https://discuss.elastic.co/t/cant-see-journal-logs-in-kibana/169862/5 "2019-02-25T17:25:20Z")
Could you please run journalbeat with `./journalbeat -e -d "*"` for ~1-2 mins and paste its output here? Also, what is your systemd version? ---
**Author:** ![DiogoB](https://avatars.discourse-cdn.com/v4/letter/d/df788c/32.png) [@DiogoB](https://discuss.elastic.co/u/DiogoB)\ **Post date:** [February 25, 2019, 6:00pm UTC](https://discuss.elastic.co/t/cant-see-journal-logs-in-kibana/169862/6 "2019-02-25T18:00:57Z")
[debug log](https://gist.github.com/Misirlou/c63d4bc948f76ef44c22837a2cf9d4f8) systemd --version systemd 237 +PAM +AUDIT +SELINUX +IMA +APPARMOR +SMACK +SYSVINIT +UTMP +LIBCRYPTSETUP +GCRYPT +GNUTLS +ACL +XZ +LZ4 +SECCOMP +BLKID +ELFUTILS +KMOD -IDN2 +IDN -PCRE2 default-hierarchy=hybrid journalctl --version gives the same output Thank you for looking into this 🙂 ---
**Author:** ![DiogoB](https://avatars.discourse-cdn.com/v4/letter/d/df788c/32.png) [@DiogoB](https://discuss.elastic.co/u/DiogoB)\ **Post date:** [February 25, 2019, 6:33pm UTC](https://discuss.elastic.co/t/cant-see-journal-logs-in-kibana/169862/7 "2019-02-25T18:33:52Z")
I have changed the include\_matches: [ "systemd.unit=consumer\_delivery.service" ] from just consumer\_delivery (I can read the journal with either name) and the output was a lot longer, so part of the problem is this. However it is still not showing up in kibana [debug log](https://gist.github.com/Misirlou/fb46401b72539b385a56d4fe638f8ba6) ---
**Author:** ![kvch](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kvch/32/72058_2.png) [@kvch](https://discuss.elastic.co/u/kvch)\ **Post date:** [February 26, 2019, 8:49am UTC](https://discuss.elastic.co/t/cant-see-journal-logs-in-kibana/169862/8 "2019-02-26T08:49:17Z")
What exactly do you mean by not showing up in Kibana? Is it missing from the Discovery page? Is it possible that you are not seeing the events, because the timeframe is not adjusted properly? ---
**Author:** ![DiogoB](https://avatars.discourse-cdn.com/v4/letter/d/df788c/32.png) [@DiogoB](https://discuss.elastic.co/u/DiogoB)\ **Post date:** [February 26, 2019, 11:08am UTC](https://discuss.elastic.co/t/cant-see-journal-logs-in-kibana/169862/9 "2019-02-26T11:08:06Z")
In the discovery page, I have created the `journalbeat-*` filter but no data shows up, using last 7 days. Using the `filebeat-*` filter, in the fields.app filter there's no `delivery-consumer` like I configured in journalbeat, but I can see `delivery-api` which is logged from filebeat in the same machine. Same thing in the infra#/logs page, when I type `fields.app:` the only suggestion is for `delivery-api`. ---
**Author:** ![DiogoB](https://avatars.discourse-cdn.com/v4/letter/d/df788c/32.png) [@DiogoB](https://discuss.elastic.co/u/DiogoB)\ **Post date:** [February 26, 2019, 11:47am UTC](https://discuss.elastic.co/t/cant-see-journal-logs-in-kibana/169862/10 "2019-02-26T11:47:24Z")
I have removed the configs that I was trying to use to change the index to filebeat instead of journalbeat and I can see the logs now in discover under journalbeat. Thank you for your patience 🙂 ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [November 4, 2022, 6:56am UTC](https://discuss.elastic.co/t/cant-see-journal-logs-in-kibana/169862/11 "2022-11-04T06:56:38Z")