# Data from fuse.log into Kibana

**URL:** <https://discuss.elastic.co/t/data-from-fuse-log-into-kibana/123735>\
**Category:** Kibana\
**Created:** [March 13, 2018, 1:19pm UTC](https://discuss.elastic.co/t/data-from-fuse-log-into-kibana/123735 "2018-03-13T13:19:32Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![solo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/solo/32/29084_2.png) [@solo](https://discuss.elastic.co/u/solo)\
**Post date:** [March 13, 2018, 1:19pm UTC](https://discuss.elastic.co/t/data-from-fuse-log-into-kibana/123735/1 "2018-03-13T13:19:32Z")

</div>

Hi,

I am trying to get data from a file named fuse.log into Kibana.  
When I go to [http://localhost:5601](http://localhost:5601) I see "Couldn't find any Elasticsearch data".

The data I want to load is fuse.log data. Here is some sample data:

> Mar 09, 2018 12:47:59 PM org.apache.karaf.main.SimpleFileLock lock  
> INFO: locking  
> 2018-03-09 12:48:01,393 | INFO | FelixStartLevel | | org.apache.felix.fileinstall | Creating configuration from org.apache.karaf.features.repos.cfg  
> 2018-03-09 12:48:05,765 | INFO | FelixStartLevel | | org.apache.karaf.shell.security.impl.SecuredCommandConfigTransformer | Generating command ACL config org.apache.karaf.command.acl.activemq into service ACL configs [org.apache.karaf.service.acl.command.activemq.query, org.apache.karaf.service.acl.command.activemq.purge, org.apache.karaf.service.acl.command.activemq.bstat, org.apache.karaf.service.acl.command.activemq.dstat, org.apache.karaf.service.acl.command.activemq.browse, org.apache.karaf.service.acl.command.activemq.list]

What I have done so far:

1. Installed elasticsearch-6.2.2.deb

2. Installed ingest-geoip

3. Installed kibana-6.2.2-amd64.deb  
Set elasticsearch.url: "[http://localhost:9200](http://localhost:9200)"

4. Installed filebeat-6.2.2-amd64.deb  
Set host: "localhost:5601"  
Set hosts: ["localhost:5044"]  
Change - /var/log/_.log to - /home/sindre/Temp/FileBeatInput/_.log

5. Installed logstash  
Created file /etc/logstash/conf.d/beats.conf:

> ```
> input { 
> beats { 
> port => "5043"
> } 
> }
> filter {
> if [type] == "syslog" {
> grok {
> match => { "message" => "<%{POSINT:syslog_pri}>%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?:? %{GREEDYDATA:syslog_message}" }
> }
> date {
> match => ["syslog_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss"]
> }
> }
> }
> 
> output {
> elasticsearch { 
> hosts => ["localhost:9200"]
> index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
> document_type => "%{[metadata][type]}"
> }
> }
> 
> ```

1. Created /etc/filebeat/filebeat.template.json

> {  
> "index\_patterns": ["te\*", "bar\*"],  
> "mappings": {  
> "type1": {  
> "properties": {  
> "host\_name": {  
> "type": "keyword"  
> }  
> }  
> }  
> }  
> }

Loaded it:  
curl -XPUT '[http://localhost:9200/\_template/filebeat?pretty](http://localhost:9200/_template/filebeat?pretty)' -d@/etc/filebeat/filebeat.template.json -H'Content-Type: application/json'

---

<div class="post-metadata">

**Author:** ![spalger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/spalger/32/14092_2.png) [@spalger](https://discuss.elastic.co/u/spalger)\
**Post date:** [March 14, 2018, 3:38am UTC](https://discuss.elastic.co/t/data-from-fuse-log-into-kibana/123735/2 "2018-03-14T03:38:01Z")

</div>

1. Filebeat should be pointing to elasticsearch, not Kibana, so I think host should be set to `localhost:9200`
2. When you run filebeat do you see any errors?
3. Are you following a tutorial of some sort?

---

<div class="post-metadata">

**Author:** ![solo](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/solo/32/29084_2.png) [@solo](https://discuss.elastic.co/u/solo)\
**Post date:** [March 14, 2018, 1:58pm UTC](https://discuss.elastic.co/t/data-from-fuse-log-into-kibana/123735/3 "2018-03-14T13:58:09Z")

</div>

I will try this without logstash.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 11, 2018, 1:58pm UTC](https://discuss.elastic.co/t/data-from-fuse-log-into-kibana/123735/4 "2018-04-11T13:58:23Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.