# Elasticsearch didn't show index from logstash-filebeat

**URL:** <https://discuss.elastic.co/t/elasticsearch-didnt-show-index-from-logstash-filebeat/156009>\
**Category:** Logstash\
**Created:** [November 9, 2018, 9:03am UTC](https://discuss.elastic.co/t/elasticsearch-didnt-show-index-from-logstash-filebeat/156009 "2018-11-09T09:03:24Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![lala](https://avatars.discourse-cdn.com/v4/letter/l/b5e925/32.png) [@lala](https://discuss.elastic.co/u/lala)\
**Post date:** [November 9, 2018, 9:03am UTC](https://discuss.elastic.co/t/elasticsearch-didnt-show-index-from-logstash-filebeat/156009/1 "2018-11-09T09:03:24Z")

</div>

Hi I'm student, I'm new to ELK, I would like to ask about my configurations, because the elasticsearch didn't show the indices

log from server SOA -\> server ELK -\> logstash -\> elasticsearch

I'm using filebeat 6.4.2  
the config on filebeat.yml:

#=========================== Filebeat inputs =============================

filebeat.inputs:

# Each - is an input. Most options can be set at the input level, so

# you can use different inputs for various configurations.

# Below are the input specific configurations.

- type: log  
enabled: true  
paths:
  - /SOADEV/default/logs/server.log  
fields\_under\_root: true  
fields.task: server-soa

#and then I want to send filebeat to logstash of ELK server

#----------------------------- Logstash output --------------------------------  
output.logstash:

# The Logstash hosts

hosts: ["172.16.4.20:5044"]  
ssl:certificate\_authorities: ["/etc/filebeat/logstash.crt"]

for logstash configuration or soatest.conf  
input {  
beats{  
port =\> 5044  
}  
}

filter{  
if [fields.task] == "server-soa"{  
grok {  
match =\> { "message" =\> ["%{TIMESTAMP\_ISO8601:timestamp} %{WORD:timezone} [%{DATA:isp}] %{WORD:status} | [%{DATA:externalID}] | [%{DATA:httpdo}] | [User : %{WORD:user}] | [IP : %{IP:IPclient}] | [Server : %{DATA:hostname}] | [%{DATESTAMP:timeend}] | [%{DATA:info}]", "%{TIMESTAMP\_ISO8601:timestamp} %{WORD:timezone} [%{DATA:isp}] %{WORD:status} | [%{DATA:externalID}] | [%{DATA:httpdo}] | [User : %{WORD:user}] | [%{SECOND:second} Sec] | [%{DATA:info}]"  
]}  
}  
date {  
match =\> ["timestamp", "yyyy-MM-dd HH:mm:ss"]  
}  
}  
}

output{  
if [fields.task] == "server-soa" {  
elasticsearch{  
hosts =\> ["localhost:9200"]  
index =\> "%{[fields.task]}-%{+YYYY.MM.dd}"  
manage\_template =\> false  
}}  
}

I made and already check the grok pattern and log, it's correct by grok debugger in dev tools  
thankyou very much. I hope anyone can tell me and fix whats wrong 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 7, 2018, 9:17am UTC](https://discuss.elastic.co/t/elasticsearch-didnt-show-index-from-logstash-filebeat/156009/2 "2018-12-07T09:17:46Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.