# Empty logs on kibana

**URL:** <https://discuss.elastic.co/t/empty-logs-on-kibana/137186>\
**Category:** Kibana\
**Created:** [June 25, 2018, 6:17am UTC](https://discuss.elastic.co/t/empty-logs-on-kibana/137186 "2018-06-25T06:17:12Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Tuxmin](https://avatars.discourse-cdn.com/v4/letter/t/f17d59/32.png) [@Tuxmin](https://discuss.elastic.co/u/Tuxmin)\
**Post date:** [June 25, 2018, 6:17am UTC](https://discuss.elastic.co/t/empty-logs-on-kibana/137186/1 "2018-06-25T06:17:12Z")

</div>

Hello,

I meet a problem in kibana, on logs that are empty for a device:

![image](https://us1.discourse-cdn.com/elastic/original/3X/c/7/c78affd60c777e02c0144b9a558c30f188e3160d.png)

I don't understand why they are empty, because all the logs for this device are not empty.

> ```
> {
> "_index": "securite-2018.06.25",
> "_type": "fortinet",
> "_id": "AWQ1fde9i1msriLshtFb",
> "_score": 1,
> "fields": {
> "@timestamp": [
> 1529905795396
> ]
> }
> }
> 
> ```

If the issue came from parsing, I should have a grokparsefailure tag in json.

Elasticsearch version: 5.4.1  
Kibana version: 5.4.1  
Logstash version: 5.4.1

Have already seen this issue?

---

<div class="post-metadata">

**Author:** ![Nathan\_Reese](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nathan_reese/32/84829_2.png) [@Nathan\_Reese](https://discuss.elastic.co/u/Nathan_Reese)\
**Post date:** [June 25, 2018, 11:42pm UTC](https://discuss.elastic.co/t/empty-logs-on-kibana/137186/2 "2018-06-25T23:42:00Z")

</div>

How is your Kibana Index Pattern set up? Does it contain the expected fields? Under Management -\> Index Patterns, open your index pattern. If your fields are not displayed, click `Refresh Index Pattern` to get the latest mappings from Elastic search.

Do your documents have the expected fields in Elastic search? Use Dev Tools -\> console to query your index and verify that the documents look as expected. `GET /logstash-0/_search` is a simple query that will return the first 10 documents in the "logstash-0" index. You can also use dev tools to view the mapping for the index. Does the mapping contain the fields you expected with the correct types? `GET /logstash-0/_mapping` will show you the mappings for the "logstash-0" index.

---

<div class="post-metadata">

**Author:** ![Tuxmin](https://avatars.discourse-cdn.com/v4/letter/t/f17d59/32.png) [@Tuxmin](https://discuss.elastic.co/u/Tuxmin)\
**Post date:** [June 26, 2018, 5:49am UTC](https://discuss.elastic.co/t/empty-logs-on-kibana/137186/3 "2018-06-26T05:49:46Z")

</div>

Hello,

Thank you for your reply.

My Kibana index pattern setup is securite-\* because all the index' name are securite-AAAA.MM.DD an yes all the expected fields are displayed.

I find all the fields wanted on the mapping GET /securite-2018.06.25/\_mapping and the simple search looks good.

Maybe is there a query for search with the \_id tag? With that, I could see what Elasticsearch has I think.

---

<div class="post-metadata">

**Author:** ![Tuxmin](https://avatars.discourse-cdn.com/v4/letter/t/f17d59/32.png) [@Tuxmin](https://discuss.elastic.co/u/Tuxmin)\
**Post date:** [June 27, 2018, 6:02am UTC](https://discuss.elastic.co/t/empty-logs-on-kibana/137186/4 "2018-06-27T06:02:00Z")

</div>

There is an example of empty log searched by the \_id field:

Query:

> GET securite-2018.06.27/\_search  
> {  
> "query": {  
> "terms": {  
> "\_id": ["AWQ\_z8rJS39vmUnUvmV0"]  
> }  
> }  
> }

Request:

> {  
> "took": 85,  
> "timed\_out": false,  
> "\_shards": {  
> "total": 2,  
> "successful": 2,  
> "failed": 0  
> },  
> "hits": {  
> "total": 1,  
> "max\_score": 1,  
> "hits": [  
> {  
> "\_index": "securite-2018.06.27",  
> "\_type": "checkpoint",  
> "\_id": "AWQ\_z8rJS39vmUnUvmV0",  
> "\_score": 1  
> }  
> ]  
> }  
> }

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 25, 2018, 6:02am UTC](https://discuss.elastic.co/t/empty-logs-on-kibana/137186/5 "2018-07-25T06:02:08Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.