# Filebeat http endpoint message doesn't show up in Log

**URL:** <https://discuss.elastic.co/t/filebeat-http-endpoint-message-doesnt-show-up-in-log/265704>\
**Category:** Logs\
**Created:** [February 27, 2021, 10:31pm UTC](https://discuss.elastic.co/t/filebeat-http-endpoint-message-doesnt-show-up-in-log/265704 "2021-02-27T22:31:05Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![snowfrogdev](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/snowfrogdev/32/84655_2.png) [@snowfrogdev](https://discuss.elastic.co/u/snowfrogdev)\
**Post date:** [February 27, 2021, 10:31pm UTC](https://discuss.elastic.co/t/filebeat-http-endpoint-message-doesnt-show-up-in-log/265704/1 "2021-02-27T22:31:05Z")

</div>

This is what I get:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/6/a/6aa26f42b9fa1f0250afb3be14aa8cbf4db0b320.png)

This is my request:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/1/7/1759ab10167202edee382216897b66eef250f442.png)

This is my config file:

```auto
filebeat.inputs:
  - type: http_endpoint
    enabled: true
    listen_address: filebeat
    listen_port: 8088
    response_code: 200

output.elasticsearch:
  hosts: "${ELASTICSEARCH_HOSTS:elasticsearch:9200}"

setup.kibana:
  hosts: "kibana:5601"

```

And this is my docker-compose file

```auto
version: '2.2'
services:
  apm-server:
    image: docker.elastic.co/apm/apm-server:7.11.0
    depends_on:
      elasticsearch:
        condition: service_healthy
      kibana:
        condition: service_healthy
    cap_add: ["CHOWN", "DAC_OVERRIDE", "SETGID", "SETUID"]
    cap_drop: ["ALL"]
    ports:
    - 8200:8200
    networks:
    - elastic
    command: >
       apm-server -e
         -E apm-server.rum.enabled=true
         -E setup.kibana.host=kibana:5601
         -E setup.template.settings.index.number_of_replicas=0
         -E apm-server.kibana.enabled=true
         -E apm-server.kibana.host=kibana:5601
         -E output.elasticsearch.hosts=["elasticsearch:9200"]
    healthcheck:
      interval: 10s
      retries: 12
      test: curl --write-out 'HTTP %{http_code}' --fail --silent --output /dev/null http://localhost:8200/
  
  filebeat:
    image: docker.elastic.co/beats/filebeat:7.11.0
    depends_on:
      elasticsearch:
        condition: service_healthy
      kibana:
        condition: service_healthy
    cap_add: ["CHOWN", "DAC_OVERRIDE", "SETGID", "SETUID"]
    cap_drop: ["ALL"]
    command: filebeat -e -strict.perms=false
    volumes:
    - ./filebeat.docker.yml:/usr/share/filebeat/filebeat.yml:ro
    networks:
    - elastic
    ports:
    - 8088:8088
    healthcheck:
      interval: 10s
      retries: 12
      test: curl --write-out 'HTTP %{http_code}' --fail --silent --output /dev/null http://localhost:8200/

  elasticsearch:
    image: docker.elastic.co/elasticsearch/elasticsearch:7.11.0
    environment:
    - bootstrap.memory_lock=true
    - cluster.name=docker-cluster
    - cluster.routing.allocation.disk.threshold_enabled=false
    - discovery.type=single-node
    - ES_JAVA_OPTS=-XX:UseAVX=2 -Xms1g -Xmx1g
    ulimits:
      memlock:
        hard: -1
        soft: -1
    volumes:
    - esdata:/usr/share/elasticsearch/data
    ports:
    - 9200:9200
    networks:
    - elastic
    healthcheck:
      interval: 20s
      retries: 10
      test: curl -s http://localhost:9200/_cluster/health | grep -vq '"status":"red"'

  kibana:
    image: docker.elastic.co/kibana/kibana:7.11.0
    depends_on:
      elasticsearch:
        condition: service_healthy
    environment:
      ELASTICSEARCH_URL: http://elasticsearch:9200
      ELASTICSEARCH_HOSTS: http://elasticsearch:9200
    ports:
    - 5601:5601
    networks:
    - elastic
    healthcheck:
      interval: 10s
      retries: 20
      test: curl --write-out 'HTTP %{http_code}' --fail --silent --output /dev/null http://localhost:5601/api/status

volumes:
  esdata:
    driver: local

networks:
  elastic:
    driver: bridge

```

Why aren't my log events displaying properly?

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [February 28, 2021, 12:40am UTC](https://discuss.elastic.co/t/filebeat-http-endpoint-message-doesnt-show-up-in-log/265704/2 "2021-02-28T00:40:33Z")

</div>

Hi @snowfrogdev welcome to the community!

To precise your message is absolutely showing up in elastic / logs you are just not seeing it the log viewer message column

In the log viewer it is expecting the message to be in `message` field at the root level yours is in `json.message`

Probably 2 ways to fix...

Set the [prefix](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-input-http_endpoint.html#_prefix) in your filebeat.yml to empty string looks like it defaults to `json` (docs may be missing that new feature

`prefix: ""`  
Or  
`prefix:`

Or go to the Settings in the log viewer and a the field `json.message` to the display

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 28, 2021, 12:40am UTC](https://discuss.elastic.co/t/filebeat-http-endpoint-message-doesnt-show-up-in-log/265704/3 "2021-03-28T00:40:47Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.