# Filebeat log file input empty in Kibana

**URL:** https://discuss.elastic.co/t/filebeat-log-file-input-empty-in-kibana/315093
**Category:** Beats
**Tags:** docker, filebeat
**Created:** [September 25, 2022, 2:09am UTC](https://discuss.elastic.co/t/filebeat-log-file-input-empty-in-kibana/315093 "2022-09-25T02:09:09Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![Karthik\_ELK](https://avatars.discourse-cdn.com/v4/letter/k/a3d4f5/32.png) [@Karthik\_ELK](https://discuss.elastic.co/u/Karthik_ELK)
#### Post date: [September 25, 2022, 2:09am UTC](https://discuss.elastic.co/t/filebeat-log-file-input-empty-in-kibana/315093/1 "2022-09-25T02:09:09Z")

</div>

Hi,

I just started learning ELK stack. I'm trying to send logs via a log file from Filebeat directly to Elastic. Each row in the log file is a json. filebeat.yml file is shown below. I'm running all these services using docker in windows 11 machine. I've been trying to fix this for hours but couldn't find the root cause. I didn't see any errors in filebeat docker container but when Kibana.

```auto
filebeat.inputs:
  - type: filestream
    enabled: true
    id: fbtestapp
    paths:
      - C:\Ash\Learn\ELK\elk\demonode\logs\log.json

processors:
  - add_host_metadata: ~
  - add_cloud_metadata: ~
  - add_docker_metadata: ~
  - add_kubernetes_metadata: ~

output.elasticsearch:
  hosts: ["http://elasticsearch:9200"]
  username: elastic
  password: ${ELASTIC_PASSWORD}

setup.kibana:
  host: "elasticsearch:5601"

```

---

<div class="post-metadata">

### Author: ![Karthik\_ELK](https://avatars.discourse-cdn.com/v4/letter/k/a3d4f5/32.png) [@Karthik\_ELK](https://discuss.elastic.co/u/Karthik_ELK)
#### Post date: [September 25, 2022, 11:04pm UTC](https://discuss.elastic.co/t/filebeat-log-file-input-empty-in-kibana/315093/2 "2022-09-25T23:04:45Z")

</div>

After spending several hours on trying to make it work, I finally understood (I think) that filebeat needs to be run as a docker only when you want to retrieve logs from other docker containers running on the same machine. My goal is to ingest logs from a non-docker application running on a windows machine, so this set up wouldn't work.

I've installed the windows version of filebeat directly with slightly different yaml config. I managed to see few logs (finally!). The caveat though is that I only see 115 logs (out of 1800). I don't understand why the other logs are missing. There is only one file in the folder (log.json) that holds all the 1800 records.

I shared my filebeat.yml config below.

```auto
filebeat.inputs:

  - type: filestream
    id: test_filebeat_id10
    enabled: true
    paths:
      - C:\Ash\Learn\ELK\demonode\logs\*
    parsers:
      - ndjson:
        target: ""

```

I'm running the following two steps after updating the yaml file.  
step1) Set up the assets using command ".\filebeat.exe setup -e"  
step2) Start the filebeat service using command "Start-Service filebeat"

Each row in the log file is a json. Any help in resolving the issue is much appreciated. Thanks!

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [October 24, 2022, 1:05am UTC](https://discuss.elastic.co/t/filebeat-log-file-input-empty-in-kibana/315093/3 "2022-10-24T01:05:40Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.