# Filebeat nginx dashboard kubernetes

**URL:** https://discuss.elastic.co/t/filebeat-nginx-dashboard-kubernetes/299520
**Category:** Beats
**Tags:** docker, filebeat
**Created:** [March 12, 2022, 1:16pm UTC](https://discuss.elastic.co/t/filebeat-nginx-dashboard-kubernetes/299520 "2022-03-12T13:16:04Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![Mohsin\_Ijaz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mohsin_ijaz/32/100500_2.png) [@Mohsin\_Ijaz](https://discuss.elastic.co/u/Mohsin_Ijaz)
#### Post date: [March 12, 2022, 1:16pm UTC](https://discuss.elastic.co/t/filebeat-nginx-dashboard-kubernetes/299520/1 "2022-03-12T13:16:04Z")

</div>

Hi,  
I am new to ELK and IT field started as a devops recently so you can consider me being a complete noob.

I am having trouble setting up the filebeat nginx dashboard.  
deployed the ELK on Kubernetes cluster, using the nginx ingress, I can see the logs coming but it doesn't include the GEOIP in fields, i have used the ingest pipeline as suggested in the link [Enrich events with geoIP information | Filebeat Reference [7.17] | Elastic](https://www.elastic.co/guide/en/beats/filebeat/7.17/filebeat-geoip.html) but still it doesn't work .

However It works fine if i use the logstash as the output with filter, then geo.location is detected and i can see the geo.location on map but the dashboard couldn't find the filebeat index and using setup.dashboards.index: "logstash-\*" still wont work. it still looks for filebeat index

attaching the configmap for reference

```auto
filebeat.yml: |-
    setup.dashboards.enabled: true
    setup.template.settings:
      index.number_of_shards: 1
    filebeat.autodiscover:
      providers:
        - type: kubernetes
          node: ${NODE_NAME}
          hints.enabled: true
          templates:
            - config:
                - type: container
                  paths:
                    - /var/lib/docker/containers/*/${data.kubernetes.container.id}-json.log
                  exclude_lines: ["^\\s+[\\-`('.|_]"]
                  processors:
                    - drop_event.when.not.or:
                        - equals.kubernetes.namespace: "ingress-nginx"
    processors:
      - add_cloud_metadata:
      - add_host_metadata:
      - add_docker_metadata:
      - add_kubernetes_metadata:

    output.elasticsearch:
      hosts: elasticsearch.kube-logging:9200
      pipeline: geoip-info
    #output.logstash:
      #hosts: logstash-service.kube-logging:5044
    setup.kibana.host: "kibana-np.kube-logging.svc.cluster.local"
    setup.kibana.protocol: "http"
    setup.dashboards.index: "logstash-*"

```

any help will be greatly appreciated if someone can help me point out what i am doing wrong.

Thanks

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 9, 2022, 3:16pm UTC](https://discuss.elastic.co/t/filebeat-nginx-dashboard-kubernetes/299520/2 "2022-04-09T15:16:37Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.