# Filebeat & NGINX Logs

**URL:** <https://discuss.elastic.co/t/filebeat-nginx-logs/124381>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [March 17, 2018, 3:04am UTC](https://discuss.elastic.co/t/filebeat-nginx-logs/124381 "2018-03-17T03:04:03Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![jamesl](https://avatars.discourse-cdn.com/v4/letter/j/c0e974/32.png) [@jamesl](https://discuss.elastic.co/u/jamesl)\
**Post date:** [March 17, 2018, 3:04am UTC](https://discuss.elastic.co/t/filebeat-nginx-logs/124381/1 "2018-03-17T03:04:03Z")

</div>

Hi. I have enabled the filebeat modules enable nginx (and restarted it). I'm hitting the nginx engine (and generating some logs in /var/log/nginx/access.log & error.log but I am not seeing anything in Elasticsearch. Do I need to add some config in the filebeat.yml file?

---

<div class="post-metadata">

**Author:** ![Magnus\_Kessler](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnus_kessler/32/42001_2.png) [@Magnus\_Kessler](https://discuss.elastic.co/u/Magnus_Kessler)\
**Post date:** [March 19, 2018, 2:01pm UTC](https://discuss.elastic.co/t/filebeat-nginx-logs/124381/2 "2018-03-19T14:01:20Z")

</div>

Did you follow the [documentation](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-nginx.html#configuring-nginx-module) and configure the path to your nginx logs? This may be different from the default built into filebeat.

Also, make sure that filebeat is configured correctly to talk to your elasticsearch instance, in particular if you're using X-Pack Security.

---

<div class="post-metadata">

**Author:** ![jamesl](https://avatars.discourse-cdn.com/v4/letter/j/c0e974/32.png) [@jamesl](https://discuss.elastic.co/u/jamesl)\
**Post date:** [March 20, 2018, 10:07am UTC](https://discuss.elastic.co/t/filebeat-nginx-logs/124381/3 "2018-03-20T10:07:57Z")

</div>

Yes I just did thanks, I updated etc/filebeat/modules.d/nginx.yml with my location of the 2 files (standard location /var/log/nginx/\*) and then installed these 2 Elasticsearch plugins on all the ES nodes.

sudo /usr/share/elasticsearch/bin/elasticsearch-plugin install ingest-user-agent  
sudo /usr/share/elasticsearch/bin/elasticsearch-plugin install ingest-geoip

Just checked my Nginx error logs [Filebeat Nginx] Dashboard but the error.log has the wrong time.. it's in Zulu.

My Cluster + Nginx and Filebeat have all the right time (ntp sync'd).

---

<div class="post-metadata">

**Author:** ![jamesl](https://avatars.discourse-cdn.com/v4/letter/j/c0e974/32.png) [@jamesl](https://discuss.elastic.co/u/jamesl)\
**Post date:** [March 24, 2018, 6:56am UTC](https://discuss.elastic.co/t/filebeat-nginx-logs/124381/4 "2018-03-24T06:56:00Z")

</div>

Performed a full cluster reboot and also upgraded from 6.2.2. --\> 6.2.3. It's good now.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 21, 2018, 6:56am UTC](https://discuss.elastic.co/t/filebeat-nginx-logs/124381/5 "2018-04-21T06:56:28Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.