# How to check logs were sending to elasticsearch
**URL:** https://discuss.elastic.co/t/how-to-check-logs-were-sending-to-elasticsearch/302799
**Category:** Beats
**Tags:** filebeat
**Created:** [April 20, 2022, 10:42am UTC](https://discuss.elastic.co/t/how-to-check-logs-were-sending-to-elasticsearch/302799 "2022-04-20T10:42:45Z")
**Posts on this page:** 13
**Page:** 1
### Author:  [@Hoa\_Nguy\_n\_Van](https://discuss.elastic.co/u/Hoa_Nguy_n_Van)
#### Post date: [April 20, 2022, 10:42am UTC](https://discuss.elastic.co/t/how-to-check-logs-were-sending-to-elasticsearch/302799/1 "2022-04-20T10:42:45Z")
I deployment my EFK stack on version 7.4.0. When deploying filebeat, logs from filebeat do not send to Elasticsearch.
My configuration Filebeat on k8s:
Logs from Filebeat:
Help me for this issue. Thanks ! 🙂
---
### Author:  [@TiagoQueiroz](https://discuss.elastic.co/u/TiagoQueiroz)
#### Post date: [April 21, 2022, 5:02pm UTC](https://discuss.elastic.co/t/how-to-check-logs-were-sending-to-elasticsearch/302799/2 "2022-04-21T17:02:40Z")
Hi @Hoa_Nguy_n_Van ,
If you are just starting with Elastic Stack/Filebeat I suggest trying one of our currently supported versions like 7.17.x or 8.1.x.
That said, Filebeat should be getting its own logs too. How did you deploy Filebeat? Did you follow our documentation: [Run Filebeat on Kubernetes | Filebeat Reference [8.1] | Elastic](https://www.elastic.co/guide/en/beats/filebeat/current/running-on-kubernetes.html)?
I have just tested using the manifest on our documentation with the same image as you (`docker.elastic.co/beats/filebeat-oss:7.9.3`) and it worked just fine.
So if you didn't quite follow the documentation, please try to use use it as unchanged as possible (just as a test). There are a number of configurations and mount points that need to be done in order for Filebeat to work well in a Kubernetes environment.
If none of this work, please post here the whole manifest and `filebeat.yml` (don't forget to redact any sensitive information like passwords, etc).
---
### Author:  [@Hoa\_Nguy\_n\_Van](https://discuss.elastic.co/u/Hoa_Nguy_n_Van)
#### Post date: [April 22, 2022, 3:20am UTC](https://discuss.elastic.co/t/how-to-check-logs-were-sending-to-elasticsearch/302799/3 "2022-04-22T03:20:03Z")
I tried this but not worked.
This all my whole manifest.
> **[GitHub - hoaf13/efk-xpack](https://github.com/hoaf13/efk-xpack)**
>
> Contribute to hoaf13/efk-xpack development by creating an account on GitHub.
---
### Author:  [@can.ozdemir](https://discuss.elastic.co/u/can.ozdemir)
#### Post date: [April 22, 2022, 5:43am UTC](https://discuss.elastic.co/t/how-to-check-logs-were-sending-to-elasticsearch/302799/4 "2022-04-22T05:43:55Z")
Hello,
You filebeat-kubernetes.yaml file shows;
```auto
- name: filebeat
image: docker.elastic.co/beats/filebeat:8.1.3
args: [
"-c", "/etc/filebeat.yml",
"-e",
]
```
Could you please share the /etc/filebeat.yml details?
Best regards,
---
### Author:  [@Hoa\_Nguy\_n\_Van](https://discuss.elastic.co/u/Hoa_Nguy_n_Van)
#### Post date: [April 22, 2022, 6:58am UTC](https://discuss.elastic.co/t/how-to-check-logs-were-sending-to-elasticsearch/302799/5 "2022-04-22T06:58:24Z")
> [@can.ozdemir](#):
>
> Could you please share the /etc/filebeat.yml details?
Of courses,
filebeat.inputs:
- type: container
paths:
- /var/log/containers/\*.log
processors:
- add\_kubernetes\_metadata:
host: ${NODE\_NAME}
matchers:
- logs\_path:
logs\_path: "/var/log/containers/"
/# To enable hints based autodiscover, remove `filebeat.inputs` configuration and uncomment this:
/#filebeat.autodiscover:
/# providers:
/# - type: kubernetes
/# node: ${NODE\_NAME}
/# hints.enabled: true
/# hints.default\_config:
/# type: container
/# paths:
/# - /var/log/containers/\*${data.kubernetes.container.id}.log
processors:
- add\_cloud\_metadata:
- add\_host\_metadata:
cloud.id: ${ELASTIC\_CLOUD\_ID}
cloud.auth: ${ELASTIC\_CLOUD\_AUTH}
output.elasticsearch:
hosts: ["elasticsearch-client.efk-xpack.svc.cluster.local:9200"]
username: "${ELASTICSEARCH\_USERNAME}"
password: "${ELASTICSEARCH\_PASSWORD}"
---
### Author:  [@can.ozdemir](https://discuss.elastic.co/u/can.ozdemir)
#### Post date: [April 22, 2022, 7:07am UTC](https://discuss.elastic.co/t/how-to-check-logs-were-sending-to-elasticsearch/302799/6 "2022-04-22T07:07:43Z")
It seems ok, filebeat elastic output plugin should work, your filebeat logs say the harvesters start without issue, but they cannot find any files to open under the path.
> [@Hoa\_Nguy\_n\_Van](#):
>
> /var/log/containers/\*.log
does your filebeat user on docker can read the files inside this path? Does this path contain your \*.log files?
Also I am sure its just a problem with copy pasting but, is this really how your filebeat.yml look like;
```auto
output.Elasticsearch:
hosts: ["Elasticsearch-client.efk-xpack.svc.cluster.local:9200"]
username: "${ELASTICSEARCH_USERNAME}"
password: "${ELASTICSEARCH_PASSWORD}"
```
There should be indentations, this is a yaml file, like this;
```auto
output.elasticsearch:
hosts: ["https://myEShost:9200"]
username: "YOUR_USERNAME"
password: "YOUR_PASSWORD"
```
---
### Author:  [@Hoa\_Nguy\_n\_Van](https://discuss.elastic.co/u/Hoa_Nguy_n_Van)
#### Post date: [April 22, 2022, 7:17am UTC](https://discuss.elastic.co/t/how-to-check-logs-were-sending-to-elasticsearch/302799/7 "2022-04-22T07:17:39Z")
This is permisions to all files log.
---
### Author:  [@can.ozdemir](https://discuss.elastic.co/u/can.ozdemir)
#### Post date: [April 22, 2022, 7:39am UTC](https://discuss.elastic.co/t/how-to-check-logs-were-sending-to-elasticsearch/302799/8 "2022-04-22T07:39:36Z")
The indentations are really important inside your filebeat.yml file can you please send it again but with using Preformatted text feature.
Best regards,
---
### Author:  [@Hoa\_Nguy\_n\_Van](https://discuss.elastic.co/u/Hoa_Nguy_n_Van)
#### Post date: [April 22, 2022, 7:40am UTC](https://discuss.elastic.co/t/how-to-check-logs-were-sending-to-elasticsearch/302799/9 "2022-04-22T07:40:00Z")
This is filebeat logs:
---
### Author:  [@Hoa\_Nguy\_n\_Van](https://discuss.elastic.co/u/Hoa_Nguy_n_Van)
#### Post date: [April 22, 2022, 7:42am UTC](https://discuss.elastic.co/t/how-to-check-logs-were-sending-to-elasticsearch/302799/10 "2022-04-22T07:42:54Z")
This is filebeat.yaml file.
---
### Author:  [@Hoa\_Nguy\_n\_Van](https://discuss.elastic.co/u/Hoa_Nguy_n_Van)
#### Post date: [April 22, 2022, 8:06am UTC](https://discuss.elastic.co/t/how-to-check-logs-were-sending-to-elasticsearch/302799/11 "2022-04-22T08:06:20Z")
I dont know why index of filebeat not created in kibana index management.
---
### Author:  [@can.ozdemir](https://discuss.elastic.co/u/can.ozdemir)
#### Post date: [April 22, 2022, 8:31am UTC](https://discuss.elastic.co/t/how-to-check-logs-were-sending-to-elasticsearch/302799/12 "2022-04-22T08:31:28Z")
Your log files under paths: seems to be linkes to other files under another path, whats the premission settings on those folders? starting with /var/log/pods...
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 20, 2022, 10:31am UTC](https://discuss.elastic.co/t/how-to-check-logs-were-sending-to-elasticsearch/302799/13 "2022-05-20T10:31:52Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.