# Http://localhost:9200/packetbeat-\*/ empty

**URL:** <https://discuss.elastic.co/t/http-localhost-9200-packetbeat-empty/86640>\
**Category:** Beats\
**Tags:** packetbeat\
**Created:** [May 22, 2017, 9:32am UTC](https://discuss.elastic.co/t/http-localhost-9200-packetbeat-empty/86640 "2017-05-22T09:32:14Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![commonman.net](https://avatars.discourse-cdn.com/v4/letter/c/87869e/32.png) [@commonman.net](https://discuss.elastic.co/u/commonman.net)\
**Post date:** [May 22, 2017, 9:32am UTC](https://discuss.elastic.co/t/http-localhost-9200-packetbeat-empty/86640/1 "2017-05-22T09:32:14Z")

</div>

Dears,

I have setup ELK windows 10 and trying to retrieve IIS logs through packetbeat =\> ES =\> Kibana.  
However stuck up by this  
[http://localhost:9200/packetbeat-\*/](http://localhost:9200/packetbeat-*/)  
{}

Thanks in advance

---

<div class="post-metadata">

**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\
**Post date:** [May 23, 2017, 12:42pm UTC](https://discuss.elastic.co/t/http-localhost-9200-packetbeat-empty/86640/2 "2017-05-23T12:42:12Z")

</div>

I think we need a bit more details here:

- Packetbeat: Config, logs, setup, version
- ES / Kibana: Version

---

<div class="post-metadata">

**Author:** ![commonman.net](https://avatars.discourse-cdn.com/v4/letter/c/87869e/32.png) [@commonman.net](https://discuss.elastic.co/u/commonman.net)\
**Post date:** [May 24, 2017, 3:07am UTC](https://discuss.elastic.co/t/http-localhost-9200-packetbeat-empty/86640/3 "2017-05-24T03:07:10Z")

</div>

Hi Rufin,

Thanks for your reply.. I tried in two set of versions

1. Elasticsearch 5.4.0, Kibana 5.4.0, packetbeat 5.4.0
2. Elasticsearch 2.3.3, Kibana , packetbeat

and both I used the default config settings. seems no errors logged

---

<div class="post-metadata">

**Author:** ![Leandro\_Sampaio](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandro_sampaio/32/18409_2.png) [@Leandro\_Sampaio](https://discuss.elastic.co/u/Leandro_Sampaio)\
**Post date:** [May 24, 2017, 3:49am UTC](https://discuss.elastic.co/t/http-localhost-9200-packetbeat-empty/86640/4 "2017-05-24T03:49:05Z")

</div>

I made with a filebeat / logstash (grok) / ES

It's Works and its more flexible

---

<div class="post-metadata">

**Author:** ![ruflin](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ruflin/32/3116_2.png) [@ruflin](https://discuss.elastic.co/u/ruflin)\
**Post date:** [May 26, 2017, 7:03am UTC](https://discuss.elastic.co/t/http-localhost-9200-packetbeat-empty/86640/5 "2017-05-26T07:03:47Z")

</div>

Why do you use packetbeat instead of filebeat for the logs?

---

<div class="post-metadata">

**Author:** ![commonman.net](https://avatars.discourse-cdn.com/v4/letter/c/87869e/32.png) [@commonman.net](https://discuss.elastic.co/u/commonman.net)\
**Post date:** [June 8, 2017, 4:49am UTC](https://discuss.elastic.co/t/http-localhost-9200-packetbeat-empty/86640/6 "2017-06-08T04:49:52Z")

</div>

Hello Dears,

I used packetbeat to trace IIS & got the output as

 ![](https://us1.discourse-cdn.com/elastic/original/3X/e/f/efa4d1c800d9c38533faf7aeadb949b06488ecfc.png)

I used filebeat to trace IIS log & the output is as below

![](https://us1.discourse-cdn.com/elastic/original/3X/f/2/f2009a011ab25ce55dea2952e01c96fdf7f14754.png)

1. Is there a possibility to get full IIS detail in filebeat.. Please let me know, how to do that
2. or how to setup packebeat to trace IIS logs (I did somehow, but didn't working again)

Thanks

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:01am UTC](https://discuss.elastic.co/t/http-localhost-9200-packetbeat-empty/86640/7 "2017-07-06T05:01:21Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.