# Importing Apache logs with FIlebeats tutorial doesn't work **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [February 26, 2020, 3:19pm UTC](https://discuss.elastic.co/t/importing-apache-logs-with-filebeats-tutorial-doesnt-work/221065 "2020-02-26T15:19:52Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![lgo](https://avatars.discourse-cdn.com/v4/letter/l/e9c0ed/32.png) [@lgo](https://discuss.elastic.co/u/lgo)\ **Post date:** [February 26, 2020, 3:19pm UTC](https://discuss.elastic.co/t/importing-apache-logs-with-filebeats-tutorial-doesnt-work/221065/1 "2020-02-26T15:19:52Z")
Hello I'm following this tutorial, where you ingest some Apache logs with FIlebeats into Elasticsearch to visualize them in Kibana. > **[Elastic Cloud Tutorial: Getting Started with a sample dataset](https://www.elastic.co/es/blog/getting-started-with-hosted-elasticsearch-and-a-sample-dataset)** > > This step-by-step set of instructions will walk you through setting up an Elastic Cloud account, creating and securing a Elasticsearch cluster, importing data, and visualizing it in Kibana. I follow all the steps and none fails, but when I have a look at the index pattern there is no data, even changing dates. Could someone help me? I'm doing this from Ubuntu 18.04. Thanks in advance. ---
**Author:** ![ChrsMark](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/chrsmark/32/55858_2.png) [@ChrsMark](https://discuss.elastic.co/u/ChrsMark)\ **Post date:** [February 26, 2020, 4:05pm UTC](https://discuss.elastic.co/t/importing-apache-logs-with-filebeats-tutorial-doesnt-work/221065/2 "2020-02-26T16:05:26Z")
Hi! Are you able to [start](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-starting.html) `filebeat` without errors to collect apache logs? C. ---
**Author:** ![lgo](https://avatars.discourse-cdn.com/v4/letter/l/e9c0ed/32.png) [@lgo](https://discuss.elastic.co/u/lgo)\ **Post date:** [February 26, 2020, 4:37pm UTC](https://discuss.elastic.co/t/importing-apache-logs-with-filebeats-tutorial-doesnt-work/221065/3 "2020-02-26T16:37:38Z")
Yes, I think so. ![filebeat_commands](https://us1.discourse-cdn.com/elastic/original/3X/3/1/310d4e978e5ee35843c93adcd12813ae29af2aa8.png) I've tried with both what is said on that tutorial (with the -E and -M options) and with what appears if I go to the Kibana home page \> Add log data \> Apache logs \> DEB (for Ubuntu) (sudo filebeat setup and sudo service filebeat start) But with any of those it doesn't seem to work, in Kibana there is no data. ![kibana_indexpattern](https://us1.discourse-cdn.com/elastic/original/3X/6/7/673cbc259e8fe3b01fbd34390a8603cbbc42c825.png) Thanks. ---
**Author:** ![ChrsMark](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/chrsmark/32/55858_2.png) [@ChrsMark](https://discuss.elastic.co/u/ChrsMark)\ **Post date:** [February 27, 2020, 8:56am UTC](https://discuss.elastic.co/t/importing-apache-logs-with-filebeats-tutorial-doesnt-work/221065/4 "2020-02-27T08:56:39Z")
Hi! Could you check the logs and see if there is anything problematic? (you can fined them with `tail -f /var/log/filebeat/filebeat`) C. ---
**Author:** ![lgo](https://avatars.discourse-cdn.com/v4/letter/l/e9c0ed/32.png) [@lgo](https://discuss.elastic.co/u/lgo)\ **Post date:** [February 27, 2020, 9:52am UTC](https://discuss.elastic.co/t/importing-apache-logs-with-filebeats-tutorial-doesnt-work/221065/5 "2020-02-27T09:52:54Z")
Hi Chris I've pasted the complete logs, not only the last ones, here: [https://pastebin.com/gQyEAdUQ](https://pastebin.com/gQyEAdUQ) I don't understand it very well, but to me it seems everything is ok. Thank you. ---
**Author:** ![ChrsMark](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/chrsmark/32/55858_2.png) [@ChrsMark](https://discuss.elastic.co/u/ChrsMark)\ **Post date:** [February 27, 2020, 12:52pm UTC](https://discuss.elastic.co/t/importing-apache-logs-with-filebeats-tutorial-doesnt-work/221065/6 "2020-02-27T12:52:14Z")
Thanks! It doesn't seem to keep running...Could you try starting Filebeat like `filebeat -e -d "*"`? C. ---
**Author:** ![lgo](https://avatars.discourse-cdn.com/v4/letter/l/e9c0ed/32.png) [@lgo](https://discuss.elastic.co/u/lgo)\ **Post date:** [February 27, 2020, 1:24pm UTC](https://discuss.elastic.co/t/importing-apache-logs-with-filebeats-tutorial-doesnt-work/221065/7 "2020-02-27T13:24:51Z")
That gave me an error, you meant: filebeat -e -d "\*" right? That worked and the output is: [https://pastebin.com/PKu9r11D](https://pastebin.com/PKu9r11D) I have the logs file on Downloads but maybe I have to change the extension? I downloaded it and didn't touch it. ![logs](https://us1.discourse-cdn.com/elastic/original/3X/b/e/be9f249405de6a21df8165b3ece5b9d4e2058de1.png) Thanks. ---
**Author:** ![ChrsMark](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/chrsmark/32/55858_2.png) [@ChrsMark](https://discuss.elastic.co/u/ChrsMark)\ **Post date:** [February 27, 2020, 4:42pm UTC](https://discuss.elastic.co/t/importing-apache-logs-with-filebeats-tutorial-doesnt-work/221065/8 "2020-02-27T16:42:09Z")
Sorry for my typo! It seems that the `paths` config is not an array. Could you try with something like: ```auto ./filebeat -e \ --modules=apache2 \ --setup \ -E cloud.id="Demo_Deployment:dXMtY2Vu..........jczODYke30=" \ -E cloud.auth="sa_admin:s00p3rS3cr3t" \ -M "apache2.access.var.paths=[/Users/jamie/Downloads/apache_logs]" ``` C. ---
**Author:** ![lgo](https://avatars.discourse-cdn.com/v4/letter/l/e9c0ed/32.png) [@lgo](https://discuss.elastic.co/u/lgo)\ **Post date:** [February 28, 2020, 8:54am UTC](https://discuss.elastic.co/t/importing-apache-logs-with-filebeats-tutorial-doesnt-work/221065/9 "2020-02-28T08:54:04Z")
Hello Chris As I'm using Ubuntu I typed (I hope I didn't make a mistake "translating" it): ``` sudo filebeat -e --modules apache2 setup -E cloud.id="MPRO:whatever" -E cloud.auth="sa_admin:password" -M "apache2.access.var.paths=[/home/luis/Downloads/apache_logs]" ``` But it happens the same as previously, the logs are the same as the last pastebin. Thanks. ---
**Author:** ![ChrsMark](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/chrsmark/32/55858_2.png) [@ChrsMark](https://discuss.elastic.co/u/ChrsMark)\ **Post date:** [February 28, 2020, 9:01am UTC](https://discuss.elastic.co/t/importing-apache-logs-with-filebeats-tutorial-doesnt-work/221065/10 "2020-02-28T09:01:58Z")
Hi! This one works for me locally: `./filebeat -e -d "*" --modules apache -M "apache.access.var.paths=[/tmp/apache_logs]"` Note that this only collects logs with `apache` module, you still need to setup things with setup command etc. Also in order to make it work with cloud you need the cloud flags too. C. ---
**Author:** ![lgo](https://avatars.discourse-cdn.com/v4/letter/l/e9c0ed/32.png) [@lgo](https://discuss.elastic.co/u/lgo)\ **Post date:** [February 28, 2020, 9:07am UTC](https://discuss.elastic.co/t/importing-apache-logs-with-filebeats-tutorial-doesnt-work/221065/11 "2020-02-28T09:07:08Z")
Hi Chris You saying that the paths config is not an array made me search on Google the last line of the filebeat logs and found [https://discuss.elastic.co/t/unable-to-ingest-apache2-logs-through-filebeat/146309/3](https://discuss.elastic.co/t/unable-to-ingest-apache2-logs-through-filebeat/146309/3). I had to change the apache.yml file from: ``` var.paths: /home/luis/Downloads/apache_logs ``` to ``` var.paths: - '/home/luis/Downloads/apache_logs' ``` And now it works with `filebeat -e -d "*"`!! Thanks a lot, Chris. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [March 27, 2020, 9:07am UTC](https://discuss.elastic.co/t/importing-apache-logs-with-filebeats-tutorial-doesnt-work/221065/12 "2020-03-27T09:07:14Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.