# Kibana (7.11.1) isn't showing logs

**URL:** <https://discuss.elastic.co/t/kibana-7-11-1-isnt-showing-logs/268399>\
**Category:** Kibana\
**Created:** [March 25, 2021, 5:57pm UTC](https://discuss.elastic.co/t/kibana-7-11-1-isnt-showing-logs/268399 "2021-03-25T17:57:29Z")\
**Posts on this page:** 15\
**Page:** 1

<div class="post-metadata">

**Author:** ![AnneHermann](https://avatars.discourse-cdn.com/v4/letter/a/bc79bd/32.png) [@AnneHermann](https://discuss.elastic.co/u/AnneHermann)\
**Post date:** [March 25, 2021, 5:57pm UTC](https://discuss.elastic.co/t/kibana-7-11-1-isnt-showing-logs/268399/1 "2021-03-25T17:57:29Z")

</div>

Hi,

I have an index, that is containing log data, but the data can't be seen under Observability -\> Logs. I have also created an index pattern and choose a time field.  
I adjusted the settings of Observability -\> Logs to "Log indices: {my-index-name}\*."  
But I just get " There are no log messages to display. Try adjusting your filter."  
Apparently there is an Internal Server Error with the following message:

```auto
[query_shard_exception] No mapping found for [@timestamp] in order to sort on, with { index_uuid="BhrWkvASSDakWeMZJByc6w" & index="scs-client-log" }

```

The name of the time field is in the index pattern is "timeStamp". Is there a problem because of the "@"?

 ![grafik](https://us1.discourse-cdn.com/elastic/original/3X/1/e/1ebd4ec489e8a7fc05ad16137a3ac5500a76f2d8.png)

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [March 25, 2021, 6:16pm UTC](https://discuss.elastic.co/t/kibana-7-11-1-isnt-showing-logs/268399/2 "2021-03-25T18:16:13Z")

</div>

Hi @AnneHermann Welcome to the community.

Also I am not sure where that screenshot is from, a little more context helps us help you. 🙂 Which App / Visualization is that?

When you created the index pattern what did you select at the Time field?

If you you are not using the default @timestamp then you should select the field that your timestamp is in

 ![Screen Shot 2021-03-25 at 11.13.59 AM](https://us1.discourse-cdn.com/elastic/original/3X/2/2/22aa771aa4c91143c67d104cb53e18bad7a405b1.png)

---

<div class="post-metadata">

**Author:** ![AnneHermann](https://avatars.discourse-cdn.com/v4/letter/a/bc79bd/32.png) [@AnneHermann](https://discuss.elastic.co/u/AnneHermann)\
**Post date:** [March 26, 2021, 9:02am UTC](https://discuss.elastic.co/t/kibana-7-11-1-isnt-showing-logs/268399/3 "2021-03-26T09:02:48Z")

</div>

Thanks for the quick reply 🙂

In the screenshot above you can see my time field in my index pattern.

I have chosen "timeStamp" as my time field when creating the index pattern:

 ![grafik](https://us1.discourse-cdn.com/elastic/original/3X/0/d/0d913b95e54bdaff261090a980b8afb60f6cbc8a.png)

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [March 26, 2021, 2:23pm UTC](https://discuss.elastic.co/t/kibana-7-11-1-isnt-showing-logs/268399/4 "2021-03-26T14:23:01Z")

</div>

First just to be clear so I don't make assumptions when you showed setting the indices in log viewer you showed

`{my-index-name}*.`

You should put in the index pattern name like

`scs-client-logs-*`

2nd thing I notice is that you have a field

`properties.@timestamp`

Which is highly unusual so let's back up a bit and take a look perhaps at the indices and mapping.

In Kibana / Dev Tools can you run

`GET _cat/indices?v`

And post the results?

If there are indices with documents can you post

`GET /<indexname>/`

That should show the mapping.

Finally you could also post

`GET /<indexname>/_search`

And post a couple docs

This should help us diagnos

---

<div class="post-metadata">

**Author:** ![AnneHermann](https://avatars.discourse-cdn.com/v4/letter/a/bc79bd/32.png) [@AnneHermann](https://discuss.elastic.co/u/AnneHermann)\
**Post date:** [March 26, 2021, 5:02pm UTC](https://discuss.elastic.co/t/kibana-7-11-1-isnt-showing-logs/268399/5 "2021-03-26T17:02:58Z")

</div>

```auto
GET _cat/indices?v

```

 ![grafik](https://us1.discourse-cdn.com/elastic/original/3X/d/c/dc39c680d67c38a85950964b750cf006d2f35bf9.png)

```auto
GET /scs-client-log/

```

```auto
{
  "scs-client-log" : {
    "aliases" : { },
    "mappings" : {
      "properties" : {
        "className" : {
          "type" : "text",
          "fields" : {
            "keyword" : {
              "type" : "keyword",
              "ignore_above" : 256
            }
          }
        },
        "exception" : {
          "type" : "object"
        },
        "fileName" : {
          "type" : "text",
          "fields" : {
            "keyword" : {
              "type" : "keyword",
              "ignore_above" : 256
            }
          }
        },
        "fix" : {
          "type" : "text",
          "fields" : {
            "keyword" : {
              "type" : "keyword",
              "ignore_above" : 256
            }
          }
        },
        "fullInfo" : {
          "type" : "text",
          "fields" : {
            "keyword" : {
              "type" : "keyword",
              "ignore_above" : 256
            }
          }
        },
        "hostName" : {
          "type" : "text",
          "fields" : {
            "keyword" : {
              "type" : "keyword",
              "ignore_above" : 256
            }
          }
        },
        "level" : {
          "type" : "text",
          "fields" : {
            "keyword" : {
              "type" : "keyword",
              "ignore_above" : 256
            }
          }
        },
        "lineNumber" : {
          "type" : "text",
          "fields" : {
            "keyword" : {
              "type" : "keyword",
              "ignore_above" : 256
            }
          }
        },
        "message" : {
          "type" : "text",
          "fields" : {
            "keyword" : {
              "type" : "keyword",
              "ignore_above" : 256
            }
          }
        },
        "messageObject" : {
          "type" : "object"
        },
        "methodName" : {
          "type" : "text",
          "fields" : {
            "keyword" : {
              "type" : "keyword",
              "ignore_above" : 256
            }
          }
        },
        "properties" : {
          "properties" : {
            "@timestamp" : {
              "type" : "date"
            },
            "log4net:HostName" : {
              "type" : "text",
              "fields" : {
                "keyword" : {
                  "type" : "keyword",
                  "ignore_above" : 256
                }
              }
            },
            "tab" : {
              "type" : "text",
              "fields" : {
                "keyword" : {
                  "type" : "keyword",
                  "ignore_above" : 256
                }
              }
            }
          }
        },
        "timeStamp" : {
          "type" : "date"
        }
      }
    },
    "settings" : {
      "index" : {
        "routing" : {
          "allocation" : {
            "include" : {
              "_tier_preference" : "data_content"
            }
          }
        },
        "number_of_shards" : "1",
        "provided_name" : "scs-client-log",
        "creation_date" : "1614264757339",
        "number_of_replicas" : "1",
        "uuid" : "BhrWkvASSDakWeMZJByc6w",
        "version" : {
          "created" : "7110199"
        }
      }
    }
  }
}

```

```auto
GET /scs-client-log/_search

```

```auto
{
  "took" : 1,
  "timed_out" : false,
  "_shards" : {
    "total" : 1,
    "successful" : 1,
    "skipped" : 0,
    "failed" : 0
  },
  "hits" : {
    "total" : {
      "value" : 1317,
      "relation" : "eq"
    },
    "max_score" : 1.0,
    "hits" : [
      {
        "_index" : "scs-client-log",
        "_type" : "logEvent",
        "_id" : "ySWv2XcBYgpFxvFAgAvO",
        "_score" : 1.0,
        "_source" : {
          "timeStamp" : "2021-02-25T11:55:33.3922395Z",
          "message" : "SCS.Client (3.4.0.297) - LogManager initialisiert",
          "messageObject" : { },
          "exception" : { },
          "loggerName" : null,
          "domain" : null,
          "identity" : null,
          "level" : "INFO",
          "className" : "LogManager",
          "fileName" : "",
          "lineNumber" : "0",
          "fullInfo" : "LogManager.(:0)",
          "methodName" : "",
          "fix" : "All",
          "properties" : {
            "log4net:UserName" : null,
            "log4net:Identity" : null,
            "tab" : """	""",
            "log4net:HostName" : "DE106YDX",
            "@timestamp" : "2021-02-25T11:55:33.3922395Z"
          },
          "userName" : null,
          "threadName" : null,
          "hostName" : "DE106YDX"
        }
      },

```

I hope that this helps. I've tried using "scs-client-logs-\*" in the index pattern, but there is the same error.

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [March 26, 2021, 8:31pm UTC](https://discuss.elastic.co/t/kibana-7-11-1-isnt-showing-logs/268399/6 "2021-03-26T20:31:28Z")

</div>

In general looks pretty good, there are a few things I might fix, but those should not keep you from seeing the logs. We can come back to those.

Lets try this.

Go delete the existing index pattern.

Recreate the index pattern for now just use `scs-client-log` no `*` or anything.

Use the `timeStamp` field as the time field.

Go to Discover

Select index pattern `scs-client-log` and in the time picker select last 90 days and lets see what you get...

 ![Screen Shot 2021-03-26 at 1.28.44 PM](https://us1.discourse-cdn.com/elastic/original/3X/e/d/ed65216e5afa96636ea3bc53d5a1082dc86c27f4.png)

---

<div class="post-metadata">

**Author:** ![AnneHermann](https://avatars.discourse-cdn.com/v4/letter/a/bc79bd/32.png) [@AnneHermann](https://discuss.elastic.co/u/AnneHermann)\
**Post date:** [March 29, 2021, 5:27am UTC](https://discuss.elastic.co/t/kibana-7-11-1-isnt-showing-logs/268399/7 "2021-03-29T05:27:50Z")

</div>

The log data appears under Discover, but not under Logs.

 ![grafik](https://us1.discourse-cdn.com/elastic/original/3X/9/8/988371d386c227a1ed9625f9b3ba32c660db10c4.png)

 ![grafik](https://us1.discourse-cdn.com/elastic/original/3X/a/2/a2739f54a88046fe0bf1259e1e2459f58faee986.png)

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [March 29, 2021, 2:30pm UTC](https://discuss.elastic.co/t/kibana-7-11-1-isnt-showing-logs/268399/8 "2021-03-29T14:30:52Z")

</div>

Hi @AnneHermann

I should have recognized this earlier, but it has been recently deprecated. The logviewier uses ECS (Elastic Common Schema) fields so it is based on the @timestamp field which is the correct ECS field.

In the Logs / Settings you will see this

 ![Screen Shot 2021-03-29 at 7.23.51 AM](https://us1.discourse-cdn.com/elastic/original/3X/3/c/3c414cb9c996d4a52d4a54fb8d687b16d350319f.png)

What we really need to do is fix your timestamp in the ingest process.

This is what I was referring

> [@stephenb](#):
>
> In general looks pretty good, there are a few things I might fix

I just did not realize we have deprecated setting in the log viewer, so it needs to be fixed first.

You want the either rename this field to` @timestamp` (yes the `@` is correct)

> [@AnneHermann](#):
>
> ```auto
> "timeStamp" : {
> "type" : "date"
> }
> }
> 
> ```

or move this field to the root level

> [@AnneHermann](#):
>
> ```auto
> "properties" : {
> "properties" : {
> "@timestamp" : {
> "type" : "date"
> },
> 
> ```

Get that fixed and delete and recreate the index patterns and you should be good to go.

and of course you need to add your index pattern here in the logs settings

 ![Screen Shot 2021-03-29 at 7.48.13 AM](https://us1.discourse-cdn.com/elastic/original/3X/6/c/6c7c478be12e00535d18c3dc89e1e8bdae480b5a.png)

---

<div class="post-metadata">

**Author:** ![AnneHermann](https://avatars.discourse-cdn.com/v4/letter/a/bc79bd/32.png) [@AnneHermann](https://discuss.elastic.co/u/AnneHermann)\
**Post date:** [March 29, 2021, 4:40pm UTC](https://discuss.elastic.co/t/kibana-7-11-1-isnt-showing-logs/268399/9 "2021-03-29T16:40:16Z")

</div>

okay and we have no other option because the function you mentioned is deprecated? I have to change the name of the timeStamp field (or move the other to the root level)?  
Because I am using Log4Net.ElasticSearch to log messages to the ElasticSearch document database and I think the name of the field is set in this library.

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [March 29, 2021, 4:53pm UTC](https://discuss.elastic.co/t/kibana-7-11-1-isnt-showing-logs/268399/10 "2021-03-29T16:53:15Z")

</div>

Yes that is correct, and what you really should do anyways.

Best practice is the timestamp in the `@timestamp` field in the root level, that complies with ECS

How are you ingesting the data? Logstash? Beats?

Let me know if you need help with that.

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [March 29, 2021, 11:49pm UTC](https://discuss.elastic.co/t/kibana-7-11-1-isnt-showing-logs/268399/11 "2021-03-29T23:49:36Z")

</div>

@AnneHermann

Sorry I just saw, that is the format from `Log4Net.ElasticSearch` someone should really write an issue to get that fixed `@timestamp` should be the default timestamp field 🙂 It also looks that this logger is becoming legacy it is still setting `_type` which legacy / deprecated and will not longer be supported going forward.

This is deprecated see [here](https://www.elastic.co/guide/en/elasticsearch/reference/current/removal-of-types.html)

```auto
        "_type" : "logEvent",

```

I believe there is an ECS Compliant Logger [Here](https://github.com/elastic/ecs-dotnet/tree/master/src/Elasticsearch.Extensions.Logging)

But that may not be an option.

So what you can do is use an ingest pipeline to rename the field and we can get ride of that `_type` too

```
PUT _ingest/pipeline/dotnet-logger-pipeline
{
  "processors": [
    {
      "rename": {
        "field": "timeStamp",
        "target_field": "@timestamp"
      }
    },
    {
      "remove": {
        "field": "_type"
      }
    }
  ]
}

```

You can create a \_template and name that pipeline as the index default pipeline

```
PUT _template/scs-client-log
{
  "index_patterns": [
    "scs-client-log*"
  ],
  "settings": {
    "default_pipeline": "dotnet-logger-pipeline"
  },
  "mappings": {
    "properties": {
      "@timestamp": {
        "type": "date"
      }
     ..... <- The rest of your mapping 
    }
  }
}

```

Then on ingest it should remove the `_type` and rename the `timeStamp` field to `@timestamp`

---

<div class="post-metadata">

**Author:** ![AnneHermann](https://avatars.discourse-cdn.com/v4/letter/a/bc79bd/32.png) [@AnneHermann](https://discuss.elastic.co/u/AnneHermann)\
**Post date:** [March 31, 2021, 2:16pm UTC](https://discuss.elastic.co/t/kibana-7-11-1-isnt-showing-logs/268399/12 "2021-03-31T14:16:20Z")

</div>

It works now! Thank you so much for your help and your patience.

Now I wanted to try "Anomaly detection with Machine Learning" (Observability -\> Logs -\> Anomalies) and I got a new problem:

 ![grafik](https://us1.discourse-cdn.com/elastic/original/3X/5/a/5a9df7b80c80948e46368b26c468125aaf00c3b5.png)

I get the impression that using Log4net.ElasticSearch leads to a couple of problems. I will take a look on the ECS Compliant Logger.

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [March 31, 2021, 2:39pm UTC](https://discuss.elastic.co/t/kibana-7-11-1-isnt-showing-logs/268399/13 "2021-03-31T14:39:17Z")

</div>

Cool,

Yes that is an issue too....

I would look at the ECS logger

`event.dataset` is required but can you fix that reql quick by adding

`event.dataset`as a keyword type in your mapping and then adding a set processor

```
{
  "set": {
    "field": "event.dataset",
    "value": "scs-log"
  }
}

```

that will probably fix that...

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [March 31, 2021, 3:11pm UTC](https://discuss.elastic.co/t/kibana-7-11-1-isnt-showing-logs/268399/14 "2021-03-31T15:11:44Z")

</div>

Hi @AnneHermann

I just found this, not sure why I did not see it earlier. I think we just released some new docs! 🙂

Hope this helps!

> **[Get Started | ECS Logging .NET Reference | Elastic](https://www.elastic.co/guide/en/ecs-logging/dotnet/master/setup.html)**

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 28, 2021, 3:12pm UTC](https://discuss.elastic.co/t/kibana-7-11-1-isnt-showing-logs/268399/15 "2021-04-28T15:12:18Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.