# Kibana not showing data from logstash

**URL:** https://discuss.elastic.co/t/kibana-not-showing-data-from-logstash/89384
**Category:** Kibana
**Created:** [June 14, 2017, 1:32pm UTC](https://discuss.elastic.co/t/kibana-not-showing-data-from-logstash/89384 "2017-06-14T13:32:31Z")
**Posts on this page:** 12
**Page:** 1

<div class="post-metadata">

### Author: ![BrunoC](https://avatars.discourse-cdn.com/v4/letter/b/2acd7d/32.png) [@BrunoC](https://discuss.elastic.co/u/BrunoC)
#### Post date: [June 14, 2017, 1:32pm UTC](https://discuss.elastic.co/t/kibana-not-showing-data-from-logstash/89384/1 "2017-06-14T13:32:31Z")

</div>

Hello,

Kibana is not showing anything from logstash, I can create an index but no data comes out.

> ```
> {"reason":"match","flags":"none","rule":"5","type":"syslog","ip_ver":"4","sub_rule":"16777216","src_ip":"192.168.0.152","@version":"1","host":"172.17.0.1","tracker":"1000000103","proto_id":"17","action":"block","tos":"0x0","id":"52249","dest_port":"138","direction":"in","geoip":{},"offset":"0","data_length":"182","length":"202","message":"5,16777216,,1000000103,re0,match,block,in,4,0x0,,64,52249,0,none,17,udp,202,192.168.0.152,192.168.0.255,138,138,182","ttl":"64","prog":"filterlog","tags":["firewall","_geoip_lookup_failure"],"src_port":"138","iface":"re0","@timestamp":"2017-06-14T15:30:55.000Z","proto":"udp","dest_ip":"192.168.0.255","evtid":"134"}
> {"reason":"match","flags":"none","rule":"5","type":"syslog","ip_ver":"4","sub_rule":"16777216","src_ip":"192.168.0.151","@version":"1","host":"172.17.0.1","tracker":"1000000103","proto_id":"17","action":"block","tos":"0x0","id":"51877","dest_port":"1900","direction":"in","geoip":{},"offset":"0","data_length":"135","length":"155","message":"5,16777216,,1000000103,re0,match,block,in,4,0x0,,1,51877,0,none,17,udp,155,192.168.0.151,239.255.255.250,51984,1900,135","ttl":"1","prog":"filterlog","tags":["firewall","_geoip_lookup_failure"],"src_port":"51984","iface":"re0","@timestamp":"2017-06-14T15:30:56.000Z","proto":"udp","dest_ip":"239.255.255.250","evtid":"134"}
> 
> ```

Any idea?

---

<div class="post-metadata">

### Author: ![erion](https://avatars.discourse-cdn.com/v4/letter/e/779978/32.png) [@erion](https://discuss.elastic.co/u/erion)
#### Post date: [June 14, 2017, 3:23pm UTC](https://discuss.elastic.co/t/kibana-not-showing-data-from-logstash/89384/2 "2017-06-14T15:23:00Z")

</div>

Do you have data in ElasticSearch?

---

<div class="post-metadata">

### Author: ![BrunoC](https://avatars.discourse-cdn.com/v4/letter/b/2acd7d/32.png) [@BrunoC](https://discuss.elastic.co/u/BrunoC)
#### Post date: [June 14, 2017, 3:55pm UTC](https://discuss.elastic.co/t/kibana-not-showing-data-from-logstash/89384/3 "2017-06-14T15:55:49Z")

</div>

That's what I was asking myself, I guess I don't and I have no idea about Elasticsearch querying.

---

<div class="post-metadata">

### Author: ![erion](https://avatars.discourse-cdn.com/v4/letter/e/779978/32.png) [@erion](https://discuss.elastic.co/u/erion)
#### Post date: [June 14, 2017, 4:03pm UTC](https://discuss.elastic.co/t/kibana-not-showing-data-from-logstash/89384/4 "2017-06-14T16:03:25Z")

</div>

Kibana display graph of data are in ElasticSearch. Logstash match your data for elasticsearch. this is a very general answere i know but you should read something on web about Elasticsearch, Logstash and kibana. For more questions here we are.

---

<div class="post-metadata">

### Author: ![BrunoC](https://avatars.discourse-cdn.com/v4/letter/b/2acd7d/32.png) [@BrunoC](https://discuss.elastic.co/u/BrunoC)
#### Post date: [June 15, 2017, 7:48am UTC](https://discuss.elastic.co/t/kibana-not-showing-data-from-logstash/89384/5 "2017-06-15T07:48:56Z")

</div>

There is data in Elasticsearch and it's valid data.

---

<div class="post-metadata">

### Author: ![erion](https://avatars.discourse-cdn.com/v4/letter/e/779978/32.png) [@erion](https://discuss.elastic.co/u/erion)
#### Post date: [June 15, 2017, 7:51am UTC](https://discuss.elastic.co/t/kibana-not-showing-data-from-logstash/89384/6 "2017-06-15T07:51:28Z")

</div>

In your logstash config file do you set hosts?  
Can you publish a copy of your config logstash file?

---

<div class="post-metadata">

### Author: ![BrunoC](https://avatars.discourse-cdn.com/v4/letter/b/2acd7d/32.png) [@BrunoC](https://discuss.elastic.co/u/BrunoC)
#### Post date: [June 15, 2017, 8:03am UTC](https://discuss.elastic.co/t/kibana-not-showing-data-from-logstash/89384/7 "2017-06-15T08:03:51Z")

</div>

This is the output of my logstash config

```
output {
    elasticsearch {
        hosts => localhost
        index => "logstash-%{+YYYY.MM.dd}"
    }
    file {
        path => "/var/log/logstash/log-%{+YYYY-MM-dd}.log"
    }
}
```

---

<div class="post-metadata">

### Author: ![erion](https://avatars.discourse-cdn.com/v4/letter/e/779978/32.png) [@erion](https://discuss.elastic.co/u/erion)
#### Post date: [June 15, 2017, 8:09am UTC](https://discuss.elastic.co/t/kibana-not-showing-data-from-logstash/89384/8 "2017-06-15T08:09:04Z")

</div>

Change hosts to something like this hosts =\> ["[https://127.0.0.1:9200](https://127.0.0.1:9200)"]

---

<div class="post-metadata">

### Author: ![BrunoC](https://avatars.discourse-cdn.com/v4/letter/b/2acd7d/32.png) [@BrunoC](https://discuss.elastic.co/u/BrunoC)
#### Post date: [June 15, 2017, 8:15am UTC](https://discuss.elastic.co/t/kibana-not-showing-data-from-logstash/89384/9 "2017-06-15T08:15:34Z")

</div>

Doesn't change anything, the data gets in Elasticsearch, it just doesn't show in Kibana.

---

<div class="post-metadata">

### Author: ![erion](https://avatars.discourse-cdn.com/v4/letter/e/779978/32.png) [@erion](https://discuss.elastic.co/u/erion)
#### Post date: [June 15, 2017, 9:24am UTC](https://discuss.elastic.co/t/kibana-not-showing-data-from-logstash/89384/10 "2017-06-15T09:24:45Z")

</div>

Follow this [https://www.elastic.co/guide/en/kibana/current/connect-to-elasticsearch.html](https://www.elastic.co/guide/en/kibana/current/connect-to-elasticsearch.html)

---

<div class="post-metadata">

### Author: ![BrunoC](https://avatars.discourse-cdn.com/v4/letter/b/2acd7d/32.png) [@BrunoC](https://discuss.elastic.co/u/BrunoC)
#### Post date: [June 15, 2017, 9:36am UTC](https://discuss.elastic.co/t/kibana-not-showing-data-from-logstash/89384/11 "2017-06-15T09:36:59Z")

</div>

I'm already doing it that way.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 13, 2017, 9:37am UTC](https://discuss.elastic.co/t/kibana-not-showing-data-from-logstash/89384/12 "2017-07-13T09:37:05Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
