# Kibana - Syslog and Winlogbeat are not visible

**URL:** <https://discuss.elastic.co/t/kibana-syslog-and-winlogbeat-are-not-visible/239457>\
**Category:** Beats\
**Created:** [July 1, 2020, 10:26am UTC](https://discuss.elastic.co/t/kibana-syslog-and-winlogbeat-are-not-visible/239457 "2020-07-01T10:26:03Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Phillip](https://avatars.discourse-cdn.com/v4/letter/p/3e96dc/32.png) [@Phillip](https://discuss.elastic.co/u/Phillip)\
**Post date:** [July 1, 2020, 10:26am UTC](https://discuss.elastic.co/t/kibana-syslog-and-winlogbeat-are-not-visible/239457/1 "2020-07-01T10:26:03Z")

</div>

Hey,

I configured logstash to get data from beats and syslog like here:

```auto
input {
  beats {
    port => 5044
    ssl => true
    ssl_certificate => "/etc/pki/tls/certs/logstash.crt"
    ssl_key => "/etc/pki/tls/private/logstash.key"
  }
  tcp {
    port => 5515
    type => syslog
  }
  udp {
    port => 5514
    type => syslog
  }
}

filter {
  if [type] == "syslog" {
    grok {
      match => { "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} %{SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: %{GREEDYDATA:syslog_message}" }
      add_field => ["received_at", "%{@timestamp}"]
      add_field => ["received_from", "%{host}"]
    }
    date {
      match => ["syslog_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss"]
    }
  }
}

output {
    elasticsearch {
        hosts => "XXX.XXX.XXX.XXX:9200"
        index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
    }
}

```

I can see, that the syslog messages and also the winlogbeat messages are arriving, but i cannot see them on Kibana.

If i make a tcpdump on my elastic server and generate syslog messages on the client, i can see that these messages are forwarded.

```auto
[root@lab-elastic-01 ~]# tcpdump host XXX.XXX.XXX.XXX
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes
12:18:25.188968 ARP, Request who-has XXX.XXX.XXX.XXX tell 172.31.255.201, length 46
12:18:26.247534 IP XXX.XXX.XXX.XXX.38886 > lab-elastic-01.5514: UDP, length 109
12:18:26.255254 IP XXX.XXX.XXX.XXX.38886 > lab-elastic-01.5514: UDP, length 81
12:18:26.256603 IP XXX.XXX.XXX.XXX.38886 > lab-elastic-01.5514: UDP, length 80
12:18:26.258855 IP XXX.XXX.XXX.XXX.38886 > lab-elastic-01.5514: UDP, length 114
12:18:26.258963 IP XXX.XXX.XXX.XXX.38886 > lab-elastic-01.5514: UDP, length 83

```

I also can see the index in Kibana and see that the number of documents increases. But when im in the discover tab, there i cant see any of these logs/messages.

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/3/a/3a65c64153cfc65514728890295229dcb3c1805a.png)  
 ![image](https://us1.discourse-cdn.com/elastic/original/3X/6/e/6e83d496ce064d73cde4b8d3bdf927b749ca8941.png)

When i look into these indexes of syslog there is an Error appearing.

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/4/5/4573d05c69dce8e4d4a725df3f27da1ce3b75feb.png)

Are there problems in my configuration of syslog and winlogbeat?

Thanks for your time 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 29, 2020, 10:26am UTC](https://discuss.elastic.co/t/kibana-syslog-and-winlogbeat-are-not-visible/239457/2 "2020-07-29T10:26:23Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.