# Log messages not populated in Elasticsearch

**URL:** https://discuss.elastic.co/t/log-messages-not-populated-in-elasticsearch/375101
**Category:** Beats
**Tags:** filebeat
**Created:** [February 26, 2025, 6:19pm UTC](https://discuss.elastic.co/t/log-messages-not-populated-in-elasticsearch/375101 "2025-02-26T18:19:45Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![rejiprn](https://avatars.discourse-cdn.com/v4/letter/r/f0a364/32.png) [@rejiprn](https://discuss.elastic.co/u/rejiprn)
#### Post date: [February 26, 2025, 6:19pm UTC](https://discuss.elastic.co/t/log-messages-not-populated-in-elasticsearch/375101/1 "2025-02-26T18:19:45Z")

</div>

Hi, following is my filebeat config and I am trying to push Kubernetes container logs to Elastic search, unfortunately log messages are not loaded . Could someone please help me what I am missing in my config?

```auto
apiVersion: v1
kind: ConfigMap
metadata:
  labels:
    beat.k8s.elastic.co/name: quickstart
    common.k8s.elastic.co/type: beat
    eck.k8s.elastic.co/credentials: "true"
    k8s-app: filebeat
  name: quickstart-beat-filebeat-config
  namespace: default
data:
  beat.yml: |-
    filebeat.inputs:
    - type: filestream
      id: kubernetes-container-logs
      paths:
        - /var/log/containers/quicksilver-*.log
      parsers:
        - container: ~
      prospector:
        scanner:
          fingerprint.enabled: true
          symlinks: true
      file_identity.fingerprint: ~    
      processors:
        - add_kubernetes_metadata:  
            in_cluster: true 
            default_matchers.enabled: true
    processors:
      - add_cloud_metadata:
      - add_host_metadata:
    logging:
        files:
            keepfiles: 7
            name: filebeat.log
            path: /var/log/filebeat
            permissions: 420
        level: debug
        to_files: true
    output:
        elasticsearch:
            hosts: [http://elastic-quickcore-ws-http.default.svc:9200]
            username: default-quickstart-beat-user
            password: pdS4reIh292U3m9B9U0MJV36
            ssl:
                certificate_authorities:
                    - /mnt/elastic-internal/elasticsearch-certs/ca.crt
            

```

 ![Screenshot 2025-02-26 at 6.19.15 PM](https://us1.discourse-cdn.com/elastic/original/3X/8/9/895071385d436e2a0c9a77e8fb492032422e6ef2.png)

---

<div class="post-metadata">

### Author: ![strawgate](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/strawgate/32/131008_2.png) [@strawgate](https://discuss.elastic.co/u/strawgate)
#### Post date: [March 2, 2025, 3:37am UTC](https://discuss.elastic.co/t/log-messages-not-populated-in-elasticsearch/375101/2 "2025-03-02T03:37:03Z")

</div>

Can you share a sample log lines grabbed directly from the container?

And also the full document for that log line in Kibana? The screenshot has the headers cut off and doesn't contain much information. Another option might be to just query the \_search endpoint for the `filebeat-*` datastream via Dev Tools by running `POST filebeat-*/_search` and sharing the results so we can see what fields are present in the document.

---

<div class="post-metadata">

### Author: ![Tortoise](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tortoise/32/147587_2.png) [@Tortoise](https://discuss.elastic.co/u/Tortoise)
#### Post date: [March 2, 2025, 4:17am UTC](https://discuss.elastic.co/t/log-messages-not-populated-in-elasticsearch/375101/3 "2025-03-02T04:17:24Z")

</div>

Hello,

Could you please check the filebeat logs and the server which can help if there is any error while processing the records. If there are no errors in the log file then we need to review the YML file which could be an issue.

Thanks!!

---

<div class="post-metadata">

### Author: ![rejiprn](https://avatars.discourse-cdn.com/v4/letter/r/f0a364/32.png) [@rejiprn](https://discuss.elastic.co/u/rejiprn)
#### Post date: [March 2, 2025, 9:42am UTC](https://discuss.elastic.co/t/log-messages-not-populated-in-elasticsearch/375101/4 "2025-03-02T09:42:47Z")

</div>

Issue is resolved