# Logs are indexed into logstash indices but not showing in kibana dashboard?

**URL:** <https://discuss.elastic.co/t/logs-are-indexed-into-logstash-indices-but-not-showing-in-kibana-dashboard/242015>\
**Category:** Kibana\
**Created:** [July 21, 2020, 11:37am UTC](https://discuss.elastic.co/t/logs-are-indexed-into-logstash-indices-but-not-showing-in-kibana-dashboard/242015 "2020-07-21T11:37:49Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![Bhavin\_Varsur](https://avatars.discourse-cdn.com/v4/letter/b/ecccb3/32.png) [@Bhavin\_Varsur](https://discuss.elastic.co/u/Bhavin_Varsur)\
**Post date:** [July 21, 2020, 11:37am UTC](https://discuss.elastic.co/t/logs-are-indexed-into-logstash-indices-but-not-showing-in-kibana-dashboard/242015/1 "2020-07-21T11:37:49Z")

</div>

logs are showing in index in Discover page. but not showing in dashboard.  
need help?  
here are my index patterns:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/9/a/9a526ca31bfc6545d886fe38287375b1f28a900d.png)

here are log lines :

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/7/2/7288606f85369d7cd9068555f8691b639c7616bc.png)

but here in dashboard i can't see.  
 ![image](https://us1.discourse-cdn.com/elastic/original/3X/0/6/069ead1c6b272d1f52ad7c83611114b4f01ea74e.png)

---

<div class="post-metadata">

**Author:** ![flash1293](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/flash1293/32/41227_2.png) [@flash1293](https://discuss.elastic.co/u/flash1293)\
**Post date:** [July 21, 2020, 12:21pm UTC](https://discuss.elastic.co/t/logs-are-indexed-into-logstash-indices-but-not-showing-in-kibana-dashboard/242015/2 "2020-07-21T12:21:12Z")

</div>

Can you open one of the visualizations in Visualize to check whether they are using the right index pattern?

Also make sure they are built using the right fields (the one actually having data in your indices)

---

<div class="post-metadata">

**Author:** ![Bhavin\_Varsur](https://avatars.discourse-cdn.com/v4/letter/b/ecccb3/32.png) [@Bhavin\_Varsur](https://discuss.elastic.co/u/Bhavin_Varsur)\
**Post date:** [July 22, 2020, 3:36am UTC](https://discuss.elastic.co/t/logs-are-indexed-into-logstash-indices-but-not-showing-in-kibana-dashboard/242015/3 "2020-07-22T03:36:50Z")

</div>

there nothing to show

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/6/e/6e547df5ec926e6ae62ef40055aeee85428849d3.png)

---

<div class="post-metadata">

**Author:** ![flash1293](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/flash1293/32/41227_2.png) [@flash1293](https://discuss.elastic.co/u/flash1293)\
**Post date:** [July 22, 2020, 7:05am UTC](https://discuss.elastic.co/t/logs-are-indexed-into-logstash-indices-but-not-showing-in-kibana-dashboard/242015/4 "2020-07-22T07:05:51Z")

</div>

The visualization is built using the saved search "logs [Filebeat Logstash] ECS". Make sure this saved search is linked to the right index pattern and doesn't set filters that exclude all results.

---

<div class="post-metadata">

**Author:** ![Bhavin\_Varsur](https://avatars.discourse-cdn.com/v4/letter/b/ecccb3/32.png) [@Bhavin\_Varsur](https://discuss.elastic.co/u/Bhavin_Varsur)\
**Post date:** [July 22, 2020, 7:46am UTC](https://discuss.elastic.co/t/logs-are-indexed-into-logstash-indices-but-not-showing-in-kibana-dashboard/242015/5 "2020-07-22T07:46:15Z")

</div>

i'm new to logstash and all this how can i know right index pattern linked ?

---

<div class="post-metadata">

**Author:** ![flash1293](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/flash1293/32/41227_2.png) [@flash1293](https://discuss.elastic.co/u/flash1293)\
**Post date:** [July 22, 2020, 8:51am UTC](https://discuss.elastic.co/t/logs-are-indexed-into-logstash-indices-but-not-showing-in-kibana-dashboard/242015/6 "2020-07-22T08:51:40Z")

</div>

Go to Discover, click the "Open" menu in the top nav and select "logs [Filebeat Logstash] ECS". This will load the saved search which is used as data source for the visualization.

To the left below "Add filter" the name of the index pattern will be shown.

I suspect this search will point to older data, that's why you can't see the recent data. You have multiple index patterns like `logstash-2020.07.21`, but you should just create a single one spanning them all: `logstash-*`. Then you can look at the data from all days at once.

---

<div class="post-metadata">

**Author:** ![Bhavin\_Varsur](https://avatars.discourse-cdn.com/v4/letter/b/ecccb3/32.png) [@Bhavin\_Varsur](https://discuss.elastic.co/u/Bhavin_Varsur)\
**Post date:** [July 22, 2020, 12:32pm UTC](https://discuss.elastic.co/t/logs-are-indexed-into-logstash-indices-but-not-showing-in-kibana-dashboard/242015/7 "2020-07-22T12:32:39Z")

</div>

there is need something extra configuration for this index pattern ? or just simply create index pattern "logstash-\*" ?

---

<div class="post-metadata">

**Author:** ![Bhavin\_Varsur](https://avatars.discourse-cdn.com/v4/letter/b/ecccb3/32.png) [@Bhavin\_Varsur](https://discuss.elastic.co/u/Bhavin_Varsur)\
**Post date:** [July 22, 2020, 1:07pm UTC](https://discuss.elastic.co/t/logs-are-indexed-into-logstash-indices-but-not-showing-in-kibana-dashboard/242015/8 "2020-07-22T13:07:58Z")

</div>

i just created logstash-\* index pattern there is all days logs showing but in logs [Filebeat logstassh] dashboard i can't see. i done what you said but i won't able to see.

look...

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/9/e/9eca88432c5c8994d1984a9c1c017dc7bb5c450e.png)

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/5/3/532a2a96c38db81c2a82d069a7b1888cfef49bd4.png)

---

<div class="post-metadata">

**Author:** ![flash1293](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/flash1293/32/41227_2.png) [@flash1293](https://discuss.elastic.co/u/flash1293)\
**Post date:** [July 22, 2020, 1:25pm UTC](https://discuss.elastic.co/t/logs-are-indexed-into-logstash-indices-but-not-showing-in-kibana-dashboard/242015/9 "2020-07-22T13:25:10Z")

</div>

Based on the screenshot in your original post, some of your data is in the `filebeat-7.8.0-2020.07.18` index - as it doesn't start with `logstash-`, you won't be able to see it when working with the `logstash-*` pattern.

The way these patterns work is by replacing the \* with any possible string and fetching data from the matching indices. So `logstash-*` will match `logstash-2020.07.21` and `logstash-just-really-anything-else`, but it won't match `filebeat-7.8.0-2020.07.18`.

The most common setup is to create a second index pattern `filebeat-*` and recreate the visualizations and dashboard based on that one. Then it will work for all future filebeat data.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 19, 2020, 1:25pm UTC](https://discuss.elastic.co/t/logs-are-indexed-into-logstash-indices-but-not-showing-in-kibana-dashboard/242015/10 "2020-08-19T13:25:12Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
