# Logs being sent to LS Server. Nothing showing up in Kibana Dashboard **URL:** \ **Category:** Logstash\ **Created:** [August 3, 2016, 8:33pm UTC](https://discuss.elastic.co/t/logs-being-sent-to-ls-server-nothing-showing-up-in-kibana-dashboard/57148 "2016-08-03T20:33:22Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Sully1](https://avatars.discourse-cdn.com/v4/letter/s/9dc877/32.png) [@Sully1](https://discuss.elastic.co/u/Sully1)\ **Post date:** [August 3, 2016, 8:33pm UTC](https://discuss.elastic.co/t/logs-being-sent-to-ls-server-nothing-showing-up-in-kibana-dashboard/57148/1 "2016-08-03T20:33:22Z")
I'm having trouble viewing the logs that are being sent to my logstash server. I'm using filebeat to ship HTTP Logs and IIS logs. Additionally, i'm using winlogbeat to ship my event logs. I receive the following message(s) when i start filebeat & Winlogbeat, i'm assuming this means the logs were sent to the log stash server successfully. They don't appear anywhere in Kibana. Please let me if you need any additional config files to help me out. #Filebeat C:\Program Files\filebeat\>filebeat.exe -c filebeat.yml -e -v 2016/08/03 20:07:49.210982 geolite.go:24: INFO GeoIP disabled: No paths were set under output.geoip.paths 2016/08/03 20:07:49.211982 logstash.go:106: INFO Max Retries set to: 3 2016/08/03 20:07:50.234085 transport.go:125: ERR SSL client failed to connect wi th: dial tcp 10.100.20.222:5044: connectex: No connection could be made because the target machine actively refused it. 2016/08/03 20:07:50.235085 outputs.go:126: INFO Activated logstash as output plu gin. 2016/08/03 20:07:50.245086 log.go:113: INFO Harvester started for file: C:\Progr am Files\HTTPLog\httperr133.log 2016/08/03 20:07:50.245086 log.go:113: INFO Harvester started for file: C:\Progr am Files\HTTPLog\httperr133 - Copy.log 2016/08/03 20:07:50.242085 spooler.go:77: INFO Starting spooler: spool\_size: 100 00; idle\_timeout: 10s 2016/08/03 20:07:50.244086 prospector.go:143: INFO Starting prospector of type: log 2016/08/03 20:07:50.246086 crawler.go:78: INFO All prospectors initialised with 5 states to persist 2016/08/03 20:07:50.246086 registrar.go:87: INFO Starting Registrar 2016/08/03 20:07:50.246086 publish.go:88: INFO Start sending events to output 2016/08/03 20:07:50.247086 log.go:113: INFO Harvester started for file: C:\Progr am Files\IISlogs\u\_ex160803.log 2016/08/03 20:07:50.245086 log.go:113: INFO Harvester started for file: C:\Progr am Files\HTTPLog\httperr133 - Copy (2).log 2016/08/03 20:08:20.250086 log.go:113: INFO Harvester started for file: C:\Progr am Files\HTTPLog\httperr133 - Copy (4).log 2016/08/03 20:08:20.251086 registrar.go:162: INFO Registry file updated. 6 state s written. 2016/08/03 20:08:39.208982 publish.go:104: INFO Events sent: 6632 2016/08/03 20:08:39.217982 registrar.go:162: INFO Registry file updated. 6 state s written. #Winlogbeat C:\Program Files\Winlogbeat\>winlogbeat.exe -c winlogbeat.yml -e -v 2016/08/03 20:28:43.360360 geolite.go:24: INFO GeoIP disabled: No paths were set under output.geoip.paths 2016/08/03 20:28:43.361360 logstash.go:106: INFO Max Retries set to: 3 2016/08/03 20:28:43.576360 outputs.go:126: INFO Activated logstash as output plu gin. 2016/08/03 20:28:43.576360 publish.go:288: INFO Publisher name: My-Server 2016/08/03 20:28:43.579360 async.go:78: INFO Flush Interval set to: 1s 2016/08/03 20:28:43.579360 async.go:84: INFO Max Bulk Size set to: 2048 2016/08/03 20:28:43.580360 beat.go:147: INFO Init Beat: winlogbeat; Version: 1.2 .3 2016/08/03 20:28:43.580360 winlogbeat.go:87: INFO State will be read from and pe rsisted to C:\ProgramData\winlogbeat.winlogbeat.yml 2016/08/03 20:28:43.612360 beat.go:173: INFO winlogbeat sucessfully setup. Start running. 2016/08/03 20:28:43.632360 winlogbeat.go:200: WARN EventLog[Security] Open() err or. No events will be read from this source. Access is denied. 2016/08/03 20:28:45.084360 winlogbeat.go:260: INFO EventLog[System] Successfully published 50 events 2016/08/03 20:28:45.501360 winlogbeat.go:260: INFO EventLog[Application] Success fully published 50 events 2016/08/03 20:28:45.907360 winlogbeat.go:260: INFO EventLog[System] Successfully published 50 events Thank you in advance! ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [August 5, 2016, 12:26am UTC](https://discuss.elastic.co/t/logs-being-sent-to-ls-server-nothing-showing-up-in-kibana-dashboard/57148/2 "2016-08-05T00:26:37Z")
How do you know they are processing through LS? What does your config look like? ---
**Author:** ![Sully1](https://avatars.discourse-cdn.com/v4/letter/s/9dc877/32.png) [@Sully1](https://discuss.elastic.co/u/Sully1)\ **Post date:** [August 5, 2016, 7:42pm UTC](https://discuss.elastic.co/t/logs-being-sent-to-ls-server-nothing-showing-up-in-kibana-dashboard/57148/3 "2016-08-05T19:42:59Z")
The fields are showing up in the settings -- index patterns. For both filebeat and winlogbeats logs. #WinLogBeat Configuration winlogbeat: registry\_file: C:/ProgramData/winlogbeat/.winlogbeat.yml event\_logs: - name: Application - name: Security - name: System output: logstash: hosts: ["myserver:5044"] ``` # A template is used to set the mapping in Elasticsearch # By default template loading is disabled and no template is loaded. # These settings can be adjusted to load your own template or overwrite existing ones template: # Template name. By default the template name is winlogbeat. name: "winlogbeat" # Path to template file path: "winlogbeat.template.json" # Overwrite existing template #overwrite: false tls: # List of root certificates for server verifications certificate_authorities: ["C:/Program Files/winlogbeat//logstash-forwarder.crt"] ``` logging: to\_files: true files: path: C:/ProgramData/winlogbeat/Logs level: info #Filebeat Configuration filebeat: spool\_size: 10000 idle\_timeout: 10s prospectors: - type: IISLog document\_type: IISLog paths: - "C:/Program Files/IISlogs/_" - type: HTTPLog document\_type: HTTPLog paths: - "C:/Program Files/HTTPLog/_" registry\_file: "C:/ProgramData/filebeat/registry" output: ### Logstash as output logstash: # The Logstash hosts enabled: true hosts: - "MyServer:5044" bulk\_max\_size: 1024 index: "logstash" template: ``` # Template name. By default the template name is filebeat. name: "logstash" # Path to template file path: "C:/Program Files/Filebeat/logstash-template.json" # Overwrite existing template overwrite: true tls: # List of root certificates for server verifications certificate_authorities: ["C:/Program Files/Filebeat//logstash-forwarder.crt"] ``` shipper: logging: level: info to\_files: true to\_syslog: false files: path: C:/Filebeat name: filebeat.log keepfiles: 5 #Log Stash Conf 1\_beats\_inputs.conf input { beats { port =\> 5044 ssl =\> true ssl\_certificate =\> "/etc/pki/tls/certs/logstash-forwarder.crt" ssl\_key =\> "/etc/pki/tls/private/logstash-forwarder.key" } } 2\_iis\_filters.conf filter { if [message] =~ "^#" {drop {}} ``` #IIS if [type] == "IISLog" { grok { match => [ "message","(%{TIMESTAMP_ISO8601:log_timestamp})\s(?(.*?))\s(?(.*?))\s(?(.*?))\s(?(.*?))\s(?(.*?))\s(?(.*?))\s(?(.*?))\s(?(.*?))\s(?(.*?))\s(?(.*?))\s(?(?:[4-5_.-]+[0-9_.-]+[0-9_.-]))\s(?(.*?))\s(?(.*?))\s(%{GREEDYDATA:Request_Time_Elapsed})", "message","(%{TIMESTAMP_ISO8601:log_timestamp})\s(?(.*?))\s(?(.*?))\s(?(.*?))\s(?(.*?))\s(?(.*?))\s(?(.*?))\s(?(.*?))\s(?(.*?))\s(?(.*?))\s(?(?:[4-5_.-]+[0-9_.-]+[0-9_.-]))\s(?(.*?))\s(?(.*?))\s(%{GREEDYDATA:Request_Time_Elapsed})", "message","(%{TIMESTAMP_ISO8601:log_timestamp})\s(?(.*?))\s(?(.*?))\s(?(.*?))\s(?(.*?))\s(?(.*?))\s(?(.*?))\s(?(.*?))\s(?(.*?))\s(?(?:[4-5_.-]+[0-9_.-]+[0-9_.-]))\s(?(.*?))\s(?(.*?))\s(%{GREEDYDATA:Request_Time_Elapsed})" ] add_tag => "IIS"} date { match => ["log_timestamp", "YYYY-MM-dd HH:mm:ss"] timezone => "Etc/UCT" } } ``` 3\_output.conf output { elasticsearch { hosts =\> ["localhost:9200"] } } ---
**Author:** ![Sully1](https://avatars.discourse-cdn.com/v4/letter/s/9dc877/32.png) [@Sully1](https://discuss.elastic.co/u/Sully1)\ **Post date:** [August 17, 2016, 7:24pm UTC](https://discuss.elastic.co/t/logs-being-sent-to-ls-server-nothing-showing-up-in-kibana-dashboard/57148/4 "2016-08-17T19:24:02Z")
Hey guys, any update on this? I'm still stuck. ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [August 17, 2016, 7:29pm UTC](https://discuss.elastic.co/t/logs-being-sent-to-ls-server-nothing-showing-up-in-kibana-dashboard/57148/5 "2016-08-17T19:29:31Z")
Start with the basics, a simple config, then work forwards. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 4:43am UTC](https://discuss.elastic.co/t/logs-being-sent-to-ls-server-nothing-showing-up-in-kibana-dashboard/57148/6 "2017-07-06T04:43:00Z")