Logs don't show up on kibana

Elastic Stack Elasticsearch
1

Hey I am using winlogbeat on my windows machine with sysmon64.
my winlogbeat.yml file is configured correctly. I have checked with the config command.
once I run ./winlogbeat.exe setup -e ! my index and dashboards get loaded succesfully and I have checked that on my kibana discover tab.

The problem is that I am not getting any logs !

any help

2

Hello Yassine,
Did you mean that when you start ./winlogbeat.exe setup -e you get logsinto your cluster; but you you run your winlogbeatservice you don't get any?

3

Hello,
winlogbeat-service is working perfectly.
when I run ./winlogbeat.exe setup -e I get everything okay that my dashboard and index were loaded.
I go to my kibana through "ip-address:5601", I click on discover then I find that my "winlogbeat" indexx is there when I click on it, there is no logs.

4

You might have timstamps issues , that can be due to the timezone of your server vs the time zone of your kibana.
One way to chek that is to set you time intervall , in kibana , to a wide one try 1 year for example.

5

This is the first thing I have checked in both my elk server and windows node. it's the same time

6

What i would do in that case is to check if my datastream is created and eventually click on the temporary discorvery from there.
You can find it in kibana: index management > datastream
If you don't have the datasream i would tend to think you have an issue in the ingestion or in the mapping.
I will elaborate more if you don't find the datestream ...

7

my data stream is set correctly

8

If your datastream is created via your index pattern then you can just query it in devtools to check its data:
GET your_data_stream_name/_search

9

Thank you ! It's working now

1 Like
10

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.