# Logs don't show up on kibana

**URL:** <https://discuss.elastic.co/t/logs-dont-show-up-on-kibana/345930>\
**Category:** Elasticsearch\
**Created:** [October 27, 2023, 2:11pm UTC](https://discuss.elastic.co/t/logs-dont-show-up-on-kibana/345930 "2023-10-27T14:11:29Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![yassinebad](https://avatars.discourse-cdn.com/v4/letter/y/e8c25b/32.png) [@yassinebad](https://discuss.elastic.co/u/yassinebad)\
**Post date:** [October 27, 2023, 2:11pm UTC](https://discuss.elastic.co/t/logs-dont-show-up-on-kibana/345930/1 "2023-10-27T14:11:29Z")

</div>

Hey I am using winlogbeat on my windows machine with sysmon64.  
my winlogbeat.yml file is configured correctly. I have checked with the config command.  
once I run ./winlogbeat.exe setup -e ! my index and dashboards get loaded succesfully and I have checked that on my kibana discover tab.

The problem is that I am not getting any logs !

any help

---

<div class="post-metadata">

**Author:** ![azizim](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/azizim/32/127005_2.png) [@azizim](https://discuss.elastic.co/u/azizim)\
**Post date:** [October 27, 2023, 6:20pm UTC](https://discuss.elastic.co/t/logs-dont-show-up-on-kibana/345930/2 "2023-10-27T18:20:32Z")

</div>

Hello Yassine,  
Did you mean that when you start ./winlogbeat.exe setup -e you get logsinto your cluster; but you you run your winlogbeatservice you don't get any?

---

<div class="post-metadata">

**Author:** ![yassinebad](https://avatars.discourse-cdn.com/v4/letter/y/e8c25b/32.png) [@yassinebad](https://discuss.elastic.co/u/yassinebad)\
**Post date:** [October 27, 2023, 7:46pm UTC](https://discuss.elastic.co/t/logs-dont-show-up-on-kibana/345930/3 "2023-10-27T19:46:42Z")

</div>

Hello,  
winlogbeat-service is working perfectly.  
when I run ./winlogbeat.exe setup -e I get everything okay that my dashboard and index were loaded.  
I go to my kibana through "ip-address:5601", I click on discover then I find that my "winlogbeat" indexx is there when I click on it, there is no logs.

---

<div class="post-metadata">

**Author:** ![azizim](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/azizim/32/127005_2.png) [@azizim](https://discuss.elastic.co/u/azizim)\
**Post date:** [October 27, 2023, 8:09pm UTC](https://discuss.elastic.co/t/logs-dont-show-up-on-kibana/345930/4 "2023-10-27T20:09:34Z")

</div>

You might have timstamps issues , that can be due to the timezone of your server vs the time zone of your kibana.  
One way to chek that is to set you time intervall , in kibana , to a wide one try 1 year for example.

---

<div class="post-metadata">

**Author:** ![yassinebad](https://avatars.discourse-cdn.com/v4/letter/y/e8c25b/32.png) [@yassinebad](https://discuss.elastic.co/u/yassinebad)\
**Post date:** [October 27, 2023, 8:49pm UTC](https://discuss.elastic.co/t/logs-dont-show-up-on-kibana/345930/5 "2023-10-27T20:49:05Z")

</div>

This is the first thing I have checked in both my elk server and windows node. it's the same time

---

<div class="post-metadata">

**Author:** ![azizim](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/azizim/32/127005_2.png) [@azizim](https://discuss.elastic.co/u/azizim)\
**Post date:** [October 27, 2023, 9:35pm UTC](https://discuss.elastic.co/t/logs-dont-show-up-on-kibana/345930/6 "2023-10-27T21:35:15Z")

</div>

What i would do in that case is to check if my datastream is created and eventually click on the temporary discorvery from there.  
You can find it in kibana: index management \> datastream  
If you don't have the datasream i would tend to think you have an issue in the ingestion or in the mapping.  
I will elaborate more if you don't find the datestream ...

---

<div class="post-metadata">

**Author:** ![yassinebad](https://avatars.discourse-cdn.com/v4/letter/y/e8c25b/32.png) [@yassinebad](https://discuss.elastic.co/u/yassinebad)\
**Post date:** [October 27, 2023, 9:43pm UTC](https://discuss.elastic.co/t/logs-dont-show-up-on-kibana/345930/7 "2023-10-27T21:43:52Z")

</div>

my data stream is set correctly

---

<div class="post-metadata">

**Author:** ![azizim](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/azizim/32/127005_2.png) [@azizim](https://discuss.elastic.co/u/azizim)\
**Post date:** [October 27, 2023, 10:00pm UTC](https://discuss.elastic.co/t/logs-dont-show-up-on-kibana/345930/8 "2023-10-27T22:00:20Z")

</div>

If your datastream is created via your index pattern then you can just query it in devtools to check its data:  
`GET your_data_stream_name/_search`

---

<div class="post-metadata">

**Author:** ![yassinebad](https://avatars.discourse-cdn.com/v4/letter/y/e8c25b/32.png) [@yassinebad](https://discuss.elastic.co/u/yassinebad)\
**Post date:** [October 29, 2023, 11:06am UTC](https://discuss.elastic.co/t/logs-dont-show-up-on-kibana/345930/9 "2023-10-29T11:06:23Z")

</div>

Thank you ! It's working now

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 26, 2023, 11:06am UTC](https://discuss.elastic.co/t/logs-dont-show-up-on-kibana/345930/10 "2023-11-26T11:06:52Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
