# Logs no longer showing up in Kibana after updating my pipeline

**URL:** <https://discuss.elastic.co/t/logs-no-longer-showing-up-in-kibana-after-updating-my-pipeline/96892>\
**Category:** Elasticsearch\
**Created:** [August 14, 2017, 1:26am UTC](https://discuss.elastic.co/t/logs-no-longer-showing-up-in-kibana-after-updating-my-pipeline/96892 "2017-08-14T01:26:22Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![mmugabo](https://avatars.discourse-cdn.com/v4/letter/m/f08c70/32.png) [@mmugabo](https://discuss.elastic.co/u/mmugabo)\
**Post date:** [August 14, 2017, 1:26am UTC](https://discuss.elastic.co/t/logs-no-longer-showing-up-in-kibana-after-updating-my-pipeline/96892/1 "2017-08-14T01:26:22Z")

</div>

Hello to you all,  
I have an issue, my logs were being pushed and view-able into kibana until I made pipeline update, I am using:

Elastic search 5.4.0  
Filebeat 5.3.1  
Kibana not sure but it must be 5.4.0 too, I did not set the environment up…

So, in short, my logs were being pushed fine, but when I wanted to update my grok pattern, I made a pipeline update thru my postman successfully (Just the same way I created it), then I am not seeing my logs in kibana anymore, I can see that the logs are being pushed while tailing the filebeat log, but when I refresh kibana, I don’t see my logs anymore. Please tell me what could be the reason?

One might think it is the grok pattern update that cause this, but even when I update the pipeline as it was when the logs were being sent into kibana, it still does not work.. What is the best way to updated a pipeline?

Here is my pipeline update “PUT” request payload, and I am sending it to: {{host}}/\_ingest/pipeline/xyz\_pipeline

Please note that after a lot of troubleshooting on server, I installed everything locally, elasticsearch, kibana and filebeat, ALL 5.5.1, and the behavior is same. I reconfigured the logging for all these tools, but still not able to figure out what is going on to not see the logs once I make a pipeline update.

++++++++++++  
{  
"description" : "xyz log pipeline",  
"processors": [  
{  
"gsub": {  
"field": "message",  
"pattern": "\n",  
"replacement": "\\n"  
}  
},  
{  
"grok": {  
"field": "message",  
"patterns": ["%{TIMESTAMP\_ISO8601:log.datetime} \_%{DATA:log.level}\_ \[%{DATA:log.module}\] %{GREEDYDATA:log.message}"],  
"on\_failure": [  
{  
"set":{  
"field": "ingestError",  
"value": "{{ \_ingest.on\_failure\_message }}"  
}  
},  
{  
"set":{  
"field": "log.datetime",  
"value": "{{ @timestamp }}"  
}  
}  
]  
}  
}  
]  
}  
+++++++++++++++++++++++++++++++++++

I can see this being printed out in my filebeat log, which tells me (I think) that the logs are being pushed to elastic:

2017-08-11T12:16:37-04:00 INFO Non-zero metrics in the last 30s: filebeat.harvester.open\_files=1 filebeat.harvester.running=1 filebeat.harvester.started=1 libbeat.es.call\_count.PublishEvents=1 libbeat.es.publish.read\_bytes=1804 libbeat.es.publish.write\_bytes=136541 libbeat.es.published\_and\_acked\_events=1 libbeat.publisher.published\_events=1 publish.events=10 registrar.states.current=153 registrar.states.update=10 registrar.writes=2

Advice appreciated…

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 11, 2017, 1:26am UTC](https://discuss.elastic.co/t/logs-no-longer-showing-up-in-kibana-after-updating-my-pipeline/96892/2 "2017-09-11T01:26:26Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.