# Logsatsh reading logs but not showing in kibana

**URL:** https://discuss.elastic.co/t/logsatsh-reading-logs-but-not-showing-in-kibana/75044
**Category:** Kibana
**Created:** [February 14, 2017, 2:09pm UTC](https://discuss.elastic.co/t/logsatsh-reading-logs-but-not-showing-in-kibana/75044 "2017-02-14T14:09:51Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![wolfghost](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/wolfghost/32/15500_2.png) [@wolfghost](https://discuss.elastic.co/u/wolfghost)
#### Post date: [February 14, 2017, 2:09pm UTC](https://discuss.elastic.co/t/logsatsh-reading-logs-but-not-showing-in-kibana/75044/1 "2017-02-14T14:09:51Z")

</div>

Logsash is giving

[root@localhost bin]# /usr/share/logstash/bin/logstash -f logstash.conf  
WARNING: Could not find logstash.yml which is typically located in $LS\_HOME/config or /etc/logstash. You can specify the path using --path.settings. Continuing using the defaults  
Could not find log4j2 configuration at path /usr/share/logstash/config/log4j2.properties. Using default config which logs to console  
19:38:19.250 [[main]-pipeline-manager] INFO logstash.outputs.elasticsearch - Elasticsearch pool URLs updated {:changes=\>{:removed=\>[], :added=\>[[http://localhost:9200/](http://localhost:9200/)]}}  
19:38:19.254 [[main]-pipeline-manager] INFO logstash.outputs.elasticsearch - Running health check to see if an Elasticsearch connection is working {:healthcheck\_url=\>[http://localhost:9200/](http://localhost:9200/), :path=\>"/"}  
19:38:19.382 [[main]-pipeline-manager] WARN logstash.outputs.elasticsearch - Restored connection to ES instance {:url=\>#\<URI::HTTP:0x56831f79 URL:[http://localhost:9200/](http://localhost:9200/)\>}  
19:38:19.383 [[main]-pipeline-manager] INFO logstash.outputs.elasticsearch - Using mapping template from {:path=\>nil}  
19:38:19.720 [[main]-pipeline-manager] INFO logstash.outputs.elasticsearch - Attempting to install template {:manage\_template=\>{"template"=\>"logstash-_", "version"=\>50001, "settings"=\>{"index.refresh\_interval"=\>"5s"}, "mappings"=\>{"default"=\>{"\_all"=\>{"enabled"=\>true, "norms"=\>false}, "dynamic\_templates"=\>[{"message\_field"=\>{"path\_match"=\>"message", "match\_mapping\_type"=\>"string", "mapping"=\>{"type"=\>"text", "norms"=\>false}}}, {"string\_fields"=\>{"match"=\>"_", "match\_mapping\_type"=\>"string", "mapping"=\>{"type"=\>"text", "norms"=\>false, "fields"=\>{"keyword"=\>{"type"=\>"keyword"}}}}}], "properties"=\>{"@timestamp"=\>{"type"=\>"date", "include\_in\_all"=\>false}, "@version"=\>{"type"=\>"keyword", "include\_in\_all"=\>false}, "geoip"=\>{"dynamic"=\>true, "properties"=\>{"ip"=\>{"type"=\>"ip"}, "location"=\>{"type"=\>"geo\_point"}, "latitude"=\>{"type"=\>"half\_float"}, "longitude"=\>{"type"=\>"half\_float"}}}}}}}}  
19:38:19.731 [[main]-pipeline-manager] INFO logstash.outputs.elasticsearch - New Elasticsearch output {:class=\>"LogStash::Outputs::ElasticSearch", :hosts=\>[#\<URI::Generic:0x41414c0f URL://localhost:9200\>]}  
19:38:19.828 [[main]-pipeline-manager] INFO logstash.pipeline - Starting pipeline {"id"=\>"main", "pipeline.workers"=\>4, "pipeline.batch.size"=\>125, "pipeline.batch.delay"=\>5, "pipeline.max\_inflight"=\>500}  
19:38:19.857 [[main]-pipeline-manager] INFO logstash.pipeline - Pipeline main started  
19:38:19.924 [Api Webserver] INFO logstash.agent - Successfully started Logstash API endpoint {:port=\>9600}

but not showing in kibana

---

<div class="post-metadata">

### Author: ![tylersmalley](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tylersmalley/32/8833_2.png) [@tylersmalley](https://discuss.elastic.co/u/tylersmalley)
#### Post date: [February 14, 2017, 9:18pm UTC](https://discuss.elastic.co/t/logsatsh-reading-logs-but-not-showing-in-kibana/75044/2 "2017-02-14T21:18:59Z")

</div>

Not sure I understand the issue. You have started Logstash, but are you putting data into it? Have you verified that the data is making it into elasticsearch?

I would recommend the /\_cat/indices API to verify the index exists.  
Then, have you added the index pattern into Kibana?

---

<div class="post-metadata">

### Author: ![asp](https://avatars.discourse-cdn.com/v4/letter/a/9fc348/32.png) [@asp](https://discuss.elastic.co/u/asp)
#### Post date: [February 16, 2017, 2:58pm UTC](https://discuss.elastic.co/t/logsatsh-reading-logs-but-not-showing-in-kibana/75044/3 "2017-02-16T14:58:13Z")

</div>

could you please post your input and output configuration?  
and check if indizes have been created. Maybe the date is malformated not parsed correctly.

You could also try to set rubydebug as filter, than you can see what logstash is doing with your event.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 16, 2017, 2:58pm UTC](https://discuss.elastic.co/t/logsatsh-reading-logs-but-not-showing-in-kibana/75044/4 "2017-03-16T14:58:17Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.