# Logstash get data but Kibana can't show it! **URL:** \ **Category:** Logstash\ **Created:** [August 23, 2017, 6:33am UTC](https://discuss.elastic.co/t/logstash-get-data-but-kibana-cant-show-it/98006 "2017-08-23T06:33:10Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![hack3rcon](https://avatars.discourse-cdn.com/v4/letter/h/96bed5/32.png) [@hack3rcon](https://discuss.elastic.co/u/hack3rcon)\ **Post date:** [August 23, 2017, 6:33am UTC](https://discuss.elastic.co/t/logstash-get-data-but-kibana-cant-show-it/98006/1 "2017-08-23T06:33:10Z")
Hello. I'm using "Winlogbeat for sending Windows event Log to my ELK. Logstash get data: ```auto $ curl -XGET 'http://localhost:9200/_cat/indices?v' yellow open beat-2017.08.22 Ez89QEvaR8207QD06iY3jw 5 1 8 ``` My logstash config: ```auto input { beats { port => 5044 } } output { elasticsearch { # action => "%{[@metadata][action]}" # document_id => "%{[@metadata][_id]}" hosts => ["172.30.9.20"] #index => "index_name" index => "beat-%{+YYYY.MM.dd}" } } ``` And: ![beat](https://us1.discourse-cdn.com/elastic/original/3X/9/0/900b99b141750d522c7ababaf6886f9c0f36916b.png) How can I troubleshooting it? Thank you. ---
**Author:** ![malhotras](https://avatars.discourse-cdn.com/v4/letter/m/a8b319/32.png) [@malhotras](https://discuss.elastic.co/u/malhotras)\ **Post date:** [August 23, 2017, 6:41am UTC](https://discuss.elastic.co/t/logstash-get-data-but-kibana-cant-show-it/98006/2 "2017-08-23T06:41:36Z")
The problem occurs if you dont chose "time based data" properly when creating the index. If you dont want to use timestamp chose it. Only if you chose properly it will work. Otherwise, discover will not show anything. ---
**Author:** ![hack3rcon](https://avatars.discourse-cdn.com/v4/letter/h/96bed5/32.png) [@hack3rcon](https://discuss.elastic.co/u/hack3rcon)\ **Post date:** [August 23, 2017, 8:49am UTC](https://discuss.elastic.co/t/logstash-get-data-but-kibana-cant-show-it/98006/3 "2017-08-23T08:49:29Z")
How to chose “time based data”? Can you show me how can I solve it? If you mean time in Kibana then I must say that it is a Log for today and as you see, I selected "Today". ---
**Author:** ![malhotras](https://avatars.discourse-cdn.com/v4/letter/m/a8b319/32.png) [@malhotras](https://discuss.elastic.co/u/malhotras)\ **Post date:** [August 23, 2017, 8:58am UTC](https://discuss.elastic.co/t/logstash-get-data-but-kibana-cant-show-it/98006/4 "2017-08-23T08:58:25Z")
When you create a new index in kibana, i think you created one as i can see in the figure you attached. Did you chose "Time filter field name"?? If you have any field which you want to act as timefilter chose from the drop down list. Otherwise, chose "I dont want to use to timefilter". If you dont do this index will be created but discover will not show up any data. Hth. ---
**Author:** ![hack3rcon](https://avatars.discourse-cdn.com/v4/letter/h/96bed5/32.png) [@hack3rcon](https://discuss.elastic.co/u/hack3rcon)\ **Post date:** [August 23, 2017, 9:05am UTC](https://discuss.elastic.co/t/logstash-get-data-but-kibana-cant-show-it/98006/5 "2017-08-23T09:05:58Z")
![beat-2](https://us1.discourse-cdn.com/elastic/original/3X/c/6/c6d9f19870d7704f79c11e26da8fbb4dc9824393.png) I can't find any option "“I dont want to use to timefilter" !!! Can you address it? In your opinion, Is my config OK? How can I clear cache? ---
**Author:** ![malhotras](https://avatars.discourse-cdn.com/v4/letter/m/a8b319/32.png) [@malhotras](https://discuss.elastic.co/u/malhotras)\ **Post date:** [August 23, 2017, 9:18am UTC](https://discuss.elastic.co/t/logstash-get-data-but-kibana-cant-show-it/98006/6 "2017-08-23T09:18:20Z")
Uncheck index contains time-based events. To clear cache you can do it like this curl -XPOST '[http://localhost:9200/\_cache/clear](http://localhost:9200/_cache/clear)' I also do the following: curl -XDELETE '[http://localhost:9200/\_all](http://localhost:9200/_all)' Should resolve the issue. Key is to chose no timefilter. ---
**Author:** ![hack3rcon](https://avatars.discourse-cdn.com/v4/letter/h/96bed5/32.png) [@hack3rcon](https://discuss.elastic.co/u/hack3rcon)\ **Post date:** [August 23, 2017, 9:57am UTC](https://discuss.elastic.co/t/logstash-get-data-but-kibana-cant-show-it/98006/7 "2017-08-23T09:57:32Z")
both commands tell me: ```auto {"acknowledged":true} ``` "tcpdump" tell me I have data stream: ```auto # tcpdump -n -s 0 -i enp4s0 -X tcp port 5044 and host 172.30.10.15 tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on enp4s0, link-type EN10MB (Ethernet), capture size 65535 bytes 10:39:10.765514 IP 172.30.10.15.49258 > 172.30.9.20.lxi-evntsvc: Flags [S], seq 4228250198, win 8192, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0 0x0000: 4500 0034 01a8 4000 7f06 8ebc ac1e 0a0f E..4..@......... 0x0010: ac1e 0914 c06a 13b4 fc05 fa56 0000 0000 .....j.....V.... 0x0020: 8002 2000 1935 0000 0204 05b4 0103 0308 .....5.......... 0x0030: 0101 0402 .... 10:39:13.766075 IP 172.30.10.15.49258 > 172.30.9.20.lxi-evntsvc: Flags [S], seq 4228250198, win 8192, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0 0x0000: 4500 0034 01a9 4000 7f06 8ebb ac1e 0a0f E..4..@......... 0x0010: ac1e 0914 c06a 13b4 fc05 fa56 0000 0000 .....j.....V.... 0x0020: 8002 2000 1935 0000 0204 05b4 0103 0308 .....5.......... 0x0030: 0101 0402 .... 10:39:19.768996 IP 172.30.10.15.49258 > 172.30.9.20.lxi-evntsvc: Flags [S], seq 4228250198, win 8192, options [mss 1460,nop,nop,sackOK], length 0 0x0000: 4500 0030 01aa 4000 7f06 8ebe ac1e 0a0f E..0..@......... 0x0010: ac1e 0914 c06a 13b4 fc05 fa56 0000 0000 .....j.....V.... 0x0020: 7002 2000 2d44 0000 0204 05b4 0101 0402 p...-D.......... ``` but I guess it is not working properly. I mean is that I sense data can't receive ☹ ---
**Author:** ![malhotras](https://avatars.discourse-cdn.com/v4/letter/m/a8b319/32.png) [@malhotras](https://discuss.elastic.co/u/malhotras)\ **Post date:** [August 23, 2017, 10:23am UTC](https://discuss.elastic.co/t/logstash-get-data-but-kibana-cant-show-it/98006/8 "2017-08-23T10:23:33Z")
Sorry, still not working. I am not an expert here. But, faced similar issue and solved it like i mentioned here. Maybe you need to wait for experts comment now. ---
**Author:** ![hack3rcon](https://avatars.discourse-cdn.com/v4/letter/h/96bed5/32.png) [@hack3rcon](https://discuss.elastic.co/u/hack3rcon)\ **Post date:** [August 23, 2017, 11:46am UTC](https://discuss.elastic.co/t/logstash-get-data-but-kibana-cant-show-it/98006/9 "2017-08-23T11:46:17Z")
Thank you. The problem is that this forum is so slow. ---
**Author:** ![malhotras](https://avatars.discourse-cdn.com/v4/letter/m/a8b319/32.png) [@malhotras](https://discuss.elastic.co/u/malhotras)\ **Post date:** [August 23, 2017, 11:49am UTC](https://discuss.elastic.co/t/logstash-get-data-but-kibana-cant-show-it/98006/10 "2017-08-23T11:49:09Z")
Not really. But there are many questions to answer. I am tagging some people who helped in my problems. @magnusbaeck @fbaligand. ---
**Author:** ![hack3rcon](https://avatars.discourse-cdn.com/v4/letter/h/96bed5/32.png) [@hack3rcon](https://discuss.elastic.co/u/hack3rcon)\ **Post date:** [August 23, 2017, 11:50am UTC](https://discuss.elastic.co/t/logstash-get-data-but-kibana-cant-show-it/98006/11 "2017-08-23T11:50:59Z")
@magnusbaeck @fbaligand can offer any help? ---
**Author:** ![fbaligand](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/fbaligand/32/5657_2.png) [@fbaligand](https://discuss.elastic.co/u/fbaligand)\ **Post date:** [August 23, 2017, 4:17pm UTC](https://discuss.elastic.co/t/logstash-get-data-but-kibana-cant-show-it/98006/12 "2017-08-23T16:17:18Z")
Up to me, the main problem is that you have a wrong index mapping. Question : why do you put logstash between beats and elasticsearch ? Beats can directly send data to elasticsearch. And when it does that, it puts the right template mapping for your data. If you use Winlogbeat, it could be relevant to import specific Winlogbeat elasticsearch mapping template and kibana dashboards. Steps 4 and 6 here : [https://www.elastic.co/guide/en/beats/winlogbeat/current/winlogbeat-template.html](https://www.elastic.co/guide/en/beats/winlogbeat/current/winlogbeat-template.html) ---
**Author:** ![hack3rcon](https://avatars.discourse-cdn.com/v4/letter/h/96bed5/32.png) [@hack3rcon](https://discuss.elastic.co/u/hack3rcon)\ **Post date:** [August 26, 2017, 6:58am UTC](https://discuss.elastic.co/t/logstash-get-data-but-kibana-cant-show-it/98006/13 "2017-08-26T06:58:35Z")
My index is "beat" as you see in config file. Thus, I don't need "Logstash". OK, I disabled it. but if I want to use a diagram like below then what should I do: "Winlogbeat -\> Logstash -\> Elasticsearch -\> Kibana". ---
**Author:** ![fbaligand](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/fbaligand/32/5657_2.png) [@fbaligand](https://discuss.elastic.co/u/fbaligand)\ **Post date:** [August 26, 2017, 8:30am UTC](https://discuss.elastic.co/t/logstash-get-data-but-kibana-cant-show-it/98006/14 "2017-08-26T08:30:08Z")
If you don't need document transformation to another output than elasticsearch, Logstash is useless. That said, you have to set this in Logstash elasticsearch output : manage\_template =\> false And to import manually elasticsearch index template for winlogbeat. All of this is explained here : [https://www.elastic.co/guide/en/beats/winlogbeat/current/config-winlogbeat-logstash.html](https://www.elastic.co/guide/en/beats/winlogbeat/current/config-winlogbeat-logstash.html) Globally I advice you to read carefully getting started doc for winlogbeat which is very well done and explain you all the possibilities. ---
**Author:** ![hack3rcon](https://avatars.discourse-cdn.com/v4/letter/h/96bed5/32.png) [@hack3rcon](https://discuss.elastic.co/u/hack3rcon)\ **Post date:** [August 26, 2017, 10:04am UTC](https://discuss.elastic.co/t/logstash-get-data-but-kibana-cant-show-it/98006/15 "2017-08-26T10:04:20Z")
I configured it correctly as URL said. Where I did "manage\_template =\> false" ? ---
**Author:** ![fbaligand](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/fbaligand/32/5657_2.png) [@fbaligand](https://discuss.elastic.co/u/fbaligand)\ **Post date:** [August 26, 2017, 10:22am UTC](https://discuss.elastic.co/t/logstash-get-data-but-kibana-cant-show-it/98006/16 "2017-08-26T10:22:20Z")
Where I said in my previous comment : In Logstash elasticsearch output ---
**Author:** ![hack3rcon](https://avatars.discourse-cdn.com/v4/letter/h/96bed5/32.png) [@hack3rcon](https://discuss.elastic.co/u/hack3rcon)\ **Post date:** [August 26, 2017, 12:42pm UTC](https://discuss.elastic.co/t/logstash-get-data-but-kibana-cant-show-it/98006/17 "2017-08-26T12:42:45Z")
I never set it!!! ---
**Author:** ![fbaligand](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/fbaligand/32/5657_2.png) [@fbaligand](https://discuss.elastic.co/u/fbaligand)\ **Post date:** [August 26, 2017, 1:07pm UTC](https://discuss.elastic.co/t/logstash-get-data-but-kibana-cant-show-it/98006/18 "2017-08-26T13:07:49Z")
OK, to be more clear : - by default, Logstash elasticsearch output puts its own index template into elasticsearch. A template that is relevant with Logstash logs. - in your case, Logstash template is not relevant because it is winlogbeat data. - If you wish winlogbeat data is correctly ingested into elasticsearch, you have to put winlogbeat template into elasticsearch - you have to disable template management in Logstash elasticsearch output using `manage_template => false` - finally, if you think I said "you did set this setting", you misunderstand me. Sorry to tell that, but when I say "You have to", it means "You must" (it is synonym). So yes, you have not set this setting, and if you want that it works, you must set this setting. - globally, all that I said is explained in winlogbeat "getting started" : [https://www.elastic.co/guide/en/beats/winlogbeat/current/winlogbeat-getting-started.html](https://www.elastic.co/guide/en/beats/winlogbeat/current/winlogbeat-getting-started.html) ---
**Author:** ![hack3rcon](https://avatars.discourse-cdn.com/v4/letter/h/96bed5/32.png) [@hack3rcon](https://discuss.elastic.co/u/hack3rcon)\ **Post date:** [August 26, 2017, 1:27pm UTC](https://discuss.elastic.co/t/logstash-get-data-but-kibana-cant-show-it/98006/19 "2017-08-26T13:27:26Z")
Thus, I must put "manage\_template =\> false" into my "winlogbeat" configuration? ---
**Author:** ![fbaligand](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/fbaligand/32/5657_2.png) [@fbaligand](https://discuss.elastic.co/u/fbaligand)\ **Post date:** [August 26, 2017, 2:14pm UTC](https://discuss.elastic.co/t/logstash-get-data-but-kibana-cant-show-it/98006/20 "2017-08-26T14:14:13Z")
No, just in Logstash. [Next page](https://discuss.elastic.co/t/logstash-get-data-but-kibana-cant-show-it/98006.md?page=2)