# Logstash Log Stream

**URL:** <https://discuss.elastic.co/t/logstash-log-stream/299262>\
**Category:** Kibana\
**Created:** [March 9, 2022, 9:06pm UTC](https://discuss.elastic.co/t/logstash-log-stream/299262 "2022-03-09T21:06:32Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![laolao](https://avatars.discourse-cdn.com/v4/letter/l/e56c9b/32.png) [@laolao](https://discuss.elastic.co/u/laolao)\
**Post date:** [March 9, 2022, 9:06pm UTC](https://discuss.elastic.co/t/logstash-log-stream/299262/1 "2022-03-09T21:06:32Z")

</div>

I have a basic configuration of logstash sending syslogs to Elasticsearch. I created my index pattern and can make visualizations, etc. However, I want to view the logs in real time on my dashboard.

My dashboard has 4 different visualizations, and all of them show data. The only one that doesn't show anything is the 'Log Stream' widget.  
 ![52afe6f2d0bfaa2f0ff80cd42c296cf2519da2d7_2_690x316](https://us1.discourse-cdn.com/elastic/original/3X/2/2/220024ac93c4c5018ca908fad10a648c9bf63871.png)

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [March 9, 2022, 9:28pm UTC](https://discuss.elastic.co/t/logstash-log-stream/299262/2 "2022-03-09T21:28:01Z")

</div>

By _Log Stream_ you mean the Logs app in Kibana, part of the Observability module?

The logs app per default will only look into index named `filebeat-*` and nothing else, if you are using different index names you will need to edit the settings and change which index pattern the log stream should look and which fields it will show.

How you will do that will depend on the version you are using. What is the stack version you are using?

In [this link](https://www.elastic.co/guide/en/observability/7.17/configure-data-sources.html) you have the documentation for version 7.17, just change to your current version to see what you need to change.

---

<div class="post-metadata">

**Author:** ![laolao](https://avatars.discourse-cdn.com/v4/letter/l/e56c9b/32.png) [@laolao](https://discuss.elastic.co/u/laolao)\
**Post date:** [March 10, 2022, 3:27pm UTC](https://discuss.elastic.co/t/logstash-log-stream/299262/3 "2022-03-10T15:27:59Z")

</div>

I do not have any logging integrations. The observability \> logs tab is completely empty, just prompting me to integrate-- which I shouldn't have to do in order to display logs that I can already see in Discover.

---

<div class="post-metadata">

**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\
**Post date:** [March 10, 2022, 3:55pm UTC](https://discuss.elastic.co/t/logstash-log-stream/299262/4 "2022-03-10T15:55:34Z")

</div>

You do not need any logging integrations, you just need to configure the Logs app in the Observability session to use your index patterns and fields, check the documentation I shared and the answer above.

The Logs tab is completely different from discover, it won't work unless you change it from the default setting that uses the `filebeat-*` index.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 7, 2022, 3:55pm UTC](https://discuss.elastic.co/t/logstash-log-stream/299262/5 "2022-04-07T15:55:35Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.