# Logstash Output to Kibana with SSL?
**URL:** https://discuss.elastic.co/t/logstash-output-to-kibana-with-ssl/341905
**Category:** Logstash
**Created:** [August 29, 2023, 3:37pm UTC](https://discuss.elastic.co/t/logstash-output-to-kibana-with-ssl/341905 "2023-08-29T15:37:42Z")
**Posts on this page:** 14
**Page:** 1
### Author:  [@paolovalladolid](https://discuss.elastic.co/u/paolovalladolid)
#### Post date: [August 29, 2023, 3:37pm UTC](https://discuss.elastic.co/t/logstash-output-to-kibana-with-ssl/341905/1 "2023-08-29T15:37:42Z")
I am new to Logstash, having previous experience with Filebeat and Winlogbeat.
In the Filebeat/Winlogbeat configuration we have separate output sections for Elasticsearch and Kibana. We configure the Kibana output section with paths to certificate files for authentication with Kibana, because without authentication we cannot create Kibana visualizations.
But in Logstash, there is only an elasticsearch output. I can't find any documentation on a Kibana output plugin for Logstash, where we may configure the paths to cert files. Am I just searching in the wrong places?
---
### Author:  [@Badger](https://discuss.elastic.co/u/Badger)
#### Post date: [August 29, 2023, 4:35pm UTC](https://discuss.elastic.co/t/logstash-output-to-kibana-with-ssl/341905/2 "2023-08-29T16:35:00Z")
> [@paolovalladolid](#):
>
> I can't find any documentation on a Kibana output plugin for Logstash
logstash does not provide support for the the Kibana APIs.
---
### Author:  [@paolovalladolid](https://discuss.elastic.co/u/paolovalladolid)
#### Post date: [August 29, 2023, 4:46pm UTC](https://discuss.elastic.co/t/logstash-output-to-kibana-with-ssl/341905/3 "2023-08-29T16:46:27Z")
Any suggestions then? We need to be able to display this data on Kibana dashboards.
---
### Author:  [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)
#### Post date: [August 29, 2023, 5:07pm UTC](https://discuss.elastic.co/t/logstash-output-to-kibana-with-ssl/341905/4 "2023-08-29T17:07:29Z")
> [@paolovalladolid](#):
>
> Any suggestions then? We need to be able to display this data on Kibana dashboards.
This is unrelated to Logstash.
The beats (filebeat, winlogbeat etc) does not have anyoutput to Kibana as Kibana does not receive data, it shows data present in Elasticsearch, what theyhave is a way to setup the built-in dashboards made by Elastic for data collected by them, this is what you configure.
Logstash has no integration with Kibana, if you are sending data from Logstash to Elasticsearch, you will need to create your own dashboards in Kibana.
Kibana is the visualization and management tool of the Elastic Stack, all the data is sent to and stored into Elasticsearch.
---
### Author:  [@paolovalladolid](https://discuss.elastic.co/u/paolovalladolid)
#### Post date: [August 29, 2023, 6:24pm UTC](https://discuss.elastic.co/t/logstash-output-to-kibana-with-ssl/341905/5 "2023-08-29T18:24:55Z")
Wait, if there's no output to Kibana, why is there a Kibana output section in filebeat.yml?
> **[Configure SSL | Filebeat Reference \[8.9\] | Elastic](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-ssl.html)**
It seems like we have never been able to get even a simple chart to show up in Kibana without SSL files configured in the Kibana output section of filebeat.yml or winlogbeat.yml. We can see data in Kibana Discover but that's it
But I could have been looking at the wrong config(s) the whole time.
I'll try some things. If we're still struggling with this maybe I'll start a thread on a Kibana appropriate forum if there are objections to continuing this thread here.
---
### Author:  [@Rios](https://discuss.elastic.co/u/Rios)
#### Post date: [August 29, 2023, 6:51pm UTC](https://discuss.elastic.co/t/logstash-output-to-kibana-with-ssl/341905/6 "2023-08-29T18:51:44Z")
Filebeat needs Kibana url to import:
- index template
- dashboards
- ingest pipeline
- space.id (optional)
---
### Author:  [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)
#### Post date: [August 29, 2023, 6:58pm UTC](https://discuss.elastic.co/t/logstash-output-to-kibana-with-ssl/341905/7 "2023-08-29T18:58:26Z")
> [@paolovalladolid](#):
>
> Wait, if there's no output to Kibana, why is there a Kibana output section in filebeat.yml?
This is not an output per se, it is the configuration needed for Filebeat to be able to communicate with Kibana to install the dashboards as explained [here](https://www.elastic.co/guide/en/beats/filebeat/current/setup-kibana-endpoint.html#setup-kibana-endpoint).
> Kibana dashboards are loaded into Kibana via the Kibana API. This requires a Kibana endpoint configuration.
This needs to be done on the first install and when there is an update to Filebeat or you install another filebeat module, this does not need to be done by the same filebeat that will collect your data. A common approach is to have a different filebeat the does not collect anything, just setup the dashboards.
---
### Author:  [@stephenb](https://discuss.elastic.co/u/stephenb)
#### Post date: [August 29, 2023, 7:09pm UTC](https://discuss.elastic.co/t/logstash-output-to-kibana-with-ssl/341905/8 "2023-08-29T19:09:31Z")
@paolovalladolid
Perhaps you should take a look at the quick start guide for filebeat
It shows how to enable a module, you can just use whichever module you like and configure it
> **[Filebeat quick start: installation and configuration | Filebeat Reference...](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-installation-configuration.html)**
If you have SSL issues it may be due to self-signed certs and there are docs on how to do that... or we can help with that
---
### Author:  [@paolovalladolid](https://discuss.elastic.co/u/paolovalladolid)
#### Post date: [August 29, 2023, 7:12pm UTC](https://discuss.elastic.co/t/logstash-output-to-kibana-with-ssl/341905/9 "2023-08-29T19:12:36Z")
Oh I've used Filebeat on other VMs and love it. I'd use it on this VM too if I didn't need Logstash's mutate to get rid of the "\_id" field.
Let me see if I can articulate my real problem more clearly.
In Kibana Discover, I see 3 documents that match index pattern `itential-jobs-*`. All 3 have a populated `@timestamp` field. All 3 were indexed by Logstash within the last 24 hours.
Then I do the following:
1. create a new Dashboard
2. set the time range to last 7 days (which should include the 24 hours)
3. click Create Visualization
4. select index pattern `itential-jobs-*`
I am unable to select `@timestamp` as the horizontal axis for a bar chart. I see the message `@timestamp does not match any options` when I type it into the field under "Select a field". But as mentioned previously, I can see 3 documents with populated @timestamp.
btw, it's version 7.17
---
### Author:  [@stephenb](https://discuss.elastic.co/u/stephenb)
#### Post date: [August 29, 2023, 8:45pm UTC](https://discuss.elastic.co/t/logstash-output-to-kibana-with-ssl/341905/10 "2023-08-29T20:45:07Z")
Next time start with the actual issue .. we will get to an answer quicker 🙂
Ok so things to check
Go to the index pattern and see what type of field `@timestamp` is is it date field?
2nd when you created the index pattern did you choose `@timestamp` as the time field?
If you go to Discover does it use `@timestamp`
The assuming you go to Lens are you using Date Histogram for the X Axis.. that would be correct choice... Are you trying a different type?
---
### Author:  [@paolovalladolid](https://discuss.elastic.co/u/paolovalladolid)
#### Post date: [August 29, 2023, 8:50pm UTC](https://discuss.elastic.co/t/logstash-output-to-kibana-with-ssl/341905/11 "2023-08-29T20:50:59Z")
This is odd. @timestamp is not listed under fields, even though, as I said, it is being populated in the documents. Logstash was used to index the documents.
example document seen in Discover
```auto
{
"_index": "itential-jobs-20230828",
"_type": "_doc",
"_id": "Qgl8PooBatf_EgwfVDjB",
"_version": 1,
"_score": 1,
"_source": {
"groups": [
"default"
],
"@timestamp": "2023-08-28T23:30:49.990922086Z",
.
.
.
}
```
For any index pattern that was used by Filebeat, @timestamp is listed
Maybe I have to delete itential-jobs-\*, and reset the mapping with @timestamp explicitly mapped? This is the mapping I set yesterday before indexing the 3 documents with Logstash.
```auto
{
"itential-jobs-20230828" : {
"mappings" : {
"dynamic" : "false",
"properties" : {
"error" : {
"type" : "flattened"
},
"name" : {
"type" : "text"
},
"tasks" : {
"type" : "flattened"
},
"transitions" : {
"type" : "flattened"
},
"variables" : {
"type" : "flattened"
}
}
}
}
}
```
---
### Author:  [@stephenb](https://discuss.elastic.co/u/stephenb)
#### Post date: [August 29, 2023, 9:01pm UTC](https://discuss.elastic.co/t/logstash-output-to-kibana-with-ssl/341905/12 "2023-08-29T21:01:54Z")
So check the fields... Looks to me like it is in the source but was not indexed as a field
> [@paolovalladolid](#):
>
> ` "dynamic" : "false",`
Yes I think you are ignoring the `@timestamp` field it is not getting indexed add it to the mapping and try again
---
### Author:  [@paolovalladolid](https://discuss.elastic.co/u/paolovalladolid)
#### Post date: [August 29, 2023, 9:45pm UTC](https://discuss.elastic.co/t/logstash-output-to-kibana-with-ssl/341905/13 "2023-08-29T21:45:43Z")
That did it! Thank you very much!
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 26, 2023, 9:45pm UTC](https://discuss.elastic.co/t/logstash-output-to-kibana-with-ssl/341905/14 "2023-09-26T21:45:52Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.