# "Looks like you don't have any logging indices" **URL:** \ **Category:** Logs\ **Created:** [November 15, 2018, 5:19pm UTC](https://discuss.elastic.co/t/looks-like-you-dont-have-any-logging-indices/156915 "2018-11-15T17:19:26Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![trondhindenes](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/trondhindenes/32/10534_2.png) [@trondhindenes](https://discuss.elastic.co/u/trondhindenes)\ **Post date:** [November 15, 2018, 5:19pm UTC](https://discuss.elastic.co/t/looks-like-you-dont-have-any-logging-indices/156915/1 "2018-11-15T17:19:26Z")
I'm trying to figure out what constitutes a "logging index" - I'm getting the message " Looks like you don't have any logging indices" when testing the new "Logs" app in Kibana, but I can't find any documentation around what it considers a logging index. Is this feature "locked" to the builtin pattern (filebeat\*, logstash\*) etc? ---
**Author:** ![weltenwort](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/weltenwort/32/53885_2.png) [@weltenwort](https://discuss.elastic.co/u/weltenwort)\ **Post date:** [November 15, 2018, 6:56pm UTC](https://discuss.elastic.co/t/looks-like-you-dont-have-any-logging-indices/156915/2 "2018-11-15T18:56:01Z")
Hi @trondhindenes, the logging ui indeed defaults to using the `filebeat-*` index pattern created by the default filebeat configuration. Clicking the "Setup Instructions" button brings you to the "Add Data" UI, which can walk you through setting up filebeat. If you already have logs in other indices, you can change the index pattern and fields via the `kibana.yml` configuration file. The github issue [#20428](https://github.com/elastic/kibana/issues/20428) shows the default configuration, any part of which you can override. So if your logs were located in indices matching `logs-*`, you could put the following line into your config file to change it: ```auto xpack.infra.sources.default.logAlias: 'logs-*' ``` The infrastructure UI is released as a Beta product at this point, so we would be very much interested to hear your feedback and wishlist. ---
**Author:** ![weltenwort](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/weltenwort/32/53885_2.png) [@weltenwort](https://discuss.elastic.co/u/weltenwort)\ **Post date:** [November 15, 2018, 6:57pm UTC](https://discuss.elastic.co/t/looks-like-you-dont-have-any-logging-indices/156915/3 "2018-11-15T18:57:24Z")
I took the liberty of moving your question to the new #logs sub-forum. ---
**Author:** ![Balu](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/balu/32/37569_2.png) [@Balu](https://discuss.elastic.co/u/Balu)\ **Post date:** [November 16, 2018, 7:33am UTC](https://discuss.elastic.co/t/looks-like-you-dont-have-any-logging-indices/156915/4 "2018-11-16T07:33:35Z")
> [@weltenwort](#): > > The infrastructure UI is released as a Beta product at this point, so we would be very much interested to hear your feedback and wishlist. Well for starters you could have a select box like Discover that allows you to select the index instead of having to set it in a config file 😉 I'm actually a little confused because of that. The default log index, [Documentation](https://www.elastic.co/guide/en/infrastructure/guide/6.5/infrastructure-monitoring-overview.html) and all "add data" examples are based on \*beats. Doesn't it work with logstash inputs too? ---
**Author:** ![trondhindenes](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/trondhindenes/32/10534_2.png) [@trondhindenes](https://discuss.elastic.co/u/trondhindenes)\ **Post date:** [November 16, 2018, 7:46am UTC](https://discuss.elastic.co/t/looks-like-you-dont-have-any-logging-indices/156915/5 "2018-11-16T07:46:15Z")
Thanks for responding. This seems to imply that only one 'log pattern' is supported. We have at lest 6 distinctly different index patterns that all contain log-type data. ---
**Author:** ![weltenwort](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/weltenwort/32/53885_2.png) [@weltenwort](https://discuss.elastic.co/u/weltenwort)\ **Post date:** [November 16, 2018, 10:05am UTC](https://discuss.elastic.co/t/looks-like-you-dont-have-any-logging-indices/156915/6 "2018-11-16T10:05:17Z")
> Well for starters you could have a select box like Discover that allows you to select the index instead of having to set it in a config file Yes, this is definitely planned. > The default log index, [Documentation](https://www.elastic.co/guide/en/infrastructure/guide/6.5/infrastructure-monitoring-overview.html) and all "add data" examples are based on \*beats. Doesn't it work with logstash inputs too? It is currently designed to work with filebeat out-of-the box. That said, there is some flexibility if you're willing to change the Kibana configuration file (there will be a UI for that soon as well). - The index pattern used to read log events can be changed via the `xpack.infra.sources.default.logAlias` setting, which can contain any [index pattern supported by Elasticsearch](https://www.elastic.co/guide/en/elasticsearch/reference/current/multi-index.html). - The timestamp and sorting tiebreaker fields can be changed via the `xpack.infra.sources.default.fields.timestamp` and `xpack.infra.sources.default.fields.tiebreaker`, respectively. - The logic to read the message from the individual documents looks at several fields specific to filebeat modules first, but then falls back to the `message` and `@message` fields. That means no matter what the ingestion pipeline is, as long as it is possible to formulate an index pattern and structure the documents therein such that they contain timestamp and `message`/`@message` fields, the Log UI should pick them up, e.g.: ```auto xpack.infra: sources: default: logAlias: 'logstash-*' fields: timestamp: 'my_timestamp_field' tiebreaker: 'line_number_field' ``` ---
**Author:** ![weltenwort](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/weltenwort/32/53885_2.png) [@weltenwort](https://discuss.elastic.co/u/weltenwort)\ **Post date:** [November 16, 2018, 10:08am UTC](https://discuss.elastic.co/t/looks-like-you-dont-have-any-logging-indices/156915/7 "2018-11-16T10:08:28Z")
> [@trondhindenes](#): > > This seems to imply that only one 'log pattern' is supported. We have at lest 6 distinctly different index patterns that all contain log-type data. It is currently possible to set the `xpack.infra.sources.default.logAlias` setting to a compound index pattern such as `log-source-a-*,log-source-b-*`. The ability to configure and choose between multiple separate log data sources is being worked on. ---
**Author:** ![trondhindenes](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/trondhindenes/32/10534_2.png) [@trondhindenes](https://discuss.elastic.co/u/trondhindenes)\ **Post date:** [November 16, 2018, 10:18am UTC](https://discuss.elastic.co/t/looks-like-you-dont-have-any-logging-indices/156915/8 "2018-11-16T10:18:30Z")
Nice, thanks for explaining. We'll test the current options, and see how far we get! ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [December 14, 2018, 10:21am UTC](https://discuss.elastic.co/t/looks-like-you-dont-have-any-logging-indices/156915/9 "2018-12-14T10:21:56Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.