# Make functionbeat logs show in "Logs" section of Kibana

**URL:** <https://discuss.elastic.co/t/make-functionbeat-logs-show-in-logs-section-of-kibana/165453>\
**Category:** Beats\
**Tags:** functionbeat\
**Created:** [January 23, 2019, 4:17pm UTC](https://discuss.elastic.co/t/make-functionbeat-logs-show-in-logs-section-of-kibana/165453 "2019-01-23T16:17:17Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Marc\_Fielding](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marc_fielding/32/39406_2.png) [@Marc\_Fielding](https://discuss.elastic.co/u/Marc_Fielding)\
**Post date:** [January 23, 2019, 4:17pm UTC](https://discuss.elastic.co/t/make-functionbeat-logs-show-in-logs-section-of-kibana/165453/1 "2019-01-23T16:17:17Z")

</div>

Heya,

So I'd like to use the nice new tail functionality for our Lambda logs in Kibana, the logs themselves are going into a filebeat index, but when I click "Logs" it tells me there are none available and obviously as there's no tutorial section for functionbeat(because it's in beta) it's hard to track down what to do.

Any pointers would be very helpful as I'd like to use this on a number of commercial projects.

Cheers

Marc

---

<div class="post-metadata">

**Author:** ![Marc\_Fielding](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marc_fielding/32/39406_2.png) [@Marc\_Fielding](https://discuss.elastic.co/u/Marc_Fielding)\
**Post date:** [January 24, 2019, 9:25am UTC](https://discuss.elastic.co/t/make-functionbeat-logs-show-in-logs-section-of-kibana/165453/2 "2019-01-24T09:25:53Z")

</div>

Aha I think I found it, the interface uses FILEbeat-\* as it's index, obviously the one being created is FUNCTIONbeat-\* so a change would need to be made to the config.yml - I'm seeing if thats possible in elastic cloud.

---

<div class="post-metadata">

**Author:** ![GAHila](https://avatars.discourse-cdn.com/v4/letter/g/f14d63/32.png) [@GAHila](https://discuss.elastic.co/u/GAHila)\
**Post date:** [January 25, 2019, 4:08pm UTC](https://discuss.elastic.co/t/make-functionbeat-logs-show-in-logs-section-of-kibana/165453/3 "2019-01-25T16:08:50Z")

</div>

> [@Marc\_Fielding](#):
>
> e very helpful as I'd like to use this on a number of commercial projects.

Were you able to make this work?

---

<div class="post-metadata">

**Author:** ![Marc\_Fielding](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/marc_fielding/32/39406_2.png) [@Marc\_Fielding](https://discuss.elastic.co/u/Marc_Fielding)\
**Post date:** [January 26, 2019, 2:56pm UTC](https://discuss.elastic.co/t/make-functionbeat-logs-show-in-logs-section-of-kibana/165453/4 "2019-01-26T14:56:23Z")

</div>

Heya, sorry for the slow response, yes I was by using my own cloudwatch exporter and manually putting the logs into the correct index. Basically functionbeat puts logs into the "functionbeat-blah" index, the Kibana logs interface doesn't notice that, so until that's allowed as a documented option then it's a manual thing, I'm just writing up a blog post now.

---

<div class="post-metadata">

**Author:** ![pierhugues](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pierhugues/32/48383_2.png) [@pierhugues](https://discuss.elastic.co/u/pierhugues)\
**Post date:** [February 7, 2019, 1:03pm UTC](https://discuss.elastic.co/t/make-functionbeat-logs-show-in-logs-section-of-kibana/165453/5 "2019-02-07T13:03:16Z")

</div>

You can change which index to puts logs using the `index` option in the elasticsearch output, but I don't think it will work right away. I will create a issue to follow up.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 28, 2019, 3:03am UTC](https://discuss.elastic.co/t/make-functionbeat-logs-show-in-logs-section-of-kibana/165453/6 "2019-02-28T03:03:23Z")

</div>

This topic was automatically closed 20 days after the last reply. New replies are no longer allowed.
