# Monitoring.ui.logs.index not working on docker?

**URL:** <https://discuss.elastic.co/t/monitoring-ui-logs-index-not-working-on-docker/273186>\
**Category:** Logs\
**Created:** [May 17, 2021, 2:18pm UTC](https://discuss.elastic.co/t/monitoring-ui-logs-index-not-working-on-docker/273186 "2021-05-17T14:18:28Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Flavio\_Pompermaier](https://avatars.discourse-cdn.com/v4/letter/f/54ee81/32.png) [@Flavio\_Pompermaier](https://discuss.elastic.co/u/Flavio_Pompermaier)\
**Post date:** [May 17, 2021, 2:18pm UTC](https://discuss.elastic.co/t/monitoring-ui-logs-index-not-working-on-docker/273186/1 "2021-05-17T14:18:28Z")

</div>

Hi to all,  
I've setup a working Kibana using docker-compose and I use journalbeat to collect elasticsearch logs of my docker container (that use journald as logging option). I've tried to change **monitoring.ui.logs.index** to **journalbeat-** \* but still no log is shown in the Stack monitoring section.  
I've used MONITORING\_UI\_LOGS\_INDEX: "journalbeat-\*" in the environment section of the service to set that property. Could it be that the docker helper does not pass it correctly to the container?

The logs produced by filebeat and journalbeat are almost the same (I set up some processor in the journalbeat to populate elasticsearch.\* fields correctly (and fileset.name or input.log as well)..so it is not clear at all to me why Kibana does not show any elasticsearch logs.

Any help is appreciated and thanks in advance,  
Flavio

---

<div class="post-metadata">

**Author:** ![Igor\_Zaytsev](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/igor_zaytsev/32/50662_2.png) [@Igor\_Zaytsev](https://discuss.elastic.co/u/Igor_Zaytsev)\
**Post date:** [May 19, 2021, 11:17pm UTC](https://discuss.elastic.co/t/monitoring-ui-logs-index-not-working-on-docker/273186/2 "2021-05-19T23:17:18Z")

</div>

@Flavio_Pompermaier Sorry to hear that.

This is the query we use to logs:

```auto
GET journalbeat-*/_search
{
  "size": 0,
  "sort": {
    "@timestamp": {
      "order": "desc",
      "unmapped_type": "long"
    }
  },
  "query": {
    "bool": {
      "filter": [
        {
          "term": {
            "service.type": "elasticsearch"
          }
        }
      ]
    }
  },
  "aggs": {
    "types": {
      "terms": {
        "field": "event.dataset"
      },
      "aggs": {
        "levels": {
          "terms": {
            "field": "log.level"
          }
        }
      }
    }
  }
}

```

Can you please run this in Dev Tools and post the result here. Also, can you please send my one raw document from `journalbeat-*` I want to make sure it abides by `"service.type": "elasticsearch"` which is in the query

---

<div class="post-metadata">

**Author:** ![Flavio\_Pompermaier](https://avatars.discourse-cdn.com/v4/letter/f/54ee81/32.png) [@Flavio\_Pompermaier](https://discuss.elastic.co/u/Flavio_Pompermaier)\
**Post date:** [May 24, 2021, 8:17am UTC](https://discuss.elastic.co/t/monitoring-ui-logs-index-not-working-on-docker/273186/3 "2021-05-24T08:17:07Z")

</div>

Unfortunately I've reverted to file logging of my ES container to send its logs to the cluster because I saw that there is a lot of logic inside the filbeat.elasticsearch-xpack module and I want them to be handled correctly. In an ideal world there would be a journalbeat.elasticsearch-xpack module that replicates all the logic contained in the filbeat one. Before switching back to file logging this was the processor section of my journalbeat (I think the query you suggested was returning a non empty response when I had data in the journalbeat index):

```
processors:
  - add_host_metadata: ~
  - add_cloud_metadata: ~
  - add_docker_metadata: ~
  - if:
      regexp:
        journald.custom.image_name: "^docker.elastic.co/elasticsearch/elasticsearch.*"
    then:
      - decode_json_fields:
          fields:
            - message
          target: elasticsearch
          add_error_key: true
          overwrite_keys: true
      - drop_fields:
          fields:
            - message
          ignore_missing: true
      - rename:
          fields:
          - from: elasticsearch.message
            to: message
          - from: elasticsearch.type
            to: fileset.name
          - from: elasticsearch.level
            to: log.level
          - from: elasticsearch.service.type
            to: service.type
          fail_on_error: false
          ignore_missing: true
      - add_fields:
          target: event
          fields:
            module: elasticsearch
            service.type: elasticsearch
      - add_fields:
          target: input
          fields:
            type: "log"
      - script:
          lang: javascript
          id: add_event_dataset
          source: >
            function process(event) {
              var value = event.Get("fileset.name");
              event.Put("event.dataset","elasticsarch." + value);
            }
      - if:
          not:
            has_fields:
              - service.type
        then:
          - add_fields:
              target: service
              fields:
                type: elasticsearch
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 21, 2021, 8:17am UTC](https://discuss.elastic.co/t/monitoring-ui-logs-index-not-working-on-docker/273186/4 "2021-06-21T08:17:18Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.