# No Structured Logs Found in Stack Monitoring when using Logstash

**URL:** https://discuss.elastic.co/t/no-structured-logs-found-in-stack-monitoring-when-using-logstash/302005
**Category:** Logstash
**Created:** [April 9, 2022, 12:28am UTC](https://discuss.elastic.co/t/no-structured-logs-found-in-stack-monitoring-when-using-logstash/302005 "2022-04-09T00:28:37Z")
**Posts on this page:** 8
**Page:** 1

<div class="post-metadata">

### Author: ![zx8086](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zx8086/32/94917_2.png) [@zx8086](https://discuss.elastic.co/u/zx8086)
#### Post date: [April 9, 2022, 12:28am UTC](https://discuss.elastic.co/t/no-structured-logs-found-in-stack-monitoring-when-using-logstash/302005/1 "2022-04-09T00:28:37Z")

</div>

Same issue

Running filebeat -\> Elasticsearch = Works, can see Server, GC, Kibana etc logs...  
filebeat -\> Logstash = No Logs displayed

> [@No Structured Logs Found in Stack Monitoring when using Logstashs](https://discuss.elastic.co/t/no-structured-logs-found-in-stack-monitoring-when-using-logstashs/296776):
>
> Hello All, Hope someone can help as I spent the past week trying to resolve this issue but couldn't. So some backstory. If I setup Elasticsearch with filebeat pointing to Elasticsearch, the Logs section in Stack Monitoring reports the server logs and recent logs no problem. When I go modify the filebeat to point to logstash, the logs do make it to Elasticsearch but I always have the "No Structured Logs Found" with a recommendation of pointing to the .json logs which are already setup and goin…

---

<div class="post-metadata">

### Author: ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)
#### Post date: [April 10, 2022, 11:14pm UTC](https://discuss.elastic.co/t/no-structured-logs-found-in-stack-monitoring-when-using-logstash/302005/2 "2022-04-10T23:14:36Z")

</div>

Perhaps this...

> [@No Structured Logs Found in Stack Monitoring when using Logstashs](https://discuss.elastic.co/t/no-structured-logs-found-in-stack-monitoring-when-using-logstashs/296776/7):
>
> You may be missing the pipeline setting input { beats { port =\> 5044 } } output { if [@metadata][pipeline] { elasticsearch { hosts =\> "https://061ab24010a2482e9d64729fdb0fd93a.us-east-1.aws.found.io:9243" manage\_template =\> false index =\> "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}" pipeline =\> "%{[@metadata][pipeline]}" user =\> "elastic" password =\> "secret" } } else { elasticsearch { hosts =\> "https://061ab…

---

<div class="post-metadata">

### Author: ![zx8086](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zx8086/32/94917_2.png) [@zx8086](https://discuss.elastic.co/u/zx8086)
#### Post date: [April 10, 2022, 11:23pm UTC](https://discuss.elastic.co/t/no-structured-logs-found-in-stack-monitoring-when-using-logstash/302005/3 "2022-04-10T23:23:57Z")

</div>

@stephenb So can i use a data stream, which is what i was doing and missing the manage\_template =\> false.

Everything else was identical

---

<div class="post-metadata">

### Author: ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)
#### Post date: [April 10, 2022, 11:29pm UTC](https://discuss.elastic.co/t/no-structured-logs-found-in-stack-monitoring-when-using-logstash/302005/4 "2022-04-10T23:29:06Z")

</div>

I would think so... I have not played with data streams much yet ..

---

<div class="post-metadata">

### Author: ![zx8086](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zx8086/32/94917_2.png) [@zx8086](https://discuss.elastic.co/u/zx8086)
#### Post date: [April 10, 2022, 11:48pm UTC](https://discuss.elastic.co/t/no-structured-logs-found-in-stack-monitoring-when-using-logstash/302005/5 "2022-04-10T23:48:47Z")

</div>

@stephenb

Just confirmed... you cannot use these two settings, with **data\_stream =\> "true"**

```auto
        manage_template => false
        index => "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"

```

So there must be a way, while using data streams, to keep the Structured logs in the Stack Monitoring UI, as we are migrating to recommended future architecture with Data Streams.

---

<div class="post-metadata">

### Author: ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)
#### Post date: [April 11, 2022, 2:20am UTC](https://discuss.elastic.co/t/no-structured-logs-found-in-stack-monitoring-when-using-logstash/302005/6 "2022-04-11T02:20:03Z")

</div>

Did you enable the Elasticsearch module and then take out those 2 lines from logstash? If so what data stream does the data end up in?

---

<div class="post-metadata">

### Author: ![zx8086](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zx8086/32/94917_2.png) [@zx8086](https://discuss.elastic.co/u/zx8086)
#### Post date: [April 11, 2022, 2:23am UTC](https://discuss.elastic.co/t/no-structured-logs-found-in-stack-monitoring-when-using-logstash/302005/7 "2022-04-11T02:23:59Z")

</div>

@stephenb

The data goes into a data stream, the default one, as i don't specify any other data stream

```auto
.ds-logs-generic-default

```

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 9, 2022, 2:24am UTC](https://discuss.elastic.co/t/no-structured-logs-found-in-stack-monitoring-when-using-logstash/302005/8 "2022-05-09T02:24:54Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
