# Not able to see index log file in elastic search

**URL:** <https://discuss.elastic.co/t/not-able-to-see-index-log-file-in-elastic-search/330571>\
**Category:** Logstash\
**Created:** [April 23, 2023, 6:32am UTC](https://discuss.elastic.co/t/not-able-to-see-index-log-file-in-elastic-search/330571 "2023-04-23T06:32:23Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![sks](https://avatars.discourse-cdn.com/v4/letter/s/90db22/32.png) [@sks](https://discuss.elastic.co/u/sks)\
**Post date:** [April 23, 2023, 6:32am UTC](https://discuss.elastic.co/t/not-able-to-see-index-log-file-in-elastic-search/330571/1 "2023-04-23T06:32:23Z")

</div>

I am sending this log file

**web\_access.log**  
54.36.149.41 - - [22/Jan/2019:03:56:14 +0330] "GET /filter/27|13%20%D9%85%DA%AF%D8%A7%D9%BE%DB%8C%DA%A9%D8%B3%D9%84,27|%DA%A9%D9%85%D8%AA%D8%B1%20%D8%A7%D8%B2%205%20%D9%85%DA%AF%D8%A7%D9%BE%DB%8C%DA%A9%D8%B3%D9%84,p53 HTTP/1.1" 200 30577 "-" "Mozilla/5.0 (compatible; AhrefsBot/6.1; +http://ahrefs.com/robot/)" "-"  
31.56.96.51 - - [22/Jan/2019:03:56:16 +0330] "GET /image/60844/productModel/200x200 HTTP/1.1" 200 5667 "[https://www.zanbil.ir/m/filter/b113](https://www.zanbil.ir/m/filter/b113)" "Mozilla/5.0 (Linux; Android 6.0; ALE-L21 Build/HuaweiALE-L21) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.158 Mobile Safari/537.36" "-"  
31.56.96.51 - - [22/Jan/2019:03:56:16 +0330] "GET /image/61474/productModel/200x200 HTTP/1.1" 200 5379 "[هواوی | خرید محصولات هواوی با تضمین بهترین قیمت | زنبیل](https://www.zanbil.ir/m/filter/b113)" "Mozilla/5.0 (Linux; Android 6.0; ALE-L21 Build/HuaweiALE-L21) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.158 Mobile Safari/537.36" "-"  
40.77.167.129 - - [22/Jan/2019:03:56:17 +0330] "GET /image/14925/productModel/100x100 HTTP/1.1" 200 1696 "-" "Mozilla/5.0 (compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm)" "-"  
91.99.72.15 - - [22/Jan/2019:03:56:17 +0330] "GET /product/31893/62100/%D8%B3%D8%B4%D9%88%D8%A7%D8%B1-%D8%AE%D8%A7%D9%86%DA%AF%DB%8C-%D9%BE%D8%B1%D9%86%D8%B3%D9%84%DB%8C-%D9%85%D8%AF%D9%84-PR257AT HTTP/1.1" 200 41483 "-" "Mozilla/5.0 (Windows NT 6.2; Win64; x64; rv:16.0)Gecko/16.0 Firefox/16.0" "-"  
40.77.167.129 - - [22/Jan/2019:03:56:17 +0330] "GET /image/23488/productModel/150x150 HTTP/1.1" 200 2654 "-" "Mozilla/5.0 (compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm)" "-"  
40.77.167.129 - - [22/Jan/2019:03:56:18 +0330] "GET /image/45437/productModel/150x150 HTTP/1.1" 200 3688 "-" "Mozilla/5.0 (compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm)" "-"  
40.77.167.129 - - [22/Jan/2019:03:56:18 +0330] "GET /image/576/article/100x100 HTTP/1.1" 200 14776 "-" "Mozilla/5.0 (compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm)" "-"  
66.249.66.194 - - [22/Jan/2019:03:56:18 +0330] "GET /filter/b41,b665,c150%7C%D8%A8%D8%AE%D8%A7%D8%B1%D9%BE%D8%B2,p56 HTTP/1.1" 200 34277 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)" "-"

to logstash using the config file

input {  
file{  
path=\>"/home/mtech4/Downloads/web\_log.log.json"  
}  
}

filter {  
grok {  
match =\> { "message" =\> "%{COMBINEDAPACHELOG}"}  
}  
}

output {  
elasticsearch{hosts =\>["[https://localhost:9200](https://localhost:9200)" ]  
ssl\_certificate\_verification=\>false  
user =\>"elastic"  
password =\> "my name" }  
}

**in the output i am getting this:**  
INFO ] 2023-04-23 17:22:09.394 [[main]-pipeline-manager] javapipeline - Pipeline started {"pipeline.id"=\>"main"}  
[INFO] 2023-04-23 17:22:09.397 [[main]\<file] observingtail - START, creating Discoverer, Watch with file and sincedb collections  
[INFO] 2023-04-23 17:22:09.406 [Agent thread] agent - Pipelines running {:count=\>1, :running\_pipelines=\>[:main], :non\_running\_pipelines=\>}

**how see the output in kibana**

I am new to Elasticsearch and logstash , should i have to give index name inthe output  
Pls help me.

---

<div class="post-metadata">

**Author:** ![Rios](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/rios/32/95745_2.png) [@Rios](https://discuss.elastic.co/u/Rios)\
**Post date:** [April 23, 2023, 8:06pm UTC](https://discuss.elastic.co/t/not-able-to-see-index-log-file-in-elastic-search/330571/2 "2023-04-23T20:06:46Z")

</div>

Your grok filtering is fine. By default, your data ended in [logstash index](https://www.elastic.co/guide/en/logstash/current/plugins-outputs-elasticsearch.html#plugins-outputs-elasticsearch-index)  
If you want to separate, set index name: `index => "someindexname"`. After that, you should [create a data view](https://www.elastic.co/guide/en/kibana/master/data-views.html).

Additionally, you can add:

1. date to be from log - the timestamp field, for instance 22/Jan/2019:03:56:14 +0330, not LS @timestamp - 23/Apr/2023:06:00:00+0330
2. useragent lookup, based on the agent field
3. geoip lookup, based on the clientip field
4. bytes convert to the number

Try this 4 things by your own.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [May 21, 2023, 8:07pm UTC](https://discuss.elastic.co/t/not-able-to-see-index-log-file-in-elastic-search/330571/3 "2023-05-21T20:07:12Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
