# Not able to see logs in the index

**URL:** <https://discuss.elastic.co/t/not-able-to-see-logs-in-the-index/213399>\
**Category:** Logstash\
**Created:** [December 31, 2019, 12:34am UTC](https://discuss.elastic.co/t/not-able-to-see-logs-in-the-index/213399 "2019-12-31T00:34:06Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![dustlesspuma](https://avatars.discourse-cdn.com/v4/letter/d/f1d935/32.png) [@dustlesspuma](https://discuss.elastic.co/u/dustlesspuma)\
**Post date:** [December 31, 2019, 12:34am UTC](https://discuss.elastic.co/t/not-able-to-see-logs-in-the-index/213399/1 "2019-12-31T00:34:07Z")

</div>

I have two mutate filters created one to get all the /var/log/messages to type \> security and other mutate filter to get all the logs from one kind of hosts to type \> host\_type.  
I am not able to see the /var/log/messages in the host\_type index.

Here is the filters code I am using, please help me understand what's going on here. why am I not able to see /var/log/messages in my apihost index?  
I have filebeat setup on the hosts to send logs to logstash.

fileter-security.conf  
filter {  
if [source] =~ //var/log/(secure|syslog|auth.log|messages|kern.log)$/ {  
mutate {  
replace =\> { "type" =\> "security" }  
}  
}  
}

filter-apihost.conf  
filter {  
if (([host.name] =~ /(?i)apihost-/) or ([host] =~ /(?i)apihost-/)) {  
mutate {  
replace =\> { "type" =\> "apihost" }  
}  
}  
}

---

<div class="post-metadata">

**Author:** ![dustlesspuma](https://avatars.discourse-cdn.com/v4/letter/d/f1d935/32.png) [@dustlesspuma](https://discuss.elastic.co/u/dustlesspuma)\
**Post date:** [January 3, 2020, 7:19pm UTC](https://discuss.elastic.co/t/not-able-to-see-logs-in-the-index/213399/2 "2020-01-03T19:19:38Z")

</div>

@magnusbaeck any input would be appreciated. TIA

---

<div class="post-metadata">

**Author:** ![mancharagopan](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mancharagopan/32/60266_2.png) [@mancharagopan](https://discuss.elastic.co/u/mancharagopan)\
**Post date:** [January 4, 2020, 2:51am UTC](https://discuss.elastic.co/t/not-able-to-see-logs-in-the-index/213399/3 "2020-01-04T02:51:05Z")

</div>

Can you please share the pipeline.yml configuration and the input, output, and filter configuration files?

You said you cannot see /var/log/messages in host\_type index, are you sending it to different index?

Try adding tags for the logs first using `add_tag` option whether your regex conditions are correct.

This site is really helpful for debugging regex,  
[regex debug](https://regex101.com/)

---

<div class="post-metadata">

**Author:** ![dustlesspuma](https://avatars.discourse-cdn.com/v4/letter/d/f1d935/32.png) [@dustlesspuma](https://discuss.elastic.co/u/dustlesspuma)\
**Post date:** [January 6, 2020, 7:46pm UTC](https://discuss.elastic.co/t/not-able-to-see-logs-in-the-index/213399/4 "2020-01-06T19:46:59Z")

</div>

@mancharagopan thanks for your reply. Yeah I am sending them to a different index like I mentioned in my post:  
filter-security.conf  
filter {  
if [source] =~ //var/log/(secure|syslog|auth.log|messages|kern.log)$/ {  
mutate {  
replace =\> { "type" =\> "security" }  
}  
}  
}  
So what I am trying to achieve is I want to see them in both my indexes : 'security' as well as 'apihost'  
As I am sending /var/log/\* to 'secutiry' index, I am not able to see only those logs in 'apihost' index. But I can see all other logs I am sending from apihosts to 'apihost' index. Please advice. Thanks

---

<div class="post-metadata">

**Author:** ![dustlesspuma](https://avatars.discourse-cdn.com/v4/letter/d/f1d935/32.png) [@dustlesspuma](https://discuss.elastic.co/u/dustlesspuma)\
**Post date:** [January 7, 2020, 7:45pm UTC](https://discuss.elastic.co/t/not-able-to-see-logs-in-the-index/213399/5 "2020-01-07T19:45:56Z")

</div>

Actually I fixed this issue by adding a clone filter and sending data to both indexes. Just wanted to let you know @mancharagopan

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 4, 2020, 7:54pm UTC](https://discuss.elastic.co/t/not-able-to-see-logs-in-the-index/213399/6 "2020-02-04T19:54:52Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.