# Problem visualising nginx access logs in grafana

**URL:** <https://discuss.elastic.co/t/problem-visualising-nginx-access-logs-in-grafana/140579>\
**Category:** Logstash\
**Created:** [July 18, 2018, 2:31pm UTC](https://discuss.elastic.co/t/problem-visualising-nginx-access-logs-in-grafana/140579 "2018-07-18T14:31:42Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![nycterent](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nycterent/32/31451_2.png) [@nycterent](https://discuss.elastic.co/u/nycterent)\
**Post date:** [July 18, 2018, 2:31pm UTC](https://discuss.elastic.co/t/problem-visualising-nginx-access-logs-in-grafana/140579/1 "2018-07-18T14:31:42Z")

</div>

hi,

I have had success pushing logs using filebeat to elasticsearch and visualising them in grafana, but when introduced logstash between filebeat and elasticsearch graphs are gone. in grafana i get this error:

Fielddata is disabled on text fields by default. Set fielddata=true on [nginx.access.response\_code] in order to load fielddata in memory by uninverting the inverted index. Note that this can however use significant memory. Alternatively use a keyword field instead.

my pipeline:

input {  
beats {  
port =\> "5044"  
}  
}

filter {  
if [fileset][module] == "nginx" {  
if [fileset][name] == "access" {  
grok {  
match =\> { "message" =\> ["%{IPORHOST:[nginx][access][http\_host]} %{IPORHOST:[nginx][access][remote\_ip]} - %{DATA:[nginx][access][user\_name]} [%{HTTPDATE:[nginx][access][time]}] "%{WORD:[nginx][access][method]} %{DATA:[nginx][access][url]} HTTP/%{NUMBER:[nginx][access][http\_version]}" %{NUMBER:[nginx][access][response\_code]} %{NUMBER:[nginx][access][body\_sent][bytes]} "%{DATA:[nginx][access][referrer]}" "%{DATA:[nginx][access][agent]}" %{NUMBER:[nginx][access][request\_time]} %{NUMBER:[nginx][access][upstream\_time]}"] }  
remove\_field =\> "message"  
}  
mutate {  
add\_field =\> { "read\_timestamp" =\> "%{@timestamp}" }  
convert =\> ["[nginx][access][response\_code]", "integer" ]  
convert =\> ["[nginx][access][body\_sent][bytes]","integer" ]  
convert =\> ["[nginx][access][request\_time]","float" ]  
convert =\> ["[nginx][access][upstream\_time]","float" ]  
}  
date {  
match =\> ["[nginx][access][time]", "dd/MMM/YYYY:H:m:s Z" ]  
remove\_field =\> "[nginx][access][time]"  
}  
useragent {  
source =\> "[nginx][access][agent]"  
target =\> "[nginx][access][user\_agent]"  
remove\_field =\> "[nginx][access][agent]"  
}  
geoip {  
source =\> "[nginx][access][remote\_ip]"  
target =\> "[nginx][access][geoip]"  
}  
}  
else if [fileset][name] == "error" {  
grok {  
match =\> { "message" =\> ["%{DATA:[nginx][error][time]} [%{DATA:[nginx][error][level]}] %{NUMBER:[nginx][error][pid]}#%{NUMBER:[nginx][error][tid]}: (\*%{NUMBER:[nginx][error][connection\_id]} )?%{GREEDYDATA:[nginx][error][message]}"] }  
remove\_field =\> "message"  
}  
mutate {  
rename =\> { "@timestamp" =\> "read\_timestamp" }  
}  
date {  
match =\> ["[nginx][error][time]", "YYYY/MM/dd H:m:s" ]  
remove\_field =\> "[nginx][error][time]"  
}  
}  
}  
}

output {  
elasticsearch {  
manage\_template =\> false  
hosts =\> ["ELASTICSERVER"]  
}  
}

i can view logs in kibana fine, with all required fields for me. hopefully someone can point me to the right direction..

thank you in advance!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 15, 2018, 2:31pm UTC](https://discuss.elastic.co/t/problem-visualising-nginx-access-logs-in-grafana/140579/2 "2018-08-15T14:31:50Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.