# Setting up logs functionality with fluentd **URL:** \ **Category:** Logs\ **Created:** [February 26, 2019, 12:13am UTC](https://discuss.elastic.co/t/setting-up-logs-functionality-with-fluentd/169923 "2019-02-26T00:13:16Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Erik\_Tribou](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/erik_tribou/32/40998_2.png) [@Erik\_Tribou](https://discuss.elastic.co/u/Erik_Tribou)\ **Post date:** [February 26, 2019, 12:13am UTC](https://discuss.elastic.co/t/setting-up-logs-functionality-with-fluentd/169923/1 "2019-02-26T00:13:16Z")
I'm using elasticsearch and kibana 6.5.1 and trying to get the logs functionality working with logs we are inserting via fluentd. Unfortunately all I'm getting is message that no logs can be found and to adjust my filter. I'm seeing some action on the timeline at the right hand of the screen, but nothing ever shows when I set logs to start streaming or do searches for messages I know are there. I can see new messages through the discover module of Kibana, but nothing ever shows up in the logs module. Any ideas on what could be wrong with the configuration? Relevant entries from kibana.yml: xpack.infra.sources.default.logAlias: 'fluentd-\*' xpack.infra.sources.default.fields.message: ['msg', 'MESSAGE'] xpack.infra.sources.default.fields.host: '\_HOSTNAME' xpack.infra.sources.default.fields.container: 'container\_name' xpack.infra.sources.default.fields.pod: 'pod\_name' xpack.infra.sources.default.fields.tiebreaker: '\_SOURCE\_REALTIME\_TIMESTAMP' An example of the source field (json view in kibana) from one of our records (redacting a few fields): "\_index": "fluentd-2019.02.25", "\_type": "fluentd", "\_id": "7lARJ2kBLWoRN3y-8Wpv", "\_version": 1, "\_score": null, "\_source": { "PRIORITY": "6", "\_PID": "62984", "\_UID": "0", "\_GID": "0", "\_COMM": "dockerd-current", "\_EXE": "/usr/bin/dockerd-current", "\_CMDLINE": "blah blah cmdline", "\_CAP\_EFFECTIVE": "1fffffffff", "\_SYSTEMD\_CGROUP": "/system.slice/docker.service", "\_SYSTEMD\_UNIT": "docker.service", "\_SYSTEMD\_SLICE": "system.slice", "\_BOOT\_ID": "a4a22bc8790b4ad1a666e4446f60cc06", "\_MACHINE\_ID": "955d8fb4b61d4db3ad878e45e9008bcc", "\_HOSTNAME": "[blahblah.com](http://blahblah.com)", "CONTAINER\_ID": "fd1f537b429f", "CONTAINER\_ID\_FULL": "fd1f537b429fb51eca428b60334c93689029b7ed24bbf471f2999b62d013353f", "CONTAINER\_NAME": "blah-blah-container-name", "CONTAINER\_TAG": "", "\_TRANSPORT": "journal", "\_SELINUX\_CONTEXT": "system\_u:system\_r:container\_runtime\_t:s0", "MESSAGE": "{\"@timestamp\":\"2019-02-25T15:50:43.046-08:00\",\"msg":\"Clearing decision cache\",\"logger\_name\":\"com.blahblah.fraud\_analysis.cache.DecisionCacheHolder\",\"thread\_name\":\"scheduling-1\",\"level\":\"INFO\",\"level\_value\":20000,\"traceId\":\"2181d65dcf43ebbe\",\"spanId\":\"2181d65dcf43ebbe\",\"spanExportable\":\"true\",\"app\":\"siftscience\"}", "\_SOURCE\_REALTIME\_TIMESTAMP": "1551138643047036", "name\_prefix": "k8s", "container\_name": "sift-science-30162-ce2b1acd", "pod\_name": "sift-science-30162-ce2b1acd-1-z4g36", "namespace": "sift-science", "@timestamp": "2019-02-25T15:50:43.046-08:00", "msg": "Clearing decision cache", "logger\_name": "com.blahblah.fraud\_analysis.cache.DecisionCacheHolder", "thread\_name": "scheduling-1", "level": "INFO", "level\_value": 20000, "traceId": "2181d65dcf43ebbe", "spanId": "2181d65dcf43ebbe", "spanExportable": "true", "app": "siftscience", "syzygy": "syzygy44" } Attaching what I see in the logs module: ![image](https://us1.discourse-cdn.com/elastic/original/3X/6/e/6ec2b85d4e7bd800aa8ddad82b06566120b13eca.png) ---
**Author:** ![Kerry](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/kerry/32/40330_2.png) [@Kerry](https://discuss.elastic.co/u/Kerry)\ **Post date:** [February 26, 2019, 12:53pm UTC](https://discuss.elastic.co/t/setting-up-logs-functionality-with-fluentd/169923/2 "2019-02-26T12:53:36Z")
Hi @Erik_Tribou, The `xpack.infra.sources.default.fields.message` configuration option is broken at present. Currently, the UI uses a heuristic to attempt to generate the log message for a number of known Filebeat modules. After this we fallback to the `message` and `@message` fields of the document. If you ingest your logs with a `message` or `@message` field you should see your logs in the Logs UI. You _might_ be able to[setup a field alias](https://www.elastic.co/guide/en/elasticsearch/reference/6.5/alias.html) for this if that's an easier route. In 6.5 this is only possible if the index uses the setting `index.mapping.single_type: true`. Apologies for this, we are looking to extend configuration of the Logs UI in the future. ---
**Author:** ![Erik\_Tribou](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/erik_tribou/32/40998_2.png) [@Erik\_Tribou](https://discuss.elastic.co/u/Erik_Tribou)\ **Post date:** [February 26, 2019, 10:23pm UTC](https://discuss.elastic.co/t/setting-up-logs-functionality-with-fluentd/169923/3 "2019-02-26T22:23:05Z")
@Kerry, Thank you for letting me know that the configuration option does not work. I tried removing the xpack.infra.sources.default.fields.message parameter from my kibana.yml and creating aliases with the names message and @message (pointing to our real message fields), but had the same result. I could search on the aliases in the discover module but nothing ever showed in logs (except the graph on the side for the number of messages). The Logs module isn't critical to us, so I think we'll just try again after a couple more releases when hopefully the configuration option will work as documented. ---
**Author:** ![Mary92](https://avatars.discourse-cdn.com/v4/letter/m/85e7bf/32.png) [@Mary92](https://discuss.elastic.co/u/Mary92)\ **Post date:** [March 23, 2019, 9:22am UTC](https://discuss.elastic.co/t/setting-up-logs-functionality-with-fluentd/169923/4 "2019-03-23T09:22:34Z")
> [@Kerry](#): > > Hi @Erik_Tribou, > > The `xpack.infra.sources.default.fields.message` configuration option is broken at present. > > Currently, the UI uses a heuristic to attempt to generate the log message for a number of known Filebeat modules. After this we fallback to the `message` and `@message` fields of the document. [kissanime](https://www.kissanime.vip/) > > If you ingest your logs with a `message` or `@message` field you should see your logs in the Logs UI. > > You _might_ be able to[setup a field alias for this if that's an easier route. In 6.5 this is only possible if the index uses the setting `index.mapping.single_type: true`. > > Apologies for this, we are looking to extend configuration of the Logs UI in the future. Thank you so much for this post.. ---
**Author:** ![mluto](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mluto/32/43395_2.png) [@mluto](https://discuss.elastic.co/u/mluto)\ **Post date:** [April 3, 2019, 1:07pm UTC](https://discuss.elastic.co/t/setting-up-logs-functionality-with-fluentd/169923/5 "2019-04-03T13:07:45Z")
there seems to be a fix in [#32502](https://github.com/elastic/kibana/pull/32502) 🙂 thanks, elastic! ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [May 1, 2019, 1:07pm UTC](https://discuss.elastic.co/t/setting-up-logs-functionality-with-fluentd/169923/6 "2019-05-01T13:07:48Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.