# Where is the filebeat event log? **URL:** \ **Category:** Beats\ **Tags:** docker\ **Created:** [December 10, 2024, 8:45pm UTC](https://discuss.elastic.co/t/where-is-the-filebeat-event-log/371789 "2024-12-10T20:45:41Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![helloworld4](https://avatars.discourse-cdn.com/v4/letter/h/ea5d25/32.png) [@helloworld4](https://discuss.elastic.co/u/helloworld4)\ **Post date:** [December 10, 2024, 8:45pm UTC](https://discuss.elastic.co/t/where-is-the-filebeat-event-log/371789/1 "2024-12-10T20:45:41Z")
I'm getting this error when some log lines are sent to ES by filebeat: `"message":"Cannot index event (status=400): dropping event! Look at the event log to view the event and cause."` Where can I find that event log? I've looked at the ES pod logs and I've looked for logs named `*event*log` in the filebeat pod (no matches). So far I haven't found anything. I'm not sure where else to look. I'm using the docker image `docker.elastic.co/beats/filebeat:8.15.0`. ---
**Author:** ![strawgate](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/strawgate/32/131008_2.png) [@strawgate](https://discuss.elastic.co/u/strawgate)\ **Post date:** [December 11, 2024, 3:10am UTC](https://discuss.elastic.co/t/where-is-the-filebeat-event-log/371789/2 "2024-12-11T03:10:03Z")
> [@helloworld4](#): > > Look at the event log to view the event and cause The configuration for the event\_data logger is available here: [Configure logging | Filebeat Reference [8.16] | Elastic](https://www.elastic.co/guide/en/beats/filebeat/current/configuration-logging.html#_configuration_options_for_event_data_logger) The default file name is `filebeat-event-data` with some id for rollover and an extension of `.ndjson` and should log to `{beat_home}\logs` which should be something like `\usr\share\filebeat\logs\filebeat-event-data` in a container. ---
**Author:** ![helloworld4](https://avatars.discourse-cdn.com/v4/letter/h/ea5d25/32.png) [@helloworld4](https://discuss.elastic.co/u/helloworld4)\ **Post date:** [December 11, 2024, 3:18pm UTC](https://discuss.elastic.co/t/where-is-the-filebeat-event-log/371789/3 "2024-12-11T15:18:03Z")
Thank you! I don't think I ever would have found that on my own. ---
**Author:** ![strawgate](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/strawgate/32/131008_2.png) [@strawgate](https://discuss.elastic.co/u/strawgate)\ **Post date:** [December 11, 2024, 3:41pm UTC](https://discuss.elastic.co/t/where-is-the-filebeat-event-log/371789/4 "2024-12-11T15:41:33Z")
It's pretty new (and pretty cool) but there's very little content online where people in the forums or github discuss it. Hopefully future people with this question (and our LLM-based AI overlords) will stumble upon this thread and get back on their way! I'll also file an issue to see if maybe we can include the event\_data path in the log message: [Beat Check Event\_log message could include the path to the event\_log · Issue #41991 · elastic/beats · GitHub](https://github.com/elastic/beats/issues/41991) ---
**Author:** ![Nicoletta](https://avatars.discourse-cdn.com/v4/letter/n/e9bcb4/32.png) [@Nicoletta](https://discuss.elastic.co/u/Nicoletta)\ **Post date:** [January 24, 2025, 2:46pm UTC](https://discuss.elastic.co/t/where-is-the-filebeat-event-log/371789/5 "2025-01-24T14:46:05Z")
Hi, how do you expect to read these event log file in a containerized filebeat? Is there a setting available to redirect these logs to std output (so that we can check logs directly with kubectl)? Or do we have to read the events logs inside the container? Thanks, Nicoletta ---
**Author:** ![strawgate](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/strawgate/32/131008_2.png) [@strawgate](https://discuss.elastic.co/u/strawgate)\ **Post date:** [January 24, 2025, 7:46pm UTC](https://discuss.elastic.co/t/where-is-the-filebeat-event-log/371789/6 "2025-01-24T19:46:34Z")
event\_data should only be needed during troubleshooting, as they can contain sensitive information, we do not recommend streaming them to stdout