# Zeek Dashboard No Results Found in Query **URL:** \ **Category:** Kibana\ **Created:** [August 2, 2020, 2:50pm UTC](https://discuss.elastic.co/t/zeek-dashboard-no-results-found-in-query/243463 "2020-08-02T14:50:30Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![georgef](https://avatars.discourse-cdn.com/v4/letter/g/77aa72/32.png) [@georgef](https://discuss.elastic.co/u/georgef)\ **Post date:** [August 2, 2020, 2:50pm UTC](https://discuss.elastic.co/t/zeek-dashboard-no-results-found-in-query/243463/1 "2020-08-02T14:50:30Z")
Hi Everyone, ELK newb here. I do not have data appearing in the Filebeat Zeek Dashboard. I have two servers in a lab environment both running Ubuntu 18.04. The first server is running Zeek and Filebeat with Zeek module enabled. The second server is running Elasticsearch and Kibana. I'm running the newest version of Elasticsearch, 7.8.1. I have been following the walkthroughs for installing Elasticsearch, Kibana, and Filebeat, so I don't believe I have anything out of the ordinary in my configurations. I have Zeek logs showing up in Logs and Discovery. See screenshot for sample log. ![Discover Sample DNS Log](https://us1.discourse-cdn.com/elastic/original/3X/0/a/0a13cb14bb959a41f2a7a8182b2748ddceb72c84.png) However, they are not showing in the Dashboards. After inspecting the Visualization, it appears the logs are showing up (Hits (total)), but are not being returned by the query (Hits). See attached screenshot. ![Top DNS Domains Filebeat Zeek](https://us1.discourse-cdn.com/elastic/original/3X/8/0/80e3cfd3c433c25bee15e71515005dba2c91be72.png) Also, if I take the query request (zeek.dns.query) and put it in Discovery, nothing is returned. ![Top DNS Domains Filebeat Zeek Query Request](https://us1.discourse-cdn.com/elastic/original/3X/5/2/52a55767a9f9b41205393b13ef1486aadc10a46f.png) I've rebuilt the lab twice and tried expanding the time, but results are the same. I feel like I'm missing something in the mapping between the logs and the query. Please let me know what else I can provide. Your guidance and recommendations are greatly appreciated. Thanks, George ---
**Author:** ![nickpeihl](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nickpeihl/32/112622_2.png) [@nickpeihl](https://discuss.elastic.co/u/nickpeihl)\ **Post date:** [August 3, 2020, 8:42pm UTC](https://discuss.elastic.co/t/zeek-dashboard-no-results-found-in-query/243463/2 "2020-08-03T20:42:53Z")
hi @georgef. What version of Zeek are you running? The [Zeek module for Filebeat](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-zeek.html) was developed against Zeek 2.6.1. There may have been breaking changes in Zeek 3+ that aren't supported by this module (and the dashboards) yet. ---
**Author:** ![georgef](https://avatars.discourse-cdn.com/v4/letter/g/77aa72/32.png) [@georgef](https://discuss.elastic.co/u/georgef)\ **Post date:** [August 5, 2020, 11:22pm UTC](https://discuss.elastic.co/t/zeek-dashboard-no-results-found-in-query/243463/3 "2020-08-05T23:22:26Z")
Thank you, Nick. I definitely did not use that version of Zeek. Thank you. ---
**Author:** ![nickpeihl](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nickpeihl/32/112622_2.png) [@nickpeihl](https://discuss.elastic.co/u/nickpeihl)\ **Post date:** [August 13, 2020, 4:53pm UTC](https://discuss.elastic.co/t/zeek-dashboard-no-results-found-in-query/243463/4 "2020-08-13T16:53:23Z")
Hi George. I just saw this blog post that also goes into more detail on using Zeek. Hope it helps. [https://www.elastic.co/blog/collecting-and-analyzing-zeek-data-with-elastic-security](https://www.elastic.co/blog/collecting-and-analyzing-zeek-data-with-elastic-security) ---
**Author:** ![georgef](https://avatars.discourse-cdn.com/v4/letter/g/77aa72/32.png) [@georgef](https://discuss.elastic.co/u/georgef)\ **Post date:** [August 18, 2020, 11:43am UTC](https://discuss.elastic.co/t/zeek-dashboard-no-results-found-in-query/243463/5 "2020-08-18T11:43:32Z")
Hi Nick, Thanks for passing the blog to me. That was the fix: enter zeek log path in zeek.yml file, as opposed to filebeat.yml file. It's working well installed on 7.8.1 with Zeek 3.2.0. Thanks again, George ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [September 15, 2020, 11:43am UTC](https://discuss.elastic.co/t/zeek-dashboard-no-results-found-in-query/243463/6 "2020-09-15T11:43:38Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.