# Troubleshooting Log Ingestion: Syslog and Windows Event Logs (Winlogbeat/Sidecar) not appearing in Search **URL:** \ **Category:** Graylog Central (peer support)\ **Tags:** access-specific-log-\ **Created:** [May 23, 2026, 3:56am UTC](https://community.graylog.org/t/troubleshooting-log-ingestion-syslog-and-windows-event-logs-winlogbeat-sidecar-not-appearing-in-search/37318 "2026-05-23T03:56:44Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![ahnaf702](https://avatars.discourse-cdn.com/v4/letter/a/59ef9b/32.png) [@ahnaf702](https://community.graylog.org/u/ahnaf702)\ **Post date:** [May 23, 2026, 3:56am UTC](https://community.graylog.org/t/troubleshooting-log-ingestion-syslog-and-windows-event-logs-winlogbeat-sidecar-not-appearing-in-search/37318/1 "2026-05-23T03:56:44Z")
**Hi Graylog Community Team,** I am experiencing an issue where my Graylog server is not successfully ingesting or displaying forwarded logs. I am currently trying to set up two parallel ingestion streams: Syslog for network devices and Windows Event Logs via Winlogbeat and the Graylog Sidecar. **Environment Details:** - **OS:** Ubuntu 22.04.5 LTS - **Graylog Version:** 4.3.15 - **Elasticsearch:** 6.8.23 - **MongoDB:** 4.4.30 **Current Symptoms:** Neither the Syslog data nor the Windows Event Logs are populating in the Search interface. The Windows Sidecar service is installed and running, and the Syslog forwarders are active, but the data is either being dropped or not correctly parsed by the inputs. **Troubleshooting Steps Already Completed:** 1. **Service Bindings:** Confirmed via `ss -lptn` that the web interface is successfully bound to `0.0.0.0:9000` and Elasticsearch is correctly restricted to `127.0.0.1`. 2. **Input Configuration:** Created global inputs in the UI (Beats on port 5044 and Syslog TCP/UDP). The inputs show a “RUNNING” state. 3. **Firewall:** Verified that the specific ingestion ports (5044, 514/1514) are open through UFW on the Ubuntu host. 4. **Time Synchronization:** Installed and configured `chrony`. Verified via `chronyc tracking` that the system time is perfectly synced (`Leap status: Normal`) with zero significant offset, so logs are not being dropped due to future/past timestamp rejections. 5. **Sidecar Configuration:** The Windows Sidecar is using the correct API token and pointing to the `/api` endpoint. Could you please advise on the best way to trace these packets once they hit the Ubuntu server to determine if the blockage is happening at the Beats/Syslog input layer, or if Elasticsearch is rejecting the indices? Thank you, Ahnaf Tahmeed ---
**Author:** ![Joel\_Duffield](https://avatars.discourse-cdn.com/v4/letter/j/71c47a/32.png) [@Joel\_Duffield](https://community.graylog.org/u/Joel_Duffield)\ **Post date:** [May 23, 2026, 12:00pm UTC](https://community.graylog.org/t/troubleshooting-log-ingestion-syslog-and-windows-event-logs-winlogbeat-sidecar-not-appearing-in-search/37318/2 "2026-05-23T12:00:03Z")
On the input page do you see any traffic being reported on each input, connections etc? ---
**Author:** ![ahnaf702](https://avatars.discourse-cdn.com/v4/letter/a/59ef9b/32.png) [@ahnaf702](https://community.graylog.org/u/ahnaf702)\ **Post date:** [May 23, 2026, 1:55pm UTC](https://community.graylog.org/t/troubleshooting-log-ingestion-syslog-and-windows-event-logs-winlogbeat-sidecar-not-appearing-in-search/37318/3 "2026-05-23T13:55:23Z")
yes only 6kib but i cannot see in search or in dashboard ---
**Author:** ![Joel\_Duffield](https://avatars.discourse-cdn.com/v4/letter/j/71c47a/32.png) [@Joel\_Duffield](https://community.graylog.org/u/Joel_Duffield)\ **Post date:** [May 23, 2026, 2:15pm UTC](https://community.graylog.org/t/troubleshooting-log-ingestion-syslog-and-windows-event-logs-winlogbeat-sidecar-not-appearing-in-search/37318/4 "2026-05-23T14:15:11Z")
You should see way way more than that, so the problem is the data getting to your graylog in the first place. Are you sure the syslog is udp vs tcp and that you have used the correct input type to match? Does your sidecard winlogbeat configuration point to your graylog server on the right address? ---
**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\ **Post date:** [June 6, 2026, 2:16pm UTC](https://community.graylog.org/t/troubleshooting-log-ingestion-syslog-and-windows-event-logs-winlogbeat-sidecar-not-appearing-in-search/37318/5 "2026-06-06T14:16:05Z")
This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.