diff --git a/x-pack/legacy/plugins/monitoring/public/components/logs/__snapshots__/reason.test.js.snap b/x-pack/legacy/plugins/monitoring/public/components/logs/__snapshots__/reason.test.js.snap
index cd317dee65c33..de4b888a48545 100644
--- a/x-pack/legacy/plugins/monitoring/public/components/logs/__snapshots__/reason.test.js.snap
+++ b/x-pack/legacy/plugins/monitoring/public/components/logs/__snapshots__/reason.test.js.snap
@@ -67,7 +67,7 @@ exports[`Logs should render with a no cluster found reason 1`] = `
       values={
         Object {
           "link": <ForwardRef
-            href="https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-installation.html"
+            href="https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-elasticsearch.html"
             target="_blank"
           >
             setup
@@ -92,7 +92,7 @@ exports[`Logs should render with a no index found reason 1`] = `
       values={
         Object {
           "link": <ForwardRef
-            href="https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-installation.html"
+            href="https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-elasticsearch.html"
             target="_blank"
           >
             setup
@@ -142,7 +142,7 @@ exports[`Logs should render with a no node found reason 1`] = `
       values={
         Object {
           "link": <ForwardRef
-            href="https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-installation.html"
+            href="https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-elasticsearch.html"
             target="_blank"
           >
             setup
@@ -154,6 +154,34 @@ exports[`Logs should render with a no node found reason 1`] = `
 </EuiCallOut>
 `;
 
+exports[`Logs should render with a no structured logs reason 1`] = `
+<EuiCallOut
+  color="warning"
+  iconType="help"
+  title="No structured logs found"
+>
+  <p>
+    <FormattedMessage
+      defaultMessage="Check if the {varPaths} setting {link}."
+      id="xpack.monitoring.logs.reason.notUsingStructuredLogsMessage"
+      values={
+        Object {
+          "link": <ForwardRef
+            href="https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-elasticsearch.html"
+            target="_blank"
+          >
+            points to JSON logs
+          </ForwardRef>,
+          "varPaths": <Monospace>
+            var.paths
+          </Monospace>,
+        }
+      }
+    />
+  </p>
+</EuiCallOut>
+`;
+
 exports[`Logs should render with a no type found reason 1`] = `
 <EuiCallOut
   color="warning"
diff --git a/x-pack/legacy/plugins/monitoring/public/components/logs/reason.js b/x-pack/legacy/plugins/monitoring/public/components/logs/reason.js
index 098f2a79a3782..91c62ae53a1ca 100644
--- a/x-pack/legacy/plugins/monitoring/public/components/logs/reason.js
+++ b/x-pack/legacy/plugins/monitoring/public/components/logs/reason.js
@@ -9,6 +9,7 @@ import { EuiCallOut, EuiLink } from '@elastic/eui';
 import { i18n } from '@kbn/i18n';
 import { FormattedMessage } from '@kbn/i18n/react';
 import { ELASTIC_WEBSITE_URL, DOC_LINK_VERSION } from 'ui/documentation_links';
+import { Monospace } from '../metricbeat_migration/instruction_steps/components/monospace/monospace';
 
 export const Reason = ({ reason }) => {
   let title = i18n.translate('xpack.monitoring.logs.reason.defaultTitle', {
@@ -91,6 +92,29 @@ export const Reason = ({ reason }) => {
         }}
       />
     );
+  } else if (false === reason.usingStructuredLogs) {
+    title = i18n.translate('xpack.monitoring.logs.reason.notUsingStructuredLogsTitle', {
+      defaultMessage: 'No structured logs found',
+    });
+    message = (
+      <FormattedMessage
+        id="xpack.monitoring.logs.reason.notUsingStructuredLogsMessage"
+        defaultMessage="Check if the {varPaths} setting {link}."
+        values={{
+          varPaths: <Monospace>var.paths</Monospace>,
+          link: (
+            <EuiLink
+              target="_blank"
+              href={`${ELASTIC_WEBSITE_URL}guide/en/beats/filebeat/${DOC_LINK_VERSION}/filebeat-module-elasticsearch.html`}
+            >
+              {i18n.translate('xpack.monitoring.logs.reason.notUsingStructuredLogsLink', {
+                defaultMessage: 'points to JSON logs',
+              })}
+            </EuiLink>
+          ),
+        }}
+      />
+    );
   } else if (false === reason.clusterExists) {
     title = i18n.translate('xpack.monitoring.logs.reason.noClusterTitle', {
       defaultMessage: 'No logs for this cluster',
@@ -103,7 +127,7 @@ export const Reason = ({ reason }) => {
           link: (
             <EuiLink
               target="_blank"
-              href={`${ELASTIC_WEBSITE_URL}guide/en/beats/filebeat/${DOC_LINK_VERSION}/filebeat-installation.html`}
+              href={`${ELASTIC_WEBSITE_URL}guide/en/beats/filebeat/${DOC_LINK_VERSION}/filebeat-module-elasticsearch.html`}
             >
               {i18n.translate('xpack.monitoring.logs.reason.noClusterLink', {
                 defaultMessage: 'setup',
@@ -125,7 +149,7 @@ export const Reason = ({ reason }) => {
           link: (
             <EuiLink
               target="_blank"
-              href={`${ELASTIC_WEBSITE_URL}guide/en/beats/filebeat/${DOC_LINK_VERSION}/filebeat-installation.html`}
+              href={`${ELASTIC_WEBSITE_URL}guide/en/beats/filebeat/${DOC_LINK_VERSION}/filebeat-module-elasticsearch.html`}
             >
               {i18n.translate('xpack.monitoring.logs.reason.noNodeLink', {
                 defaultMessage: 'setup',
@@ -147,7 +171,7 @@ export const Reason = ({ reason }) => {
           link: (
             <EuiLink
               target="_blank"
-              href={`${ELASTIC_WEBSITE_URL}guide/en/beats/filebeat/${DOC_LINK_VERSION}/filebeat-installation.html`}
+              href={`${ELASTIC_WEBSITE_URL}guide/en/beats/filebeat/${DOC_LINK_VERSION}/filebeat-module-elasticsearch.html`}
             >
               {i18n.translate('xpack.monitoring.logs.reason.noIndexLink', {
                 defaultMessage: 'setup',
diff --git a/x-pack/legacy/plugins/monitoring/public/components/logs/reason.test.js b/x-pack/legacy/plugins/monitoring/public/components/logs/reason.test.js
index 2957de26f7189..c8ed05bd73ade 100644
--- a/x-pack/legacy/plugins/monitoring/public/components/logs/reason.test.js
+++ b/x-pack/legacy/plugins/monitoring/public/components/logs/reason.test.js
@@ -29,6 +29,13 @@ describe('Logs', () => {
     expect(component).toMatchSnapshot();
   });
 
+  it('should render with a no structured logs reason', () => {
+    const component = shallow(
+      <Reason reason={{ indexPatternExists: true, typeExists: true, usingStructuredLogs: false }} />
+    );
+    expect(component).toMatchSnapshot();
+  });
+
   it('should render with a no cluster found reason', () => {
     const component = shallow(
       <Reason reason={{ indexPatternExists: true, typeExists: true, clusterExists: false }} />
diff --git a/x-pack/legacy/plugins/monitoring/server/lib/logs/detect_reason.js b/x-pack/legacy/plugins/monitoring/server/lib/logs/detect_reason.js
index 16bd9d506dd0f..b3b835d6ba987 100644
--- a/x-pack/legacy/plugins/monitoring/server/lib/logs/detect_reason.js
+++ b/x-pack/legacy/plugins/monitoring/server/lib/logs/detect_reason.js
@@ -16,6 +16,7 @@ async function doesFilebeatIndexExist(
   const filter = [createTimeFilter({ start, end, metric })];
 
   const typeFilter = { term: { 'service.type': 'elasticsearch' } };
+  const structuredLogsFilter = { exists: { field: 'elasticsearch.cluster' } };
   const clusterFilter = { term: { 'elasticsearch.cluster.uuid': clusterUuid } };
   const nodeFilter = { term: { 'elasticsearch.node.id': nodeUuid } };
   const indexFilter = { term: { 'elasticsearch.index.name': indexUuid } };
@@ -44,6 +45,14 @@ async function doesFilebeatIndexExist(
     },
   };
 
+  const usingStructuredLogsQuery = {
+    query: {
+      bool: {
+        filter: [...filter, typeFilter, structuredLogsFilter],
+      },
+    },
+  };
+
   const clusterExistsQuery = {
     query: {
       bool: {
@@ -81,6 +90,8 @@ async function doesFilebeatIndexExist(
     { ...defaultParams, ...typeExistsAtAnyTimeQuery },
     { index: filebeatIndexPattern },
     { ...defaultParams, ...typeExistsQuery },
+    { index: filebeatIndexPattern },
+    { ...defaultParams, ...usingStructuredLogsQuery },
   ];
 
   if (clusterUuid) {
@@ -102,6 +113,7 @@ async function doesFilebeatIndexExist(
       indexPatternExistsInTimeRangeResponse,
       typeExistsAtAnyTimeResponse,
       typeExistsResponse,
+      usingStructuredLogsResponse,
       clusterExistsResponse,
       nodeExistsResponse,
       indexExistsResponse,
@@ -114,6 +126,7 @@ async function doesFilebeatIndexExist(
       get(indexPatternExistsInTimeRangeResponse, 'hits.total.value', 0) > 0,
     typeExistsAtAnyTime: get(typeExistsAtAnyTimeResponse, 'hits.total.value', 0) > 0,
     typeExists: get(typeExistsResponse, 'hits.total.value', 0) > 0,
+    usingStructuredLogs: get(usingStructuredLogsResponse, 'hits.total.value', 0) > 0,
     clusterExists: clusterUuid ? get(clusterExistsResponse, 'hits.total.value', 0) > 0 : null,
     nodeExists: nodeUuid ? get(nodeExistsResponse, 'hits.total.value', 0) > 0 : null,
     indexExists: indexUuid ? get(indexExistsResponse, 'hits.total.value', 0) > 0 : null,
diff --git a/x-pack/test/api_integration/apis/monitoring/cluster/fixtures/overview.json b/x-pack/test/api_integration/apis/monitoring/cluster/fixtures/overview.json
index be87c3458453c..49e80b244f760 100644
--- a/x-pack/test/api_integration/apis/monitoring/cluster/fixtures/overview.json
+++ b/x-pack/test/api_integration/apis/monitoring/cluster/fixtures/overview.json
@@ -69,7 +69,8 @@
         "nodeExists": null,
         "indexExists": null,
         "typeExists": false,
-        "typeExistsAtAnyTime": false
+        "typeExistsAtAnyTime": false,
+        "usingStructuredLogs": false
       },
       "types": []
     }
diff --git a/x-pack/test/api_integration/apis/monitoring/elasticsearch/fixtures/index_detail.json b/x-pack/test/api_integration/apis/monitoring/elasticsearch/fixtures/index_detail.json
index 7aee56e697d9e..04d56d5949d2c 100644
--- a/x-pack/test/api_integration/apis/monitoring/elasticsearch/fixtures/index_detail.json
+++ b/x-pack/test/api_integration/apis/monitoring/elasticsearch/fixtures/index_detail.json
@@ -17,6 +17,7 @@
       "indexPatternExists": false,
       "indexPatternInTimeRangeExists": false,
       "typeExistsAtAnyTime": false,
+      "usingStructuredLogs": false,
       "nodeExists": null,
       "indexExists": false,
       "typeExists": false
diff --git a/x-pack/test/api_integration/apis/monitoring/elasticsearch/fixtures/node_detail.json b/x-pack/test/api_integration/apis/monitoring/elasticsearch/fixtures/node_detail.json
index c2ee3a818fe14..0b8d26558e7fc 100644
--- a/x-pack/test/api_integration/apis/monitoring/elasticsearch/fixtures/node_detail.json
+++ b/x-pack/test/api_integration/apis/monitoring/elasticsearch/fixtures/node_detail.json
@@ -18,6 +18,7 @@
       "indexPatternExists": false,
       "indexPatternInTimeRangeExists": false,
       "typeExistsAtAnyTime": false,
+      "usingStructuredLogs": false,
       "nodeExists": false,
       "indexExists": null,
       "typeExists": false
diff --git a/x-pack/test/api_integration/apis/monitoring/elasticsearch/fixtures/overview_green_platinum.json b/x-pack/test/api_integration/apis/monitoring/elasticsearch/fixtures/overview_green_platinum.json
index 8f9b427d4466b..9dd55cdd27ede 100644
--- a/x-pack/test/api_integration/apis/monitoring/elasticsearch/fixtures/overview_green_platinum.json
+++ b/x-pack/test/api_integration/apis/monitoring/elasticsearch/fixtures/overview_green_platinum.json
@@ -5757,6 +5757,7 @@
       "indexPatternExists": false,
       "indexPatternInTimeRangeExists": false,
       "typeExistsAtAnyTime": false,
+      "usingStructuredLogs": false,
       "nodeExists": null,
       "indexExists": null,
       "typeExists": false
diff --git a/x-pack/test/api_integration/apis/monitoring/elasticsearch/fixtures/overview_red_platinum.json b/x-pack/test/api_integration/apis/monitoring/elasticsearch/fixtures/overview_red_platinum.json
index 8a9405abda817..45f2a7e6581f9 100644
--- a/x-pack/test/api_integration/apis/monitoring/elasticsearch/fixtures/overview_red_platinum.json
+++ b/x-pack/test/api_integration/apis/monitoring/elasticsearch/fixtures/overview_red_platinum.json
@@ -22,6 +22,7 @@
       "indexPatternExists": false,
       "indexPatternInTimeRangeExists": false,
       "typeExistsAtAnyTime": false,
+      "usingStructuredLogs": false,
       "nodeExists": null,
       "indexExists": null,
       "typeExists": false
diff --git a/x-pack/test/api_integration/apis/monitoring/elasticsearch/fixtures/overview_shards_relocating.json b/x-pack/test/api_integration/apis/monitoring/elasticsearch/fixtures/overview_shards_relocating.json
index 9c340ffb4cd50..415ef5c589c1f 100644
--- a/x-pack/test/api_integration/apis/monitoring/elasticsearch/fixtures/overview_shards_relocating.json
+++ b/x-pack/test/api_integration/apis/monitoring/elasticsearch/fixtures/overview_shards_relocating.json
@@ -22,6 +22,7 @@
       "indexPatternExists": false,
       "indexPatternInTimeRangeExists": false,
       "typeExistsAtAnyTime": false,
+      "usingStructuredLogs": false,
       "nodeExists": null,
       "indexExists": null,
       "typeExists": false
diff --git a/x-pack/test/api_integration/apis/monitoring/logs/fixtures/multiple_clusters.json b/x-pack/test/api_integration/apis/monitoring/logs/fixtures/multiple_clusters.json
index 37afc6acec076..442f9cb38ae33 100644
--- a/x-pack/test/api_integration/apis/monitoring/logs/fixtures/multiple_clusters.json
+++ b/x-pack/test/api_integration/apis/monitoring/logs/fixtures/multiple_clusters.json
@@ -5,6 +5,7 @@
     "indexPatternExists": true,
     "indexPatternInTimeRangeExists": true,
     "typeExistsAtAnyTime": true,
+    "usingStructuredLogs": true,
     "typeExists": true,
     "clusterExists": false,
     "nodeExists": null,
diff --git a/x-pack/test/api_integration/apis/monitoring/standalone_cluster/fixtures/cluster.json b/x-pack/test/api_integration/apis/monitoring/standalone_cluster/fixtures/cluster.json
index ae61d289fe338..802bd0c7fcd74 100644
--- a/x-pack/test/api_integration/apis/monitoring/standalone_cluster/fixtures/cluster.json
+++ b/x-pack/test/api_integration/apis/monitoring/standalone_cluster/fixtures/cluster.json
@@ -16,6 +16,7 @@
         "indexPatternExists": false,
         "indexPatternInTimeRangeExists": false,
         "typeExistsAtAnyTime": false,
+        "usingStructuredLogs": false,
         "nodeExists": null,
         "indexExists": null,
         "typeExists": false