# Begin LogStash
**URL:** https://discuss.elastic.co/t/begin-logstash/146585
**Category:** Logstash
**Created:** [August 29, 2018, 9:14pm UTC](https://discuss.elastic.co/t/begin-logstash/146585 "2018-08-29T21:14:40Z")
**Posts on this page:** 11
**Page:** 1
### Author:  [@marcos.vbp](https://discuss.elastic.co/u/marcos.vbp)
#### Post date: [August 29, 2018, 9:14pm UTC](https://discuss.elastic.co/t/begin-logstash/146585/1 "2018-08-29T21:14:40Z")
Hi All,
I'm starting with logstash, and studying alone.
I was trying to make a simple filter to display in kiban, for example the number of requests that an apache receives, I put two apaches of tests to show in a graph, the number of requests that are receiving, but I can not make a filter to arrive in that counter.
Would you have something to tell me?
with make this setting?
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [August 30, 2018, 6:07am UTC](https://discuss.elastic.co/t/begin-logstash/146585/2 "2018-08-30T06:07:44Z")
What do your logs look like? What does your Logstash configuration look like? Are you seeing _anything_ in Kibana right now? If so, what does it look like?
---
### Author:  [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [August 30, 2018, 6:10am UTC](https://discuss.elastic.co/t/begin-logstash/146585/3 "2018-08-30T06:10:23Z")
Have a look at this [practical introduction to Logstash](https://www.elastic.co/blog/a-practical-introduction-to-logstash), which explains how to use grok and get data into Elasticsearch.
---
### Author:  [@marcos.vbp](https://discuss.elastic.co/u/marcos.vbp)
#### Post date: [August 30, 2018, 1:12pm UTC](https://discuss.elastic.co/t/begin-logstash/146585/4 "2018-08-30T13:12:02Z")
> [@magnusbaeck](#):
>
> What do your logs look like? What does your Logstash configuration look like? Are you seeing _anything_ in Kibana right now? If so, what does it look like?
Records:
172.59.12.211 - - [30/Ago/2018:10:05:41 -0300] "POST /lms HTTP/1.1" 200 435
Setup:
input {
file {
path =\> "/var/log/weblogic/producao/lms01/access.log"
type =\> "weblogic-access-lms01"
start\_position =\> "beginning"
}
filter {
if [type] == "weblogic-access-lms01" {
grok {
match =\> { "message" =\> "%{COMBINEDAPACHELOG}" }
add\_field =\> {"server\_log" =\> "%{type}"}
}
date {
match =\> ["timestamp" , "dd/MMM/yyyy:HH:mm:ss Z"]
}
}
output {
elasticsearch { hosts =\> "localhost:9800"}
}
In kibana , show , but I would like in Kibana grafical number conecction ( request ) in this apache.
---
### Author:  [@marcos.vbp](https://discuss.elastic.co/u/marcos.vbp)
#### Post date: [August 30, 2018, 1:13pm UTC](https://discuss.elastic.co/t/begin-logstash/146585/5 "2018-08-30T13:13:16Z")
Christian I look this , but I could not mount an expression to get the number of connections that this apache receives.
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [August 30, 2018, 1:20pm UTC](https://discuss.elastic.co/t/begin-logstash/146585/6 "2018-08-30T13:20:37Z")
> In kibana , show , but I would like in Kibana grafical number conecction ( request ) in this apache.
The default Discover view shows a histogram of events per unit of time so that sounds like what you want. You just need to filter out any events that aren't HTTP from this particular server. How that can be done depends on what your events look like. That's why I asked for that last time.
---
### Author:  [@marcos.vbp](https://discuss.elastic.co/u/marcos.vbp)
#### Post date: [August 30, 2018, 2:18pm UTC](https://discuss.elastic.co/t/begin-logstash/146585/7 "2018-08-30T14:18:36Z")
> [@magnusbaeck](#):
>
> The default Discover view shows a histogram of events per unit of time so that sounds like what you want. You just need to filter out any events that aren't HTTP from this particular server. How that can be done depends on what your events look like. That's why I asked for that last time.
Ok , tks for y help. I try change the filter and find information.
---
### Author:  [@marcos.vbp](https://discuss.elastic.co/u/marcos.vbp)
#### Post date: [August 30, 2018, 7:57pm UTC](https://discuss.elastic.co/t/begin-logstash/146585/8 "2018-08-30T19:57:34Z")
Hi again
need help here now
problem in extract date , try any exemples and same error
---
### Author:  [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [August 30, 2018, 8:26pm UTC](https://discuss.elastic.co/t/begin-logstash/146585/9 "2018-08-30T20:26:10Z")
The `timestamp` pattern does not have a closing brace. Start from the beginning and build out from there step by step. That is the easiest way to catch mistakes.
---
### Author:  [@marcos.vbp](https://discuss.elastic.co/u/marcos.vbp)
#### Post date: [August 30, 2018, 9:05pm UTC](https://discuss.elastic.co/t/begin-logstash/146585/10 "2018-08-30T21:05:07Z")
> [@Christian\_Dahlqvist](#):
>
> The `timestamp` pattern does not have a closing brace. Start from the beginning and build out from there step by step. That is the easiest way to catch mistakes.
I'm running step by step, field by field. from start to finish.
That's how it works. % {IP: client\_adress}% {SPACE} -% {SPACE} -% {GREEDYDATA: remainder}
Next step is to add the httd data.
% {IP: client\_adress}% {SPACE} -% {SPACE} - \ [% {HTTPDATE: timestamp}]% {GREEDYDATA: remainder}.
But I tried in different ways and none of them.
So I asked if there is any way to get the date as I need it.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 27, 2018, 9:05pm UTC](https://discuss.elastic.co/t/begin-logstash/146585/11 "2018-09-27T21:05:16Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.