# Best practices for "debugging" and problem solving logstash problems

**URL:** <https://discuss.elastic.co/t/best-practices-for-debugging-and-problem-solving-logstash-problems/121154>\
**Category:** Logstash\
**Created:** [February 23, 2018, 3:23am UTC](https://discuss.elastic.co/t/best-practices-for-debugging-and-problem-solving-logstash-problems/121154 "2018-02-23T03:23:44Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![digirave](https://avatars.discourse-cdn.com/v4/letter/d/85e7bf/32.png) [@digirave](https://discuss.elastic.co/u/digirave)\
**Post date:** [February 23, 2018, 3:23am UTC](https://discuss.elastic.co/t/best-practices-for-debugging-and-problem-solving-logstash-problems/121154/1 "2018-02-23T03:23:45Z")

</div>

Hello,  
I'm new to logstash and testing  
filebeat -\> logstash -\> elasticsearch -\> kibana  
for viewing log data.

I have managed to use logstash to parse and format log formats,  
but I am worried that some log lines may be in a format that I did not consider and my parser will miss and not store in elasticsearch.

1. 

How can I find out if some of my log lines are not matching and not processed with the grok patterns I am using?

1. 

If the mapping of the some log data and elasticsearch doesn't match, how would I find out and view or log such errors?

1. 

I noticed the --debug command line option gives more information.  
What is the --debug equivalent in logstash.yml?

1. 

Other than the --debug command line option, logs stored by logstash in /var/log/\* what other useful tips for debugging and problem solving can you suggest?

Thank you.

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [February 23, 2018, 7:10am UTC](https://discuss.elastic.co/t/best-practices-for-debugging-and-problem-solving-logstash-problems/121154/2 "2018-02-23T07:10:08Z")

</div>

> How can I find out if some of my log lines are not matching and not processed with the grok patterns I am using?

They'll get tagged with `_grokparsefailure`.

> If the mapping of the some log data and elasticsearch doesn't match, how would I find out and view or log such errors?

Check out the dead letter queue feature.

> I noticed the --debug command line option gives more information.  
> What is the --debug equivalent in logstash.yml?

```
log.level: debug

```

> Other than the --debug command line option, logs stored by logstash in /var/log/\* what other useful tips for debugging and problem solving can you suggest?

I'm obviously biased but I find my testing tool [Logstash Filter Verifier](https://github.com/magnusbaeck/logstash-filter-verifier) to be very useful when developing and debugging filters.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [March 23, 2018, 7:10am UTC](https://discuss.elastic.co/t/best-practices-for-debugging-and-problem-solving-logstash-problems/121154/3 "2018-03-23T07:10:27Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.