# Cannot parse jboss server log

**URL:** https://discuss.elastic.co/t/cannot-parse-jboss-server-log/49572
**Category:** Logstash
**Created:** [May 9, 2016, 4:03pm UTC](https://discuss.elastic.co/t/cannot-parse-jboss-server-log/49572 "2016-05-09T16:03:47Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![dlopez](https://avatars.discourse-cdn.com/v4/letter/d/bc79bd/32.png) [@dlopez](https://discuss.elastic.co/u/dlopez)
#### Post date: [May 9, 2016, 4:03pm UTC](https://discuss.elastic.co/t/cannot-parse-jboss-server-log/49572/1 "2016-05-09T16:03:47Z")

</div>

Hi,

I'm newbie on logstash, I've successfully installed and configured ElasticSearch, LogStash and Kibana as well as my first input using the Remote Log4J connector.

But now I'm trying to parse the server.log file with no success. This is my latest config file:

```
input {
   #log4j {
   # mode => "server"
   # host => "localhost"
   # port => 4712
   # }

    file {
        path => "/home/dlopez/server.log"
        start_position => "beginning"
        }
   }

   output {
     elasticsearch {
      hosts => "localhost:9200"
      index => "logstash-%{+YYYY.MM.dd}"
    }
  }

```

Anybody can help me,please? I just only need to send the whole file to Elastic and let Kibana do the rest.  
Thank you very much in advanced.

Best regards

---

<div class="post-metadata">

### Author: ![dlopez](https://avatars.discourse-cdn.com/v4/letter/d/bc79bd/32.png) [@dlopez](https://discuss.elastic.co/u/dlopez)
#### Post date: [May 10, 2016, 2:45pm UTC](https://discuss.elastic.co/t/cannot-parse-jboss-server-log/49572/2 "2016-05-10T14:45:28Z")

</div>

Finally I got it working,  
now I'm trying to use a grok filter. I've tested the filter using the [Grok Debugger](http://grokdebug.herokuapp.com/) but when restarting logstash, nothing is parsed.

Here is my logstash.conf file:

```
input {
  file {
        path => "/home/dlopez/server.log"
        start_position => "beginning"
       }
}

filter {
   grok {
     match =>
        {
          "message" => "%{TIMESTAMP_ISO8601:timestamp}%{SPACE}%{LOGLEVEL:level}\s+\[%{DATA:className}\]%{SPACE}%{GREEDYDATA:message}"
        }
   }
}
output {
  elasticsearch {
    hosts => "localhost:9200"
    index => "logstash-%{+YYYY.MM.dd}"
  }
}

```

Any help would be appreciated. Thanks

Regards

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [May 12, 2016, 5:47am UTC](https://discuss.elastic.co/t/cannot-parse-jboss-server-log/49572/3 "2016-05-12T05:47:58Z")

</div>

Logstash is probably tailing the input file and waiting for more lines to be added to it. Either delete the sincedb file or set `sincedb_path` to /dev/null. Also, if the file is older than a day you need to adjust the file input's `ignore_older` option.

---

<div class="post-metadata">

### Author: ![dlopez](https://avatars.discourse-cdn.com/v4/letter/d/bc79bd/32.png) [@dlopez](https://discuss.elastic.co/u/dlopez)
#### Post date: [May 12, 2016, 8:02am UTC](https://discuss.elastic.co/t/cannot-parse-jboss-server-log/49572/4 "2016-05-12T08:02:33Z")

</div>

Thank you very much! it works now!

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 4:57am UTC](https://discuss.elastic.co/t/cannot-parse-jboss-server-log/49572/5 "2017-07-06T04:57:54Z")

</div>