# Can't filter Input on Filter Logstash

**URL:** <https://discuss.elastic.co/t/cant-filter-input-on-filter-logstash/37618>\
**Category:** Logstash\
**Created:** [December 19, 2015, 11:09am UTC](https://discuss.elastic.co/t/cant-filter-input-on-filter-logstash/37618 "2015-12-19T11:09:48Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![tatdat](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tatdat/32/113160_2.png) [@tatdat](https://discuss.elastic.co/u/tatdat)\
**Post date:** [December 19, 2015, 11:09am UTC](https://discuss.elastic.co/t/cant-filter-input-on-filter-logstash/37618/1 "2015-12-19T11:09:48Z")

</div>

Hi, i try to install filebeat on web server with config

> filebeat:  
> prospectors:  
> -  
> paths:
> 
> - /var/log/nginx/access.log  
> input\_type: nginx-access-2  
> logstash:  
> hosts: ["10.1.11.171:5044"]  
> index: filebeat-kibana-srv

And i try to using filter on Logstash with Patterns nginx

```
NGUSERNAME [a-zA-Z\.\@\-\+_%]+
NGUSER %{NGUSERNAME}
NGINXACCESS %{IPORHOST:clientip} %{NGUSER:ident} %{NGUSER:auth} \[%{HTTPDATE:timestamp}\] "%{WORD:verb} %{URIPATHPARAM:request} HTTP/%{NUMBER:httpversion}" %{NUMBER:response} (?:%{NUMBER:bytes}|-) (?:"(?:%{URI:referrer}|-)"|%{QS:referrer}) %{QS:agent} %{QS:xforwardedfor} %{IPORHOST:host} %{BASE10NUM:request_duration}

```

And add new file config filter-nginx-access-2.conf

> filter {  
> if [type] == "nginx-access-2" {  
> grok {  
> match =\> { "message" =\> "%{NGINXACCESS}" }  
> }  
> }  
> }

and this is file config beat with logstash

> input {  
> beats {  
> port =\> 5044  
> }  
> }  
> output {  
> elasticsearch {  
> hosts =\> "10.1.11.173:9200"  
> sniffing =\> true  
> manage\_template =\> false  
> index =\> "%{[@metadata][beat]}-%{+YYYY.MM.dd}"  
> document\_type =\> "%{[@metadata][type]}"  
> }  
> }

When i try to view log on kibana :

[http://www.upsieutoc.com/images/2015/12/19/log.png](http://www.upsieutoc.com/images/2015/12/19/log.png)

In this image, filter not working ???  
Can you help me explain that ?

Thanks

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:17am UTC](https://discuss.elastic.co/t/cant-filter-input-on-filter-logstash/37618/2 "2017-07-06T05:17:48Z")

</div>