# Configuring Logstash to parse Apache log files and send

**URL:** <https://discuss.elastic.co/t/configuring-logstash-to-parse-apache-log-files-and-send/49591>\
**Category:** Logstash\
**Created:** [May 9, 2016, 10:13pm UTC](https://discuss.elastic.co/t/configuring-logstash-to-parse-apache-log-files-and-send/49591 "2016-05-09T22:13:54Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![Jemli\_Fathi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jemli_fathi/32/10714_2.png) [@Jemli\_Fathi](https://discuss.elastic.co/u/Jemli_Fathi)\
**Post date:** [May 9, 2016, 10:13pm UTC](https://discuss.elastic.co/t/configuring-logstash-to-parse-apache-log-files-and-send/49591/1 "2016-05-09T22:13:54Z")

</div>

I'm trying to parse xampp log files and to send them to ES, i found a configuration example:

```
input{
	file{
		path => '/opt/lampp/logs/*.log'
		start_position => beginning
	}
}
filter {  
  if [path] =~ "access" {
    mutate { replace => { "type" => "apache_access" } }
    grok {
      # Depends on the format of your log file
      match => { "message" => "%{COMBINEDAPACHELOG}" }
    }
  } else if [path] =~ "error" {
    mutate { replace => { type => "apache_error" } }
  }
  date {
    match => ["timestamp" , "dd/MMM/yyyy:HH:mm:ss Z"]
    locale => "en"
  }
}

output{
	elasticsearch {
       index => "apache_logs"
       document_type => "apache_log"
       host => "localhost"
    }
    file { path => "/home/logstash.out"}
}

```

But , it sounds not working 😞

- logstash.err content:

- My access\_log file

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [May 10, 2016, 6:30am UTC](https://discuss.elastic.co/t/configuring-logstash-to-parse-apache-log-files-and-send/49591/2 "2016-05-10T06:30:55Z")

</div>

What isn't working? Which version of Logstash is this? Elasticsearch 1.7.0 is quite old by now. You should upgrade.

Comment out the elasticsearch output and use a simple `stdout { codec => rubydebug }` output until you've verified that the logs are parsed as desired.

---

<div class="post-metadata">

**Author:** ![Jemli\_Fathi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jemli_fathi/32/10714_2.png) [@Jemli\_Fathi](https://discuss.elastic.co/u/Jemli_Fathi)\
**Post date:** [May 10, 2016, 10:25am UTC](https://discuss.elastic.co/t/configuring-logstash-to-parse-apache-log-files-and-send/49591/3 "2016-05-10T10:25:23Z")

</div>

I'm using Logstash 2.2.2 with ES 1.7.1. Unfortunately, i can't upgrade my ES, cause i have some stuff, which do not work with recent ES versions. Which logstash version can do this job and which i can use with ES 1.7.1?

But, it's not working even when commenting ES ouput, actually, when using rubydebug, it prints

`Logstash startup completed`

And it still blocked for several minutes

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [May 10, 2016, 10:46am UTC](https://discuss.elastic.co/t/configuring-logstash-to-parse-apache-log-files-and-send/49591/4 "2016-05-10T10:46:17Z")

</div>

Logstash is probably waiting for more data to be added to the log file. Delete the sincedb file to make sure the file is scanned from the beginning and check if the log file is older than 24 hours. If yes, either touch the file or adjust the file input's `ignore\_older' option.

---

<div class="post-metadata">

**Author:** ![Jemli\_Fathi](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jemli_fathi/32/10714_2.png) [@Jemli\_Fathi](https://discuss.elastic.co/u/Jemli_Fathi)\
**Post date:** [May 10, 2016, 11:06am UTC](https://discuss.elastic.co/t/configuring-logstash-to-parse-apache-log-files-and-send/49591/5 "2016-05-10T11:06:30Z")

</div>

I tried this with a file, i just have created and i still getting the same behaviour

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:58am UTC](https://discuss.elastic.co/t/configuring-logstash-to-parse-apache-log-files-and-send/49591/6 "2017-07-06T04:58:20Z")

</div>