# Filebeat not passing logs through logstash

**URL:** <https://discuss.elastic.co/t/filebeat-not-passing-logs-through-logstash/147926>\
**Category:** Beats\
**Created:** [September 10, 2018, 9:16am UTC](https://discuss.elastic.co/t/filebeat-not-passing-logs-through-logstash/147926 "2018-09-10T09:16:01Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Naveen\_Reddy\_Sama](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/naveen_reddy_sama/32/32399_2.png) [@Naveen\_Reddy\_Sama](https://discuss.elastic.co/u/Naveen_Reddy_Sama)\
**Post date:** [September 10, 2018, 9:16am UTC](https://discuss.elastic.co/t/filebeat-not-passing-logs-through-logstash/147926/1 "2018-09-10T09:16:02Z")

</div>

Hi folks

am passing logs from filebeat through logstash filter, am unable to pass the logs. but when am passing directly to kibana am able to get logs in kibana.

my file beat yml

> filebeat.prospectors:
> 
> - type: log
> - paths:  
> - /var/log/syslog
> - /Users/naveen.sama/Desktop/allure-results/Allure\_Log.txt
> 
> filebeat.config.modules:  
> path: ${path.config}/modules.d/\*.yml  
> reload.enabled: true  
> setup.template.settings:  
> index.number\_of\_shards: 3  
> output.logstash:  
> hosts: ["localhost:5044"]

Logstash config file

> input {  
> beats {  
> port =\> 5044  
> host =\> "localhost"  
> }  
> }
> 
> filter {  
> if [message] =~ /TRANSACTION START/ {  
> grok {  
> match =\> ["message", "%{TIMESTAMP\_ISO8601:timestamp} %{WORD:Info}\s+([%{WORD:loglevel}]\s+)?%{NOTSPACE}%{WORD} %{CISCO\_REASON}%{BASE10NUM}-%{WORD:TransactionID}%{NOTSPACE}%{GREEDYDATA:taskid}" ]  
> }  
> }  
> }
> 
> output  
> {  
> elasticsearch  
> {  
> hosts =\> ["localhost:9200"]  
> }  
> stdout { codec =\> rubydebug }  
> }

can anyone help me on this.

Thanks in advance

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 8, 2018, 11:16am UTC](https://discuss.elastic.co/t/filebeat-not-passing-logs-through-logstash/147926/2 "2018-10-08T11:16:06Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.