# Filebeat syslog unix socket input doesn't work for Nginx

**URL:** <https://discuss.elastic.co/t/filebeat-syslog-unix-socket-input-doesnt-work-for-nginx/252958>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [October 22, 2020, 8:06am UTC](https://discuss.elastic.co/t/filebeat-syslog-unix-socket-input-doesnt-work-for-nginx/252958 "2020-10-22T08:06:07Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![zoulja](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zoulja/32/77747_2.png) [@zoulja](https://discuss.elastic.co/u/zoulja)\
**Post date:** [October 22, 2020, 8:06am UTC](https://discuss.elastic.co/t/filebeat-syslog-unix-socket-input-doesnt-work-for-nginx/252958/1 "2020-10-22T08:06:08Z")

</div>

I'm trying to collect customized Nginx access logs via Filebeat using syslog unix socket type.  
Filebeat 7.9.2:

> ```
> - input_type: syslog
> protocol.unix:
> path: "/var/log/nginx/nginx.sock"
> 
> ```

Nginx 1.15.2:  
`access_log syslog:server=unix:/var/log/nginx/nginx.sock,tag=nginx_access mycustomformat;`

From the Filebeat log I see Input is started successfully:  
`020-10-21T16:18:24.599+0300 INFO [unix] common/listener.go:87 Started listening for UNIX connection {"address": "/var/log/nginx/nginx.sock"}`

Such configuration seems don't work, since in Nginx error.log I see the following:

> 2020/10/22 10:59:04 [alert] 29709#0: connect() failed (91: Protocol wrong type for socket)  
> 2020/10/22 10:59:04 [warn] 29709#0: \*82175 send() to syslog failed while logging request, client: 10.241.71.8, server: localhost, request: "GET /API/heartbeat HTTP/1.0", host: "1.2.3.4:443"

I suspect this issue can be related to [Add support for ~UDP~ Datagram unix socket input · Issue #18632 · elastic/beats · GitHub](https://github.com/elastic/beats/issues/18632) or to [in\_syslog with haproxy and nginx · Issue #292 · fluent/fluent-bit · GitHub](https://github.com/fluent/fluent-bit/issues/292) (some socket parameters need to be changed?)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 19, 2020, 10:06am UTC](https://discuss.elastic.co/t/filebeat-syslog-unix-socket-input-doesnt-work-for-nginx/252958/2 "2020-11-19T10:06:30Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.