# Filebeat vs Logstash **URL:** \ **Category:** Logstash\ **Created:** [April 10, 2018, 12:57pm UTC](https://discuss.elastic.co/t/filebeat-vs-logstash/127485 "2018-04-10T12:57:05Z")\ **Posts on this page:** 5\ **Page:** 5
**Author:** ![sancroth](https://avatars.discourse-cdn.com/v4/letter/s/838e76/32.png) [@sancroth](https://discuss.elastic.co/u/sancroth)\ **Post date:** [April 16, 2018, 9:21am UTC](https://discuss.elastic.co/t/filebeat-vs-logstash/127485/81 "2018-04-16T09:21:46Z")
What we have created so far is this: You send many different logs. If it is an apache log then filter it and add a tag that implies this is an apache log from whatever server. In the output we say "is this tagged as apache log?". If so then write all the tagged apache events,from all sources, to a single file. We never checked for other logs. Why were you seeing events before but after my fix you did not? Becouse you never checked for the tag and just dumped everything out. Now that you are checking for the tag , and NOTHING gets tagged since they are not coming from apache, you see nothing. Please try to read and understand what i am trying to explain here. ---
**Author:** ![sancroth](https://avatars.discourse-cdn.com/v4/letter/s/838e76/32.png) [@sancroth](https://discuss.elastic.co/u/sancroth)\ **Post date:** [April 16, 2018, 9:25am UTC](https://discuss.elastic.co/t/filebeat-vs-logstash/127485/82 "2018-04-16T09:25:09Z")
> [@jawad846](#): > > # OUTPUT HERE > > output { > if "apache\_logs" in [tags] { > file { > path =\> "/home/ubuntu/apache.log" > } > } I feel like you do not want to help yourself. This will be my last post i already gave you EVERYTHING you need to understand and solver your problem. Your error is clear. There is a special character missing. ``` output { if "apache_logs" in [tags] { file { path => "/home/ubuntu/apache.log" } } } # <- this was missing on output. Please count curly braces even if other write it to help you. ``` It even tells you where exactly it was : `"LogStash::ConfigurationError", :message=>"Expected one of #, else, if, ", ', } at line 23, column 1 (byte 336) after output {\n if "apache_logs" in [tags] {\n file {\n path => "/home/ubuntu/apache.log"\n }\n}\n",` ---
**Author:** ![jawad846](https://avatars.discourse-cdn.com/v4/letter/j/edb3f5/32.png) [@jawad846](https://discuss.elastic.co/u/jawad846)\ **Post date:** [April 16, 2018, 9:26am UTC](https://discuss.elastic.co/t/filebeat-vs-logstash/127485/83 "2018-04-16T09:26:29Z")
sorry its there, while copying it missed. ---
**Author:** ![jawad846](https://avatars.discourse-cdn.com/v4/letter/j/edb3f5/32.png) [@jawad846](https://discuss.elastic.co/u/jawad846)\ **Post date:** [April 16, 2018, 9:33am UTC](https://discuss.elastic.co/t/filebeat-vs-logstash/127485/84 "2018-04-16T09:33:22Z")
config file --\> /usr/share/logstash/apache.conf ``` # INPUT HERE input { beats { port => 5044 } } # FILTER HERE filter{ if [source]=="/var/log/apache2/error.log" { mutate { remove_tag => ["beats_input_codec_plain_applied"] add_tag => ["apache_logs"] } } if [source]=="/var/log/apache2/access.log" { mutate { remove_tag => ["beats_input_codec_plain_applied"] add_tag => ["apache_logs"] } } } # OUTPUT HERE output { if "apache_logs" in [tags] { file { path => "/home/ubuntu/apache.log" codec => "json" } } ``` output --\> /home/ubuntu/apache.log `42,"@version":"1","message":"14.142.151.180 - - [17/Apr/2018:06:33:01 +0000] \"GET /favicon.ico HTTP/1.1\" 404 504 \"-\" \"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:59.0) Gecko/20100101 Firefox/59.0\"","prospector":{"type":"log"}}{"tags":["apache_logs"],"beat":{"version":"6.2.3","hostname":"ip-192-168-2-223","name":"ip-192-168-2-223"},"@timestamp":"2018-04-17T06:33:06.508Z","source":"/var/log/apache2/access.log","host":"ip-192-168-2-223","fileset":{"name":"access","module":"apache2"},"offset":569,"@version":"1","message":"14.142.151.180 - - [17/Apr/2018:06:33:00 +0000] \"GET /icons/ubuntu-logo.png HTTP/1.1\" 200 3623 \"http://35.154.56.205/\" \"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:59.0) Gecko/20100101 Firefox/59.0\"","prospector":{"type":"log"}}{"tags":["apache_logs"],"beat":{"version":"6.2.3","hostname":"ip-192-168-2-223","name":"ip-192-168-2-223"},"@timestamp":"2018-04-17T06:33:06.590Z","source":"/var/log/apache2/access.log","host":"ip-192-168-2-223","offset":365,"@version":"1","message":"14.142.151.180 - - [17/Apr/2018:06:33:00 +0000] \"GET / HTTP/1.1\" 200 3525 \"-\" \"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:59.0) Gecko/20100101 Firefox/59.0\"","prospector":{"type":"log"}}{"tags":["apache_logs"],"beat":{"version":"6.2.3","hostname":"ip-192-168-2-223","name":"ip-192-168-2-223"},"@timestamp":"2018-04-17T06:33:06.507Z","source":"/var/log/apache2/access.log","host":"ip-192-168-2-223","fileset":{"name":"access","module":"apache2"},"offset":365,"@version":"1","message":"14.142.151.180 - - [17/Apr/2018:06:33:00 +0000] \"GET / HTTP/1.1\" 200 3525 \"-\" \"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:59.0) Gecko/20100101 Firefox/59.0\"","prospector":{"type":"log"}}{"tags":["apache_logs"],"beat":{"version":"6.2.3","hostname":"ip-192-168-2-223","name":"ip-192-168-2-223"},"@timestamp":"2018-04-17T06:33:06.508Z","source":"/var/log/apache2/access.log","host":"ip-192-168-2-223","fileset":{"name":"access","module":"apache2"},"offset":742,"@version":"1","message":"14.142.151.180 - - [17/Apr/2018:06:33:01 +0000] \"GET /favicon.ico HTTP/1.1\" 404 504 \"-\" \"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:59.0) Gecko/20100101 Firefox/59.0\"","prospector":{"type":"log"}}{"tags":["apache_logs"],"beat":{"version":"6.2.3","hostname":"ip-192-168-2-223","name":"ip-192-168-2-223"},"@timestamp":"2018-04-17T06:33:06.590Z","source":"/var/log/apache2/access.log","host":"ip-192-168-2-223","offset":569,"@version":"1","message":"14.142.151.180 - - [17/Apr/2018:06:33:00 +0000] \"GET /icons/ubuntu-logo.png HTTP/1.1\" 200 3623 \"http://35.154.56.205/\" \"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:59.0) Gecko/20100101 Firefox/59.0\"","prospector":{"type":"log"}}{"tags":["apache_logs"],"beat":{"version":"6.2.3","hostname":"ip-192-168-2-223","name":"ip-192-168-2-223"},"@timestamp":"2018-04-17T06:33:06.590Z","source":"/var/log/apache2/access.log","host":"ip-192-168-2-223","offset":742,"@version":"1","message":"14.142.151.180 - - [17/Apr/2018:06:33:01 +0000] \"GET /favicon.ico HTTP/1.1\" 404 504 \"-\" \"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:59.0) Gecko/20100101 Firefox/59.0\"","prospector":{"type":"log"}}{"tags":["apache_logs"],"beat":{"version":"6.2.3","hostname":"ip-192-168-2-223","name":"ip-192-168-2-223"},"@timestamp":"2018-04-17T07:00:21.558Z","source":"/var/log/apache2/access.log","host":"ip-192-168-2-223","fileset":{"name":"access","module":"apache2"},"offset":940,"@version":"1","message":"14.142.151.180 - - [17/Apr/2018:07:00:13 +0000] \"GET / HTTP/1.1\" 200 3525 \"-\" \"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_4) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.1 Safari/605.1.15\"","prospector":{"type":"log"}}{"tags":["apache_logs"],"beat":{"version":"6.2.3","hostname":"ip-192-168-2-223","name":"ip-192-168-2-2` Thanks for support @sancroth ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [May 14, 2018, 9:33am UTC](https://discuss.elastic.co/t/filebeat-vs-logstash/127485/85 "2018-05-14T09:33:32Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed. [Previous page](https://discuss.elastic.co/t/filebeat-vs-logstash/127485.md?page=4)