# Have couple questions about Logstash configuration **URL:** \ **Category:** Logstash\ **Created:** [September 7, 2015, 7:05pm UTC](https://discuss.elastic.co/t/have-couple-questions-about-logstash-configuration/28794 "2015-09-07T19:05:07Z")\ **Posts on this page:** 8\ **Page:** 2
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [September 14, 2015, 2:45pm UTC](https://discuss.elastic.co/t/have-couple-questions-about-logstash-configuration/28794/21 "2015-09-14T14:45:26Z")
> ``` > sincedb_path => "/var/log/logstash" > > ``` Hmm. `sincedb_path` should point to a file, not a directory. Does /var/log/logstash exist on your system? If it does, is it a directory or a file? Logstash _should_ fail upon startup if it exists as a directory. > i mean how can i create that logstash will send data to Kibana from 2 different devices with 2 different index pattern ? See [elasticsearch - Make logstash add different inputs to different indices - Stack Overflow](http://stackoverflow.com/a/27147688/414355). ---
**Author:** ![AlekMarkus](https://avatars.discourse-cdn.com/v4/letter/a/ac8455/32.png) [@AlekMarkus](https://discuss.elastic.co/u/AlekMarkus)\ **Post date:** [September 14, 2015, 8:24pm UTC](https://discuss.elastic.co/t/have-couple-questions-about-logstash-configuration/28794/22 "2015-09-14T20:24:07Z")
1. i have this path as a folder but logstash running and working without any errors , i will remove this line , but how can i delete all fields with time and that it wont create them again ? 2. after reading this article : [http://stackoverflow.com/a/27147688/414355](http://stackoverflow.com/a/27147688/414355). i have changed my config input { file { path =\> ["/var/log/network.log"] start\_position =\> "beginning" type =\> "firewall" tags =\> ["netsyslog"] } file { path =\> ["/var/log/Windows.log"] start\_position =\> "beginning" type =\> "Windows" tags =\> ["netsyslog"] } } filter { ``` kv { field_split => "," } ``` } output { if [type] == "firewall" { elasticsearch { protocol =\> "node" host =\> "localhost" index =\> "firewall-%{+YYYY.MM.dd}" } } else { elasticsearch { protocol =\> "node" host =\> "localhost" ``` index => "Windows-%{+YYYY.MM.dd}" } ``` } } and still doesn't work ![](https://us1.discourse-cdn.com/elastic/original/2X/0/047cd195a1a9cc15f1e1ceff9a43f7effbfc2c90.png) ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [September 15, 2015, 6:07am UTC](https://discuss.elastic.co/t/have-couple-questions-about-logstash-configuration/28794/23 "2015-09-15T06:07:33Z")
1. Sorry, I don't understand this question. 2. The configuration looks sane but Kibana complains about there not being any indexes matching Windows-\*. _Are_ there such indexes? ---
**Author:** ![AlekMarkus](https://avatars.discourse-cdn.com/v4/letter/a/ac8455/32.png) [@AlekMarkus](https://discuss.elastic.co/u/AlekMarkus)\ **Post date:** [September 15, 2015, 7:58am UTC](https://discuss.elastic.co/t/have-couple-questions-about-logstash-configuration/28794/24 "2015-09-15T07:58:30Z")
1. how can i delete all fields with those messages ? and how can i make that it wont create them again ? 2. well i entered to kibana path and i can see that indices created , but with other name than Windows/Firewall and why its separated ? traffic,event,app-ctrl they are all Firewall messages , how can i make them to be in 1 folder under 1 index pattern ![](https://us1.discourse-cdn.com/elastic/original/2X/a/a36d3cc986c476a06c4593b4610bb1e0e6e90778.png) ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [September 15, 2015, 8:22am UTC](https://discuss.elastic.co/t/have-couple-questions-about-logstash-configuration/28794/25 "2015-09-15T08:22:37Z")
> how can i delete all fields with those messages ? Oh, right. Just delete all messages with such fields. You can use Elasticsearch's [delete by query API](https://www.elastic.co/guide/en/elasticsearch/reference/current/docs-delete-by-query.html). But since you're obviously still in the testing phase, why not just start over again or ignore these fields > and how can i make that it wont create them again ? If you've fixed your configuration it won't happen again. This is a good example why it's a good idea to inspect messages with e.g. the stdout output before you actually start sending data to Elasticsearch. > well i entered to kibana path Kibana doesn't have any local storage so I don't know what you mean. Are you actually talking about Elasticsearch? Don't inspect Elasticsearch's state by looking at the file system. Use a cluster dashboard plugin like kopf or ElasticHQ instead. ---
**Author:** ![AlekMarkus](https://avatars.discourse-cdn.com/v4/letter/a/ac8455/32.png) [@AlekMarkus](https://discuss.elastic.co/u/AlekMarkus)\ **Post date:** [September 15, 2015, 11:13am UTC](https://discuss.elastic.co/t/have-couple-questions-about-logstash-configuration/28794/26 "2015-09-15T11:13:05Z")
1. the problem is that at the begging of my log i have this : 2015-09-15T14:00:18+03:00 example : 2015-09-15T14:00:18+03:00 10.1.1.200 date=2015-09-15,time=13:04:41,devname=FG200B,device\_id=FG200B3911602199,log\_id=0021000002,type=traffic,subtype=allowed,pri=notice,vd=root,src=50.50.50.1,src\_port=65143,src\_int="ssl.root",dst=10.1.1.240,dst\_port=53,dst\_int="port13",SN=54725607,status=accept,policyid=23,dir\_disp=org,tran\_disp=snat,proto=17,duration=180,sent=72,rcvd=265,sent\_pkt=1,rcvd\_pkt=1 how i can make that it will ignore this message ? i tried filter { ``` kv { field_split => "," remove_field => ["@timestamp"] ``` } but then nothing works.. 1. Kibana doesn't have any local storage so I don't know what you mean. Are you actually talking about Elasticsearch? Don't inspect Elasticsearch's state by looking at the file system. Use a cluster dashboard plugin like kopf or ElasticHQ instead. i mean the path of elasticsearch /var/lib/logstash/data/elasticsearch/nodes/1/ so why when i configured type for Firewall and Windows i have those folders ? when all of them are from fortigate . why its not take traffic,event,app-ctrl under 1 folder with the name Firewall-\* ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [September 15, 2015, 11:36am UTC](https://discuss.elastic.co/t/have-couple-questions-about-logstash-configuration/28794/27 "2015-09-15T11:36:21Z")
You need to isolate the key/value pairs in a field, then feed _that_ field to the kv filter. ``` grok { match => ["message", "%{TIMESTAMP_ISO8601:timestamp} %{IP:ip} %{GREEDYDATA:kv}"] } kv { source => "kv" ... } ``` (I haven't tested if TIMESTAMP\_ISO8601 actually matches your timestamp. This config snippet is just an example.) > so why when i configured type for Firewall and Windows i have those folders ? when all of them are from fortigate . why its not take traffic,event,app-ctrl under 1 folder with the name Firewall-\* There are no folders in Elasticsearch. You're better off ignoring the on-disk storage structure. The configuration you showed earlier posts messages to either firewall-\* or Windows-\*. Under no circumstances will it post to an index that begins with any of the other prefixes you mentioned. Make sure you don't have another configuration file in /etc/logstash/conf.d with an output section that posts to those indexes. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 5:29am UTC](https://discuss.elastic.co/t/have-couple-questions-about-logstash-configuration/28794/28 "2017-07-06T05:29:07Z")
Closed on July 6, 2017, 5:29am UTC [Previous page](https://discuss.elastic.co/t/have-couple-questions-about-logstash-configuration/28794.md?page=1)