# Help with processing log files

**URL:** https://discuss.elastic.co/t/help-with-processing-log-files/261858
**Category:** Elasticsearch
**Created:** [January 21, 2021, 11:31pm UTC](https://discuss.elastic.co/t/help-with-processing-log-files/261858 "2021-01-21T23:31:27Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![Maria\_Elle](https://avatars.discourse-cdn.com/v4/letter/m/a5b964/32.png) [@Maria\_Elle](https://discuss.elastic.co/u/Maria_Elle)
#### Post date: [January 21, 2021, 11:31pm UTC](https://discuss.elastic.co/t/help-with-processing-log-files/261858/1 "2021-01-21T23:31:27Z")

</div>

I'm very very new to Elasticsearch/ELK, and I'm currently learning it from scratch for a project. I'm running it on an Ubuntu VM and my first task is to process json log files from my desktop through Filebeat into Elasticsearch. I have everything installed and I've experimented with downloading the Shakespeare files as a demo, but I'm stuck on how I can link my own files to Elasticsearch?

Right now I'm trying to process a log file called 'test.log' and this is what I have so far:

`//curl -XPOST "http://localhost:9200/test/test" -H "Content-Type: application/json" -d @test.log`

The error I get reads:

```
    Warning: Couldn't read data from file "test.log", this makes and empty POST. 
    {"error":{"root_cause":[{"type":"parse_exception","reason":"request body is required"}],"type":"parse_exception","reason":"request body is required"},"status":400}

```

Would appreciate some help and guidance. Thank you.

---

<div class="post-metadata">

### Author: ![aaron-nimocks](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aaron-nimocks/32/73965_2.png) [@aaron-nimocks](https://discuss.elastic.co/u/aaron-nimocks)
#### Post date: [January 22, 2021, 1:49am UTC](https://discuss.elastic.co/t/help-with-processing-log-files/261858/2 "2021-01-22T01:49:06Z")

</div>

Your task is to ingest data using [filebeat](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-installation-configuration.html).

Basically you will download and install Filebeat. Configure it to read from a folder where your logs are located. Configure your Elasticsearch connection if you changed from default.

Turn it on and then filebeat will read that folder you specified, read the log file and send it over to elasticsearch for you.

---

<div class="post-metadata">

### Author: ![Maria\_Elle](https://avatars.discourse-cdn.com/v4/letter/m/a5b964/32.png) [@Maria\_Elle](https://discuss.elastic.co/u/Maria_Elle)
#### Post date: [January 22, 2021, 2:48am UTC](https://discuss.elastic.co/t/help-with-processing-log-files/261858/3 "2021-01-22T02:48:48Z")

</div>

Thank you so much for your help! I'm trying to follow the article you provided and in the screenshot below is what I get from inputing the first two commands found in the article. Do you know how I may be able to fix it or why the command is not found?  
Thank you again.

 ![Screen Shot 2021-01-21 at 9.43.10 PM](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1af606bc8ac1e5297f8a50e46fbb9ff29bd135a1.png)

---

<div class="post-metadata">

### Author: ![aaron-nimocks](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aaron-nimocks/32/73965_2.png) [@aaron-nimocks](https://discuss.elastic.co/u/aaron-nimocks)
#### Post date: [January 22, 2021, 3:16am UTC](https://discuss.elastic.co/t/help-with-processing-log-files/261858/4 "2021-01-22T03:16:16Z")

</div>

> Set the connection information in `filebeat.yml`

The 2nd one isn't a command but tells you what needs to set inside the configuration file. If you didn't change elasticsearch from default you won't need to edit this.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [February 19, 2021, 3:16am UTC](https://discuss.elastic.co/t/help-with-processing-log-files/261858/5 "2021-02-19T03:16:29Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
