# How to forward logstash logs to Rapid7?

**URL:** <https://discuss.elastic.co/t/how-to-forward-logstash-logs-to-rapid7/214141>\
**Category:** Logstash\
**Created:** [January 7, 2020, 11:34pm UTC](https://discuss.elastic.co/t/how-to-forward-logstash-logs-to-rapid7/214141 "2020-01-07T23:34:29Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![srbhklkrn](https://avatars.discourse-cdn.com/v4/letter/s/e480ec/32.png) [@srbhklkrn](https://discuss.elastic.co/u/srbhklkrn)\
**Post date:** [January 7, 2020, 11:34pm UTC](https://discuss.elastic.co/t/how-to-forward-logstash-logs-to-rapid7/214141/1 "2020-01-07T23:34:29Z")

</div>

I'm trying to forward logs using Logstash to Rapid7 SIEM tool with particular tags, below is the output plugin but it's not working, what am I doing wrong?

```auto
output {
    if [type] == "syslog" {

        elasticsearch { hosts => ["localhost:9200"] }

        if [tags] == "Prod"
        {
            http {
                hosts => ["10.10.1.1:10025"]
            }
        }
    }
}

```

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [January 8, 2020, 12:06am UTC](https://discuss.elastic.co/t/how-to-forward-logstash-logs-to-rapid7/214141/2 "2020-01-08T00:06:44Z")

</div>

> [@srbhklkrn](#):
>
> if [tags] == "Prod"

That's valid, but it is a string comparison. It is more likely you want an array membership test

```
if "Prod" in [tags]

```

---

<div class="post-metadata">

**Author:** ![srbhklkrn](https://avatars.discourse-cdn.com/v4/letter/s/e480ec/32.png) [@srbhklkrn](https://discuss.elastic.co/u/srbhklkrn)\
**Post date:** [January 8, 2020, 2:50pm UTC](https://discuss.elastic.co/t/how-to-forward-logstash-logs-to-rapid7/214141/3 "2020-01-08T14:50:08Z")

</div>

Thank you for the reply I changed my condition to

```auto
if "Prod" in [tags]

```

and I'm trying to write it to the file but its not writing it with `if` condition, but if I remove it it writes to the specified path.

```
output {
    if [type] == "syslog" {

        elasticsearch { hosts => ["localhost:9200"] }
         }

        if "Prod" in [tags]
        {
           file{
                 path => "/home/user/logstash-test/test-%{+YYYY-MM-dd}.log"
           }
        }
}
```

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [January 8, 2020, 3:19pm UTC](https://discuss.elastic.co/t/how-to-forward-logstash-logs-to-rapid7/214141/4 "2020-01-08T15:19:39Z")

</div>

OK, so add

```
codec => rubydebug

```

to the file output and show us what an event looks like when it is written out.

---

<div class="post-metadata">

**Author:** ![srbhklkrn](https://avatars.discourse-cdn.com/v4/letter/s/e480ec/32.png) [@srbhklkrn](https://discuss.elastic.co/u/srbhklkrn)\
**Post date:** [January 8, 2020, 3:24pm UTC](https://discuss.elastic.co/t/how-to-forward-logstash-logs-to-rapid7/214141/5 "2020-01-08T15:24:50Z")

</div>

it still not writing it in file

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [January 8, 2020, 3:58pm UTC](https://discuss.elastic.co/t/how-to-forward-logstash-logs-to-rapid7/214141/6 "2020-01-08T15:58:23Z")

</div>

Maybe it does not have [type] set to syslog. Add an else and a second file output.

---

<div class="post-metadata">

**Author:** ![srbhklkrn](https://avatars.discourse-cdn.com/v4/letter/s/e480ec/32.png) [@srbhklkrn](https://discuss.elastic.co/u/srbhklkrn)\
**Post date:** [January 8, 2020, 4:15pm UTC](https://discuss.elastic.co/t/how-to-forward-logstash-logs-to-rapid7/214141/7 "2020-01-08T16:15:20Z")

</div>

Here is the complete pipeline, I need to send all logs tagged as Prod to rapid7 but for now I just need to send it to file, as you said by putting else indeed write the file but how do I send only `Prod` logs?

```
   input {
  tcp {
    port => 10514
    type => syslog
  }

  udp {
    port => 10514
    type => syslog
  }

}

filter {
  if [type] == "syslog" {
    grok {
      match => { "message" => "%{SYSLOG5424PRI}%{NONNEGINT:syslog5424_ver} +(?:%{TIMESTAMP_ISO8601:syslog5424_ts}|-) +(?:%{HOSTNAME:syslog5424_host}|-) +(?:%{NOTSPACE:syslog5424_app}|-) +(?:%{NOTSS
PACE:syslog5424_proc}|-) +(?:%{WORD:syslog5424_msgid}|-) +(?:%{SYSLOG5424SD:syslog5424_sd}|-|) +%{GREEDYDATA:syslog5424_msg}" }
    }

    syslog_pri { }

    date {
      match => ["syslog_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss"]
    }

    if !("_grokparsefailure" in [tags]) {
      mutate {
        replace => ["@source_host", "%{syslog_hostname}"]
        replace => ["@message", "%{syslog_message}"]
      }
    }

    mutate {
      remove_field => ["syslog_hostname", "syslog_message", "syslog_timestamp"]
    }

    if [message] =~ /.prod./ {
        mutate {
                add_tag => ["Prod"]
        }
     }
  }

}

output {
  if [type] == "syslog" {
    elasticsearch {
      hosts => ["10.31.45.85:9450", "10.31.45.86:9450", "10.31.45.87:9450"]
      index => "logstash-%{+yyyy.MM.dd}"
    }

    if "Prod" in [tags] {

      file {
        path => "/home/myuser/logstash-logs/test-%{+YYYY-MM-dd}.log"
        codec => rubydebug
      }
    } else {
      file {
        path => "/home/myuser/logstash-logs/test2-%{+YYYY-MM-dd}.log"
        codec => rubydebug
      }
    }
  }
}
```

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [February 5, 2020, 4:25pm UTC](https://discuss.elastic.co/t/how-to-forward-logstash-logs-to-rapid7/214141/8 "2020-02-05T16:25:01Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.