# How to get shards from elasticsearch to logstash

**URL:** <https://discuss.elastic.co/t/how-to-get-shards-from-elasticsearch-to-logstash/140825>\
**Category:** Logstash\
**Created:** [July 20, 2018, 2:31am UTC](https://discuss.elastic.co/t/how-to-get-shards-from-elasticsearch-to-logstash/140825 "2018-07-20T02:31:28Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![deok](https://avatars.discourse-cdn.com/v4/letter/d/5fc32e/32.png) [@deok](https://discuss.elastic.co/u/deok)\
**Post date:** [July 20, 2018, 2:31am UTC](https://discuss.elastic.co/t/how-to-get-shards-from-elasticsearch-to-logstash/140825/1 "2018-07-20T02:31:29Z")

</div>

first i am sorry than i poored at english

i want to get a shards... and print out the log file

i used elasticsearch for search engine....

this result is an api using the postman  
get : xxx.x.xx.xxx:9800/searchlog\_201807\*

result \>\>\>\>

```
    "mappings": {
        "keywordlog": {
            "_meta": {
                "index_name": "searchHistory",
                "type_name": "searchHistory"
            },
            "properties": {
                "custNo": {
                    "type": "keyword"
                },
                "insertByAdmin": {
                    "type": "boolean"
                },
                "insertDate": {
                    "type": "date"
                },
                "ipAddr": {
                    "type": "keyword"
                },
                "isSuccess": {
                    "type": "boolean"
                },
                "searchWord": {
                    "type": "keyword"
                }
            }
        }
    },

```

but i want convert this form and printout logfile

2018-07-20 11:23:14 custNo:xxxx , insertByAdmin:xxxx, insertData:xxxxxx, ipAddr: xxxxxx, isSuccess: xxxx, searchWord: xxxx

logstash config...

input {  
elasticsearch{  
port =\> "9800"  
host =\> "xxx.xx.xx.xxx"  
index =\> "searchlog\_\*"  
docinfo =\> true  
}  
}  
filter{  
ruby{

# code =\> "event.set('date\_index',event.timestamp.time.localtime.strftime('%Y%m%d'))"

```
    }

```

}  
output {  
file {  
codec =\> line {  
format =\> "%{[message]}"  
}  
path=\>["/applog/logstash/test.log"]

```
            }

```

}

how to write logstash config?  
(logstash 5.2.2)  
plz help me....

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [July 20, 2018, 3:09am UTC](https://discuss.elastic.co/t/how-to-get-shards-from-elasticsearch-to-logstash/140825/2 "2018-07-20T03:09:12Z")

</div>

It's best if you keep your question to one topic. Feel free to update the original one with more info, like this config - [How to get shards from elasticsearch to logstash?](https://discuss.elastic.co/t/how-to-get-shards-from-elasticsearch-to-logstash/140449)

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [July 20, 2018, 3:09am UTC](https://discuss.elastic.co/t/how-to-get-shards-from-elasticsearch-to-logstash/140825/3 "2018-07-20T03:09:14Z")

</div>