# How to track/monitor logstash errors

**URL:** <https://discuss.elastic.co/t/how-to-track-monitor-logstash-errors/88762>\
**Category:** Logstash\
**Created:** [June 8, 2017, 8:43pm UTC](https://discuss.elastic.co/t/how-to-track-monitor-logstash-errors/88762 "2017-06-08T20:43:55Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![saisn](https://avatars.discourse-cdn.com/v4/letter/s/c5a1d2/32.png) [@saisn](https://discuss.elastic.co/u/saisn)\
**Post date:** [June 8, 2017, 8:43pm UTC](https://discuss.elastic.co/t/how-to-track-monitor-logstash-errors/88762/1 "2017-06-08T20:43:55Z")

</div>

Hi,

I've multiple logstash process setup and scheduled every 5 minutes. Here, I'd like to include a mechanism that capture any error or exception thrown by logstash process and eventually trigger an alert in the form of emails. What is the best approach / available options to achieve this functionality.

Thanks  
Sai

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [June 9, 2017, 3:44am UTC](https://discuss.elastic.co/t/how-to-track-monitor-logstash-errors/88762/2 "2017-06-09T03:44:36Z")

</div>

Errors that are manifested as tags being added to events could be monitored by Elastic Watcher or Elastalert if they're sent to Elasticsearch. Errors that only show up in the Logstash log file are trickier. Perhaps you could use Filebeat to ship that stuff directly to ES and use the Watcher/Elastalert mechanism for monitoring them?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 7, 2017, 3:58am UTC](https://discuss.elastic.co/t/how-to-track-monitor-logstash-errors/88762/3 "2017-07-07T03:58:37Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
