# How work Logstash with Filebeat

**URL:** <https://discuss.elastic.co/t/how-work-logstash-with-filebeat/147353>\
**Category:** Logstash\
**Created:** [September 5, 2018, 9:28am UTC](https://discuss.elastic.co/t/how-work-logstash-with-filebeat/147353 "2018-09-05T09:28:43Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Jose\_Luis\_Sanchez\_Bo](https://avatars.discourse-cdn.com/v4/letter/j/eb8c5e/32.png) [@Jose\_Luis\_Sanchez\_Bo](https://discuss.elastic.co/u/Jose_Luis_Sanchez_Bo)\
**Post date:** [September 5, 2018, 9:28am UTC](https://discuss.elastic.co/t/how-work-logstash-with-filebeat/147353/1 "2018-09-05T09:28:43Z")

</div>

Hi everyone,

I have a ELK Server, and i use Filebeat for input. Example:

2018-06-30 20:18:32,137 Authenticate a=1234  
2018-06-30 20:18:32,137 Values b=4 c=5

Procedure in logstash:

The first "Authenticate" traces, process and I save in ElasticSearch with the value a = 1234.  
The second "Values" trace, look for the first trace "Authenticate" and I get the value of a = 1234, then process and save in ElasticSearch with b = 4, c = 5 and a = 1234.

If Filebeat sends these two traces to Logstash at the same time, when the trace "Values" searches the first trace "Authenticate", this is not yet in ElasticSerach so it does not find the value of "a".

Is there any way to do this that I tell?  
I need your help  
Thanks.

---

<div class="post-metadata">

**Author:** ![Jose\_Luis\_Sanchez\_Bo](https://avatars.discourse-cdn.com/v4/letter/j/eb8c5e/32.png) [@Jose\_Luis\_Sanchez\_Bo](https://discuss.elastic.co/u/Jose_Luis_Sanchez_Bo)\
**Post date:** [September 5, 2018, 10:33am UTC](https://discuss.elastic.co/t/how-work-logstash-with-filebeat/147353/2 "2018-09-05T10:33:50Z")

</div>

elasticsearch{  
hosts =\> ["localhost:9200"]  
index =\> "sam\_values"  
query =\> "thread:%{thread} AND epoc:%{epoc} AND type\_msg:sam\_analize"  
fields =\> { "uid" =\> "uid\_sam" }  
}

When i run logstash, the uid is not found. I think is because logstash take to much time to add the first event in elasticsearch and when it is trying to filter the second log event, it can't find nothing because the first log event is not yet saved in elasticsearch.

How can i solve this?

---

<div class="post-metadata">

**Author:** ![Jose\_Luis\_Sanchez\_Bo](https://avatars.discourse-cdn.com/v4/letter/j/eb8c5e/32.png) [@Jose\_Luis\_Sanchez\_Bo](https://discuss.elastic.co/u/Jose_Luis_Sanchez_Bo)\
**Post date:** [September 5, 2018, 10:54am UTC](https://discuss.elastic.co/t/how-work-logstash-with-filebeat/147353/3 "2018-09-05T10:54:44Z")

</div>

Please, someone could help me?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 3, 2018, 10:54am UTC](https://discuss.elastic.co/t/how-work-logstash-with-filebeat/147353/4 "2018-10-03T10:54:45Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.