# Issue parsing Apache log coming from Filebeat
**URL:** https://discuss.elastic.co/t/issue-parsing-apache-log-coming-from-filebeat/68297
**Category:** Logstash
**Created:** [December 7, 2016, 12:20pm UTC](https://discuss.elastic.co/t/issue-parsing-apache-log-coming-from-filebeat/68297 "2016-12-07T12:20:29Z")
**Posts on this page:** 6
**Page:** 1
### Author:  [@bicofino](https://discuss.elastic.co/u/bicofino)
#### Post date: [December 7, 2016, 12:20pm UTC](https://discuss.elastic.co/t/issue-parsing-apache-log-coming-from-filebeat/68297/1 "2016-12-07T12:20:29Z")
Hello all,
I'm trying use ELK with Filebeat to parse some apache logs, but the filter never gets fired.
ELK Server:
Packages installed:
> logstash-5.0.2-1.noarch
> kibana-5.0.2-1.x86\_64
> elasticsearch-5.0.2-1.noarch
The filter is OK:
> 0:\> /usr/share/logstash/bin/logstash -f /etc/logstash/conf.d/apache-filter.conf --config.test\_and\_exit --path.settings /etc/logstash/
> Sending Logstash's logs to /var/log/logstash which is now configured via log4j2.properties
> Configuration OK
Content of /etc/logstash/conf.d/apache-filter.conf:
```
filter {
if [type] == "apache-access" {
# This will parse the apache access event
grok {
match => ["message", "%{COMBINEDAPACHELOG}"]
}
}
}
```
Client server(filebeat):
Packages installed:
> filebeat-5.0.2-1.x86\_64
Contents of /etc/filebeat/filebeat.yml
`filebeat.prospectors:
- input\_type: log
paths:
- /logs/\*.log
document\_type: apache-access
output.elasticsearch:
hosts: ["[mylogstashserver.com:9200](http://mylogstashserver.com:9200)"]
tls:
certificate\_authorities: ["/etc/pki/tls/certs/logstash-forwarder.crt"]`
Filebeat is working and the log is forwarded to Logstash and I can see on Kibana, below an example:
> {
> "\_index": "filebeat-2016.12.07",
> "\_type": "apache-access",
> "\_id": "AVjZG5H0oxxqAxp3g61g",
> "\_score": null,
> "\_source": {
> "@timestamp": "2016-12-07T11:46:51.405Z",
> "beat": {
> "hostname": "[myfilebeatserver.com](http://myfilebeatserver.com)",
> "name": "[myfilebeatserver.com](http://myfilebeatserver.com)",
> "version": "5.0.2"
> },
> "input\_type": "log",
> "message": "191.255.248.250 - - [05/Dec/2016:11:21:05 +0000] "GET [http://img.mysite.com/8019370/orig-img.mysite.com/cars/389632.jpg](http://img.mysite.com/8019370/orig-img.mysite.com/cars/389632.jpg) HTTP/1.1" 200 14383 "[http://www.mysite.com/travel/resultado-de-carros?searchtype=Car&withdrawalCity=FLL&withdrawalCityType=AEROPORTO&devolutionCity=FLL&devolutionCityType=AEROPORTO&anotherCity=false&pickUpDateTime=20/12/2016T14:00&returnDateTime=04/01/2017T14:00&pickUpLocationCityCode=34691&returnLocationCityCode=34691\](http://www.mysite.com/travel/resultado-de-carros?searchtype=Car&withdrawalCity=FLL&withdrawalCityType=AEROPORTO&devolutionCity=FLL&devolutionCityType=AEROPORTO&anotherCity=false&pickUpDateTime=20/12/2016T14:00&returnDateTime=04/01/2017T14:00&pickUpLocationCityCode=34691&returnLocationCityCode=34691%5C)" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.99 Safari/537.36" "-"",
> "offset": 283053696,
> "source": "/logs/site/wpc\_19370\_20161205\_0001.log",
> "type": "apache-access"
> },
> "fields": {
> "@timestamp": [
> 1481111211405
> ]
> },
> "sort": [
> 1481111211405
> ]
> }
I tried the example here [Logstash configuration examples | Logstash Reference [8.11] | Elastic](https://www.elastic.co/guide/en/logstash/current/config-examples.html), and the content of the message is parsed correctly. Looks like the issue is when the content comes from Filebeat, I already configured Logstash log to Debug and got nothing. Any idea?
Best Regards,
Danilo F. Chilene
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [December 7, 2016, 12:25pm UTC](https://discuss.elastic.co/t/issue-parsing-apache-log-coming-from-filebeat/68297/2 "2016-12-07T12:25:00Z")
If the grok filter was used but the expression didn't match you'd get a `_grokparsefailure` tag, but that's not the case here. The configuration looks okay from here. Are you sure you're actually using the configuration you think you're using? If you start Logstash with `--debug` I think it'll log the exact configuration it loaded.
---
### Author:  [@bicofino](https://discuss.elastic.co/u/bicofino)
#### Post date: [December 7, 2016, 12:49pm UTC](https://discuss.elastic.co/t/issue-parsing-apache-log-coming-from-filebeat/68297/3 "2016-12-07T12:49:34Z")
Hello Magnus,
Here the begin of the log: [http://pastebin.com/R0UdccsR](http://pastebin.com/R0UdccsR)
---
### Author:  [@Bevan](https://discuss.elastic.co/u/Bevan)
#### Post date: [December 9, 2016, 12:46am UTC](https://discuss.elastic.co/t/issue-parsing-apache-log-coming-from-filebeat/68297/4 "2016-12-09T00:46:57Z")
What's the input section of your logstash configuration look like?
I suspect that, while "\_type" is getting set by beats, you aren't setting "type", which means you could either change the if to `if [_type] == "apache-access"` or else add a `type => "apache-access"` section to your input.
---
### Author:  [@bicofino](https://discuss.elastic.co/u/bicofino)
#### Post date: [December 9, 2016, 12:14pm UTC](https://discuss.elastic.co/t/issue-parsing-apache-log-coming-from-filebeat/68297/5 "2016-12-09T12:14:53Z")
Hi,
I tried put a if inside the input too, take a look:
0:\> cat /etc/logstash/conf.d/02-beats-input.conf
input {
beats {
port =\> 5044
ssl =\> true
ssl\_certificate =\> "/etc/pki/tls/certs/logstash-forwarder.crt"
ssl\_key =\> "/etc/pki/tls/private/logstash-forwarder.key"
}
}
filter {
if [type] == "apache-access" {
# This will parse the apache access event
grok {
match =\> ["message", "%{COMBINEDAPACHELOG}"]
}
}
}
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [January 6, 2017, 12:15pm UTC](https://discuss.elastic.co/t/issue-parsing-apache-log-coming-from-filebeat/68297/6 "2017-01-06T12:15:00Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.