# Issue sending logs with FileBeat Getting parsed at Logstash

**URL:** https://discuss.elastic.co/t/issue-sending-logs-with-filebeat-getting-parsed-at-logstash/182821
**Category:** Beats
**Tags:** filebeat
**Created:** [May 27, 2019, 12:34am UTC](https://discuss.elastic.co/t/issue-sending-logs-with-filebeat-getting-parsed-at-logstash/182821 "2019-05-27T00:34:37Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![iukea](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/iukea/32/49083_2.png) [@iukea](https://discuss.elastic.co/u/iukea)
#### Post date: [May 27, 2019, 12:34am UTC](https://discuss.elastic.co/t/issue-sending-logs-with-filebeat-getting-parsed-at-logstash/182821/1 "2019-05-27T00:34:37Z")

</div>

I am able to get some of my logs sent from FileBeat to Logstash, but I seem to be having an issue with a 2 of them.

Do you guys have any words of wisdom?

I see logs in the folders that FileBeat is supposed to read from, but I am getting no dice on getting them to be sent back.

**Part of the Filebeat Yml**

```auto
# Mailoney
     -
        paths:
        - /data/mailoney/log/commands.log
        input_type: log
        document_type: Mailoney

        fields:
        fields_under_root: true
        json.keys_under_root: false
        json.add_error_key: true

# Conpot
     -
        paths:
        - /data/conpot/log/*.json"
        input_type: log
        document_type: Conpot

        fields:
        fields_under_root: true
        json.keys_under_root: false
        json.add_error_key: true

# Heralding
     -
        paths:
        - /data/heralding/log/auth.csv"
        document_type: Heralding

        fields:
        fields_under_root: true
        json.keys_under_root: false
        json.add_error_key: true

```

Logstash conf

```auto
# Heralding
  if [type] == "Heralding" {
    csv {
      columns => ["timestamp","auth_id","session_id","src_ip","src_port","dest_ip","dest_port","proto","username","password"] separator => ","
    }
    date {
      match => ["timestamp", "yyyy-MM-dd HH:mm:ss.SSSSSS"]
      remove_field => ["timestamp"]
    }
  }

# Conpot
  if [type] == "Conpot" {
    date {
      match => ["timestamp", "ISO8601"]
    }
    mutate { 
      rename => { 
        "dst_port" => "dest_port" 
        "dst_ip" => "dest_ip" 
      } 
    } 
  }

# Mailoney
  if [type] == "Mailoney" {
    grok {
      match => ["message", "\A%{NAGIOSTIME}\[%{IPV4:src_ip}:%{INT:src_port:integer}] %{GREEDYDATA:smtp_input}" ]
    }
    mutate {
      add_field => {
        "dest_port" => "25"
      }
    }
    date {
      match => ["nagios_epoch", "UNIX"]
      remove_field => ["nagios_epoch"]
    }
  }

```

---

<div class="post-metadata">

### Author: ![faec](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/faec/32/46988_2.png) [@faec](https://discuss.elastic.co/u/faec)
#### Post date: [May 29, 2019, 8:19pm UTC](https://discuss.elastic.co/t/issue-sending-logs-with-filebeat-getting-parsed-at-logstash/182821/2 "2019-05-29T20:19:24Z")

</div>

When you say you're having trouble with two of them, do you mean one of these three type configurations is working? Which ones are / aren't getting sent to Logstash?

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [June 26, 2019, 8:19pm UTC](https://discuss.elastic.co/t/issue-sending-logs-with-filebeat-getting-parsed-at-logstash/182821/3 "2019-06-26T20:19:26Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.