# JournalBeat Logstash configuration

**URL:** <https://discuss.elastic.co/t/journalbeat-logstash-configuration/107427>\
**Category:** Logstash\
**Created:** [November 13, 2017, 4:04pm UTC](https://discuss.elastic.co/t/journalbeat-logstash-configuration/107427 "2017-11-13T16:04:27Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![moriol](https://avatars.discourse-cdn.com/v4/letter/m/439d5e/32.png) [@moriol](https://discuss.elastic.co/u/moriol)\
**Post date:** [November 13, 2017, 4:04pm UTC](https://discuss.elastic.co/t/journalbeat-logstash-configuration/107427/1 "2017-11-13T16:04:27Z")

</div>

I am trying to get the JournalBeat installed and working, so it can take my systemd logs and send them to ElasticSearch. I am running Centos 7.3.

The steps I completed:

1. I have downloaded the zip file file from [https://github.com/mheese/journalbeat](https://github.com/mheese/journalbeat) and extracted the contents under /usr/local/bin.  
2)I have my journalbeat.yml file placed under /usr/local/bin/journalbeat-master/etc  
3)I have Logstash configuration as follows:  
input {  
beats {  
port =\> 5044  
}  
}  
filter {  
if [type] == "journal" {  
json {  
source =\> "message"  
skip\_on\_invalid\_json =\> true  
}  
}  
}

output {  
elasticsearch {  
hosts =\> ["127.0.0.1:9200"]  
index =\> "syslog-%{+YYYY.MM.dd}"  
}  
stdout {  
codec =\> rubydebug  
}  
}  
4)I started logstash with the configuration file and see that I am listening on port 5044.

I do not see any systemd output in my console or anything in the index.  
Can you please let me know how to configure this correctly?

---

<div class="post-metadata">

**Author:** ![moriol](https://avatars.discourse-cdn.com/v4/letter/m/439d5e/32.png) [@moriol](https://discuss.elastic.co/u/moriol)\
**Post date:** [November 13, 2017, 5:02pm UTC](https://discuss.elastic.co/t/journalbeat-logstash-configuration/107427/2 "2017-11-13T17:02:27Z")

</div>

I managed to get journalbeat installed and possible to start, thanks to this thread:

> <https://github.com/mheese/journalbeat/issues/76>

How can I get this to take my logs from systemd and send them to ES?

---

<div class="post-metadata">

**Author:** ![moriol](https://avatars.discourse-cdn.com/v4/letter/m/439d5e/32.png) [@moriol](https://discuss.elastic.co/u/moriol)\
**Post date:** [November 22, 2017, 1:23pm UTC](https://discuss.elastic.co/t/journalbeat-logstash-configuration/107427/3 "2017-11-22T13:23:16Z")

</div>

The answer is to specify specific services you want to monitor in journalbeat.yml, under units section, for example:  
units: ["sshd.service"]

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 11, 2017, 4:04pm UTC](https://discuss.elastic.co/t/journalbeat-logstash-configuration/107427/4 "2017-12-11T16:04:28Z")

</div>

This topic was automatically closed after 28 days. New replies are no longer allowed.