# Logs to logstash config file

**URL:** https://discuss.elastic.co/t/logs-to-logstash-config-file/44735
**Category:** Logstash
**Created:** [March 17, 2016, 4:35pm UTC](https://discuss.elastic.co/t/logs-to-logstash-config-file/44735 "2016-03-17T16:35:17Z")
**Posts on this page:** 8
**Page:** 1

<div class="post-metadata">

### Author: ![bishaka](https://avatars.discourse-cdn.com/v4/letter/b/e480ec/32.png) [@bishaka](https://discuss.elastic.co/u/bishaka)
#### Post date: [March 17, 2016, 4:35pm UTC](https://discuss.elastic.co/t/logs-to-logstash-config-file/44735/1 "2016-03-17T16:35:17Z")

</div>

I have a simple log file consisting of some information...how do convert it to a logstash-configuration file for indexing in elasticsearch and visualizing in kibana?  
I am confused. please help!

---

<div class="post-metadata">

### Author: ![bishaka](https://avatars.discourse-cdn.com/v4/letter/b/e480ec/32.png) [@bishaka](https://discuss.elastic.co/u/bishaka)
#### Post date: [March 17, 2016, 5:55pm UTC](https://discuss.elastic.co/t/logs-to-logstash-config-file/44735/2 "2016-03-17T17:55:09Z")

</div>

I'm shipping some logs from server 1 to server 2 using logstash-shipper and receiving the message on redis...

the config file i'm using is this:

input {  
file {  
path =\> "/path/to/my/logfile.log"  
type =\> "apache"  
}  
}

filter {  
if [type] == "apache" {  
grok {  
pattern =\> "%{COMBINEDAPACHELOG}"  
}  
}  
}

output {  
redis { host =\> "myserverIP" data\_type =\> "list" key =\> "logstash" }  
}

when i type  
java -Xmx256m -jar logstash-1.3.2-flatjar.jar agent -f /etc/logstash/sys-log-test.conf  
on the command like...i get the following message and nothing else:

Using milestone 2 input plugin 'file'. This plugin should be stable, but if you see strange behavior, ple ase let us know! For more information on plugin milestones, see [http://logstash.net/docs/1.3.2/plugin-mil](http://logstash.net/docs/1.3.2/plugin-mil) estones {:level=\>:warn}  
You are using a deprecated config setting "pattern" set in grok. Deprecated settings will continue to wor k, but are scheduled for removal from logstash in the future. You should use this instead: match =\> { "me ssage" =\> "your pattern here" } If you have any questions about this, please visit the #logstash channel on freenode irc. {:name=\>"pattern", :plugin=\>\<LogStash::Filters::Grok ---\>, :level=\>:warn}  
Using milestone 2 output plugin 'redis'. This plugin should be stable, but if you see strange behavior, p lease let us know! For more information on plugin milestones, see [http://logstash.net/docs/1.3.2/plugin-m](http://logstash.net/docs/1.3.2/plugin-m) ilestones {:level=\>:warn}

What am i doing wrong? Please help!

---

<div class="post-metadata">

### Author: ![AlexH](https://avatars.discourse-cdn.com/v4/letter/a/6f9a4e/32.png) [@AlexH](https://discuss.elastic.co/u/AlexH)
#### Post date: [March 17, 2016, 10:47pm UTC](https://discuss.elastic.co/t/logs-to-logstash-config-file/44735/3 "2016-03-17T22:47:47Z")

</div>

It looks like it wants you to use the newer grok filter. Try changing this:

```
grok {
pattern => "%{COMBINEDAPACHELOG}"
}

```

to this:

```
grok {
    match => { "message" => "%{COMBINEDAPACHELOG}" }
}
```

---

<div class="post-metadata">

### Author: ![bishaka](https://avatars.discourse-cdn.com/v4/letter/b/e480ec/32.png) [@bishaka](https://discuss.elastic.co/u/bishaka)
#### Post date: [March 18, 2016, 5:18pm UTC](https://discuss.elastic.co/t/logs-to-logstash-config-file/44735/4 "2016-03-18T17:18:18Z")

</div>

Tried it still doesn't work..

When i open up redis-cli..i type ping..it returns pong which works correctly..

When i send logs from logstash shipper to redis...it is suppose to display a message like  
[83019] 02 Jul 12:51:02 - Accepted 127.0.0.1:58312  
[83019] 02 Jul 12:51:06 - Client closed connection  
[83019] 02 Jul 12:51:06 - DB 0: 1 keys (0 volatile) in 4 slots HT.

but i am not seeing this message. logstash shipper is not able to connect to redis-cli...

whats happening?

---

<div class="post-metadata">

### Author: ![bishaka](https://avatars.discourse-cdn.com/v4/letter/b/e480ec/32.png) [@bishaka](https://discuss.elastic.co/u/bishaka)
#### Post date: [March 18, 2016, 5:19pm UTC](https://discuss.elastic.co/t/logs-to-logstash-config-file/44735/5 "2016-03-18T17:19:16Z")

</div>

please help! i have been stuck with problem for long time...

---

<div class="post-metadata">

### Author: ![bishaka](https://avatars.discourse-cdn.com/v4/letter/b/e480ec/32.png) [@bishaka](https://discuss.elastic.co/u/bishaka)
#### Post date: [March 18, 2016, 5:24pm UTC](https://discuss.elastic.co/t/logs-to-logstash-config-file/44735/6 "2016-03-18T17:24:34Z")

</div>

the error i am getting is this:

Failed to send event to redis {:event=\>#\<LogStash::Event:0x482a0e9e @cancelled=false, @data={"message"=\>"Hi", "@version"=\>"1", "@timestamp"=\>"2016-03-18T17:23:14.588Z", "host"=\>"meshka"}\>, :identity=\>"default", :exception=\>#\<Redis::CannotConnectError: Error connecting to Redis on 127.0.0.1:6379 (ECONNREFUSED)\>, :backtrace=\>["file:/opt/Oracle/logstash\_ol/logstash-1.3.2-flatjar.jar!/redis/client.rb:278:in `establish_connection'", "file:/opt/Oracle/logstash_ol/logstash-1.3.2-flatjar.jar!/redis/client.rb:69:in`connect'", "file:/opt/Oracle/logstash\_ol/logstash-1.3.2-flatjar.jar!/redis/client.rb:292:in `ensure_connected'", "file:/opt/Oracle/logstash_ol/logstash-1.3.2-flatjar.jar!/redis/client.rb:179:in`process'", "file:/opt/Oracle/logstash\_ol/logstash-1.3.2-flatjar.jar!/redis/client.rb:258:in `logging'", "file:/opt/Oracle/logstash_ol/logstash-1.3.2-flatjar.jar!/redis/client.rb:178:in`process'", "file:/opt/Oracle/logstash\_ol/logstash-1.3.2-flatjar.jar!/redis/client.rb:84:in `call'", "file:/opt/Oracle/logstash_ol/logstash-1.3.2-flatjar.jar!/redis.rb:970:in`rpush'", "file:/opt/Oracle/logstash\_ol/logstash-1.3.2-flatjar.jar!/redis.rb:36:in `synchronize'", "jar:file:/opt/Oracle/logstash_ol/logstash-1.3.2-flatjar.jar!/META-INF/jruby.home/lib/ruby/1.9/monitor.rb:211:in`mon\_synchronize'", "file:/opt/Oracle/logstash\_ol/logstash-1.3.2-flatjar.jar!/redis.rb:36:in `synchronize'", "file:/opt/Oracle/logstash_ol/logstash-1.3.2-flatjar.jar!/redis.rb:969:in`rpush'", "file:/opt/Oracle/logstash\_ol/logstash-1.3.2-flatjar.jar!/logstash/outputs/redis.rb:163:in `receive'", "file:/opt/Oracle/logstash_ol/logstash-1.3.2-flatjar.jar!/logstash/outputs/base.rb:86:in`handle'", "(eval):21:in `initialize'", "org/jruby/RubyProc.java:271:in`call'", "file:/opt/Oracle/logstash\_ol/logstash-1.3.2-flatjar.jar!/logstash/pipeline.rb:259:in `output'", "file:/opt/Oracle/logstash_ol/logstash-1.3.2-flatjar.jar!/logstash/pipeline.rb:218:in`outputworker'", "file:/opt/Oracle/logstash\_ol/logstash-1.3.2-flatjar.jar!/logstash/pipeline.rb:145:in `start\_outputs'"], :level=\>:warn}

---

<div class="post-metadata">

### Author: ![bishaka](https://avatars.discourse-cdn.com/v4/letter/b/e480ec/32.png) [@bishaka](https://discuss.elastic.co/u/bishaka)
#### Post date: [March 19, 2016, 12:16am UTC](https://discuss.elastic.co/t/logs-to-logstash-config-file/44735/7 "2016-03-19T00:16:46Z")

</div>

Problem solved. All i did i was restart logstash and redis.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 5:06am UTC](https://discuss.elastic.co/t/logs-to-logstash-config-file/44735/8 "2017-07-06T05:06:23Z")

</div>


