# Logstash Custom file for apache configuration

**URL:** <https://discuss.elastic.co/t/logstash-custom-file-for-apache-configuration/187900>\
**Category:** Logstash\
**Created:** [June 27, 2019, 6:21pm UTC](https://discuss.elastic.co/t/logstash-custom-file-for-apache-configuration/187900 "2019-06-27T18:21:25Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Aryan90](https://avatars.discourse-cdn.com/v4/letter/a/e68b1a/32.png) [@Aryan90](https://discuss.elastic.co/u/Aryan90)\
**Post date:** [June 27, 2019, 6:21pm UTC](https://discuss.elastic.co/t/logstash-custom-file-for-apache-configuration/187900/1 "2019-06-27T18:21:26Z")

</div>

Hi Guys,

I have installed ELK stack on single server and i have created a logstash file for apache server which is running on client server. I have setup the filebeat to read access and error log of apache.

the problem is how will i sure filebeat is reading the custom apache logstash file and there are also msyql logstash file too ?...

when i connect elk stack while enable the logstash in filebeat. this does not make connections. gives me en error like trying to connect backoff ( rsync:http:..). this works with elasticsearch only.

displaying the Apache logstash file.

\<  
input {  
beats {  
port =\> 5044  
}  
}

output {  
if [@metadata][pipeline] {  
elasticsearch {  
hosts =\> "[http://192.168.185.143:9200](http://192.168.185.143:9200)"  
manage\_template =\> false  
index =\> "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"  
pipeline =\> "%{[@metadata][pipeline]}"

```
}

```

} else {  
elasticsearch {  
hosts =\> "[http://192.168.185.143:9200](http://192.168.185.143:9200)"  
manage\_template =\> false  
index =\> "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}"

```
}

```

}  
}  
/\>

Also showing the logstash logs error.

\<  
[2019-06-27T19:40:26,198][ERROR][logstash.agent] Failed to execute action {:action=\>LogStash::PipelineAction::Create/pipeline\_id:main, :exception=\>"LogStash::ConfigurationError", :message=\>"Expected one of #, =\> at line 64, column 14 (byte 1312) after output {\n elasticsearch {\n\thosts =\> ["192.168.185.143:9200"]\n\tsniffing =\> true\n\tmanage\_template =\> false\n#\tindex =\> "%{[@metadata][beat]}-%{+YYYY.MM.dd}" #\n index", :backtrace=\>["/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:41:in `compile_imperative'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:49:in`compile\_graph'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:11:in `block in compile_sources'", "org/jruby/RubyArray.java:2577:in`map'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:10:in `compile_sources'", "org/logstash/execution/AbstractPipelineExt.java:151:in`initialize'", "org/logstash/execution/JavaBasePipelineExt.java:47:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/java_pipeline.rb:23:in`initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline\_action/create.rb:36:in `execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:325:in`block in converge\_state'"]}  
[2019-06-27T19:40:26,915][INFO][logstash.agent] Successfully started Logstash API endpoint {:port=\>9600}  
[2019-06-27T19:40:31,529][INFO][logstash.runner] Logstash shut down.  
[root@elasticsearch logstash]#  
/\>

Please provide me solution asap or give me working apache logstash file.

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [June 27, 2019, 6:58pm UTC](https://discuss.elastic.co/t/logstash-custom-file-for-apache-configuration/187900/2 "2019-06-27T18:58:21Z")

</div>

The error message does not match the configuration you posted. The error message has

```
output {
    elasticsearch {
        hosts => ["192.168.185.143:9200"]
        sniffing => true
        manage_template => false
# index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}" 
        index

```

That suggests that index is not followed by =\>

Please show us the configuration you are using. Select it in the edit panel and click on \</\> in the toolbar above so that it is blockquoted. Verify in the preview pane on the right that it is formatted correctly.

---

<div class="post-metadata">

**Author:** ![Aryan90](https://avatars.discourse-cdn.com/v4/letter/a/e68b1a/32.png) [@Aryan90](https://discuss.elastic.co/u/Aryan90)\
**Post date:** [June 29, 2019, 6:26am UTC](https://discuss.elastic.co/t/logstash-custom-file-for-apache-configuration/187900/3 "2019-06-29T06:26:37Z")

</div>

Hi Badger,

I'm trying this apache custom code. can you find if there is any problem in this code ?

 ![apchelo4](https://us1.discourse-cdn.com/elastic/original/3X/8/9/894dfdf73c5bab98adbca6508e699525b86166cc.png)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 27, 2019, 6:26am UTC](https://discuss.elastic.co/t/logstash-custom-file-for-apache-configuration/187900/4 "2019-07-27T06:26:38Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.