# Logstash Docker container is not working with the config file which worked fine in windows

**URL:** <https://discuss.elastic.co/t/logstash-docker-container-is-not-working-with-the-config-file-which-worked-fine-in-windows/142397>\
**Category:** Logstash\
**Created:** [July 31, 2018, 3:12pm UTC](https://discuss.elastic.co/t/logstash-docker-container-is-not-working-with-the-config-file-which-worked-fine-in-windows/142397 "2018-07-31T15:12:19Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![sreeja](https://avatars.discourse-cdn.com/v4/letter/s/e274bd/32.png) [@sreeja](https://discuss.elastic.co/u/sreeja)\
**Post date:** [July 31, 2018, 3:12pm UTC](https://discuss.elastic.co/t/logstash-docker-container-is-not-working-with-the-config-file-which-worked-fine-in-windows/142397/1 "2018-07-31T15:12:19Z")

</div>

Hi,  
I was using logstash in my Windows machine, and it was working fine. Now my server is in Linux and I am using logstash docker container. Most of the things which worked in windows is not working now, the regex patterns, json plugin, drop {}. Whatever I was given in filter {} is not working? Do I need to install all plugins when using a docker container ?

Here is my config file, it works in windows. (websocket didn't work in windows, I was using stdin{}, but it works in docker )

input {  
websocket {  
url =\> "ws://localhost:3333/"  
}  
}

filter {  
grok {  
match =\> { "message" =\> "%{GREEDYDATA:request}"}  
}

grok {  
match =\> ["message", ".\*?sta(?\d+)"]  
}

json{  
source =\> "request"  
target =\> "parsedJson"  
remove\_field=\>["request"]  
}

if ([message] =~ "._new interface_.") {  
mutate {  
add\_field =\> {  
"status" =\> "Created Interface"  
}  
add\_tag =\> "station\_event"  
}  
}

if ([message] =~ "._delete interface_.") {  
mutate {  
add\_field =\> {  
"status" =\> "Deleted Interface"  
}  
add\_tag =\> "station\_event"  
}  
}

if ([message] =~ "._disconnected_.") {  
mutate {  
add\_field =\> {  
"status" =\> "Station disconnected"  
}  
add\_tag =\> "station\_event"  
}  
}

if ([message] =~ "._CTRL - EVENT - CONNECTED_.") {  
mutate {  
add\_field =\> {  
"status" =\> "Station connected"  
}  
add\_tag =\> "station\_event"  
}  
}

mutate {

```
add_field => {
  "station" => "sta%{interface}"
}

add_field => {
  "time" => "%{[parsedJson][@timestamp]}"
}

add_field => {
  "detailed_status" => "%{[parsedJson][wifi-event]}"
}

remove_field=>["message", "@timestamp", "@version", host, "parsedJson", "interface"]

```

}

}

output {  
if "station\_event" in [tags] {  
file {  
path =\> "/tmp/logdata.log"  
}  
}  
}

Please see my Dockerfile

FROM [docker.elastic.co/logstash/logstash:6.3.2](http://docker.elastic.co/logstash/logstash:6.3.2)  
USER root  
COPY certs/ /etc/pki/ca-trust/source/anchors/  
RUN update-ca-trust  
RUN logstash-plugin install logstash-input-websocket  
RUN logstash-plugin install logstash-filter-mutate  
RUN logstash-plugin install logstash-filter-drop

Could you please point what I should modify/add to make it work in logstash docker container?

---

<div class="post-metadata">

**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\
**Post date:** [July 31, 2018, 5:07pm UTC](https://discuss.elastic.co/t/logstash-docker-container-is-not-working-with-the-config-file-which-worked-fine-in-windows/142397/2 "2018-07-31T17:07:49Z")

</div>

What do you mean by "not working"? Is logstash running? Is it logging any errors? How are you telling it to use that configuration file?

---

<div class="post-metadata">

**Author:** ![sreeja](https://avatars.discourse-cdn.com/v4/letter/s/e274bd/32.png) [@sreeja](https://discuss.elastic.co/u/sreeja)\
**Post date:** [July 31, 2018, 7:25pm UTC](https://discuss.elastic.co/t/logstash-docker-container-is-not-working-with-the-config-file-which-worked-fine-in-windows/142397/3 "2018-07-31T19:25:10Z")

</div>

Found out the issue. All the filters I did on text file. But input\_websocket was giving response as json, which I was not able to filter.

Adding codec =\> "plain" solved my issue  
websocket {  
------  
-----------  
codec =\> "plain"  
}

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 28, 2018, 7:25pm UTC](https://discuss.elastic.co/t/logstash-docker-container-is-not-working-with-the-config-file-which-worked-fine-in-windows/142397/4 "2018-08-28T19:25:11Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.