# Logstash does not send apache logs to elasticsearch

**URL:** <https://discuss.elastic.co/t/logstash-does-not-send-apache-logs-to-elasticsearch/90797>\
**Category:** Logstash\
**Created:** [June 26, 2017, 8:53am UTC](https://discuss.elastic.co/t/logstash-does-not-send-apache-logs-to-elasticsearch/90797 "2017-06-26T08:53:06Z")\
**Posts on this page:** 14\
**Page:** 3

<div class="post-metadata">

**Author:** ![Vishal\_Sharma1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vishal_sharma1/32/20207_2.png) [@Vishal\_Sharma1](https://discuss.elastic.co/u/Vishal_Sharma1)\
**Post date:** [June 27, 2017, 6:06pm UTC](https://discuss.elastic.co/t/logstash-does-not-send-apache-logs-to-elasticsearch/90797/41 "2017-06-27T18:06:32Z")

</div>

for me the globe issue is gone but still no index is created. Need to dig more

---

<div class="post-metadata">

**Author:** ![themoisis](https://avatars.discourse-cdn.com/v4/letter/t/ecd19e/32.png) [@themoisis](https://discuss.elastic.co/u/themoisis)\
**Post date:** [June 28, 2017, 7:44am UTC](https://discuss.elastic.co/t/logstash-does-not-send-apache-logs-to-elasticsearch/90797/42 "2017-06-28T07:44:15Z")

</div>

Magnus, the host directory which contains the apache log file is not mounted into the container. I will try this and come back again

---

<div class="post-metadata">

**Author:** ![Vishal\_Sharma1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vishal_sharma1/32/20207_2.png) [@Vishal\_Sharma1](https://discuss.elastic.co/u/Vishal_Sharma1)\
**Post date:** [June 28, 2017, 8:14am UTC](https://discuss.elastic.co/t/logstash-does-not-send-apache-logs-to-elasticsearch/90797/43 "2017-06-28T08:14:16Z")

</div>

For me I have tried everything like permissions / checked path still no index created ... sigh

---

<div class="post-metadata">

**Author:** ![Vishal\_Sharma1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vishal_sharma1/32/20207_2.png) [@Vishal\_Sharma1](https://discuss.elastic.co/u/Vishal_Sharma1)\
**Post date:** [June 28, 2017, 10:22am UTC](https://discuss.elastic.co/t/logstash-does-not-send-apache-logs-to-elasticsearch/90797/44 "2017-06-28T10:22:37Z")

</div>

I do not understand why logstash able to parse the conf file from command line but not as service. I am out of ideas .. ☹ any pointers ?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [June 28, 2017, 11:02am UTC](https://discuss.elastic.co/t/logstash-does-not-send-apache-logs-to-elasticsearch/90797/45 "2017-06-28T11:02:18Z")

</div>

That sounds like a permissions problem. Increase the log level to debug and look for log entries with "glob" or "discover" in them.

But please, let's not talk about two problems in one thread. It gets very confusing.

---

<div class="post-metadata">

**Author:** ![Vishal\_Sharma1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vishal_sharma1/32/20207_2.png) [@Vishal\_Sharma1](https://discuss.elastic.co/u/Vishal_Sharma1)\
**Post date:** [June 28, 2017, 11:22am UTC](https://discuss.elastic.co/t/logstash-does-not-send-apache-logs-to-elasticsearch/90797/46 "2017-06-28T11:22:45Z")

</div>

as said earlier i have already checked permissions. Also i have put access\_log to /tmp and gave it 777 permission still no luck

---

<div class="post-metadata">

**Author:** ![themoisis](https://avatars.discourse-cdn.com/v4/letter/t/ecd19e/32.png) [@themoisis](https://discuss.elastic.co/u/themoisis)\
**Post date:** [June 28, 2017, 1:58pm UTC](https://discuss.elastic.co/t/logstash-does-not-send-apache-logs-to-elasticsearch/90797/47 "2017-06-28T13:58:55Z")

</div>

So, Vishal, you use the same configuration (same logstash.conf) as mine but without any docker containers and logstash still cannot send apache logs to elastic search

---

<div class="post-metadata">

**Author:** ![Vishal\_Sharma1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vishal_sharma1/32/20207_2.png) [@Vishal\_Sharma1](https://discuss.elastic.co/u/Vishal_Sharma1)\
**Post date:** [June 28, 2017, 2:01pm UTC](https://discuss.elastic.co/t/logstash-does-not-send-apache-logs-to-elasticsearch/90797/48 "2017-06-28T14:01:16Z")

</div>

I am not using same config file but another one. So i have already some server running Elastic Stack version 2.4. I have taken apache config from there. No i am not running docker container

---

<div class="post-metadata">

**Author:** ![Makra](https://avatars.discourse-cdn.com/v4/letter/m/8491ac/32.png) [@Makra](https://discuss.elastic.co/u/Makra)\
**Post date:** [June 28, 2017, 2:12pm UTC](https://discuss.elastic.co/t/logstash-does-not-send-apache-logs-to-elasticsearch/90797/49 "2017-06-28T14:12:44Z")

</div>

Hi  
I have faced the same issue in `Windows 7` and was getting the following in the console output infinitely, the permission was correct in my case. Then i changed the file name from `filename_123.log to filename123.log` and the index was created there after. I have no idea if the `underscore (_)` in the file name is the real culprit.

> logstash.pipeline ] Pushing flush onto pipeline  
> logstash.pipeline ] Pushing flush onto pipeline  
> logstash.pipeline ] Pushing flush onto pipeline  
> logstash.inputs.file ] globbedfiles: D:\filename\_123.log: glob is:

The same configuration seems to work in Ubuntu 16 ( file name with underscore )

Regards

---

<div class="post-metadata">

**Author:** ![themoisis](https://avatars.discourse-cdn.com/v4/letter/t/ecd19e/32.png) [@themoisis](https://discuss.elastic.co/u/themoisis)\
**Post date:** [June 28, 2017, 2:36pm UTC](https://discuss.elastic.co/t/logstash-does-not-send-apache-logs-to-elasticsearch/90797/50 "2017-06-28T14:36:55Z")

</div>

IN my case, renaming my file from admin\_access.log to adminAccess.log (underscore removed) didn't solve the problem

---

<div class="post-metadata">

**Author:** ![Makra](https://avatars.discourse-cdn.com/v4/letter/m/8491ac/32.png) [@Makra](https://discuss.elastic.co/u/Makra)\
**Post date:** [June 28, 2017, 3:33pm UTC](https://discuss.elastic.co/t/logstash-does-not-send-apache-logs-to-elasticsearch/90797/51 "2017-06-28T15:33:30Z")

</div>

Hi  
@themoisis  
I was wrong, added the .xml to the filename in path =\> parameter, therefore i got the error. It was not due to any underscore related issues.

---

<div class="post-metadata">

**Author:** ![themoisis](https://avatars.discourse-cdn.com/v4/letter/t/ecd19e/32.png) [@themoisis](https://discuss.elastic.co/u/themoisis)\
**Post date:** [June 28, 2017, 3:33pm UTC](https://discuss.elastic.co/t/logstash-does-not-send-apache-logs-to-elasticsearch/90797/52 "2017-06-28T15:33:45Z")

</div>

Guys, after mounting the apache log file in the docker container, i finally managed to see some log results in elasticsearch. So, my logstash.conf and my apache log are mounted in the logstash container. However, still in kibana the option to configure an index pattern is still disabled. Need to dig a bit (i hope) more

---

<div class="post-metadata">

**Author:** ![themoisis](https://avatars.discourse-cdn.com/v4/letter/t/ecd19e/32.png) [@themoisis](https://discuss.elastic.co/u/themoisis)\
**Post date:** [June 29, 2017, 9:45am UTC](https://discuss.elastic.co/t/logstash-does-not-send-apache-logs-to-elasticsearch/90797/53 "2017-06-29T09:45:24Z")

</div>

After matching the index from logstash.conf to the index in kibana (by creating a same index in kibana) i finally get also some logs in kibana. Not all the logs but i get some, so what's remaining is digging now in kibana and in logstash.conf filters, grok e.t.c.. So i guess my original problem is solved now. Thank you all!!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 27, 2017, 9:45am UTC](https://discuss.elastic.co/t/logstash-does-not-send-apache-logs-to-elasticsearch/90797/54 "2017-07-27T09:45:25Z")

</div>

Closed on July 27, 2017, 9:45am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.

[Previous page](https://discuss.elastic.co/t/logstash-does-not-send-apache-logs-to-elasticsearch/90797.md?page=2)
