# Logstash - Exchange 2013 Message Tracking

**URL:** <https://discuss.elastic.co/t/logstash-exchange-2013-message-tracking/145581>\
**Category:** Logstash\
**Created:** [August 22, 2018, 3:31pm UTC](https://discuss.elastic.co/t/logstash-exchange-2013-message-tracking/145581 "2018-08-22T15:31:16Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![L33T](https://avatars.discourse-cdn.com/v4/letter/l/dbc845/32.png) [@L33T](https://discuss.elastic.co/u/L33T)\
**Post date:** [August 22, 2018, 3:31pm UTC](https://discuss.elastic.co/t/logstash-exchange-2013-message-tracking/145581/1 "2018-08-22T15:31:16Z")

</div>

Hi,

I cannot get logstash to output exchange 2013 tracking logs properly. Can anyone help?

Logstash Config:

input {  
beats {  
port =\> 5044  
type =\> "ex\_msg\_trk"  
}  
}

filter {  
if [type] == "ex\_msg\_trk" {

grok {  
match =\> { "message" =\> "(%{TIMESTAMP\_ISO8601:date-time})?,(%{IPORHOST:client-ip})?,(%{IPORHOST:client-hostname})?,(%{IPORHOST:server-ip})?,(%{IPORHOST:server-hostname})?,(%{GREEDYDATA:source-context})?,(%{GREEDYDATA:connector-id})?$

```
}

mutate {
    convert => ["total-bytes", "integer"]
    convert => ["recipient-count", "integer"]
    split => ["recipient-address", ";"]
    split => ["source-context", ";"]
    split => ["custom_data", ";"]
    }

```

}  
}

output {  
if [type] == "ex\_msg\_trk" {  
elasticsearch {  
hosts =\> elastic1:9201  
index =\> "logstash\_exch-%{+YYYY.MM.dd}"  
}  
}  
}

Logstash Error:  
[2018-08-22T15:28:59,381][ERROR][logstash.agent] Failed to execute action {:action=\>LogStash::PipelineAction::Create/pipeline\_id:main, :exception=\>"LogStash::ConfigurationError", :message=\>"Expected one of #, {, } at line 30, column 23 (byte 1265) after output {\n if [type] == "ex\_msg\_trk" {\n elasticsearch {\n hosts =\> elastic1", :backtrace=\>["/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:42:in `compile_imperative'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:50:in`compile\_graph'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:12:in `block in compile_sources'", "org/jruby/RubyArray.java:2486:in`map'", "/usr/share/logstash/logstash-core/lib/logstash/compiler.rb:11:in `compile_sources'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:49:in`initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline.rb:167:in `initialize'", "/usr/share/logstash/logstash-core/lib/logstash/pipeline_action/create.rb:40:in`execute'", "/usr/share/logstash/logstash-core/lib/logstash/agent.rb:305:in `block in converge\_state'"]}  
[2018-08-22T15:29:00,120][INFO][logstash.agent] Successfully started Logstash API endpoint {:port=\>9600}

Cheers,

---

<div class="post-metadata">

**Author:** ![L33T](https://avatars.discourse-cdn.com/v4/letter/l/dbc845/32.png) [@L33T](https://discuss.elastic.co/u/L33T)\
**Post date:** [August 23, 2018, 12:39pm UTC](https://discuss.elastic.co/t/logstash-exchange-2013-message-tracking/145581/2 "2018-08-23T12:39:19Z")

</div>

Cured, missing " off each end of the hosts entry.

resolved.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [September 20, 2018, 12:39pm UTC](https://discuss.elastic.co/t/logstash-exchange-2013-message-tracking/145581/3 "2018-09-20T12:39:39Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.