# LogStash filter not works with FileBeat input
**URL:** https://discuss.elastic.co/t/logstash-filter-not-works-with-filebeat-input/118836
**Category:** Logstash
**Created:** [February 7, 2018, 12:01pm UTC](https://discuss.elastic.co/t/logstash-filter-not-works-with-filebeat-input/118836 "2018-02-07T12:01:05Z")
**Posts on this page:** 2
**Page:** 1
### Author:  [@Uwais\_Ibrahim](https://discuss.elastic.co/u/Uwais_Ibrahim)
#### Post date: [February 7, 2018, 12:01pm UTC](https://discuss.elastic.co/t/logstash-filter-not-works-with-filebeat-input/118836/1 "2018-02-07T12:01:06Z")
Hi,
I have an ELK stack running on my server. Everything looks good except when I tried to filter out the timestamp from the message part of catalina.out log file.
The below is the message.
**2018-01-23 12:49:17,944 [http-nio-8080-exec-6] INFO org.napa.web.rest.interceptor.RequestVersionInterceptor (RequestVersionInterceptor.java:34) - App Version: 2.1.1.3/null App type: by userId: 2119**
The below is the LogStash configuration.
input {
beats {
port =\> 5044
}
}
filter {
grok {
match =\> ["message", "(?(\d){4}-(\d){2}-(\d){2} (\d){2}:(\d){2}:(\d){2},(\d){3})"]
}
date {
match =\> ["sourcestamp" , "yyyy-MM-dd HH:mm:ss,SSS"]
}
}
output {
elasticsearch {
hosts =\> ["localhost:9200"]
manage\_template =\> false
user =\> "elastic"
password =\> "\*\*\*\*\*\*\*"
index =\> "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
document\_type =\> "%{[@metadata][type]}"
}
}
Below the filebeat.yml configuration.
filebeat.prospectors:
- type: log
enabled: true
paths:
- /var/log/tomcat/catalina.\*
multiline.pattern: '^java|^[[:space:]]+(at)'
multiline.negate: false
multiline.match: after
filebeat.config.modules:
path: ${path.config}/modules.d/\*.yml
reload.enabled: false
setup.template.settings:
index.number\_of\_shards: 3
setup.kibana:
output.logstash:
hosts: ["127.0.0.1:5044"]
The log is not coming up in Kibana. I need the log in Kibana with timestamp from the message part. Please help with that. Not getting any idea from the logs. If you need, I can share the logs as well here.
Note: When I tried from the terminal using Logstash command with stdin and stdout(given below), I got the required output. But it is not working with filebeat-logstash combination.
**~$** _echo "2018-01-23 12:49:17,944 [http-nio-8080-exec-6] INFO org.napa.web.rest.interceptor.RequestVersionInterceptor.testcatalina (RequestVersionInterceptor.java:34) - App Version: 2.1.1.3/null App type: by userId: 2119" | /usr/share/logstash/bin/logstash -f conf.d/logstash.conf --path.settings /etc/logstash/_
**~$** \_2018-02-07 17:29:21,704 main ERROR Unable to locate appender "${sys:ls.log.format}_rolling" for logger config "root"_
2018-02-07 17:29:23,841 main ERROR Unable to locate appender
"${sys:ls.log.format}\_rolling" for logger config "root"
Sending Logstash's logs to /var/log/logstash which is now configured via log4j2.properties
{
"sourcestamp" =\> "2018-01-23 12:49:17,944",
"host" =\> "QB-IPL-1205",
"@version" =\> "1",
"message" =\> "2018-01-23 12:49:17,944 [http-nio-8080-exec-6] INFO org.napa.web.rest.interceptor.RequestVersionInterceptor.testcatalina (RequestVersionInterceptor.java:34) - App Version: 2.1.1.3/null App type: by userId: 2119",
"@timestamp" =\> 2018-01-23T07:19:17.944Z
}
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 7, 2018, 12:01pm UTC](https://discuss.elastic.co/t/logstash-filter-not-works-with-filebeat-input/118836/2 "2018-03-07T12:01:07Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.