# Logstash- issue to parse logs from multi location
**URL:** https://discuss.elastic.co/t/logstash-issue-to-parse-logs-from-multi-location/141510
**Category:** Logstash
**Created:** [July 25, 2018, 7:33am UTC](https://discuss.elastic.co/t/logstash-issue-to-parse-logs-from-multi-location/141510 "2018-07-25T07:33:03Z")
**Posts on this page:** 5
**Page:** 1
### Author:  [@2anilkumar](https://discuss.elastic.co/u/2anilkumar)
#### Post date: [July 25, 2018, 7:33am UTC](https://discuss.elastic.co/t/logstash-issue-to-parse-logs-from-multi-location/141510/1 "2018-07-25T07:33:03Z")
--------- filebeat.yml ------
filebeat.prospectors:
- type: log
--------- input.conf ------
input {
beats {
port =\> 5044
}
}
--------- output.conf ------
output {
if [fields][log\_type] == "airflow\_dags\_log"
{
elasticsearch {
hosts =\> ["localhost:9200"]
index =\> ["airflow\_dags\_log"]
}
```
}
if [fields][log_type] == "unpack_process_logs"
{
elasticsearch {
hosts => ["localhost:9200"]
index => ["unpack_process_logs"]
}
}
```
}
--------- filter.conf ------
filter {
```
if [fields][log_type] == "unpack_process_logs"
{
csv {
separator => "|"
columns => ["LogLevel","LogDate","LogTime","SourceFile","LineNo","filler","ClientShortName","FileName","FileLocation","FileDate","FileSize","FrtId","Status"]
}
}
if [fields][log_type] == "airflow_dags_log"
{
csv {
separator => " "
columns => ["LogDate","ProcessID","INFO"]
}
}
```
}
Error :
[2018-07-25T02:12:17,245][INFO][logstash.outputs.elasticsearch] ES Output version determined {:es\_version=\>6}
[2018-07-25T02:12:17,252][WARN][logstash.outputs.elasticsearch] Detected a 6.x and above cluster: the `type` event field won't be used to determine the document \_type {:es\_version=\>6}
[2018-07-25T02:12:17,272][INFO][logstash.outputs.elasticsearch] Using mapping template from {:path=\>nil}
[2018-07-25T02:12:17,297][INFO][logstash.outputs.elasticsearch] Attempting to install template {:manage\_template=\>{"template"=\>"logstash-_", "version"=\>60001, "settings"=\>{"index.refresh\_interval"=\>"5s"}, "mappings"=\>{"default"=\>{"dynamic\_templates"=\>[{"message\_field"=\>{"path\_match"=\>"message", "match\_mapping\_type"=\>"string", "mapping"=\>{"type"=\>"text", "norms"=\>false}}}, {"string\_fields"=\>{"match"=\>"_", "match\_mapping\_type"=\>"string", "mapping"=\>{"type"=\>"text", "norms"=\>false, "fields"=\>{"keyword"=\>{"type"=\>"keyword", "ignore\_above"=\>256}}}}}], "properties"=\>{"@timestamp"=\>{"type"=\>"date"}, "@version"=\>{"type"=\>"keyword"}, "geoip"=\>{"dynamic"=\>true, "properties"=\>{"ip"=\>{"type"=\>"ip"}, "location"=\>{"type"=\>"geo\_point"}, "latitude"=\>{"type"=\>"half\_float"}, "longitude"=\>{"type"=\>"half\_float"}}}}}}}}
---
### Author:  [@Krunal\_kalaria](https://discuss.elastic.co/u/Krunal_kalaria)
#### Post date: [July 25, 2018, 7:45am UTC](https://discuss.elastic.co/t/logstash-issue-to-parse-logs-from-multi-location/141510/2 "2018-07-25T07:45:21Z")
Hello @2anilkumar,
It's seems like a version compatibility issue.
Thanks & Regards,
Krunal.
---
### Author:  [@2anilkumar](https://discuss.elastic.co/u/2anilkumar)
#### Post date: [July 25, 2018, 7:50am UTC](https://discuss.elastic.co/t/logstash-issue-to-parse-logs-from-multi-location/141510/3 "2018-07-25T07:50:56Z")
Yes, log shows, but I'm using fields: {log\_type: unpack\_process\_logs}
Detected a 6.x and above cluster: the type event field won't be used to determine the document \_type
---
### Author:  [@2anilkumar](https://discuss.elastic.co/u/2anilkumar)
#### Post date: [July 25, 2018, 12:00pm UTC](https://discuss.elastic.co/t/logstash-issue-to-parse-logs-from-multi-location/141510/4 "2018-07-25T12:00:28Z")
This was WARN, that still exits.
My issue was due to existing pattern, I was not able to create new index. That's resolved now.
PUT \_settings
{
"index": {
"blocks": {
"read\_only\_allow\_delete": "false"
}
}
}
Delete similar pattern index & recreate.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [August 22, 2018, 12:00pm UTC](https://discuss.elastic.co/t/logstash-issue-to-parse-logs-from-multi-location/141510/5 "2018-08-22T12:00:29Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.