# Logstash metrics

**URL:** <https://discuss.elastic.co/t/logstash-metrics/79022>\
**Category:** Logstash\
**Created:** [March 17, 2017, 12:30pm UTC](https://discuss.elastic.co/t/logstash-metrics/79022 "2017-03-17T12:30:03Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![bush](https://avatars.discourse-cdn.com/v4/letter/b/f08c70/32.png) [@bush](https://discuss.elastic.co/u/bush)\
**Post date:** [March 17, 2017, 12:30pm UTC](https://discuss.elastic.co/t/logstash-metrics/79022/1 "2017-03-17T12:30:03Z")

</div>

Good day everyone.

I have a problem configuring logstash to store metrics. So the goal is to have statistics based on  
connected servers. I want to see how many messages each of my servers emit in a point of time.

looks like metrics plugin is a way to go, but i can't store this data in elasticseach in the way i want.

So far i came with this configuration:

```
filter {
  if [message] and [host] {
    metrics {
      meter => ["%{host}"]
      add_tag => "metric"
    }
  }
}
output {
     if "metric" in [tags] {
         file {
           path => "/tmp/test.out" 
	   codec => rubydebug {
		metadata => true
	   }
         }

     }
}

```

This is output

{  
"@version" =\> "1",  
"@timestamp" =\> "2017-03-17T11:22:05.227Z",  
"message" =\> "el1",  
"nlbint2" =\> {  
"count" =\> 172,  
"rate\_1m" =\> 0.028768455154214556,  
"rate\_5m" =\> 0.08007273499832629,  
"rate\_15m" =\> 0.08472905443413455  
},  
"rfapp-test" =\> {  
"count" =\> 67543,  
"rate\_1m" =\> 38.32375267123969,  
"rate\_5m" =\> 31.368829680900127,  
"rate\_15m" =\> 27.19415559842569  
},  
...  
etc

so when i put this to elasticsearch there is one message "el1" with the bunch of fields.

How i can make it look like @timestamp host count rate1m rate5m rate15m ?

---

<div class="post-metadata">

**Author:** ![anhlqn](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/anhlqn/32/5454_2.png) [@anhlqn](https://discuss.elastic.co/u/anhlqn)\
**Post date:** [March 18, 2017, 2:31am UTC](https://discuss.elastic.co/t/logstash-metrics/79022/2 "2017-03-18T02:31:19Z")

</div>

> [@bush](#):
>
> I have a problem configuring logstash to store metrics. So the goal is to have statistics based onconnected servers. I want to see how many messages each of my servers emit in a point of time.

Are you trying to measure Logstash throughput to troubleshoot? If not, I would use the count aggregation, split by Date Histogram then by server field. With that you can view messages per server at any interval you need.

---

<div class="post-metadata">

**Author:** ![bush](https://avatars.discourse-cdn.com/v4/letter/b/f08c70/32.png) [@bush](https://discuss.elastic.co/u/bush)\
**Post date:** [March 20, 2017, 8:17am UTC](https://discuss.elastic.co/t/logstash-metrics/79022/3 "2017-03-20T08:17:37Z")

</div>

The idea is to track log generation spikes from each server. So if we see that particular server starts to emit many messages there is a posibility that it feels bad.  
Unfortunately not all logs delivered to elastic. Some of them stored in raw format on filesytem. But all of them still collected by logstash.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 17, 2017, 8:17am UTC](https://discuss.elastic.co/t/logstash-metrics/79022/4 "2017-04-17T08:17:40Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.