# Logstash not getting any syslog **URL:** \ **Category:** Logstash\ **Created:** [January 7, 2016, 2:46pm UTC](https://discuss.elastic.co/t/logstash-not-getting-any-syslog/38631 "2016-01-07T14:46:14Z")\ **Posts on this page:** 12\ **Page:** 1
**Author:** ![simroo](https://avatars.discourse-cdn.com/v4/letter/s/f475e1/32.png) [@simroo](https://discuss.elastic.co/u/simroo)\ **Post date:** [January 7, 2016, 2:46pm UTC](https://discuss.elastic.co/t/logstash-not-getting-any-syslog/38631/1 "2016-01-07T14:46:14Z")
Hello I have just installed ELK on my Linux Debian, and i can access kibana. But i just seem to get No results found :(. I have config a fortigate firewall and juniper switch to syslog everything to the server. But still i cant see anything. Is there any logs that i can check to see to find any information regarding this ? In the /var/log/logstash.err is empty, logstash.log is showing : {:timestamp=\>"2015-12-21T13:41:32.792000+0100", :message=\>"SIGTERM received. Shutting down the pipeline.", :level=\>:warn} {:timestamp=\>"2015-12-21T14:21:33.948000+0100", :message=\>"SIGTERM received. Shutting down the pipeline.", :level=\>:warn} cat logstash.stdout Sending logstash logs to /var/log/logstash/logstash.log. ---
**Author:** ![simroo](https://avatars.discourse-cdn.com/v4/letter/s/f475e1/32.png) [@simroo](https://discuss.elastic.co/u/simroo)\ **Post date:** [January 7, 2016, 3:24pm UTC](https://discuss.elastic.co/t/logstash-not-getting-any-syslog/38631/2 "2016-01-07T15:24:38Z")
Edit When running tcpdump -Xni eth0 port 514, I can see that i get syslog info but kibana does not show anything. ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [January 7, 2016, 6:30pm UTC](https://discuss.elastic.co/t/logstash-not-getting-any-syslog/38631/3 "2016-01-07T18:30:37Z")
Increasing Logstash's logging verbosity by starting it with `--verbose` or even `--debug` could result in useful clues in /var/log/logstash/logstash.log. ---
**Author:** ![simroo](https://avatars.discourse-cdn.com/v4/letter/s/f475e1/32.png) [@simroo](https://discuss.elastic.co/u/simroo)\ **Post date:** [January 8, 2016, 8:14am UTC](https://discuss.elastic.co/t/logstash-not-getting-any-syslog/38631/4 "2016-01-08T08:14:23Z")
## Hello I cant seem to find where i can change the logging to debug. i would think that it be /etc/logstash/conf.d but my syslog.conf is only showing : filter { if [type] == "syslog" { grok { match =\> { "message" =\> "%{SYSLOGTIMESTAMP:syslog\_timestamp} %{SYSLOGHOST:syslog\_hostname} %{DATA:syslog\_program}(?:[%{POSINT:syslog\_pid}])?: %{GREEDYDATA:syslog\_message}" } add\_field =\> ["received\_at", "%{@timestamp}"] add\_field =\> ["received\_from", "%{host}"] } syslog\_pri { } date { match =\> ["syslog\_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss"] Where can change the logging to be on debug? Thank you ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [January 8, 2016, 8:17am UTC](https://discuss.elastic.co/t/logstash-not-getting-any-syslog/38631/5 "2016-01-08T08:17:50Z")
Logstash's startup options are typically set in /etc/default/logstash or /etc/sysconfig/logstash. ---
**Author:** ![simroo](https://avatars.discourse-cdn.com/v4/letter/s/f475e1/32.png) [@simroo](https://discuss.elastic.co/u/simroo)\ **Post date:** [January 8, 2016, 8:39am UTC](https://discuss.elastic.co/t/logstash-not-getting-any-syslog/38631/6 "2016-01-08T08:39:59Z")
Hello You where correct good sir, /etc/default. I found the logstash file Iam correct to assume that i can add a level like "#level: debug" . Or is this incorrect ? # logstash logging #LS\_LOG\_FILE=/var/log/logstash/logstash.log #LS\_USE\_GC\_LOGGING="true" Thank You ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [January 8, 2016, 8:56am UTC](https://discuss.elastic.co/t/logstash-not-getting-any-syslog/38631/7 "2016-01-08T08:56:45Z")
No, uncomment and modify the LS\_OPTS variable: ``` LS_OPTS="--debug" ``` ---
**Author:** ![simroo](https://avatars.discourse-cdn.com/v4/letter/s/f475e1/32.png) [@simroo](https://discuss.elastic.co/u/simroo)\ **Post date:** [January 8, 2016, 11:44am UTC](https://discuss.elastic.co/t/logstash-not-getting-any-syslog/38631/8 "2016-01-08T11:44:11Z")
Hello I have edit the LS\_OPTS to show #LS\_OPTS="--debug" But even after restarting logstash as a services. i dont see anything in the logstash.err, logstash.log , logstash.stdout. I cant seem to find a sepreat debug log either. Have i missed something ? ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [January 8, 2016, 11:45am UTC](https://discuss.elastic.co/t/logstash-not-getting-any-syslog/38631/9 "2016-01-08T11:45:22Z")
Remove the hash; `LS_OPTS="--debug"` not `#LS_OPTS="--debug"`. Details matter! ---
**Author:** ![simroo](https://avatars.discourse-cdn.com/v4/letter/s/f475e1/32.png) [@simroo](https://discuss.elastic.co/u/simroo)\ **Post date:** [January 8, 2016, 1:13pm UTC](https://discuss.elastic.co/t/logstash-not-getting-any-syslog/38631/10 "2016-01-08T13:13:33Z")
So i got the debug running, but i cant seem to make sense of it. What do you think ? I have posted it to pastebin [http://pastebin.com/z6vPDihP](http://pastebin.com/z6vPDihP) ---
**Author:** ![simroo](https://avatars.discourse-cdn.com/v4/letter/s/f475e1/32.png) [@simroo](https://discuss.elastic.co/u/simroo)\ **Post date:** [January 15, 2016, 7:58am UTC](https://discuss.elastic.co/t/logstash-not-getting-any-syslog/38631/11 "2016-01-15T07:58:52Z")
Does anyone know ? ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 5:15am UTC](https://discuss.elastic.co/t/logstash-not-getting-any-syslog/38631/12 "2017-07-06T05:15:38Z")