# Logstash not parsing logs

**URL:** https://discuss.elastic.co/t/logstash-not-parsing-logs/90148
**Category:** Logstash
**Created:** [June 20, 2017, 7:08pm UTC](https://discuss.elastic.co/t/logstash-not-parsing-logs/90148 "2017-06-20T19:08:21Z")
**Posts on this page:** 3
**Page:** 1

<div class="post-metadata">

### Author: ![vgupta0308](https://avatars.discourse-cdn.com/v4/letter/v/dc4da7/32.png) [@vgupta0308](https://discuss.elastic.co/u/vgupta0308)
#### Post date: [June 20, 2017, 7:08pm UTC](https://discuss.elastic.co/t/logstash-not-parsing-logs/90148/1 "2017-06-20T19:08:21Z")

</div>

Hello,

We have created the Logstash config for parsing the bro ids logs which is not working. Below is the output of log file:

[2017-06-20T17:25:16,966][WARN][logstash.outputs.elasticsearch] Restored connection to ES instance {:url=\>#\<URI::HTTP:0x7be6d418 URL:[http://localhost:9220/](http://localhost:9220/)\>}  
[2017-06-20T17:25:16,969][INFO][logstash.outputs.elasticsearch] Using mapping template from {:path=\>nil}  
[2017-06-20T17:25:17,014][INFO][logstash.outputs.elasticsearch] Attempting to install template {:manage\_template=\>{"template"=\>"logstash-_", "version"=\>50001, "settings"=\>{"index.refresh\_interval"=\>"5s"}, "mappings"=\>{"default"=\>{"\_all"=\>{"enabled"=\>true, "norms"=\>false}, "dynamic\_templates"=\>[{"message\_field"=\>{"path\_match"=\>"message", "match\_mapping\_type"=\>"string", "mapping"=\>{"type"=\>"text", "norms"=\>false}}}, {"string\_fields"=\>{"match"=\>"_", "match\_mapping\_type"=\>"string", "mapping"=\>{"type"=\>"text", "norms"=\>false, "fields"=\>{"keyword"=\>{"type"=\>"keyword"}}}}}], "properties"=\>{"@timestamp"=\>{"type"=\>"date", "include\_in\_all"=\>false}, "@version"=\>{"type"=\>"keyword", "include\_in\_all"=\>false}, "geoip"=\>{"dynamic"=\>true, "properties"=\>{"ip"=\>{"type"=\>"ip"}, "location"=\>{"type"=\>"geo\_point"}, "latitude"=\>{"type"=\>"half\_float"}, "longitude"=\>{"type"=\>"half\_float"}}}}}}}}  
[2017-06-20T17:25:17,018][INFO][logstash.outputs.elasticsearch] New Elasticsearch output {:class=\>"LogStash::Outputs::ElasticSearch", :hosts=\>[#\<URI::Generic:0x758a9fe0 URL://localhost:9220\>]}  
[2017-06-20T17:25:17,214][INFO][logstash.pipeline] Starting pipeline {"id"=\>"main", "pipeline.workers"=\>8, "pipeline.batch.size"=\>125, "pipeline.batch.delay"=\>5, "pipeline.max\_inflight"=\>1000}  
[2017-06-20T17:25:17,481][INFO][logstash.pipeline] Pipeline main started  
[2017-06-20T17:25:17,528][INFO][logstash.agent] Successfully started Logstash API endpoint {:port=\>9600}

The Logs are being parsed if we use the following command:

/usr/share/logstash/bin/logstash -f /etc/logstash/conf.d/ --path.settings /etc/logstash --debug

The Logstash version is 5.3 and log in through root user. We are not using filebeat here. Simply, using input file where the path of the file is stated.

Please assist.

Thanks,

Vinay Gupta

---

<div class="post-metadata">

### Author: ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [June 21, 2017, 6:15am UTC](https://discuss.elastic.co/t/logstash-not-parsing-logs/90148/2 "2017-06-21T06:15:51Z")

</div>

Does the logstash user have permission to access the log files? If you increase the logging verbosity you'll get clues about this. Look for "discover" or "glob" in the log.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 19, 2017, 6:15am UTC](https://discuss.elastic.co/t/logstash-not-parsing-logs/90148/3 "2017-07-19T06:15:58Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.