# Logstash not parsing

**URL:** https://discuss.elastic.co/t/logstash-not-parsing/88223
**Category:** Logstash
**Created:** [June 5, 2017, 5:49am UTC](https://discuss.elastic.co/t/logstash-not-parsing/88223 "2017-06-05T05:49:25Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![tomer](https://avatars.discourse-cdn.com/v4/letter/t/41988e/32.png) [@tomer](https://discuss.elastic.co/u/tomer)
#### Post date: [June 5, 2017, 5:49am UTC](https://discuss.elastic.co/t/logstash-not-parsing/88223/1 "2017-06-05T05:49:25Z")

</div>

After building a new machine of Logstash and copying the same exact "filter" used in the last machine with Logstash. From some reason Logstash is not parsing the logs correctly.

Info:  
Filebeat is sending three types of logs 2 of them are not in json form to whom I expect Logstash to send them as raw material to ES. While one log type is by Json format which I expect Logstash to parse it.

The result of my LS in the ES is:

![](https://us1.discourse-cdn.com/elastic/original/3X/8/a/8a04e0dc20980bb75db3cfa0ce78b3dc32e95352.png)

While the terms in message (underlined) should be by there self terms.

Here is my LogStash config file in /etc/logstash/conf.d (called 02-beats-input.conf)

```
input {
  beats {
    port => 5044
  }
}

filter {
  date {
    match => ["msgSubmissionTime", "UNIX_MS"]
    target => "msgSubmissionTime"
  }
  date {
    match => ["msgDeliveryTime", "UNIX_MS"]
    target => "msgDeliveryTime"
  }
  date {
    match => ["eventTs", "UNIX_MS"]
    target => "eventTs"
  }

  mutate {
    convert => {
        "concatenated" => "boolean"
        "msgLength" => "integer"
      }
   }

}

output {
  elasticsearch {
    hosts => ["192.168.1.116:9200"]
    manage_template => false
    index => "%{[@metadata][beat]}-%{+YYYY.MM.dd}"
    document_type => "%{[@metadata][type]}"
  }
}

```

I installed the mutate and date plugin.

I also deleted the index in ES and restarted ES

Any help will be greatly helpful!

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 3, 2017, 5:49am UTC](https://discuss.elastic.co/t/logstash-not-parsing/88223/2 "2017-07-03T05:49:30Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.