# Logstash not receiving any Logs **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [February 20, 2018, 2:21pm UTC](https://discuss.elastic.co/t/logstash-not-receiving-any-logs/120661 "2018-02-20T14:21:05Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![vamshi\_krishna](https://avatars.discourse-cdn.com/v4/letter/v/c2a13f/32.png) [@vamshi\_krishna](https://discuss.elastic.co/u/vamshi_krishna)\ **Post date:** [February 20, 2018, 2:21pm UTC](https://discuss.elastic.co/t/logstash-not-receiving-any-logs/120661/1 "2018-02-20T14:21:05Z")
Hello, I have installed and configured Filebeat in Wind River Linux 5.0.1.4. And I have installed and configured ELK in Ubuntu 16.04. I am trying to access syslog from Wind River. Everything seems fine and all four configurations are running without any error and fault. But the problem is I can't see any log file receiving at Logstash. below I am adding Filebeat config file. #=========================== Filebeat prospectors ============================= filebeat.prospectors: # Each - is a prospector. Most options can be set at the prospector level, so # you can use different prospectors for various configurations. # Below are the prospector specific configurations. - type: log Thanks in Advance! ---
**Author:** ![pierhugues](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pierhugues/32/48383_2.png) [@pierhugues](https://discuss.elastic.co/u/pierhugues)\ **Post date:** [February 20, 2018, 3:24pm UTC](https://discuss.elastic.co/t/logstash-not-receiving-any-logs/120661/2 "2018-02-20T15:24:47Z")
Hello @vamshi_krishna First, when posting configuration to discuss can you use `code blocks` defined in the following example, this helps a lot with readability. ````auto ``` My code ``` ```` In your provided configured I don't see a [logstash output](https://www.elastic.co/guide/en/beats/filebeat/current/logstash-output.html) defined? Thanks ---
**Author:** ![vamshi\_krishna](https://avatars.discourse-cdn.com/v4/letter/v/c2a13f/32.png) [@vamshi\_krishna](https://discuss.elastic.co/u/vamshi_krishna)\ **Post date:** [February 20, 2018, 3:57pm UTC](https://discuss.elastic.co/t/logstash-not-receiving-any-logs/120661/3 "2018-02-20T15:57:31Z")
Hello @pierhugues Sorry for the inconvenience. Below I am adding Logstash Output from Filebeat Config ``` output.logstash: # The Logstash hosts hosts: ["192.168.100.239:5044"] bulk_max_size: 1024 # Optional SSL. By default is off. # List of root certificates for HTTPS server verifications ssl.certificate_authorities: ["/etc/pki/tls/certs/logstash-forwarder.crt"] # Certificate for SSL client authentication #ssl.certificate: "/etc/pki/client/cert.pem" # Client Certificate Key #ssl.key: "/etc/pki/client/cert.key" ``` Thanks! ---
**Author:** ![pierhugues](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pierhugues/32/48383_2.png) [@pierhugues](https://discuss.elastic.co/u/pierhugues)\ **Post date:** [February 20, 2018, 4:16pm UTC](https://discuss.elastic.co/t/logstash-not-receiving-any-logs/120661/4 "2018-02-20T16:16:55Z")
Can you also answer the following questions: - Can you Add your Logstash config? - Are there any errors in the Logstash log or the Filebeat log? ---
**Author:** ![vamshi\_krishna](https://avatars.discourse-cdn.com/v4/letter/v/c2a13f/32.png) [@vamshi\_krishna](https://discuss.elastic.co/u/vamshi_krishna)\ **Post date:** [February 21, 2018, 11:12am UTC](https://discuss.elastic.co/t/logstash-not-receiving-any-logs/120661/5 "2018-02-21T11:12:31Z")
Hi, @pierhugues below I am adding logstash- filter.conf file. ``` indent preformatted text by 4 spaces filter { if [type] == "syslog" { grok { match => { "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} % {SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: % {GREEDYDATA:syslog_message}" } add_field => ["received_at", "%{@timestamp}"] add_field => ["received_from", "%{host}"] } syslog_pri { } date { match => ["syslog_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss"] } } } ``` I have also had two other config files. I have followed [[https://www.digitalocean.com/community/tutorials/how-to-install-elasticsearch-logstash-and-kibana-elk-stack-on-ubuntu-16-04#test-filebeat-installation](https://www.digitalocean.com/community/tutorials/how-to-install-elasticsearch-logstash-and-kibana-elk-stack-on-ubuntu-16-04#test-filebeat-installation)] link to install ELk server. I have tried many times but still I am not getting logs. when I try this command, ``` curl -XGET 'http://localhost:9200/filebeat-*/_search?pretty' ``` my output is giving all 0 values. ``` pretty' { "took" : 1, "timed_out" : false, "_shards" : { "total" : 0, "successful" : 0, "failed" : 0 }, "hits" : { "total" : 0, "max_score" : 0.0, "hits" : [] } } ``` In Filebeat log,m the last line is showing ``` 2018-02-21T12:08:03.374+0100 ERROR pipeline/output.go:74 Failed to connect: dial tcp 192.168.100.239:5044: i/o timeout ``` In Logstash I am getting Connection refused error. Thanks. ---
**Author:** ![pierhugues](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pierhugues/32/48383_2.png) [@pierhugues](https://discuss.elastic.co/u/pierhugues)\ **Post date:** [February 21, 2018, 2:31pm UTC](https://discuss.elastic.co/t/logstash-not-receiving-any-logs/120661/6 "2018-02-21T14:31:23Z")
Can we get the input/output part of your Logstash configuration? ---
**Author:** ![vamshi\_krishna](https://avatars.discourse-cdn.com/v4/letter/v/c2a13f/32.png) [@vamshi\_krishna](https://discuss.elastic.co/u/vamshi_krishna)\ **Post date:** [February 22, 2018, 1:16pm UTC](https://discuss.elastic.co/t/logstash-not-receiving-any-logs/120661/7 "2018-02-22T13:16:15Z")
Logstash Input Configuration ``` input { beats { port => 5044 ssl => true ssl_certificate => "/etc/pki/tls/certs/logstash-forwarder.crt" ssl_key => "/etc/pki/tls/private/logstash-forwarder.key" } } ``` Logstash output configuration ``` filter { if [type] == "syslog" { grok { match => { "message" => "%{SYSLOGTIMESTAMP:syslog_timestamp} % {SYSLOGHOST:syslog_hostname} %{DATA:syslog_program}(?:\[%{POSINT:syslog_pid}\])?: % {GREEDYDATA:syslog_message}" } add_field => ["received_at", "%{@timestamp}"] add_field => ["received_from", "%{host}"] } syslog_pri { } date { match => ["syslog_timestamp", "MMM d HH:mm:ss", "MMM dd HH:mm:ss"] } } } ``` thanx! ---
**Author:** ![pierhugues](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pierhugues/32/48383_2.png) [@pierhugues](https://discuss.elastic.co/u/pierhugues)\ **Post date:** [February 22, 2018, 2:12pm UTC](https://discuss.elastic.co/t/logstash-not-receiving-any-logs/120661/8 "2018-02-22T14:12:03Z")
At first the configuration look fine. Lets take a few steps back to debug this issue, can you try the following: - Remove SSL from both Logstash and Filebeat - Remove the All filters from logstash Do you see any events going through? ---
**Author:** ![vamshi\_krishna](https://avatars.discourse-cdn.com/v4/letter/v/c2a13f/32.png) [@vamshi\_krishna](https://discuss.elastic.co/u/vamshi_krishna)\ **Post date:** [February 22, 2018, 4:28pm UTC](https://discuss.elastic.co/t/logstash-not-receiving-any-logs/120661/9 "2018-02-22T16:28:38Z")
I have tried as you mentioned in above comment. But it gives me error ``` curl:(7) Failed to connect to localhost port 9200: Connection refused zsh: exit 7 curl -XGET 'http://localhost:9200//filebeat-*/_search?pretty' ``` ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [March 22, 2018, 4:28pm UTC](https://discuss.elastic.co/t/logstash-not-receiving-any-logs/120661/10 "2018-03-22T16:28:44Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.