# Logstash parses configs but not as service

**URL:** <https://discuss.elastic.co/t/logstash-parses-configs-but-not-as-service/89440>\
**Category:** Logstash\
**Created:** [June 14, 2017, 6:49pm UTC](https://discuss.elastic.co/t/logstash-parses-configs-but-not-as-service/89440 "2017-06-14T18:49:21Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Callahan](https://avatars.discourse-cdn.com/v4/letter/c/dbc845/32.png) [@Callahan](https://discuss.elastic.co/u/Callahan)\
**Post date:** [June 14, 2017, 6:49pm UTC](https://discuss.elastic.co/t/logstash-parses-configs-but-not-as-service/89440/1 "2017-06-14T18:49:21Z")

</div>

Hi,

So this is very odd. I have a small conf file that pulls data from log file and does a little mutating, and key/value pair matching then outputs to elastic. That conf is shown below.

```
input {
      file {
        type => "log"
    	path => "C:\ELK\Import_Logs_Folder\Events.log"
    	start_position => beginning
    	sincedb_path => "/dev/null"
      }
    }

    filter {
      if [type] == "log" {
      kv {
      field_split => ";"
      trimkey => "\s"
         }
      }
      
    mutate {
    	gsub => ["UserName", "^(.*)[\\\\]", " " ]
    	remove_field => ["message"]
    	strip => ["UserName"]
    	gsub => ["ComputerIPAddress", "\r", ""]
    }
    date {
               match => ["InsertedAt", "YYYY-MM-dd HH:mm:ss"]
               target => "@timestamp"
         }
    }
    output {
    	if [type] == "sophoslog" {
        elasticsearch {
        index => "log-%{+YYYY.MM.dd}"
        hosts => ["172.16.30.12:9200"]
    	user => elastic
        password => changeme
        }
    }
    #stdout { codec => rubydebug }
    }

```

If I remove the # from stdout and run it manually, I can see the output all formatted correctly and it is inserted into Elastic. If I then put the conf file into my configs folder along with my other confs and restart the Logstash service, Logstash dumps the index into Elastic but it looks like this:

```
{
  "log-2017.06.14": {
    "aliases": {},
    "mappings": {
      "log": {
        "properties": {
          "@timestamp": {
            "type": "date"
          },
          "@version": {
            "type": "text",
            "fields": {
              "keyword": {
                "type": "keyword",
                "ignore_above": 256
              }
            }
          },
          "host": {
            "type": "text",
            "fields": {
              "keyword": {
                "type": "keyword",
                "ignore_above": 256
              }
            }
          },
          "path": {
            "type": "text",
            "fields": {
              "keyword": {
                "type": "keyword",
                "ignore_above": 256
              }
            }
          },
          "type": {
            "type": "text",
            "fields": {
              "keyword": {
                "type": "keyword",
                "ignore_above": 256
              }
            }
          }
        }
      }
    },
    "settings": {
      "index": {
        "creation_date": "1497465239325",
        "number_of_shards": "5",
        "number_of_replicas": "1",
        "uuid": "MczS4oYyQi2-lyL4XnT65A",
        "version": {
          "created": "5020299"
        },
        "provided_name": "log-2017.06.14"
      }
    }
  }
}

```

I'm at a loss as to explain why it works when run manually ( logstash -f C:\path\_to\_folder), but not as a service. It's calling the same exe....

If you have any insight, please share!

Thanks.

---

<div class="post-metadata">

**Author:** ![mick66](https://avatars.discourse-cdn.com/v4/letter/m/d2c977/32.png) [@mick66](https://discuss.elastic.co/u/mick66)\
**Post date:** [June 19, 2017, 2:50pm UTC](https://discuss.elastic.co/t/logstash-parses-configs-but-not-as-service/89440/2 "2017-06-19T14:50:57Z")

</div>

On your input filter you have:

`type => "log"`

and on your output filter you have:

`if [type] == "sophoslog" {`

These do not match therefore your output filter will not process the message and it will not get added to ES.

Change this line to:

`if [type] == "log" {`

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 17, 2017, 2:52pm UTC](https://discuss.elastic.co/t/logstash-parses-configs-but-not-as-service/89440/3 "2017-07-17T14:52:50Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.