# Logstash proftpd log **URL:** \ **Category:** Logstash\ **Created:** [February 22, 2016, 10:58am UTC](https://discuss.elastic.co/t/logstash-proftpd-log/42378 "2016-02-22T10:58:17Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![ismael\_boumedien](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ismael_boumedien/32/5331_2.png) [@ismael\_boumedien](https://discuss.elastic.co/u/ismael_boumedien)\ **Post date:** [February 22, 2016, 10:58am UTC](https://discuss.elastic.co/t/logstash-proftpd-log/42378/1 "2016-02-22T10:58:17Z")
Hi guys, I'm working on logstash and I want to send proftpd and sftp logs to elasticsearch. But I'm facing some issues with doing that. No index is genreated in ES. Can any one help me 🙂 File conf: #input { # file { # 'path' =\> ['/var/log/proftpd/sftp.log'] # 'type' =\> 'system logs' # } #} input { file { type =\> "proftpd-common" path =\> "/var/log/proftpd/\*log" } } filter { if [type] == 'proftpd-common' { grok { match =\> [ "message", "%{IPORHOST:clientip} %{WORD:indent} %{USER:ftpuser} [%{HTTPDATE:timestamp}] "%{WORD:command}(?:%{SPACE}%{DATA:request}|%{SPACE})" (?:%{NUMBER:response}|-) (?:%{NUMBER:bytes}|-)" ] } ``` date { match => ["timestamp" , "dd/MMM/YYYY:HH:mm:ss Z"] } } ``` } output { elasticsearch { codec =\> json hosts =\> "localhost:9200" index =\> "logstash" } } ![](https://us1.discourse-cdn.com/elastic/original/2X/3/3b1a17baa0f13e42af54e6caca371c2674ddc359.jpg) ---
**Author:** ![Sergey\_Grigorov](https://avatars.discourse-cdn.com/v4/letter/s/ecb155/32.png) [@Sergey\_Grigorov](https://discuss.elastic.co/u/Sergey_Grigorov)\ **Post date:** [February 22, 2016, 11:09am UTC](https://discuss.elastic.co/t/logstash-proftpd-log/42378/2 "2016-02-22T11:09:40Z")
Try to add index in the following format: index =\> "logstash-test-%{+YYYY.MM.dd}" ---
**Author:** ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)\ **Post date:** [February 22, 2016, 11:20am UTC](https://discuss.elastic.co/t/logstash-proftpd-log/42378/3 "2016-02-22T11:20:36Z")
> [@ismael\_boumedien](#): > > elasticsearch { codec =\> json hosts =\> "localhost:9200" index =\> "logstash" } There should not be any JSON codec within the Elasticsearch output plugin, as it converts the event to JSON automatically. ---
**Author:** ![ismael\_boumedien](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ismael_boumedien/32/5331_2.png) [@ismael\_boumedien](https://discuss.elastic.co/u/ismael_boumedien)\ **Post date:** [February 22, 2016, 12:08pm UTC](https://discuss.elastic.co/t/logstash-proftpd-log/42378/4 "2016-02-22T12:08:32Z")
> [@Christian\_Dahlqvist](#): > > elasticsearch { codec =\> json hosts =\> "localhost:9200" index =\> "logstash" } Thanks guys I'm testing right now 🙂 ---
**Author:** ![ismael\_boumedien](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ismael_boumedien/32/5331_2.png) [@ismael\_boumedien](https://discuss.elastic.co/u/ismael_boumedien)\ **Post date:** [February 22, 2016, 12:39pm UTC](https://discuss.elastic.co/t/logstash-proftpd-log/42378/5 "2016-02-22T12:39:42Z")
Hi, I made some tests and I have the same issue. **_I have this message:_** Using mapping template from {:path=\>nil, :level=\>:info} Attempting to install template {:manage\_template=\>{"template"=\>"logstash-_", "settings"=\>{"index.refresh\_interval"=\>"5s"}, "mappings"=\>{"default"=\>{"\_all"=\>{"enabled"=\>true, "omit\_norms"=\>true}, "dynamic\_templates"=\>[{"message\_field"=\>{"match"=\>"message", "match\_mapping\_type"=\>"string", "mapping"=\>{"type"=\>"string", "index"=\>"analyzed", "omit\_norms"=\>true, "fielddata"=\>{"format"=\>"disabled"}}}}, {"string\_fields"=\>{"match"=\>"_", "match\_mapping\_type"=\>"string", "mapping"=\>{"type"=\>"string", "index"=\>"analyzed", "omit\_norms"=\>true, "fielddata"=\>{"format"=\>"disabled"}, "fields"=\>{"raw"=\>{"type"=\>"string", "index"=\>"not\_analyzed", "doc\_values"=\>true, "ignore\_above"=\>256}}}}}, {"float\_fields"=\>{"match"=\>"_", "match\_mapping\_type"=\>"float", "mapping"=\>{"type"=\>"float", "doc\_values"=\>true}}}, {"double\_fields"=\>{"match"=\>"_", "match\_mapping\_type"=\>"double", "mapping"=\>{"type"=\>"double", "doc\_values"=\>true}}}, {"byte\_fields"=\>{"match"=\>"_", "match\_mapping\_type"=\>"byte", "mapping"=\>{"type"=\>"byte", "doc\_values"=\>true}}}, {"short\_fields"=\>{"match"=\>"_", "match\_mapping\_type"=\>"short", "mapping"=\>{"type"=\>"short", "doc\_values"=\>true}}}, {"integer\_fields"=\>{"match"=\>"_", "match\_mapping\_type"=\>"integer", "mapping"=\>{"type"=\>"integer", "doc\_values"=\>true}}}, {"long\_fields"=\>{"match"=\>"_", "match\_mapping\_type"=\>"long", "mapping"=\>{"type"=\>"long", "doc\_values"=\>true}}}, {"date\_fields"=\>{"match"=\>"_", "match\_mapping\_type"=\>"date", "mapping"=\>{"type"=\>"date", "doc\_values"=\>true}}}, {"geo\_point\_fields"=\>{"match"=\>"_", "match\_mapping\_type"=\>"geo\_point", "mapping"=\>{"type"=\>"geo\_point", "doc\_values"=\>true}}}], "properties"=\>{"@timestamp"=\>{"type"=\>"date", "doc\_values"=\>true}, "@version"=\>{"type"=\>"string", "index"=\>"not\_analyzed", "doc\_values"=\>true}, "geoip"=\>{"type"=\>"object", "dynamic"=\>true, "properties"=\>{"ip"=\>{"type"=\>"ip", "doc\_values"=\>true}, "location"=\>{"type"=\>"geo\_point", "doc\_values"=\>true}, "latitude"=\>{"type"=\>"float", "doc\_values"=\>true}, "longitude"=\>{"type"=\>"float", "doc\_values"=\>true}}}}}}}, :level=\>:info} Best regards Ismael ---
**Author:** ![ismael\_boumedien](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ismael_boumedien/32/5331_2.png) [@ismael\_boumedien](https://discuss.elastic.co/u/ismael_boumedien)\ **Post date:** [February 23, 2016, 7:41am UTC](https://discuss.elastic.co/t/logstash-proftpd-log/42378/6 "2016-02-23T07:41:54Z")
Hi guys, Thanks for your help. I solved the issue, it's related to my filter and didn't add start\_position =\> "beginning" in the input file. Have a nice day. Best regards Ismael ---
**Author:** ![quimnuss](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/quimnuss/32/9992_2.png) [@quimnuss](https://discuss.elastic.co/u/quimnuss)\ **Post date:** [June 15, 2017, 9:49am UTC](https://discuss.elastic.co/t/logstash-proftpd-log/42378/7 "2017-06-15T09:49:57Z")
Do you mind sharing your proftpd ELK config files with the community? ---
**Author:** ![ismael\_boumedien](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ismael_boumedien/32/5331_2.png) [@ismael\_boumedien](https://discuss.elastic.co/u/ismael_boumedien)\ **Post date:** [June 15, 2017, 1:00pm UTC](https://discuss.elastic.co/t/logstash-proftpd-log/42378/8 "2017-06-15T13:00:56Z")
Hi, input { file { path =\> "/var/log/proftpd/sftp-xferlog" start\_position =\> "beginning" } } filter { grok { match =\> ["message", "(?\w{3} \w{3} \d{2} \d{2}:\d{2}:\d{2} \d{4}) (?\d\*) (?\b\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3}\b) (?\d\*) (?\S\*) (?[a|b]) (?\S{1}) (?\S{1}) (?\S{1}) (?\S\*) (?\S\*) (?\S\*) (?\S\*) (?\S\*)" ] } ``` date { match => ["time", "EEE MMM dd HH:mm:ss YYYY"] timezone => ["Europe/Paris"] # Change to your local timezone } geoip { source => ["remoteHost"] } ``` } output { elasticsearch { hosts =\> "localhost:9200" index =\> "mft\_r7" } stdout {} } Best regards Ismael ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [November 4, 2022, 4:15am UTC](https://discuss.elastic.co/t/logstash-proftpd-log/42378/9 "2022-11-04T04:15:00Z")