# Logstash sending /var/log/messages to Elastic

**URL:** <https://discuss.elastic.co/t/logstash-sending-var-log-messages-to-elastic/161727>\
**Category:** Logstash\
**Created:** [December 20, 2018, 4:16pm UTC](https://discuss.elastic.co/t/logstash-sending-var-log-messages-to-elastic/161727 "2018-12-20T16:16:58Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Robert\_Fyffe](https://avatars.discourse-cdn.com/v4/letter/r/3be4f8/32.png) [@Robert\_Fyffe](https://discuss.elastic.co/u/Robert_Fyffe)\
**Post date:** [December 20, 2018, 4:16pm UTC](https://discuss.elastic.co/t/logstash-sending-var-log-messages-to-elastic/161727/1 "2018-12-20T16:16:58Z")

</div>

Hi Everyone,

I am using the following 6.x stack:

Filebeat -\> Logstash -\> Elastic -\> Kibana

I am trying to configure filebeat/logstash to send a specific logfile only to Elastic. Right now it appears to be sending everything.

When I look in Kibana I see most messages from `/var/log/messages`.

**Filebeat config:**

filebeat.inputs:

- type: log  
enabled: true  
paths:  
#- /var/log/\*.log
  - /var/log/nginx/app.access.log  
#- c:\programdata\elasticsearch\logs\*

output.logstash:  
hosts: ["localhost:5044"]  
index: logstash

**Logstash Config:**

input {  
beats {  
port =\> "5044"  
}  
}

filter {  
grok {  
match =\> {"message" =\> '%{IP:client} - %{USERNAME:username} [%{HTTPDATE:timestamp}] "(?:%{WORD:verb} %{NOTSPACE:request}(?: HTTP/%{NUMBER:httpversion})?|%{DATA:rawrequest})" %{NUMBER:response} (?:%{NUMBER:bytes}|-) %{QS:referrer} %{QS:agent} %{DATA: http\_x\_forwarded\_for} %{DATA:gzip\_ratio} rt=%{NUMBER:request\_time} uct=%{NUMBER:upstream\_connect\_time} uht=%{NUMBER:upstream\_header\_time} urt=%{NUMBER:upstream\_response\_time} %{NUMBER:user\_id}'}  
}  
grok {  
match =\> {"request" =\> "/dataset/%{NUMBER:dataset\_id}"}  
}  
kv {  
source =\> "request"  
field\_split =\> "&?"  
transform\_key =\> "lowercase"  
}  
if "/search" in [request] and [q] {  
mutate {add\_field =\> {"search\_action" =\> "search" }}  
}  
if [request] =~ "/dataset/%{NUMBER:dataset\_id}" {  
mutate {add\_field =\> {"dataset\_id" =\> dataset\_id}}  
}  
mutate {  
convert =\> {  
"user\_id" =\> "integer"  
"dataset\_id" =\> "integer"  
}  
}  
}

output {  
elasticsearch {  
codec =\> "json"  
hosts =\> ["127.0.0.1:9200"]  
}  
stdout { codec =\> rubydebug }  
}

With this configuration I should only be getting `/var/log/nginx/app.access.log` data sent to elastic?

Within Kibana I see all activity from multiple log files:

/var/log/messages  
/var/log/secure

Any ideas why this happening as I can't really find any solutions to this?

Thanks

---

<div class="post-metadata">

**Author:** ![AquaX](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/aquax/32/92006_2.png) [@AquaX](https://discuss.elastic.co/u/AquaX)\
**Post date:** [January 3, 2019, 3:41pm UTC](https://discuss.elastic.co/t/logstash-sending-var-log-messages-to-elastic/161727/2 "2019-01-03T15:41:48Z")

</div>

Have you restarted beats since making that configuration change?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [January 31, 2019, 3:41pm UTC](https://discuss.elastic.co/t/logstash-sending-var-log-messages-to-elastic/161727/3 "2019-01-31T15:41:56Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.