# Lost connection in logstash forwarder when addind patterns and grok filters

**URL:** <https://discuss.elastic.co/t/lost-connection-in-logstash-forwarder-when-addind-patterns-and-grok-filters/81657>\
**Category:** Logstash\
**Created:** [April 7, 2017, 7:25pm UTC](https://discuss.elastic.co/t/lost-connection-in-logstash-forwarder-when-addind-patterns-and-grok-filters/81657 "2017-04-07T19:25:54Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![aziz\_007](https://avatars.discourse-cdn.com/v4/letter/a/ac91a4/32.png) [@aziz\_007](https://discuss.elastic.co/u/aziz_007)\
**Post date:** [April 7, 2017, 7:25pm UTC](https://discuss.elastic.co/t/lost-connection-in-logstash-forwarder-when-addind-patterns-and-grok-filters/81657/1 "2017-04-07T19:25:54Z")

</div>

i work with zimbra i have created a grok filter for mailbox.log and a pattern file

i have put the filter file called zimbra\_mailbox.conf in /etc/logstash/conf.d/  
and i have created a directory called patterns in /etc/logstash/ and puted the pattern file into it

and i made this commande chown logstash:logstash /etc/logstash/patterns/zimbra

but when i open logsatsh-forwader.err to see how the transfer of log is going but i get lost connection connection failure ☹  
could you help me please to know where is my problem

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [April 7, 2017, 11:54pm UTC](https://discuss.elastic.co/t/lost-connection-in-logstash-forwarder-when-addind-patterns-and-grok-filters/81657/2 "2017-04-07T23:54:52Z")

</div>

Logstash forwarder is no longer supported, please upgrade to filebeat.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [April 8, 2017, 12:14am UTC](https://discuss.elastic.co/t/lost-connection-in-logstash-forwarder-when-addind-patterns-and-grok-filters/81657/3 "2017-04-08T00:14:55Z")

</div>

Also, please don't post the same thing in different categories - [Lost connection when adding filter files and patterns in logstash](https://discuss.elastic.co/t/lost-connection-when-adding-filter-files-and-patterns-in-logstash/81654)

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [April 8, 2017, 12:14am UTC](https://discuss.elastic.co/t/lost-connection-in-logstash-forwarder-when-addind-patterns-and-grok-filters/81657/4 "2017-04-08T00:14:59Z")

</div>

Closed on April 8, 2017, 12:14am UTC