# Make log from socket listener
**URL:** https://discuss.elastic.co/t/make-log-from-socket-listener/300559
**Category:** Beats
**Tags:** filebeat
**Created:** [March 24, 2022, 10:44am UTC](https://discuss.elastic.co/t/make-log-from-socket-listener/300559 "2022-03-24T10:44:41Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@Badb0y](https://discuss.elastic.co/u/Badb0y)
#### Post date: [March 24, 2022, 10:44am UTC](https://discuss.elastic.co/t/make-log-from-socket-listener/300559/1 "2022-03-24T10:44:41Z")
Hi,
Is there a way to make a log entry with filebeat from these entries that logstash can consume?
I have entries like this
```auto
Thu Mar 24 17:34:49 +07 2022
# table: https, type: ip, size:1048576, used:0
# table: http, type: ip, size:1048576, used:2
0x55dfab70bbd0: key=10.121.91.77 use=1 exp=4281 http_req_rate(10000)=1
0x55dfab726830: key=10.121.91.88 use=7 exp=6174 http_req_rate(10000)=7
Thu Mar 24 17:34:50 +07 2022
# table: https, type: ip, size:1048576, used:0
# table: http, type: ip, size:1048576, used:2
0x55dfab70bbd0: key=10.121.91.77 use=1 exp=3268 http_req_rate(10000)=1
0x55dfab726830: key=10.121.91.88 use=8 exp=9104 http_req_rate(10000)=8
```
Somehow I'd like to have like the following, take the date, put the hostname and app name followed by the entry.
From this:
```auto
Thu Mar 24 17:34:49 +07 2022
# table: https, type: ip, size:1048576, used:0
# table: http, type: ip, size:1048576, used:2
0x55dfab70bbd0: key=10.121.91.77 use=1 exp=4281 http_req_rate(10000)=1
0x55dfab726830: key=10.121.91.88 use=7 exp=6174 http_req_rate(10000)=7
```
I'd like to have the following log entry sent by filebeat:
```auto
Thu Mar 24 17:34:49 +07 2022 hostname haproxy_rate_limit: key=10.121.91.77 use=1 exp=4281 http_req_rate(10000)=1
Thu Mar 24 17:34:49 +07 2022 hostname haproxy_rate_limit: key=10.121.91.88 use=7 exp=6174 http_req_rate(10000)=7
```
How to achieve this? Appreciate your help.
---
### Author:  [@mtojek](https://discuss.elastic.co/u/mtojek)
#### Post date: [March 24, 2022, 2:12pm UTC](https://discuss.elastic.co/t/make-log-from-socket-listener/300559/2 "2022-03-24T14:12:10Z")
I'm not sure if it isn't faster to simply modify those files on the fly to the required format. What's the source of those entries? Can you adjust the source formatting instead?
---
### Author:  [@Badb0y](https://discuss.elastic.co/u/Badb0y)
#### Post date: [March 28, 2022, 5:26am UTC](https://discuss.elastic.co/t/make-log-from-socket-listener/300559/3 "2022-03-28T05:26:58Z")
YEs, that's what I've done finally create log on the fly.
It is an haproxy listened information from socket with netcat.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [April 25, 2022, 7:27am UTC](https://discuss.elastic.co/t/make-log-from-socket-listener/300559/4 "2022-04-25T07:27:09Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.