# Monitor inactivity in log files **URL:** \ **Category:** Logstash\ **Created:** [May 20, 2016, 6:56pm UTC](https://discuss.elastic.co/t/monitor-inactivity-in-log-files/50597 "2016-05-20T18:56:17Z")\ **Posts on this page:** 16\ **Page:** 1
**Author:** ![vikas\_J](https://avatars.discourse-cdn.com/v4/letter/v/7ba0ec/32.png) [@vikas\_J](https://discuss.elastic.co/u/vikas_J)\ **Post date:** [May 20, 2016, 6:56pm UTC](https://discuss.elastic.co/t/monitor-inactivity-in-log-files/50597/1 "2016-05-20T18:56:17Z")
I have certain log files being monitored through ELK stack using filbebeat to send files to log stash. Suppose if the server is down and the logs are no longer being written, i want to monitor the same. Is there some way to do the same using log stash , such that if there are no events being generated by log stash say for last 1 hour, then generate an alert ---
**Author:** ![vikas\_J](https://avatars.discourse-cdn.com/v4/letter/v/7ba0ec/32.png) [@vikas\_J](https://discuss.elastic.co/u/vikas_J)\ **Post date:** [May 21, 2016, 12:35am UTC](https://discuss.elastic.co/t/monitor-inactivity-in-log-files/50597/2 "2016-05-21T00:35:31Z")
Any help appreciated. Can logstash generate a dummy event if it doesnt receive any new records from filebeat after a period of time? ---
**Author:** ![theuntergeek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/theuntergeek/32/44961_2.png) [@theuntergeek](https://discuss.elastic.co/u/theuntergeek)\ **Post date:** [May 21, 2016, 1:52am UTC](https://discuss.elastic.co/t/monitor-inactivity-in-log-files/50597/3 "2016-05-21T01:52:22Z")
Have you looked at the heartbeat input plugin? ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [May 21, 2016, 5:45pm UTC](https://discuss.elastic.co/t/monitor-inactivity-in-log-files/50597/4 "2016-05-21T17:45:17Z")
Logstash can alert and take action on the presence of events but not on the absence of them. I'd use [Lovebeat](https://github.com/boivie/lovebeat) for this. ---
**Author:** ![vikas\_J](https://avatars.discourse-cdn.com/v4/letter/v/7ba0ec/32.png) [@vikas\_J](https://discuss.elastic.co/u/vikas_J)\ **Post date:** [May 23, 2016, 1:39pm UTC](https://discuss.elastic.co/t/monitor-inactivity-in-log-files/50597/5 "2016-05-23T13:39:03Z")
So If i use love beat with filbebeat and log stash, filbebeat will have to send two outputs right? One to love beat and another to log stash ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [May 23, 2016, 1:40pm UTC](https://discuss.elastic.co/t/monitor-inactivity-in-log-files/50597/6 "2016-05-23T13:40:09Z")
I don't think you can connect Filebeat to Lovebeat, but you can definitely hook up Logstash to Lovebeat. ---
**Author:** ![vikas\_J](https://avatars.discourse-cdn.com/v4/letter/v/7ba0ec/32.png) [@vikas\_J](https://discuss.elastic.co/u/vikas_J)\ **Post date:** [May 23, 2016, 1:46pm UTC](https://discuss.elastic.co/t/monitor-inactivity-in-log-files/50597/7 "2016-05-23T13:46:13Z")
Ok cool..thanks..let me try it out ---
**Author:** ![vikas\_J](https://avatars.discourse-cdn.com/v4/letter/v/7ba0ec/32.png) [@vikas\_J](https://discuss.elastic.co/u/vikas_J)\ **Post date:** [May 23, 2016, 2:30pm UTC](https://discuss.elastic.co/t/monitor-inactivity-in-log-files/50597/8 "2016-05-23T14:30:38Z")
I have love beat running in localhost 8127 port. Modified log stash output conf file as: output { elasticsearch { hosts =\> ["localhost:9200"] sniffing =\> true manage\_template =\> false index =\> "%{[@metadata][beat]}-%{+YYYY.MM.dd}" document\_type =\> "%{[@metadata][type]}" } statsd { host =\> "localhost" port =\> "8127" count =\> { "http.bytes" =\> "%{bytes}" } } } Output is being sent to elastic search running at 9200. However love beat isn't receiving any information on port 8127. Any idea where is the issue ---
**Author:** ![vikas\_J](https://avatars.discourse-cdn.com/v4/letter/v/7ba0ec/32.png) [@vikas\_J](https://discuss.elastic.co/u/vikas_J)\ **Post date:** [May 23, 2016, 3:55pm UTC](https://discuss.elastic.co/t/monitor-inactivity-in-log-files/50597/9 "2016-05-23T15:55:39Z")
Any help? ---
**Author:** ![vikas\_J](https://avatars.discourse-cdn.com/v4/letter/v/7ba0ec/32.png) [@vikas\_J](https://discuss.elastic.co/u/vikas_J)\ **Post date:** [May 23, 2016, 3:56pm UTC](https://discuss.elastic.co/t/monitor-inactivity-in-log-files/50597/10 "2016-05-23T15:56:54Z")
On manually sending data to love beat, its receiving it: echo "logstash.health:1|c" | nc -4u -w0 localhost 8127 However the statsd output send by log stash is not reaching love beat ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [May 23, 2016, 4:28pm UTC](https://discuss.elastic.co/t/monitor-inactivity-in-log-files/50597/11 "2016-05-23T16:28:49Z")
> Any help? Jeez, have patience. > On manually sending data to love beat, its receiving it: > echo "logstash.health:1|c" | nc -4u -w0 localhost 8127 > However the statsd output send by log stash is not reaching love beat Any clues in the Logstash logs? What if you crank if the log level by starting it with `--debug`? ---
**Author:** ![vikas\_J](https://avatars.discourse-cdn.com/v4/letter/v/7ba0ec/32.png) [@vikas\_J](https://discuss.elastic.co/u/vikas_J)\ **Post date:** [May 23, 2016, 5:17pm UTC](https://discuss.elastic.co/t/monitor-inactivity-in-log-files/50597/12 "2016-05-23T17:17:48Z")
Sorry about that. I managed to get data to love beat by changing host to "127.0.0.1" For a service, log stash.monitor, i assigned timeout of 10s and it changes state after 10s to error as expected. 2016/05/23 14:10:45 INFO SERVICE 'logstash.monitor', state ok -\> error However, the alarm i configured against the service pattern isn't getting triggered.Any clue why? [[alarms]] name = "example" pattern = "logstash.\*" [[alarms.alerts]] script = "/home/user/test\_alarm.sh" ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [May 23, 2016, 7:42pm UTC](https://discuss.elastic.co/t/monitor-inactivity-in-log-files/50597/13 "2016-05-23T19:42:18Z")
I have no idea OTOH. Is there nothing at all in the Lovebeat logs about the script execution? Does it work if you configure an email alert instead of a script alert? ---
**Author:** ![boivie](https://avatars.discourse-cdn.com/v4/letter/b/ecae2f/32.png) [@boivie](https://discuss.elastic.co/u/boivie)\ **Post date:** [May 23, 2016, 8:48pm UTC](https://discuss.elastic.co/t/monitor-inactivity-in-log-files/50597/14 "2016-05-23T20:48:06Z")
The syntax you specified looks good for version 1.0.0-rc5. Please check that your script is executable (chmod a+x test\_alarm.sh) and that it contains a valid interpreter as its first line (#!/bin/bash or similar). Also check that lovebeat doesn't show any errors on startup when parsing your configuration file. The lovebeat configuration syntax is changing a bit as it's getting ready for version 1.0 (and then it really will be final), so already in 1.0.0-rc6 (due tomorrow) it will be like this instead: ``` [[alarms]] name = "test-$name" pattern = "test.$name.*" alerts = ["to-slack", "run-my-script"] [alerts.to-slack] slack_channel = "#ops" [alerts.run-my-script] script = "/path/to/script.sh" ``` If you still have any issues, please open up an issue on the lovebeat github page, thanks! ---
**Author:** ![vikas\_J](https://avatars.discourse-cdn.com/v4/letter/v/7ba0ec/32.png) [@vikas\_J](https://discuss.elastic.co/u/vikas_J)\ **Post date:** [May 23, 2016, 11:03pm UTC](https://discuss.elastic.co/t/monitor-inactivity-in-log-files/50597/15 "2016-05-23T23:03:15Z")
Thanks victor ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 4:56am UTC](https://discuss.elastic.co/t/monitor-inactivity-in-log-files/50597/16 "2017-07-06T04:56:34Z")