# My ZXTM logs not shipping to Elastic Search From Logstash
**URL:** https://discuss.elastic.co/t/my-zxtm-logs-not-shipping-to-elastic-search-from-logstash/94945
**Category:** Logstash
**Created:** [July 28, 2017, 11:47am UTC](https://discuss.elastic.co/t/my-zxtm-logs-not-shipping-to-elastic-search-from-logstash/94945 "2017-07-28T11:47:21Z")
**Posts on this page:** 7
**Page:** 1
### Author:  [@kolli\_dilip](https://discuss.elastic.co/u/kolli_dilip)
#### Post date: [July 28, 2017, 11:47am UTC](https://discuss.elastic.co/t/my-zxtm-logs-not-shipping-to-elastic-search-from-logstash/94945/1 "2017-07-28T11:47:21Z")
Dear All,
Can some one help me to resolve the issue, where the ZXTM logs are not being shipped to ES.
The logstash config is as below
input
{
file
{
type =\> "ZXTMLogs"
path =\>["F:/UKBlogsstachconfiguration/Logstobestached/ZTMLogpath/\*"]
start\_position =\> beginning
sincedb\_path =\> "F:/logstash-5.5.0/bin/.sincedb"
sincedb\_write\_interval =\> 10
sindex.refresh\_interval =\> 30s
```
}
```
}
filter
{
# Include ZXTM Foramts Below
if [type] in ["ZXTMLogs", "SecureBusinessPage-IISLogs"]
{
grok
{
match =\> ["message", "(?:%{NUMBER:totalTimeTakenForClient:float}|-) (?:%{IP:clientIpAddress}|-) (?:[%{HTTPDATE:requestTimestamp:datetime}]|-) (?:%{NOTSPACE:VirtualServer}|-) (?:%{HOSTNAME:Domain}|-) (?:%{NOTSPACE:SoapAction}|-) (?:%{WORD:httpmethod}|-) (?:%{URIPATHPARAM:uriPathWithParam}|-) (?:%{NUMBER:httpResponse:int}|-) (?:%{NUMBER:bytesReceivedFromClient:int}|-) (?:%{NUMBER:bytesSentToClient:int}|-) (?:%{NUMBER:timeTakenToConstructResponse:float}|-) (?:%{IP:Connected\_Server}:%{POSINT:ConnectedServerPort}|%{HOSTNAME:Connected\_Server}:%{POSINT:ConnectedServerPort}|-) (?:%{NOTSPACE:ApplicationPool}|-) (?:%{IP:SessionServer}:%{POSINT:Sessionserverport}|%{HOSTNAME:SessionServer}:%{POSINT:Sessionserverport}|-)"]
}
```
}
```
}
output
{
if (!("\_grokparsefailure" in [tags]))
{
```
elasticsearch
{
hosts => ["localhost:9200"]
}
}
```
}
the folder structure is as below
Directory of F:\logstash-5.5.0
28/07/2017 12:09 bin
28/07/2017 12:08 config
F:\logstash-5.5.0\bin\>dir
Volume in drive F is New Volume
Volume Serial Number is 56AD-3436
Directory of F:\logstash-5.5.0\bin
07/07/2017 22:11 38,647,169 .sincedb
30/06/2017 23:56 373 cpdump
30/06/2017 23:56 155 [ingest-convert.sh](http://ingest-convert.sh)
30/06/2017 23:56 1,949 logstash
30/06/2017 23:56 448 logstash-plugin
30/06/2017 23:56 251 logstash-plugin.b
30/06/2017 23:56 677 logstash.bat
30/06/2017 23:56 5,400 [logstash.lib.sh](http://logstash.lib.sh)
30/06/2017 23:56 840 ruby
30/06/2017 23:56 2,795 setup.bat
30/06/2017 23:56 3,530 system-install
F:\logstash-5.5.0\config\>dir
Volume in drive F is New Volume
Volume Serial Number is 56AD-3436
Directory of F:\logstash-5.5.0\config
30/06/2017 23:56 1,809 jvm.options
30/06/2017 23:56 3,958 log4j2.properties
28/07/2017 12:37 1,293 logstash.conf
07/07/2016 08:41 44 run.bat
30/06/2017 23:56 1,702 startup.options
I have installed Logstash service with nssm, with the service pointing to run.bat in the config folder
Thanks
---
### Author:  [@kolli\_dilip](https://discuss.elastic.co/u/kolli_dilip)
#### Post date: [July 30, 2017, 5:53pm UTC](https://discuss.elastic.co/t/my-zxtm-logs-not-shipping-to-elastic-search-from-logstash/94945/2 "2017-07-30T17:53:20Z")
Can any one help
me here please
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [July 31, 2017, 5:13am UTC](https://discuss.elastic.co/t/my-zxtm-logs-not-shipping-to-elastic-search-from-logstash/94945/3 "2017-07-31T05:13:41Z")
The first step is to add a stdout and make sure they are making it through the pipeline.
---
### Author:  [@kolli\_dilip](https://discuss.elastic.co/u/kolli_dilip)
#### Post date: [July 31, 2017, 10:42am UTC](https://discuss.elastic.co/t/my-zxtm-logs-not-shipping-to-elastic-search-from-logstash/94945/4 "2017-07-31T10:42:59Z")
Hi
I have tried it and they are showing up on the Console
---
### Author:  [@warkolm](https://discuss.elastic.co/u/warkolm)
#### Post date: [July 31, 2017, 9:29pm UTC](https://discuss.elastic.co/t/my-zxtm-logs-not-shipping-to-elastic-search-from-logstash/94945/5 "2017-07-31T21:29:41Z")
Ok, now check Elasticsearch to see what indices have been created. `_cat/indices` is good for that.
---
### Author:  [@kolli\_dilip](https://discuss.elastic.co/u/kolli_dilip)
#### Post date: [August 4, 2017, 11:58am UTC](https://discuss.elastic.co/t/my-zxtm-logs-not-shipping-to-elastic-search-from-logstash/94945/6 "2017-08-04T11:58:12Z")
Hurray, its done
Indexes are created
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [September 1, 2017, 11:58am UTC](https://discuss.elastic.co/t/my-zxtm-logs-not-shipping-to-elastic-search-from-logstash/94945/7 "2017-09-01T11:58:19Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.