# N00b: E on bro problem

**URL:** <https://discuss.elastic.co/t/n00b-e-on-bro-problem/78262>\
**Category:** Logstash\
**Created:** [March 11, 2017, 11:52pm UTC](https://discuss.elastic.co/t/n00b-e-on-bro-problem/78262 "2017-03-11T23:52:24Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![randy](https://avatars.discourse-cdn.com/v4/letter/r/2acd7d/32.png) [@randy](https://discuss.elastic.co/u/randy)\
**Post date:** [March 11, 2017, 11:52pm UTC](https://discuss.elastic.co/t/n00b-e-on-bro-problem/78262/1 "2017-03-11T23:52:24Z")

</div>

ubuntu 16.04, following recipe in  
[https://git.rg.net/randy/randy/src/master/ELK-stack.md](https://git.rg.net/randy/randy/src/master/ELK-stack.md)

```auto
# /usr/share/logstash/bin/logstash -e
output {
  stdout {}
}
WARNING: Could not find logstash.yml which is typically located in $LS_HOME/config or /etc/logstash. You can specify the path using --path.settings. Continuing using the defaults
Could not find log4j2 configuration at path /usr/share/logstash/config/log4j2.properties. Using default config which logs to console
ERROR: No configuration file was specified. Perhaps you forgot to provide the '-f yourlogstash.conf' flag?
usage:
  bin/logstash -f CONFIG_PATH [-t] [-r] [] [-w COUNT] [-l LOG]
  bin/logstash -e CONFIG_STR [-t] [--log.level fatal|error|warn|info|debug|trace] [-w COUNT] [-l LOG]
  bin/logstash -i SHELL [--log.level fatal|error|warn|info|debug|trace]
  bin/logstash -V [--log.level fatal|error|warn|info|debug|trace]
  bin/logstash --help

```

and yet

```auto
# ls -la /etc/logstash
total 32
drwxrwxr-x 3 root root 4096 Mar 10 23:45 ./
drwxr-xr-x 107 root root 4096 Mar 11 00:27 ../
drwxrwxr-x 2 root root 4096 Mar 10 23:55 conf.d/
-rw-rw-r-- 1 root root 1738 Feb 24 17:41 jvm.options
-rw-rw-r-- 1 root root 1334 Feb 24 17:41 log4j2.properties
-rw-rw-r-- 1 root root 4487 Mar 10 23:45 logstash.yml
-rw-rw-r-- 1 root root 1659 Feb 24 17:41 startup.options

```

clue bat please

randy

---

<div class="post-metadata">

**Author:** ![theuntergeek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/theuntergeek/32/44961_2.png) [@theuntergeek](https://discuss.elastic.co/u/theuntergeek)\
**Post date:** [March 12, 2017, 12:13am UTC](https://discuss.elastic.co/t/n00b-e-on-bro-problem/78262/2 "2017-03-12T00:13:46Z")

</div>

If you installed via APT/DEB package, then you probably need to add `--path.settings /etc/logstash`

This is because the -e flag does some funny stuff under the hood. Beware of 3rd party configuration examples. Otherwise, try putting your test configuration in an actual configuration file and use the -f flag.

---

<div class="post-metadata">

**Author:** ![randy](https://avatars.discourse-cdn.com/v4/letter/r/2acd7d/32.png) [@randy](https://discuss.elastic.co/u/randy)\
**Post date:** [March 12, 2017, 5:09am UTC](https://discuss.elastic.co/t/n00b-e-on-bro-problem/78262/3 "2017-03-12T05:09:51Z")

</div>

thank you! but that gets me to

```auto
[2017-03-12T05:03:27,411][ERROR][logstash.filters.geoip] IP Field contained invalid IP address or hostname {:exception=>java.net.UnknownHostException: -, :field=>"id.resp_h", :event=>2017-03-12T05:03:19.225Z bro0.dfw.rg.net 1489294999.225140 - - - - - unknown_protocol_112 - Fworker-0}

```

do i also need to tell it where the filters are in `/etc/logstash/conf.d/`?

indeed, i used apt. so is it safe to presume that the logstash started by systemdeath does not need this parameterization if i used all the default locations?

---

<div class="post-metadata">

**Author:** ![theuntergeek](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/theuntergeek/32/44961_2.png) [@theuntergeek](https://discuss.elastic.co/u/theuntergeek)\
**Post date:** [March 12, 2017, 6:05am UTC](https://discuss.elastic.co/t/n00b-e-on-bro-problem/78262/4 "2017-03-12T06:05:54Z")

</div>

I can't see the GeoIP filter in your configuration. But it is clear that `bro0.dfw.rg.net` does not resolve to an IP that the GeoIP plugin recognizes. That seems to be what the message says.

---

<div class="post-metadata">

**Author:** ![randy](https://avatars.discourse-cdn.com/v4/letter/r/2acd7d/32.png) [@randy](https://discuss.elastic.co/u/randy)\
**Post date:** [March 12, 2017, 9:05am UTC](https://discuss.elastic.co/t/n00b-e-on-bro-problem/78262/5 "2017-03-12T09:05:15Z")

</div>

i believe that am using the bro/logstash log filters from [http://www.505forensics.com](http://www.505forensics.com). i just put the one to process the conn.log up at [https://archive.psg.com/bro-conn\_log.conf](https://archive.psg.com/bro-conn_log.conf)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 9, 2017, 9:05am UTC](https://discuss.elastic.co/t/n00b-e-on-bro-problem/78262/6 "2017-04-09T09:05:26Z")

</div>

Closed on April 9, 2017, 9:05am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.