# Need advice on AWS logs indexing using logstash **URL:** \ **Category:** Logstash\ **Created:** [January 7, 2016, 6:57pm UTC](https://discuss.elastic.co/t/need-advice-on-aws-logs-indexing-using-logstash/38667 "2016-01-07T18:57:48Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![subbu.nv](https://avatars.discourse-cdn.com/v4/letter/s/439d5e/32.png) [@subbu.nv](https://discuss.elastic.co/u/subbu.nv)\ **Post date:** [January 7, 2016, 6:57pm UTC](https://discuss.elastic.co/t/need-advice-on-aws-logs-indexing-using-logstash/38667/1 "2016-01-07T18:57:48Z")
i have elastic search + logstash installed on one server. i am trying to index the logs from AWS and push into elastic search. can any one help with the format i have to use in logstash conf file input. ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [January 7, 2016, 7:05pm UTC](https://discuss.elastic.co/t/need-advice-on-aws-logs-indexing-using-logstash/38667/2 "2016-01-07T19:05:15Z")
If you can give an example of the logs of logs you want to parse there's a better chance that someone will be able to help. ---
**Author:** ![subbu.nv](https://avatars.discourse-cdn.com/v4/letter/s/439d5e/32.png) [@subbu.nv](https://discuss.elastic.co/u/subbu.nv)\ **Post date:** [January 7, 2016, 7:17pm UTC](https://discuss.elastic.co/t/need-advice-on-aws-logs-indexing-using-logstash/38667/3 "2016-01-07T19:17:18Z")
thanks for your response. Not sure if i understood your question. the logs are usually random unstructured server logs residing in AWS. ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [January 7, 2016, 8:22pm UTC](https://discuss.elastic.co/t/need-advice-on-aws-logs-indexing-using-logstash/38667/4 "2016-01-07T20:22:24Z")
Right, but how can we help with the config unless we can see the format. What have you tried so far, or are you expecting us to write it all for you? ---
**Author:** ![subbu.nv](https://avatars.discourse-cdn.com/v4/letter/s/439d5e/32.png) [@subbu.nv](https://discuss.elastic.co/u/subbu.nv)\ **Post date:** [January 7, 2016, 10:17pm UTC](https://discuss.elastic.co/t/need-advice-on-aws-logs-indexing-using-logstash/38667/5 "2016-01-07T22:17:52Z")
ok got it. i am indexing the logs from my local windows machine and below is the input i am using. input { file { path =\> "C:/web/apps/wslogs/\*" start\_position =\> beginning type =\> syslog } } below are some of the lines from logs. Voltage Margin: Enabled Time: 06:07:42 Aug 11 2014 Temp: 27 C: 27 C: 28 C: 27 C: 27 C: 27 C Last Status: NONE ESS Test Run 1 Starts at 06:07:44 Aug 11 2014 Temp: 27 C: 27 C: 28 C: 28 C: 27 C: 27 C rst# x^x^x^0^x^x^x^x^H^0^06:07:44^0^27^27^28^28^27^27^1.06^3.28^3.25^3.25^2.50^1.80^1.50^1.19^1.20^1.00^0.98^1.01 ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [January 8, 2016, 1:15am UTC](https://discuss.elastic.co/t/need-advice-on-aws-logs-indexing-using-logstash/38667/6 "2016-01-08T01:15:42Z")
It looks like these are multiline, ie a single event over more than one line, is that right? ---
**Author:** ![subbu.nv](https://avatars.discourse-cdn.com/v4/letter/s/439d5e/32.png) [@subbu.nv](https://discuss.elastic.co/u/subbu.nv)\ **Post date:** [January 8, 2016, 1:35am UTC](https://discuss.elastic.co/t/need-advice-on-aws-logs-indexing-using-logstash/38667/7 "2016-01-08T01:35:44Z")
yes, thats right. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 5:16am UTC](https://discuss.elastic.co/t/need-advice-on-aws-logs-indexing-using-logstash/38667/8 "2017-07-06T05:16:24Z")