# Network data with Logstash and Packetbeat **URL:** \ **Category:** Logstash\ **Created:** [June 1, 2016, 6:26am UTC](https://discuss.elastic.co/t/network-data-with-logstash-and-packetbeat/51514 "2016-06-01T06:26:46Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![Kennedy\_Kan1](https://avatars.discourse-cdn.com/v4/letter/k/cc9497/32.png) [@Kennedy\_Kan1](https://discuss.elastic.co/u/Kennedy_Kan1)\ **Post date:** [June 1, 2016, 6:26am UTC](https://discuss.elastic.co/t/network-data-with-logstash-and-packetbeat/51514/1 "2016-06-01T06:26:46Z")
I have configured packetbeat to send data to logstash and I have setup a conf file in logstash; however, seems nothing is generated, can anyone advise me for how to collect network data with packetbeat and logstash? ``` input{ beats{ port => 5044 } } output{ stdout{codec=>rubydebug} elasticsearch{ hosts => "localhost" } } ``` Great Thanks in Advance. ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [June 1, 2016, 6:29am UTC](https://discuss.elastic.co/t/network-data-with-logstash-and-packetbeat/51514/2 "2016-06-01T06:29:20Z")
How do you know Packetbeat is collecting anything? Are there any indications in the Packetbeat logs that it's having problems sending to Logstash? ---
**Author:** ![Kennedy\_Kan1](https://avatars.discourse-cdn.com/v4/letter/k/cc9497/32.png) [@Kennedy\_Kan1](https://discuss.elastic.co/u/Kennedy_Kan1)\ **Post date:** [June 1, 2016, 7:02am UTC](https://discuss.elastic.co/t/network-data-with-logstash-and-packetbeat/51514/3 "2016-06-01T07:02:03Z")
Oh yea, I have solved the issue as I relook at the packetbeat.yml Thanks for your advice. But when I start read the data from logstash, it seems that it can only read data from udp **How about if I also want to read data from http?** And as I seen from the logs, it stated dns answer as follows > "answers": [ > { > "class": "IN", > "data": "[googlecode.l.googleusercontent.com](http://googlecode.l.googleusercontent.com)", > "name": "[google-code-prettify.googlecode.com](http://google-code-prettify.googlecode.com)", > "ttl": 74280, > "type": "CNAME" > }, > { > "class": "IN", > "data": "173.194.72.82", > "name": "[googlecode.l.googleusercontent.com](http://googlecode.l.googleusercontent.com)", > "ttl": 300, > "type": "A" > } > ] **How can I extract the data "173.194.72.82" from it?** Thanks ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [June 1, 2016, 11:56am UTC](https://discuss.elastic.co/t/network-data-with-logstash-and-packetbeat/51514/4 "2016-06-01T11:56:53Z")
> How about if I also want to read data from http? What do you mean by this, exactly? Logstash has an http\_poller input if you want Logstash to actively poll an HTTP URL and an http input where Logstash listens and receives events via inbound HTTP requests. > How can I extract the data "173.194.72.82" from it? The `answers` field is an array. How do you know which element you're interested in, i.e. why do you want 173.194.72.82 rather than [googlecode.l.googleusercontent.com](http://googlecode.l.googleusercontent.com)? ---
**Author:** ![Kennedy\_Kan1](https://avatars.discourse-cdn.com/v4/letter/k/cc9497/32.png) [@Kennedy\_Kan1](https://discuss.elastic.co/u/Kennedy_Kan1)\ **Post date:** [June 1, 2016, 1:23pm UTC](https://discuss.elastic.co/t/network-data-with-logstash-and-packetbeat/51514/5 "2016-06-01T13:23:59Z")
**1.** I have put the http request in the configuration file as follow but it didnt seem to collect HTTP data as all the log received are transported from udp ``` input { http{} beats { port => 5044 } } ``` **2.** I want to map the ip with **tile map visualization** in kibana so I want to extract the `answers` field. ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [June 1, 2016, 2:22pm UTC](https://discuss.elastic.co/t/network-data-with-logstash-and-packetbeat/51514/6 "2016-06-01T14:22:36Z")
> I have put the http request in the configuration file as follow but it didnt seem to collect HTTP data as all the log received are transported from udp The http input doesn't actively collect anything. Its wait for other parties to post data to it. Do you have anything that's supposed to do that? > 1. I want to map the ip with tile map visualization in kibana so I want to extract the answers field. Yes, but the `answers` field is an array with multiple values. How do you know which of the values that should be extracted? ---
**Author:** ![Kennedy\_Kan1](https://avatars.discourse-cdn.com/v4/letter/k/cc9497/32.png) [@Kennedy\_Kan1](https://discuss.elastic.co/u/Kennedy_Kan1)\ **Post date:** [June 1, 2016, 2:29pm UTC](https://discuss.elastic.co/t/network-data-with-logstash-and-packetbeat/51514/7 "2016-06-01T14:29:51Z")
I saw in kibana that the data are split like there will be an analyzed field called **dns.answers.data** in the hided field label. So couldn't I grab this data? ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [June 1, 2016, 4:41pm UTC](https://discuss.elastic.co/t/network-data-with-logstash-and-packetbeat/51514/8 "2016-06-01T16:41:26Z")
Sorry, I don't understand. ---
**Author:** ![Kennedy\_Kan1](https://avatars.discourse-cdn.com/v4/letter/k/cc9497/32.png) [@Kennedy\_Kan1](https://discuss.elastic.co/u/Kennedy_Kan1)\ **Post date:** [June 2, 2016, 3:19am UTC](https://discuss.elastic.co/t/network-data-with-logstash-and-packetbeat/51514/9 "2016-06-02T03:19:04Z")
![](https://us1.discourse-cdn.com/elastic/original/2X/e/e956507d48f64eef0b01985b24de8f0927766155.PNG) I saw this in kibana which said you can still visulize the data but as it is only a string but not IP, I can't map it with tiles map. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 4:54am UTC](https://discuss.elastic.co/t/network-data-with-logstash-and-packetbeat/51514/10 "2017-07-06T04:54:55Z")