# Reading logstash's own log file with logstash

**URL:** <https://discuss.elastic.co/t/reading-logstashs-own-log-file-with-logstash/23828>\
**Category:** Logstash\
**Created:** [June 17, 2015, 11:15am UTC](https://discuss.elastic.co/t/reading-logstashs-own-log-file-with-logstash/23828 "2015-06-17T11:15:40Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![MaxS](https://avatars.discourse-cdn.com/v4/letter/m/96bed5/32.png) [@MaxS](https://discuss.elastic.co/u/MaxS)\
**Post date:** [June 17, 2015, 11:15am UTC](https://discuss.elastic.co/t/reading-logstashs-own-log-file-with-logstash/23828/1 "2015-06-17T11:15:40Z")

</div>

Hi,

I'd like to read and parse logstash's own log file with logstash. Does anyone have a grok pattern or config to do this? I'm surprised this isn't an out of the box feature!

Cheers,

Max

---

<div class="post-metadata">

**Author:** ![simmel](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/simmel/32/48040_2.png) [@simmel](https://discuss.elastic.co/u/simmel)\
**Post date:** [June 18, 2015, 6:16am UTC](https://discuss.elastic.co/t/reading-logstashs-own-log-file-with-logstash/23828/2 "2015-06-18T06:16:40Z")

</div>

> I'd like to read and parse logstash's own log file with logstash. Does anyone have a grok pattern or config to do this? I'm surprised this isn't an out of the box feature!

I tried and it kind of worked but there are so many edge cases it's not  
even funny.

Just wait until [Internal logging: A return to JSON · Issue #1569 · elastic/logstash · GitHub](https://github.com/elastic/logstash/issues/1569) gets  
solved. Subscribe/write in it to make it more of a priority.

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [June 18, 2015, 6:36am UTC](https://discuss.elastic.co/t/reading-logstashs-own-log-file-with-logstash/23828/3 "2015-06-18T06:36:52Z")

</div>

I'd echo that.  
KB4 moved to JSON logs and it definitely makes sense for LS to as well 😃

---

<div class="post-metadata">

**Author:** ![MaxS](https://avatars.discourse-cdn.com/v4/letter/m/96bed5/32.png) [@MaxS](https://discuss.elastic.co/u/MaxS)\
**Post date:** [June 18, 2015, 9:25am UTC](https://discuss.elastic.co/t/reading-logstashs-own-log-file-with-logstash/23828/4 "2015-06-18T09:25:23Z")

</div>

Hi,

Thanks for the tips. On a similar vein, what are people's thoughts on the best way to monitor Elasticsearch's logs with logstash?

Cheers,

Max

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [June 25, 2015, 7:26pm UTC](https://discuss.elastic.co/t/reading-logstashs-own-log-file-with-logstash/23828/5 "2015-06-25T19:26:59Z")

</div>

I haven't carved out the time to actually implement it for my ES clusters so I can't promise that it'll work, but I'm planning to use [https://github.com/logstash/log4j-jsonevent-layout](https://github.com/logstash/log4j-jsonevent-layout) to get Logstash-friendly JSON logs.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:36am UTC](https://discuss.elastic.co/t/reading-logstashs-own-log-file-with-logstash/23828/6 "2017-07-06T05:36:28Z")

</div>