# Regarding conf file configuration
**URL:** https://discuss.elastic.co/t/regarding-conf-file-configuration/106075
**Category:** Logstash
**Created:** [November 1, 2017, 6:21pm UTC](https://discuss.elastic.co/t/regarding-conf-file-configuration/106075 "2017-11-01T18:21:32Z")
**Posts on this page:** 12
**Page:** 1
### Author:  [@prasad123](https://discuss.elastic.co/u/prasad123)
#### Post date: [November 1, 2017, 6:21pm UTC](https://discuss.elastic.co/t/regarding-conf-file-configuration/106075/1 "2017-11-01T18:21:32Z")
i want to read live logs from server what are the configuration i need to set in logstash conf file
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [November 1, 2017, 8:55pm UTC](https://discuss.elastic.co/t/regarding-conf-file-configuration/106075/2 "2017-11-01T20:55:28Z")
Use the file input plugin. See [https://www.elastic.co/guide/en/logstash/current/config-examples.html#\_processing\_apache\_logs](https://www.elastic.co/guide/en/logstash/current/config-examples.html#_processing_apache_logs) for an example.
---
### Author:  [@prasad123](https://discuss.elastic.co/u/prasad123)
#### Post date: [November 2, 2017, 12:10pm UTC](https://discuss.elastic.co/t/regarding-conf-file-configuration/106075/3 "2017-11-02T12:10:15Z")
i have installed apache server on my local machine and i want read its log what configuration file i should use. I went through the above link but i am not able to configure the conf file in logstash. I am getting following error:-
[2017-11-02T17:33:53,061][WARN][logstash.outputs.elasticsearch] Attempted to re
surrect connection to dead ES instance, but got an error. {:url=\>"[http://localho](http://localho)
st:9200/", :error\_type=\>LogStash::Outputs::ElasticSearch::HttpClient::Pool::BadR
esponseCodeError, :error=\>"Got response code '401' contacting Elasticsearch at U
RL '[http://localhost:9200/](http://localhost:9200/)'"}
the following conf file i have run.
input {
file {
path =\> "C:\Program Files\Apache Software Foundation\Tomcat 8.5\logs"
}
}
filter {
if [path] =~ "access" {
mutate { replace =\> { type =\> "apache\_access" } }
grok {
match =\> { "message" =\> "%{COMBINEDAPACHELOG}" }
}
date {
match =\> ["timestamp" , "dd/MMM/yyyy:HH:mm:ss Z"]
}
} else if [path] =~ "error" {
mutate { replace =\> { type =\> "apache\_error" } }
} else {
mutate { replace =\> { type =\> "random\_logs" } }
}
}
output {
elasticsearch { hosts =\> ["localhost:9200"] }
stdout { codec =\> rubydebug }
}
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [November 2, 2017, 12:11pm UTC](https://discuss.elastic.co/t/regarding-conf-file-configuration/106075/4 "2017-11-02T12:11:11Z")
Your ES instance required authentication and you haven't configured that in your elasticsearch output.
---
### Author:  [@prasad123](https://discuss.elastic.co/u/prasad123)
#### Post date: [November 2, 2017, 12:11pm UTC](https://discuss.elastic.co/t/regarding-conf-file-configuration/106075/5 "2017-11-02T12:11:59Z")
so what i have to right for that in output.
---
### Author:  [@prasad123](https://discuss.elastic.co/u/prasad123)
#### Post date: [November 2, 2017, 12:54pm UTC](https://discuss.elastic.co/t/regarding-conf-file-configuration/106075/6 "2017-11-02T12:54:22Z")
i have started xamp apche server on 81 port how i can authenticate with that server and what conf file i should write in logstash.
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [November 2, 2017, 12:59pm UTC](https://discuss.elastic.co/t/regarding-conf-file-configuration/106075/7 "2017-11-02T12:59:52Z")
I'm confused. What does Apache and port 81 have to do with Elasticsearch?
---
### Author:  [@prasad123](https://discuss.elastic.co/u/prasad123)
#### Post date: [November 2, 2017, 1:13pm UTC](https://discuss.elastic.co/t/regarding-conf-file-configuration/106075/8 "2017-11-02T13:13:37Z")
i provided the authentication required for the ES instance, there is no error and logstash pipeline is started successfully but there is no further processing. I think that it is unable to read the path provided for the logs. can you help ?
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [November 2, 2017, 1:19pm UTC](https://discuss.elastic.co/t/regarding-conf-file-configuration/106075/9 "2017-11-02T13:19:34Z")
> path =\> "C:\Program Files\Apache Software Foundation\Tomcat 8.5\logs"
The `path` setting should contain a filename or a filename pattern, not a directory. Also, you may have to use forward slashes instead of backslashes.
---
### Author:  [@prasad123](https://discuss.elastic.co/u/prasad123)
#### Post date: [November 2, 2017, 1:59pm UTC](https://discuss.elastic.co/t/regarding-conf-file-configuration/106075/10 "2017-11-02T13:59:03Z")
thank you.
With your help i am able to run the config file and the pipeline is successfully started. but i am unable to process further and i am stuck in between by following the link ([https://www.elastic.co/guide/en/logstash/current/config-examples.html#\_processing\_apache\_logs](https://www.elastic.co/guide/en/logstash/current/config-examples.html#_processing_apache_logs)) i can't understand what the below command means.
127.0.0.1 - - [11/Dec/2013:00:01:45 -0800] "GET /xampp/status.php HTTP/1.1" 200 3891 "[http://cadenza/xampp/navi.php](http://cadenza/xampp/navi.php)" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:25.0) Gecko/20100101 Firefox/25.0"
can you help me with it.
thanks.
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [November 3, 2017, 6:20am UTC](https://discuss.elastic.co/t/regarding-conf-file-configuration/106075/11 "2017-11-03T06:20:29Z")
I don't understand the question. What command are you talking about? The line you pasted above (beginning with "127.0.0.1") is an HTTP log entry.
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 1, 2017, 6:20am UTC](https://discuss.elastic.co/t/regarding-conf-file-configuration/106075/12 "2017-12-01T06:20:30Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.