# Running my first Logstash \*.conf file and need your help

**URL:** <https://discuss.elastic.co/t/running-my-first-logstash-conf-file-and-need-your-help/101474>\
**Category:** Logstash\
**Created:** [September 22, 2017, 11:12am UTC](https://discuss.elastic.co/t/running-my-first-logstash-conf-file-and-need-your-help/101474 "2017-09-22T11:12:44Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![hackilberry](https://avatars.discourse-cdn.com/v4/letter/h/87869e/32.png) [@hackilberry](https://discuss.elastic.co/u/hackilberry)\
**Post date:** [September 22, 2017, 11:12am UTC](https://discuss.elastic.co/t/running-my-first-logstash-conf-file-and-need-your-help/101474/1 "2017-09-22T11:12:44Z")

</div>

Hi all,

I'm new with it, so be patient to me.

I successfuly succeeded runing my first "test" in Logstash (or maybe I didn't .. this is my question).  
I tried to read an XML file from a directory, and output the result to a different file (the code is at the end).

My questions are:  
(1) Where I need to see the results? (Does when I'm running Logstash, I need to see the output file? or I need to do another thing in order to run it?)  
(2) Can I run it in debug mode, so I can see if I really succeeded or not.

I installed ES, Kibana and Logstash on a Windows 2016 server.  
I installed all Input, Output filters as long as the codec filters.  
I have on my machine also X-Pack

My code is:  
input {  
file {  
path =\> "C:\IN\*.xml"  
codec =\> multiline {  
pattern =\> "\<Item "  
negate =\> "false"  
what =\> "next"  
}  
}  
}  
filter  
{  
xml  
{  
store\_xml =\> "false"  
source =\> "Item"  
xpath =\>  
[  
"/Item/@ItemSeqNo", "TID",  
"/Item/@RoutNo", "routID",  
"/Item/@Amount", "Amount",  
"/Item/@CurrencyInd", "Currency",  
"/Item/@SerialNo", "CNumber",  
"/Item/@ANo", "AccountNo",  
"/Item/@PresentmentDate", "Date",  
"/Item/AddendA/@DAcct", "CAc"  
]  
}  
}  
output  
{  
file {  
path =\> "C:\ES-OUT\T%{/Item/@ItemSeqNo}.txt"  
}  
}

Please kindly advise

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [September 22, 2017, 1:18pm UTC](https://discuss.elastic.co/t/running-my-first-logstash-conf-file-and-need-your-help/101474/3 "2017-09-22T13:18:57Z")

</div>

> (1) Where I need to see the results?

Your only output is a file output that writes to C:\ES-OUT\T%{/Item/@ItemSeqNo}.txt so that's where you should inspect the results.

> (Does when I'm running Logstash, I need to see the output file? or I need to do another thing in order to run it?)

I don't understand this.

> (2) Can I run it in debug mode, so I can see if I really succeeded or not.

Logstash's log level is configurable, e.g. via command-line options. See the documentation.

---

<div class="post-metadata">

**Author:** ![hackilberry](https://avatars.discourse-cdn.com/v4/letter/h/87869e/32.png) [@hackilberry](https://discuss.elastic.co/u/hackilberry)\
**Post date:** [September 22, 2017, 2:00pm UTC](https://discuss.elastic.co/t/running-my-first-logstash-conf-file-and-need-your-help/101474/4 "2017-09-22T14:00:20Z")

</div>

Thanks Magnus for your reply.

I ment to ask, what is the triger that fires the action?  
Is it the presense of file(s) in the 'IN' directory or is it something else.

Can you kindly refer me to Logstash log configuration? I'm not sure I found  
the right one.

Thank you for your effort

---

<div class="post-metadata">

**Author:** ![hackilberry](https://avatars.discourse-cdn.com/v4/letter/h/87869e/32.png) [@hackilberry](https://discuss.elastic.co/u/hackilberry)\
**Post date:** [September 22, 2017, 2:03pm UTC](https://discuss.elastic.co/t/running-my-first-logstash-conf-file-and-need-your-help/101474/5 "2017-09-22T14:03:55Z")

</div>

Hi Hilda,

Thank you for the positive feedback.  
I'm not familier with "Assignment Writing Help  
[http://www.writing-victors.co.uk/assignment-services/](http://www.writing-victors.co.uk/assignment-services/)", therefor  
unfortunatly I didn't used it.  
I will try it

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [September 25, 2017, 5:44am UTC](https://discuss.elastic.co/t/running-my-first-logstash-conf-file-and-need-your-help/101474/6 "2017-09-25T05:44:02Z")

</div>

> I ment to ask, what is the triger that fires the action?  
> Is it the presense of file(s) in the 'IN' directory or is it something else.

Yes. The filename pattern in your file input will be scanned every 15 seconds or so and any new files will get picked up. However, your current configuration will not read files from the beginning so it's probably not very useful. Have a look at the `start_position` option.

> Can you kindly refer me to Logstash log configuration?

> **[logstash.yml | Logstash Reference \[8.11\] | Elastic](https://www.elastic.co/guide/en/logstash/current/logstash-settings-file.html)**

> **[Running Logstash from the Command Line | Logstash Reference \[8.11\] | Elastic](https://www.elastic.co/guide/en/logstash/current/running-logstash-command-line.html)**

---

<div class="post-metadata">

**Author:** ![hackilberry](https://avatars.discourse-cdn.com/v4/letter/h/87869e/32.png) [@hackilberry](https://discuss.elastic.co/u/hackilberry)\
**Post date:** [September 25, 2017, 10:03am UTC](https://discuss.elastic.co/t/running-my-first-logstash-conf-file-and-need-your-help/101474/7 "2017-09-25T10:03:03Z")

</div>

Thanks!!!

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 23, 2017, 10:03am UTC](https://discuss.elastic.co/t/running-my-first-logstash-conf-file-and-need-your-help/101474/8 "2017-10-23T10:03:16Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.
