# Send LSF to Redis to Logstash

**URL:** <https://discuss.elastic.co/t/send-lsf-to-redis-to-logstash/33294>\
**Category:** Logstash\
**Created:** [October 29, 2015, 7:47pm UTC](https://discuss.elastic.co/t/send-lsf-to-redis-to-logstash/33294 "2015-10-29T19:47:13Z")\
**Posts on this page:** 13\
**Page:** 1

<div class="post-metadata">

**Author:** ![Kaufusihm](https://avatars.discourse-cdn.com/v4/letter/k/bcef8e/32.png) [@Kaufusihm](https://discuss.elastic.co/u/Kaufusihm)\
**Post date:** [October 29, 2015, 7:47pm UTC](https://discuss.elastic.co/t/send-lsf-to-redis-to-logstash/33294/1 "2015-10-29T19:47:13Z")

</div>

I am able to send windows server 2012 logs to logstash with lumberjack with the following configs below, but I want to now send to redis from windows server 2012 and then to logstash.

lumberjack config:

{  
"network": {  
"servers": ["logstash-server:5000"],  
"timeout": 15,  
"ssl ca": "path"  
},  
"files": [  
{  
"paths":  
["C:\ProgramData\Solarwinds\Logs\SEUM\SEUM.jobs.log", "C:\ProgramData\Solarwinds\Logs\orion\orionWeb.log", "C:\ProgramData\Solarwinds\Logs\Orion\Core.BusinessLayer.log"],  
"fields": { "type": "syslog" }  
}  
]  
}

Logstash Server config

input {  
lumberjack {  
port =\> 5000  
type =\> "logs"  
ssl\_certificate =\> "/etc/pki/tls/certs/logstash-forwarder.crt"  
ssl\_key =\> "/etc/pki/tls/private/logstash-forwarder.key"  
}  
}  
output {  
elasticsearch {  
host =\> "elasticsearch-ip"  
cluster =\> "elasticsearch\_TEST" }  
stdout { codec =\> rubydebug }  
}  
Output {  
elasticsearch {  
host =\> "elasticsearch-server"  
cluster =\> "elasticsearch\_TEST" }  
stdout { codec =\> rubydebug }  
}

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [October 29, 2015, 7:57pm UTC](https://discuss.elastic.co/t/send-lsf-to-redis-to-logstash/33294/2 "2015-10-29T19:57:27Z")

</div>

LSF only supports the Lumberjack protocol.

---

<div class="post-metadata">

**Author:** ![Kaufusihm](https://avatars.discourse-cdn.com/v4/letter/k/bcef8e/32.png) [@Kaufusihm](https://discuss.elastic.co/u/Kaufusihm)\
**Post date:** [October 29, 2015, 8:07pm UTC](https://discuss.elastic.co/t/send-lsf-to-redis-to-logstash/33294/3 "2015-10-29T20:07:44Z")

</div>

What other options do I have if I want to use redis as a broker?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [October 29, 2015, 8:37pm UTC](https://discuss.elastic.co/t/send-lsf-to-redis-to-logstash/33294/4 "2015-10-29T20:37:26Z")

</div>

I'm not aware of any shippers, apart from Logstash itself, that run on Windows and support Redis.

---

<div class="post-metadata">

**Author:** ![Kaufusihm](https://avatars.discourse-cdn.com/v4/letter/k/bcef8e/32.png) [@Kaufusihm](https://discuss.elastic.co/u/Kaufusihm)\
**Post date:** [October 29, 2015, 8:46pm UTC](https://discuss.elastic.co/t/send-lsf-to-redis-to-logstash/33294/5 "2015-10-29T20:46:44Z")

</div>

Okay so use a logstash client (configured as a shipper) and send to redis?

---

<div class="post-metadata">

**Author:** ![Kaufusihm](https://avatars.discourse-cdn.com/v4/letter/k/bcef8e/32.png) [@Kaufusihm](https://discuss.elastic.co/u/Kaufusihm)\
**Post date:** [October 29, 2015, 10:45pm UTC](https://discuss.elastic.co/t/send-lsf-to-redis-to-logstash/33294/6 "2015-10-29T22:45:49Z")

</div>

How about sending windows server 2012 logs through the following flow?

lumberjack \> Logstash (collector) \> Redis \> Logstash (indexer) \> Elasticsearch

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [October 30, 2015, 5:21am UTC](https://discuss.elastic.co/t/send-lsf-to-redis-to-logstash/33294/7 "2015-10-30T05:21:57Z")

</div>

That will work.

---

<div class="post-metadata">

**Author:** ![Kaufusihm](https://avatars.discourse-cdn.com/v4/letter/k/bcef8e/32.png) [@Kaufusihm](https://discuss.elastic.co/u/Kaufusihm)\
**Post date:** [October 30, 2015, 6:03pm UTC](https://discuss.elastic.co/t/send-lsf-to-redis-to-logstash/33294/8 "2015-10-30T18:03:52Z")

</div>

I am trying to setup the following flow to send logs to Elasticsearch.

lumberjack \> Logstash (collector) \> Redis \> Logstash (indexer) \> Elasticsearch

However, I am having some troubles sending from Lumberjack (windows serv 2012) \> logstash (shipper) \> Redis \> Logstash (indexer) configuration wise. What am I missing?

So far I have

lumberjack (Win server 2012)  
{  
"network": {  
"servers": ["logstash-server-name:5000"],  
"timeout": 15,  
"ssl ca": "file path"  
},  
"files": [  
{  
"paths":  
[ "C:\File path" }  
}  
]  
}

Logstash (shipper/collector)  
input {  
lumberjack {  
port =\> 5000  
type =\> "logs"  
ssl\_certificate =\> "File path"  
ssl\_key =\> "file path"  
}  
output {  
stdout { }  
redis {  
host =\> "redis server"  
data\_type =\> "list"  
key =\> "logstash"  
}  
}

Logstash (indexer)  
}  
input {  
redis {  
host =\> "redis host"  
type =\> "redis"  
data\_type =\> "list"  
key =\> "logstash"  
}  
}  
output {  
stdout { }  
elasticsearch {  
cluster =\> "elasticsearch"  
}  
}

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [October 30, 2015, 6:27pm UTC](https://discuss.elastic.co/t/send-lsf-to-redis-to-logstash/33294/9 "2015-10-30T18:27:28Z")

</div>

What's the problem? Are the messages not arriving to Redis? Or are they arriving to Redis but not being picked up by Logstash on the other end?

---

<div class="post-metadata">

**Author:** ![Kaufusihm](https://avatars.discourse-cdn.com/v4/letter/k/bcef8e/32.png) [@Kaufusihm](https://discuss.elastic.co/u/Kaufusihm)\
**Post date:** [October 30, 2015, 6:49pm UTC](https://discuss.elastic.co/t/send-lsf-to-redis-to-logstash/33294/10 "2015-10-30T18:49:59Z")

</div>

Logstash (shipper/collector) is not starting which I believe is a config issue possibly...

What I see in logstash.log:

{:timestamp=\>"2015-10-30T12:18:28.779000-0600", :message=\>"The error reported is: \n uninitialized constant Concurrent::Delay::Executor"}  
{:timestamp=\>"2015-10-30T12:43:26.362000-0600", :message=\>"The error reported is: \n uninitialized constant Concurrent::Delay::Executor"}

---

<div class="post-metadata">

**Author:** ![Kaufusihm](https://avatars.discourse-cdn.com/v4/letter/k/bcef8e/32.png) [@Kaufusihm](https://discuss.elastic.co/u/Kaufusihm)\
**Post date:** [October 30, 2015, 7:22pm UTC](https://discuss.elastic.co/t/send-lsf-to-redis-to-logstash/33294/11 "2015-10-30T19:22:36Z")

</div>

Okay, so apparently I needed to update my lumberjack. Now my logstash collector is running but no logs are passing...

Not quite sure where the issue is at. Ideas?

---

<div class="post-metadata">

**Author:** ![Kaufusihm](https://avatars.discourse-cdn.com/v4/letter/k/bcef8e/32.png) [@Kaufusihm](https://discuss.elastic.co/u/Kaufusihm)\
**Post date:** [October 30, 2015, 7:56pm UTC](https://discuss.elastic.co/t/send-lsf-to-redis-to-logstash/33294/12 "2015-10-30T19:56:33Z")

</div>

Okay everything is sending now

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 5:24am UTC](https://discuss.elastic.co/t/send-lsf-to-redis-to-logstash/33294/13 "2017-07-06T05:24:47Z")

</div>