# Sending Logstash's logs to /var/log/logstash but not to elasticsearch
**URL:** https://discuss.elastic.co/t/sending-logstashs-logs-to-var-log-logstash-but-not-to-elasticsearch/107051
**Category:** Logstash
**Created:** [November 9, 2017, 1:59pm UTC](https://discuss.elastic.co/t/sending-logstashs-logs-to-var-log-logstash-but-not-to-elasticsearch/107051 "2017-11-09T13:59:40Z")
**Posts on this page:** 8
**Page:** 1
### Author:  [@Ferrow](https://discuss.elastic.co/u/Ferrow)
#### Post date: [November 9, 2017, 1:59pm UTC](https://discuss.elastic.co/t/sending-logstashs-logs-to-var-log-logstash-but-not-to-elasticsearch/107051/1 "2017-11-09T13:59:40Z")
Hi guys..
Im very new to this, but i dont understand why I cant load my .conf file in /usr/share/logstash/bin.. using ./logstash -f file.conf
getting a message saying: "Sending Logstash's logs to /var/log/logstash which is now configured via log4j2.properties"
but i cant see my index in Kibana after....
Its on a fresh ubuntu 17.10 with a newly installed ELK stack.
Will someone be so kind and explain to me what this means?
How do I make it work?
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [November 9, 2017, 2:16pm UTC](https://discuss.elastic.co/t/sending-logstashs-logs-to-var-log-logstash-but-not-to-elasticsearch/107051/2 "2017-11-09T14:16:31Z")
And what's in your config file?
---
### Author:  [@Ferrow](https://discuss.elastic.co/u/Ferrow)
#### Post date: [November 15, 2017, 7:30am UTC](https://discuss.elastic.co/t/sending-logstashs-logs-to-var-log-logstash-but-not-to-elasticsearch/107051/3 "2017-11-15T07:30:39Z")
witch one of them do you need? Logstash's yaml file or the .conf i have been working on?
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [November 15, 2017, 7:36am UTC](https://discuss.elastic.co/t/sending-logstashs-logs-to-var-log-logstash-but-not-to-elasticsearch/107051/4 "2017-11-15T07:36:09Z")
The .conf file.
---
### Author:  [@Ferrow](https://discuss.elastic.co/u/Ferrow)
#### Post date: [November 15, 2017, 8:39am UTC](https://discuss.elastic.co/t/sending-logstashs-logs-to-var-log-logstash-but-not-to-elasticsearch/107051/5 "2017-11-15T08:39:51Z")
input {
file {
type =\> "CISCO\_ASA\_FIREWALL"
exclude =\> "_.gz"
path =\> "/home/lasse/Skrivebord/51asa5525/messages-2015-10-30_"
start\_position =\> "beginning"
}
}
filter {
if [type] == "CISCO\_ASA\_FIREWALL" {
grok {
match =\> {"message" =\> "%{SYSLOGTIMESTAMP:Cisco\_Time} %{SYSLOGHOST:Cisco\_Host} %{NOTSPACE:LogID} [\s\*%{DATA:drop\_type}\s\*] drop %{DATA:drop\_rate\_id} exceeded. Current burst rate is %{INT:drop\_rate\_current\_burst} per second, max configured rate is %{INT:drop\_rate\_max\_burst}; Current average rate is %{INT:drop\_rate\_current\_avg} per second, max configured rate is %{INT:drop\_rate\_max\_avg}; Cumulative total count is %{INT:drop\_total\_count}"}
}
}
}
output {
stdout { codec =\> plain }
elasticsearch { hosts =\> ["[http://localhost:9200](http://localhost:9200)"]
document\_type =\> "text"
index =\> "apples"
}
}
---
### Author:  [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)
#### Post date: [November 15, 2017, 1:03pm UTC](https://discuss.elastic.co/t/sending-logstashs-logs-to-var-log-logstash-but-not-to-elasticsearch/107051/6 "2017-11-15T13:03:49Z")
As I explained in another thread yesterday, `start_position => "beginning"` only matters for new and previously unseen files. Logstash is probably tailing the input file.
---
### Author:  [@Ferrow](https://discuss.elastic.co/u/Ferrow)
#### Post date: [November 16, 2017, 9:14am UTC](https://discuss.elastic.co/t/sending-logstashs-logs-to-var-log-logstash-but-not-to-elasticsearch/107051/7 "2017-11-16T09:14:14Z")
but how should Logstash have seens theese files before when its a fresh install..?! -
I dont understand why Logstash don't read from the beginning of the file - seems odd.??
In any case.. what do I have to do, in order to fix this issue?
thanks is advance!
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 14, 2017, 9:14am UTC](https://discuss.elastic.co/t/sending-logstashs-logs-to-var-log-logstash-but-not-to-elasticsearch/107051/8 "2017-12-14T09:14:21Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.