# \[Simple\] Logstash config file **URL:** \ **Category:** Logstash\ **Created:** [April 26, 2018, 8:36am UTC](https://discuss.elastic.co/t/simple-logstash-config-file/129613 "2018-04-26T08:36:51Z")\ **Posts on this page:** 13\ **Page:** 1
**Author:** ![Kevin\_Csuka](https://avatars.discourse-cdn.com/v4/letter/k/7feea3/32.png) [@Kevin\_Csuka](https://discuss.elastic.co/u/Kevin_Csuka)\ **Post date:** [April 26, 2018, 8:36am UTC](https://discuss.elastic.co/t/simple-logstash-config-file/129613/1 "2018-04-26T08:36:51Z")
I've got these lines in my log: ``` 1524708231.794259376 8 c0:4a:00:40:e6:0e c0:4a:00:40:AA:AA -45 1524708231.829154447 6 3c:08:f6:e6:AA:AA 3c:08:f6:e6:AA:AA -71 ``` 1st item is Unix timestamp 2nd item is channel 3rd item is MAC 4rd item is MAC 5th item is RSSI What is the correct logstash config to output this to Elasticsearch? I am running everything localhost, default setting, latest version[6.2.4] with X-Pack. Should it be something like ``` input { file { path => "/my/log/file.log" type => "syslog" } filter { # ??? } output { elasticsearch { hosts => ["localhost:9200"] } ``` ---
**Author:** ![JKhondhu](https://avatars.discourse-cdn.com/v4/letter/j/ed655f/32.png) [@JKhondhu](https://discuss.elastic.co/u/JKhondhu)\ **Post date:** [April 26, 2018, 8:41am UTC](https://discuss.elastic.co/t/simple-logstash-config-file/129613/2 "2018-04-26T08:41:04Z")
Whats is your question here @Kevin_Csuka 🍰, 🙂 ---
**Author:** ![Kevin\_Csuka](https://avatars.discourse-cdn.com/v4/letter/k/7feea3/32.png) [@Kevin\_Csuka](https://discuss.elastic.co/u/Kevin_Csuka)\ **Post date:** [April 26, 2018, 8:44am UTC](https://discuss.elastic.co/t/simple-logstash-config-file/129613/3 "2018-04-26T08:44:40Z")
Sorry, pushed the tab button and then pressed space, but then it saved my message instead of putting an actual tab in the message... I edited the first post. Thanks. @JKhondhu ---
**Author:** ![JKhondhu](https://avatars.discourse-cdn.com/v4/letter/j/ed655f/32.png) [@JKhondhu](https://discuss.elastic.co/u/JKhondhu)\ **Post date:** [April 26, 2018, 9:08am UTC](https://discuss.elastic.co/t/simple-logstash-config-file/129613/4 "2018-04-26T09:08:32Z")
@Kevin_Csuka Have a look here wrt getting started with grok filters for syslog: [https://www.elastic.co/guide/en/logstash/current/config-examples.html](https://www.elastic.co/guide/en/logstash/current/config-examples.html) [https://www.elastic.co/guide/en/kibana/6.2/xpack-grokdebugger.html](https://www.elastic.co/guide/en/kibana/6.2/xpack-grokdebugger.html) > **[logstash-plugins/logstash-patterns-core](https://github.com/logstash-plugins/logstash-patterns-core/tree/master/patterns)** > > Contribute to logstash-patterns-core development by creating an account on GitHub. ---
**Author:** ![Kevin\_Csuka](https://avatars.discourse-cdn.com/v4/letter/k/7feea3/32.png) [@Kevin\_Csuka](https://discuss.elastic.co/u/Kevin_Csuka)\ **Post date:** [April 26, 2018, 9:53am UTC](https://discuss.elastic.co/t/simple-logstash-config-file/129613/5 "2018-04-26T09:53:26Z")
No new index is created .... ``` ➜ logstash cat /etc/logstash/conf.d/test.conf input { file { path => "/var/log/test.log" } } filter { grok { match => { "message" => "%{NUMBER:timestamp} %{NUMBER:channel} %{MAC:client_mac} %{MAC:mac} %{INT:rssi}" } } } output { elasticsearch { hosts => ["localhost:9200"] user => all password => x } stdout { codec => rubydebug } } ➜ logstash cat /var/log/test.log 1524708231.794259376 8 c0:4a:00:40:AA:AA c0:4a:00:40:AA:AA -45 1524708231.829154447 6 3c:08:f6:e6:AA:AA 3c:08:f6:e6:AA:AA -71 ➜ logstash ``` Log file of logstash: [https://pastebin.com/rs30KkJE](https://pastebin.com/rs30KkJE) @JKhondhu ---
**Author:** ![JKhondhu](https://avatars.discourse-cdn.com/v4/letter/j/ed655f/32.png) [@JKhondhu](https://discuss.elastic.co/u/JKhondhu)\ **Post date:** [April 26, 2018, 10:13am UTC](https://discuss.elastic.co/t/simple-logstash-config-file/129613/6 "2018-04-26T10:13:03Z")
When there is a single space between the message you are looking to ingest: ```auto bin/logstash -e 'input { stdin{} } filter { grok { match => { "message" => "%{NUMBER:timestamp} %{NUMBER:channel} %{MAC:client_mac} %{MAC:mac} %{INT:rssi}" } }} output { stdout { codec => rubydebug }}' ``` `1524708231.794259376 8 c0:4a:00:40:AA:AA c0:4a:00:40:AA:AA -45` It works: ```auto [2018-04-26T11:10:00,812][DEBUG][logstash.pipeline] output received {"event"=>{"client_mac"=>"c0:4a:00:40:AA:AA", "timestamp"=>"1524708231.794259376", "channel"=>"8", "message"=>"1524708231.794259376 8 c0:4a:00:40:AA:AA c0:4a:00:40:AA:AA -45", "mac"=>"c0:4a:00:40:AA:AA", "@version"=>"1", "@timestamp"=>2018-04-26T10:10:00.687Z, "host"=>"khondhu", "rssi"=>"-45"}} { "client_mac" => "c0:4a:00:40:AA:AA", "timestamp" => "1524708231.794259376", "channel" => "8", "message" => "1524708231.794259376 8 c0:4a:00:40:AA:AA c0:4a:00:40:AA:AA -45", "mac" => "c0:4a:00:40:AA:AA", "@version" => "1", "@timestamp" => 2018-04-26T10:10:00.687Z, "host" => "khondhu", "rssi" => "-45" ``` Perhaps we need to add a `space` grok pattern. ---
**Author:** ![Kevin\_Csuka](https://avatars.discourse-cdn.com/v4/letter/k/7feea3/32.png) [@Kevin\_Csuka](https://discuss.elastic.co/u/Kevin_Csuka)\ **Post date:** [April 26, 2018, 11:07am UTC](https://discuss.elastic.co/t/simple-logstash-config-file/129613/7 "2018-04-26T11:07:41Z")
@JKhondhu Seems like the data is being picked up. I see that RSSI is set as string, while I set it to INT, see: [[Album] Imgur ![](https://i.imgur.com/zKPNVih.jpg?fb "Imgur") ](https://imgur.com/a/X3YiWTz) For example; I want to be able to create pie charts with the most channels used. Right now, this is not possible. ---
**Author:** ![Jenni](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jenni/32/29684_2.png) [@Jenni](https://discuss.elastic.co/u/Jenni)\ **Post date:** [April 26, 2018, 11:54am UTC](https://discuss.elastic.co/t/simple-logstash-config-file/129613/8 "2018-04-26T11:54:59Z")
Use a mutate filter to convert it? ---
**Author:** ![Kevin\_Csuka](https://avatars.discourse-cdn.com/v4/letter/k/7feea3/32.png) [@Kevin\_Csuka](https://discuss.elastic.co/u/Kevin_Csuka)\ **Post date:** [April 26, 2018, 12:27pm UTC](https://discuss.elastic.co/t/simple-logstash-config-file/129613/9 "2018-04-26T12:27:47Z")
Final logstash config: ``` ➜ logstash cat /etc/logstash/conf.d/test.conf input { file { path => "/var/log/test.log" } } filter { grok { match => { "message" => "%{NUMBER:timestamp} %{NUMBER:channel} %{MAC:mac} %{INT:rssi}" } } date { match => ["timestamp", "UNIX"] locale => en } mutate { convert => { "channel" => "integer" "rssi" => "integer" } } } output { elasticsearch { hosts => ["localhost:9200"] user => all password => x } stdout { codec => rubydebug } } ``` Raw data: ``` 1524671826.853290121 10 64:70:02:cb:9d:44 -51 1524671826.854767295 10 66:70:02:cb:9d:44 -51 1524671826.859872377 10 64:70:02:cb:9d:44 -51 ``` Also note: Once logstash is started, I manually edit the raw data file and append an extra line myself, and then save it.. I don't know why, but else Logstash doesn't take the file. Thanks. ---
**Author:** ![Kevin\_Csuka](https://avatars.discourse-cdn.com/v4/letter/k/7feea3/32.png) [@Kevin\_Csuka](https://discuss.elastic.co/u/Kevin_Csuka)\ **Post date:** [April 26, 2018, 1:16pm UTC](https://discuss.elastic.co/t/simple-logstash-config-file/129613/10 "2018-04-26T13:16:33Z")
@Jenni How can I make MAC addresses searchable and visualize them with Kibana? The OUI filter isn't applicable to my version. ---
**Author:** ![Jenni](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/jenni/32/29684_2.png) [@Jenni](https://discuss.elastic.co/u/Jenni)\ **Post date:** [April 26, 2018, 1:27pm UTC](https://discuss.elastic.co/t/simple-logstash-config-file/129613/11 "2018-04-26T13:27:44Z")
I think that depends of the searches and visualizations you plan to do. You'll have to configure your ElasticSearch mapping with the right field types and analyzers to match your requirements. If you want to to aggregations based on the mac address, you'll need a 'keyword' mapping. For text searches this might help: [https://stackoverflow.com/questions/17839149/elasticsearch-mac-address-search-mapping](https://stackoverflow.com/questions/17839149/elasticsearch-mac-address-search-mapping) ---
**Author:** ![Kevin\_Csuka](https://avatars.discourse-cdn.com/v4/letter/k/7feea3/32.png) [@Kevin\_Csuka](https://discuss.elastic.co/u/Kevin_Csuka)\ **Post date:** [April 26, 2018, 1:51pm UTC](https://discuss.elastic.co/t/simple-logstash-config-file/129613/12 "2018-04-26T13:51:23Z")
> [@Jenni](#): > > I think that depends of the searches and visualizations you plan to do Really simple visualization, only the Total amount. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [May 24, 2018, 1:51pm UTC](https://discuss.elastic.co/t/simple-logstash-config-file/129613/13 "2018-05-24T13:51:26Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.