# \[solved\] Nxlog -\> logstash -\> elasticsearch **URL:** \ **Category:** Logstash\ **Created:** [May 17, 2016, 9:13pm UTC](https://discuss.elastic.co/t/solved-nxlog-logstash-elasticsearch/50263 "2016-05-17T21:13:42Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![bbach](https://avatars.discourse-cdn.com/v4/letter/b/d26b3c/32.png) [@bbach](https://discuss.elastic.co/u/bbach)\ **Post date:** [May 17, 2016, 9:13pm UTC](https://discuss.elastic.co/t/solved-nxlog-logstash-elasticsearch/50263/1 "2016-05-17T21:13:42Z")
Update: Really was a misunderstanding. Needed `codec => rubydebug` in my stdout output to see what I was expecting * * * Of course this was all working but I upgraded -- _sigh_. ubuntu 14.04 nxlog-ce 2.7.1191 logstash 2.3.2 elasticsearch 2.3.2 **Symptom:** Logstash output not outputting json: ``` /opt/logstash/bin/logstash --config /etc/logstash/conf.d/ Settings: Default pipeline workers: 8 Pipeline main started 2016-05-17T20:53:43.798Z 127.0.0.1 %{message} 2016-05-17T20:53:57.498Z 127.0.0.1 %{message} 2016-05-17T20:54:01.043Z 127.0.0.1 %{message} ``` Here is my config: ``` input { tcp { port => 5140 codec => json_lines { } } } filter { } output { stdout { } } ``` I did a netcat on port 5140 to make sure nxlog was sending Json: ``` # nc -l localhost 5140 {"MessageSourceAddress":"192.168.153.59","EventReceivedTime":"2016-05-17 16:08:36","SourceModuleName":"in_tcp","SourceModuleType":"im_tcp","SyslogFacilityValue":4,"SyslogFacility":"AUTH","SyslogSeverityValue":6,"SyslogSeverity":"INFO","SeverityValue":2,"Severity":"INFO","Hostname":"server09","EventTime":"2016-05-17 16:08:36","SourceName":"sshd","ProcessID":"10099","Message":"Received disconnect from 192.168.153.33: 3: com.jcraft.jsch.JSchException: Auth cancel [preauth]"} {"MessageSourceAddress":"192.168.153.59","EventReceivedTime":"2016-05-17 16:08:36","SourceModuleName":"in_tcp","SourceModuleType":"im_tcp","SyslogFacilityValue":4,"SyslogFacility":"AUTH","SyslogSeverityValue":6,"SyslogSeverity":"INFO","SeverityValue":2,"Severity":"INFO","Hostname":"server09","EventTime":"2016-05-17 16:08:36","SourceName":"sshd","ProcessID":"10098","Message":"Received disconnect from 192.168.153.33: 3: com.jcraft.jsch.JSchException: Auth cancel [preauth]"} ``` Any pointers? Thanks. -- Bud ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [May 18, 2016, 5:33am UTC](https://discuss.elastic.co/t/solved-nxlog-logstash-elasticsearch/50263/2 "2016-05-18T05:33:15Z")
I don't know nxlog, but why not use winlogbeat? ---
**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Post date:** [May 18, 2016, 5:46am UTC](https://discuss.elastic.co/t/solved-nxlog-logstash-elasticsearch/50263/3 "2016-05-18T05:46:50Z")
I'd be surprised if your configuration ever emitted JSON. The default codec of the stdout output has AFAIK always been plain. If you want the stdout plugin to serialize the events into JSON you need to use the json\_lines codec there too. ---
**Author:** ![bbach](https://avatars.discourse-cdn.com/v4/letter/b/d26b3c/32.png) [@bbach](https://discuss.elastic.co/u/bbach)\ **Post date:** [May 18, 2016, 1:32pm UTC](https://discuss.elastic.co/t/solved-nxlog-logstash-elasticsearch/50263/4 "2016-05-18T13:32:43Z")
nxlog is on the Linux box with logstash to handle syslog messages from network devices and other Linux boxes. nxlog provides some buffering in front of logstash and translates the syslog messages to json. I know there is/was another use case for nxlog to run n Windows to send event logs as syslog but that isn't what I am using it for. Thanks for looking at this though. -- Bud ---
**Author:** ![bbach](https://avatars.discourse-cdn.com/v4/letter/b/d26b3c/32.png) [@bbach](https://discuss.elastic.co/u/bbach)\ **Post date:** [May 18, 2016, 2:38pm UTC](https://discuss.elastic.co/t/solved-nxlog-logstash-elasticsearch/50263/5 "2016-05-18T14:38:20Z")
Yeah, I thought when I originally set this up, json would get written to stdout but I could be mis-remembering the json part. Ultimately, what I am trying to achieve, is to send all the fields in my json (i.e. from the netcat above) to get shuttled into a json doc in elasticseach: ``` output { stdout { } elasticsearch { hosts => localhost template_overwrite => true } } ``` That doesn't seem to be happening, hence adding the `stdout { }` to see what was going on. Seeing `%{message}`, rather than the actual fields of the message, written to stdout seems wrong... ---
**Author:** ![bbach](https://avatars.discourse-cdn.com/v4/letter/b/d26b3c/32.png) [@bbach](https://discuss.elastic.co/u/bbach)\ **Post date:** [May 18, 2016, 4:09pm UTC](https://discuss.elastic.co/t/solved-nxlog-logstash-elasticsearch/50263/6 "2016-05-18T16:09:25Z")
Argh! ``` output { stdout {codec => rubydebug} } ``` produces the json I remember. So my previous example produces: ``` { "MessageSourceAddress" => "192.168.153.59", "EventReceivedTime" => "2016-05-17 16:08:36", "SourceModuleName" => "in_tcp", "SourceModuleType" => "im_tcp", "SyslogFacilityValue" => 4, "SyslogFacility" => "AUTH", "SyslogSeverityValue" => 6, "SyslogSeverity" => "INFO", "SeverityValue" => 2, "Severity" => "INFO", "Hostname" => "server09", "EventTime" => "2016-05-17 16:08:36", "SourceName" => "sshd", "ProcessID" => "10099", "@version" => "1", "@timestamp" => "2016-05-18T16:05:12.585Z", "host" => "monitor01", "message" => "Received disconnect from 192.168.153.33: 3: com.jcraft.jsch.JSchException: Auth cancel [preauth]" } ``` Which seems reasonable... Off to figure out why it isn't getting into elasticsearch... ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 6, 2017, 4:57am UTC](https://discuss.elastic.co/t/solved-nxlog-logstash-elasticsearch/50263/7 "2017-07-06T04:57:08Z")