# Streaming Media Log Analyze

**URL:** <https://discuss.elastic.co/t/streaming-media-log-analyze/60954>\
**Category:** Logstash\
**Created:** [September 20, 2016, 1:08am UTC](https://discuss.elastic.co/t/streaming-media-log-analyze/60954 "2016-09-20T01:08:16Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![bv4wolf](https://avatars.discourse-cdn.com/v4/letter/b/9f8e36/32.png) [@bv4wolf](https://discuss.elastic.co/u/bv4wolf)\
**Post date:** [September 20, 2016, 1:08am UTC](https://discuss.elastic.co/t/streaming-media-log-analyze/60954/1 "2016-09-20T01:08:16Z")

</div>

Hi all,

I am the new user with the ELK system.

I've setup the ELK server and running OK.

Now I want to analyze the streaming Media logs (Videos, Flash, etc...) is put the the client servers (Filebeats is installed on the client servers).

Here are a sample log:  
145.116.135.62 - - [01/Jul/2016:00:00:01 +0000] "GET [http://sww.123w.sjye.net/213DW0/213-live/hls/AHYWHSAudioNum213.ts](http://sww.123w.sjye.net/213DW0/213-live/hls/AHYWHSAudioNum213.ts) HTTP/1.1" 200 82223 "[https://mediaplatform.streamingmediahosting.com/html5/html5lib/v2.35/mwEmbedFrame.php/p/11523/uiconf\_id/6711532/entry\_id/0\_zkqmb17e?wid=\_11523&iframeembed=true&playerId=smh\_player&entry\_id=0\_zkqmb17e&flashvars[streamerType]=rtmp](https://mediaplatform.streamingmediahosting.com/html5/html5lib/v2.35/mwEmbedFrame.php/p/11523/uiconf_id/6711532/entry_id/0_zkqmb17e?wid=_11523&iframeembed=true&playerId=smh_player&entry_id=0_zkqmb17e&flashvars%5BstreamerType%5D=rtmp)" "Mozilla/5.0 (iPhone; CPU iPhone OS 9\_3\_2 like Mac OS X) AppleWebKit/601.1.46 (KHTML, like Gecko) Version/9.0 Mobile/13F69 Safari/601.1"  
108.183.255.46 - - [01/Jul/2016:00:00:00 +0000] "GET [http://sds.dqa323.dsja.net/212CXX/321-live/hls/3213AudioNum23.ts](http://sds.dqa323.dsja.net/212CXX/321-live/hls/3213AudioNum23.ts) HTTP/1.1" 200 82249 "[https://mediaplatform.streamingmediahosting.com/html5/html5lib/v2.35/mwEmbedFrame.php/p/11523/uiconf\_id/6711532/entry\_id/0\_k4ss52rz?wid=\_11523&iframeembed=true&playerId=smh\_player&entry\_id=0\_k4ss52rz&flashvars[streamerType]=rtmp](https://mediaplatform.streamingmediahosting.com/html5/html5lib/v2.35/mwEmbedFrame.php/p/11523/uiconf_id/6711532/entry_id/0_k4ss52rz?wid=_11523&iframeembed=true&playerId=smh_player&entry_id=0_k4ss52rz&flashvars%5BstreamerType%5D=rtmp)" "Mozilla/5.0 (iPhone; CPU iPhone OS 9\_3\_2 like Mac OS X) AppleWebKit/601.1.46 (KHTML, like Gecko) Version/9.0 Mobile/13F69 Safari/601.1"

How can I analyze this logs, and what change I must do on filebeat conf and logstash conf?

---

<div class="post-metadata">

**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\
**Post date:** [September 20, 2016, 1:37am UTC](https://discuss.elastic.co/t/streaming-media-log-analyze/60954/2 "2016-09-20T01:37:10Z")

</div>

That looks like a standard apache log format.

Have a read of [https://www.elastic.co/guide/en/logstash/current/advanced-pipeline.html](https://www.elastic.co/guide/en/logstash/current/advanced-pipeline.html)

---

<div class="post-metadata">

**Author:** ![bv4wolf](https://avatars.discourse-cdn.com/v4/letter/b/9f8e36/32.png) [@bv4wolf](https://discuss.elastic.co/u/bv4wolf)\
**Post date:** [September 20, 2016, 1:43am UTC](https://discuss.elastic.co/t/streaming-media-log-analyze/60954/3 "2016-09-20T01:43:51Z")

</div>

thanhs @warkolm, i will try it and let you know the result. 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:37am UTC](https://discuss.elastic.co/t/streaming-media-log-analyze/60954/4 "2017-07-06T04:37:54Z")

</div>

Closed on July 6, 2017, 4:37am UTC