# Unable to send logs to logstash

**URL:** https://discuss.elastic.co/t/unable-to-send-logs-to-logstash/107260
**Category:** Beats
**Tags:** filebeat
**Created:** [November 11, 2017, 2:34am UTC](https://discuss.elastic.co/t/unable-to-send-logs-to-logstash/107260 "2017-11-11T02:34:06Z")
**Posts on this page:** 5
**Page:** 1

<div class="post-metadata">

### Author: ![shrikantgulia](https://avatars.discourse-cdn.com/v4/letter/s/c68b51/32.png) [@shrikantgulia](https://discuss.elastic.co/u/shrikantgulia)
#### Post date: [November 11, 2017, 2:34am UTC](https://discuss.elastic.co/t/unable-to-send-logs-to-logstash/107260/1 "2017-11-11T02:34:06Z")

</div>

filebeat.prospectors:

- input\_type: log  
paths:
  - /home/niked/Downloads/tom.log  
document\_type: prepaid\_logs  
multiline:  
pattern =\> "^%{TIMESTAMP\_ISO8601} "  
negate =\> true  
what =\> previous  
output.logstash:  
hosts: ["localhost:5044"]

This is my filebeat config but i am unable to send logs to filebeat.  
Help would be really appreciated

---

<div class="post-metadata">

### Author: ![Christian\_Dahlqvist](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/christian_dahlqvist/32/4617_2.png) [@Christian\_Dahlqvist](https://discuss.elastic.co/u/Christian_Dahlqvist)
#### Post date: [November 11, 2017, 11:20am UTC](https://discuss.elastic.co/t/unable-to-send-logs-to-logstash/107260/2 "2017-11-11T11:20:50Z")

</div>

Please format the config correctly using the tools in the editor. Yaml is sensitive to indentation so it is hard to tell what is right and wrong when config is not correctly formatted.

---

<div class="post-metadata">

### Author: ![shrikantgulia](https://avatars.discourse-cdn.com/v4/letter/s/c68b51/32.png) [@shrikantgulia](https://discuss.elastic.co/u/shrikantgulia)
#### Post date: [November 12, 2017, 8:03am UTC](https://discuss.elastic.co/t/unable-to-send-logs-to-logstash/107260/3 "2017-11-12T08:03:32Z")

</div>

@Christian_Dahlqvist thankyou for the reply  
Please have a look at the screenshot

 ![Screenshot from 2017-11-12 13:32:13](https://us1.discourse-cdn.com/elastic/original/3X/0/5/05574d5a73f58c4e7a934cc9168cec89d9e227da.png)

---

<div class="post-metadata">

### Author: ![steffens](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/steffens/32/79630_2.png) [@steffens](https://discuss.elastic.co/u/steffens)
#### Post date: [November 13, 2017, 5:22pm UTC](https://discuss.elastic.co/t/unable-to-send-logs-to-logstash/107260/4 "2017-11-13T17:22:00Z")

</div>

Use the `</>`-button to format configs. Please, no screenshots (I can barely read the text in the screenshot).

You can not use `%{...}` in filebeat multiline. You will have to configure a regular expression to match the format you're actually expecting.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 11, 2017, 5:22pm UTC](https://discuss.elastic.co/t/unable-to-send-logs-to-logstash/107260/5 "2017-12-11T17:22:18Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.