# Unable to send logs to remote Logstash server. working fine in localhost **URL:** \ **Category:** Logstash\ **Created:** [August 3, 2020, 9:33pm UTC](https://discuss.elastic.co/t/unable-to-send-logs-to-remote-logstash-server-working-fine-in-localhost/243628 "2020-08-03T21:33:52Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![mycloud2040](https://avatars.discourse-cdn.com/v4/letter/m/a183cd/32.png) [@mycloud2040](https://discuss.elastic.co/u/mycloud2040)\ **Post date:** [August 3, 2020, 9:33pm UTC](https://discuss.elastic.co/t/unable-to-send-logs-to-remote-logstash-server-working-fine-in-localhost/243628/1 "2020-08-03T21:33:52Z")
Hi, i am new to Elasticstack i configure filebeat in client machine, to send logs to logstash- it is not sending logs to logstash server. Here when I locally send logs to logstash server using filebeat its working fine. Any help would be appreciated , Thanks ---
**Author:** ![warkolm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/warkolm/32/39224_2.png) [@warkolm](https://discuss.elastic.co/u/warkolm)\ **Post date:** [August 3, 2020, 10:46pm UTC](https://discuss.elastic.co/t/unable-to-send-logs-to-remote-logstash-server-working-fine-in-localhost/243628/2 "2020-08-03T22:46:13Z")
Welcome to our community! 😃 What do your config files look like? ---
**Author:** ![mycloud2040](https://avatars.discourse-cdn.com/v4/letter/m/a183cd/32.png) [@mycloud2040](https://discuss.elastic.co/u/mycloud2040)\ **Post date:** [August 5, 2020, 6:42am UTC](https://discuss.elastic.co/t/unable-to-send-logs-to-remote-logstash-server-working-fine-in-localhost/243628/3 "2020-08-05T06:42:23Z")
HI warkolm, Thanks for kind update, below is my config files details. ## I have one elk server running with ( logstash, Kibana, Elasticsearch). I have to monitor logs from remote apache server. i have configure filebeat in apache server and it is running fine. filebeat.yml file at client side: - type: log enabled: true paths: - /var/log/apache2/\*.log ## filebeat.config.modules: path: ${path.config}/modules.d/\*.yml reload.enabled: false setup.template.settings: index.number\_of\_shards: 1 output.logstash: hosts: ["Remote-ELkServer:5044"] ## 02-beats-input.conf in ELK (/etc/logstash/conf.d): input { beats { port =\> 5044 host =\> "0.0.0.0" } } 10-apache2-filter.conf at ELK server: ## filter { if [fileset][module] == "apache2" { if [fileset][name] == "access" { grok { match =\> { "message" =\> ["%{IPORHOST:[apache2][access][remote\_ip]} - %{DATA:[apache2][access][user\_name]} [%{HTTPDATE:[apache2][access][time]}] "%{WORD:[apache2][access][method]} %{DATA:[apache2][access][url]} HTTP/%{NUMBER:[apache2][access][http\_version]}" %{NUMBER:[apache 2][access][response\_code]} %{NUMBER:[apache2][access][body\_sent][bytes]}( "%{DATA:[apache2][access][referrer]}")?( "%{DATA:[apache2][access] [agent]}")?", "%{IPORHOST:[apache2][access][remote\_ip]} - %{DATA:[apache2][access][user\_name]} \[%{HTTPDATE:[apache2][access][time]}\] "-" %{NU MBER:[apache2][access][response\_code]} -" ] } remove\_field =\> "message" } mutate { add\_field =\> { "read\_timestamp" =\> "%{@timestamp}" } } date { match =\> ["[apache2][access][time]", "dd/MMM/YYYY:H:m:s Z" ] remove\_field =\> "[apache2][access][time]" } useragent { source =\> "[apache2][access][agent]" target =\> "[apache2][access][user\_agent]" remove\_field =\> "[apache2][access][agent]" } geoip { source =\> "[apache2][access][remote\_ip]" target =\> "[apache2][access][geoip]" } } else if [fileset][name] == "error" { grok { match =\> { "message" =\> ["[%{APACHE\_TIME:[apache2][error][timestamp]}] [%{LOGLEVEL:[apache2][error][level]}]( [client %{IPORHOST:[apache2][error][client]}])? %{GREEDYDATA:[apache2][error][message]}", "[%{APACHE\_TIME:[apache2][error][timestamp]}] [%{DATA:[apache2][error][module]}:%{LOGLEVEL:[apache2][error][level]}] [pid %{NUMB ER:[apache2][error][pid]}(:tid %{NUMBER:[apache2][error][tid]})?]( [client %{IPORHOST:[apache2][error][client]}])? %{GREEDYDATA:[apache2][er ror][message1]}" ] } pattern\_definitions =\> { "APACHE\_TIME" =\> "%{DAY} %{MONTH} %{MONTHDAY} %{TIME} %{YEAR}" } remove\_field =\> "message" } mutate { rename =\> { "[apache2][error][message1]" =\> "[apache2][error][message]" } } date { match =\> ["[apache2][error][timestamp]", "EEE MMM dd H:m:s YYYY", "EEE MMM dd H:m:s.SSSSSS YYYY" ] remove\_field =\> "[apache2][error][timestamp]" } } } } ## 30-apache2-elasticserchoutput.conf at ELK server: output { elasticsearch { hosts =\> localhost manage\_template =\> false index =\> "%{[@metadata][beat]}-%{[@metadata][version]}-%{+YYYY.MM.dd}" } } ## Can you please clear my doubt.. do i have to configure logstash in client side also. ? at client side i just configure filebeat and mention the paths. I have also enable apache modue in ELK server. **filebeat test output** from client machine. logstash: 192.168.XX.XX:5044... connection... parse host... OK dns lookup... OK addresses: 192.168.XX.XX dial up... OK TLS... WARN secure connection disabled talk to server... OK ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [September 2, 2020, 6:42am UTC](https://discuss.elastic.co/t/unable-to-send-logs-to-remote-logstash-server-working-fine-in-localhost/243628/4 "2020-09-02T06:42:23Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.