# Where do I find proper syntax for configuring logstash?

**URL:** <https://discuss.elastic.co/t/where-do-i-find-proper-syntax-for-configuring-logstash/251160>\
**Category:** Logstash\
**Created:** [October 6, 2020, 4:03pm UTC](https://discuss.elastic.co/t/where-do-i-find-proper-syntax-for-configuring-logstash/251160 "2020-10-06T16:03:19Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![csheridan](https://avatars.discourse-cdn.com/v4/letter/c/e99b99/32.png) [@csheridan](https://discuss.elastic.co/u/csheridan)\
**Post date:** [October 6, 2020, 4:03pm UTC](https://discuss.elastic.co/t/where-do-i-find-proper-syntax-for-configuring-logstash/251160/1 "2020-10-06T16:03:19Z")

</div>

I have a server setup with ElasticSearch and Logstash. My plan is to have many remote servers with Filebeat installed and configured to send to this server. Currently, I am trying to get a single node setup so I know how to move forward, however, I cannot seem to get my index to show up. All I want is apache error logs and nothing else.

On the remote Filebeat server, I have these changes in my /etc/filebeat/filebeat.yml:

```auto
    # ============================== Filebeat inputs ===============================

    filebeat.inputs:

    # Each - is an input. Most options can be set at the input level, so
    # you can use different inputs for various configurations.
    # Below are the input specific configurations.

    - type: log

      # Change to true to enable this input configuration.
      #enabled: false
      enabled: true

      # Paths that should be crawled and fetched. Glob based paths.
      paths:
        - /var/log/apache2/*.error.log

    # Set to true to enable config reloading
      reload.enabled: true

      # Period on which files under path should be checked for changes
      reload.period: 30s

# ------------------------------ Logstash Output -------------------------------
    output.logstash:
      # The Logstash hosts
      hosts: ["192.168.64.50:5044"]

```

Now, on my ElasticSearch/Logstash server, I created a directory `/etc/logstash/patterns.d/`, and in that directory, I placed a file `apache-error`. It contains:

```auto
APACHE_ERROR_TIME %{DAY} %{MONTH} %{MONTHDAY} %{TIME} %{YEAR}
APACHE_ERROR_LOG \[%{APACHE_ERROR_TIME:timestamp}\] \[%{LOGLEVEL:loglevel}\] (?:\[client %{IPORHOST:clientip}\] ){0,1}%{GREEDYDATA:errormsg}

```

In `/etc/logstash/conf.d/` I have a file `apache.conf`. It's contents are:

```auto
    input {
        beats {
            port => "5044"
        }
    }
     filter {
        grok {
          patterns_dir => ["/etc/logstash/patterns.d"]
          match => ["message", "%{APACHE_ERROR_LOG}"]
        }
        geoip {
            source => "clientip"
        }
    }
    output {
        elasticsearch {
          hosts => ["localhost:9200"]
          user => ["myadminuser"]
          password => ["myadminpass"]
          index => "apache-error-%{+YYYY.MM.dd}"
        }
    stdout { codec => rubydebug }
    }

```

I am completely new to this, and that apache-error config was taken directory from [this Stack Overflow question](https://stackoverflow.com/questions/17331593/parse-apache2-error-logs-with-grok-for-logstash). Where can I find documentation that tells me the proper syntax for what I'm looking at in that file? I may not need all of that, and would like to learn how to fine tune to my needs.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [November 3, 2020, 4:03pm UTC](https://discuss.elastic.co/t/where-do-i-find-proper-syntax-for-configuring-logstash/251160/2 "2020-11-03T16:03:22Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.