# Which is the proper way to check Logstash activity?

**URL:** <https://discuss.elastic.co/t/which-is-the-proper-way-to-check-logstash-activity/63057>\
**Category:** Logstash\
**Created:** [October 14, 2016, 1:05pm UTC](https://discuss.elastic.co/t/which-is-the-proper-way-to-check-logstash-activity/63057 "2016-10-14T13:05:08Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![espogian](https://avatars.discourse-cdn.com/v4/letter/e/4491bb/32.png) [@espogian](https://discuss.elastic.co/u/espogian)\
**Post date:** [October 14, 2016, 1:05pm UTC](https://discuss.elastic.co/t/which-is-the-proper-way-to-check-logstash-activity/63057/1 "2016-10-14T13:05:08Z")

</div>

Hello, I'm using Logstash on a docker container (see [[https://hub.docker.com/\_/logstash/](https://hub.docker.com/_/logstash/)]) which I'm starting with the detach (-d) option.  
The thing is working fine, however now that I'm parsing a lot of logs I would like to check:

- If everything is going fine, I mean if Logstash is correctly filtering all lines, successfully sending them to Elasticsearch, etc.
- When Logstash has finished parsing one file
- Generally speaking, how Logstash is working

I see that in the Logstash container (which is running properly) inside /var/log/logstash I can't find any file. So where should I look for logs? Are there some commands to check the status?

---

<div class="post-metadata">

**Author:** ![magnusbaeck](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/magnusbaeck/32/44943_2.png) [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\
**Post date:** [October 19, 2016, 5:54am UTC](https://discuss.elastic.co/t/which-is-the-proper-way-to-check-logstash-activity/63057/2 "2016-10-19T05:54:24Z")

</div>

> If everything is going fine, I mean if Logstash is correctly filtering all lines, successfully sending them to Elasticsearch, etc.

Two things spring to mind:

- Is Logstash logging anything (errors or warnings, in particular) at any significant rate?
- Are messages flowing through Logstash? You can use [Lovebeat](https://github.com/boivie/lovebeat) to receive pings from Logstash and sound an alarm if they stop coming.

> When Logstash has finished parsing one file

You'll have to monitor your sincedb file(s) for that. I'm not sure if Logstash 5.0 adds any interesting metrics to the file input.

> I see that in the Logstash container (which is running properly) inside /var/log/logstash I can't find any file. So where should I look for logs?

`docker logs`, perhaps?

---

<div class="post-metadata">

**Author:** ![espogian](https://avatars.discourse-cdn.com/v4/letter/e/4491bb/32.png) [@espogian](https://discuss.elastic.co/u/espogian)\
**Post date:** [October 31, 2016, 3:40pm UTC](https://discuss.elastic.co/t/which-is-the-proper-way-to-check-logstash-activity/63057/3 "2016-10-31T15:40:30Z")

</div>

Thanks for the very complete answer! 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 6, 2017, 4:31am UTC](https://discuss.elastic.co/t/which-is-the-proper-way-to-check-logstash-activity/63057/4 "2017-07-06T04:31:56Z")

</div>