# How to configure sensu to send log to ELK host?
**URL:** https://discourse.sensu.io/t/how-to-configure-sensu-to-send-log-to-elk-host/334
**Category:** Sensu Classic (EOL)
**Created:** [January 8, 2015, 4:14am UTC](https://discourse.sensu.io/t/how-to-configure-sensu-to-send-log-to-elk-host/334 "2015-01-08T04:14:56Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@Jin\_Nguyen](https://discourse.sensu.io/u/Jin_Nguyen)
#### Post date: [January 8, 2015, 4:14am UTC](https://discourse.sensu.io/t/how-to-configure-sensu-to-send-log-to-elk-host/334/1 "2015-01-08T04:14:56Z")
Hi guys,
I want to send log of sensu to logstash and this is my config
logstash.json:
{
“logstash”: {
“server”: “192.168.1.100”,
“port”: 5099,
“list”: “logstash”,
“type” : “sensu-logstash”
}
}
handler\_logstash.json:
{
“handlers”: {
“logstash”: {
“type”: “pipe”,
“command”: “/opt/sensu/embedded/bin/ruby /etc/sensu/handlers/logstash.rb”,
“severities”: [
“ok”,
“warning”,
“critical”,
“unknown”
]
}
}
}
config.json:
{
“handlers”: {
“default”: {
“type”: “set”,
“handlers”: [
“logstash”
]
},
“logstash”: {
“socket”: {
“host”: “192.168.1.100”,
“port”: 5099
},
“type”: “tcp”,
“command”: “/etc/sensu/handlers/logstash.rb”
}
}
}
and config of logstash input:
input {
tcp { port =\> 5099 type =\> “sensu-logstash” }
}
output { elasticsearch { host =\> “192.168.1.100” protocol =\> “http” port =\> “9200” } }
are these config file ok?I have no received any event. Someone help me this config
Thanks in advanced
---
### Author:  [@Kyle\_Anderson](https://discourse.sensu.io/u/Kyle_Anderson)
#### Post date: [January 9, 2015, 3:14am UTC](https://discourse.sensu.io/t/how-to-configure-sensu-to-send-log-to-elk-host/334/2 "2015-01-09T03:14:04Z")
It looks like the logstash handler is defined as a "tcp" handler and a
"pipe" handler?
Also by examining the output of the sensu-sever logs you should be
able to inspect what is happening?
> **···**
>
> On Wed, Jan 7, 2015 at 8:14 PM, Jin Nguyen \ wrote:
>
> > Hi guys,
> >
> > I want to send log of sensu to logstash and this is my config
> >
> > logstash.json:
> >
> > {
> > "logstash": {
> > "server": "192.168.1.100",
> > "port": 5099,
> > "list": "logstash",
> > "type" : "sensu-logstash"
> > }
> > }
> >
> > handler\_logstash.json:
> >
> > {
> > "handlers": {
> > "logstash": {
> > "type": "pipe",
> > "command": "/opt/sensu/embedded/bin/ruby
> > /etc/sensu/handlers/logstash.rb",
> > "severities": [
> > "ok",
> > "warning",
> > "critical",
> > "unknown"
> > ]
> > }
> > }
> > }
> >
> > config.json:
> >
> > {
> > "handlers": {
> > "default": {
> > "type": "set",
> > "handlers": [
> > "logstash"
> > ]
> > },
> > "logstash": {
> > "socket": {
> > "host": "192.168.1.100",
> > "port": 5099
> > },
> > "type": "tcp",
> > "command": "/etc/sensu/handlers/logstash.rb"
> > }
> > }
> > }
> >
> > and config of logstash input:
> >
> > input {
> >
> > tcp { port =\> 5099 type =\> "sensu-logstash" }
> >
> > }
> >
> > output { elasticsearch { host =\> "192.168.1.100" protocol =\> "http" port =\>
> > "9200" } }
> >
> > are these config file ok?I have no received any event. Someone help me this
> > config
> >
> > Thanks in advanced
---
### Author:  [@lenfree\_yeung](https://discourse.sensu.io/u/lenfree_yeung)
#### Post date: [May 5, 2015, 1:22pm UTC](https://discourse.sensu.io/t/how-to-configure-sensu-to-send-log-to-elk-host/334/3 "2015-05-05T13:22:32Z")
Hi Jin,
Wondering if you had solved this? I am trying to implement similar one, either via UDP or Redis.
> **···**
>
> On Friday, 9 January 2015 14:14:06 UTC+11, Kyle Anderson wrote:
>
> > It looks like the logstash handler is defined as a “tcp” handler and a
> >
> > “pipe” handler?
> >
> > Also by examining the output of the sensu-sever logs you should be
> >
> > able to inspect what is happening?
> >
> > On Wed, Jan 7, 2015 at 8:14 PM, Jin Nguyen [jin...@gmail.com](mailto:jin...@gmail.com) wrote:
> >
> > > Hi guys,
> >
> > >
> >
> > > I want to send log of sensu to logstash and this is my config
> >
> > >
> >
> > > logstash.json:
> >
> > >
> >
> > > {
> >
> > > “logstash”: {
> >
> > > ```
> > > "server": "192.168.1.100",
> > >
> > > ```
> >
> > > ```
> > > "port": 5099,
> > >
> > > ```
> >
> > > ```
> > > "list": "logstash",
> > >
> > > ```
> >
> > > ```
> > > "type" : "sensu-logstash"
> > >
> > > ```
> >
> > > ```
> > > }
> > >
> > > ```
> >
> > > }
> >
> > >
> >
> > > handler\_logstash.json:
> >
> > >
> >
> > > {
> >
> > > “handlers”: {
> >
> > > ```
> > > "logstash": {
> > >
> > > ```
> >
> > > ```
> > > "type": "pipe",
> > >
> > > ```
> >
> > > ```
> > > "command": "/opt/sensu/embedded/bin/ruby
> > >
> > > ```
> >
> > > /etc/sensu/handlers/logstash.rb",
> >
> > > ```
> > > "severities": [
> > >
> > > ```
> >
> > > ```
> > > "ok",
> > >
> > > ```
> >
> > > ```
> > > "warning",
> > >
> > > ```
> >
> > > ```
> > > "critical",
> > >
> > > ```
> >
> > > ```
> > > "unknown"
> > >
> > > ```
> >
> > > ```
> > > ]
> > >
> > > ```
> >
> > > ```
> > > }
> > >
> > > ```
> >
> > > }
> >
> > > }
> >
> > >
> >
> > > config.json:
> >
> > >
> >
> > > {
> >
> > > “handlers”: {
> >
> > > ```
> > > "default": {
> > >
> > > ```
> >
> > > ```
> > > "type": "set",
> > >
> > > ```
> >
> > > ```
> > > "handlers": [
> > >
> > > ```
> >
> > > ```
> > > "logstash"
> > >
> > > ```
> >
> > > ```
> > > ]
> > >
> > > ```
> >
> > > ```
> > > },
> > >
> > > ```
> >
> > > ```
> > > "logstash": {
> > >
> > > ```
> >
> > > ```
> > > "socket": {
> > >
> > > ```
> >
> > > ```
> > > "host": "192.168.1.100",
> > >
> > > ```
> >
> > > ```
> > > "port": 5099
> > >
> > > ```
> >
> > > ```
> > > },
> > >
> > > ```
> >
> > > ```
> > > "type": "tcp",
> > >
> > > ```
> >
> > > ```
> > > "command": "/etc/sensu/handlers/logstash.rb"
> > >
> > > ```
> >
> > > ```
> > > }
> > >
> > > ```
> >
> > > }
> >
> > > }
> >
> > >
> >
> > >
> >
> > > and config of logstash input:
> >
> > >
> >
> > > input {
> >
> > >
> >
> > > tcp { port =\> 5099 type =\> “sensu-logstash” }
> >
> > >
> >
> > > }
> >
> > >
> >
> > > output { elasticsearch { host =\> “192.168.1.100” protocol =\> “http” port =\>
> >
> > > “9200” } }
> >
> > >
> >
> > > are these config file ok?I have no received any event. Someone help me this
> >
> > > config
> >
> > >
> >
> > > Thanks in advanced
---
### Author:  [@Matt\_Jones](https://discourse.sensu.io/u/Matt_Jones)
#### Post date: [May 5, 2015, 1:32pm UTC](https://discourse.sensu.io/t/how-to-configure-sensu-to-send-log-to-elk-host/334/4 "2015-05-05T13:32:08Z")
[https://github.com/sensu-plugins/sensu-plugins-logstash/issues/2](https://github.com/sensu-plugins/sensu-plugins-logstash/issues/2)
Cross-posting is fine, but make sure you reference it as the log info you posted could be helpful to other who are looking at the issue as well. 😉
> **···**
>
> On Tue, May 5, 2015 at 9:22 AM, lenfree yeung [lenfree.yeung@gmail.com](mailto:lenfree.yeung@gmail.com) wrote:
>
> > Hi Jin,
>
> > Wondering if you had solved this? I am trying to implement similar one, either via UDP or Redis.
> >
> > On Friday, 9 January 2015 14:14:06 UTC+11, Kyle Anderson wrote:
> >
> > > It looks like the logstash handler is defined as a “tcp” handler and a
> > > “pipe” handler?
> > >
> > > Also by examining the output of the sensu-sever logs you should be
> > > able to inspect what is happening?
> > >
> > > On Wed, Jan 7, 2015 at 8:14 PM, Jin Nguyen [jin...@gmail.com](mailto:jin...@gmail.com) wrote:
> > >
> > > > Hi guys,
> > > >
> > > > I want to send log of sensu to logstash and this is my config
> > > >
> > > > logstash.json:
> > > >
> > > > {
> > > > “logstash”: {
> > > > “server”: “192.168.1.100”,
> > > > “port”: 5099,
> > > > “list”: “logstash”,
> > > > “type” : “sensu-logstash”
> > > > }
> > > > }
> > > >
> > > > handler\_logstash.json:
> > > >
> > > > {
> > > > “handlers”: {
> > > > “logstash”: {
> > > > “type”: “pipe”,
> > > > “command”: “/opt/sensu/embedded/bin/ruby
> > > > /etc/sensu/handlers/logstash.rb”,
> > > > “severities”: [
> > > > “ok”,
> > > > “warning”,
> > > > “critical”,
> > > > “unknown”
> > > > ]
> > > > }
> > > > }
> > > > }
> > > >
> > > > config.json:
> > > >
> > > > {
> > > > “handlers”: {
> > > > “default”: {
> > > > “type”: “set”,
> > > > “handlers”: [
> > > > “logstash”
> > > > ]
> > > > },
> > > > “logstash”: {
> > > > “socket”: {
> > > > “host”: “192.168.1.100”,
> > > > “port”: 5099
> > > > },
> > > > “type”: “tcp”,
> > > > “command”: “/etc/sensu/handlers/logstash.rb”
> > > > }
> > > > }
> > > > }
> > > >
> > > > and config of logstash input:
> > > >
> > > > input {
> > > >
> > > > tcp { port =\> 5099 type =\> “sensu-logstash” }
> > > >
> > > > }
> > > >
> > > > output { elasticsearch { host =\> “192.168.1.100” protocol =\> “http” port =\>
> > > > “9200” } }
> > > >
> > > > are these config file ok?I have no received any event. Someone help me this
> > > > config
> > > >
> > > > Thanks in advanced
>
> –
>
> Matt Jones @DevopsMatt
>
> Infrastructure Engineer - [Yieldbot Inc.](http://yieldbot.com/)
>
> Core Contributor - [Sensu Plugins](http://sensu-plugins.github.io/)
>
> [https://linkedin.com/in/mattyjones](https://linkedin.com/in/mattyjones)