# Logstash handler for every check resault

**URL:** <https://discourse.sensu.io/t/logstash-handler-for-every-check-resault/582>\
**Category:** Sensu Classic (EOL)\
**Created:** [April 27, 2016, 9:15am UTC](https://discourse.sensu.io/t/logstash-handler-for-every-check-resault/582 "2016-04-27T09:15:10Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Paneng\_Worldwide](https://avatars.discourse-cdn.com/v4/letter/p/ed655f/32.png) [@Paneng\_Worldwide](https://discourse.sensu.io/u/Paneng_Worldwide)\
**Post date:** [April 27, 2016, 9:15am UTC](https://discourse.sensu.io/t/logstash-handler-for-every-check-resault/582/1 "2016-04-27T09:15:10Z")

</div>

Hello,

We are using the logstash handler to write the check results into our ELK cluster. Unfortunately it just writes the stat changes (e.g. OK -\> critical). What we want is every check result into logstash even when the status keeps being “OK”.

Here the config:

“logstash”: {

“command”: “/etc/sensu/handlers/logstash.rb”,

“severities”: [

“ok”,

“warning”,

“critical”,

“unknown”

],

“type”: “pipe”

}

---

<div class="post-metadata">

**Author:** ![Philipp\_H](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.sensu.io/philipp_h/32/539_2.png) [@Philipp\_H](https://discourse.sensu.io/u/Philipp_H)\
**Post date:** [April 27, 2016, 5:55pm UTC](https://discourse.sensu.io/t/logstash-handler-for-every-check-resault/582/2 "2016-04-27T17:55:30Z")

</div>

That happens by design only metric events are handled every time. Our solution is using filebeat to collect all server and client logs and send them to logstash. They can be parsed easily and you get check results even if the server is unreachable or something like that.