# Pipleline definition to parse Icinga logs (logstash of telegraph)

**URL:** <https://community.icinga.com/t/pipleline-definition-to-parse-icinga-logs-logstash-of-telegraph/10328>\
**Category:** Icinga 2\
**Tags:** graylog, logstash, telegraph\
**Created:** [August 8, 2022, 8:46am UTC](https://community.icinga.com/t/pipleline-definition-to-parse-icinga-logs-logstash-of-telegraph/10328 "2022-08-08T08:46:56Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![PedroMSantosD](https://community.icinga.com/user_avatar/community.icinga.com/pedromsantosd/32/2435_2.png) [@PedroMSantosD](https://community.icinga.com/u/PedroMSantosD)\
**Post date:** [August 8, 2022, 8:46am UTC](https://community.icinga.com/t/pipleline-definition-to-parse-icinga-logs-logstash-of-telegraph/10328/1 "2022-08-08T08:46:56Z")

</div>

Hi, I’m trying to ‘automagically’ parse icinga logs for troubleshooting, and I was wondering if anyone has already developed either a

- _logstash_ input pipeline definition or a
- _teletraph_ input definition  
So that I don’t have to reinvent the wheel?

I know there are icinga features for elasticsearch ([Features - Icinga 2](https://icinga.com/docs/icinga-2/latest/doc/14-features/#elasticsearch-writer)), elastic-beats integration ([About - Icingabeat](https://icinga.com/docs/icingabeat/latest/docs/01-about/)) ; Gelf-wirter([Features - Icinga 2](https://icinga.com/docs/icinga-2/latest/doc/14-features/#gelf-writer)), but neither of those seem appropiate to parse already existing log files

Thanks in advance

---

<div class="post-metadata">

**Author:** ![MarcusCaepio](https://community.icinga.com/user_avatar/community.icinga.com/marcuscaepio/32/287_2.png) [@MarcusCaepio](https://community.icinga.com/u/MarcusCaepio)\
**Post date:** [August 8, 2022, 11:36am UTC](https://community.icinga.com/t/pipleline-definition-to-parse-icinga-logs-logstash-of-telegraph/10328/2 "2022-08-08T11:36:25Z")

</div>

Hi,  
there is an icinga module for filebeat: [Icinga module | Filebeat Reference [8.3] | Elastic](https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-icinga.html)

---

<div class="post-metadata">

**Author:** ![PedroMSantosD](https://community.icinga.com/user_avatar/community.icinga.com/pedromsantosd/32/2435_2.png) [@PedroMSantosD](https://community.icinga.com/u/PedroMSantosD)\
**Post date:** [August 16, 2022, 7:18am UTC](https://community.icinga.com/t/pipleline-definition-to-parse-icinga-logs-logstash-of-telegraph/10328/3 "2022-08-16T07:18:17Z")

</div>

Thanks Marcus!  
Trully appreciated

> <https://github.com/elastic/beats/blob/master/filebeat/module/icinga/main/ingest/pipeline.yml>