# Gelf output plugin of Logstash is not pushing Azure Activity logs to Graylog

**URL:** <https://community.graylog.org/t/gelf-output-plugin-of-logstash-is-not-pushing-azure-activity-logs-to-graylog/28978>\
**Category:** GELF Library\
**Tags:** gelf-library\
**Created:** [May 29, 2023, 2:53am UTC](https://community.graylog.org/t/gelf-output-plugin-of-logstash-is-not-pushing-azure-activity-logs-to-graylog/28978 "2023-05-29T02:53:31Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![neeleshg](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/neeleshg/32/14855_2.png) [@neeleshg](https://community.graylog.org/u/neeleshg)\
**Post date:** [May 29, 2023, 2:53am UTC](https://community.graylog.org/t/gelf-output-plugin-of-logstash-is-not-pushing-azure-activity-logs-to-graylog/28978/1 "2023-05-29T02:53:31Z")

</div>

I have exported Azure Activity Logs to Blob Storage. I am using Logstash 8.7.1 version along with gelf output using docker-compose to ship these logs to Graylog using GelfUDP. For Input of Logstash, using azure\_blob\_storage plugin of Logstash.

However Logstash is unable to send these logs to Graylog.

```auto
input {
     azure_blob_storage {
          connection_string => "DefaultEndpointsProtocol=https;AccountName=<BLOB_NAME>;AccountKey=<BLOB_ACCOUNT_KEY>;EndpointSuffix=core.usgovcloudapi.net"
         container => "insights-activity-logs"
         registry_create_policy => "start_over"
         codec => "json"
         addall => true
         path_filters => ['**/*.json']
         addfilename => true
         prefix => "resourceId=/"
         # Possible options: `do_not_break`, `with_head_tail`, `without_head_tail`
         interval => 5
     }
 }

filter {
    json {
        source => "message"
    }
    mutate {
        add_field => {"short_message" => ["This is short message"]}
        add_field => { "host" => "127.0.0.1" }
    }
    date {
        match => ["unixtimestamp", "UNIX"]
    }
}

output {
    gelf {
        host => "127.0.0.1"
        port => 12201
        protocol => "UDP"
        codec => "json"
    }
}

```

I also checked with stdout output. it is showing all messages from blob. What can be the issue? Or how can I ship Azure Activity logs to Graylog?

---

<div class="post-metadata">

**Author:** ![drewmiranda-gl](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/drewmiranda-gl/32/13376_2.png) [@drewmiranda-gl](https://community.graylog.org/u/drewmiranda-gl)\
**Post date:** [May 30, 2023, 7:55pm UTC](https://community.graylog.org/t/gelf-output-plugin-of-logstash-is-not-pushing-azure-activity-logs-to-graylog/28978/2 "2023-05-30T19:55:52Z")

</div>

I’ve never used logstash but it looks like there is a specific gelf output plugin:

> **[Gelf output plugin | Logstash Reference \[8.8\] | Elastic](https://www.elastic.co/guide/en/logstash/current/plugins-outputs-gelf.html)**

---

<div class="post-metadata">

**Author:** ![neeleshg](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/neeleshg/32/14855_2.png) [@neeleshg](https://community.graylog.org/u/neeleshg)\
**Post date:** [May 31, 2023, 2:47pm UTC](https://community.graylog.org/t/gelf-output-plugin-of-logstash-is-not-pushing-azure-activity-logs-to-graylog/28978/3 "2023-05-31T14:47:11Z")

</div>

I have fixed this issue and my updated output code.  
Somehow Gelf UDP was not working, so created TCP Output and TCP Graylog Input.

```auto
output {
    gelf {
        host => "127.0.0.1"
        port => 12201
        protocol => "TCP"
        codec => "json"
    }
}

```