# AWX 22.0.0 External Logging Settings to ELK Stack

**URL:** <https://forum.ansible.com/t/awx-22-0-0-external-logging-settings-to-elk-stack/37866>\
**Category:** AWX Project\
**Tags:** awx\
**Created:** [April 9, 2023, 8:39am UTC](https://forum.ansible.com/t/awx-22-0-0-external-logging-settings-to-elk-stack/37866 "2023-04-09T08:39:06Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![jeromearellano](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/jeromearellano/32/999_2.png) [@jeromearellano](https://forum.ansible.com/u/jeromearellano)\
**Post date:** [April 9, 2023, 8:39am UTC](https://forum.ansible.com/t/awx-22-0-0-external-logging-settings-to-elk-stack/37866/1 "2023-04-09T08:39:06Z")

</div>

Hello AWX Project Team, To whom it may concern,

I would like to seek your expertise on how to setup the external logging settings of Ansible AWX.

**AWX Environment** :  
**OS** : CentOS Stream 8  
**K3S** :  
Client Version: v1.26.3+k3s1  
Kustomize Version: v4.5.7  
Server Version: v1.26.3+k3s1  
**AWX-Operator** : 2.0.0  
**Static IP** : 192.168.XXX.11

**ELK Enviroment** :  
**OS** : CentOS Stream 8  
**ELK Version** : 7.17.9  
**Static IP** : 192.168.XXX.12

I configured the ELK Stack as per usual below are my configs.

Kibana config: **/etc/kibana/kibana.yml**  
_server.host: “0.0.0.0”_  
_server.publicBaseUrl: “[http://kibana.local.com](http://kibana.local.com)”_

Elasticsearch config: **/etc/elasticsearch/elasticsearch.yml**  
_path.data: /var/lib/elasticsearch_  
_path.logs: /var/log/elasticsearch_

Logstash config: /etc/logstash/logstash.yml  
_path.data: /var/lib/logstash_  
_path.logs: /var/log/logstash_

Logstash Pipeline config: **/etc/logstash/conf.d/awx\_pipeline.conf**  
_input {_  
_http {_  
_port =\> 5055_  
_codec =\> “json”_  
_}_  
_}_

_filter {_  
_mutate {_  
_remove\_field =\> [“[headers]” ]_  
_}_  
_}_

_output {_  
_elasticsearch {_  
_hosts =\> [“[http://localhost:9200](http://localhost:9200)”]_  
_index =\> “awx-logs-%{+YYYY.MM.dd}”_  
_manage\_template =\> false_  
_}_  
_}_

Then next, i configure **AWX Settings \> Logging Settings** to the following values:  
_ **Logging Aggregator** : 192.168.XXX.12_  
_ **Logging Aggregator Port** : 5055_  
_ **Logging Aggregator Type** : logstash_  
_ **Logging Aggregator Protocol** : HTTPS/HTTP_  
_ **Logging Aggregator Level Threshold** : INFO_

With this configuration, I wasn’t able to collect any logs or output from AWX but i did a curl test if the [http://192.168.XXX.12:5055](http://192.168.XXX.12:5055) wasn’t reachable but it posted and Kibana was able to display the logs under index awx-logs-\*.

_curl -XPOST -H “Content-Type: application/json” [http://192.168.XXX.12:5055/](http://192.168.XXX.12:5055/) -d ‘{“message”: “Hello, World!”}’_  
_curl -XPOST -H “Content-Type: application/json” [http://192.168.XXX.12:5055/](http://192.168.XXX.12:5055/) -d ‘{“message”: “Hello, World2!”}’_

using this test, I was able to conclude that my ELK Stack is working.  
Am i missing something on logging settings or a configuration on AWX side?  
Thank you in advance for your response.

---

<div class="post-metadata">

**Author:** ![rake](https://avatars.discourse-cdn.com/v4/letter/r/8e8cbc/32.png) [@rake](https://forum.ansible.com/u/rake)\
**Post date:** [April 10, 2023, 12:51am UTC](https://forum.ansible.com/t/awx-22-0-0-external-logging-settings-to-elk-stack/37866/2 "2023-04-10T00:51:13Z")

</div>

I also had the similar issue in the past.Glad that it was just not me.  
Some thing is off with this log forwarding from the AWX to ELK Stack.

Thanks,  
Rakesh

---

<div class="post-metadata">

**Author:** ![jeromearellano](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/jeromearellano/32/999_2.png) [@jeromearellano](https://forum.ansible.com/u/jeromearellano)\
**Post date:** [April 10, 2023, 1:39pm UTC](https://forum.ansible.com/t/awx-22-0-0-external-logging-settings-to-elk-stack/37866/3 "2023-04-10T13:39:28Z")

</div>

Hello Rakesh,

I figured it out.  
Using the boilerplate and configuration of the ELK stack above. I’ve made an adjustment on AWX GUI. See below.  
I configure **AWX Settings \> Logging Settings** to the following values:  
**Logging Aggregator** : [http://192.168.XXX.12:5055](http://192.168.XXX.12:5055)  
**Logging Aggregator Port** : null  
**Logging Aggregator Type** : logstash  
**Logging Aggregator Protocol** : HTTPS/HTTP  
**Logging Aggregator Level Threshold:** INFO  
**Loggers Sending Data to Log Aggregator Form:**  
[  
“job\_events”  
]

logstash was able to collect the data from the execution of every jobs/templates on my AWX. go try it. cheers mate!

Jerome