Logstash working