LEK stack for node.js 1) node access log file 1. node access log json formatting (/Users/mac/git/fuji/config/express.js) app.use(expressWinston.logger({ transports: [ new winston.transports.DailyRotateFile({ json: true , filename: config.logs_dir + '/access-', datePattern: 'yyyy-MM-dd.log' }) ] })); 2) logstash 1. logstash download http://logstash.net/ extract file to mac:/data1/logstash-1.4.0 2. make config file mac:/data1/logstash-1.4.0> vi logstash-node.conf input{ file{ codec => json path => ["/Users/mac/git/fuji/logs/access*.log"] start_position => "beginning" } } output{ elasticsearch { cluster => "locketCast" node_name => "logstash" host => "127.0.0.1" index => "updatelogs"