# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1013 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1014 --- ## [How to send a json object to elasticsearch throw logstash](https://discuss.elastic.co/t/how-to-send-a-json-object-to-elasticsearch-throw-logstash/79516)
**Author:** [@DemeCarvO](https://discuss.elastic.co/u/DemeCarvO)\ **Replies:** 14\ **Last updated:** [March 22, 2017, 8:25pm UTC](https://discuss.elastic.co/t/how-to-send-a-json-object-to-elasticsearch-throw-logstash/79516 "2017-03-22T20:25:30Z")
I am creating "bill" feature in my nodejs application that basically will save in Elasticsearch the username every time any user access any rest service. I have struggling for the last two days with no success. It is my… --- ## [What version of logstash am I running](https://discuss.elastic.co/t/what-version-of-logstash-am-i-running/79642)
**Author:** [@tglasgow](https://discuss.elastic.co/u/tglasgow)\ **Replies:** 1\ **Last updated:** [March 22, 2017, 8:11pm UTC](https://discuss.elastic.co/t/what-version-of-logstash-am-i-running/79642 "2017-03-22T20:11:00Z")
I have found an old server we installed Logstash on and I want to know what agent version it is. What is the best way to determine the version of the agent from the command line of the server (for Windows and Linux)? --- ## [Stripping text from a JSON file](https://discuss.elastic.co/t/stripping-text-from-a-json-file/79428)
**Author:** [@Toontje](https://discuss.elastic.co/u/Toontje)\ **Replies:** 5\ **Last updated:** [March 22, 2017, 8:08pm UTC](https://discuss.elastic.co/t/stripping-text-from-a-json-file/79428 "2017-03-22T20:08:26Z")
Hi all! I have a valid JSON structure that is prepended with a fixed string and then a number. Something like: RRR This is the leading string created at 01-01-2017 at 12:34:56: { valid JSON } So there is a f… --- ## [I cant put logs in elasticsearch from logstash](https://discuss.elastic.co/t/i-cant-put-logs-in-elasticsearch-from-logstash/79068)
**Author:** [@adrianmc](https://discuss.elastic.co/u/adrianmc)\ **Replies:** 9\ **Last updated:** [March 22, 2017, 6:07pm UTC](https://discuss.elastic.co/t/i-cant-put-logs-in-elasticsearch-from-logstash/79068 "2017-03-22T18:07:42Z")
Im using logstash 1.4.2 and ... :slight\_smile: I have the next logstash.conf input { udp { port =\> 9991 codec =\> netflow { definitions =\> "/home/profucom/logstash-1.4.2/lib/logstash/codecs/netflo… --- ## [Logstash unable to reach es cluster on elastic cloud](https://discuss.elastic.co/t/logstash-unable-to-reach-es-cluster-on-elastic-cloud/79627)
**Author:** [@geantbrun](https://discuss.elastic.co/u/geantbrun)\ **Replies:** 2\ **Last updated:** [March 22, 2017, 5:54pm UTC](https://discuss.elastic.co/t/logstash-unable-to-reach-es-cluster-on-elastic-cloud/79627 "2017-03-22T17:54:22Z")
Hi, I'm experimenting with the elastic cloud for the first time and I have some issue when I try the simple example found here: https://www.elastic.co/blog/building-cloud-sandbox-with-sample-data-v2. When I try to do the… --- ## [Rubydebug logs get sent to /var/log/syslog rather than the default log path (/var/log/logstash/)](https://discuss.elastic.co/t/rubydebug-logs-get-sent-to-var-log-syslog-rather-than-the-default-log-path-var-log-logstash/79631)
**Author:** [@dfinn](https://discuss.elastic.co/u/dfinn)\ **Replies:** 0\ **Last updated:** [March 22, 2017, 5:52pm UTC](https://discuss.elastic.co/t/rubydebug-logs-get-sent-to-var-log-syslog-rather-than-the-default-log-path-var-log-logstash/79631 "2017-03-22T17:52:25Z")
Logstash 5.2.2-1 installed from Elastic repos on Ubuntu 16 While troubleshooting an issue earlier I enabled rubydebug output like so: output { elasticsearch { hosts =\> "localhost:9200" } stdout { codec =\> r… --- ## [Logstash : run at periodical interval](https://discuss.elastic.co/t/logstash-run-at-periodical-interval/79625)
**Author:** [@Lemec\_Cinq](https://discuss.elastic.co/u/Lemec_Cinq)\ **Replies:** 1\ **Last updated:** [March 22, 2017, 5:39pm UTC](https://discuss.elastic.co/t/logstash-run-at-periodical-interval/79625 "2017-03-22T17:39:32Z")
I would like to launch my logstash task at periodical interval: Do you know if there is a way and if i should add some stuffs to my conf file bellow ? input { jdbc { jdbc\_connection\_string =\> "jdbc:sqlserver:/… --- ## [Constant JSON parse errors in logstash output log](https://discuss.elastic.co/t/constant-json-parse-errors-in-logstash-output-log/79515)
**Author:** [@dfinn](https://discuss.elastic.co/u/dfinn)\ **Replies:** 2\ **Last updated:** [March 22, 2017, 5:17pm UTC](https://discuss.elastic.co/t/constant-json-parse-errors-in-logstash-output-log/79515 "2017-03-22T17:17:10Z")
This may be more of a general question on how to deal with mixed inputs of normal logs and JSON. I'm working on upgrading our stack to 5.2. As part of this process I've built a new ELK server and I have it up and runn… --- ## [Error with offline plugin installation](https://discuss.elastic.co/t/error-with-offline-plugin-installation/79608)
**Author:** [@cmpsoares](https://discuss.elastic.co/u/cmpsoares)\ **Replies:** 1\ **Last updated:** [March 22, 2017, 5:11pm UTC](https://discuss.elastic.co/t/error-with-offline-plugin-installation/79608 "2017-03-22T17:11:16Z")
Hello, Since I performed an offline installation of multiple packages (The installation itself did not throw any errors) I noticed that Logstash crashes at startup. When I check the service logs, I get as followed: … --- ## [IIS - CSV parsing error](https://discuss.elastic.co/t/iis-csv-parsing-error/79549)
**Author:** [@ronsevet](https://discuss.elastic.co/u/ronsevet)\ **Replies:** 7\ **Last updated:** [March 22, 2017, 2:53pm UTC](https://discuss.elastic.co/t/iis-csv-parsing-error/79549 "2017-03-22T14:53:45Z")
Hi, I've been using Logstash for quite some time and over many of it's versions, we are shipping IIS logs via Filebeat to Logstash (currently 5.2.0) filtering of these logs is done mostly via CSV filter (we tried GROK … --- ## [How to Upsert Nested Obj using grok and Logstash](https://discuss.elastic.co/t/how-to-upsert-nested-obj-using-grok-and-logstash/79164)
**Author:** [@abidul\_wahab\_ramadan](https://discuss.elastic.co/u/abidul_wahab_ramadan)\ **Replies:** 3\ **Last updated:** [March 22, 2017, 1:58pm UTC](https://discuss.elastic.co/t/how-to-upsert-nested-obj-using-grok-and-logstash/79164 "2017-03-22T13:58:13Z")
So currently i'm analysing data from my MYSQL subtitles db, and putting them in ElasticSearch 5.2. Regardless, my ES logstash has the following filter: filter { grok { match =\> \["subtitles", "%{TIME:\[\_su… --- ## [Logstash: Reading the log files remotely](https://discuss.elastic.co/t/logstash-reading-the-log-files-remotely/79591)
**Author:** [@mruthyu](https://discuss.elastic.co/u/mruthyu)\ **Replies:** 1\ **Last updated:** [March 22, 2017, 1:44pm UTC](https://discuss.elastic.co/t/logstash-reading-the-log-files-remotely/79591 "2017-03-22T13:44:19Z")
Whether logstash can be used to read the log files (Webserver, Application,.etc) remotely, instead of using the filebeat locally on the server where the logs reside? --- ## [Pattern Assistance](https://discuss.elastic.co/t/pattern-assistance/79283)
**Author:** [@rach](https://discuss.elastic.co/u/rach)\ **Replies:** 12\ **Last updated:** [March 22, 2017, 1:34pm UTC](https://discuss.elastic.co/t/pattern-assistance/79283 "2017-03-22T13:34:25Z")
Hi :slight\_smile: can you please help me understand the issue? this is my log: DEBUG 2017-02-21 17:49:13,431 "local Ip":172.33.82.82 "Algo":Extraction "Status":"Constructor" "Current":0 "Pending":0 "Done":0 "All":0 "T… --- ## [Help with Netflow Configuration](https://discuss.elastic.co/t/help-with-netflow-configuration/79387)
**Author:** [@BenoitJ76](https://discuss.elastic.co/u/BenoitJ76)\ **Replies:** 5\ **Last updated:** [March 22, 2017, 1:15pm UTC](https://discuss.elastic.co/t/help-with-netflow-configuration/79387 "2017-03-22T13:15:26Z")
Hello, First, I have this error : "\[2017-03-21T11:36:33,543\]\[WARN \]\[logstash.codecs.netflow \] No matching template for flow id 260" I read a lot of topics about that but I don't know how to solve this. Then, I trie… --- ## [IndexOutOfBoundsException in ackedQueue](https://discuss.elastic.co/t/indexoutofboundsexception-in-ackedqueue/79576)
**Author:** [@sivu](https://discuss.elastic.co/u/sivu)\ **Replies:** 0\ **Last updated:** [March 22, 2017, 11:28am UTC](https://discuss.elastic.co/t/indexoutofboundsexception-in-ackedqueue/79576 "2017-03-22T11:28:49Z")
I am receiving IndexOutOfBoundsException from time to time, usually right after if output fails to push events into elasticsearch, but it can happen in other places too. Example log snippet with partial callstack becau… --- ## [Cisco ASA firewall patterns](https://discuss.elastic.co/t/cisco-asa-firewall-patterns/79573)
**Author:** [@caliph](https://discuss.elastic.co/u/caliph)\ **Replies:** 1\ **Last updated:** [March 22, 2017, 11:26am UTC](https://discuss.elastic.co/t/cisco-asa-firewall-patterns/79573 "2017-03-22T11:26:26Z")
I am new to Elastic and have been experimenting with syslog from my Cisco ASA firewall to logstash to get an understanding of it. I've followed the various instructions on the Internet to achieve this and managed to get … --- ## [How to import a csv file into elasticsearch using logstash without filtering the fields?](https://discuss.elastic.co/t/how-to-import-a-csv-file-into-elasticsearch-using-logstash-without-filtering-the-fields/79379)
**Author:** [@Nesrine](https://discuss.elastic.co/u/Nesrine)\ **Replies:** 3\ **Last updated:** [March 22, 2017, 9:54am UTC](https://discuss.elastic.co/t/how-to-import-a-csv-file-into-elasticsearch-using-logstash-without-filtering-the-fields/79379 "2017-03-22T09:54:42Z")
Hello , I want to load the csv file into elasticsearch using logstash without using filter , I mean without knowing all the fields, I want to load it all Thank you in advance :slight\_smile: --- ## [Tibco EMS/JMS plugin integration with Logstash](https://discuss.elastic.co/t/tibco-ems-jms-plugin-integration-with-logstash/79009)
**Author:** [@Hanit\_grover](https://discuss.elastic.co/u/Hanit_grover)\ **Replies:** 2\ **Last updated:** [March 22, 2017, 9:17am UTC](https://discuss.elastic.co/t/tibco-ems-jms-plugin-integration-with-logstash/79009 "2017-03-22T09:17:39Z")
Has anyone integrated the input JMS plugin with logstash. I am trying to send events/messages from Tibco ESB and want to recieve that in logstash but could not find the configuration details. Can somebody help with the c… --- ## [Condition check eror](https://discuss.elastic.co/t/condition-check-eror/79539)
**Author:** [@shijinbose](https://discuss.elastic.co/u/shijinbose)\ **Replies:** 2\ **Last updated:** [March 22, 2017, 7:18am UTC](https://discuss.elastic.co/t/condition-check-eror/79539 "2017-03-22T07:18:47Z")
Hi, I am trying to filter out "Error" from the message tag, input { tcp { port =\> 5000 type =\> syslog } udp { port =\> 5000 type =\> syslog } } filter { grok { match =\> { "message… --- ## [Combining all log lines starting with the same timestamps to a single event](https://discuss.elastic.co/t/combining-all-log-lines-starting-with-the-same-timestamps-to-a-single-event/79537)
**Author:** [@alex88](https://discuss.elastic.co/u/alex88)\ **Replies:** 1\ **Last updated:** [March 22, 2017, 6:46am UTC](https://discuss.elastic.co/t/combining-all-log-lines-starting-with-the-same-timestamps-to-a-single-event/79537 "2017-03-22T06:46:07Z")
i have apache mod\_wsgi log: \[Sun Mar 05 14:26:12.858516 2017\] \[wsgi:error\] \[pid 11254:tid 140473096181504\] \[Sun Mar 05 14:26:12.859199 2017\] \[wsgi:error\] \[pid 11254:tid 140473096181504\] /usr/local/lib/python3.5/dist-p… --- ## [Question: Possible to override the response body of http-input plugin?](https://discuss.elastic.co/t/question-possible-to-override-the-response-body-of-http-input-plugin/79482)
**Author:** [@paul.42](https://discuss.elastic.co/u/paul.42)\ **Replies:** 1\ **Last updated:** [March 22, 2017, 6:37am UTC](https://discuss.elastic.co/t/question-possible-to-override-the-response-body-of-http-input-plugin/79482 "2017-03-22T06:37:57Z")
We're trying to send data from a .net application to logstash for ingest into elastic search, I was wondering if we could use a more REST oriented class, sending/receiving JSON. When we set the response-header to be appl… --- ## [Parsing xml with name value pairs?](https://discuss.elastic.co/t/parsing-xml-with-name-value-pairs/79506)
**Author:** [@darren114](https://discuss.elastic.co/u/darren114)\ **Replies:** 1\ **Last updated:** [March 22, 2017, 6:36am UTC](https://discuss.elastic.co/t/parsing-xml-with-name-value-pairs/79506 "2017-03-22T06:36:17Z")
Can someone please provide an example config file setup to parse a xml file with name value pairs? I have a sample xml input below: \ **Author:** [@leenanarmeta](https://discuss.elastic.co/u/leenanarmeta)\ **Replies:** 5\ **Last updated:** [March 22, 2017, 5:20am UTC](https://discuss.elastic.co/t/logstash-scheduling-for-every-one-hour/79411 "2017-03-22T05:20:25Z") Hi, EveryOne how can i schedule logstash for every hour and for every 6 hours.......? Regads N Leena --- ## [Logstash for Mainframes](https://discuss.elastic.co/t/logstash-for-mainframes/58378)
**Author:** [@elkuser](https://discuss.elastic.co/u/elkuser)\ **Replies:** 1\ **Last updated:** [March 22, 2017, 4:02am UTC](https://discuss.elastic.co/t/logstash-for-mainframes/58378 "2017-03-22T04:02:24Z")
Is there a version of Logstash for Z/OS Unix for Mainframes? --- ## [Logstash to elasticsearch template to elasticsearch](https://discuss.elastic.co/t/logstash-to-elasticsearch-template-to-elasticsearch/79385)
**Author:** [@gringo](https://discuss.elastic.co/u/gringo)\ **Replies:** 2\ **Last updated:** [March 22, 2017, 3:06am UTC](https://discuss.elastic.co/t/logstash-to-elasticsearch-template-to-elasticsearch/79385 "2017-03-22T03:06:09Z")
I have done geoip geoip { database =\> "C:\\GeoLiteCity.dat" source =\> "sIP" target =\> "srcGeoIP" } Tried template "sourceGeoIP": { "type": "object", "index": "not\_analyzed" } and "sourceGeo… --- ## [Ingestion pipeline](https://discuss.elastic.co/t/ingestion-pipeline/79122)
**Author:** [@shane\_lee](https://discuss.elastic.co/u/shane_lee)\ **Replies:** 8\ **Last updated:** [March 22, 2017, 2:09am UTC](https://discuss.elastic.co/t/ingestion-pipeline/79122 "2017-03-22T02:09:02Z")
Hi, I am looking at ingestion pipeline using logstash into elasticsearch. Source data comes from sql database (MySQL) I have used the jdbc input plugin for logstash which is fantastic. I have a question: I want t… --- ## [Parsing difficulties filters/plugin](https://discuss.elastic.co/t/parsing-difficulties-filters-plugin/79484)
**Author:** [@zbay](https://discuss.elastic.co/u/zbay)\ **Replies:** 7\ **Last updated:** [March 22, 2017, 1:03am UTC](https://discuss.elastic.co/t/parsing-difficulties-filters-plugin/79484 "2017-03-22T01:03:11Z")
hello everyone, I've been having a little difficulty dealing with this collection of files I'm trying to get indexed into the elk stack. As of the current conf file the system is parsing everything into the system and ad… --- ## [Logstash with multiple inputs](https://discuss.elastic.co/t/logstash-with-multiple-inputs/79326)
**Author:** [@red888](https://discuss.elastic.co/u/red888)\ **Replies:** 2\ **Last updated:** [March 22, 2017, 12:44am UTC](https://discuss.elastic.co/t/logstash-with-multiple-inputs/79326 "2017-03-22T00:44:41Z")
I have beats shipping syslog and nxlog shipping iis logs to logstash. So I have this in my logstash config: input { beats { port =\> "3333" } tcp { type =\> "iis" … --- ## [Input file reads the entire file with every new row](https://discuss.elastic.co/t/input-file-reads-the-entire-file-with-every-new-row/79505)
**Author:** [@zisraeli](https://discuss.elastic.co/u/zisraeli)\ **Replies:** 2\ **Last updated:** [March 21, 2017, 9:30pm UTC](https://discuss.elastic.co/t/input-file-reads-the-entire-file-with-every-new-row/79505 "2017-03-21T21:30:23Z")
My input file configuration is as follow: input { file { path =\> "c:\\temp\\my-logstash.input" type =\> "logs" start\_position =\> "end" } } Yet, every time I add a row to the my-logstash.input file, the e… --- ## [Reading files chronologically](https://discuss.elastic.co/t/reading-files-chronologically/79466)
**Author:** [@blacklobo](https://discuss.elastic.co/u/blacklobo)\ **Replies:** 1\ **Last updated:** [March 21, 2017, 8:33pm UTC](https://discuss.elastic.co/t/reading-files-chronologically/79466 "2017-03-21T20:33:10Z")
Is there a way to force Logstash to open files in chronological order so that they are written to the Kafka topic in chronological order? I am setting up a Logstash instance that will read files written to a server (2 … [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1012) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1014)