# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1014 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1015 --- ## [Logstash config error reason=\>"Expected one of #, \\", ', }](https://discuss.elastic.co/t/logstash-config-error-reason-expected-one-of/55594)
**Author:** [@Saurabh\_Jambhule](https://discuss.elastic.co/u/Saurabh_Jambhule)\ **Replies:** 7\ **Last updated:** [March 21, 2017, 8:20pm UTC](https://discuss.elastic.co/t/logstash-config-error-reason-expected-one-of/55594 "2017-03-21T20:20:17Z")
Why this error is coming... input { file { path =\> \[ "Documents/apache-sample-dataset.log" \] type =\> "apache" start\_position =\> "beginning" } } filter { if \[type\] == "apache" { grok { … --- ## [How to run queries from multiple JDBC inputs sequentially](https://discuss.elastic.co/t/how-to-run-queries-from-multiple-jdbc-inputs-sequentially/77226)
**Author:** [@madebydna](https://discuss.elastic.co/u/madebydna)\ **Replies:** 3\ **Last updated:** [March 21, 2017, 8:18pm UTC](https://discuss.elastic.co/t/how-to-run-queries-from-multiple-jdbc-inputs-sequentially/77226 "2017-03-21T20:18:35Z")
My pipeline consists of three JDBC inputs, a set of common filters and one output stage to Elasticsearch. The three JDBC inputs fetch similar data from three different tables, the aggregate filter groups the data by a pa… --- ## [Logstash newb, a bit baffled. Connecting a log4j2 application to logstash](https://discuss.elastic.co/t/logstash-newb-a-bit-baffled-connecting-a-log4j2-application-to-logstash/78045)
**Author:** [@dylan1987](https://discuss.elastic.co/u/dylan1987)\ **Replies:** 1\ **Last updated:** [March 21, 2017, 7:29pm UTC](https://discuss.elastic.co/t/logstash-newb-a-bit-baffled-connecting-a-log4j2-application-to-logstash/78045 "2017-03-21T19:29:48Z")
I have an application that uses log4j2 to output it's log files. I am trying to figure out a "correct", out-of-the-box way to get these logs into logstash. I see there is a log4j input plugin, however it does not sup… --- ## [Date match issue in logstash filter](https://discuss.elastic.co/t/date-match-issue-in-logstash-filter/79486)
**Author:** [@whyapenny](https://discuss.elastic.co/u/whyapenny)\ **Replies:** 1\ **Last updated:** [March 21, 2017, 6:54pm UTC](https://discuss.elastic.co/t/date-match-issue-in-logstash-filter/79486 "2017-03-21T18:54:09Z")
"Tue Mar 21 2017 11:55:00 GMT-0400 (EDT)" Could use a little help figuring out what I have wrong: date{ match =\> \[ "\[ENTRY\]\[Timestamp\]", "YYYY-MM-dd HH:mm:ss.SSS Z", "ISO8601", "EEE MMM dd yyyy HH:mm:ss z"… --- ## [How to debug statsd](https://discuss.elastic.co/t/how-to-debug-statsd/79467)
**Author:** [@ENG618](https://discuss.elastic.co/u/ENG618)\ **Replies:** 0\ **Last updated:** [March 21, 2017, 4:21pm UTC](https://discuss.elastic.co/t/how-to-debug-statsd/79467 "2017-03-21T16:21:33Z")
I keep getting the following line in my output: Unable to parse line: "logstash.%{host}.spaces.GET./api/673283b4667df11448015951bc0450" I am trying to get additional information as to why the parser is failing. I've… --- ## [Conditional for empty string in field](https://discuss.elastic.co/t/conditional-for-empty-string-in-field/77182)
**Author:** [@ENG618](https://discuss.elastic.co/u/ENG618)\ **Replies:** 6\ **Last updated:** [March 21, 2017, 4:03pm UTC](https://discuss.elastic.co/t/conditional-for-empty-string-in-field/77182 "2017-03-21T16:03:08Z")
I'm trying to drop logs from the config that contain a field with blank string for a particular field. e.g. if \[foo\] == "" { drop{} } This is not working as when the logs come through it shows as "foo" =\> "\\"\\"" A … --- ## [Logstash 2.4 -- Check if two \[tags\] is present then ouput](https://discuss.elastic.co/t/logstash-2-4-check-if-two-tags-is-present-then-ouput/79277)
**Author:** [@gh0stid](https://discuss.elastic.co/u/gh0stid)\ **Replies:** 20\ **Last updated:** [March 21, 2017, 3:11pm UTC](https://discuss.elastic.co/t/logstash-2-4-check-if-two-tags-is-present-then-ouput/79277 "2017-03-21T15:11:33Z")
Hello, Would like to have information I am having a little difficulty with my logstash config, I would like to be able to "filter" out IF traffic come and goes from internal network, then output it to a specific index f… --- ## [Logstash Date Filter issue](https://discuss.elastic.co/t/logstash-date-filter-issue/79170)
**Author:** [@kernelpanic](https://discuss.elastic.co/u/kernelpanic)\ **Replies:** 15\ **Last updated:** [March 21, 2017, 2:20pm UTC](https://discuss.elastic.co/t/logstash-date-filter-issue/79170 "2017-03-21T14:20:48Z")
Hello all, as part of testing Elasticsearch for use within our organisation I'm trying to capture entries from the Windowsupdate.log file in C:\\Windows but I'm having trouble converting the log's timestamp to be the Elas… --- ## [S3 Input Plugin Choking on Glacier Files](https://discuss.elastic.co/t/s3-input-plugin-choking-on-glacier-files/28119)
**Author:** [@zwalls](https://discuss.elastic.co/u/zwalls)\ **Replies:** 4\ **Last updated:** [August 28, 2015, 1:27pm UTC](https://discuss.elastic.co/t/s3-input-plugin-choking-on-glacier-files/28119 "2015-08-28T13:27:49Z")
Up-front info: Distro - Amazon Linux Logstash - yum-installed ElasticSearch - yum-installed These are on the same box, at present. I am currently using the s3 input plugin to ingest .gz'ed catalina log files. Recently… --- ## [Update a list json](https://discuss.elastic.co/t/update-a-list-json/79393)
**Author:** [@E.Eric](https://discuss.elastic.co/u/E.Eric)\ **Replies:** 1\ **Last updated:** [March 21, 2017, 1:20pm UTC](https://discuss.elastic.co/t/update-a-list-json/79393 "2017-03-21T13:20:32Z")
Hello, here is my field : "servers": \[ {"name":"value1", "ip":"value1"}, {"name":"value2","ip":"value2"} \] I want to update it with elasticsearch output plugin by adding a new server. this is my configuration: m… --- ## [Having trouble running Logstash as a service](https://discuss.elastic.co/t/having-trouble-running-logstash-as-a-service/79314)
**Author:** [@jcannell](https://discuss.elastic.co/u/jcannell)\ **Replies:** 1\ **Last updated:** [March 21, 2017, 1:03pm UTC](https://discuss.elastic.co/t/having-trouble-running-logstash-as-a-service/79314 "2017-03-21T13:03:17Z")
Hello, I've been experimenting with logstash for a little bit now but mostly from command line. I've had trouble getting it working properly when run as a service. Using logstash 2.3.4 install via rpm. sudo service… --- ## [Logstash code and documentation not aligned](https://discuss.elastic.co/t/logstash-code-and-documentation-not-aligned/79395)
**Author:** [@Santo\_Natale](https://discuss.elastic.co/u/Santo_Natale)\ **Replies:** 0\ **Last updated:** [March 21, 2017, 11:10am UTC](https://discuss.elastic.co/t/logstash-code-and-documentation-not-aligned/79395 "2017-03-21T11:10:06Z")
Hi, in this commit it seems that the default value for logfile for windows have been changed from \["Application","System", "Security"\] to "Application", while in the documentation here states that the default is still … --- ## [@timestamp not match with the log date](https://discuss.elastic.co/t/timestamp-not-match-with-the-log-date/78551)
**Author:** [@Michael\_TRAN](https://discuss.elastic.co/u/Michael_TRAN)\ **Replies:** 8\ **Last updated:** [March 21, 2017, 10:33am UTC](https://discuss.elastic.co/t/timestamp-not-match-with-the-log-date/78551 "2017-03-21T10:33:10Z")
Hi guys, I'm new in the ELK universe. I have a trouble with the date of my log. On kibana, Timestamp shows the date when I put it on my server but not when the log were created. I try to modify my logstash configuration… --- ## [Sending CSV data to Logstash](https://discuss.elastic.co/t/sending-csv-data-to-logstash/79376)
**Author:** [@prakash1243](https://discuss.elastic.co/u/prakash1243)\ **Replies:** 1\ **Last updated:** [March 21, 2017, 10:21am UTC](https://discuss.elastic.co/t/sending-csv-data-to-logstash/79376 "2017-03-21T10:21:05Z")
Hi - I have a CSV data, I'd need to publish them to the Logstash and then to the Elastic Search, and may be visualize them on the Kibana. Could some one please help me in doing this. Am pretty much new to the Logstash… --- ## [Split line in multiple messages](https://discuss.elastic.co/t/split-line-in-multiple-messages/77011)
**Author:** [@bertvervaele](https://discuss.elastic.co/u/bertvervaele)\ **Replies:** 2\ **Last updated:** [March 21, 2017, 8:52am UTC](https://discuss.elastic.co/t/split-line-in-multiple-messages/77011 "2017-03-21T08:52:28Z")
I have all my logs on 1 line like this: aE0020170216090418001004100058S3 0 26742 2711-------- 640--------------------------------------… --- ## [HTTP\_Poller Connection Refused from within a Docker contrainer](https://discuss.elastic.co/t/http-poller-connection-refused-from-within-a-docker-contrainer/76767)
**Author:** [@lisadeng](https://discuss.elastic.co/u/lisadeng)\ **Replies:** 4\ **Last updated:** [March 21, 2017, 8:40am UTC](https://discuss.elastic.co/t/http-poller-connection-refused-from-within-a-docker-contrainer/76767 "2017-03-21T08:40:04Z")
I'm really new to the ELK stack and honestly extremely shaky when it comes to understanding concepts like ports, port forwarding and how they relate to Docker and the ELK stack. I'm currently trying to use HTTP Poller,… --- ## [Stomp output plugin ignoring codec?](https://discuss.elastic.co/t/stomp-output-plugin-ignoring-codec/79367)
**Author:** [@Benjamin\_Habegger](https://discuss.elastic.co/u/Benjamin_Habegger)\ **Replies:** 0\ **Last updated:** [March 21, 2017, 8:20am UTC](https://discuss.elastic.co/t/stomp-output-plugin-ignoring-codec/79367 "2017-03-21T08:20:39Z")
In the documentation codec is marked as one of the plugins options. The expected behavior is that the codec is used as the message body (eg. codec =\> plain, should give the message as is). However json is always the retu… --- ## [Cannot install v5.2.2, although JAVA is installed](https://discuss.elastic.co/t/cannot-install-v5-2-2-although-java-is-installed/79365)
**Author:** [@netfisher](https://discuss.elastic.co/u/netfisher)\ **Replies:** 0\ **Last updated:** [March 21, 2017, 8:12am UTC](https://discuss.elastic.co/t/cannot-install-v5-2-2-although-java-is-installed/79365 "2017-03-21T08:12:53Z")
During the installation process Logstash v5.2.2 an error occurs "Could not find any executable java binary. Please install java in your PATH or set JAVAHOME."\_ Installing on the server with installed ubuntu 16.04.2-serve… --- ## [Unable to parse Grok Filter on Proxy Logs](https://discuss.elastic.co/t/unable-to-parse-grok-filter-on-proxy-logs/79194)
**Author:** [@supercup](https://discuss.elastic.co/u/supercup)\ **Replies:** 3\ **Last updated:** [March 21, 2017, 8:05am UTC](https://discuss.elastic.co/t/unable-to-parse-grok-filter-on-proxy-logs/79194 "2017-03-21T08:05:53Z")
I am attempting to parse and structured a raw proxy data using GROK filter in the ELK stack and I can,t get the timestamp and user agent string in the correct format. Do refer to sample log as follows: "1488852784.440 … --- ## [Logstash CEF output 5.x vs 2.x](https://discuss.elastic.co/t/logstash-cef-output-5-x-vs-2-x/79107)
**Author:** [@hybrid](https://discuss.elastic.co/u/hybrid)\ **Replies:** 2\ **Last updated:** [March 21, 2017, 7:26am UTC](https://discuss.elastic.co/t/logstash-cef-output-5-x-vs-2-x/79107 "2017-03-21T07:26:54Z")
Hi all. I'm successfully using an ArcSight CEF connector to read a cef output file in logstash 2.3.2. I have just done the same using 5.2.0 However, the ArcSight connector is not picking up any events. It seems to be b… --- ## [Init: logstash main process ended, respawning](https://discuss.elastic.co/t/init-logstash-main-process-ended-respawning/79357)
**Author:** [@sdubey](https://discuss.elastic.co/u/sdubey)\ **Replies:** 0\ **Last updated:** [March 21, 2017, 6:59am UTC](https://discuss.elastic.co/t/init-logstash-main-process-ended-respawning/79357 "2017-03-21T06:59:04Z")
Hi, I am trying to setup ELK first time ever and has success in setting up Elasticsearch and Kibana but facing issue with Logstash. My env. - OS - Ubuntu 14.04 on Virtualbox Logstash - 5.0.2 installed using .deb offl… --- ## [Configuring Logstash to read Cisco WSA logs](https://discuss.elastic.co/t/configuring-logstash-to-read-cisco-wsa-logs/76975)
**Author:** [@Becky\_Jones](https://discuss.elastic.co/u/Becky_Jones)\ **Replies:** 1\ **Last updated:** [March 21, 2017, 6:34am UTC](https://discuss.elastic.co/t/configuring-logstash-to-read-cisco-wsa-logs/76975 "2017-03-21T06:34:44Z")
Hi there, I have installed logstash and have some raw logs which have been transferred to my log server from our Cisco WSA (IronPort S170). I have run some basic tests, e.g the Hello World test which works fine. When… --- ## [SQS Output Plugin Data Mapping](https://discuss.elastic.co/t/sqs-output-plugin-data-mapping/79236)
**Author:** [@Samarth\_Prabhu](https://discuss.elastic.co/u/Samarth_Prabhu)\ **Replies:** 1\ **Last updated:** [March 21, 2017, 6:23am UTC](https://discuss.elastic.co/t/sqs-output-plugin-data-mapping/79236 "2017-03-21T06:23:22Z")
Does the SQS output plugin allow me to write only select data which was filtered in my "filter" plugin? I would like to illustrate my question with a simple example : A) My application produces logs as follows : 20… --- ## [Logstash performance for indexing to ES](https://discuss.elastic.co/t/logstash-performance-for-indexing-to-es/79155)
**Author:** [@Sharat\_Jagannath](https://discuss.elastic.co/u/Sharat_Jagannath)\ **Replies:** 5\ **Last updated:** [March 21, 2017, 6:09am UTC](https://discuss.elastic.co/t/logstash-performance-for-indexing-to-es/79155 "2017-03-21T06:09:17Z")
I'm trying to index docs to elasticsearch from logstash with kafka input. I see the indexing takes a long time and i am looking to index around 3 million documents as fast as possible. My logstash conf is - in… --- ## [Logstash not Starting](https://discuss.elastic.co/t/logstash-not-starting/79148)
**Author:** [@AHK](https://discuss.elastic.co/u/AHK)\ **Replies:** 1\ **Last updated:** [March 21, 2017, 3:29am UTC](https://discuss.elastic.co/t/logstash-not-starting/79148 "2017-03-21T03:29:48Z")
Hello, I am trying to install ELK & I follow all topic on when i try this command sudo service logstash configtest Error is Could not find any executable java binary. Please install java in your PATH or set JAVAH… --- ## [Can I set Xms or Xmx on logstash 5.2.2?](https://discuss.elastic.co/t/can-i-set-xms-or-xmx-on-logstash-5-2-2/79202)
**Author:** [@MattYoon](https://discuss.elastic.co/u/MattYoon)\ **Replies:** 2\ **Last updated:** [March 21, 2017, 3:27am UTC](https://discuss.elastic.co/t/can-i-set-xms-or-xmx-on-logstash-5-2-2/79202 "2017-03-21T03:27:24Z")
Hi~, I'm using Logstash 5.2.2. I edited jvm.option (-Xms256m -Xmx256m) but Logstash started with 1G Maximum Java Heap Size (I monitored with Java Mission Control) Was I wrong..? In addition, this is my start comman… --- ## [\_grokparsefailure for Apache records w/o a client ip](https://discuss.elastic.co/t/-grokparsefailure-for-apache-records-w-o-a-client-ip/79275)
**Author:** [@mikemi](https://discuss.elastic.co/u/mikemi)\ **Replies:** 2\ **Last updated:** [March 21, 2017, 2:05am UTC](https://discuss.elastic.co/t/-grokparsefailure-for-apache-records-w-o-a-client-ip/79275 "2017-03-21T02:05:43Z")
I'm using logstash to parse logs from a hosting provider (Acquia), and send them to an elastic.co hosted elasticsearch account. We have a lot of apache records that don't have a client ip at the start of the log entry… --- ## [Variable space working in grok debugger but not in server](https://discuss.elastic.co/t/variable-space-working-in-grok-debugger-but-not-in-server/79024)
**Author:** [@raamee](https://discuss.elastic.co/u/raamee)\ **Replies:** 5\ **Last updated:** [March 21, 2017, 12:50am UTC](https://discuss.elastic.co/t/variable-space-working-in-grok-debugger-but-not-in-server/79024 "2017-03-21T00:50:34Z")
Hi, My new problem: Here's my logs: (14529) Login OK: \[host\] (from client DEVICE-NAME port 13 cli 20-19-44-03-26-c6 via TLS tunnel) (14529) Login OK: \[host\] (from client DEVICE-NAME port 13 cli 20-19-44-03-26-c6 v… --- ## [XML parsing error: \](https://discuss.elastic.co/t/xml-parsing-error-runtimeerror-entity-expansion-has-grown-too-large/79104)
**Author:** [@daian.martinho](https://discuss.elastic.co/u/daian.martinho)\ **Replies:** 0\ **Last updated:** [March 17, 2017, 11:30pm UTC](https://discuss.elastic.co/t/xml-parsing-error-runtimeerror-entity-expansion-has-grown-too-large/79104 "2017-03-17T23:30:33Z")
I'm trying to parse XML file that has 40000 lines as one event. Error at logstash: \ Filebeat: multiline.pattern: '^\ drop duplicate -\> elasticsearch](https://discuss.elastic.co/t/logstash-drop-duplicate-elasticsearch/77807)
**Author:** [@Exocomp](https://discuss.elastic.co/u/Exocomp)\ **Replies:** 7\ **Last updated:** [March 13, 2017, 4:10pm UTC](https://discuss.elastic.co/t/logstash-drop-duplicate-elasticsearch/77807 "2017-03-13T16:10:15Z")
Hello, Looking over documentation I see that the field "document\_id" can be used as a way to upsert in Elasticsearch. However, is there way to detect the duplicate at the filter stage and just drop? Thanks, E [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1013) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1015)