# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1021 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1022 --- ## [Jdbc mysql input plugin, Communication link failure](https://discuss.elastic.co/t/jdbc-mysql-input-plugin-communication-link-failure/78047)
**Author:** [@gusDuarte](https://discuss.elastic.co/u/gusDuarte)\ **Replies:** 0\ **Last updated:** [March 9, 2017, 7:59pm UTC](https://discuss.elastic.co/t/jdbc-mysql-input-plugin-communication-link-failure/78047 "2017-03-09T19:59:34Z")
Hi, we are facing a problem with JDBC INPUT plugin connection to DB. When Logstash service start, the following error is logged: \[2017-03-09T16:44:15,061\]\[ERROR\]\[logstash.pipeline \] Error registering plugin {:… --- ## [Logstash stdout going to syslog](https://discuss.elastic.co/t/logstash-stdout-going-to-syslog/73585)
**Author:** [@astickler](https://discuss.elastic.co/u/astickler)\ **Replies:** 5\ **Last updated:** [March 9, 2017, 6:31pm UTC](https://discuss.elastic.co/t/logstash-stdout-going-to-syslog/73585 "2017-03-09T18:31:49Z")
I have just installed logstash 5.2.0 on a clean Ubuntu 16.04, and my 'metric' filter is now writing its 1-minute document count and rates to syslog instead of logstash.stdout. Is this a change in 5.2.0? With 2.4, it us… --- ## [Logstash fingerprint hash everything](https://discuss.elastic.co/t/logstash-fingerprint-hash-everything/77827)
**Author:** [@Exocomp](https://discuss.elastic.co/u/Exocomp)\ **Replies:** 2\ **Last updated:** [March 9, 2017, 7:03pm UTC](https://discuss.elastic.co/t/logstash-fingerprint-hash-everything/77827 "2017-03-09T19:03:14Z")
Is there a way with the fingerprint filter to hash every field into one hash value? fingerprint { method =\> "SHA1" source =\> \["myfield1", "myfield2"\] concatenate\_sources =\> true } By default… --- ## [Logstash multiple expressions in a single condition](https://discuss.elastic.co/t/logstash-multiple-expressions-in-a-single-condition/77848)
**Author:** [@capsno1](https://discuss.elastic.co/u/capsno1)\ **Replies:** 1\ **Last updated:** [March 9, 2017, 6:52pm UTC](https://discuss.elastic.co/t/logstash-multiple-expressions-in-a-single-condition/77848 "2017-03-09T18:52:38Z")
quick question: Would this be the correct way to place multiple expressions in a single condition? if \[EMS\_Identifier\] == "monitor.globalStatus.nonCritical" and "disk" in \[syslog\_message\] and "failed" in \[syslog\_mes… --- ## [Is it possible to install logstash plugin without gem (with out internet)](https://discuss.elastic.co/t/is-it-possible-to-install-logstash-plugin-without-gem-with-out-internet/77514)
**Author:** [@tomer](https://discuss.elastic.co/u/tomer)\ **Replies:** 3\ **Last updated:** [March 9, 2017, 6:28pm UTC](https://discuss.elastic.co/t/is-it-possible-to-install-logstash-plugin-without-gem-with-out-internet/77514 "2017-03-09T18:28:49Z")
Is it possible to install logstash plugin without RubyGem on a VM without internet? --- ## [Logstash CSV ingest 5.2.1 "Attempting to install template" still broken](https://discuss.elastic.co/t/logstash-csv-ingest-5-2-1-attempting-to-install-template-still-broken/77341)
**Author:** [@GregMeadows](https://discuss.elastic.co/u/GregMeadows)\ **Replies:** 9\ **Last updated:** [March 9, 2017, 5:45pm UTC](https://discuss.elastic.co/t/logstash-csv-ingest-5-2-1-attempting-to-install-template-still-broken/77341 "2017-03-09T17:45:33Z")
Spend days in this forum before posting. I have large csv file/conf file with mappings from previous ELK VM (no longer running) which worked great - alpha 5x. File permissions allow read/write to all ELK directories. Thi… --- ## [Logstash if any array element exists in \[tags\]](https://discuss.elastic.co/t/logstash-if-any-array-element-exists-in-tags/77808)
**Author:** [@Exocomp](https://discuss.elastic.co/u/Exocomp)\ **Replies:** 2\ **Last updated:** [March 9, 2017, 5:38pm UTC](https://discuss.elastic.co/t/logstash-if-any-array-element-exists-in-tags/77808 "2017-03-09T17:38:04Z")
Hi, Is there a way to do a conditional check such that elements of any array element exists in \[tags\] ?, something like: if \["element1", "element2", "element3"\] in \[tags\] { } Thanks, E --- ## [Logstash 5.2.0 - \_grokparsefailure, but it looks like the grok filter is correctly working](https://discuss.elastic.co/t/logstash-5-2-0--grokparsefailure-but-it-looks-like-the-grok-filter-is-correctly-working/77570)
**Author:** [@Rich\_Johnson](https://discuss.elastic.co/u/Rich_Johnson)\ **Replies:** 5\ **Last updated:** [March 9, 2017, 5:17pm UTC](https://discuss.elastic.co/t/logstash-5-2-0--grokparsefailure-but-it-looks-like-the-grok-filter-is-correctly-working/77570 "2017-03-09T17:17:50Z")
If I tail -f /var/log/messages, I see: ... { Mar 6 12:18:16 s-ut-logstash-1 logstash: "server" =\> "443", Mar 6 12:18:16 s-ut-logstash-1 logstash: "referer" =\> "\\"https://broadcast.storagecraft.com/videos/\\"", Mar … --- ## [Logstash stops processing requests](https://discuss.elastic.co/t/logstash-stops-processing-requests/64162)
**Author:** [@micahlmartin](https://discuss.elastic.co/u/micahlmartin)\ **Replies:** 1\ **Last updated:** [March 9, 2017, 5:06pm UTC](https://discuss.elastic.co/t/logstash-stops-processing-requests/64162 "2017-03-09T17:06:19Z")
We keep running into issues where after a while some of our logstash nodes that are reading from kafka, parsing the data, and sending to ES stop processing new requests. This is what were seeing in the logs: { "infli… --- ## [Logstash: Problem regarding inout plugin, Logstash startup completed does not get dislayed](https://discuss.elastic.co/t/logstash-problem-regarding-inout-plugin-logstash-startup-completed-does-not-get-dislayed/50979)
**Author:** [@Piyush\_Paritosh](https://discuss.elastic.co/u/Piyush_Paritosh)\ **Replies:** 13\ **Last updated:** [March 9, 2017, 4:11pm UTC](https://discuss.elastic.co/t/logstash-problem-regarding-inout-plugin-logstash-startup-completed-does-not-get-dislayed/50979 "2017-03-09T16:11:18Z")
I am using Macbook and trying to use Logstash. I am using the following config file: input { file { path =\> "/Desktop/data.csv" type =\> "core2" start\_position =\> "beginning" } } filter { csv { … --- ## [Use variable for target value (kv)](https://discuss.elastic.co/t/use-variable-for-target-value-kv/78009)
**Author:** [@florentmair](https://discuss.elastic.co/u/florentmair)\ **Replies:** 2\ **Last updated:** [March 9, 2017, 3:51pm UTC](https://discuss.elastic.co/t/use-variable-for-target-value-kv/78009 "2017-03-09T15:51:59Z")
Hi I want to use a fieldname to setup the "target" field in KV plugin, but it's doesn't work :slight\_smile: filter { if \[message\] =~ /^NUMBER OF .\*:/ { grok { match =\> { "message" =\> "^NUMBER OF %{DATA:f… --- ## [Sending same logs to two different Redis keys](https://discuss.elastic.co/t/sending-same-logs-to-two-different-redis-keys/78012)
**Author:** [@ash007](https://discuss.elastic.co/u/ash007)\ **Replies:** 0\ **Last updated:** [March 9, 2017, 3:37pm UTC](https://discuss.elastic.co/t/sending-same-logs-to-two-different-redis-keys/78012 "2017-03-09T15:37:45Z")
Is there a way i can send same data to two different redis outputs. I have tried sending same data to two different elasticsearch clusters and it works. Following is the configuration i am trying: filter { if "some typ… --- ## [Logstash flags XML header in log message as \_jsonparsefailure?](https://discuss.elastic.co/t/logstash-flags-xml-header-in-log-message-as--jsonparsefailure/77885)
**Author:** [@ZillaG](https://discuss.elastic.co/u/ZillaG)\ **Replies:** 6\ **Last updated:** [March 9, 2017, 3:29pm UTC](https://discuss.elastic.co/t/logstash-flags-xml-header-in-log-message-as--jsonparsefailure/77885 "2017-03-09T15:29:45Z")
I've narrowed one of my \_jsonparsefailure to an XML header, shown below. The XML is "part" of the log that our application sends out. 2017-02-27 14:01:30,215 INFO :SimpleThreadPoolWorker-4 \[jdbc.sqlonly\] batching 1 s… --- ## [Logstash update @timestamp](https://discuss.elastic.co/t/logstash-update-timestamp/77816)
**Author:** [@Exocomp](https://discuss.elastic.co/u/Exocomp)\ **Replies:** 9\ **Last updated:** [March 9, 2017, 3:27pm UTC](https://discuss.elastic.co/t/logstash-update-timestamp/77816 "2017-03-09T15:27:28Z")
Hi, I have a field that is already a datetime field: "last\_execution\_time" =\> 2017-03-08T12:19:14.593Z, I would like this field to be the value of @timestamp. When I try: mutate { update =\> { "@timestamp" =\> … --- ## [Field not converting to integer](https://discuss.elastic.co/t/field-not-converting-to-integer/78004)
**Author:** [@Pokecallum](https://discuss.elastic.co/u/Pokecallum)\ **Replies:** 2\ **Last updated:** [March 9, 2017, 3:25pm UTC](https://discuss.elastic.co/t/field-not-converting-to-integer/78004 "2017-03-09T15:25:09Z")
Hi, Can anyone see why my hour field isnt converting to an integer. But my size field is. Im not getting any obvious errors anywhere to explain why input { file { type =\> "csv" path =\> "/home/callum… --- ## [In what all ways I can optimize my Logstash filters?](https://discuss.elastic.co/t/in-what-all-ways-i-can-optimize-my-logstash-filters/77938)
**Author:** [@elasticheart](https://discuss.elastic.co/u/elasticheart)\ **Replies:** 2\ **Last updated:** [March 9, 2017, 3:09pm UTC](https://discuss.elastic.co/t/in-what-all-ways-i-can-optimize-my-logstash-filters/77938 "2017-03-09T15:09:05Z")
Hi, I am using ELK GA 5.0.0. I have a Logstash which consumes from 3 different Kafka topics. I have the filter like below; filter { if\[logtype\] == "LOGFILE"{ if\[logtype\] == "LOGFILE"{ if\[fields\]\[logtype\] == "logf… --- ## [Logstash is not accepting my Filebeat logs](https://discuss.elastic.co/t/logstash-is-not-accepting-my-filebeat-logs/77555)
**Author:** [@wmstein](https://discuss.elastic.co/u/wmstein)\ **Replies:** 9\ **Last updated:** [March 9, 2017, 3:05pm UTC](https://discuss.elastic.co/t/logstash-is-not-accepting-my-filebeat-logs/77555 "2017-03-09T15:05:19Z")
Filebeat is on a prod server and Logstash is on a different servers.. I can not figure out why Logstash is rejecting my Filebeat log pushes. Below is the Logstash error. And below that shows telnet to port 5044 works. EL… --- ## [Speed limit for logstash to elasticsearch](https://discuss.elastic.co/t/speed-limit-for-logstash-to-elasticsearch/77703)
**Author:** [@robertchen117](https://discuss.elastic.co/u/robertchen117)\ **Replies:** 1\ **Last updated:** [March 9, 2017, 2:58pm UTC](https://discuss.elastic.co/t/speed-limit-for-logstash-to-elasticsearch/77703 "2017-03-09T14:58:58Z")
I have a slow network from logstash to elasticsearch cluster, anyone can share any ideas about how to do speed limit like \<5M/s ? or traffic control? Or please let me know how to do from filebeat to logstash? than… --- ## [New to Logstash need help with config file](https://discuss.elastic.co/t/new-to-logstash-need-help-with-config-file/77713)
**Author:** [@parrot](https://discuss.elastic.co/u/parrot)\ **Replies:** 1\ **Last updated:** [March 9, 2017, 2:58pm UTC](https://discuss.elastic.co/t/new-to-logstash-need-help-with-config-file/77713 "2017-03-09T14:58:18Z")
Hello, I need to create configuration file that this is the input: 2017-02-14T13:39:33+02:00 PulseSecure: 2017-02-14 13:39:33 - ive - \[10.16.4.225\] dpnini(Users)\[\] - Testing Password realm restrictions failed for dpn… --- ## [Logstash auth problem](https://discuss.elastic.co/t/logstash-auth-problem/77769)
**Author:** [@Jonas](https://discuss.elastic.co/u/Jonas)\ **Replies:** 1\ **Last updated:** [March 9, 2017, 2:55pm UTC](https://discuss.elastic.co/t/logstash-auth-problem/77769 "2017-03-09T14:55:49Z")
Hello, When I set logstash config with params: auth =\> { user =\> "user" password =\> "password" } It doesn't work. I receive "Bad credential error". The same user and password in curl wo… --- ## [Geo\_point missing](https://discuss.elastic.co/t/geo-point-missing/77506)
**Author:** [@lendoly](https://discuss.elastic.co/u/lendoly)\ **Replies:** 5\ **Last updated:** [March 9, 2017, 2:15pm UTC](https://discuss.elastic.co/t/geo-point-missing/77506 "2017-03-09T14:15:21Z")
Hello, I saw a lot of questions and solutions for this issue in the forums, but no one of them solves my problem so I decided to ask. My question is about the geo\_point, Kibana is telling this message when I'm trying… --- ## [Errors in logstash](https://discuss.elastic.co/t/errors-in-logstash/77980)
**Author:** [@emilio](https://discuss.elastic.co/u/emilio)\ **Replies:** 1\ **Last updated:** [March 9, 2017, 1:28pm UTC](https://discuss.elastic.co/t/errors-in-logstash/77980 "2017-03-09T13:28:06Z")
Dear all, I have such errors in logstash: Mar 9 16:22:40 spark1test init: logstash main process (4444) terminated with status 1 Mar 9 16:22:40 spark1test init: logstash main process ended, respawning Mar 9 16:23:2… --- ## [Mutate "message" don't understand example](https://discuss.elastic.co/t/mutate-message-dont-understand-example/77985)
**Author:** [@pgrzec2s](https://discuss.elastic.co/u/pgrzec2s)\ **Replies:** 3\ **Last updated:** [March 9, 2017, 1:29pm UTC](https://discuss.elastic.co/t/mutate-message-dont-understand-example/77985 "2017-03-09T13:29:35Z")
I read the Example about mutating a fiel in logstash but I don't understand the syntax correctly. After parsing I want to replace the whole "message" with the %{GREEDYDATA} part. so i tried: if \[type\] == "apache-err… --- ## [Logstash stops processing input on malformed JSON line](https://discuss.elastic.co/t/logstash-stops-processing-input-on-malformed-json-line/77662)
**Author:** [@Firass\_Gzayil](https://discuss.elastic.co/u/Firass_Gzayil)\ **Replies:** 2\ **Last updated:** [March 9, 2017, 1:16pm UTC](https://discuss.elastic.co/t/logstash-stops-processing-input-on-malformed-json-line/77662 "2017-03-09T13:16:45Z")
Hello! I have logstash 5.2.2 reading files containing data in JSON format. When logstash encounters a malformed line it throws error and stops processing the whole input config: input { file { path =\> "c:/programdata/m… --- ## [Gzip files handle in different plugins](https://discuss.elastic.co/t/gzip-files-handle-in-different-plugins/77983)
**Author:** [@rninov](https://discuss.elastic.co/u/rninov)\ **Replies:** 0\ **Last updated:** [March 9, 2017, 1:08pm UTC](https://discuss.elastic.co/t/gzip-files-handle-in-different-plugins/77983 "2017-03-09T13:08:32Z")
Hi all, I would like to know how will be handled compressed (gz) files in plugins, especially S3 plugin. And how to config input to make them uncompressed before processing Regards --- ## [Simple parsing in logstash](https://discuss.elastic.co/t/simple-parsing-in-logstash/77531)
**Author:** [@Beuhlet\_Reseau](https://discuss.elastic.co/u/Beuhlet_Reseau)\ **Replies:** 7\ **Last updated:** [March 9, 2017, 12:57pm UTC](https://discuss.elastic.co/t/simple-parsing-in-logstash/77531 "2017-03-09T12:57:01Z")
Hey ! I have a question :slight\_smile: Imagine a log file that has different lines than : Nick,connect,11:00,appli1 Pablo,disconnect,, My pattern is %{WORD:name}\[;\]%{WORD:action}\[;\]%{DATA:time}\[;\]%{WORD:applic… --- ## [Read data from OPC-UA Server](https://discuss.elastic.co/t/read-data-from-opc-ua-server/77619)
**Author:** [@sasauz](https://discuss.elastic.co/u/sasauz)\ **Replies:** 1\ **Last updated:** [March 9, 2017, 12:34pm UTC](https://discuss.elastic.co/t/read-data-from-opc-ua-server/77619 "2017-03-09T12:34:21Z")
Hello everyone, I'm trying to read data from an OPC-UA Server. OPC-UA communicates via TCP and my hope was that it would work with the standard TCP-plugin, but it doesn't input { tcp { host =\> "localhost… --- ## [Unrecognized option: Files\\Elasticsearch\\Logstash/heapdump.hprof"](https://discuss.elastic.co/t/unrecognized-option-files-elasticsearch-logstash-heapdump-hprof/77576)
**Author:** [@Gregory\_Green](https://discuss.elastic.co/u/Gregory_Green)\ **Replies:** 1\ **Last updated:** [March 9, 2017, 12:32pm UTC](https://discuss.elastic.co/t/unrecognized-option-files-elasticsearch-logstash-heapdump-hprof/77576 "2017-03-09T12:32:05Z")
Hello, I'm working to install a brand new ELK stack. Following the installation of Logstash on 2012R2, I attempted to test it with the following command: logstash -e 'input { stdin { } } output { stdout {} }' I re… --- ## [Logstash-aggregate 2.4.0 does not generate aggregate\_maps\_path file when it stops](https://discuss.elastic.co/t/logstash-aggregate-2-4-0-does-not-generate-aggregate-maps-path-file-when-it-stops/77538)
**Author:** [@mr\_chang7](https://discuss.elastic.co/u/mr_chang7)\ **Replies:** 1\ **Last updated:** [March 9, 2017, 12:30pm UTC](https://discuss.elastic.co/t/logstash-aggregate-2-4-0-does-not-generate-aggregate-maps-path-file-when-it-stops/77538 "2017-03-09T12:30:46Z")
Hi, I'm a big fan of logstash-aggregate filter and we're using it in the production system. As for this topic, I can see the aggregate version 2.5.1 seems having fixed this bug only with logstash 2.4 or later. But we w… --- ## [Logstash not working as a service on Ubuntu 14.04](https://discuss.elastic.co/t/logstash-not-working-as-a-service-on-ubuntu-14-04/77974)
**Author:** [@ezequielo](https://discuss.elastic.co/u/ezequielo)\ **Replies:** 0\ **Last updated:** [March 9, 2017, 11:59am UTC](https://discuss.elastic.co/t/logstash-not-working-as-a-service-on-ubuntu-14-04/77974 "2017-03-09T11:59:42Z")
I am unable to run Logstash as a service on Ubuntu 14.04. Seems like installation and everything goes well... however, when I run the command to start logstash service, I got: logstash start/running, process XXXX Bu… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1020) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1022)