# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1024 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1025 --- ## [@timestamp is missing in Time-field name in Logstash template](https://discuss.elastic.co/t/timestamp-is-missing-in-time-field-name-in-logstash-template/77187)
**Author:** [@111148](https://discuss.elastic.co/u/111148)\ **Replies:** 9\ **Last updated:** [March 6, 2017, 5:32pm UTC](https://discuss.elastic.co/t/timestamp-is-missing-in-time-field-name-in-logstash-template/77187 "2017-03-06T17:32:06Z")
Hello, i am using this default template from logstash 5.2. folder in order to create it in Kibana for elastic search. { "template" : "logstash-", "version" : 50001, "settings" : { "index.refresh\_interval" : "5s" }, … --- ## [Logstash mutate and translate the same field](https://discuss.elastic.co/t/logstash-mutate-and-translate-the-same-field/77489)
**Author:** [@Diyal](https://discuss.elastic.co/u/Diyal)\ **Replies:** 2\ **Last updated:** [March 6, 2017, 4:03pm UTC](https://discuss.elastic.co/t/logstash-mutate-and-translate-the-same-field/77489 "2017-03-06T16:03:07Z")
Hello, I would like to make services translation like this: 21/tcp =\> ftp 80/tcp =\> http But the translation doesn't work. So, my services.yaml file is like this : "1/tcp": "tcpmux" "1/udp": "tcpmux" "5… --- ## [Error while running logstash : end of file reached](https://discuss.elastic.co/t/error-while-running-logstash-end-of-file-reached/77536)
**Author:** [@amilus](https://discuss.elastic.co/u/amilus)\ **Replies:** 0\ **Last updated:** [March 6, 2017, 3:52pm UTC](https://discuss.elastic.co/t/error-while-running-logstash-end-of-file-reached/77536 "2017-03-06T15:52:43Z")
I'm running logstash uploading twets into mongodb but i keep getting this error . End of file reached {:exception=\>#, :backtrace=\>\["org/jruby/ext/openssl/SSLSocket.java:777:in sysread'", "/opt/logstash/vendor/bundle/jrub… --- ## [Recieves Syslogdata, but not visibel in Kibana](https://discuss.elastic.co/t/recieves-syslogdata-but-not-visibel-in-kibana/77420)
**Author:** [@perch](https://discuss.elastic.co/u/perch)\ **Replies:** 4\ **Last updated:** [March 6, 2017, 3:35pm UTC](https://discuss.elastic.co/t/recieves-syslogdata-but-not-visibel-in-kibana/77420 "2017-03-06T15:35:14Z")
Setting up an ELK Stack solution. The thing I am trying to do is to get Syslog data into Logstash (maybe this is more of a Kibana issue?). The Elk stack works fine with Netflow, getting 41 fields of data to play around … --- ## [Cannot configure secure connection Firebeat-\>Logstash](https://discuss.elastic.co/t/cannot-configure-secure-connection-firebeat-logstash/77527)
**Author:** [@Marcin\_Pawlikowski](https://discuss.elastic.co/u/Marcin_Pawlikowski)\ **Replies:** 0\ **Last updated:** [March 6, 2017, 3:21pm UTC](https://discuss.elastic.co/t/cannot-configure-secure-connection-firebeat-logstash/77527 "2017-03-06T15:21:04Z")
Hi, After configuration I run Firebug and Logstash but the Graylog weren't recivied any data . I can\`t see any ununsual logs in logstash log file , only standard inforamtion like belows . \[2017-03-06T15:36:50,447\]… --- ## [Active Directory Change Auditing](https://discuss.elastic.co/t/active-directory-change-auditing/77526)
**Author:** [@HawkUser](https://discuss.elastic.co/u/HawkUser)\ **Replies:** 0\ **Last updated:** [March 6, 2017, 3:18pm UTC](https://discuss.elastic.co/t/active-directory-change-auditing/77526 "2017-03-06T15:18:46Z")
Hi Folks, I'm interesting in logging Event IDs 5136 (Directory Service Changes - A directory service object was modified.). i'm already using WinLogBeats to capture login/logout events, that was pretty straight forward… --- ## [Problem installing logstash-filter-cipher](https://discuss.elastic.co/t/problem-installing-logstash-filter-cipher/76599)
**Author:** [@Vittorio](https://discuss.elastic.co/u/Vittorio)\ **Replies:** 12\ **Last updated:** [March 6, 2017, 2:56pm UTC](https://discuss.elastic.co/t/problem-installing-logstash-filter-cipher/76599 "2017-03-06T14:56:32Z")
Hi all, I'm trying to install chiper filter but unfortunately I'm gettin this error: bin/logstash-plugin install logstash-filter-cipher Validating logstash-filter-cipher Installing logstash-filter-cipher Plugin versi… --- ## [Using amazon\_es output plugin via proxy](https://discuss.elastic.co/t/using-amazon-es-output-plugin-via-proxy/62192)
**Author:** [@kvinell](https://discuss.elastic.co/u/kvinell)\ **Replies:** 2\ **Last updated:** [March 3, 2017, 2:06pm UTC](https://discuss.elastic.co/t/using-amazon-es-output-plugin-via-proxy/62192 "2017-03-03T14:06:23Z")
Hi, I'm trying to use amazon\_es output plugin for Logstash to send data to my Elasticsearch cluster in AWS (Elasticsearch service). However, the Logstash instance is installed on a server that needs to go through a pro… --- ## [Timeout executing grok](https://discuss.elastic.co/t/timeout-executing-grok/76261)
**Author:** [@kmroz](https://discuss.elastic.co/u/kmroz)\ **Replies:** 11\ **Last updated:** [March 6, 2017, 3:00pm UTC](https://discuss.elastic.co/t/timeout-executing-grok/76261 "2017-03-06T15:00:05Z")
Hello I am getting a timeout issue when running a grok filter. My logstash config looks like so. filter { if \[type\] == "cast" { grok { break\_on\_match =\> false mat… --- ## [Understanding Logstash config parenthesis](https://discuss.elastic.co/t/understanding-logstash-config-parenthesis/75765)
**Author:** [@rrs](https://discuss.elastic.co/u/rrs)\ **Replies:** 2\ **Last updated:** [March 6, 2017, 2:53pm UTC](https://discuss.elastic.co/t/understanding-logstash-config-parenthesis/75765 "2017-03-06T14:53:56Z")
Hello, I am configuring Logstash multiple pipe lines to get logs processed. While configuring I am a bit confused where to use square and curly parenthesis in config files. Can anyone explain me how to understand t… --- ## [Does Logstash parse Word Documents?](https://discuss.elastic.co/t/does-logstash-parse-word-documents/77488)
**Author:** [@rlv\_praveen](https://discuss.elastic.co/u/rlv_praveen)\ **Replies:** 6\ **Last updated:** [March 6, 2017, 2:15pm UTC](https://discuss.elastic.co/t/does-logstash-parse-word-documents/77488 "2017-03-06T14:15:06Z")
Hi All, I have a requirement in which i need to parse the WORD documents. Does logstash supports the parsing of word files. Is there any plugin available for that. Please help me whether i can do this or not? Thanks … --- ## [Remove field from logstash configuration](https://discuss.elastic.co/t/remove-field-from-logstash-configuration/77507)
**Author:** [@vinodMS](https://discuss.elastic.co/u/vinodMS)\ **Replies:** 1\ **Last updated:** [March 6, 2017, 1:58pm UTC](https://discuss.elastic.co/t/remove-field-from-logstash-configuration/77507 "2017-03-06T13:58:00Z")
My indices are using the parent-child relationship, therefore my sql query returns parent ID that I use in the logstash configuration to use as the parent ID. Here is my logstash configuration, output { elasticsearch… --- ## [SInce updating to logstash 5.2 (from 2.x) glob is \[\]](https://discuss.elastic.co/t/since-updating-to-logstash-5-2-from-2-x-glob-is/74983)
**Author:** [@logstashisawesome](https://discuss.elastic.co/u/logstashisawesome)\ **Replies:** 13\ **Last updated:** [March 6, 2017, 1:53pm UTC](https://discuss.elastic.co/t/since-updating-to-logstash-5-2-from-2-x-glob-is/74983 "2017-03-06T13:53:45Z")
Since updating my system (centos 6.5), logstash and elasticsearch, there has been no input from logstash. The files are in the correct directory (it's an NTFS share with a windows server) and everyone has read access on … --- ## [Environment variables not set in logstash 5.2](https://discuss.elastic.co/t/environment-variables-not-set-in-logstash-5-2/77482)
**Author:** [@vinodMS](https://discuss.elastic.co/u/vinodMS)\ **Replies:** 2\ **Last updated:** [March 6, 2017, 1:31pm UTC](https://discuss.elastic.co/t/environment-variables-not-set-in-logstash-5-2/77482 "2017-03-06T13:31:29Z")
I'm following the instructions given here, but unable to get it to work. This is the error message I get when I run logstas, nd "port" pre-2.0\\n\\tdocument\_type =\> "tm"\\n\\tdocument\_id =\> "%{id}"\\n ssl =\> "true"\\n … --- ## [Although installing logstash, I get "logstash: unrecognized service"](https://discuss.elastic.co/t/although-installing-logstash-i-get-logstash-unrecognized-service/76282)
**Author:** [@tomer](https://discuss.elastic.co/u/tomer)\ **Replies:** 4\ **Last updated:** [March 6, 2017, 1:16pm UTC](https://discuss.elastic.co/t/although-installing-logstash-i-get-logstash-unrecognized-service/76282 "2017-03-06T13:16:28Z")
Since I will need to install a logstash with out internet I downloaded the rpm (for version 5.2.0) and wrote "rpm -i ..." without running yum install. LogStash was installed, also after writing a test.conf I was able to … --- ## [Facing Issues with Logstash while Practicing Incremental Fetch over SQL Datasets using JDBC Plugin](https://discuss.elastic.co/t/facing-issues-with-logstash-while-practicing-incremental-fetch-over-sql-datasets-using-jdbc-plugin/77503)
**Author:** [@Thangaraj\_Muruganant](https://discuss.elastic.co/u/Thangaraj_Muruganant)\ **Replies:** 0\ **Last updated:** [March 6, 2017, 1:04pm UTC](https://discuss.elastic.co/t/facing-issues-with-logstash-while-practicing-incremental-fetch-over-sql-datasets-using-jdbc-plugin/77503 "2017-03-06T13:04:51Z")
I have already tried loading Sql Data sets into Logstash it was working fine even also with timestamp fields. But I have been looking for Dynamic Loading (Incremental Fetch). I have a table 'Kibana\_ch' which has Three fi… --- ## [Configuring logstash-input-jms plugin to read WebSphere JMS queue](https://discuss.elastic.co/t/configuring-logstash-input-jms-plugin-to-read-websphere-jms-queue/77490)
**Author:** [@Ranieri\_Mazili\_de\_Ol](https://discuss.elastic.co/u/Ranieri_Mazili_de_Ol)\ **Replies:** 0\ **Last updated:** [March 6, 2017, 11:31am UTC](https://discuss.elastic.co/t/configuring-logstash-input-jms-plugin-to-read-websphere-jms-queue/77490 "2017-03-06T11:31:11Z")
I'm trying to connect to a WebSphere JMS. I can connect to it using HermesJMS and below are the steps need to connect to my queue using HermesJMS and then what I tried to connection using logstash-plugin-jms. Please, I r… --- ## [Remove some parts in the middle of a string](https://discuss.elastic.co/t/remove-some-parts-in-the-middle-of-a-string/77305)
**Author:** [@guenther](https://discuss.elastic.co/u/guenther)\ **Replies:** 1\ **Last updated:** [March 6, 2017, 11:05am UTC](https://discuss.elastic.co/t/remove-some-parts-in-the-middle-of-a-string/77305 "2017-03-06T11:05:09Z")
Hi, we have the problems, that some errors (stackTraces) get really long. In such cases, we get the error Document contains at least one immense term in field=\\"exception.stackTrace\\" (whose UTF8 encoding is longer … --- ## [BAD URI Error while installing x-pack plugin into logstash](https://discuss.elastic.co/t/bad-uri-error-while-installing-x-pack-plugin-into-logstash/77471)
**Author:** [@Tareq\_Selwadi](https://discuss.elastic.co/u/Tareq_Selwadi)\ **Replies:** 0\ **Last updated:** [March 6, 2017, 10:19am UTC](https://discuss.elastic.co/t/bad-uri-error-while-installing-x-pack-plugin-into-logstash/77471 "2017-03-06T10:19:09Z")
Hi All, Elasticsearch verion 5.2.2 Kibana 5.2.2 logstash 5.2.2 I had successfully installed x-pack to elastic search and kibana, but I am unable to do this for logstash, please I need your help to check below error bea… --- ## [Dynamically match and rename json fields](https://discuss.elastic.co/t/dynamically-match-and-rename-json-fields/77220)
**Author:** [@lask001](https://discuss.elastic.co/u/lask001)\ **Replies:** 1\ **Last updated:** [March 6, 2017, 9:31am UTC](https://discuss.elastic.co/t/dynamically-match-and-rename-json-fields/77220 "2017-03-06T09:31:36Z")
Hoping I can get some ideas on how to go about fixing this issue I'm running into. I'm on elastic 2.3.5, and it doesn't allow for fields to contain a .. I'm using the JSON filter in log stash to parse this data: "net… --- ## [How to Stop Logstash in Windows programatically](https://discuss.elastic.co/t/how-to-stop-logstash-in-windows-programatically/77430)
**Author:** [@anisen](https://discuss.elastic.co/u/anisen)\ **Replies:** 1\ **Last updated:** [March 6, 2017, 9:23am UTC](https://discuss.elastic.co/t/how-to-stop-logstash-in-windows-programatically/77430 "2017-03-06T09:23:57Z")
Hi, I am using Logstash 5.1.1. Running logstash in windows command prompt using the command "logstash -f logstash.conf" and stopping it with CTRL+C . But, I want to stop logstash programatically. Any suggestion on… --- ## [Fetched an invalid config](https://discuss.elastic.co/t/fetched-an-invalid-config/77464)
**Author:** [@mattiabbate](https://discuss.elastic.co/u/mattiabbate)\ **Replies:** 0\ **Last updated:** [March 6, 2017, 9:17am UTC](https://discuss.elastic.co/t/fetched-an-invalid-config/77464 "2017-03-06T09:17:33Z")
Hello all, Please, can you help me to resolve this problem? I've installed Only Logstash 5.2.1 in a Windows 8.1. This is my CONFIG file: input { file { path =\> "C:\\var\\log\\xmltest\_2.xml" start\_position =\> … --- ## [\_grokparsefailure help required ASAP](https://discuss.elastic.co/t/-grokparsefailure-help-required-asap/77426)
**Author:** [@Vutsuak16](https://discuss.elastic.co/u/Vutsuak16)\ **Replies:** 3\ **Last updated:** [March 6, 2017, 8:31am UTC](https://discuss.elastic.co/t/-grokparsefailure-help-required-asap/77426 "2017-03-06T08:31:45Z")
what could be the regex for this log \['Estimated', '904699466068', '508587356765', 'LineItem', '61133026369107517924193456', 'AWS CloudTrail', '16091348', '215570231', '1256864', 'APS1-FreeEventsRecorded', 'None', '', 'N… --- ## [Unexpected Error when reading a csv log data](https://discuss.elastic.co/t/unexpected-error-when-reading-a-csv-log-data/77147)
**Author:** [@varun1992](https://discuss.elastic.co/u/varun1992)\ **Replies:** 1\ **Last updated:** [March 6, 2017, 6:51am UTC](https://discuss.elastic.co/t/unexpected-error-when-reading-a-csv-log-data/77147 "2017-03-06T06:51:35Z")
I am creating index from csv data. I got error as below. What is the problem ?? 07:31:56.196 \[\[main\]-pipeline-manager\] INFO logstash.pipeline - Pipeline main started 07:31:56.335 \[LogStash::Runner\] FATAL logstash.runn… --- ## [CSV output plugin prints wrong stuff - still not solved](https://discuss.elastic.co/t/csv-output-plugin-prints-wrong-stuff-still-not-solved/77143)
**Author:** [@Vesela\_Houba](https://discuss.elastic.co/u/Vesela_Houba)\ **Replies:** 1\ **Last updated:** [March 6, 2017, 6:50am UTC](https://discuss.elastic.co/t/csv-output-plugin-prints-wrong-stuff-still-not-solved/77143 "2017-03-06T06:50:21Z")
Hi, I've came across this topic https://discuss.elastic.co/t/csv-output-plugin-prints-wrong-stuff/65574 - and it's closed for inactivity, but I've tested with the same (wrong) results on latest 5.2.2 logstash. It's work… --- ## [Logstash outout to Kafka](https://discuss.elastic.co/t/logstash-outout-to-kafka/77443)
**Author:** [@agrawalsaurabh](https://discuss.elastic.co/u/agrawalsaurabh)\ **Replies:** 0\ **Last updated:** [March 6, 2017, 5:10am UTC](https://discuss.elastic.co/t/logstash-outout-to-kafka/77443 "2017-03-06T05:10:41Z")
Hi, I am using Logstash version 5.2.0 and want to output to kafka. For this I downloaded the latest version of Kakfa which is kafka\_2.12-0.10.2.0 Can you let me know if this is compatible version? I am unable to find… --- ## [Loading plugin inside Windows Server Docker container](https://discuss.elastic.co/t/loading-plugin-inside-windows-server-docker-container/77440)
**Author:** [@timmy8ken](https://discuss.elastic.co/u/timmy8ken)\ **Replies:** 0\ **Last updated:** [March 6, 2017, 4:58am UTC](https://discuss.elastic.co/t/loading-plugin-inside-windows-server-docker-container/77440 "2017-03-06T04:58:08Z")
Hello All, I am having a few problems getting a logstash plugin loading correctly inside a Windows Server Docker container. For a bit of background, I am running the elastic stack on a traditional virtual machine wit… --- ## [Getting started with JDBC Input Plugin](https://discuss.elastic.co/t/getting-started-with-jdbc-input-plugin/77162)
**Author:** [@matt40413](https://discuss.elastic.co/u/matt40413)\ **Replies:** 2\ **Last updated:** [March 5, 2017, 9:54pm UTC](https://discuss.elastic.co/t/getting-started-with-jdbc-input-plugin/77162 "2017-03-05T21:54:00Z")
Hi, so i've been trying to find some documentation on the JDBC Input Plugin. Since it seems like this is the ideal route taking in what im trying to do: Essentially, I have a table in a Postgres Database that im wantin… --- ## [Having issues getting a CSV file into Logstash](https://discuss.elastic.co/t/having-issues-getting-a-csv-file-into-logstash/77245)
**Author:** [@Bradley\_Sanders](https://discuss.elastic.co/u/Bradley_Sanders)\ **Replies:** 1\ **Last updated:** [March 5, 2017, 9:50pm UTC](https://discuss.elastic.co/t/having-issues-getting-a-csv-file-into-logstash/77245 "2017-03-05T21:50:16Z")
Hello im looking for help. This is for a college project and i am just lost on how to get this file working in logstash for elastic search. Idk if im running the command wrong or what but ive run the test on this conf fi… --- ## [Changing a term in a json to become the timestamp from filebeat](https://discuss.elastic.co/t/changing-a-term-in-a-json-to-become-the-timestamp-from-filebeat/75907)
**Author:** [@tomer](https://discuss.elastic.co/u/tomer)\ **Replies:** 4\ **Last updated:** [March 5, 2017, 8:49am UTC](https://discuss.elastic.co/t/changing-a-term-in-a-json-to-become-the-timestamp-from-filebeat/75907 "2017-03-05T08:49:26Z")
Hi, My Filebeat is reading the time that the a log file is created as the timestamp. This is a problem since it does not read every message in the log with a unique time. What I am trying to do is to parse a json that … [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1023) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1025)