# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1028 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1029 --- ## [Logstash Connection refused](https://discuss.elastic.co/t/logstash-connection-refused/76754)
**Author:** [@Rajasekaran\_Mari](https://discuss.elastic.co/u/Rajasekaran_Mari)\ **Replies:** 3\ **Last updated:** [February 28, 2017, 2:09pm UTC](https://discuss.elastic.co/t/logstash-connection-refused/76754 "2017-02-28T14:09:45Z")
Hi, My team had incorporated TLSv12,TLSv1.1 changes on rabbitmq and because of this logstash cluster got failed. I recovered logstash cluster and updated logstash configurations to ignore rabbitmq inputs. When i run … --- ## [Comapatibility of Logstash, Graylog and ElasticSearch](https://discuss.elastic.co/t/comapatibility-of-logstash-graylog-and-elasticsearch/76765)
**Author:** [@Shrawan\_Bhagwat](https://discuss.elastic.co/u/Shrawan_Bhagwat)\ **Replies:** 2\ **Last updated:** [February 28, 2017, 1:51pm UTC](https://discuss.elastic.co/t/comapatibility-of-logstash-graylog-and-elasticsearch/76765 "2017-02-28T13:51:03Z")
Hi, I want to configure logstash-5.2.1. can anyone tell me which Graylog and ElasticSearch version is compatible with this logstash version? --- ## [Question in Multi line grok pattern](https://discuss.elastic.co/t/question-in-multi-line-grok-pattern/76632)
**Author:** [@Mohsen\_Sabbaghi](https://discuss.elastic.co/u/Mohsen_Sabbaghi)\ **Replies:** 1\ **Last updated:** [February 28, 2017, 1:25pm UTC](https://discuss.elastic.co/t/question-in-multi-line-grok-pattern/76632 "2017-02-28T13:25:55Z")
hi there this is my #beats:filebeat config file that read and send logs to output #logstash: filebeat.prospectors: - input\_type: log paths: - D:\\log\\my-log01.log tags: \["log01"\] field… --- ## [Logstash file input not loading](https://discuss.elastic.co/t/logstash-file-input-not-loading/75826)
**Author:** [@vaishnavi](https://discuss.elastic.co/u/vaishnavi)\ **Replies:** 0\ **Last updated:** [February 21, 2017, 6:45am UTC](https://discuss.elastic.co/t/logstash-file-input-not-loading/75826 "2017-02-21T06:45:17Z")
Hi My input to logstash is input{ file { path =\> "/root/file1.json" start\_position =\> "beginning" } } My logstash output is as follows It stucks in 'pipeline started' but data not inserted to elasticsearch. I… --- ## [Mongodb query log in logsatsh](https://discuss.elastic.co/t/mongodb-query-log-in-logsatsh/75842)
**Author:** [@wolfghost](https://discuss.elastic.co/u/wolfghost)\ **Replies:** 10\ **Last updated:** [February 28, 2017, 12:38pm UTC](https://discuss.elastic.co/t/mongodb-query-log-in-logsatsh/75842 "2017-02-28T12:38:40Z")
can we only show query logs from mongodb in kibana through logstash filter? how? --- ## [How to customize index name with multipule inputs](https://discuss.elastic.co/t/how-to-customize-index-name-with-multipule-inputs/76659)
**Author:** [@Apache\_HOU](https://discuss.elastic.co/u/Apache_HOU)\ **Replies:** 3\ **Last updated:** [February 28, 2017, 12:31pm UTC](https://discuss.elastic.co/t/how-to-customize-index-name-with-multipule-inputs/76659 "2017-02-28T12:31:04Z")
As suggested by @magnusbaeck I create a new topic about customized index name with multiple inputs. Case : I have 2 Apache logs from 2 projects which are stored separately in the directories /tmp/toto/first and /tm… --- ## [Logstash output send rate](https://discuss.elastic.co/t/logstash-output-send-rate/76277)
**Author:** [@ld\_pvl](https://discuss.elastic.co/u/ld_pvl)\ **Replies:** 8\ **Last updated:** [February 28, 2017, 11:37am UTC](https://discuss.elastic.co/t/logstash-output-send-rate/76277 "2017-02-28T11:37:04Z")
Hi Elastic Team, Does Logstash have a feature that allows us to set how many events are sent to remotes, for example outputted to Elasticsearch, for every particular time interval? What we are trying to do is somethi… --- ## [Response code 429](https://discuss.elastic.co/t/response-code-429/47390)
**Author:** [@dkota](https://discuss.elastic.co/u/dkota)\ **Replies:** 8\ **Last updated:** [February 28, 2017, 9:31am UTC](https://discuss.elastic.co/t/response-code-429/47390 "2017-02-28T09:31:57Z")
I have logstash 2.2.2 installed in my server. Getting the error "Retrying failed action with response code :429" on the logstash node. This means that the ES cluster is not able to keep up with the incoming requests, is… --- ## [Syncing mysql table to influxdb](https://discuss.elastic.co/t/syncing-mysql-table-to-influxdb/76506)
**Author:** [@ash007](https://discuss.elastic.co/u/ash007)\ **Replies:** 1\ **Last updated:** [February 28, 2017, 7:18am UTC](https://discuss.elastic.co/t/syncing-mysql-table-to-influxdb/76506 "2017-02-28T07:18:09Z")
I am trying to sync a mysql table in influxdb. Following is my test.conf file. input { jdbc { jdbc\_driver\_library =\> "/root/mysql-connector-java-5.1.40/mysql-connector-java-5.1.40-bin.jar" jdbc\_driver\_class =\> "com.m… --- ## [Indexed records with logstash-input-jdbc not appearing in elasticsearch](https://discuss.elastic.co/t/indexed-records-with-logstash-input-jdbc-not-appearing-in-elasticsearch/76429)
**Author:** [@vinuret](https://discuss.elastic.co/u/vinuret)\ **Replies:** 1\ **Last updated:** [February 28, 2017, 7:07am UTC](https://discuss.elastic.co/t/indexed-records-with-logstash-input-jdbc-not-appearing-in-elasticsearch/76429 "2017-02-28T07:07:49Z")
Hi, I am new to elasticsearch. I am using elasticsearch version 5.2.1 . I used logstash-input-jdbc plugin to index Oracle table data into elasticsearch. The table has almost 5.5 lakhs records. After indexing is completed… --- ## [How can i send particular field to csv using logstash 2.4.0?](https://discuss.elastic.co/t/how-can-i-send-particular-field-to-csv-using-logstash-2-4-0/76403)
**Author:** [@Yaswanth](https://discuss.elastic.co/u/Yaswanth)\ **Replies:** 1\ **Last updated:** [February 28, 2017, 7:04am UTC](https://discuss.elastic.co/t/how-can-i-send-particular-field-to-csv-using-logstash-2-4-0/76403 "2017-02-28T07:04:55Z")
I have so many fields in logstash which i matched with grok filter but in that i want only one field to be taken to csv. fields like timestamp,item name,cost,description etc.. in that i want only item name to be sent … --- ## [Elasticsearch filter is not working in logstash](https://discuss.elastic.co/t/elasticsearch-filter-is-not-working-in-logstash/75995)
**Author:** [@Ganesh2303](https://discuss.elastic.co/u/Ganesh2303)\ **Replies:** 2\ **Last updated:** [February 28, 2017, 5:48am UTC](https://discuss.elastic.co/t/elasticsearch-filter-is-not-working-in-logstash/75995 "2017-02-28T05:48:52Z")
Hi, I'm using new version of logstash(5.2.0) and i'm facing correlation issue in that. Kinldy find the below detail of my issue, Actually im trying to move some fields from index 1 to another index 2. Already i process… --- ## [User-agent filter does not handle "+" as space in ua-strings from IIS](https://discuss.elastic.co/t/user-agent-filter-does-not-handle-as-space-in-ua-strings-from-iis/51263)
**Author:** [@bradley.bristowstagg](https://discuss.elastic.co/u/bradley.bristowstagg)\ **Replies:** 4\ **Last updated:** [February 28, 2017, 2:07am UTC](https://discuss.elastic.co/t/user-agent-filter-does-not-handle-as-space-in-ua-strings-from-iis/51263 "2017-02-28T02:07:10Z")
Hey all, I'm using logstash 2.3 to pull in IIS logs into our little ES cluster running on site. Things are going well (albeit slowly) and now I can start to troll through some of our data I'm seeing a LOT of results from… --- ## [Monitoring Logstash with X-Pack Not Working](https://discuss.elastic.co/t/monitoring-logstash-with-x-pack-not-working/76700)
**Author:** [@mrmt](https://discuss.elastic.co/u/mrmt)\ **Replies:** 2\ **Last updated:** [February 28, 2017, 12:27am UTC](https://discuss.elastic.co/t/monitoring-logstash-with-x-pack-not-working/76700 "2017-02-28T00:27:49Z")
Saw this blogpost: Monitoring Logstash Filters: X-ray glasses included | Elastic Blog and decided to give it a try. I installed the X-Pack plugin on my single Logstash node (5.2.1), added the following to my yaml: xpa… --- ## [Logstash Docker Image locations and size differences](https://discuss.elastic.co/t/logstash-docker-image-locations-and-size-differences/76035)
**Author:** [@kevingimbel](https://discuss.elastic.co/u/kevingimbel)\ **Replies:** 5\ **Last updated:** [February 28, 2017, 12:06am UTC](https://discuss.elastic.co/t/logstash-docker-image-locations-and-size-differences/76035 "2017-02-28T00:06:27Z")
Hello there, @pmoust pointed out in a recent post of me (https://discuss.elastic.co/t/cant-connect-to-elastic-cloud-from-logstash-docker-image-logstash/75517/4) that the official Logstash Docker Images from Elastic are… --- ## [Discrepancy in logstash timestamp output and kibana](https://discuss.elastic.co/t/discrepancy-in-logstash-timestamp-output-and-kibana/76677)
**Author:** [@abd.wsu](https://discuss.elastic.co/u/abd.wsu)\ **Replies:** 11\ **Last updated:** [February 27, 2017, 11:15pm UTC](https://discuss.elastic.co/t/discrepancy-in-logstash-timestamp-output-and-kibana/76677 "2017-02-27T23:15:40Z")
Hello, I have a csv with line like following "Broker Name","Flow Name","Record Start Date","Record Start Time","Record GMT Start Timestamp","Record End Date","Record End Time","Record GMT End Timestamp","Average CPU … --- ## [Logstash Schedule](https://discuss.elastic.co/t/logstash-schedule/76257)
**Author:** [@spraveenjd](https://discuss.elastic.co/u/spraveenjd)\ **Replies:** 1\ **Last updated:** [February 27, 2017, 9:16pm UTC](https://discuss.elastic.co/t/logstash-schedule/76257 "2017-02-27T21:16:32Z")
General concern on using schedule. I am using logstash oracle connector to get the details from tables in every 10min. If suppose the query or the loading took more than 10min to finish. how the next run will trigger? … --- ## [Using the %{foo} syntax in ES output - template parameter](https://discuss.elastic.co/t/using-the-foo-syntax-in-es-output-template-parameter/75040)
**Author:** [@kariboe](https://discuss.elastic.co/u/kariboe)\ **Replies:** 5\ **Last updated:** [February 27, 2017, 8:53pm UTC](https://discuss.elastic.co/t/using-the-foo-syntax-in-es-output-template-parameter/75040 "2017-02-27T20:53:49Z")
Hello all, Using logstash 5.2 .. can I use the %{foo} syntax in the ES output template\_path variable? output { elasticsearch { hosts =\> \["xxxxxx:9200","xxxxxxxx:9200"\] index =\> "%{application}-%{… --- ## [Slowness in logstash throughput while reading from topbeat : how to debug](https://discuss.elastic.co/t/slowness-in-logstash-throughput-while-reading-from-topbeat-how-to-debug/39165)
**Author:** [@biswajit86](https://discuss.elastic.co/u/biswajit86)\ **Replies:** 15\ **Last updated:** [February 27, 2017, 7:25pm UTC](https://discuss.elastic.co/t/slowness-in-logstash-throughput-while-reading-from-topbeat-how-to-debug/39165 "2017-02-27T19:25:57Z")
Hi, I am trying to use logstash to consume messages from topbeat. I setup a topbeat-\>logstash-\>elasticsearch flow and I can see the data in kibana. However, I keep on seeing these messages in logstash logs Beats in… --- ## [Failed to Flush Outgoing Events to New Relic due to EOFError Exception](https://discuss.elastic.co/t/failed-to-flush-outgoing-events-to-new-relic-due-to-eoferror-exception/76663)
**Author:** [@practic\_elk](https://discuss.elastic.co/u/practic_elk)\ **Replies:** 1\ **Last updated:** [February 27, 2017, 6:36pm UTC](https://discuss.elastic.co/t/failed-to-flush-outgoing-events-to-new-relic-due-to-eoferror-exception/76663 "2017-02-27T18:36:25Z")
I am facing EOFError while inserting events to New Relic from rabbit through log stash. Can anyone help me to solve this issue? --- ## [How to mark an event as "Looked At" in Logstash](https://discuss.elastic.co/t/how-to-mark-an-event-as-looked-at-in-logstash/76648)
**Author:** [@Ben\_Hoffman](https://discuss.elastic.co/u/Ben_Hoffman)\ **Replies:** 1\ **Last updated:** [February 27, 2017, 6:28pm UTC](https://discuss.elastic.co/t/how-to-mark-an-event-as-looked-at-in-logstash/76648 "2017-02-27T18:28:14Z")
So I am querying Logstash with this query, which returns all the things off of the top of the stack: { "query": { "match\_all": { } }, "size": 7, "\_source": { "includes": \[ "transport", "dest", "packet\_source", "id\_orig… --- ## [Installing x-pack on offline machines does not work on logstash](https://discuss.elastic.co/t/installing-x-pack-on-offline-machines-does-not-work-on-logstash/75481)
**Author:** [@das-chick](https://discuss.elastic.co/u/das-chick)\ **Replies:** 4\ **Last updated:** [February 27, 2017, 5:57pm UTC](https://discuss.elastic.co/t/installing-x-pack-on-offline-machines-does-not-work-on-logstash/75481 "2017-02-27T17:57:35Z")
when i try to install x-pack-5.0.2 on logstash 5.0.2 the manager tries to go to rubygems.org \[root@node logstash\]# ./bin/logstash-plugin install file:///tmp/x-pack-5.0.2.zip Validating file:///tmp/x-pack-5.0.2.zip Unab… --- ## [Problem installing logstash-filter-dissect](https://discuss.elastic.co/t/problem-installing-logstash-filter-dissect/76673)
**Author:** [@lyres](https://discuss.elastic.co/u/lyres)\ **Replies:** 0\ **Last updated:** [February 27, 2017, 5:34pm UTC](https://discuss.elastic.co/t/problem-installing-logstash-filter-dissect/76673 "2017-02-27T17:34:15Z")
Hi, When I trying to install logstash-filter-dissect to logstash-5.2.1 - getting the following error: logstash-5.2.1\> bin/logstash-plugin install logstash-filter-dissect Validating logstash-filter-dissect Installing lo… --- ## [Parsing custom field with logstash](https://discuss.elastic.co/t/parsing-custom-field-with-logstash/76634)
**Author:** [@mohsin106](https://discuss.elastic.co/u/mohsin106)\ **Replies:** 1\ **Last updated:** [February 27, 2017, 5:31pm UTC](https://discuss.elastic.co/t/parsing-custom-field-with-logstash/76634 "2017-02-27T17:31:41Z")
Hi, I have a log file that I need to parse. I'm forwarding the log from a remote server using FileBeat. My log file content looks like this: ip address, data (characters and numbers). My logstash conf file looks li… --- ## [Using wanted\_fields with in content code with single quotes](https://discuss.elastic.co/t/using-wanted-fields-with-in-content-code-with-single-quotes/76503)
**Author:** [@abd.wsu](https://discuss.elastic.co/u/abd.wsu)\ **Replies:** 2\ **Last updated:** [February 27, 2017, 5:20pm UTC](https://discuss.elastic.co/t/using-wanted-fields-with-in-content-code-with-single-quotes/76503 "2017-02-27T17:20:38Z")
I am trying to use a big logstash config file to parse my (atleast 100) csv file depending on the index created by filebeat. So, I am using the following code within my logstash conf file for these particular csv files.… --- ## [Help Setting Up Logstash through Docker on Windows](https://discuss.elastic.co/t/help-setting-up-logstash-through-docker-on-windows/76299)
**Author:** [@Stephen\_Bodey](https://discuss.elastic.co/u/Stephen_Bodey)\ **Replies:** 8\ **Last updated:** [February 27, 2017, 4:06pm UTC](https://discuss.elastic.co/t/help-setting-up-logstash-through-docker-on-windows/76299 "2017-02-27T16:06:14Z")
I am trying to setup and run Logstash through Docker on a Windows machine. I have started with the references on: https://www.elastic.co/guide/en/logstash/current/docker.html#\_custom\_images to create a custom image, wh… --- ## [Parse a String to an Int](https://discuss.elastic.co/t/parse-a-string-to-an-int/76621)
**Author:** [@tomer](https://discuss.elastic.co/u/tomer)\ **Replies:** 6\ **Last updated:** [February 27, 2017, 3:40pm UTC](https://discuss.elastic.co/t/parse-a-string-to-an-int/76621 "2017-02-27T15:40:07Z")
I am new to the whole ELK. I have a field that I get through a Json that is called "msgDeliveryTime" who I get as a String even though it is an Integer. So I tried to learn the "GROK" and I improvised the following: in… --- ## [How to handle multiple inputs with Logstash to different indices](https://discuss.elastic.co/t/how-to-handle-multiple-inputs-with-logstash-to-different-indices/24541)
**Author:** [@Saket\_Kumar](https://discuss.elastic.co/u/Saket_Kumar)\ **Replies:** 18\ **Last updated:** [February 27, 2017, 3:31pm UTC](https://discuss.elastic.co/t/how-to-handle-multiple-inputs-with-logstash-to-different-indices/24541 "2017-02-27T15:31:35Z")
Directory Structure: ....Results ....Project1 +....RUN1 +....Run2 ....Project2 +....RUN1 +....Run2 "Results" directory contains Project1 & Project2 sub director… --- ## [How to query the index and only get specific indecies](https://discuss.elastic.co/t/how-to-query-the-index-and-only-get-specific-indecies/76445)
**Author:** [@Ben\_Hoffman](https://discuss.elastic.co/u/Ben_Hoffman)\ **Replies:** 2\ **Last updated:** [February 27, 2017, 2:38pm UTC](https://discuss.elastic.co/t/how-to-query-the-index-and-only-get-specific-indecies/76445 "2017-02-27T14:38:46Z")
So I am querying my index like this right now: { "query": { "match\_all" : { } }, "size": 1, "sort": \[ { "@timestamp": { "order": "desc" } } \] } And I get the whole set of data, like you are supposed… --- ## [Logstash instance slave failover](https://discuss.elastic.co/t/logstash-instance-slave-failover/76418)
**Author:** [@SuperbBug](https://discuss.elastic.co/u/SuperbBug)\ **Replies:** 6\ **Last updated:** [February 27, 2017, 1:48pm UTC](https://discuss.elastic.co/t/logstash-instance-slave-failover/76418 "2017-02-27T13:48:40Z")
Does someone knows how to scale Logstash? What do I mean by scaling? Let's say I have one instance of Logstash producing messages from jdbc to Kafka and lets say that node where Logstash service is installed and instance… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1027) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1029)