# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1029 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1030 --- ## [Getting the error in logstash5.2.1 and elasticsearch 5.2.1](https://discuss.elastic.co/t/getting-the-error-in-logstash5-2-1-and-elasticsearch-5-2-1/76614)
**Author:** [@Naveen\_Kumar\_M\_A](https://discuss.elastic.co/u/Naveen_Kumar_M_A)\ **Replies:** 3\ **Last updated:** [February 27, 2017, 12:20pm UTC](https://discuss.elastic.co/t/getting-the-error-in-logstash5-2-1-and-elasticsearch-5-2-1/76614 "2017-02-27T12:20:23Z")
\`Sending Logstash's logs to /home/user/tools/logstash-5.2.1/logs which is now configured via log4j2.properties \[2017-02-27T17:43:52,402\]\[INFO \]\[logstash.inputs.twitter \] Starting twitter tracking {:locations=\>"-179.985,… --- ## [Extract specific key and value in Logstash](https://discuss.elastic.co/t/extract-specific-key-and-value-in-logstash/76478)
**Author:** [@gnievoj](https://discuss.elastic.co/u/gnievoj)\ **Replies:** 2\ **Last updated:** [February 27, 2017, 12:12pm UTC](https://discuss.elastic.co/t/extract-specific-key-and-value-in-logstash/76478 "2017-02-27T12:12:38Z")
Im using Logastash to collecting data from mysql. Json result looks : "\_source" : { "username" : "room\_test@localhost", "timestamp" : 1481785195811703, "peer" : "user@localhos… --- ## [Reading beats fields from Kafka input](https://discuss.elastic.co/t/reading-beats-fields-from-kafka-input/76206)
**Author:** [@Rober](https://discuss.elastic.co/u/Rober)\ **Replies:** 2\ **Last updated:** [February 27, 2017, 11:57am UTC](https://discuss.elastic.co/t/reading-beats-fields-from-kafka-input/76206 "2017-02-27T11:57:10Z")
Hi, in my infrastructure I have something like: Filebeat -\> Kafka -\> Logstash -\> Elasticsearch I'm having problems reading the custom fields set up in Filebeat when filtering in Logstash. I configured the kafka input… --- ## [Logstash 5.2: init script for manual tar.gz installation?](https://discuss.elastic.co/t/logstash-5-2-init-script-for-manual-tar-gz-installation/74079)
**Author:** [@asp](https://discuss.elastic.co/u/asp)\ **Replies:** 3\ **Last updated:** [February 27, 2017, 11:25am UTC](https://discuss.elastic.co/t/logstash-5-2-init-script-for-manual-tar-gz-installation/74079 "2017-02-27T11:25:45Z")
Hi, I installed logstash 5.2 from the tar package on redhat 6.7. I did not use the installer, because an older version of the elk stack with installed services for logstash, etc. are already present at the system. I … --- ## [Logstash cannot upload files, "failed to open Permission Denied"](https://discuss.elastic.co/t/logstash-cannot-upload-files-failed-to-open-permission-denied/76584)
**Author:** [@ArieTwigt](https://discuss.elastic.co/u/ArieTwigt)\ **Replies:** 4\ **Last updated:** [February 27, 2017, 11:22am UTC](https://discuss.elastic.co/t/logstash-cannot-upload-files-failed-to-open-permission-denied/76584 "2017-02-27T11:22:47Z")
I am facing an issue with uploading XML-files to an index in the cloud using Logstash. I have a directory with around 10.000 files and configured a Logstash in which all the contents of that directory are indicated. When… --- ## [Logstash Received fatal alert: protocol\_version {:class=\>"Java::JavaxNetSsl::SSLException", :location=\>"sun.security.ssl.Alerts.getSSLException(sun/security/ssl/Alerts.java:208)",](https://discuss.elastic.co/t/logstash-received-fatal-alert-protocol-version-class-java-javaxnetssl-sslexception-location-sun-security-ssl-alerts-getsslexception-sun-security-ssl-alerts-java-208/76602)
**Author:** [@Rajasekaran\_Mari](https://discuss.elastic.co/u/Rajasekaran_Mari)\ **Replies:** 0\ **Last updated:** [February 27, 2017, 10:22am UTC](https://discuss.elastic.co/t/logstash-received-fatal-alert-protocol-version-class-java-javaxnetssl-sslexception-location-sun-security-ssl-alerts-getsslexception-sun-security-ssl-alerts-java-208/76602 "2017-02-27T10:22:27Z")
Hi, When i run this following logstash configuration, some fatal error came, kindly help this issue. Settings: Default pipeline workers: 1 Received fatal alert: protocol\_version {:class=\>"Java::JavaxNetSsl::SSLExc… --- ## [Multiline log parsing from redis to logstash](https://discuss.elastic.co/t/multiline-log-parsing-from-redis-to-logstash/76588)
**Author:** [@prosenjit](https://discuss.elastic.co/u/prosenjit)\ **Replies:** 3\ **Last updated:** [February 27, 2017, 9:25am UTC](https://discuss.elastic.co/t/multiline-log-parsing-from-redis-to-logstash/76588 "2017-02-27T09:25:37Z")
Hi Everyone, I have multiline custom logs which I am processing as a single line by the filebeat multiline keyword. Now this includes \\n at the end of each line. This however causes grok parse failure in my logstsash con… --- ## [Rename particular field using logstash 2.4.0?](https://discuss.elastic.co/t/rename-particular-field-using-logstash-2-4-0/76583)
**Author:** [@Yaswanth](https://discuss.elastic.co/u/Yaswanth)\ **Replies:** 1\ **Last updated:** [February 27, 2017, 8:17am UTC](https://discuss.elastic.co/t/rename-particular-field-using-logstash-2-4-0/76583 "2017-02-27T08:17:47Z")
I have slow logs like this... \[2017-01-13 14:37:48,943\]\[DEBUG\]\[index.search.slowlog.query\] \[Spectra\] \[test\]\[4\] took\[50micros\], took\_millis\[0\], types\[\], stats\[\], search\_type\[QUERY\_THEN\_FETCH\], total\_shards\[5\], source\[\],… --- ## [Sending to data to Elasticsearch using logstash?](https://discuss.elastic.co/t/sending-to-data-to-elasticsearch-using-logstash/76354)
**Author:** [@Yaswanth](https://discuss.elastic.co/u/Yaswanth)\ **Replies:** 6\ **Last updated:** [February 27, 2017, 7:07am UTC](https://discuss.elastic.co/t/sending-to-data-to-elasticsearch-using-logstash/76354 "2017-02-27T07:07:22Z")
Hi ES 2.4.1 Logstash 2.4.0 I am sending data to elasticsearch from local to create a index "pica".I used the below conf file. input { file { path =\> "C:\\Output\\Receive.txt" start\_position =\> "be… --- ## [Can logstash listen directly from JMS queue using logstash-input-jms plugin?](https://discuss.elastic.co/t/can-logstash-listen-directly-from-jms-queue-using-logstash-input-jms-plugin/76543)
**Author:** [@Ranieri\_Mazili\_de\_Ol](https://discuss.elastic.co/u/Ranieri_Mazili_de_Ol)\ **Replies:** 1\ **Last updated:** [February 27, 2017, 6:52am UTC](https://discuss.elastic.co/t/can-logstash-listen-directly-from-jms-queue-using-logstash-input-jms-plugin/76543 "2017-02-27T06:52:57Z")
Hello, I'm studying a little bit about Beats, Logstash and ElasticSearch and which features of each one I have to use to create a solution. I was thinking that I should use Beats to listen a JMS queue and then send thi… --- ## [Parsing text file with specific fields](https://discuss.elastic.co/t/parsing-text-file-with-specific-fields/76256)
**Author:** [@SebB](https://discuss.elastic.co/u/SebB)\ **Replies:** 1\ **Last updated:** [February 27, 2017, 6:43am UTC](https://discuss.elastic.co/t/parsing-text-file-with-specific-fields/76256 "2017-02-27T06:43:00Z")
Hi. I want to parse a csv file that's look like this: EventId : 212, Level : Informational, Message : Receiver RetoursStatutVcom last executed on 20170223-000407, duration 5257 ms, Payload : \[name : RetoursStatutVcom\] … --- ## [Logstash error with x-pack](https://discuss.elastic.co/t/logstash-error-with-x-pack/76379)
**Author:** [@Suin\_You](https://discuss.elastic.co/u/Suin_You)\ **Replies:** 2\ **Last updated:** [February 27, 2017, 5:56am UTC](https://discuss.elastic.co/t/logstash-error-with-x-pack/76379 "2017-02-27T05:56:30Z")
I install the x-pack and start logstash but got the error. Error is Sending Logstash's logs to /usr/local/logstash/logs which is now configured via log4j2.properties \[2017-02-24T18:54:14,460\]\[ERROR\]\[logstash.monitori… --- ## [Logstash run as a background service](https://discuss.elastic.co/t/logstash-run-as-a-background-service/76138)
**Author:** [@Suin\_You](https://discuss.elastic.co/u/Suin_You)\ **Replies:** 8\ **Last updated:** [February 27, 2017, 5:54am UTC](https://discuss.elastic.co/t/logstash-run-as-a-background-service/76138 "2017-02-27T05:54:02Z")
I install logstash-5.2.0.tar.gz and wanna start logstash as a background service using script. My command in the script is 'bin/logstash -f test.conf &'. But it is also not in background and 'agent' not is included in th… --- ## [Can Logstash enrich data before send to elasticsearch?](https://discuss.elastic.co/t/can-logstash-enrich-data-before-send-to-elasticsearch/76437)
**Author:** [@Ranieri\_Mazili\_de\_Ol](https://discuss.elastic.co/u/Ranieri_Mazili_de_Ol)\ **Replies:** 3\ **Last updated:** [February 27, 2017, 3:52am UTC](https://discuss.elastic.co/t/can-logstash-enrich-data-before-send-to-elasticsearch/76437 "2017-02-27T03:52:03Z")
Hello, I'm completely new and I'm evaluating some tool to implement my solution. I'll use Beats as agent and when a new event come I'll send it to Logstash. Can Logstash, based in the information receveid by Beats,… --- ## [Logstash-plugin install](https://discuss.elastic.co/t/logstash-plugin-install/76510)
**Author:** [@Dan\_Kennedy](https://discuss.elastic.co/u/Dan_Kennedy)\ **Replies:** 2\ **Last updated:** [February 26, 2017, 8:19pm UTC](https://discuss.elastic.co/t/logstash-plugin-install/76510 "2017-02-26T20:19:59Z")
Hope someone can help? I attempted to install the translate plugin for logstash. This failed with a memory problem Feb 25 23:20:47 elk logstash: OpenJDK 64-Bit Server VM warning: INFO: os::commit\_memory(0x00000000d14… --- ## [Problems with exec input plugin](https://discuss.elastic.co/t/problems-with-exec-input-plugin/49829)
**Author:** [@fhasanaj](https://discuss.elastic.co/u/fhasanaj)\ **Replies:** 3\ **Last updated:** [February 26, 2017, 12:13am UTC](https://discuss.elastic.co/t/problems-with-exec-input-plugin/49829 "2017-02-26T00:13:11Z")
Hello, I'm having trouble with exec input plugin. The command I'm trying to execute is 'papertrail -json' which is a ruby gem I have installed locally, so when I run the command by itself in terminal I do get the desir… --- ## [LogStash-forwarder not sending data to Logstash/ElasticSearch older than 24 hours](https://discuss.elastic.co/t/logstash-forwarder-not-sending-data-to-logstash-elasticsearch-older-than-24-hours/76508)
**Author:** [@priyashet123](https://discuss.elastic.co/u/priyashet123)\ **Replies:** 1\ **Last updated:** [February 25, 2017, 11:52pm UTC](https://discuss.elastic.co/t/logstash-forwarder-not-sending-data-to-logstash-elasticsearch-older-than-24-hours/76508 "2017-02-25T23:52:15Z")
We have ELK s/w setup in one server(serverA) and logstash-forwarder (in a remote server-ServerB), forwarding logs to ELK server(ServerA). Everything works fine if both server are up and running. If logstash-forwarde… --- ## [Error Beats Logstash](https://discuss.elastic.co/t/error-beats-logstash/76492)
**Author:** [@CGC](https://discuss.elastic.co/u/CGC)\ **Replies:** 0\ **Last updated:** [February 25, 2017, 6:02pm UTC](https://discuss.elastic.co/t/error-beats-logstash/76492 "2017-02-25T18:02:24Z")
I'm new to elasticsearch, kibana, logstash. Installed them separatly and works but now I was trying to follow the guide and installed beats as plugin and was succesfull, listed them and appears in the list. Then I starte… --- ## [Use executable as filter](https://discuss.elastic.co/t/use-executable-as-filter/76489)
**Author:** [@benaryorg](https://discuss.elastic.co/u/benaryorg)\ **Replies:** 0\ **Last updated:** [February 25, 2017, 5:14pm UTC](https://discuss.elastic.co/t/use-executable-as-filter/76489 "2017-02-25T17:14:33Z")
Hi, as I'm just getting started with Logstash, ELK and Beats (Filebeats to be exact) I'm trying to comprehend the vast amount of information thrown at me. The whole stack seems to adhere to the Unix Philosophy, which I… --- ## [Logstash with redis server](https://discuss.elastic.co/t/logstash-with-redis-server/76464)
**Author:** [@daaakeee](https://discuss.elastic.co/u/daaakeee)\ **Replies:** 3\ **Last updated:** [February 25, 2017, 4:18pm UTC](https://discuss.elastic.co/t/logstash-with-redis-server/76464 "2017-02-25T16:18:28Z")
Hi, can I use input from redis server on logstash 5.2, where received input passed to redis server from logstash 2.4? logstash2.4 --\> redis output--\> redis-server --\> logstash5.2 input? --- ## [Fresh Logstash installation crashes periodically, has high CPU load, returns "active:failed" and "status=143" after stopping](https://discuss.elastic.co/t/fresh-logstash-installation-crashes-periodically-has-high-cpu-load-returns-active-failed-and-status-143-after-stopping/76101)
**Author:** [@akipaki](https://discuss.elastic.co/u/akipaki)\ **Replies:** 3\ **Last updated:** [February 25, 2017, 3:18pm UTC](https://discuss.elastic.co/t/fresh-logstash-installation-crashes-periodically-has-high-cpu-load-returns-active-failed-and-status-143-after-stopping/76101 "2017-02-25T15:18:13Z")
System Logstash version: 5.2.1, installed with .deb package. Although this problem has occured on Logstash 5.1.2 as well. OS: Debian 8.7 Java Version: $ java -version openjdk version "1.8.0\_111" OpenJDK Runtime Envi… --- ## [Metricbeat -](https://discuss.elastic.co/t/metricbeat/76441)
**Author:** [@Exocomp](https://discuss.elastic.co/u/Exocomp)\ **Replies:** 3\ **Last updated:** [February 25, 2017, 1:07pm UTC](https://discuss.elastic.co/t/metricbeat/76441 "2017-02-25T13:07:45Z")
No longer needed, don't know how to delete this. --- ## [Logstash coverting field names to all lowercase](https://discuss.elastic.co/t/logstash-coverting-field-names-to-all-lowercase/76470)
**Author:** [@harikishore96](https://discuss.elastic.co/u/harikishore96)\ **Replies:** 2\ **Last updated:** [February 25, 2017, 9:50am UTC](https://discuss.elastic.co/t/logstash-coverting-field-names-to-all-lowercase/76470 "2017-02-25T09:50:45Z")
I'm using Logstash to keep my MySql database and ES in sync. I want to keep field names in both databases to be same. But logstash is converting some uppercase field names to lowercase. How to config logstash, so that th… --- ## [Issue installing x-pack with logstash 5.2.1](https://discuss.elastic.co/t/issue-installing-x-pack-with-logstash-5-2-1/75785)
**Author:** [@vinodpattel](https://discuss.elastic.co/u/vinodpattel)\ **Replies:** 4\ **Last updated:** [February 24, 2017, 9:31pm UTC](https://discuss.elastic.co/t/issue-installing-x-pack-with-logstash-5-2-1/75785 "2017-02-24T21:31:47Z")
Hi, I installed logstash 5.2.1 & tried offline installation of x-pack 5.2.1. This seems to hang, with no progress on installation. x-pack-5.2.1.zip file was downloaded and placed in /var/tmp folder. ls -lrt /var/tmp/… --- ## [Logstash upgrade 2.x -\> 5.x and kafka input](https://discuss.elastic.co/t/logstash-upgrade-2-x-5-x-and-kafka-input/76416)
**Author:** [@carrot](https://discuss.elastic.co/u/carrot)\ **Replies:** 1\ **Last updated:** [February 24, 2017, 5:46pm UTC](https://discuss.elastic.co/t/logstash-upgrade-2-x-5-x-and-kafka-input/76416 "2017-02-24T17:46:18Z")
Since new Kafka input is using bootstrap servers and not zookeeper anymore for offsets, how do I migrate from 2.x to 5.x? Seems like the only option is change topic as my offsets don't work anymore. Am I missing som… --- ## [How can I check if an object is empty?](https://discuss.elastic.co/t/how-can-i-check-if-an-object-is-empty/76380)
**Author:** [@Jean\_Helou](https://discuss.elastic.co/u/Jean_Helou)\ **Replies:** 5\ **Last updated:** [February 24, 2017, 4:25pm UTC](https://discuss.elastic.co/t/how-can-i-check-if-an-object-is-empty/76380 "2017-02-24T16:25:14Z")
I manipulate http requests. my event structure looks like { "http\_body":{ "raw":"..." } } I detect the content type of the requests and when it's application/json, I parse the http\_body as json and endup with … --- ## [Error (end of file reached) while streaming tweetsusing logstash and putting them into mongodb](https://discuss.elastic.co/t/error-end-of-file-reached-while-streaming-tweetsusing-logstash-and-putting-them-into-mongodb/76408)
**Author:** [@amilus](https://discuss.elastic.co/u/amilus)\ **Replies:** 0\ **Last updated:** [February 24, 2017, 2:45pm UTC](https://discuss.elastic.co/t/error-end-of-file-reached-while-streaming-tweetsusing-logstash-and-putting-them-into-mongodb/76408 "2017-02-24T14:45:40Z")
I'm trying to stream tweets using logstash and my output is mongodb and i'm getting this error that i can't find a solution to. This is theerror text End of file reached {:exception=\>#, :backtrace=\>\["org/jruby/ext/opens… --- ## [Parse nested json](https://discuss.elastic.co/t/parse-nested-json/46114)
**Author:** [@ajays](https://discuss.elastic.co/u/ajays)\ **Replies:** 8\ **Last updated:** [April 4, 2016, 5:12pm UTC](https://discuss.elastic.co/t/parse-nested-json/46114 "2016-04-04T17:12:48Z")
Hello, I have an input line as given below {"dwo":"0","rs":{"$date":"2016-02-11T00:52:50.348Z"},"first":\[{"timestamp":"2016-02-11T00:52:51Z","a":"abc","b":"243253456","c":"fdsfg444323fef"},{"timestamp":"2016-02-11T00… --- ## [Parsing JSON objects in array](https://discuss.elastic.co/t/parsing-json-objects-in-array/76402)
**Author:** [@Nejc\_Zupan](https://discuss.elastic.co/u/Nejc_Zupan)\ **Replies:** 0\ **Last updated:** [February 24, 2017, 1:41pm UTC](https://discuss.elastic.co/t/parsing-json-objects-in-array/76402 "2017-02-24T13:41:13Z")
Hello @magnusbaeck, Thank you for your effort and help resolving Logstash questions. I have learned a lot from you. Amongst other sources, I am receiving logs from RabbitMQ in valid JSON but with JSON objects in array… --- ## [Input STDIN 4096 character input limit?](https://discuss.elastic.co/t/input-stdin-4096-character-input-limit/50630)
**Author:** [@dmg0122](https://discuss.elastic.co/u/dmg0122)\ **Replies:** 1\ **Last updated:** [February 24, 2017, 12:47pm UTC](https://discuss.elastic.co/t/input-stdin-4096-character-input-limit/50630 "2017-02-24T12:47:58Z")
File wc: #\] wc file 1 22 4097 file Processing some json from the STDIN input I get the following: :exception=\># at \[Source: \[B@1d6f5292; line: 1, column: 8191\]\>, :level=\>:warn} After cutting off sections of… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1028) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1030)