# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1036 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1037 --- ## [Configuring logstash to listen to Filebeat](https://discuss.elastic.co/t/configuring-logstash-to-listen-to-filebeat/75160)
**Author:** [@agrawalsaurabh](https://discuss.elastic.co/u/agrawalsaurabh)\ **Replies:** 2\ **Last updated:** [February 15, 2017, 10:26am UTC](https://discuss.elastic.co/t/configuring-logstash-to-listen-to-filebeat/75160 "2017-02-15T10:26:10Z")
Hi, I have installed Logstash version 5.2.0 and File Beat 5.2.0. Next I configured file beat to send events to logstash. Next I configured logstash to listen to file beat by the following configuration: input { beat… --- ## [Jdbc column join](https://discuss.elastic.co/t/jdbc-column-join/75129)
**Author:** [@Greentea](https://discuss.elastic.co/u/Greentea)\ **Replies:** 3\ **Last updated:** [February 15, 2017, 8:33am UTC](https://discuss.elastic.co/t/jdbc-column-join/75129 "2017-02-15T08:33:46Z")
Hi I want to ask is it possible and how to use filter to make to column join together? For example, I have a column call brand and another column call name in my database. I want to use filter to make it look like "… --- ## [When elastic X-PACK is enabled logstash can't connect to elasticsearch](https://discuss.elastic.co/t/when-elastic-x-pack-is-enabled-logstash-cant-connect-to-elasticsearch/75138)
**Author:** [@zqc0512](https://discuss.elastic.co/u/zqc0512)\ **Replies:** 2\ **Last updated:** [February 15, 2017, 7:13am UTC](https://discuss.elastic.co/t/when-elastic-x-pack-is-enabled-logstash-cant-connect-to-elasticsearch/75138 "2017-02-15T07:13:49Z")
when elastic X-PACK is enabled how logstash can connect to elastic 9200 the logstash can't startup when use ./logstash -f logstash.conf the confgure file output elasticsearch host xx.xx.xx:9200 the logstash log … --- ## [IF ELSE in Logstash INPUT](https://discuss.elastic.co/t/if-else-in-logstash-input/75142)
**Author:** [@froto](https://discuss.elastic.co/u/froto)\ **Replies:** 1\ **Last updated:** [February 15, 2017, 7:02am UTC](https://discuss.elastic.co/t/if-else-in-logstash-input/75142 "2017-02-15T07:02:08Z")
Hey there, at the moment many different systems were sending logs on port 514 Does anyone know if it is possible to declare different type direktly in the input section? Something like: input { udp { port =\> "514… --- ## [Email Authentication error](https://discuss.elastic.co/t/email-authentication-error/74420)
**Author:** [@amitkashyap](https://discuss.elastic.co/u/amitkashyap)\ **Replies:** 4\ **Last updated:** [February 15, 2017, 2:22am UTC](https://discuss.elastic.co/t/email-authentication-error/74420 "2017-02-15T02:22:45Z")
I am getting authentication error while sending mail throug logstash. below is my Email configuration I set email { debug =\> true authentication =\> "login" address =\> "\*\*my mail server IP\*\*" port =\> 25 … --- ## [Logstash snort implementation](https://discuss.elastic.co/t/logstash-snort-implementation/32386)
**Author:** [@ssi](https://discuss.elastic.co/u/ssi)\ **Replies:** 2\ **Last updated:** [February 14, 2017, 8:00pm UTC](https://discuss.elastic.co/t/logstash-snort-implementation/32386 "2017-02-14T20:00:29Z")
have anyone made or heard of a snort plugin for logstash i found this and will try it out sometime next week but if anyone have succeded in getting snort alerts parsed and into ELK I would really like to hear about how… --- ## [What is the definitive way of only retaining 7 days of logs](https://discuss.elastic.co/t/what-is-the-definitive-way-of-only-retaining-7-days-of-logs/28399)
**Author:** [@Sam\_Saffron](https://discuss.elastic.co/u/Sam_Saffron)\ **Replies:** 8\ **Last updated:** [February 14, 2017, 9:00pm UTC](https://discuss.elastic.co/t/what-is-the-definitive-way-of-only-retaining-7-days-of-logs/28399 "2017-02-14T21:00:48Z")
Our haproxy logs are eating up a large amount of space in logstash indexes, what is the "correct" / "best" way of setting up logstash only to retain 7 days of logs in elastic? Step by step guide would be much apprecia… --- ## [Trouble with simple ruby code calculation](https://discuss.elastic.co/t/trouble-with-simple-ruby-code-calculation/75094)
**Author:** [@cuenca](https://discuss.elastic.co/u/cuenca)\ **Replies:** 1\ **Last updated:** [February 14, 2017, 8:18pm UTC](https://discuss.elastic.co/t/trouble-with-simple-ruby-code-calculation/75094 "2017-02-14T20:18:30Z")
Hi, I am getting a ruby exception error for the calculation, but not sure what could causing it. input { file { type =\> "csv" path =\> "/Users/path/perf.csv" start\_position =\> beginning # to rea… --- ## [Sensu to send logs to logstash](https://discuss.elastic.co/t/sensu-to-send-logs-to-logstash/74920)
**Author:** [@Lakshmi\_D](https://discuss.elastic.co/u/Lakshmi_D)\ **Replies:** 8\ **Last updated:** [February 14, 2017, 7:31pm UTC](https://discuss.elastic.co/t/sensu-to-send-logs-to-logstash/74920 "2017-02-14T19:31:17Z")
im not able to see logs from to elk --- ## [Mutate beats field](https://discuss.elastic.co/t/mutate-beats-field/74940)
**Author:** [@kopacko](https://discuss.elastic.co/u/kopacko)\ **Replies:** 9\ **Last updated:** [February 14, 2017, 5:55pm UTC](https://discuss.elastic.co/t/mutate-beats-field/74940 "2017-02-14T17:55:57Z")
I cannot seem to get this to work: mutate { add\_field =\> { "hostname" =\> "%{beat.hostname}" } } I used this template of code quite a bit and it is working just fine for other items. --- ## [Grok pattern performance](https://discuss.elastic.co/t/grok-pattern-performance/75047)
**Author:** [@german23](https://discuss.elastic.co/u/german23)\ **Replies:** 2\ **Last updated:** [February 14, 2017, 3:09pm UTC](https://discuss.elastic.co/t/grok-pattern-performance/75047 "2017-02-14T15:09:38Z")
Hey folks, there was a nice article on the elastic homepage a while ago about the performance of grok filters, so i went on and set up this script to mesure throughput for the filter. In my understand using %{DATA:sth}… --- ## [Global variables in LS possible?](https://discuss.elastic.co/t/global-variables-in-ls-possible/75043)
**Author:** [@seanziee](https://discuss.elastic.co/u/seanziee)\ **Replies:** 2\ **Last updated:** [February 14, 2017, 2:51pm UTC](https://discuss.elastic.co/t/global-variables-in-ls-possible/75043 "2017-02-14T14:51:14Z")
So I'm an amateur ruby user and I'm trying to figure this out, but a bit hard trying to mesh my limited ruby knowledge and trying to incorporate it with how the ruby plugin works in logstash. I'd like to somehow save a… --- ## [No network syslogs in logstash](https://discuss.elastic.co/t/no-network-syslogs-in-logstash/74931)
**Author:** [@GGabriele](https://discuss.elastic.co/u/GGabriele)\ **Replies:** 2\ **Last updated:** [February 14, 2017, 12:18pm UTC](https://discuss.elastic.co/t/no-network-syslogs-in-logstash/74931 "2017-02-14T12:18:52Z")
Hi all, I need to build something similar to this blog post but I'm having hard times while trying to make it work. I've installed logstash and configured it following the guide on the official website. I've tested t… --- ## [How do I rotate the output log files of logstash](https://discuss.elastic.co/t/how-do-i-rotate-the-output-log-files-of-logstash/29108)
**Author:** [@achakrab22](https://discuss.elastic.co/u/achakrab22)\ **Replies:** 7\ **Last updated:** [February 14, 2017, 11:25am UTC](https://discuss.elastic.co/t/how-do-i-rotate-the-output-log-files-of-logstash/29108 "2017-02-14T11:25:04Z")
Hi I am trying to log all the logstash output including Errors /Info. What is the best recommended way? Also I want to rotate the log file. I see there is an output-\> file command supported in config. but the option max\_… --- ## [Logstash jdbc multi input](https://discuss.elastic.co/t/logstash-jdbc-multi-input/74957)
**Author:** [@Greentea](https://discuss.elastic.co/u/Greentea)\ **Replies:** 3\ **Last updated:** [February 14, 2017, 10:28am UTC](https://discuss.elastic.co/t/logstash-jdbc-multi-input/74957 "2017-02-14T10:28:41Z")
Hi I am currently using logstash-plugin-jdbc to pull data from mysql to elasticsearch.I want to know how can I input multi table from mysql into same index? here is some of the code input { jdbc { # the contr… --- ## [Creating a delta filter in logstash using global variable](https://discuss.elastic.co/t/creating-a-delta-filter-in-logstash-using-global-variable/75008)
**Author:** [@jayesh.w](https://discuss.elastic.co/u/jayesh.w)\ **Replies:** 0\ **Last updated:** [February 14, 2017, 10:24am UTC](https://discuss.elastic.co/t/creating-a-delta-filter-in-logstash-using-global-variable/75008 "2017-02-14T10:24:06Z")
I was trying to replicate cpu usage graph in jconsole.It needs to substract prvious values from the present values.So I am trying to use @@prevprocesscpuload as a global variable.But it is not working please help filter… --- ## [I can't get a directory name added as a field in Logstash and Kibana](https://discuss.elastic.co/t/i-cant-get-a-directory-name-added-as-a-field-in-logstash-and-kibana/74518)
**Author:** [@hoagieben](https://discuss.elastic.co/u/hoagieben)\ **Replies:** 2\ **Last updated:** [February 14, 2017, 10:11am UTC](https://discuss.elastic.co/t/i-cant-get-a-directory-name-added-as-a-field-in-logstash-and-kibana/74518 "2017-02-14T10:11:21Z")
Hi again. I have a structure within Logstash running in Docker of /opt/logs/CUSTOMERNAME/SERVERNAME/SystemOut\*.log I want to have SERVERNAME and CUSTOMERNAME as fields in Kibana but it doesn't work for me. Below i… --- ## [Can't install Logsatash plugin in Centos](https://discuss.elastic.co/t/cant-install-logsatash-plugin-in-centos/74977)
**Author:** [@wolfghost](https://discuss.elastic.co/u/wolfghost)\ **Replies:** 10\ **Last updated:** [February 14, 2017, 10:01am UTC](https://discuss.elastic.co/t/cant-install-logsatash-plugin-in-centos/74977 "2017-02-14T10:01:59Z")
I am new for elk and trying to install logstash plugin for MongoDB in centos 7.1 but it always say command not found, Elasticsearch and kibana are working fine, Can you please help me. --- ## [Multiple inputs or single input in logstash config, Which is better?](https://discuss.elastic.co/t/multiple-inputs-or-single-input-in-logstash-config-which-is-better/74981)
**Author:** [@Mayank\_Agrawal](https://discuss.elastic.co/u/Mayank_Agrawal)\ **Replies:** 0\ **Last updated:** [February 14, 2017, 7:41am UTC](https://discuss.elastic.co/t/multiple-inputs-or-single-input-in-logstash-config-which-is-better/74981 "2017-02-14T07:41:00Z")
Scenario: Files that I need logstash to process have same file name pattern (say xyz.log). Earlier I was using single file input, but had issues reading .sincedb file (logstash is not updating it properly). So I am thin… --- ## [Logstash set log rotate time](https://discuss.elastic.co/t/logstash-set-log-rotate-time/74965)
**Author:** [@howie\_chen](https://discuss.elastic.co/u/howie_chen)\ **Replies:** 2\ **Last updated:** [February 14, 2017, 7:01am UTC](https://discuss.elastic.co/t/logstash-set-log-rotate-time/74965 "2017-02-14T07:01:57Z")
I have installed logstash-5.2.0 on centos 7.2, the config show as below, now the new log web\_%{+YYYY-MM-dd}.log generated at 8:00 am everyday, but i want to set the log rotate time at 00:00:00 everyday, i can't find log… --- ## [Logstash Kafka Input Plugin Data has Type Already](https://discuss.elastic.co/t/logstash-kafka-input-plugin-data-has-type-already/57161)
**Author:** [@kingston](https://discuss.elastic.co/u/kingston)\ **Replies:** 5\ **Last updated:** [February 14, 2017, 6:01am UTC](https://discuss.elastic.co/t/logstash-kafka-input-plugin-data-has-type-already/57161 "2017-02-14T06:01:34Z")
I'm using the Kafka Input plugin and noticed that my elasticsearch indices were being named incorrectly. After debugging, I realized that the kafka topic had documents that already included a type field. Input.conf i… --- ## [Broken encoding of Windows EventLog messages](https://discuss.elastic.co/t/broken-encoding-of-windows-eventlog-messages/74955)
**Author:** [@polymorfiqcoder](https://discuss.elastic.co/u/polymorfiqcoder)\ **Replies:** 1\ **Last updated:** [February 14, 2017, 4:55am UTC](https://discuss.elastic.co/t/broken-encoding-of-windows-eventlog-messages/74955 "2017-02-14T04:55:01Z")
On localized windows we have eventlog messages with non-english letters which logstash unable to reproduce in right way. { "@timestamp" =\> 2017-02-14T03:42:20.105Z, "message" =\> "\\xD1\\xEB\\xF3\\xE6\\… --- ## [Elasticsearch Input Filter Returns %{message}](https://discuss.elastic.co/t/elasticsearch-input-filter-returns-message/74934)
**Author:** [@ben-10](https://discuss.elastic.co/u/ben-10)\ **Replies:** 1\ **Last updated:** [February 13, 2017, 11:29pm UTC](https://discuss.elastic.co/t/elasticsearch-input-filter-returns-message/74934 "2017-02-13T23:29:33Z")
Attempting to use the Elasticsearch input plugin on Logstash 5.2.0, but with the following config: input { elasticsearch { hosts =\> "esearch-cn1:9200" index =\> "logstash\_sa\_2017.02.06" query =\> '{ … --- ## [Logstash json parse error](https://discuss.elastic.co/t/logstash-json-parse-error/74000)
**Author:** [@mattgolding](https://discuss.elastic.co/u/mattgolding)\ **Replies:** 15\ **Last updated:** [February 13, 2017, 11:14pm UTC](https://discuss.elastic.co/t/logstash-json-parse-error/74000 "2017-02-13T23:14:55Z")
I have a problem trying to parse a log file with backslashes in it. I have tried a number of escape options using the gsub() method although without any luck. I am not a ruby coder so its possible i am doing something … --- ## [How can I import json data from Mysql 5.5 to logstash 1.4.2?](https://discuss.elastic.co/t/how-can-i-import-json-data-from-mysql-5-5-to-logstash-1-4-2/74740)
**Author:** [@pythonl1](https://discuss.elastic.co/u/pythonl1)\ **Replies:** 5\ **Last updated:** [February 13, 2017, 10:20pm UTC](https://discuss.elastic.co/t/how-can-i-import-json-data-from-mysql-5-5-to-logstash-1-4-2/74740 "2017-02-13T22:20:00Z")
Hi, I am using ELK stack on an Ubuntu 14.04 server. The versions of each application is as follows: Elasticsearch: 0.90.13 Logstash: 1.4.2 Kibana: 3.0.1 I have succeeded in establishing connection between the three a… --- ## [File input: sincedb general questions](https://discuss.elastic.co/t/file-input-sincedb-general-questions/28846)
**Author:** [@Alex\_6](https://discuss.elastic.co/u/Alex_6)\ **Replies:** 6\ **Last updated:** [February 13, 2017, 9:02pm UTC](https://discuss.elastic.co/t/file-input-sincedb-general-questions/28846 "2017-02-13T21:02:20Z")
I have some questions about how sincedb and File input works. My current understanding is that File input records where it gets up to in a particular file by writing it to the sincedb file every x seconds or on Logstash … --- ## [Elapsed Plugin Negative elapsed\_time](https://discuss.elastic.co/t/elapsed-plugin-negative-elapsed-time/74877)
**Author:** [@varundbest](https://discuss.elastic.co/u/varundbest)\ **Replies:** 0\ **Last updated:** [February 13, 2017, 12:09pm UTC](https://discuss.elastic.co/t/elapsed-plugin-negative-elapsed-time/74877 "2017-02-13T12:09:28Z")
There are no unique ids in my logs so i'm creating my own by adding multiple fields but the thing is that they may repeat over time. My LOC #1457(END Tag) is matching with #1559 (START Tag) instead of #1450(START Tag). … --- ## [Logstash "\_grokparsefailure" in output](https://discuss.elastic.co/t/logstash--grokparsefailure-in-output/74519)
**Author:** [@ash007](https://discuss.elastic.co/u/ash007)\ **Replies:** 5\ **Last updated:** [February 13, 2017, 7:28pm UTC](https://discuss.elastic.co/t/logstash--grokparsefailure-in-output/74519 "2017-02-13T19:28:02Z")
Hi, I am trying to execute a simple logstash config by using the grok patterns. Following is the total.conf file: input { tcp { port =\> 5000 type =\> meter } udp { port =\> 5000 type =\> meter } } filt… --- ## [Parsing syslogs from different Cisco devices to Logstash](https://discuss.elastic.co/t/parsing-syslogs-from-different-cisco-devices-to-logstash/74680)
**Author:** [@Rinat](https://discuss.elastic.co/u/Rinat)\ **Replies:** 2\ **Last updated:** [February 13, 2017, 6:41pm UTC](https://discuss.elastic.co/t/parsing-syslogs-from-different-cisco-devices-to-logstash/74680 "2017-02-13T18:41:44Z")
My scenario is as follows: rsyslog server collects logs from different Cisco gears. It then forwards it to Logstash as syslogs type. Are there any configuration examples for Logstash to filter all the different Cisco d… --- ## [How to use Logstash plugin ID effectively?](https://discuss.elastic.co/t/how-to-use-logstash-plugin-id-effectively/74918)
**Author:** [@Maxwell\_Flanders](https://discuss.elastic.co/u/Maxwell_Flanders)\ **Replies:** 0\ **Last updated:** [February 13, 2017, 6:37pm UTC](https://discuss.elastic.co/t/how-to-use-logstash-plugin-id-effectively/74918 "2017-02-13T18:37:26Z")
I am using logstash-kafka input plugin, and I have configured the ID setting, as referenced here: https://www.elastic.co/guide/en/logstash/current/plugins-inputs-kafka.html#plugins-inputs-kafka-id I thought this would … [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1035) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1037)