# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1041 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1042 --- ## [Logstash - beat plugin had an unrecoverable error](https://discuss.elastic.co/t/logstash-beat-plugin-had-an-unrecoverable-error/74188)
**Author:** [@tatdat](https://discuss.elastic.co/u/tatdat)\ **Replies:** 0\ **Last updated:** [February 7, 2017, 9:13am UTC](https://discuss.elastic.co/t/logstash-beat-plugin-had-an-unrecoverable-error/74188 "2017-02-07T09:13:18Z")
Hi, Im using elastic, kibana , logstash 5.2. im getting error when config beat plugin 16:02:19.188 \[\[main\]\ **Author:** [@Morten\_Bormeth](https://discuss.elastic.co/u/Morten_Bormeth)\ **Replies:** 6\ **Last updated:** [February 7, 2017, 9:08am UTC](https://discuss.elastic.co/t/index-isn-t-created/74172 "2017-02-07T09:08:53Z") Hello :slight\_smile: Cluster Id: 32188e I've restarted the Elastic node and now I can't create index like "logstash-production-2017.02.07" but it creates "logstash-development-2017.02.07" and "logstash-test-2017.02.0… --- ## [Logstash 2.3.3 convert integers in list of json](https://discuss.elastic.co/t/logstash-2-3-3-convert-integers-in-list-of-json/74089)
**Author:** [@misomij](https://discuss.elastic.co/u/misomij)\ **Replies:** 1\ **Last updated:** [February 7, 2017, 8:46am UTC](https://discuss.elastic.co/t/logstash-2-3-3-convert-integers-in-list-of-json/74089 "2017-02-07T08:46:22Z")
Hi all, I have a parsing problem with Logstash 2.3.3 I haven't found similar questions, apologize if this is a duplicate. As input I have a file which every like is a json similar to this: { "field1": "foo", … --- ## [Logstash filter cidr error](https://discuss.elastic.co/t/logstash-filter-cidr-error/73187)
**Author:** [@ANU\_SARA\_VARGHESE](https://discuss.elastic.co/u/ANU_SARA_VARGHESE)\ **Replies:** 10\ **Last updated:** [February 7, 2017, 8:32am UTC](https://discuss.elastic.co/t/logstash-filter-cidr-error/73187 "2017-02-07T08:32:16Z")
Hi, I was trying CIDR filter of logstash. cidr { add\_tag =\> \["matched"\] address =\> \["%{clientip}"\] network =\> \["10.123.123.0/24", "10.xxx.xxx.0/24", "10.xxx.xxx.0/24", "10.xxx.xxx.0/24"\] } This is giving an… --- ## [Possible bug with redis output plugin](https://discuss.elastic.co/t/possible-bug-with-redis-output-plugin/73832)
**Author:** [@olorasde](https://discuss.elastic.co/u/olorasde)\ **Replies:** 8\ **Last updated:** [February 7, 2017, 7:54am UTC](https://discuss.elastic.co/t/possible-bug-with-redis-output-plugin/73832 "2017-02-07T07:54:14Z")
Hi, I'm using redis output plugin in my logstash to extract keys from redis, preprocess it and return it to redis. Logstash version are 5.1.1 and redis is 3.2.6. I confgure my redis output plugin in logstsh as follow… --- ## [Error-Unable to Parse Sample XML (in logstash console)](https://discuss.elastic.co/t/error-unable-to-parse-sample-xml-in-logstash-console/74167)
**Author:** [@rlv\_praveen](https://discuss.elastic.co/u/rlv_praveen)\ **Replies:** 0\ **Last updated:** [February 7, 2017, 7:07am UTC](https://discuss.elastic.co/t/error-unable-to-parse-sample-xml-in-logstash-console/74167 "2017-02-07T07:07:39Z")
HI All, When I am trying to parse my XML using my configuration file in logstash I am getting the following error in my logstash console as follows. 19:28:34.292 \[\[main\]\>worker0\] WARN logstash.filters.xml - Error par… --- ## [Cannot install plugin environment](https://discuss.elastic.co/t/cannot-install-plugin-environment/64853)
**Author:** [@sizgiyaev](https://discuss.elastic.co/u/sizgiyaev)\ **Replies:** 2\ **Last updated:** [February 7, 2017, 1:25am UTC](https://discuss.elastic.co/t/cannot-install-plugin-environment/64853 "2017-02-07T01:25:44Z")
Hello, I'm trying to install the plugin envrionment for my logstash forwarders that are running logstash 5.0. Here is the out put i get: Validating logstash-filter-environment Installing logstash-filter-environment Plugi… --- ## [Logstash sflow](https://discuss.elastic.co/t/logstash-sflow/50203)
**Author:** [@Karl\_Trasschaert](https://discuss.elastic.co/u/Karl_Trasschaert)\ **Replies:** 14\ **Last updated:** [February 6, 2017, 10:43pm UTC](https://discuss.elastic.co/t/logstash-sflow/50203 "2017-02-06T22:43:42Z")
Hi, I've read that it's possible to get sflow logs from switches to logstash. Can yo explain me how to do it ? I've followed that tutorial, but nothing appear in my logs: http://whiskeyalpharomeo.com/2015/06/13/logs… --- ## [Is there a reason not to have logstash on each host](https://discuss.elastic.co/t/is-there-a-reason-not-to-have-logstash-on-each-host/74076)
**Author:** [@kmroz](https://discuss.elastic.co/u/kmroz)\ **Replies:** 6\ **Last updated:** [February 6, 2017, 10:34pm UTC](https://discuss.elastic.co/t/is-there-a-reason-not-to-have-logstash-on-each-host/74076 "2017-02-06T22:34:27Z")
Hello, i am curious if there is a reason that I should use file beat to ship the logs to a logstash agent rather than having a logstash agent on each host and eliminating the middle man? Thanks, Kenneth --- ## [TimeStamp Off by a month\_Help](https://discuss.elastic.co/t/timestamp-off-by-a-month-help/74111)
**Author:** [@harshavardan25000](https://discuss.elastic.co/u/harshavardan25000)\ **Replies:** 2\ **Last updated:** [February 6, 2017, 10:02pm UTC](https://discuss.elastic.co/t/timestamp-off-by-a-month-help/74111 "2017-02-06T22:02:11Z")
I am trying to parse "20170201 00:54:24 GMT-0600" field from logline and convert it to the @timestamp. I designed a data filter which looks like this "YYYYMMDD HH:mm:ss zZ" but the output becomes 2017-01-01T07:02:01.000Z… --- ## [How to debug logstash errors](https://discuss.elastic.co/t/how-to-debug-logstash-errors/74130)
**Author:** [@dbenson](https://discuss.elastic.co/u/dbenson)\ **Replies:** 0\ **Last updated:** [February 6, 2017, 9:37pm UTC](https://discuss.elastic.co/t/how-to-debug-logstash-errors/74130 "2017-02-06T21:37:28Z")
I've started writing json files into ELK 5.1.1 but don't know where to proceed with log messages in logstash-plain.log like: \[2017-02-06T21:07:17,039\]\[WARN \]\[logstash.outputs.elasticsearch\] Failed action. {:status=\>400… --- ## [Logstash CLI not working](https://discuss.elastic.co/t/logstash-cli-not-working/73749)
**Author:** [@capsno1](https://discuss.elastic.co/u/capsno1)\ **Replies:** 4\ **Last updated:** [February 6, 2017, 9:14pm UTC](https://discuss.elastic.co/t/logstash-cli-not-working/73749 "2017-02-06T21:14:38Z")
I managed to install logstash recently but I am unable to use any cli commands. I followed these instructions (https://www.elastic.co/guide/en/logstash/current/installing-logstash.html) using APT. I had to start logs… --- ## [Logstash service not working?](https://discuss.elastic.co/t/logstash-service-not-working/73900)
**Author:** [@capsno1](https://discuss.elastic.co/u/capsno1)\ **Replies:** 2\ **Last updated:** [February 6, 2017, 9:13pm UTC](https://discuss.elastic.co/t/logstash-service-not-working/73900 "2017-02-06T21:13:13Z")
Can anyone help me with this error? my logstash service is not opening the requested pots in the config files such as port 514. I don't know if that is related. root@fgprd-oncommand-elasticlog-app001:/var/log/logstas… --- ## [Logstash azure plugin](https://discuss.elastic.co/t/logstash-azure-plugin/29435)
**Author:** [@dhrumil83](https://discuss.elastic.co/u/dhrumil83)\ **Replies:** 2\ **Last updated:** [February 6, 2017, 8:01pm UTC](https://discuss.elastic.co/t/logstash-azure-plugin/29435 "2017-02-06T20:01:56Z")
I am very new to logstash, and am kind of stuck how to do this part. I copied logs from azure blob container, and was able to parse via logstash and put the records in elastic search on my local machine. Now I want to … --- ## [Grok Parsing failure](https://discuss.elastic.co/t/grok-parsing-failure/73981)
**Author:** [@ssasporta](https://discuss.elastic.co/u/ssasporta)\ **Replies:** 11\ **Last updated:** [February 6, 2017, 6:03pm UTC](https://discuss.elastic.co/t/grok-parsing-failure/73981 "2017-02-06T18:03:41Z")
I am getting into Logstash files from Filebeat, grok them and insert into Elasticsearch. As my log file contains various formats I created 6 different groks, all in the same "if" on the type of the input and in each gro… --- ## [Logstash existing log4j files](https://discuss.elastic.co/t/logstash-existing-log4j-files/72216)
**Author:** [@Sacha](https://discuss.elastic.co/u/Sacha)\ **Replies:** 3\ **Last updated:** [February 6, 2017, 5:41pm UTC](https://discuss.elastic.co/t/logstash-existing-log4j-files/72216 "2017-02-06T17:41:42Z")
Tried make this work few moths back, gave up. Issue again on head. Lesson giving up does fix the problem. I have this Java applicaiton running on JBoss server and it writes Log4j files. The files go like 1 gb and rotate.… --- ## [New Plugin: logstash-filter-augment - Enhance your events from external data files](https://discuss.elastic.co/t/new-plugin-logstash-filter-augment-enhance-your-events-from-external-data-files/72062)
**Author:** [@Adam\_Caldwell](https://discuss.elastic.co/u/Adam_Caldwell)\ **Replies:** 9\ **Last updated:** [February 6, 2017, 4:17pm UTC](https://discuss.elastic.co/t/new-plugin-logstash-filter-augment-enhance-your-events-from-external-data-files/72062 "2017-02-06T16:17:16Z")
I wrote a plugin that people here might find useful. Given a CSV/JSON/YML file with structured data, add fields to your event based on a lookup into that file. The use-case I had for it was to do geocoding based on ac… --- ## [Reparse log file with Filebeat-Logstash](https://discuss.elastic.co/t/reparse-log-file-with-filebeat-logstash/74085)
**Author:** [@Beuhlet\_Reseau](https://discuss.elastic.co/u/Beuhlet_Reseau)\ **Replies:** 0\ **Last updated:** [February 6, 2017, 3:45pm UTC](https://discuss.elastic.co/t/reparse-log-file-with-filebeat-logstash/74085 "2017-02-06T15:45:09Z")
Hello, I have seems few topics about my request but any performs... So, i have all ELK 5.1 installed + Filebeat to send log to Logstash. I have tested : In logstash's conf : Start\_position =\> "beginning" (Inval… --- ## [Ignoring Newline (\\n) within double quotes for CSV Filter](https://discuss.elastic.co/t/ignoring-newline-n-within-double-quotes-for-csv-filter/27700)
**Author:** [@umangjain](https://discuss.elastic.co/u/umangjain)\ **Replies:** 1\ **Last updated:** [February 6, 2017, 3:23pm UTC](https://discuss.elastic.co/t/ignoring-newline-n-within-double-quotes-for-csv-filter/27700 "2017-02-06T15:23:26Z")
Hello, I have a CSV file and am trying to read it using my logstash configuration. Everything works great for each row. It doesn't work if we have newline character (\\n) in a value surrounded by double quotes. Exampl… --- ## [Extract a string from a field and create a new field with that string](https://discuss.elastic.co/t/extract-a-string-from-a-field-and-create-a-new-field-with-that-string/74051)
**Author:** [@jstar](https://discuss.elastic.co/u/jstar)\ **Replies:** 1\ **Last updated:** [February 6, 2017, 2:41pm UTC](https://discuss.elastic.co/t/extract-a-string-from-a-field-and-create-a-new-field-with-that-string/74051 "2017-02-06T14:41:46Z")
Hi EveryBody, I'm working with logstash grok to extract a string from a field. Here is an example of the "myfield":" stringToExtract-instance 2017-02-06 05:48:25 INFO XXXXXXXX" I want to extract the stringToExtra… --- ## [Filter data logstash error](https://discuss.elastic.co/t/filter-data-logstash-error/74070)
**Author:** [@skb](https://discuss.elastic.co/u/skb)\ **Replies:** 0\ **Last updated:** [February 6, 2017, 2:41pm UTC](https://discuss.elastic.co/t/filter-data-logstash-error/74070 "2017-02-06T14:41:20Z")
\ \ \ \1234\ \123\ \2017/01/21\ \samplee… --- ## [How combine different data inputs in logstash](https://discuss.elastic.co/t/how-combine-different-data-inputs-in-logstash/73997)
**Author:** [@yoshua](https://discuss.elastic.co/u/yoshua)\ **Replies:** 2\ **Last updated:** [February 6, 2017, 2:30pm UTC](https://discuss.elastic.co/t/how-combine-different-data-inputs-in-logstash/73997 "2017-02-06T14:30:22Z")
Hello, I have a set of http API one of them with "no time" data based , the fields are ID, geo location(lat,lon) and others data. The ID is the key to access another API, (time based) , our target is to send a… --- ## [Default parsing of the geoip field: location?](https://discuss.elastic.co/t/default-parsing-of-the-geoip-field-location/73979)
**Author:** [@JohanLanderholm](https://discuss.elastic.co/u/JohanLanderholm)\ **Replies:** 8\ **Last updated:** [February 6, 2017, 1:56pm UTC](https://discuss.elastic.co/t/default-parsing-of-the-geoip-field-location/73979 "2017-02-06T13:56:58Z")
Hi all, This might be a stupid question, please forgive me. But I am struggling to get the default mapping for my geoip field location to be changed from float to geo\_point, I haven't found out how to do this. But - … --- ## [Hitting error - Ignoring Netflow version v10](https://discuss.elastic.co/t/hitting-error-ignoring-netflow-version-v10/73796)
**Author:** [@aayush.a15](https://discuss.elastic.co/u/aayush.a15)\ **Replies:** 4\ **Last updated:** [February 6, 2017, 1:53pm UTC](https://discuss.elastic.co/t/hitting-error-ignoring-netflow-version-v10/73796 "2017-02-06T13:53:09Z")
Hi I am a Logstash newbie. I am using python-ipfix module to generate IPFIX Packets and send it to LogStash on Localhost over port 10000. However, I am hitting the error - Ignoring Netflow version v10 {:level=\>:warn} in … --- ## [Reading from redis server into logstash input](https://discuss.elastic.co/t/reading-from-redis-server-into-logstash-input/74060)
**Author:** [@daaakeee](https://discuss.elastic.co/u/daaakeee)\ **Replies:** 0\ **Last updated:** [February 6, 2017, 1:44pm UTC](https://discuss.elastic.co/t/reading-from-redis-server-into-logstash-input/74060 "2017-02-06T13:44:04Z")
Hi, I am new to logstash. How can I read values which are saved in redis-server under the key ":1:logstash"? if the type of ":1:logstash" is string.. I have an input setting like this: redis { host =\> "so… --- ## [Parsing hierarchical data using logstash](https://discuss.elastic.co/t/parsing-hierarchical-data-using-logstash/74056)
**Author:** [@GautamP](https://discuss.elastic.co/u/GautamP)\ **Replies:** 0\ **Last updated:** [February 6, 2017, 1:01pm UTC](https://discuss.elastic.co/t/parsing-hierarchical-data-using-logstash/74056 "2017-02-06T13:01:11Z")
Continuing the discussion from Recursive nested documents in elasticsearch: Hi all, I would like to parse a log file containing hierarchical data as mentioned in Recursive nested documents in elasticsearch. I would l… --- ## [Logstash unable to establish SSL connection to Elastic Cloud Enterprise](https://discuss.elastic.co/t/logstash-unable-to-establish-ssl-connection-to-elastic-cloud-enterprise/74050)
**Author:** [@YuWatanabe](https://discuss.elastic.co/u/YuWatanabe)\ **Replies:** 0\ **Last updated:** [February 6, 2017, 11:49am UTC](https://discuss.elastic.co/t/logstash-unable-to-establish-ssl-connection-to-elastic-cloud-enterprise/74050 "2017-02-06T11:49:26Z")
Logstash version 5.2.0 Elastic Cloud Enterprise version 1.0.0 alpha4 I am trying to connect to ECE Proxy node using ssl (tcp/9243 https) but logstash seems to not start ssl handshake against the proxy node. I would lik… --- ## [Set "fields" into array - SOLVED](https://discuss.elastic.co/t/set-fields-into-array-solved/73995)
**Author:** [@adrianolimit](https://discuss.elastic.co/u/adrianolimit)\ **Replies:** 3\ **Last updated:** [February 6, 2017, 11:45am UTC](https://discuss.elastic.co/t/set-fields-into-array-solved/73995 "2017-02-06T11:45:44Z")
Hello everyone, I'm using the "Twitter input" and I want to put in lowercase one field, I tried some things but I didn't success ... I know that there are few changes since Logstash 5.0 (I'm using Logstash 5.1.1) with … --- ## [Upgraded logstash 1.5 to 5.2, now it doesn't read](https://discuss.elastic.co/t/upgraded-logstash-1-5-to-5-2-now-it-doesnt-read/73974)
**Author:** [@quietsche](https://discuss.elastic.co/u/quietsche)\ **Replies:** 1\ **Last updated:** [February 6, 2017, 11:32am UTC](https://discuss.elastic.co/t/upgraded-logstash-1-5-to-5-2-now-it-doesnt-read/73974 "2017-02-06T11:32:40Z")
Hi everyone. I'm a bit of a newbie with logstash so I hope you could help me with this issue. I have this customer who uses AWS Beanstalk and has logstash on those instances. They were using logstash 1.5 and I recently … --- ## [Input multiline and json](https://discuss.elastic.co/t/input-multiline-and-json/74040)
**Author:** [@Rafael\_Marquez\_Diaz](https://discuss.elastic.co/u/Rafael_Marquez_Diaz)\ **Replies:** 0\ **Last updated:** [February 6, 2017, 10:19am UTC](https://discuss.elastic.co/t/input-multiline-and-json/74040 "2017-02-06T10:19:40Z")
Hi all, My name is Rafa. I stared with logstash one week ago and I have a problem. I need to read two types of logs from filebeat: json and multiline: JSON: { "op": "kudos", "trans": "71", "version": "6.7.1", "envi… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1040) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1042)