# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1044 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1045 --- ## [Sending changing log (name) to ELK](https://discuss.elastic.co/t/sending-changing-log-name-to-elk/73535)
**Author:** [@Yzord](https://discuss.elastic.co/u/Yzord)\ **Replies:** 3\ **Last updated:** [February 1, 2017, 5:58pm UTC](https://discuss.elastic.co/t/sending-changing-log-name-to-elk/73535 "2017-02-01T17:58:16Z")
I have a little problem. I want to send a logfile with the name "firewall-01-02-2017.log" to my ELK server, but this file is changing every month to for instance "firewall-01-03-2017.log" etc. So i thought it would be b… --- ## [Logstash SSL configuration problem](https://discuss.elastic.co/t/logstash-ssl-configuration-problem/49404)
**Author:** [@Aljaz\_Gantar](https://discuss.elastic.co/u/Aljaz_Gantar)\ **Replies:** 10\ **Last updated:** [February 1, 2017, 5:14pm UTC](https://discuss.elastic.co/t/logstash-ssl-configuration-problem/49404 "2017-02-01T17:14:49Z")
Okei so i have this case: I have tree server which are running the whole stack, and they are set up so: Filebeat =\> Logstash =\> Elasticsearch/Kibana And I successfully configured that the Filebeat sends logs from his s… --- ## [Logstash JMX plugin offline installation](https://discuss.elastic.co/t/logstash-jmx-plugin-offline-installation/73546)
**Author:** [@wokmichel](https://discuss.elastic.co/u/wokmichel)\ **Replies:** 0\ **Last updated:** [February 1, 2017, 4:08pm UTC](https://discuss.elastic.co/t/logstash-jmx-plugin-offline-installation/73546 "2017-02-01T16:08:43Z")
Hello, I am trying to use the JMX plugin in order to gather metrics from a number of remote JVMs. The plugin is here : https://github.com/logstash-plugins/logstash-input-jmx The Server running Logstash does not have a… --- ## [Getting 429 errors in Elasticsearch output](https://discuss.elastic.co/t/getting-429-errors-in-elasticsearch-output/73545)
**Author:** [@tarp](https://discuss.elastic.co/u/tarp)\ **Replies:** 0\ **Last updated:** [February 1, 2017, 4:04pm UTC](https://discuss.elastic.co/t/getting-429-errors-in-elasticsearch-output/73545 "2017-02-01T16:04:17Z")
Hi, I have seen several other threads talking about the 429 errors from the elasticsearch output, but I'm not finding any kind of solution. So I'm starting a new thread. My Environment: 2 Kibana Servers 4 Dedicated mast… --- ## [FileBeat in Windows and LogStash in Linux](https://discuss.elastic.co/t/filebeat-in-windows-and-logstash-in-linux/73529)
**Author:** [@Shmuel.Bouhnik](https://discuss.elastic.co/u/Shmuel.Bouhnik)\ **Replies:** 11\ **Last updated:** [February 1, 2017, 3:40pm UTC](https://discuss.elastic.co/t/filebeat-in-windows-and-logstash-in-linux/73529 "2017-02-01T15:40:23Z")
Hi, I running FileBeat on Windows and LogStash on Linux. When I'm sending a log file from FileBeat to LogStash ... LogStash is getting in utf8 and the grok filtering is not working. But when I'm sending the file fro… --- ## [Logstash fail with multiline exception messages](https://discuss.elastic.co/t/logstash-fail-with-multiline-exception-messages/73532)
**Author:** [@pajesz](https://discuss.elastic.co/u/pajesz)\ **Replies:** 0\ **Last updated:** [February 1, 2017, 2:50pm UTC](https://discuss.elastic.co/t/logstash-fail-with-multiline-exception-messages/73532 "2017-02-01T14:50:21Z")
Hello, I've encountered a huge problem which I can't solve myself. I have a file with like 60000 java exceptions and I'm using logstash to send it to elasticsearch. Each exception starts with 30 Jan 2017 and looks like… --- ## [How to reference field value from Environment plugin?](https://discuss.elastic.co/t/how-to-reference-field-value-from-environment-plugin/73394)
**Author:** [@Jimmy\_Kang](https://discuss.elastic.co/u/Jimmy_Kang)\ **Replies:** 3\ **Last updated:** [February 1, 2017, 2:36pm UTC](https://discuss.elastic.co/t/how-to-reference-field-value-from-environment-plugin/73394 "2017-02-01T14:36:44Z")
Hi Guys. I am on logstash 1.5 and I'm trying to use environment plugin and then pass that field value to mongo as part of the URI for the password. This is mainly to mask the password so that it is not in plaintext in … --- ## [Encountered an unexpected error submitting a bulk request! Will retry](https://discuss.elastic.co/t/encountered-an-unexpected-error-submitting-a-bulk-request-will-retry/71642)
**Author:** [@nbari](https://discuss.elastic.co/u/nbari)\ **Replies:** 6\ **Last updated:** [February 1, 2017, 2:06pm UTC](https://discuss.elastic.co/t/encountered-an-unexpected-error-submitting-a-bulk-request-will-retry/71642 "2017-02-01T14:06:02Z")
I am installing/testing logstash 5.1.1 I am available to send the logs to elasticsearch this is my output: output { elasticsearch { timeout =\> 30 hosts =\> \["10.10.23.183"\] index =\> "logstash-… --- ## [Logstash not generating logs](https://discuss.elastic.co/t/logstash-not-generating-logs/73525)
**Author:** [@ssasporta](https://discuss.elastic.co/u/ssasporta)\ **Replies:** 0\ **Last updated:** [February 1, 2017, 1:53pm UTC](https://discuss.elastic.co/t/logstash-not-generating-logs/73525 "2017-02-01T13:53:36Z")
My configuration in logstash.yml is: log.level: info log.format: plain path.logs: /var/log/logstash But I can't see logs created in the directory. Any idea? --- ## [How to save and retrieve usernames and passwords from logstash config](https://discuss.elastic.co/t/how-to-save-and-retrieve-usernames-and-passwords-from-logstash-config/73037)
**Author:** [@gmmurugan](https://discuss.elastic.co/u/gmmurugan)\ **Replies:** 10\ **Last updated:** [February 1, 2017, 1:50pm UTC](https://discuss.elastic.co/t/how-to-save-and-retrieve-usernames-and-passwords-from-logstash-config/73037 "2017-02-01T13:50:21Z")
i need to get a password to connect to database using jdbc plugin. please let me know best vault method to use inside logstash config jdbc\_connection\_string =\> "jdbc:db2://xxxxxxxxxxxxxx:port" jdbc\_user =\> "username" … --- ## [I can not install any LogStash plug-in in ES 5.0](https://discuss.elastic.co/t/i-can-not-install-any-logstash-plug-in-in-es-5-0/64313)
**Author:** [@michelmooren](https://discuss.elastic.co/u/michelmooren)\ **Replies:** 26\ **Last updated:** [February 1, 2017, 1:17pm UTC](https://discuss.elastic.co/t/i-can-not-install-any-logstash-plug-in-in-es-5-0/64313 "2017-02-01T13:17:43Z")
I did a fresh install of ES 5.0. When trying to install LS plug-ins like logstash-filter-multiline and logstash-filter-mutate I keep getting the following error message: An error occurred while installing logstash-cor… --- ## [SSL problem](https://discuss.elastic.co/t/ssl-problem/59383)
**Author:** [@amran1](https://discuss.elastic.co/u/amran1)\ **Replies:** 1\ **Last updated:** [February 1, 2017, 9:49am UTC](https://discuss.elastic.co/t/ssl-problem/59383 "2017-02-01T09:49:44Z")
Hello, I found a problem when i generate SSL certificate for filebeats. 2016/08/31 03:18:31.828989 transport.go:125: ERR SSL client failed to connect with: x509: certificate signed by unknown authority (possibly becaus… --- ## [Plugin not found](https://discuss.elastic.co/t/plugin-not-found/73472)
**Author:** [@pjanzen](https://discuss.elastic.co/u/pjanzen)\ **Replies:** 6\ **Last updated:** [February 1, 2017, 9:28am UTC](https://discuss.elastic.co/t/plugin-not-found/73472 "2017-02-01T09:28:26Z")
Hi, I am trying to install logstash-filter-elasticsearch plugin using the following command: JARS\_DEBUG=true JARS\_VERBOSE=true DEBUG=1 bin/logstash-plugin install logstash-filter-elasticsearch The error I get is: Err… --- ## [Mcafee DAM syslog parsing Logstash](https://discuss.elastic.co/t/mcafee-dam-syslog-parsing-logstash/73136)
**Author:** [@HawkUser](https://discuss.elastic.co/u/HawkUser)\ **Replies:** 5\ **Last updated:** [February 1, 2017, 8:59am UTC](https://discuss.elastic.co/t/mcafee-dam-syslog-parsing-logstash/73136 "2017-02-01T08:59:15Z")
Hi Community, i'm looking for logstash idea how to parse the next content: \<15\>#externalId=0#rt=1XXXX1#cs1=SaXXM XX-XXXXXX#cs1Label=XXX#dst=XX.XX.xx.xx#src=xx.xx.xx.xxx#duser=xxx\_xxxx#suser=#shost=XXX-XXXXXXX#dproc=xx… --- ## [Convert boolean fails on TrueClass](https://discuss.elastic.co/t/convert-boolean-fails-on-trueclass/73480)
**Author:** [@stevie](https://discuss.elastic.co/u/stevie)\ **Replies:** 2\ **Last updated:** [February 1, 2017, 8:38am UTC](https://discuss.elastic.co/t/convert-boolean-fails-on-trueclass/73480 "2017-02-01T08:38:14Z")
Version: logstash 1:5.1.2-1 Operating System: Linux elk-1.domain.net 3.13.0-105-generic #152-Ubuntu SMP Fri Dec 2 15:37:11 UTC 2016 x86\_64 x86\_64 x86\_64 GNU/Linux Config File (if you have sensitive info, please remove … --- ## [How to name new index based on time from log](https://discuss.elastic.co/t/how-to-name-new-index-based-on-time-from-log/73336)
**Author:** [@John16](https://discuss.elastic.co/u/John16)\ **Replies:** 9\ **Last updated:** [February 1, 2017, 8:37am UTC](https://discuss.elastic.co/t/how-to-name-new-index-based-on-time-from-log/73336 "2017-02-01T08:37:02Z")
Hello, by default logstash names index using pattern logstash-%{+yyyy.MM.dd} (and filebeat-%{+yyyy.MM.dd} for filebeat), where %{+yyyy.MM.dd} is the date when event is being published to ES. How can I substitute date… --- ## [TTY grok filter needs changed](https://discuss.elastic.co/t/tty-grok-filter-needs-changed/72669)
**Author:** [@panaman](https://discuss.elastic.co/u/panaman)\ **Replies:** 3\ **Last updated:** [February 1, 2017, 6:59am UTC](https://discuss.elastic.co/t/tty-grok-filter-needs-changed/72669 "2017-02-01T06:59:55Z")
The current TTY grok filter does not match if does not contain "/dev" It will not match the secure log on centos. Jan 24 16:19:36 USOHWC-ESCTL1 sudo: panaman : TTY=pts/1 ; PWD=/home/panaman ; USER=root ; COMMAND=/bin… --- ## [Grok filter EMAILADDRESS no worky if it starts with a number](https://discuss.elastic.co/t/grok-filter-emailaddress-no-worky-if-it-starts-with-a-number/73425)
**Author:** [@panaman](https://discuss.elastic.co/u/panaman)\ **Replies:** 0\ **Last updated:** [January 31, 2017, 9:45pm UTC](https://discuss.elastic.co/t/grok-filter-emailaddress-no-worky-if-it-starts-with-a-number/73425 "2017-01-31T21:45:39Z")
if you have an email address like "2livecrew@gmail.com" that starts with a number and not a letter, the %{EMAILADDRESS:email} filter won't work. The regex in EMAILLOCALPART needs to have 0-9 added ORIGINAL EMAILLOC… --- ## [Logstash parse grok](https://discuss.elastic.co/t/logstash-parse-grok/73337)
**Author:** [@taurs](https://discuss.elastic.co/u/taurs)\ **Replies:** 3\ **Last updated:** [January 31, 2017, 8:15pm UTC](https://discuss.elastic.co/t/logstash-parse-grok/73337 "2017-01-31T20:15:06Z")
\[7/1/05 13:41:00:516 PDT\] -- log line ( \\\[%{DD/MM/YY HH:MM:SS:S Z}\\\] ) -- this is the grok pattern i have used. Doesnt seem to work. Can anyone help with this logstash grok pattern --- ## [Scalable Logstash Config Generator](https://discuss.elastic.co/t/scalable-logstash-config-generator/72691)
**Author:** [@thehybridtech](https://discuss.elastic.co/u/thehybridtech)\ **Replies:** 3\ **Last updated:** [January 31, 2017, 7:00pm UTC](https://discuss.elastic.co/t/scalable-logstash-config-generator/72691 "2017-01-31T19:00:26Z")
I have been using Logstash for over 2 years and love it. One frustration I have had is scaling Logstash across multiple (100+) different data types. (These are not like dissimilar syslog types but completely different… --- ## [Best Process For Counting Lines in Multiline Event](https://discuss.elastic.co/t/best-process-for-counting-lines-in-multiline-event/73410)
**Author:** [@seth.yes](https://discuss.elastic.co/u/seth.yes)\ **Replies:** 2\ **Last updated:** [January 31, 2017, 6:20pm UTC](https://discuss.elastic.co/t/best-process-for-counting-lines-in-multiline-event/73410 "2017-01-31T18:20:42Z")
I need a way to count lines in a multiline event using Logstash 5.1.2. I've attempted simply doing a Grok on the multiline event, but when some of these events have 15 lines, I consistently get Grok Timeouts (logstash-fi… --- ## [File input reading file but not pushing to pipeline](https://discuss.elastic.co/t/file-input-reading-file-but-not-pushing-to-pipeline/73401)
**Author:** [@tglawless](https://discuss.elastic.co/u/tglawless)\ **Replies:** 0\ **Last updated:** [January 31, 2017, 5:21pm UTC](https://discuss.elastic.co/t/file-input-reading-file-but-not-pushing-to-pipeline/73401 "2017-01-31T17:21:22Z")
I'm having trouble with the file input plugin. It sees new entries in the log file, but those entries are not added to the pipeline. The input looks like: input { file { path =\> "/var/journald-json/journald" codec… --- ## [Secure way of setting username/password in logstash config file](https://discuss.elastic.co/t/secure-way-of-setting-username-password-in-logstash-config-file/28126)
**Author:** [@imad](https://discuss.elastic.co/u/imad)\ **Replies:** 5\ **Last updated:** [January 31, 2017, 5:18pm UTC](https://discuss.elastic.co/t/secure-way-of-setting-username-password-in-logstash-config-file/28126 "2017-01-31T17:18:45Z")
Is there a more secure way of setting username/password of couchdb in logstash config file. Setting a plain password in config file wouldn't be a very likable option. Thanks, Imad. --- ## [Can't install Logstash on Ubuntu](https://discuss.elastic.co/t/cant-install-logstash-on-ubuntu/73294)
**Author:** [@darthbinks911](https://discuss.elastic.co/u/darthbinks911)\ **Replies:** 8\ **Last updated:** [January 31, 2017, 5:02pm UTC](https://discuss.elastic.co/t/cant-install-logstash-on-ubuntu/73294 "2017-01-31T17:02:03Z")
I've followed all the steps on the installation guide for Logstash but I keep getting this error: Setting up nginx-core (1.10.0-0ubuntu0.16.04.4) ... Job for nginx.service failed because the control process exited with… --- ## [Logstash listening on 3515 and 514](https://discuss.elastic.co/t/logstash-listening-on-3515-and-514/25461)
**Author:** [@cav10](https://discuss.elastic.co/u/cav10)\ **Replies:** 4\ **Last updated:** [January 31, 2017, 4:50pm UTC](https://discuss.elastic.co/t/logstash-listening-on-3515-and-514/25461 "2017-01-31T16:50:29Z")
I am trying to get logstash listening on 3515 and 514 so I can ship logs from my Windows client and Bro sensor. I am using CentOS 6.6. Any thoughts be awesome. I've been working on this for a few days. Things I have do… --- ## [Elasticsearch Delete action does not take effect](https://discuss.elastic.co/t/elasticsearch-delete-action-does-not-take-effect/73393)
**Author:** [@ArunANayagam](https://discuss.elastic.co/u/ArunANayagam)\ **Replies:** 0\ **Last updated:** [January 31, 2017, 4:28pm UTC](https://discuss.elastic.co/t/elasticsearch-delete-action-does-not-take-effect/73393 "2017-01-31T16:28:21Z")
Hi, I am using Logstash 2.4.0 and Elasticsearch 2.4.0 Below is my logstash conf, filter { json { source =\> "message" } if (\[root\]\[ns0:selection\]\[isFinished\] == "true" or \[root\]\[ns0:market\]\[isFin… --- ## [Logstash Config Test Fails with Multiple Files](https://discuss.elastic.co/t/logstash-config-test-fails-with-multiple-files/73070)
**Author:** [@kopacko](https://discuss.elastic.co/u/kopacko)\ **Replies:** 1\ **Last updated:** [January 31, 2017, 4:29pm UTC](https://discuss.elastic.co/t/logstash-config-test-fails-with-multiple-files/73070 "2017-01-31T16:29:21Z")
If use this command: sudo /usr/share/logstash/bin/logstash -t --log.level=debug -l /usr/share/logstash/logs --path. settings /etc/logstash/ -f /etc/logstash/conf.d/1\* I get this as a r… --- ## [Beats input not behaving as documented](https://discuss.elastic.co/t/beats-input-not-behaving-as-documented/73360)
**Author:** [@nick-george](https://discuss.elastic.co/u/nick-george)\ **Replies:** 0\ **Last updated:** [January 31, 2017, 12:22pm UTC](https://discuss.elastic.co/t/beats-input-not-behaving-as-documented/73360 "2017-01-31T12:22:33Z")
Hi, Logstash version: 5.1.2-1 EDIT The following patch should fix this, will open a pull request. diff --git a/lib/logstash/inputs/beats.rb b/lib/logstash/inputs/beats.rb index 3c0c54a..76b971d 100644 --- a/lib/… --- ## [API showing incorrect data](https://discuss.elastic.co/t/api-showing-incorrect-data/73017)
**Author:** [@Mormaii](https://discuss.elastic.co/u/Mormaii)\ **Replies:** 6\ **Last updated:** [January 31, 2017, 2:20pm UTC](https://discuss.elastic.co/t/api-showing-incorrect-data/73017 "2017-01-31T14:20:48Z")
Trying to check the heap max in bytes using http://localhost:9600/\_node/jvm?pretty=true works correctly which shows 8GB for me. Now when I try to see more detailed stats about the JVM with: http://localhost:9600/\_… --- ## [Invalid Frame Type, received 1and 3](https://discuss.elastic.co/t/invalid-frame-type-received-1and-3/72441)
**Author:** [@mitter1989](https://discuss.elastic.co/u/mitter1989)\ **Replies:** 1\ **Last updated:** [January 31, 2017, 1:36pm UTC](https://discuss.elastic.co/t/invalid-frame-type-received-1and-3/72441 "2017-01-31T13:36:55Z")
Hi Guys, Thanks..!!! in advance :slight\_smile: After replacing "localhost" with "192.168.0.100:9200" in the output of logstash configuration I am getting below errors in /var/log/logstash/logstash-plain.log : \[201… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1043) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1045)