# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1047 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1048 --- ## [How to filter excel for rows containing certain row strings?](https://discuss.elastic.co/t/how-to-filter-excel-for-rows-containing-certain-row-strings/72921)
**Author:** [@scheung38](https://discuss.elastic.co/u/scheung38)\ **Replies:** 1\ **Last updated:** [January 26, 2017, 9:52pm UTC](https://discuss.elastic.co/t/how-to-filter-excel-for-rows-containing-certain-row-strings/72921 "2017-01-26T21:52:28Z")
Date Time Variable value 08/01/2017 06:00:05 O\_T4CHK\_zoneA\_1\_Live 83 08/01/2017 06:00:05 O\_T4CHK\_totalConcourse\_1\_Live 510 08/01/2017 06:00:05 ProjQueueTime\_T4CHK\_zoneA\_1\_Live 919.048 08/01/2… --- ## [Need to calculate duration run time](https://discuss.elastic.co/t/need-to-calculate-duration-run-time/72947)
**Author:** [@amir.duvdevani](https://discuss.elastic.co/u/amir.duvdevani)\ **Replies:** 1\ **Last updated:** [January 26, 2017, 9:33pm UTC](https://discuss.elastic.co/t/need-to-calculate-duration-run-time/72947 "2017-01-26T21:33:02Z")
I have 2 fields , start time and endtime with datetime format. how could I add new field in logstash or Kibana that will include the duration time = end time - start time ? thanks Amir --- ## [Error while finding translate plugin](https://discuss.elastic.co/t/error-while-finding-translate-plugin/49377)
**Author:** [@harshafrnd4u](https://discuss.elastic.co/u/harshafrnd4u)\ **Replies:** 3\ **Last updated:** [January 26, 2017, 5:20pm UTC](https://discuss.elastic.co/t/error-while-finding-translate-plugin/49377 "2017-01-26T17:20:40Z")
The error reported is: Couldn't find any filter plugin named 'translate'. Are you sure this is correct? Trying to load the translate filter plugin resulted in this error: no such file to load -- logstash/filters/trans… --- ## [Multiline grok conditional filter based on block of text in logfile](https://discuss.elastic.co/t/multiline-grok-conditional-filter-based-on-block-of-text-in-logfile/72664)
**Author:** [@kvjeevan](https://discuss.elastic.co/u/kvjeevan)\ **Replies:** 1\ **Last updated:** [January 26, 2017, 4:56pm UTC](https://discuss.elastic.co/t/multiline-grok-conditional-filter-based-on-block-of-text-in-logfile/72664 "2017-01-26T16:56:59Z")
I want to create a grok filter based on the block of multiline log file as given below. Sometimes the log file will not have the "sent VerifyRes" due to transaction failure, so I want to create a grok filter to capture t… --- ## [Logstash to Logstash Not Working](https://discuss.elastic.co/t/logstash-to-logstash-not-working/72840)
**Author:** [@kopacko](https://discuss.elastic.co/u/kopacko)\ **Replies:** 5\ **Last updated:** [January 26, 2017, 4:46pm UTC](https://discuss.elastic.co/t/logstash-to-logstash-not-working/72840 "2017-01-26T16:46:51Z")
I have a Logstash server with a tcp output configured: output { tcp { host =\> "x.x.x.x" port =\> 12345 codec =\> json } } On a receiving Logstash box, I have a tcp input configured and I am adding a coup… --- ## [Geoip.ip and private ip file](https://discuss.elastic.co/t/geoip-ip-and-private-ip-file/72301)
**Author:** [@Grenouille06](https://discuss.elastic.co/u/Grenouille06)\ **Replies:** 3\ **Last updated:** [January 26, 2017, 1:47pm UTC](https://discuss.elastic.co/t/geoip-ip-and-private-ip-file/72301 "2017-01-26T13:47:06Z")
Hi, I want to try geoip functionnalities. I import with ELK logs from many active directory controllers. I want to match IP from that logs with a personal file. For example 10.12.x.x =\> research floor 1 or 10.15.x.x -\> … --- ## [Input http plugin lost backlog parameter and defaults to 50](https://discuss.elastic.co/t/input-http-plugin-lost-backlog-parameter-and-defaults-to-50/72900)
**Author:** [@strakh](https://discuss.elastic.co/u/strakh)\ **Replies:** 0\ **Last updated:** [January 26, 2017, 1:08pm UTC](https://discuss.elastic.co/t/input-http-plugin-lost-backlog-parameter-and-defaults-to-50/72900 "2017-01-26T13:08:09Z")
I'm experiencing connection timeout sending bunches of requests to input http plugin (logstash v2.3.4). strace shows that logstash listen call is made with backlog 50 which is default for jvm, while Puma::Server default… --- ## [Another one \_dateparsefailure error](https://discuss.elastic.co/t/another-one--dateparsefailure-error/72895)
**Author:** [@m0nhawk](https://discuss.elastic.co/u/m0nhawk)\ **Replies:** 2\ **Last updated:** [January 26, 2017, 12:24pm UTC](https://discuss.elastic.co/t/another-one--dateparsefailure-error/72895 "2017-01-26T12:24:45Z")
I have the following config: input { file { path =\> "/root/logs/test.log" type =\> "accesslog" start\_position =\> beginning sincedb\_path =\> "/dev/null" ignore\_older =\> 0 } … --- ## [Manipulate data with grok - logstash](https://discuss.elastic.co/t/manipulate-data-with-grok-logstash/72755)
**Author:** [@gutasaputra](https://discuss.elastic.co/u/gutasaputra)\ **Replies:** 9\ **Last updated:** [January 26, 2017, 10:55am UTC](https://discuss.elastic.co/t/manipulate-data-with-grok-logstash/72755 "2017-01-26T10:55:50Z")
hi, i have log data like this. 2017-01-19T18:08:35+07:00 payment INFO {"user\_id":0,"cart\_id":"81746"} so i want using logstash to input data to elasticsearch. but i want to manipulate the data it self before insert… --- ## [How can we make output to elasticsearch host array to load from a file](https://discuss.elastic.co/t/how-can-we-make-output-to-elasticsearch-host-array-to-load-from-a-file/72861)
**Author:** [@macymin](https://discuss.elastic.co/u/macymin)\ **Replies:** 3\ **Last updated:** [January 26, 2017, 10:51am UTC](https://discuss.elastic.co/t/how-can-we-make-output-to-elasticsearch-host-array-to-load-from-a-file/72861 "2017-01-26T10:51:20Z")
Hi, when logstash output to elasticsearch , in our case the hosts can be changed quite frequently. is there any way we can configure the hosts to load from certain files instead of change the server inside logstash conf … --- ## [Parse specific file text](https://discuss.elastic.co/t/parse-specific-file-text/72780)
**Author:** [@Beuhlet\_Reseau](https://discuss.elastic.co/u/Beuhlet_Reseau)\ **Replies:** 2\ **Last updated:** [January 26, 2017, 10:00am UTC](https://discuss.elastic.co/t/parse-specific-file-text/72780 "2017-01-26T10:00:31Z")
Hello, I have some lines in a file text and i want parse it with logstash to create graph. I'm begginers to use logstash. Here few examples of file text, each hour new lines are copied in: 20170123215959;Volume… --- ## [Logstash elasticsearch output configuration:partial update](https://discuss.elastic.co/t/logstash-elasticsearch-output-configuration-partial-update/72862)
**Author:** [@Maher.Glenza](https://discuss.elastic.co/u/Maher.Glenza)\ **Replies:** 0\ **Last updated:** [January 26, 2017, 8:14am UTC](https://discuss.elastic.co/t/logstash-elasticsearch-output-configuration-partial-update/72862 "2017-01-26T08:14:35Z")
hi , plz how can i use the partial update with "doc" in logstash for elasticsearch output? thanks --- ## [Are constants and/or variabales available in Logstash?](https://discuss.elastic.co/t/are-constants-and-or-variabales-available-in-logstash/72833)
**Author:** [@irom77](https://discuss.elastic.co/u/irom77)\ **Replies:** 1\ **Last updated:** [January 26, 2017, 7:10am UTC](https://discuss.elastic.co/t/are-constants-and-or-variabales-available-in-logstash/72833 "2017-01-26T07:10:08Z")
I am reusing same values (see integer 100 example below) in my logstash configuration file. Is there way I can define constant at the beginning of the file i.e. THRESHOLD=60 for later use in the config file if \[SOMETHI… --- ## [Logstash 5.1.2 connection refused](https://discuss.elastic.co/t/logstash-5-1-2-connection-refused/72702)
**Author:** [@bishop2001](https://discuss.elastic.co/u/bishop2001)\ **Replies:** 1\ **Last updated:** [January 26, 2017, 7:07am UTC](https://discuss.elastic.co/t/logstash-5-1-2-connection-refused/72702 "2017-01-26T07:07:03Z")
Greetings im trying to install a gem file that I copied over from another server. I am getting the following error message: Something went wrong when installing logstash-myfilter message: Connection refused - Connection … --- ## [Mapper\_parsing\_exception for to\_char date field](https://discuss.elastic.co/t/mapper-parsing-exception-for-to-char-date-field/72629)
**Author:** [@elasticheart](https://discuss.elastic.co/u/elasticheart)\ **Replies:** 1\ **Last updated:** [January 26, 2017, 6:52am UTC](https://discuss.elastic.co/t/mapper-parsing-exception-for-to-char-date-field/72629 "2017-01-26T06:52:20Z")
Hi, I am fetching data from db and I convert one of the date fields in my db to char like TO\_CHAR(processtime, 'DD-MM-YYYY hh:mm:ss.MIFF1 AM') as process\_time returns date like; 03-01-2017 03:01:50.320 PM When I … --- ## [Getting duplicate records with logstash JDBC plugin](https://discuss.elastic.co/t/getting-duplicate-records-with-logstash-jdbc-plugin/72716)
**Author:** [@praveen.nangunoori](https://discuss.elastic.co/u/praveen.nangunoori)\ **Replies:** 3\ **Last updated:** [January 26, 2017, 6:46am UTC](https://discuss.elastic.co/t/getting-duplicate-records-with-logstash-jdbc-plugin/72716 "2017-01-26T06:46:24Z")
Hi, I'm getting duplicate records when i run query for every one minute. Here is my conf file. input { jdbc { jdbc\_connection\_string =\> "jdbc:oracle:thin:@dbhost:port:SID" # The user we wish to execut… --- ## [Satellite Design](https://discuss.elastic.co/t/satellite-design/72660)
**Author:** [@froto](https://discuss.elastic.co/u/froto)\ **Replies:** 2\ **Last updated:** [January 26, 2017, 6:24am UTC](https://discuss.elastic.co/t/satellite-design/72660 "2017-01-26T06:24:41Z")
Hey there, does anyone know if it is possible to store data in logstash for a specific time before sending them to elasticsearch? We need to store our log data over one day and have to send them at night through a WAN … --- ## [Exec Outputs Queued](https://discuss.elastic.co/t/exec-outputs-queued/72712)
**Author:** [@tcouto](https://discuss.elastic.co/u/tcouto)\ **Replies:** 0\ **Last updated:** [January 24, 2017, 11:51pm UTC](https://discuss.elastic.co/t/exec-outputs-queued/72712 "2017-01-24T23:51:19Z")
We're using an exec output to restart servers if tomcat has more than 40 stuck threads which we define as threads that take longer than 8 seconds. This recorded in a log file which logstash consumes. After tomcat restart… --- ## [Logstash-output-webhdfs combine snappy streaming files](https://discuss.elastic.co/t/logstash-output-webhdfs-combine-snappy-streaming-files/72598)
**Author:** [@ctr](https://discuss.elastic.co/u/ctr)\ **Replies:** 1\ **Last updated:** [January 25, 2017, 8:54pm UTC](https://discuss.elastic.co/t/logstash-output-webhdfs-combine-snappy-streaming-files/72598 "2017-01-25T20:54:22Z")
The logstash-output-webhdfs plugin can produce framed snappy files (with option snappy\_format = stream) to HDFS which, according to the original Snappy documentation, has the advantage "This allows for easy concatenation… --- ## [Using script params - elasticsearch output plugin](https://discuss.elastic.co/t/using-script-params-elasticsearch-output-plugin/71693)
**Author:** [@esamudio](https://discuss.elastic.co/u/esamudio)\ **Replies:** 4\ **Last updated:** [January 25, 2017, 5:18pm UTC](https://discuss.elastic.co/t/using-script-params-elasticsearch-output-plugin/71693 "2017-01-25T17:18:12Z")
Hello, I was trying to use script params in scripted updates in the elasticsearch output plugin of logstash but I was unsure of how to do it. Currently, we two types of scripted updates: … --- ## [Java Key Store and SSL not working for HTTP plugin](https://discuss.elastic.co/t/java-key-store-and-ssl-not-working-for-http-plugin/72665)
**Author:** [@Maria\_Delarosa](https://discuss.elastic.co/u/Maria_Delarosa)\ **Replies:** 0\ **Last updated:** [January 24, 2017, 3:58pm UTC](https://discuss.elastic.co/t/java-key-store-and-ssl-not-working-for-http-plugin/72665 "2017-01-24T15:58:52Z")
This is my first time working with Java Key Store and I am having a bit of difficulty. I have ServerA sending logs to ServerB. I am able to establish an unsecure http communication that traffics the logs. However, when i… --- ## [Data delay in ELK](https://discuss.elastic.co/t/data-delay-in-elk/72472)
**Author:** [@sundar1](https://discuss.elastic.co/u/sundar1)\ **Replies:** 10\ **Last updated:** [January 25, 2017, 3:23pm UTC](https://discuss.elastic.co/t/data-delay-in-elk/72472 "2017-01-25T15:23:25Z")
Hi, Everyday we are getting close to 2 TB data and per sec 70K events from Kafka to ELK. The below are my ELK and hardware setup. 15 logstash servers(36 GM RAM, 6 CPU) 25 data nodes(36 GM RAM, 6 CPU) and each data node h… --- ## [SocketError: send: name or service not known - logstash 2.3.4 version](https://discuss.elastic.co/t/socketerror-send-name-or-service-not-known-logstash-2-3-4-version/72767)
**Author:** [@ravitandur](https://discuss.elastic.co/u/ravitandur)\ **Replies:** 1\ **Last updated:** [January 25, 2017, 2:41pm UTC](https://discuss.elastic.co/t/socketerror-send-name-or-service-not-known-logstash-2-3-4-version/72767 "2017-01-25T14:41:01Z")
Logstash agent configuration: input { heartbeat { type =\> "heartbeat" interval =\> 60 add\_field =\> { "app.name" =\> "esper" } } file { path =\> "/… --- ## [Connection Reset by peer during plugin install](https://discuss.elastic.co/t/connection-reset-by-peer-during-plugin-install/72776)
**Author:** [@graham.dalessandro](https://discuss.elastic.co/u/graham.dalessandro)\ **Replies:** 1\ **Last updated:** [January 25, 2017, 1:04pm UTC](https://discuss.elastic.co/t/connection-reset-by-peer-during-plugin-install/72776 "2017-01-25T13:04:59Z")
Hello, I am currently trying to install a protobuf plugin from the GEM file that i got off of rubygems.org and each time i run the logstash-plugin install --local command i get the following output: \[logadm@stash01ap… --- ## [Parse/split nested single JSON array in Logstash](https://discuss.elastic.co/t/parse-split-nested-single-json-array-in-logstash/72059)
**Author:** [@Thomas\_Schneider](https://discuss.elastic.co/u/Thomas_Schneider)\ **Replies:** 4\ **Last updated:** [January 25, 2017, 12:09pm UTC](https://discuss.elastic.co/t/parse-split-nested-single-json-array-in-logstash/72059 "2017-01-25T12:09:42Z")
Hello @all, i am a completely noob and need help on a JSON-file :slight\_smile: I am looking for a splitting/filter for the following JSON-array. We need each value in the array as an single value in elastice. Can som… --- ## [Can someone give pattern for Tomcat logs](https://discuss.elastic.co/t/can-someone-give-pattern-for-tomcat-logs/1709)
**Author:** [@Raman\_Saini](https://discuss.elastic.co/u/Raman_Saini)\ **Replies:** 16\ **Last updated:** [January 25, 2017, 9:24am UTC](https://discuss.elastic.co/t/can-someone-give-pattern-for-tomcat-logs/1709 "2017-01-25T09:24:03Z")
Hi, I am using logstash to process Tomcat logs and i am using below pattern \[smile\] Java Logs JAVATHREAD (?:\[A-Z\]{2}-Processor\[\\d\]+) JAVACLASS (?:\[a-zA-Z0-9-\]+.)+\[A-Za-z0-9$\]+ JAVAFILE (?:\[A-Za-z0-9\_.-\]+) JAVASTACKTRA… --- ## [Combine 3 logs](https://discuss.elastic.co/t/combine-3-logs/72744)
**Author:** [@Maher.Glenza](https://discuss.elastic.co/u/Maher.Glenza)\ **Replies:** 0\ **Last updated:** [January 25, 2017, 9:22am UTC](https://discuss.elastic.co/t/combine-3-logs/72744 "2017-01-25T09:22:42Z")
hi , i m trying to combine 3 different logs to have a complete information about an item that i m working on to save it in ES then do statistics about it but i m not getting a way . Any help plz ? --- ## [\_grokparsefailure](https://discuss.elastic.co/t/-grokparsefailure/72579)
**Author:** [@Maher.Glenza](https://discuss.elastic.co/u/Maher.Glenza)\ **Replies:** 22\ **Last updated:** [January 25, 2017, 9:04am UTC](https://discuss.elastic.co/t/-grokparsefailure/72579 "2017-01-25T09:04:30Z")
input { file { path =\>"C:\\elk\\router" type =\> "logs" start\_position =\> beginning sincedb\_path =\> "C:\\elkstack\\ELK\\logstash-5.1.2\\data\\plugins\\inputs\\file.sincedb\_5eed3ff4207ce42c69ff2b34b669aa79" } } filt… --- ## [Can we ship logs from one logstash installed on Windows & one logstash installed on Linux to one cloud instance](https://discuss.elastic.co/t/can-we-ship-logs-from-one-logstash-installed-on-windows-one-logstash-installed-on-linux-to-one-cloud-instance/72739)
**Author:** [@Deepali5](https://discuss.elastic.co/u/Deepali5)\ **Replies:** 6\ **Last updated:** [January 25, 2017, 8:32am UTC](https://discuss.elastic.co/t/can-we-ship-logs-from-one-logstash-installed-on-windows-one-logstash-installed-on-linux-to-one-cloud-instance/72739 "2017-01-25T08:32:17Z")
Hi, Can anybody please answer how can I ship logs both from logstash installed on windows and linux to one cloud instance --- ## [\_dateparsefailure While parsing string](https://discuss.elastic.co/t/-dateparsefailure-while-parsing-string/72616)
**Author:** [@tugrulcan](https://discuss.elastic.co/u/tugrulcan)\ **Replies:** 2\ **Last updated:** [January 25, 2017, 8:01am UTC](https://discuss.elastic.co/t/-dateparsefailure-while-parsing-string/72616 "2017-01-25T08:01:37Z")
Hi, Logstash parses logdate field as string. I tried to convert it to datetime (24h format) using date filter, but I get the "\_dateparsefailure" error when I try to parse a log line. Could you please help me to parse d… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1046) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1048)