# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1048 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1049 --- ## [Problem in converting string to ip](https://discuss.elastic.co/t/problem-in-converting-string-to-ip/72562)
**Author:** [@satishsnv](https://discuss.elastic.co/u/satishsnv)\ **Replies:** 8\ **Last updated:** [January 25, 2017, 7:08am UTC](https://discuss.elastic.co/t/problem-in-converting-string-to-ip/72562 "2017-01-25T07:08:07Z")
Hi i tried to convert string to ip by following the steps provided in the threads but its not working for me. I am getting following error on starting kibana. 08:24:50.444 \[\[main\]-pipeline-manager\] INFO logstash.outp… --- ## [Detect logstash output failure](https://discuss.elastic.co/t/detect-logstash-output-failure/72725)
**Author:** [@rubpa](https://discuss.elastic.co/u/rubpa)\ **Replies:** 0\ **Last updated:** [January 25, 2017, 5:09am UTC](https://discuss.elastic.co/t/detect-logstash-output-failure/72725 "2017-01-25T05:09:39Z")
I realised that logstash does not log any error/warning if the output is gelf like below and the server a.b.c.d is down. gelf { host =\> "a.b.c.d" } The code seems to have a warning but I don't get any. Any tips? --- ## [Debian installation error](https://discuss.elastic.co/t/debian-installation-error/72432)
**Author:** [@Jimmy\_Sand](https://discuss.elastic.co/u/Jimmy_Sand)\ **Replies:** 2\ **Last updated:** [January 25, 2017, 4:25am UTC](https://discuss.elastic.co/t/debian-installation-error/72432 "2017-01-25T04:25:16Z")
Hi! I'm trying to install Logstash from online repository. Source added and key added too. Successfully downloaded and unpacked. When setup tries to set up logstash there many errors. I already spend 2 days for diggi… --- ## [Can't replace timestamp , getting \[1\] "\_dateparsefailure"](https://discuss.elastic.co/t/cant-replace-timestamp-getting-1--dateparsefailure/72520)
**Author:** [@irom77](https://discuss.elastic.co/u/irom77)\ **Replies:** 13\ **Last updated:** [January 24, 2017, 8:20pm UTC](https://discuss.elastic.co/t/cant-replace-timestamp-getting-1--dateparsefailure/72520 "2017-01-24T20:20:13Z")
I am getting \[1\] "\_dateparsefailure" when trying to replace timestamp My timestamp is "@timestamp" =\> 2017-01-23T17:58:23.434Z and I want to replace it by "GenerateTime" =\> "2017/23/01 12:58:23" from my input so I … --- ## [Logstash 5.0 Alpha kafka input error](https://discuss.elastic.co/t/logstash-5-0-alpha-kafka-input-error/47182)
**Author:** [@zhanght1](https://discuss.elastic.co/u/zhanght1)\ **Replies:** 5\ **Last updated:** [January 24, 2017, 8:13pm UTC](https://discuss.elastic.co/t/logstash-5-0-alpha-kafka-input-error/47182 "2017-01-24T20:13:18Z")
Here is the logstash.conf. input { kafka { zk\_connect =\> "10.120.31.78:2181" topic\_id =\> "elk" reset\_beginning =\> true } } output{ stdout {} } After run the ./logstash -f logstash.conf ,I got this error… --- ## [Logstash::Event and Ruby code for dynamic tags with Logstash 2.3.4](https://discuss.elastic.co/t/logstash-event-and-ruby-code-for-dynamic-tags-with-logstash-2-3-4/71458)
**Author:** [@LogBabel](https://discuss.elastic.co/u/LogBabel)\ **Replies:** 8\ **Last updated:** [January 24, 2017, 7:21pm UTC](https://discuss.elastic.co/t/logstash-event-and-ruby-code-for-dynamic-tags-with-logstash-2-3-4/71458 "2017-01-24T19:21:02Z")
Hi. I use Logstash 2.3.4 to read events from Kafka broker and have a problem with the filtering. I am trying to flatten the uniq\_log\_name1 object and turn uniq\_log\_name1 into a tag. My problem is not knowing what d… --- ## [Remove characters in grok](https://discuss.elastic.co/t/remove-characters-in-grok/72548)
**Author:** [@bob-bza](https://discuss.elastic.co/u/bob-bza)\ **Replies:** 2\ **Last updated:** [January 24, 2017, 5:06pm UTC](https://discuss.elastic.co/t/remove-characters-in-grok/72548 "2017-01-24T17:06:05Z")
i have string like this \[2017-01-23 21:55:13,840\] DEBUG \[Channel manager on controller 1\]: Controller 1 trying to connect to broker 1 (kafka.controller.ControllerChannelManager) \[2017-01-23 21:55:13,852\] DEBUG \[Channe… --- ## [Update Nested object with logstash](https://discuss.elastic.co/t/update-nested-object-with-logstash/72672)
**Author:** [@Michael\_Oullion](https://discuss.elastic.co/u/Michael_Oullion)\ **Replies:** 0\ **Last updated:** [January 24, 2017, 4:41pm UTC](https://discuss.elastic.co/t/update-nested-object-with-logstash/72672 "2017-01-24T16:41:10Z")
Hello, I spend the whole day reading and trying to update partial object with nested object. First, I define a mapping : "Info": { "type": "nested", "properties": { "InfoName": { … --- ## [Problem with timestamp](https://discuss.elastic.co/t/problem-with-timestamp/72561)
**Author:** [@satishsnv](https://discuss.elastic.co/u/satishsnv)\ **Replies:** 8\ **Last updated:** [January 24, 2017, 2:49pm UTC](https://discuss.elastic.co/t/problem-with-timestamp/72561 "2017-01-24T14:49:25Z")
hi i am using following filter to overwrite the @timestamp, but its not working. may i know the issue. filter{ date{ match =\>\["timeStamp", "EEE yyyy MMM dd HH:mm:ss:SSS"\] remove\_field =\> \["timeStamp"\] } } --- ## [Make a field "less specific"](https://discuss.elastic.co/t/make-a-field-less-specific/72473)
**Author:** [@migou](https://discuss.elastic.co/u/migou)\ **Replies:** 8\ **Last updated:** [January 24, 2017, 1:53pm UTC](https://discuss.elastic.co/t/make-a-field-less-specific/72473 "2017-01-24T13:53:33Z")
Hi, I am new in Logstash, I could perform my first log analysis without any problem but I'm facing a situation I have not find a solution for. So in my logs I have a path that I manage to isolate easily, but here is … --- ## [Auto offset commit failed for group logstash](https://discuss.elastic.co/t/auto-offset-commit-failed-for-group-logstash/72636)
**Author:** [@michaelcheung](https://discuss.elastic.co/u/michaelcheung)\ **Replies:** 0\ **Last updated:** [January 24, 2017, 1:15pm UTC](https://discuss.elastic.co/t/auto-offset-commit-failed-for-group-logstash/72636 "2017-01-24T13:15:59Z")
Hi, I have a set-up with Kafka and ELK. In the logstash side, I frequently receive the following warning message. 23:41:29.767 \[Ruby-0-Thread-7: /usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-kafka-5… --- ## [Not able to see the source ip field in the auth.log on kibana dashboard](https://discuss.elastic.co/t/not-able-to-see-the-source-ip-field-in-the-auth-log-on-kibana-dashboard/72577)
**Author:** [@shubhrant](https://discuss.elastic.co/u/shubhrant)\ **Replies:** 7\ **Last updated:** [January 24, 2017, 12:29pm UTC](https://discuss.elastic.co/t/not-able-to-see-the-source-ip-field-in-the-auth-log-on-kibana-dashboard/72577 "2017-01-24T12:29:18Z")
hello, I just want to add the source ip field in the auth.log separate as my auth.log dashboard are showing these field and the source ip flied is showing in the message I want it like this, showing in the below sc… --- ## [Debugging hanging logstash](https://discuss.elastic.co/t/debugging-hanging-logstash/72627)
**Author:** [@stdweird](https://discuss.elastic.co/u/stdweird)\ **Replies:** 0\ **Last updated:** [January 24, 2017, 12:08pm UTC](https://discuss.elastic.co/t/debugging-hanging-logstash/72627 "2017-01-24T12:08:46Z")
we have a logstash setup with mainly input from syslog, grok filter and output to elasticsearch, and after a while no new message appear in ES and rsyslog starts to queue up events, suggesting that logstash is hanging so… --- ## [Logstash is very slow in sending the data to elasticsearch](https://discuss.elastic.co/t/logstash-is-very-slow-in-sending-the-data-to-elasticsearch/72130)
**Author:** [@anisen](https://discuss.elastic.co/u/anisen)\ **Replies:** 17\ **Last updated:** [January 24, 2017, 11:14am UTC](https://discuss.elastic.co/t/logstash-is-very-slow-in-sending-the-data-to-elasticsearch/72130 "2017-01-24T11:14:56Z")
Hi, I am parsing an IIS log-file which is in below format: 2014-07-12:00:08:54 100.200.50.0 GET /mypath/mypage.asmx - 80 - 100.100.50.0 Mozilla/4.1+(compatible;+MSIE+4.01;+Windows+NT;+MS+Search+8.0+Robot) - 403 0 0 3… --- ## [Splitting a column in a csv](https://discuss.elastic.co/t/splitting-a-column-in-a-csv/72043)
**Author:** [@Pokecallum](https://discuss.elastic.co/u/Pokecallum)\ **Replies:** 7\ **Last updated:** [January 24, 2017, 11:00am UTC](https://discuss.elastic.co/t/splitting-a-column-in-a-csv/72043 "2017-01-24T11:00:11Z")
I have a csv file simular to this Date|ID|Recipient|Subject 1-01-2016|123|test@test.com|A test 2-01-2016|124|test@test.com, test123@test.com|another test Sorry if this gets confusing, I have used | to show where each… --- ## [Logstash 5.1.2 starting with errors](https://discuss.elastic.co/t/logstash-5-1-2-starting-with-errors/72188)
**Author:** [@kodo83](https://discuss.elastic.co/u/kodo83)\ **Replies:** 9\ **Last updated:** [January 24, 2017, 10:49am UTC](https://discuss.elastic.co/t/logstash-5-1-2-starting-with-errors/72188 "2017-01-24T10:49:16Z")
Hi, I'm new in logstash and elasticsearch. i want to index mysql database to elasticsearch using logstash. i downloded the last versions 5.1.2 (of logstash and elasticsearch). elasticsearch start without problems. for lo… --- ## [Error when passing date to data filter](https://discuss.elastic.co/t/error-when-passing-date-to-data-filter/72595)
**Author:** [@elasticheart](https://discuss.elastic.co/u/elasticheart)\ **Replies:** 8\ **Last updated:** [January 24, 2017, 10:12am UTC](https://discuss.elastic.co/t/error-when-passing-date-to-data-filter/72595 "2017-01-24T10:12:06Z")
Hi, I am fetching rows from db using logstash jdbc input plugin. I have time entry processingtime in my db like; 03-01-17 03:32:50.006000000 PM and in Logstash, I am using; date { match =\> \[ "processingtime", "dd… --- ## [How to setup logstash with geoip](https://discuss.elastic.co/t/how-to-setup-logstash-with-geoip/72078)
**Author:** [@mhalatuituia](https://discuss.elastic.co/u/mhalatuituia)\ **Replies:** 13\ **Last updated:** [January 24, 2017, 9:01am UTC](https://discuss.elastic.co/t/how-to-setup-logstash-with-geoip/72078 "2017-01-24T09:01:50Z")
I want to enable this --- ## [Question about shipping instance and indexing instance in scalable deployment of Logstash](https://discuss.elastic.co/t/question-about-shipping-instance-and-indexing-instance-in-scalable-deployment-of-logstash/72552)
**Author:** [@yuanlinios](https://discuss.elastic.co/u/yuanlinios)\ **Replies:** 2\ **Last updated:** [January 24, 2017, 8:59am UTC](https://discuss.elastic.co/t/question-about-shipping-instance-and-indexing-instance-in-scalable-deployment-of-logstash/72552 "2017-01-24T08:59:14Z")
Hello experts According to the "Deploying and Scaling Logstash" guide, I plan to use following structure for my logstash deployment: source -\> HA proxy -\> multiple shipping instances \[input, MQ output\] -\> MQ -\> multi… --- ## [Logstash can't communicate with working Elasticsearch instance](https://discuss.elastic.co/t/logstash-cant-communicate-with-working-elasticsearch-instance/72588)
**Author:** [@mormori0n](https://discuss.elastic.co/u/mormori0n)\ **Replies:** 1\ **Last updated:** [January 24, 2017, 8:58am UTC](https://discuss.elastic.co/t/logstash-cant-communicate-with-working-elasticsearch-instance/72588 "2017-01-24T08:58:35Z")
I trying to start ELK stack on docker for collecting netflow data from Cisco routers and use for it blacktop/elastic, blacktop/kibana. For logstash I modified blacktop's logstash with netflow codec plugin Dockerfile: … --- ## [Tribble Logstash Field Output](https://discuss.elastic.co/t/tribble-logstash-field-output/72591)
**Author:** [@froto](https://discuss.elastic.co/u/froto)\ **Replies:** 2\ **Last updated:** [January 24, 2017, 8:51am UTC](https://discuss.elastic.co/t/tribble-logstash-field-output/72591 "2017-01-24T08:51:16Z")
Hi there, I got a Problem with my current Logstash configuration. I am trying to write a config for the Sophos UTM logs, the fields gets extracted like I want but every time there is the same value 3 times in the specifi… --- ## [Logstash Filter for JSON data](https://discuss.elastic.co/t/logstash-filter-for-json-data/72574)
**Author:** [@gutasaputra](https://discuss.elastic.co/u/gutasaputra)\ **Replies:** 5\ **Last updated:** [January 24, 2017, 8:11am UTC](https://discuss.elastic.co/t/logstash-filter-for-json-data/72574 "2017-01-24T08:11:03Z")
hello, i have the same issue with this post. the difference is he use filebeat to send data to logstash, then the logstash will send data to elasticsearch. i use logstash to load my log file (written in json), then … --- ## [Another Output](https://discuss.elastic.co/t/another-output/72581)
**Author:** [@lukaskolb](https://discuss.elastic.co/u/lukaskolb)\ **Replies:** 1\ **Last updated:** [January 24, 2017, 8:07am UTC](https://discuss.elastic.co/t/another-output/72581 "2017-01-24T08:07:40Z")
Hello! I got my own client to process my datas. So my question is: Is there a Output in Filebeat or Logstash to send my Datas to another IP and Port? similar to the Elasticsearch Output For example: output { user… --- ## [Logstash slack webhook](https://discuss.elastic.co/t/logstash-slack-webhook/72569)
**Author:** [@Suran\_Kularatna](https://discuss.elastic.co/u/Suran_Kularatna)\ **Replies:** 3\ **Last updated:** [January 24, 2017, 8:04am UTC](https://discuss.elastic.co/t/logstash-slack-webhook/72569 "2017-01-24T08:04:04Z")
Hi, I would like to import my slack messages into logstash, we can't use the IRC and so was looking at outgoing webhooks. How do i configure logstash http server What do i put in the logstash config file to be able… --- ## [Inline statement parameter](https://discuss.elastic.co/t/inline-statement-parameter/72509)
**Author:** [@vinodMS](https://discuss.elastic.co/u/vinodMS)\ **Replies:** 1\ **Last updated:** [January 24, 2017, 6:50am UTC](https://discuss.elastic.co/t/inline-statement-parameter/72509 "2017-01-24T06:50:57Z")
Hello, I need to create multiple indices from multiple mysql tables and I'd like to use logstash to perform this task. The issue I have here is that instead of having to create multiple logstash configuration files I'd… --- ## [Logstash Filebeat integration issue with custom logs](https://discuss.elastic.co/t/logstash-filebeat-integration-issue-with-custom-logs/72367)
**Author:** [@Ramakrishna\_K](https://discuss.elastic.co/u/Ramakrishna_K)\ **Replies:** 5\ **Last updated:** [January 24, 2017, 6:46am UTC](https://discuss.elastic.co/t/logstash-filebeat-integration-issue-with-custom-logs/72367 "2017-01-24T06:46:32Z")
Hi, I have a custom log generated by shell script as shown below: 06:48:18 PM CPU %user %nice %system %iowait %steal %idle 06:48:19 PM all 3.05 0.00 0.54 0.46 0.00 … --- ## [Index does not contains field from grok](https://discuss.elastic.co/t/index-does-not-contains-field-from-grok/72126)
**Author:** [@Vakhtang\_Badzhadze](https://discuss.elastic.co/u/Vakhtang_Badzhadze)\ **Replies:** 1\ **Last updated:** [January 24, 2017, 6:35am UTC](https://discuss.elastic.co/t/index-does-not-contains-field-from-grok/72126 "2017-01-24T06:35:47Z")
I just created an index using Elasticsearch and Logstash but the fields I've specified using the Logstash filter (grok) aren't really reflecting in Kibana. Here's my filter - grok { match =\> {"message" =\> "%{TIMESTAMP… --- ## [Logstash grok filter ignoring white space delimiter](https://discuss.elastic.co/t/logstash-grok-filter-ignoring-white-space-delimiter/72568)
**Author:** [@elasticheart](https://discuss.elastic.co/u/elasticheart)\ **Replies:** 2\ **Last updated:** [January 24, 2017, 5:57am UTC](https://discuss.elastic.co/t/logstash-grok-filter-ignoring-white-space-delimiter/72568 "2017-01-24T05:57:50Z")
Hi, I am using Logstash GA 5.0.0 with Kafka. I am ading a custom parameter "logtype":"mylogs" in kafka input. I have a Kafka message like; ##SEVERE 05-Jan-2017 06:02:25.562 com.memberA.studentB.classCa startup CUSTOM… --- ## [Import Cloudwatch Logs Into Elasticsearch ( not AWS Elasticsearch )](https://discuss.elastic.co/t/import-cloudwatch-logs-into-elasticsearch-not-aws-elasticsearch/72219)
**Author:** [@Gude.ravi](https://discuss.elastic.co/u/Gude.ravi)\ **Replies:** 1\ **Last updated:** [January 24, 2017, 3:27am UTC](https://discuss.elastic.co/t/import-cloudwatch-logs-into-elasticsearch-not-aws-elasticsearch/72219 "2017-01-24T03:27:29Z")
Hello, My use case is to import Cloudwatch logs from AWS on to Elasticsearch Cluster. I do not have AWS provided Elasticsearch as Service. The following only seem to work for cloudwatch metrics. Do we have any ot… --- ## [How can you detect the Query steam has ended? Can plugin provide "EOF" as tag to signal End of SQL data?](https://discuss.elastic.co/t/how-can-you-detect-the-query-steam-has-ended-can-plugin-provide-eof-as-tag-to-signal-end-of-sql-data/72558)
**Author:** [@iti](https://discuss.elastic.co/u/iti)\ **Replies:** 0\ **Last updated:** [January 24, 2017, 3:11am UTC](https://discuss.elastic.co/t/how-can-you-detect-the-query-steam-has-ended-can-plugin-provide-eof-as-tag-to-signal-end-of-sql-data/72558 "2017-01-24T03:11:28Z")
I have raised the same question at github, but looks like there is no interest. The problem is about input plugin create the EVENT steam, but did not provide a way for the later filter or output to determine the wor… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1047) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1049)