# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1052 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1053 --- ## [How to variables in log stash http output](https://discuss.elastic.co/t/how-to-variables-in-log-stash-http-output/71706)
**Author:** [@dineshangari](https://discuss.elastic.co/u/dineshangari)\ **Replies:** 7\ **Last updated:** [January 17, 2017, 3:57am UTC](https://discuss.elastic.co/t/how-to-variables-in-log-stash-http-output/71706 "2017-01-17T03:57:55Z")
I have configuration file where input as csv and output as http. I want to pass this csv columns as variable to http output. Please suggest me way how to do that. Thanks in Advance.... --- ## [Geoip filter fails with illegal\_state\_exception message on "type" field](https://discuss.elastic.co/t/geoip-filter-fails-with-illegal-state-exception-message-on-type-field/71802)
**Author:** [@hp-adl](https://discuss.elastic.co/u/hp-adl)\ **Replies:** 0\ **Last updated:** [January 17, 2017, 1:23am UTC](https://discuss.elastic.co/t/geoip-filter-fails-with-illegal-state-exception-message-on-type-field/71802 "2017-01-17T01:23:00Z")
Hi all, Just wondering if someone can help with this unusual problem. I'm parsing IIS logs and doing a geoip lookup on the clientIP field and I get the error message below. I have used this on my Apache logs and it wo… --- ## [SNMP Trap listener died on Windows 2008 R2](https://discuss.elastic.co/t/snmp-trap-listener-died-on-windows-2008-r2/71799)
**Author:** [@Hanky\_Cheng](https://discuss.elastic.co/u/Hanky_Cheng)\ **Replies:** 0\ **Last updated:** [January 17, 2017, 12:24am UTC](https://discuss.elastic.co/t/snmp-trap-listener-died-on-windows-2008-r2/71799 "2017-01-17T00:24:59Z")
Hi All I have create logstash 2.4 on Windows 2008 R2 for receive SNMP Trap. I also installed logstash-snmptrap plugin but show error when program run. Anyone can help on this case, Tks All guys Settings: Default pipe… --- ## [Pattern to match optional lines in multiline messages](https://discuss.elastic.co/t/pattern-to-match-optional-lines-in-multiline-messages/71772)
**Author:** [@eik3](https://discuss.elastic.co/u/eik3)\ **Replies:** 1\ **Last updated:** [January 16, 2017, 6:32pm UTC](https://discuss.elastic.co/t/pattern-to-match-optional-lines-in-multiline-messages/71772 "2017-01-16T18:32:14Z")
Here's the pattern a:%{NOTSPACE:a} (b:%{NOTSPACE:b})? c:%{NOTSPACE:c} This matches a:1 c:42 and a:1 b:23 c:42 But not a:1 c:42 How can I make the pattern match the message even it the line b is compl… --- ## [Send every 10th sample to another index](https://discuss.elastic.co/t/send-every-10th-sample-to-another-index/71762)
**Author:** [@Marcus\_Monnig](https://discuss.elastic.co/u/Marcus_Monnig)\ **Replies:** 0\ **Last updated:** [January 16, 2017, 4:11pm UTC](https://discuss.elastic.co/t/send-every-10th-sample-to-another-index/71762 "2017-01-16T16:11:33Z")
Hi! I have a setup like this: input { jdbc { jdbc\_validate\_connection =\> false jdbc\_connection\_string =\> "jdbc:oracle:thin:@HOST:1521/SID" jdbc\_user =\> "..." jdbc\_password =\> "..."… --- ## [\[SOLVED\] Grok and Greedydata regex](https://discuss.elastic.co/t/solved-grok-and-greedydata-regex/71552)
**Author:** [@axelfelix](https://discuss.elastic.co/u/axelfelix)\ **Replies:** 8\ **Last updated:** [January 16, 2017, 4:17pm UTC](https://discuss.elastic.co/t/solved-grok-and-greedydata-regex/71552 "2017-01-16T16:17:59Z")
Hi all, I have an issue with my grok patterns. Some lines in my grok patterns contains GREEDYDATA regex. So they match before other lines and I cannot match logs with the fields that I want. Could you tell me please … --- ## [Logstash remote file input](https://discuss.elastic.co/t/logstash-remote-file-input/58152)
**Author:** [@Nizar\_Khalifa](https://discuss.elastic.co/u/Nizar_Khalifa)\ **Replies:** 2\ **Last updated:** [January 16, 2017, 3:38pm UTC](https://discuss.elastic.co/t/logstash-remote-file-input/58152 "2017-01-16T15:38:51Z")
Hello, I have a log file in a Machine1 (/home/log/logfile.log) and a logstash in Machine2. How can I do to read remote logfile ? I tried with : input { file { path =\> "IP address/home/log/logfile.log" start\_posit… --- ## [Logstash-plugin list display Gem errors](https://discuss.elastic.co/t/logstash-plugin-list-display-gem-errors/71755)
**Author:** [@smutel](https://discuss.elastic.co/u/smutel)\ **Replies:** 0\ **Last updated:** [January 16, 2017, 3:05pm UTC](https://discuss.elastic.co/t/logstash-plugin-list-display-gem-errors/71755 "2017-01-16T15:05:24Z")
Hello, When I execute the command "/usr/share/logstash/bin/logstash-plugin list", I have the error below: Gem::LoadError: You have already activated json 1.8.6, but your Gemfile requires json 1.8.3. Prepending bundle … --- ## [Grok parsing issue](https://discuss.elastic.co/t/grok-parsing-issue/71750)
**Author:** [@Jiri\_Kolb](https://discuss.elastic.co/u/Jiri_Kolb)\ **Replies:** 1\ **Last updated:** [January 16, 2017, 2:52pm UTC](https://discuss.elastic.co/t/grok-parsing-issue/71750 "2017-01-16T14:52:45Z")
Hello, I am logstash newbie. Would be nice if anyone can help I tried it many times, still no luck. I used grok debuger http://grokconstructor.appspot.com/ and log is matched without issues. With following settings I am … --- ## [Multiple input for Logstash from filebeat](https://discuss.elastic.co/t/multiple-input-for-logstash-from-filebeat/54835)
**Author:** [@Kevin\_Csuka](https://discuss.elastic.co/u/Kevin_Csuka)\ **Replies:** 10\ **Last updated:** [January 16, 2017, 2:39pm UTC](https://discuss.elastic.co/t/multiple-input-for-logstash-from-filebeat/54835 "2017-01-16T14:39:05Z")
Hi, I'm sending CSV files from two servers 2012's with FIlebeat. Sending it to Logstash with Elasticsearch as output. This is my setup: click me Test1.csv contains this info: "(PDH-CSV 4.0) (W. Europe Daylight Ti… --- ## [Oracle 11g Synchronization with logstash](https://discuss.elastic.co/t/oracle-11g-synchronization-with-logstash/71639)
**Author:** [@Abdullah\_Alaiwat](https://discuss.elastic.co/u/Abdullah_Alaiwat)\ **Replies:** 19\ **Last updated:** [January 16, 2017, 1:09pm UTC](https://discuss.elastic.co/t/oracle-11g-synchronization-with-logstash/71639 "2017-01-16T13:09:09Z")
Hello, I'm using the logstash 5.1.1 to get the data from Oracle DB 11g to elastic search, the connection and data fetching is working fine but the problem is with the synchronization between the DB and Elasticsearch, e… --- ## [Remove xml-tags during parsing](https://discuss.elastic.co/t/remove-xml-tags-during-parsing/71713)
**Author:** [@Denny](https://discuss.elastic.co/u/Denny)\ **Replies:** 3\ **Last updated:** [January 16, 2017, 1:00pm UTC](https://discuss.elastic.co/t/remove-xml-tags-during-parsing/71713 "2017-01-16T13:00:24Z")
Hello, So far I've only experience with indexing csv-files with Logstash into Elasticsearch. Now I have a couple of xml-files which I want to index and fortunately it was not that difficult. With the most basic conf I'… --- ## [Logstash : How to compute endDate from startDate + duration](https://discuss.elastic.co/t/logstash-how-to-compute-enddate-from-startdate-duration/71082)
**Author:** [@cnico](https://discuss.elastic.co/u/cnico)\ **Replies:** 2\ **Last updated:** [January 16, 2017, 12:36pm UTC](https://discuss.elastic.co/t/logstash-how-to-compute-enddate-from-startdate-duration/71082 "2017-01-16T12:36:22Z")
Hello, I have an event in which its data is composed of a start dateTime and of duration in seconds. I would like to compute via logstash, the end dateTime with the problem of day change if duration high. Is possible… --- ## [Fields are not added](https://discuss.elastic.co/t/fields-are-not-added/71523)
**Author:** [@danivu](https://discuss.elastic.co/u/danivu)\ **Replies:** 3\ **Last updated:** [January 16, 2017, 11:27am UTC](https://discuss.elastic.co/t/fields-are-not-added/71523 "2017-01-16T11:27:36Z")
Hi, I have problem with adding filed in logstash part of the source code: grok { patterns\_dir =\> "../patterns" match =\> \[ "message", "%{TIMESTAMP\_ISO8601:logtime}\\ \[%{NUMBER:ThreadNum}\]\\ %{LOGLEVEL:LogLevel}\\ %{GRE… --- ## [Need help flatten json object in logstash filter](https://discuss.elastic.co/t/need-help-flatten-json-object-in-logstash-filter/71720)
**Author:** [@MarcelHallmann](https://discuss.elastic.co/u/MarcelHallmann)\ **Replies:** 0\ **Last updated:** [January 16, 2017, 11:20am UTC](https://discuss.elastic.co/t/need-help-flatten-json-object-in-logstash-filter/71720 "2017-01-16T11:20:13Z")
Hi, my data structure is as follows: { "name": "my-validation", "timestamp": "\", "details": { "2017-01-21": "My Validation result 1: OK", "2017-02-01": "My Validation result 2: OK", "20… --- ## [RabbitMQ output + Compress spooler: "wrong number of arguments"](https://discuss.elastic.co/t/rabbitmq-output-compress-spooler-wrong-number-of-arguments/34631)
**Author:** [@ceekay](https://discuss.elastic.co/u/ceekay)\ **Replies:** 7\ **Last updated:** [January 16, 2017, 10:52am UTC](https://discuss.elastic.co/t/rabbitmq-output-compress-spooler-wrong-number-of-arguments/34631 "2017-01-16T10:52:58Z")
I'm trying to use the compress spooler codec on a previously-working RMQ output, but encoding is failing with Error encoding event {:exception=\>#\ ... . I've stripped m… --- ## [\_csvparse failure multiline](https://discuss.elastic.co/t/-csvparse-failure-multiline/71700)
**Author:** [@Hassan\_Nashrah](https://discuss.elastic.co/u/Hassan_Nashrah)\ **Replies:** 0\ **Last updated:** [January 16, 2017, 9:00am UTC](https://discuss.elastic.co/t/-csvparse-failure-multiline/71700 "2017-01-16T09:00:13Z")
input { file { path =\> "/opt/logstash-5.1.1/bin/01.12.2016.csv" start\_position =\> "beginning" sincedb\_path =\> "/dev/null" } } filter { csv { separator =\> "," columns =\> \["departureDate","commen… --- ## [How to run multiple logstash instances on the same machine?](https://discuss.elastic.co/t/how-to-run-multiple-logstash-instances-on-the-same-machine/51460)
**Author:** [@esamudio](https://discuss.elastic.co/u/esamudio)\ **Replies:** 8\ **Last updated:** [January 16, 2017, 8:02am UTC](https://discuss.elastic.co/t/how-to-run-multiple-logstash-instances-on-the-same-machine/51460 "2017-01-16T08:02:03Z")
I want to run multiple logstash configurations on the same machine using different config files. As far as I know, if I put multiple config files in the /etc/logstash/conf.d/ directory, it will simply append the .conf fi… --- ## [Faild to install the plugin "logstash-output-influxdb" with logstash 5.1.1](https://discuss.elastic.co/t/faild-to-install-the-plugin-logstash-output-influxdb-with-logstash-5-1-1/71685)
**Author:** [@aybaylyn](https://discuss.elastic.co/u/aybaylyn)\ **Replies:** 0\ **Last updated:** [January 16, 2017, 7:14am UTC](https://discuss.elastic.co/t/faild-to-install-the-plugin-logstash-output-influxdb-with-logstash-5-1-1/71685 "2017-01-16T07:14:17Z")
Hello , I am writing this message to ask for help. The problem is that when I install logstash-ouput-influxdb with the command bin/logstash-plugin insall logstash-output-influxdb , It just has no result , the iT… --- ## [Use more than one table with different indexes in logstash](https://discuss.elastic.co/t/use-more-than-one-table-with-different-indexes-in-logstash/71676)
**Author:** [@Abdullah\_Alaiwat](https://discuss.elastic.co/u/Abdullah_Alaiwat)\ **Replies:** 2\ **Last updated:** [January 16, 2017, 6:38am UTC](https://discuss.elastic.co/t/use-more-than-one-table-with-different-indexes-in-logstash/71676 "2017-01-16T06:38:28Z")
Is there any way to use two tables in logstash but with two different indexes? or i have to create two config files with two services? --- ## [Logstash problems after upgrade](https://discuss.elastic.co/t/logstash-problems-after-upgrade/71339)
**Author:** [@Grenouille06](https://discuss.elastic.co/u/Grenouille06)\ **Replies:** 1\ **Last updated:** [January 16, 2017, 5:27am UTC](https://discuss.elastic.co/t/logstash-problems-after-upgrade/71339 "2017-01-16T05:27:26Z")
HI friends. I use an ELK stack for weeks a a test. All the stack is in version 5.1.1, excepting Logstash in v4. Kafka is in version 0.10.0.1 After the upgrade, my old conf file isn't working. Old conf : input { … --- ## [Mutate field is not executing?](https://discuss.elastic.co/t/mutate-field-is-not-executing/71610)
**Author:** [@Yaswanth](https://discuss.elastic.co/u/Yaswanth)\ **Replies:** 3\ **Last updated:** [January 16, 2017, 3:33am UTC](https://discuss.elastic.co/t/mutate-field-is-not-executing/71610 "2017-01-16T03:33:50Z")
Hi, I have a config file which is used to get the slowlogs .And in that i want only the queries content in the source\_body . Can anyone help me how to acheive this? input { file { path =\> "F:\\elasticsearch-2… --- ## [Unable to find Input, filter and grok pattern for logs starting with a session id](https://discuss.elastic.co/t/unable-to-find-input-filter-and-grok-pattern-for-logs-starting-with-a-session-id/71653)
**Author:** [@Anujyadav86](https://discuss.elastic.co/u/Anujyadav86)\ **Replies:** 1\ **Last updated:** [January 16, 2017, 2:57am UTC](https://discuss.elastic.co/t/unable-to-find-input-filter-and-grok-pattern-for-logs-starting-with-a-session-id/71653 "2017-01-16T02:57:00Z")
Hi Guys, after several attempt i was trying to create a grok pattern for below kind of logs, where logs start with a session id, identifying different users. Need help to create a grok pattern. Its a multi-line log, havi… --- ## [Logstash Error Message](https://discuss.elastic.co/t/logstash-error-message/71597)
**Author:** [@mhalatuituia](https://discuss.elastic.co/u/mhalatuituia)\ **Replies:** 3\ **Last updated:** [January 16, 2017, 1:47am UTC](https://discuss.elastic.co/t/logstash-error-message/71597 "2017-01-16T01:47:49Z")
ERR Failed to publish events caused by: read tcp \>ELK\_SERVER\_IP:5044: read: connection reset by peer Anyone with help really appreciate. --- ## [BIND DNS Pattern](https://discuss.elastic.co/t/bind-dns-pattern/35951)
**Author:** [@omuhans123](https://discuss.elastic.co/u/omuhans123)\ **Replies:** 8\ **Last updated:** [January 16, 2017, 1:45am UTC](https://discuss.elastic.co/t/bind-dns-pattern/35951 "2017-01-16T01:45:38Z")
Hi All, I am very new to logstash and hope I could get some help regarding splitting a log file from BIND DNS server to be pushed to Elastic Search. The log files have the following format: 04-Nov-2015 08:28:39.261 q… --- ## [Connecting Logstash to Microsoft Access DB?](https://discuss.elastic.co/t/connecting-logstash-to-microsoft-access-db/69477)
**Author:** [@chrisrumz](https://discuss.elastic.co/u/chrisrumz)\ **Replies:** 2\ **Last updated:** [January 15, 2017, 5:24pm UTC](https://discuss.elastic.co/t/connecting-logstash-to-microsoft-access-db/69477 "2017-01-15T17:24:29Z")
Is connecting Logstash to a Microsoft Access database possible? I've tried many ways, including adding the Java 7 JDBC-ODBC bridge to my Java 8 install as mentioned in this article: or open-source solutions like "UC… --- ## [Logstash CSV parse Failure](https://discuss.elastic.co/t/logstash-csv-parse-failure/69963)
**Author:** [@Prashant\_Agrawal](https://discuss.elastic.co/u/Prashant_Agrawal)\ **Replies:** 1\ **Last updated:** [January 15, 2017, 4:26pm UTC](https://discuss.elastic.co/t/logstash-csv-parse-failure/69963 "2017-01-15T16:26:53Z")
Hi All, I have a log file which I need to parse using logstash but somehow I am stuck parsing the same. The use case is I have a log file which has entries separated with ||| and message also has " in it. So while pars… --- ## [Logstash 5 Alpha4 to elasticsearch5 Alpha4 communication error](https://discuss.elastic.co/t/logstash-5-alpha4-to-elasticsearch5-alpha4-communication-error/56080)
**Author:** [@gaurav\_S\_javheri](https://discuss.elastic.co/u/gaurav_S_javheri)\ **Replies:** 4\ **Last updated:** [January 15, 2017, 11:08am UTC](https://discuss.elastic.co/t/logstash-5-alpha4-to-elasticsearch5-alpha4-communication-error/56080 "2017-01-15T11:08:48Z")
elasticsearch 5 is secured with xpack security and hooked with ldap which is working fine. Even user has admin right in role\_mapping. Below is configuration output { elasticsearch { hosts =\> \['localhost:9200'\] user =\> … --- ## [Remove HTML tag from rss input logstash plugin](https://discuss.elastic.co/t/remove-html-tag-from-rss-input-logstash-plugin/71072)
**Author:** [@jamal](https://discuss.elastic.co/u/jamal)\ **Replies:** 3\ **Last updated:** [January 15, 2017, 10:23am UTC](https://discuss.elastic.co/t/remove-html-tag-from-rss-input-logstash-plugin/71072 "2017-01-15T10:23:19Z")
I am using logstash rss input plugin to index rss feeds in elasticsearch, but I get text and html tag whic i just want to get text not html tag. any one can say me which filter plugin should I use and how to filter it … --- ## [Elasticsearch input has\_child inner\_hits](https://discuss.elastic.co/t/elasticsearch-input-has-child-inner-hits/71605)
**Author:** [@Yoram\_Kornatzky](https://discuss.elastic.co/u/Yoram_Kornatzky)\ **Replies:** 0\ **Last updated:** [January 14, 2017, 12:09pm UTC](https://discuss.elastic.co/t/elasticsearch-input-has-child-inner-hits/71605 "2017-01-14T12:09:42Z")
Using a query with has\_child, the Elastic Search input plugin, does not produce inner\_hits. The same query in Elastic Search 1.5 works fine. The query looks like: { "query": { … [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1051) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1053)