# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1054 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1055 --- ## [Missing authentication token when combining metricbeat and logstash](https://discuss.elastic.co/t/missing-authentication-token-when-combining-metricbeat-and-logstash/70941)
**Author:** [@gutasaputra](https://discuss.elastic.co/u/gutasaputra)\ **Replies:** 1\ **Last updated:** [January 12, 2017, 6:04pm UTC](https://discuss.elastic.co/t/missing-authentication-token-when-combining-metricbeat-and-logstash/70941 "2017-01-12T18:04:13Z")
helo, i have an issue with metricbeat. before i install xpack, metricbeat running very well. but suddenly after i install xpack, i cant access it from my kibana. i run this command in my terminal : curl -XGET 'http:… --- ## [Logstash s3 output doesn't clean up temporary files](https://discuss.elastic.co/t/logstash-s3-output-doesnt-clean-up-temporary-files/71416)
**Author:** [@Janos\_Csorvasi](https://discuss.elastic.co/u/Janos_Csorvasi)\ **Replies:** 0\ **Last updated:** [January 12, 2017, 5:43pm UTC](https://discuss.elastic.co/t/logstash-s3-output-doesnt-clean-up-temporary-files/71416 "2017-01-12T17:43:40Z")
logstash version: docker 5.1.1 s3 output plugin version: 4.0.3 plugin config: output { s3 { bucket =\> "some\_bucket" access\_key\_id =\> "some\_key" secret\_access\_key =\> "some\_secret" region =\> "eu-west-1"… --- ## [Influxdb output plugin - logstash](https://discuss.elastic.co/t/influxdb-output-plugin-logstash/71415)
**Author:** [@letshelp](https://discuss.elastic.co/u/letshelp)\ **Replies:** 0\ **Last updated:** [January 12, 2017, 5:42pm UTC](https://discuss.elastic.co/t/influxdb-output-plugin-logstash/71415 "2017-01-12T17:42:31Z")
Current plugin let us store data points which is great. But we have two separate JSON one for tags and other with fields after filter process. tag json: { "app": "a1", "host": "h1", "backend": "b1" } field … --- ## [Throttle by tag](https://discuss.elastic.co/t/throttle-by-tag/71412)
**Author:** [@marcmga](https://discuss.elastic.co/u/marcmga)\ **Replies:** 0\ **Last updated:** [January 12, 2017, 5:05pm UTC](https://discuss.elastic.co/t/throttle-by-tag/71412 "2017-01-12T17:05:11Z")
Hi, Is it possible to throttle by tag? Im doing something like key =\> %{host}%{tag} Is it possible? i checked it with 2 fields and it works. Thanks --- ## [Multilne codec merging UDP log entries](https://discuss.elastic.co/t/multilne-codec-merging-udp-log-entries/71395)
**Author:** [@Nezzerscape](https://discuss.elastic.co/u/Nezzerscape)\ **Replies:** 1\ **Last updated:** [January 12, 2017, 5:00pm UTC](https://discuss.elastic.co/t/multilne-codec-merging-udp-log-entries/71395 "2017-01-12T17:00:55Z")
I am using the multiline codec in Logstash 5.0. For the most part it works, merging entries that consist of several lines. So far all true multiline entries are merged correctly. The issue is that some random entries … --- ## [No logstash output to kibana/elasticsearch](https://discuss.elastic.co/t/no-logstash-output-to-kibana-elasticsearch/70679)
**Author:** [@pgrzec2s](https://discuss.elastic.co/u/pgrzec2s)\ **Replies:** 8\ **Last updated:** [January 12, 2017, 1:49pm UTC](https://discuss.elastic.co/t/no-logstash-output-to-kibana-elasticsearch/70679 "2017-01-12T13:49:46Z")
Good day to you! I am pretty new to ELK stack and i am working on a issue since 3 days. I got an apache-access.log but i can't send the logfile through kibana. Using Kibana 5.1.1, elasticsearch 5.1.1, logstash 5.1.1 … --- ## [Logstash log4j input plugin not working](https://discuss.elastic.co/t/logstash-log4j-input-plugin-not-working/71376)
**Author:** [@domisan](https://discuss.elastic.co/u/domisan)\ **Replies:** 0\ **Last updated:** [January 12, 2017, 1:11pm UTC](https://discuss.elastic.co/t/logstash-log4j-input-plugin-not-working/71376 "2017-01-12T13:11:44Z")
Hi, I just migrated from 2.4.x to 5.1.1 (Elasticsearch, Kibana and Logstash). I finally got everything up and running again except for a Logstash process which has a LOG4J input plugin. Note that : - my ELK processe… --- ## [Logstash giving problem](https://discuss.elastic.co/t/logstash-giving-problem/71034)
**Author:** [@Nikparab](https://discuss.elastic.co/u/Nikparab)\ **Replies:** 13\ **Last updated:** [January 12, 2017, 1:04pm UTC](https://discuss.elastic.co/t/logstash-giving-problem/71034 "2017-01-12T13:04:16Z")
Hii ,i m new in elasticsearch. my logstash is giving some problem while installing.how i can recover that? pls help me --- ## [Binary conversion error using Logstash to ElasticSearch](https://discuss.elastic.co/t/binary-conversion-error-using-logstash-to-elasticsearch/71368)
**Author:** [@markeaustin](https://discuss.elastic.co/u/markeaustin)\ **Replies:** 1\ **Last updated:** [January 12, 2017, 12:16pm UTC](https://discuss.elastic.co/t/binary-conversion-error-using-logstash-to-elasticsearch/71368 "2017-01-12T12:16:51Z")
I am trying to use jdbc-sql to write data from a SQL Server database into ElasticSearch. One of the columns in each of the two tables is a VARBINARY(MAX). These are failing conversion with an error; \[2017-01-12T11:51:3… --- ## [How to increase byte size in processing in logstash?](https://discuss.elastic.co/t/how-to-increase-byte-size-in-processing-in-logstash/71327)
**Author:** [@Shweta](https://discuss.elastic.co/u/Shweta)\ **Replies:** 4\ **Last updated:** [January 12, 2017, 12:00pm UTC](https://discuss.elastic.co/t/how-to-increase-byte-size-in-processing-in-logstash/71327 "2017-01-12T12:00:57Z")
Hi, While filtering logs in logstash we came across an error which states reason as: "reason"=\>"max\_bytes\_length\_exceeded\_exception: bytes can be at most 32766 in length; got 56665"}}}} We cannot tokenize our mess… --- ## [My logstash remains in started state without any output?](https://discuss.elastic.co/t/my-logstash-remains-in-started-state-without-any-output/71351)
**Author:** [@Yaswanth](https://discuss.elastic.co/u/Yaswanth)\ **Replies:** 3\ **Last updated:** [January 12, 2017, 12:00pm UTC](https://discuss.elastic.co/t/my-logstash-remains-in-started-state-without-any-output/71351 "2017-01-12T12:00:44Z")
HI ES 2.4.0 Logstash 5.5.1 I want to send the documents from local machine to elasticsearch using logstash? My config file is input { file { path =\> "C:\\Users\\571952\\Desktop\\logstash-5.1.1\\logstash" start\_… --- ## [Double entry in sincedb](https://discuss.elastic.co/t/double-entry-in-sincedb/71364)
**Author:** [@Alessandro\_Colombo](https://discuss.elastic.co/u/Alessandro_Colombo)\ **Replies:** 0\ **Last updated:** [January 12, 2017, 12:00pm UTC](https://discuss.elastic.co/t/double-entry-in-sincedb/71364 "2017-01-12T12:00:39Z")
Hello everyone, i've found that in my sincedb the inode entries are doubled. this is the filter configuration: input { file { path =\> "/NAS/log/radius/rd0\*XXX/radiator.log" type =\> "radius" codec =\> multiline { … --- ## [Json filter and .sincedb](https://discuss.elastic.co/t/json-filter-and-sincedb/71267)
**Author:** [@Kryten](https://discuss.elastic.co/u/Kryten)\ **Replies:** 1\ **Last updated:** [January 12, 2017, 11:22am UTC](https://discuss.elastic.co/t/json-filter-and-sincedb/71267 "2017-01-12T11:22:28Z")
I am seeing an issue in LS various versions including 2.2 / 2.3.4 and 2.4.1 where if I use the json filter the .sincedb is either not generated or is not observed. This makes getting LS to start processing my file from… --- ## [Geoip field is not showing in dashboard](https://discuss.elastic.co/t/geoip-field-is-not-showing-in-dashboard/71205)
**Author:** [@shubhrant](https://discuss.elastic.co/u/shubhrant)\ **Replies:** 12\ **Last updated:** [January 12, 2017, 11:08am UTC](https://discuss.elastic.co/t/geoip-field-is-not-showing-in-dashboard/71205 "2017-01-12T11:08:37Z")
I'm trying to locate the geo location on apache server but the geoip field is not showing this is logstash configuration file input { beats { port =\> 5044 } } filter { if \[type\] == "apache" { grok { match =\> { … --- ## [How can i able to see my documents content using logstash?](https://discuss.elastic.co/t/how-can-i-able-to-see-my-documents-content-using-logstash/71206)
**Author:** [@Yaswanth](https://discuss.elastic.co/u/Yaswanth)\ **Replies:** 2\ **Last updated:** [January 11, 2017, 1:39pm UTC](https://discuss.elastic.co/t/how-can-i-able-to-see-my-documents-content-using-logstash/71206 "2017-01-11T13:39:43Z")
Hi, ES 2.4.0 Logstash 5.1.1 I want to get the contents of documents from localhost index and i used the following code : input { elasticsearch { hosts =\> "http://localhost:9200/" index =\> "mediacontent-jan-20… --- ## [Index created with wrong name](https://discuss.elastic.co/t/index-created-with-wrong-name/71326)
**Author:** [@John\_Woo\_Lee](https://discuss.elastic.co/u/John_Woo_Lee)\ **Replies:** 2\ **Last updated:** [January 12, 2017, 8:04am UTC](https://discuss.elastic.co/t/index-created-with-wrong-name/71326 "2017-01-12T08:04:48Z")
Hi, I have a server with below setup #cat /etc/redhat-release CentOS Linux release 7.3.1611 (Core) #timedatectl Local time: Thu 2017-01-12 07:21:08 GMT Universal time: Thu 2017-01-12 07:21:08 UTC RT… --- ## [Logstash for multiline](https://discuss.elastic.co/t/logstash-for-multiline/71322)
**Author:** [@gringo](https://discuss.elastic.co/u/gringo)\ **Replies:** 0\ **Last updated:** [January 12, 2017, 7:00am UTC](https://discuss.elastic.co/t/logstash-for-multiline/71322 "2017-01-12T07:00:04Z")
How should I configure my logstash if I have a log of the following Beginning of Log File field1: 123 field2: 321 field3: 1133 field4: 0901 field1: 523 field2: 521 field3: 533 field4: 509 End of Log File What sho… --- ## [Permission denied in logstash?](https://discuss.elastic.co/t/permission-denied-in-logstash/71320)
**Author:** [@Yaswanth](https://discuss.elastic.co/u/Yaswanth)\ **Replies:** 2\ **Last updated:** [January 12, 2017, 6:43am UTC](https://discuss.elastic.co/t/permission-denied-in-logstash/71320 "2017-01-12T06:43:57Z")
HI, ES 2.4.0 Logstash 5.1.1 when i executed the following code : input { elasticsearch { hosts =\> "http://localhost:9200/" index =\> "mediacontent-jan-2017" } } output { file { path =\> "C:\\Users\\571952\\Desktop\\logst… --- ## [Getting http\_request\_failure error](https://discuss.elastic.co/t/getting-http-request-failure-error/71057)
**Author:** [@priti](https://discuss.elastic.co/u/priti)\ **Replies:** 1\ **Last updated:** [January 12, 2017, 5:53am UTC](https://discuss.elastic.co/t/getting-http-request-failure-error/71057 "2017-01-12T05:53:56Z")
I am trying to get status of the url but i am getting { "@version" =\> "1", "@timestamp" =\> "2017-01-10T10:19:47.157Z", "http\_poller\_metadata" =\> { "name" =\> "Server1"… --- ## [Timestamps reset to current day](https://discuss.elastic.co/t/timestamps-reset-to-current-day/71066)
**Author:** [@poysama](https://discuss.elastic.co/u/poysama)\ **Replies:** 1\ **Last updated:** [January 12, 2017, 5:51am UTC](https://discuss.elastic.co/t/timestamps-reset-to-current-day/71066 "2017-01-12T05:51:34Z")
Disclaimer: ELK beginner Hi. So I just upgraded my Logstash (2.x) to 5.1.1. Prior to this, I had VPN logs. When I started logstash, my previous VPN logs had their timestamps changed. All entries now have the current… --- ## [Logstash 5.1 - Multiline codec with file input](https://discuss.elastic.co/t/logstash-5-1-multiline-codec-with-file-input/70635)
**Author:** [@spravn789](https://discuss.elastic.co/u/spravn789)\ **Replies:** 2\ **Last updated:** [January 12, 2017, 4:28am UTC](https://discuss.elastic.co/t/logstash-5-1-multiline-codec-with-file-input/70635 "2017-01-12T04:28:28Z")
Hi All, I am using Logstash 5.1 , where facing issues with multiline, Since multiline filter is depricated, trying to use multiline codec along with file input. In the response all the line are getting combined and fa… --- ## [How to do performance testing using logstash-performance-testing](https://discuss.elastic.co/t/how-to-do-performance-testing-using-logstash-performance-testing/71305)
**Author:** [@Sunil\_Jois](https://discuss.elastic.co/u/Sunil_Jois)\ **Replies:** 0\ **Last updated:** [January 12, 2017, 3:21am UTC](https://discuss.elastic.co/t/how-to-do-performance-testing-using-logstash-performance-testing/71305 "2017-01-12T03:21:52Z")
I downloaded logstash-performance-testing from git. Need inputs on how to use this tool to performance tests using this tool. I have logstash running as a container in a vm --- ## [Combine 2 events into one](https://discuss.elastic.co/t/combine-2-events-into-one/70825)
**Author:** [@bishaka](https://discuss.elastic.co/u/bishaka)\ **Replies:** 1\ **Last updated:** [January 11, 2017, 11:02pm UTC](https://discuss.elastic.co/t/combine-2-events-into-one/70825 "2017-01-11T23:02:22Z")
Hi, I am trying to merge 2 log events into a single event in logstash.. After some research, i found out about the aggregate filter.. I am not quite sure if I am doing this correctly but as of now.. It is not adding th… --- ## [How to convert a Date field from CET timezone to UTC and save in elasticsearch using logstash](https://discuss.elastic.co/t/how-to-convert-a-date-field-from-cet-timezone-to-utc-and-save-in-elasticsearch-using-logstash/71286)
**Author:** [@g\_dev](https://discuss.elastic.co/u/g_dev)\ **Replies:** 4\ **Last updated:** [January 11, 2017, 10:36pm UTC](https://discuss.elastic.co/t/how-to-convert-a-date-field-from-cet-timezone-to-utc-and-save-in-elasticsearch-using-logstash/71286 "2017-01-11T22:36:28Z")
I want to convert date from CET i.e. 2014-11-12T13:52:11.000Z I want output as UTC: 2014-11-12T11:52:11.000Z How can I achieve thus? Thanks! --- ## [S3 Documentation Stale](https://discuss.elastic.co/t/s3-documentation-stale/71269)
**Author:** [@byped](https://discuss.elastic.co/u/byped)\ **Replies:** 2\ **Last updated:** [January 11, 2017, 8:56pm UTC](https://discuss.elastic.co/t/s3-documentation-stale/71269 "2017-01-11T20:56:33Z")
I've noticed that the official docs at https://www.elastic.co/guide/en/logstash/master/plugins-outputs-s3.html are fairly out-of-date relative to what's in github at https://github.com/logstash-plugins/logstash-output-s3.… --- ## [Logstash installation folder in Windows](https://discuss.elastic.co/t/logstash-installation-folder-in-windows/70872)
**Author:** [@Firass\_Gzayil](https://discuss.elastic.co/u/Firass_Gzayil)\ **Replies:** 5\ **Last updated:** [January 11, 2017, 7:25pm UTC](https://discuss.elastic.co/t/logstash-installation-folder-in-windows/70872 "2017-01-11T19:25:24Z")
Hi, I am trying to run logstash under c:\\program files but I get an error An unexpected error occurred! :error =\> bad URI(is not URI?): file://C:/Program Files/Infra/Data/Shipper/logstash5/config/log4j2.properties, :bac… --- ## [Error: uninitialized constant Aws::Client::Errors](https://discuss.elastic.co/t/error-uninitialized-constant-aws-client-errors/64923)
**Author:** [@swebask](https://discuss.elastic.co/u/swebask)\ **Replies:** 5\ **Last updated:** [January 11, 2017, 5:18pm UTC](https://discuss.elastic.co/t/error-uninitialized-constant-aws-client-errors/64923 "2017-01-11T17:18:41Z")
I'm trying got move json files from s3 to elastic search and I get the following error: Error: uninitialized constant Aws::Client::Errors Here is my .conf file input { s3 { bucket =\> "xxxxxxx" access\_key\_… --- ## [How can I increase # of workers of rabbitmq output on the logstash 5.1.1?](https://discuss.elastic.co/t/how-can-i-increase-of-workers-of-rabbitmq-output-on-the-logstash-5-1-1/71256)
**Author:** [@kidokim509](https://discuss.elastic.co/u/kidokim509)\ **Replies:** 0\ **Last updated:** [January 11, 2017, 5:00pm UTC](https://discuss.elastic.co/t/how-can-i-increase-of-workers-of-rabbitmq-output-on-the-logstash-5-1-1/71256 "2017-01-11T17:00:58Z")
I am using logstash 5.1.1 for sending events to the rabbitmq. I am trying to make multiple connections from logstash to rabbitmq for performance. When I use logstash 2.X, worker configuration at the config file works w… --- ## [Add (;) sépartor in csv file before analysing it](https://discuss.elastic.co/t/add-separtor-in-csv-file-before-analysing-it/70951)
**Author:** [@ismael\_boumedien](https://discuss.elastic.co/u/ismael_boumedien)\ **Replies:** 4\ **Last updated:** [January 11, 2017, 12:28pm UTC](https://discuss.elastic.co/t/add-separtor-in-csv-file-before-analysing-it/70951 "2017-01-11T12:28:42Z")
Hi guys, I want to add (:wink: sépartor in csv file before analysing it. Example befor e: 2017/01/08-18:32:08mydomain.fr;151;ACC\_EFFETMETEO\_20170108181410.tar.gz;/arc/dacc/staging/max/SCORE;1 Result wanted: 2017/01/… --- ## [Logstash multiline code pattern?](https://discuss.elastic.co/t/logstash-multiline-code-pattern/71200)
**Author:** [@aviral\_srivastava](https://discuss.elastic.co/u/aviral_srivastava)\ **Replies:** 3\ **Last updated:** [January 11, 2017, 11:55am UTC](https://discuss.elastic.co/t/logstash-multiline-code-pattern/71200 "2017-01-11T11:55:26Z")
Hi, OS: Windows7 logstash2.1 elasticsearch2.1.0 I have following log file "01","12/1/2016 12:03:43 AM","" "02","STW4157","2016-12-01","00:03:43" "03","0","0","0","0","0","1","0" "04","AP 2.0 Mail Classify P03","" "05… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1053) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1055)