# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1057 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1058 --- ## [Logstash-patterns-core BRO\_\* not working?](https://discuss.elastic.co/t/logstash-patterns-core-bro--not-working/70595)
**Author:** [@blacktop](https://discuss.elastic.co/u/blacktop)\ **Replies:** 2\ **Last updated:** [January 7, 2017, 2:19am UTC](https://discuss.elastic.co/t/logstash-patterns-core-bro--not-working/70595 "2017-01-07T02:19:54Z")
I have a question about the built-in bro grok patterns. In Bro you can greatly change the fields that are present depending on what scripts/mods/policies you load. When you look at their log-file docs MOST of the fie… --- ## [Pipeline aborted due to error in password field logstash](https://discuss.elastic.co/t/pipeline-aborted-due-to-error-in-password-field-logstash/68975)
**Author:** [@Nguy\_n\_D\_c\_Th\_nh](https://discuss.elastic.co/u/Nguy_n_D_c_Th_nh)\ **Replies:** 3\ **Last updated:** [January 6, 2017, 9:54pm UTC](https://discuss.elastic.co/t/pipeline-aborted-due-to-error-in-password-field-logstash/68975 "2017-01-06T21:54:03Z")
Hi everyone, I got an error when sending output to elasticsearch. The error message like this. \[2016-12-14T13:20:18,500\]\[ERROR\]\[logstash.agent \] Pipeline aborted due to error {:exception=\>#\ **Author:** [@Ankit\_Jain](https://discuss.elastic.co/u/Ankit_Jain)\ **Replies:** 1\ **Last updated:** [January 6, 2017, 6:56pm UTC](https://discuss.elastic.co/t/logstash-how-to-read-the-files-in-order-of-there-creation-time/70606 "2017-01-06T18:56:59Z") Hi, We want to read the multiple files (approx 1000) present in a directory (/opt/logstash/data). The creation time of each files is different and we want to read the files on the basis of creation time (file with lowe… --- ## [Curator - SSL Connection Issue](https://discuss.elastic.co/t/curator-ssl-connection-issue/70800)
**Author:** [@MSAdmin](https://discuss.elastic.co/u/MSAdmin)\ **Replies:** 16\ **Last updated:** [January 6, 2017, 5:52pm UTC](https://discuss.elastic.co/t/curator-ssl-connection-issue/70800 "2017-01-06T17:52:31Z")
I just installed Curator 4.2 from the repository. It is installed on the ELK server. I created the ~/.curator/curator.yml file with the following contents: # Remember, leave a key empty if there is no value. None will… --- ## [Cloudtrail codec error after new release](https://discuss.elastic.co/t/cloudtrail-codec-error-after-new-release/70478)
**Author:** [@Josh\_A](https://discuss.elastic.co/u/Josh_A)\ **Replies:** 1\ **Last updated:** [January 6, 2017, 3:56pm UTC](https://discuss.elastic.co/t/cloudtrail-codec-error-after-new-release/70478 "2017-01-06T15:56:06Z")
Hi - I just downloaded and installed the newly-released cloudtrail codec. Command to install was: ./bin/logstash-plugin install logstash-codec-cloudtrail The only change I made in my .conf file was to go from "json" c… --- ## [Forwarding logs from logstashA to LogstashB to Kibana](https://discuss.elastic.co/t/forwarding-logs-from-logstasha-to-logstashb-to-kibana/70609)
**Author:** [@Maria\_Delarosa](https://discuss.elastic.co/u/Maria_Delarosa)\ **Replies:** 9\ **Last updated:** [January 6, 2017, 3:53pm UTC](https://discuss.elastic.co/t/forwarding-logs-from-logstasha-to-logstashb-to-kibana/70609 "2017-01-06T15:53:24Z")
I am currently trying to implement my own "logstash-forwarder". I am running this from a local windows machine and I am succefully able to send logs from one logstash instance to Kibana. However, I would like to be able … --- ## [Input file codec json UTF-16 parse error](https://discuss.elastic.co/t/input-file-codec-json-utf-16-parse-error/70778)
**Author:** [@sungjun](https://discuss.elastic.co/u/sungjun)\ **Replies:** 0\ **Last updated:** [January 6, 2017, 11:08am UTC](https://discuss.elastic.co/t/input-file-codec-json-utf-16-parse-error/70778 "2017-01-06T11:08:18Z")
Hi i am korean. We used logstash on a windows server. logs are written in utf-16. but Logstash does not correctly interpret json except the first line. this is config file input { file { path =\> start\_posi… --- ## [How to configure ELK (Elasticsearch, Logstash,Kibana) for different application log files and display each application separately in Kibana?](https://discuss.elastic.co/t/how-to-configure-elk-elasticsearch-logstash-kibana-for-different-application-log-files-and-display-each-application-separately-in-kibana/70411)
**Author:** [@sezanawa](https://discuss.elastic.co/u/sezanawa)\ **Replies:** 15\ **Last updated:** [January 6, 2017, 9:50am UTC](https://discuss.elastic.co/t/how-to-configure-elk-elasticsearch-logstash-kibana-for-different-application-log-files-and-display-each-application-separately-in-kibana/70411 "2017-01-06T09:50:25Z")
Hallo Everybody Since last 2 days i am busy with ELK. I have successfully installed Elasticsearch 5.1.1, Logstash 5.1.1 and Kibana 5.1.1 on my local windows VM and set up logstash configuration as it can parse IIS Log … --- ## [Pattern logstash to get multi information in log but log don't have exactly format for problem](https://discuss.elastic.co/t/pattern-logstash-to-get-multi-information-in-log-but-log-dont-have-exactly-format-for-problem/70742)
**Author:** [@Tr\_ng\_Trang](https://discuss.elastic.co/u/Tr_ng_Trang)\ **Replies:** 2\ **Last updated:** [January 6, 2017, 8:32am UTC](https://discuss.elastic.co/t/pattern-logstash-to-get-multi-information-in-log-but-log-dont-have-exactly-format-for-problem/70742 "2017-01-06T08:32:49Z")
I have problem to write pattern to get information on logstash, after \[severity "CRITICAL"\] i want to get all word have tag before like \[tag "language-multi"\] \[tag "platform-multi"\] i will get language-multi and platform… --- ## [Provide custom Kafka message decoder to Logstash](https://discuss.elastic.co/t/provide-custom-kafka-message-decoder-to-logstash/1780)
**Author:** [@technichle](https://discuss.elastic.co/u/technichle)\ **Replies:** 8\ **Last updated:** [January 6, 2017, 5:26am UTC](https://discuss.elastic.co/t/provide-custom-kafka-message-decoder-to-logstash/1780 "2017-01-06T05:26:38Z")
In my Logstash configuration I'm defining a custom Kafka message decoder but when I startup Logstash I get an error that Logstash cannot find my class. Is there a relatively easy way to point Logstash to my jar where the… --- ## [HTML error on logstash reference \[5.1\]](https://discuss.elastic.co/t/html-error-on-logstash-reference-5-1/70741)
**Author:** [@Munish\_Chauhan](https://discuss.elastic.co/u/Munish_Chauhan)\ **Replies:** 0\ **Last updated:** [January 6, 2017, 2:15am UTC](https://discuss.elastic.co/t/html-error-on-logstash-reference-5-1/70741 "2017-01-06T02:15:44Z")
link to the page: https://www.elastic.co/guide/en/logstash/current/plugins-outputs-http.html#plugins-outputs-http-headers --- ## [Logstash Stopping Pipeline](https://discuss.elastic.co/t/logstash-stopping-pipeline/62858)
**Author:** [@mrognone](https://discuss.elastic.co/u/mrognone)\ **Replies:** 5\ **Last updated:** [January 5, 2017, 6:10pm UTC](https://discuss.elastic.co/t/logstash-stopping-pipeline/62858 "2017-01-05T18:10:42Z")
Hi Guys , two days ago one of my logstash servers crash with Logstash service. the error recieved is :message=\>"stopping pipeline", :id=\>"main" The configuration file is the following: input { udp { po… --- ## [Which SNMP versions are supported for snmptrap plugin?](https://discuss.elastic.co/t/which-snmp-versions-are-supported-for-snmptrap-plugin/48281)
**Author:** [@mattcrawfoord](https://discuss.elastic.co/u/mattcrawfoord)\ **Replies:** 2\ **Last updated:** [January 5, 2017, 3:24pm UTC](https://discuss.elastic.co/t/which-snmp-versions-are-supported-for-snmptrap-plugin/48281 "2017-01-05T15:24:51Z")
I’m trying logstash with snmptrap, The following log was generated . { " #\< SNMP::SNMPv2\_Trap:0xc6fb838 @request\_id=19345, @error\_index=0, @error\_status=0, @source\_ip="1.2.3.4", @varbind\_list=\[#\ **Author:** [@ld\_pvl](https://discuss.elastic.co/u/ld_pvl)\ **Replies:** 0\ **Last updated:** [January 5, 2017, 11:04am UTC](https://discuss.elastic.co/t/intermittent-issue-while-resolving-symlinks-to-real-path/70670 "2017-01-05T11:04:21Z") Hi, In our environment, we have multiple logs folders. There's a symlink that points to a currently active logs folder and this symlink constantly changes pointing to a different folder. Something like this: logs\_a… --- ## [Logstash-input-rabbitmq: Over 8000 unused threads on a 24-cores machine](https://discuss.elastic.co/t/logstash-input-rabbitmq-over-8000-unused-threads-on-a-24-cores-machine/70458)
**Author:** [@LeMic](https://discuss.elastic.co/u/LeMic)\ **Replies:** 2\ **Last updated:** [January 5, 2017, 8:16am UTC](https://discuss.elastic.co/t/logstash-input-rabbitmq-over-8000-unused-threads-on-a-24-cores-machine/70458 "2017-01-05T08:16:32Z")
Hello, We're using Logstash 5.1.1 on a physical machine with 24 cores (2 sockets \* 6 cores \* 2 hyper threads) and many instances of the input-rabbitmq plugin. With this setup, Logstash create a lot of unused threads fo… --- ## [Logstash linkage between input and output](https://discuss.elastic.co/t/logstash-linkage-between-input-and-output/70080)
**Author:** [@Makra](https://discuss.elastic.co/u/Makra)\ **Replies:** 2\ **Last updated:** [January 5, 2017, 5:51am UTC](https://discuss.elastic.co/t/logstash-linkage-between-input-and-output/70080 "2017-01-05T05:51:34Z")
Hi list experts Can anyone describe me in details, how logstash choose/link outputs ( among many output sections) for inputs that we had already defined ? Thanks Makara --- ## [Logstash creates weird files](https://discuss.elastic.co/t/logstash-creates-weird-files/70584)
**Author:** [@chromechris](https://discuss.elastic.co/u/chromechris)\ **Replies:** 1\ **Last updated:** [January 5, 2017, 12:13am UTC](https://discuss.elastic.co/t/logstash-creates-weird-files/70584 "2017-01-05T00:13:59Z")
Hello Loggers, I have noticed that Logstash creates weird files in my users home directory when I run it. The files created are empty, and they are named based on values given to input plugin settings such as "beginnin… --- ## [Parent/Child Config in same file or separate files?](https://discuss.elastic.co/t/parent-child-config-in-same-file-or-separate-files/69865)
**Author:** [@west415](https://discuss.elastic.co/u/west415)\ **Replies:** 5\ **Last updated:** [January 4, 2017, 9:21pm UTC](https://discuss.elastic.co/t/parent-child-config-in-same-file-or-separate-files/69865 "2017-01-04T21:21:22Z")
I'm new to logstash and using the latest version. I have a config file now where I've defined my input/output and it pulls data from a single SQL Server table successfully and populates my index in elasticsearch. Now … --- ## [Problem with aggregation filter](https://discuss.elastic.co/t/problem-with-aggregation-filter/70592)
**Author:** [@Kryten](https://discuss.elastic.co/u/Kryten)\ **Replies:** 0\ **Last updated:** [January 4, 2017, 6:56pm UTC](https://discuss.elastic.co/t/problem-with-aggregation-filter/70592 "2017-01-04T18:56:57Z")
Hi, I'm new to the aggregation filter and would really appreciate some assistance in working with it to solve the following problem. My log data contains certain lines which have a data value which must be persisted, o… --- ## [Converting field with HEX value to ASCII](https://discuss.elastic.co/t/converting-field-with-hex-value-to-ascii/29878)
**Author:** [@gcaccia](https://discuss.elastic.co/u/gcaccia)\ **Replies:** 6\ **Last updated:** [January 4, 2017, 7:25pm UTC](https://discuss.elastic.co/t/converting-field-with-hex-value-to-ascii/29878 "2017-01-04T19:25:28Z")
I have a dump file of JSON documents where many of the fields are in HEX. I want to import this into Elasticsearch using Logstash. Can Logstash convert HEX fields to ASCII? Thanks, Glenn --- ## [Elasticsearch Output - Request size exceeded error](https://discuss.elastic.co/t/elasticsearch-output-request-size-exceeded-error/56322)
**Author:** [@Stephen\_Purr](https://discuss.elastic.co/u/Stephen_Purr)\ **Replies:** 8\ **Last updated:** [January 4, 2017, 7:19pm UTC](https://discuss.elastic.co/t/elasticsearch-output-request-size-exceeded-error/56322 "2017-01-04T19:19:56Z")
Hello everyone, Occasionally we've been seeing our logstash server stop processing logs from our redis queue and start to show some errors in its logs about request size being too large. This causes our logstash serve… --- ## [Logstash Untar Behaviour](https://discuss.elastic.co/t/logstash-untar-behaviour/70577)
**Author:** [@chromechris](https://discuss.elastic.co/u/chromechris)\ **Replies:** 0\ **Last updated:** [January 4, 2017, 3:48pm UTC](https://discuss.elastic.co/t/logstash-untar-behaviour/70577 "2017-01-04T15:48:08Z")
Hello Loggers, I just wanted to share weird behavior I experienced in certain scenarios when using Logstash. The scenarios are the following: Scenario 1 1. Logstash is stopped 2. I delete any existing sincedb fil… --- ## [What version of logstash is compatible with elasticsearch 0.90?](https://discuss.elastic.co/t/what-version-of-logstash-is-compatible-with-elasticsearch-0-90/70579)
**Author:** [@maxrothman](https://discuss.elastic.co/u/maxrothman)\ **Replies:** 1\ **Last updated:** [January 4, 2017, 4:52pm UTC](https://discuss.elastic.co/t/what-version-of-logstash-is-compatible-with-elasticsearch-0-90/70579 "2017-01-04T16:52:46Z")
I'm currently working on migrating an index from ES 0.90 to ES 5.1, and logstash seems capable of streaming the index between the two clusters. However, the provided compatibility table only goes back to ES 1.0. What ver… --- ## [Random Output of Lostash Plugin](https://discuss.elastic.co/t/random-output-of-lostash-plugin/70550)
**Author:** [@shoryukane](https://discuss.elastic.co/u/shoryukane)\ **Replies:** 0\ **Last updated:** [January 4, 2017, 12:19pm UTC](https://discuss.elastic.co/t/random-output-of-lostash-plugin/70550 "2017-01-04T12:19:48Z")
Hello Everyone, I am rookie in logstash and I am trying use various output plugins of logstash like stdout, kafka and http. Source of my input is a \*.log file which contains a number of logs. After I parse the log from … --- ## [How to start Logstash?](https://discuss.elastic.co/t/how-to-start-logstash/69653)
**Author:** [@Michel99\_7](https://discuss.elastic.co/u/Michel99_7)\ **Replies:** 3\ **Last updated:** [January 4, 2017, 11:54am UTC](https://discuss.elastic.co/t/how-to-start-logstash/69653 "2017-01-04T11:54:28Z")
Hello, What is the good practice for executing Logstash: by command line, or possibly by service? In case I'm using a virtual machine, I'd like that Logstash starts without any need to start a window session on my ma… --- ## [Http://stackoverflow.com/questions/41427129/add-field-logstash-after-converting-value-to-json](https://discuss.elastic.co/t/http-stackoverflow-com-questions-41427129-add-field-logstash-after-converting-value-to-json/70426)
**Author:** [@Yatender\_Singh](https://discuss.elastic.co/u/Yatender_Singh)\ **Replies:** 5\ **Last updated:** [January 4, 2017, 10:26am UTC](https://discuss.elastic.co/t/http-stackoverflow-com-questions-41427129-add-field-logstash-after-converting-value-to-json/70426 "2017-01-04T10:26:55Z")
1 - unable to fetch values inside JSON. 2 - unable to map timestamp from data. For all general issues, please provide the following details for fast resolution: Version:5.1.1 Operating System: Mac Sierra Config File… --- ## [Logstash output filename timezone problem](https://discuss.elastic.co/t/logstash-output-filename-timezone-problem/69894)
**Author:** [@for\_logstash](https://discuss.elastic.co/u/for_logstash)\ **Replies:** 5\ **Last updated:** [January 4, 2017, 10:23am UTC](https://discuss.elastic.co/t/logstash-output-filename-timezone-problem/69894 "2017-01-04T10:23:33Z")
Hi I want to output the file using current time just like the config below. output { file { path =\>"/home/test/%{+YYYYMMdd}/nginx\_%{+YYYYMMdd\_HH}.log" } } the filename generated use the UTC timezone time, … --- ## [Logstash 5.1.1 can not open port](https://discuss.elastic.co/t/logstash-5-1-1-can-not-open-port/70521)
**Author:** [@TaeSung\_Kim](https://discuss.elastic.co/u/TaeSung_Kim)\ **Replies:** 2\ **Last updated:** [January 4, 2017, 9:56am UTC](https://discuss.elastic.co/t/logstash-5-1-1-can-not-open-port/70521 "2017-01-04T09:56:33Z")
logstash 5.1.1 can not open port.. Log message is down. How to fix it? \[2017-01-04T07:17:44,341\]\[INFO \]\[logstash.agent \] Successfully started Logstash API endpoint {:port=\>9600} \[2017-01-04T07:17:55,582\]\[INFO… --- ## [Logstash-filter-zeromq does not install (version conflict) on logstash 5.1](https://discuss.elastic.co/t/logstash-filter-zeromq-does-not-install-version-conflict-on-logstash-5-1/69146)
**Author:** [@burnard11](https://discuss.elastic.co/u/burnard11)\ **Replies:** 13\ **Last updated:** [January 4, 2017, 6:31am UTC](https://discuss.elastic.co/t/logstash-filter-zeromq-does-not-install-version-conflict-on-logstash-5-1/69146 "2017-01-04T06:31:09Z")
Hi all, I have trouble installing the logstah-filter-zeromq plugin on a clean logstash 5.1 install (tested with docker hub docker image logstash:5.1). Installation reports a version conflict. Full console output follow… --- ## [I think, its misspelled in logstash documentation](https://discuss.elastic.co/t/i-think-its-misspelled-in-logstash-documentation/70477)
**Author:** [@Munish\_Chauhan](https://discuss.elastic.co/u/Munish_Chauhan)\ **Replies:** 2\ **Last updated:** [January 4, 2017, 1:54am UTC](https://discuss.elastic.co/t/i-think-its-misspelled-in-logstash-documentation/70477 "2017-01-04T01:54:28Z")
it should be service instead of serice [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1056) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1058)