# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1058 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1059 --- ## [How can i give Restful API as input in log stash cons file](https://discuss.elastic.co/t/how-can-i-give-restful-api-as-input-in-log-stash-cons-file/70452)
**Author:** [@Dan](https://discuss.elastic.co/u/Dan)\ **Replies:** 1\ **Last updated:** [January 3, 2017, 10:54pm UTC](https://discuss.elastic.co/t/how-can-i-give-restful-api-as-input-in-log-stash-cons-file/70452 "2017-01-03T22:54:59Z")
I want to use Restfull API as input for logstsh. Which plugin i can use to get data by using RESTFUL API. Please provide logstash conf file. --- ## [Logstash slowlog field took\_in\_millis shows microseconds instead of milliseconds](https://discuss.elastic.co/t/logstash-slowlog-field-took-in-millis-shows-microseconds-instead-of-milliseconds/70146)
**Author:** [@nick4eva](https://discuss.elastic.co/u/nick4eva)\ **Replies:** 2\ **Last updated:** [January 3, 2017, 9:44pm UTC](https://discuss.elastic.co/t/logstash-slowlog-field-took-in-millis-shows-microseconds-instead-of-milliseconds/70146 "2017-01-03T21:44:53Z")
I configured Logstash slowlog like this: slowlog.threshold.warn: 500ms slowlog.threshold.info: 400ms slowlog.threshold.debug: 300ms slowlog.threshold.trace: 100ms But I see in slowlog file trace entry with "took\_in\_m… --- ## [Logstash elastic-search output](https://discuss.elastic.co/t/logstash-elastic-search-output/70473)
**Author:** [@sanketsvnus](https://discuss.elastic.co/u/sanketsvnus)\ **Replies:** 1\ **Last updated:** [January 3, 2017, 8:08pm UTC](https://discuss.elastic.co/t/logstash-elastic-search-output/70473 "2017-01-03T20:08:33Z")
We have below ELK pipeline out using logstash input/output features. We are following weekly rotation using below config logstash-\>logstash-aggregator-\>kafka-\>elasticasearch output { elasticsearch { codec =\> … --- ## [Iostat grok logstash](https://discuss.elastic.co/t/iostat-grok-logstash/70424)
**Author:** [@Pedro\_Vilas-Boas](https://discuss.elastic.co/u/Pedro_Vilas-Boas)\ **Replies:** 7\ **Last updated:** [January 3, 2017, 2:09pm UTC](https://discuss.elastic.co/t/iostat-grok-logstash/70424 "2017-01-03T14:09:41Z")
Hey, im trying to process logs from iostat, the problem is i have different machines with 1 or 2 disks, which means i have logs with different number of lines Example: 2017-01-03T10:41:35+0000 Device: tps … --- ## [Using beats input](https://discuss.elastic.co/t/using-beats-input/70437)
**Author:** [@chokedoke](https://discuss.elastic.co/u/chokedoke)\ **Replies:** 2\ **Last updated:** [January 3, 2017, 2:07pm UTC](https://discuss.elastic.co/t/using-beats-input/70437 "2017-01-03T14:07:03Z")
Im having a bit of a problem and i cant seem to solve it so hopefully someone here can help :slight\_smile: I have multiple servers running various beats (filebeat, winlogbeat, metricbeat). These are all configured to s… --- ## [Logstash - Add fields from the log fields property - Grok](https://discuss.elastic.co/t/logstash-add-fields-from-the-log-fields-property-grok/70100)
**Author:** [@AleGallagher](https://discuss.elastic.co/u/AleGallagher)\ **Replies:** 2\ **Last updated:** [January 3, 2017, 1:03pm UTC](https://discuss.elastic.co/t/logstash-add-fields-from-the-log-fields-property-grok/70100 "2017-01-03T13:03:32Z")
I'm learning logstash and I'm using Kibana to see the logs. I would like to know if is there anyway to add fields using data from message property. For example, the log is like this: port:46,722 host:172.18.0.5 message:… --- ## [Importing IIS logs - encoding problem](https://discuss.elastic.co/t/importing-iis-logs-encoding-problem/70431)
**Author:** [@jontj](https://discuss.elastic.co/u/jontj)\ **Replies:** 0\ **Last updated:** [January 3, 2017, 12:30pm UTC](https://discuss.elastic.co/t/importing-iis-logs-encoding-problem/70431 "2017-01-03T12:30:23Z")
Hi, I am a newbie with ELK and am having a problem importing IIS logs. The IIS server is logging W3C logs with UTF-8 encoding and my filebeat config is as below:- filebeat.prospectors - input\_type: log encoding… --- ## [Logstash or condition in if statement](https://discuss.elastic.co/t/logstash-or-condition-in-if-statement/70403)
**Author:** [@aydinnmu](https://discuss.elastic.co/u/aydinnmu)\ **Replies:** 2\ **Last updated:** [January 3, 2017, 10:35am UTC](https://discuss.elastic.co/t/logstash-or-condition-in-if-statement/70403 "2017-01-03T10:35:43Z")
Hi guys, i want to check multiple condition in if statement. my filter like that but it is not working. it pass everything :slight\_smile: it worked when i was only one condition. 1 ) doesnt work -\> if \[logid\] == "%… --- ## [Encryption of logstash configuration files](https://discuss.elastic.co/t/encryption-of-logstash-configuration-files/70408)
**Author:** [@Ruthvic](https://discuss.elastic.co/u/Ruthvic)\ **Replies:** 1\ **Last updated:** [January 3, 2017, 9:24am UTC](https://discuss.elastic.co/t/encryption-of-logstash-configuration-files/70408 "2017-01-03T09:24:30Z")
Hi. This is regarding the encryption of logstash config files. When we deploy the config files in the production environment, people should not be able to access the configuration files. So can we encrypt the config file… --- ## [Logstash if statement check in file](https://discuss.elastic.co/t/logstash-if-statement-check-in-file/69747)
**Author:** [@aydinnmu](https://discuss.elastic.co/u/aydinnmu)\ **Replies:** 4\ **Last updated:** [January 3, 2017, 8:38am UTC](https://discuss.elastic.co/t/logstash-if-statement-check-in-file/69747 "2017-01-03T08:38:28Z")
hi guys, can i check a value in a file with if statement ? such as if \[host \] in "./hostlist.txt" --- ## [Invalid Frame Type, received: 1](https://discuss.elastic.co/t/invalid-frame-type-received-1/65493)
**Author:** [@ironbeast](https://discuss.elastic.co/u/ironbeast)\ **Replies:** 19\ **Last updated:** [January 3, 2017, 8:04am UTC](https://discuss.elastic.co/t/invalid-frame-type-received-1/65493 "2017-01-03T08:04:33Z")
Hello, I installed the complete 5.0 stack (filebeat/logstash/elasticsearch/kibana). But I have following error in my logs continuously showing up: \[2016-11-09T14:17:34,982\]\[ERROR\]\[org.logstash.beats.BeatsHandler\] Excep… --- ## [Couldn't find any filter plugin named 'multiline'](https://discuss.elastic.co/t/couldnt-find-any-filter-plugin-named-multiline/70349)
**Author:** [@Ajit\_Singh](https://discuss.elastic.co/u/Ajit_Singh)\ **Replies:** 3\ **Last updated:** [January 3, 2017, 6:28am UTC](https://discuss.elastic.co/t/couldnt-find-any-filter-plugin-named-multiline/70349 "2017-01-03T06:28:04Z")
I am using logstash-5.0.0, whenever I am using multiline plugin It give me "Loaderror". --- ## [Failed to send event to MongoDB,When MongoDB Restart](https://discuss.elastic.co/t/failed-to-send-event-to-mongodb-when-mongodb-restart/70387)
**Author:** [@iamrainbow521](https://discuss.elastic.co/u/iamrainbow521)\ **Replies:** 0\ **Last updated:** [January 3, 2017, 5:28am UTC](https://discuss.elastic.co/t/failed-to-send-event-to-mongodb-when-mongodb-restart/70387 "2017-01-03T05:28:17Z")
when MongoDB Restart,Failed to continue send to MongoDB {:timestamp=\>"2016-12-30T11:03:11.564000+0800", :message=\>"Failed to send event to MongoDB", :event=\>#\"C:/tomcat\_… --- ## [Converting SQL datetime2 field to UNIX epoch](https://discuss.elastic.co/t/converting-sql-datetime2-field-to-unix-epoch/51603)
**Author:** [@ads95](https://discuss.elastic.co/u/ads95)\ **Replies:** 2\ **Last updated:** [January 3, 2017, 4:53am UTC](https://discuss.elastic.co/t/converting-sql-datetime2-field-to-unix-epoch/51603 "2017-01-03T04:53:55Z")
I'm ingesting a SQL datetime2 field from a SQL Server 2012 instance via JDBC and I'm looking to convert the field to UNIX epoch format. Ruby is not playing nicely with the fact that the original field being ingested from… --- ## [Translation missing: en.logstash.agent.configuration.invalid\_plugin\_register](https://discuss.elastic.co/t/translation-missing-en-logstash-agent-configuration-invalid-plugin-register/62834)
**Author:** [@DigiAngel](https://discuss.elastic.co/u/DigiAngel)\ **Replies:** 3\ **Last updated:** [January 2, 2017, 6:56pm UTC](https://discuss.elastic.co/t/translation-missing-en-logstash-agent-configuration-invalid-plugin-register/62834 "2017-01-02T18:56:11Z")
Using latest logstash beta, here's what I get: \[10:06:43 @tester:/var/log/logstash$\] sudo -u logstash /usr/share/logstash/bin/logstash --path.settings=/etc/logstash -f /etc/logstash/conf.d -t Configuration OK but star… --- ## [Logstash version 5 Service commands are not working](https://discuss.elastic.co/t/logstash-version-5-service-commands-are-not-working/70359)
**Author:** [@gayathri](https://discuss.elastic.co/u/gayathri)\ **Replies:** 5\ **Last updated:** [January 2, 2017, 2:11pm UTC](https://discuss.elastic.co/t/logstash-version-5-service-commands-are-not-working/70359 "2017-01-02T14:11:56Z")
Hi Team, I have upgraded the Logstash Version from 2.x to 5.x. But our service script is not working. The start command which we are using in the script is: /opt/logstash/bin/logstash agent -f /opt/logstash/conf… --- ## [Parse json Array input](https://discuss.elastic.co/t/parse-json-array-input/70194)
**Author:** [@mehdi-aouadi](https://discuss.elastic.co/u/mehdi-aouadi)\ **Replies:** 2\ **Last updated:** [January 2, 2017, 1:51pm UTC](https://discuss.elastic.co/t/parse-json-array-input/70194 "2017-01-02T13:51:03Z")
I am retrieving some json data from a REST API ussing the http\_poller input pluging : http\_poller { urls =\> { "myurl" =\> "https://myAPI" } interval =\> 30 type =\> "myType" add\_field =\> { "tag" =\>… --- ## [\_dateparsefailure](https://discuss.elastic.co/t/-dateparsefailure/69886)
**Author:** [@Lucifer\_hbp](https://discuss.elastic.co/u/Lucifer_hbp)\ **Replies:** 2\ **Last updated:** [January 2, 2017, 12:52pm UTC](https://discuss.elastic.co/t/-dateparsefailure/69886 "2017-01-02T12:52:54Z")
Hi, How to write grok match for following date in logstash: 20161219T003209.939-05:00 I have tried following but it is giving "\_dateparsefailure:" date{ match =\> \[ "timestamp" , "yyyyMMddHHmmss.SSSZ" \] } Any h… --- ## [Conditional for @timestamp](https://discuss.elastic.co/t/conditional-for-timestamp/70351)
**Author:** [@elvarb](https://discuss.elastic.co/u/elvarb)\ **Replies:** 2\ **Last updated:** [January 2, 2017, 11:37am UTC](https://discuss.elastic.co/t/conditional-for-timestamp/70351 "2017-01-02T11:37:15Z")
Is it possible to create a conditional for the @timestamp field, so for example if I get a message with a timestamp older than 1h then do something? --- ## [Logstash Elasticsearch ouput: Append array while upserting](https://discuss.elastic.co/t/logstash-elasticsearch-ouput-append-array-while-upserting/70010)
**Author:** [@slinky](https://discuss.elastic.co/u/slinky)\ **Replies:** 4\ **Last updated:** [January 2, 2017, 11:04am UTC](https://discuss.elastic.co/t/logstash-elasticsearch-ouput-append-array-while-upserting/70010 "2017-01-02T11:04:58Z")
I am upserting documents: new fields should be added and existing fields should be replaced by the new documents field value. With one exception: the value of text field 'shodan.protocols' should always be appended inste… --- ## [LogstashLogrotate conflict](https://discuss.elastic.co/t/logstashlogrotate-conflict/70354)
**Author:** [@Yarden\_Bar](https://discuss.elastic.co/u/Yarden_Bar)\ **Replies:** 0\ **Last updated:** [January 2, 2017, 10:58am UTC](https://discuss.elastic.co/t/logstashlogrotate-conflict/70354 "2017-01-02T10:58:55Z")
Hi all, I'm encountering a conflict between Logstash and logrotate rules where the later tried to rotate Logstash's logs (/var/log/logstash/logstash-plain\*). Logstash itself has Log4j2 configuration that rotates the fi… --- ## [Encrypting jdbc\_password](https://discuss.elastic.co/t/encrypting-jdbc-password/70000)
**Author:** [@gilisade](https://discuss.elastic.co/u/gilisade)\ **Replies:** 2\ **Last updated:** [January 2, 2017, 8:27am UTC](https://discuss.elastic.co/t/encrypting-jdbc-password/70000 "2017-01-02T08:27:00Z")
Hi is there a way to encrypting jdbc\_password in the config file? and the jdbc\_connection\_string aswell i have logstash 5.0.1 installed on a RHEL 7 VM thanks --- ## [Unexpected error in ruby code in logstash](https://discuss.elastic.co/t/unexpected-error-in-ruby-code-in-logstash/70264)
**Author:** [@ANU\_SARA\_VARGHESE](https://discuss.elastic.co/u/ANU_SARA_VARGHESE)\ **Replies:** 3\ **Last updated:** [January 2, 2017, 8:13am UTC](https://discuss.elastic.co/t/unexpected-error-in-ruby-code-in-logstash/70264 "2017-01-02T08:13:19Z")
Hi, An unexpected error in occuring for the following ruby code in logstash filter. SyntaxError: (ruby filter code):5: syntax error, unexpected tRCURLY \*\* }\*\* Following is the ruby code: ruby { … --- ## [Logstash-input-jdbc doesn't work on logstash 5.x](https://discuss.elastic.co/t/logstash-input-jdbc-doesnt-work-on-logstash-5-x/69137)
**Author:** [@elosada](https://discuss.elastic.co/u/elosada)\ **Replies:** 10\ **Last updated:** [January 2, 2017, 8:02am UTC](https://discuss.elastic.co/t/logstash-input-jdbc-doesnt-work-on-logstash-5-x/69137 "2017-01-02T08:02:56Z")
I installed logstash 5.x and I have a problem with logstah-input-jdbc plugin. My simple.conf works well while jdbc input is commented and it parses logs properly, but when it is enabled, logstash doesn't work (configte… --- ## [Ruby code limitation](https://discuss.elastic.co/t/ruby-code-limitation/70205)
**Author:** [@aydinnmu](https://discuss.elastic.co/u/aydinnmu)\ **Replies:** 1\ **Last updated:** [January 2, 2017, 6:53am UTC](https://discuss.elastic.co/t/ruby-code-limitation/70205 "2017-01-02T06:53:25Z")
Hi guys, is there any limitations on logstash using ruby filter ? can i run any code in the code section ? --- ## [Ruby date parsing](https://discuss.elastic.co/t/ruby-date-parsing/70067)
**Author:** [@aydinnmu](https://discuss.elastic.co/u/aydinnmu)\ **Replies:** 6\ **Last updated:** [January 2, 2017, 6:51am UTC](https://discuss.elastic.co/t/ruby-date-parsing/70067 "2017-01-02T06:51:47Z")
hi everyone, ruby section of my config file is like below. this works fine. i set the "timeid" and i mailed to me in body section. But it sends as a UTC time value. my timezone is UTC +3. can i change it ? logstash se… --- ## [Logstash How to configure UTC Time according to orcal time stamp](https://discuss.elastic.co/t/logstash-how-to-configure-utc-time-according-to-orcal-time-stamp/57567)
**Author:** [@ElsayedAwd](https://discuss.elastic.co/u/ElsayedAwd)\ **Replies:** 1\ **Last updated:** [January 1, 2017, 12:08pm UTC](https://discuss.elastic.co/t/logstash-how-to-configure-utc-time-according-to-orcal-time-stamp/57567 "2017-01-01T12:08:01Z")
I'am working with Elastic search Logstash ,catching updates from orcal data base into elastic search. My problem ==\> how to configure sql\_last\_value UTC time parameter with orcal time stamp. This is my configration =… --- ## [What is the recommended output for Logstash to Logstash forwarding?](https://discuss.elastic.co/t/what-is-the-recommended-output-for-logstash-to-logstash-forwarding/70211)
**Author:** [@fbaligand](https://discuss.elastic.co/u/fbaligand)\ **Replies:** 2\ **Last updated:** [December 31, 2016, 1:29pm UTC](https://discuss.elastic.co/t/what-is-the-recommended-output-for-logstash-to-logstash-forwarding/70211 "2016-12-31T13:29:50Z")
All is in the title :slight\_smile: --- ## [LogStash - Add properties in the logback and send them to Logstash](https://discuss.elastic.co/t/logstash-add-properties-in-the-logback-and-send-them-to-logstash/70172)
**Author:** [@AleGallagher](https://discuss.elastic.co/u/AleGallagher)\ **Replies:** 1\ **Last updated:** [December 31, 2016, 1:18pm UTC](https://discuss.elastic.co/t/logstash-add-properties-in-the-logback-and-send-them-to-logstash/70172 "2016-12-31T13:18:36Z")
I'm using Logback and Logstash in a SpringBoot application. In the logback.xml I have a property with the name of the service, and is like: configuration\> include resource="org/springframework/boot/logging/logback/de… --- ## [Date filter is not update field](https://discuss.elastic.co/t/date-filter-is-not-update-field/70069)
**Author:** [@ronnysh](https://discuss.elastic.co/u/ronnysh)\ **Replies:** 1\ **Last updated:** [December 31, 2016, 1:14pm UTC](https://discuss.elastic.co/t/date-filter-is-not-update-field/70069 "2016-12-31T13:14:09Z")
Hi Im using LS 2.3 with the following configuration: filter { if \[type\] == "egw\_total\_stats" { grok { match =\> \["message","\\\[%{TIMESTAMP\_ISO8601:localtimestamp}\\\]: %{NOTSPACE:filename} %{NUMBER:logdate} %{NOTSPA… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1057) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1059)