# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1060 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1061 --- ## [Logstash 5.1.1 "bad URI(is not URI?)"](https://discuss.elastic.co/t/logstash-5-1-1-bad-uri-is-not-uri/70062)
**Author:** [@andiroot](https://discuss.elastic.co/u/andiroot)\ **Replies:** 0\ **Last updated:** [December 27, 2016, 12:48pm UTC](https://discuss.elastic.co/t/logstash-5-1-1-bad-uri-is-not-uri/70062 "2016-12-27T12:48:20Z")
Hello. I try to run Logstash 5.1.1 but receive an error: "bad URI (is not URI?)". In logstash.yml host and port specified. Where is the problem ? Tell me please. Thank you. error: c: \\ Program Files \\ Logstash \\ bin\> l… --- ## [Unable to communicate with Elasticseach](https://discuss.elastic.co/t/unable-to-communicate-with-elasticseach/70057)
**Author:** [@gve](https://discuss.elastic.co/u/gve)\ **Replies:** 8\ **Last updated:** [December 27, 2016, 10:40am UTC](https://discuss.elastic.co/t/unable-to-communicate-with-elasticseach/70057 "2016-12-27T10:40:03Z")
Hi, I'm a newcomer in "Elastic World" so maybe my question is really stupid, but after few hours with my freind Google, I did not found the answer. I start with a brand new installation, following each part of document… --- ## [Logstash not creating right number of documents when passing folder as an argument](https://discuss.elastic.co/t/logstash-not-creating-right-number-of-documents-when-passing-folder-as-an-argument/69720)
**Author:** [@saisn](https://discuss.elastic.co/u/saisn)\ **Replies:** 5\ **Last updated:** [December 27, 2016, 10:37am UTC](https://discuss.elastic.co/t/logstash-not-creating-right-number-of-documents-when-passing-folder-as-an-argument/69720 "2016-12-27T10:37:56Z")
Hi, What I'm doing: Created 4 conf files under a root directory called XYZ. Each of these conf files will import 1000 rows from SQL and tables being imported are unique in all 4 conf files. when ran separately the numb… --- ## [When I want to use the 'count' value in metric, it returns nilClass](https://discuss.elastic.co/t/when-i-want-to-use-the-count-value-in-metric-it-returns-nilclass/70032)
**Author:** [@eastmxc](https://discuss.elastic.co/u/eastmxc)\ **Replies:** 2\ **Last updated:** [December 27, 2016, 10:34am UTC](https://discuss.elastic.co/t/when-i-want-to-use-the-count-value-in-metric-it-returns-nilclass/70032 "2016-12-27T10:34:22Z")
I'm doing some test, my filter is like the following: filter{ grok{ patterns\_dir =\> \["./my\_pattern"\] match =\> \["message","%{MY\_PATTERN:ppp}"\] remove\_field =\> \["message"\] add\_tag =\> "… --- ## [RuntimeException occurs when importing data from mysql](https://discuss.elastic.co/t/runtimeexception-occurs-when-importing-data-from-mysql/70050)
**Author:** [@catinred2](https://discuss.elastic.co/u/catinred2)\ **Replies:** 1\ **Last updated:** [December 27, 2016, 10:03am UTC](https://discuss.elastic.co/t/runtimeexception-occurs-when-importing-data-from-mysql/70050 "2016-12-27T10:03:55Z")
I am trying to import data from mysql to elastic by logstash-input-jdbc plugin. I've successfully imported simple data into elastic, the plugin works fine. But when it comes to complicated data table, e.g. some field co… --- ## [Could not find the error in logstash CONF](https://discuss.elastic.co/t/could-not-find-the-error-in-logstash-conf/69991)
**Author:** [@VijayKarthikeyan](https://discuss.elastic.co/u/VijayKarthikeyan)\ **Replies:** 4\ **Last updated:** [December 27, 2016, 5:46am UTC](https://discuss.elastic.co/t/could-not-find-the-error-in-logstash-conf/69991 "2016-12-27T05:46:34Z")
I have a logstash configuration which has the below error... \[2016-12-26T01:24:22,031\]\[FATAL\]\[logstash.runner \] The given configuration is invalid. Reason: Expected one of #, =\> at line 47, column 17 (byte 259… --- ## [Redis::CannotConnectError](https://discuss.elastic.co/t/redis-cannotconnecterror/69935)
**Author:** [@sockaddr\_in](https://discuss.elastic.co/u/sockaddr_in)\ **Replies:** 1\ **Last updated:** [December 27, 2016, 5:46am UTC](https://discuss.elastic.co/t/redis-cannotconnecterror/69935 "2016-12-27T05:46:13Z")
Hello, everyone, I used to connect redis logstash, and monitor the redis for the key, not the beginning of any problems, but after a very long period of time will be reported redis connection timeout error. Is this a war… --- ## [Plugin install on ubuntu fails](https://discuss.elastic.co/t/plugin-install-on-ubuntu-fails/69951)
**Author:** [@mcgrews3](https://discuss.elastic.co/u/mcgrews3)\ **Replies:** 2\ **Last updated:** [December 27, 2016, 3:16am UTC](https://discuss.elastic.co/t/plugin-install-on-ubuntu-fails/69951 "2016-12-27T03:16:13Z")
logstash version 5.1.1 I have gone through the documentation and installed logstash on ubuntu 14.04 twice - both times repeating the error. I have also reproduced the issue on my OS X mac-book-pro. It's also worth n… --- ## [Setting jvm.options with multiple logstash (5.x) instances on the same box](https://discuss.elastic.co/t/setting-jvm-options-with-multiple-logstash-5-x-instances-on-the-same-box/67765)
**Author:** [@Emanuele\_Verga](https://discuss.elastic.co/u/Emanuele_Verga)\ **Replies:** 4\ **Last updated:** [December 26, 2016, 8:25pm UTC](https://discuss.elastic.co/t/setting-jvm-options-with-multiple-logstash-5-x-instances-on-the-same-box/67765 "2016-12-26T20:25:12Z")
Hi all, we recently started looking into deploying multiple instances of logstash on the same box and noticed that when the logstash settings directory is changed from the default (/etc/logstash), the jvm.options file … --- ## [Define filter - to use second field as timestamp and add year](https://discuss.elastic.co/t/define-filter-to-use-second-field-as-timestamp-and-add-year/68684)
**Author:** [@ssasporta](https://discuss.elastic.co/u/ssasporta)\ **Replies:** 6\ **Last updated:** [December 26, 2016, 2:28pm UTC](https://discuss.elastic.co/t/define-filter-to-use-second-field-as-timestamp-and-add-year/68684 "2016-12-26T14:28:19Z")
My logs entries look like that: \<\\> \*\*\[Mar 01 14:55:18\]\*\* \[\[ACTIVE\] ExecuteThread: '5' for queue: 'weblogic.kernel.Default (self-tuning)'\] \[CM\] \[OMS\] (BasicParameter.getEffectiveDate) Exit \<\\> \[Mar 01 14:… --- ## [Logstash cannot recreate the connection to ORacle Db](https://discuss.elastic.co/t/logstash-cannot-recreate-the-connection-to-oracle-db/69998)
**Author:** [@nugusbayevkk](https://discuss.elastic.co/u/nugusbayevkk)\ **Replies:** 0\ **Last updated:** [December 26, 2016, 10:31am UTC](https://discuss.elastic.co/t/logstash-cannot-recreate-the-connection-to-oracle-db/69998 "2016-12-26T10:31:52Z")
Hello guys, i had problem: oracle database had been shutdowned and then begun next exceptions in logstash: logstash.inputs.jdbc \] Java::JavaSql::SQLRecoverableException: No more data to read from socket: i 've used… --- ## [Kindly suggest a filter strategy for "csv in csv" data](https://discuss.elastic.co/t/kindly-suggest-a-filter-strategy-for-csv-in-csv-data/69833)
**Author:** [@cprior](https://discuss.elastic.co/u/cprior)\ **Replies:** 6\ **Last updated:** [December 25, 2016, 6:10am UTC](https://discuss.elastic.co/t/kindly-suggest-a-filter-strategy-for-csv-in-csv-data/69833 "2016-12-25T06:10:27Z")
Dear all, I believe I have read all current filter docs, but still I'd like to get input from more knowledgeable folks: I want to parse with logstash curency counter information, structured like: The input is a text … --- ## [Does anyone have a grok for Barracuda SPAM filter?](https://discuss.elastic.co/t/does-anyone-have-a-grok-for-barracuda-spam-filter/47944)
**Author:** [@shanecentreedu](https://discuss.elastic.co/u/shanecentreedu)\ **Replies:** 1\ **Last updated:** [December 24, 2016, 1:41pm UTC](https://discuss.elastic.co/t/does-anyone-have-a-grok-for-barracuda-spam-filter/47944 "2016-12-24T13:41:50Z")
I'm wanting to send my Barracuda SPAM filter logs into ELK and wanted to know if anyone had already worked of a grok and filter for it? Barracuda has a great page that explains what the fields mean, but I'm still new … --- ## [Logstack netflow getting error for Netflowversion 9](https://discuss.elastic.co/t/logstack-netflow-getting-error-for-netflowversion-9/69902)
**Author:** [@rajunair](https://discuss.elastic.co/u/rajunair)\ **Replies:** 2\ **Last updated:** [December 24, 2016, 5:14am UTC](https://discuss.elastic.co/t/logstack-netflow-getting-error-for-netflowversion-9/69902 "2016-12-24T05:14:12Z")
Hi Team , During my testing it seems that logstah 5.1.1 is sending WARN message to process Netflow 9 messages In my setup Netflow 5 version is working fine . Any body knows root cases for this issue My error message… --- ## [Dependecy of logstash-filter-collate with old version of logstash-core-plugin-api](https://discuss.elastic.co/t/dependecy-of-logstash-filter-collate-with-old-version-of-logstash-core-plugin-api/69915)
**Author:** [@prebours](https://discuss.elastic.co/u/prebours)\ **Replies:** 1\ **Last updated:** [December 23, 2016, 5:08pm UTC](https://discuss.elastic.co/t/dependecy-of-logstash-filter-collate-with-old-version-of-logstash-core-plugin-api/69915 "2016-12-23T17:08:07Z")
Installing logstash-filter-collate fails: logstash-plugin install --version 2.0.4 logstash-filter-collate It seems that the plugin has a dependency on logstash-core-plugin-api (~\> 1.0) while I have the following gem i… --- ## [Security Exception with data/write/bulk](https://discuss.elastic.co/t/security-exception-with-data-write-bulk/69696)
**Author:** [@ggp](https://discuss.elastic.co/u/ggp)\ **Replies:** 6\ **Last updated:** [December 23, 2016, 3:54pm UTC](https://discuss.elastic.co/t/security-exception-with-data-write-bulk/69696 "2016-12-23T15:54:45Z")
I am trying to run logstash pipeline and getting below exception 13:10:00.102 \[\[main\]\>worker0\] WARN logstash.outputs.elasticsearch - Failed action. {:status=\>403, :action=\>\["index", {:\_id=\>"notifyuserprofile-webservic… --- ## [Logstash endless loop with starting and stopping](https://discuss.elastic.co/t/logstash-endless-loop-with-starting-and-stopping/69913)
**Author:** [@JoeLi](https://discuss.elastic.co/u/JoeLi)\ **Replies:** 1\ **Last updated:** [December 23, 2016, 2:12pm UTC](https://discuss.elastic.co/t/logstash-endless-loop-with-starting-and-stopping/69913 "2016-12-23T14:12:57Z")
Logstash 5.x keeps starting and stopping.... Here is my conf: input { tcp { port =\> 4560 codec =\> json\_lines } beats { port =\> 5044 codec =\> "json" } } output { if \[type\] … --- ## [How to split json value in log file using grok/regular expression](https://discuss.elastic.co/t/how-to-split-json-value-in-log-file-using-grok-regular-expression/69901)
**Author:** [@rajkamalkool6](https://discuss.elastic.co/u/rajkamalkool6)\ **Replies:** 3\ **Last updated:** [December 23, 2016, 11:36am UTC](https://discuss.elastic.co/t/how-to-split-json-value-in-log-file-using-grok-regular-expression/69901 "2016-12-23T11:36:57Z")
I have one log file which I need to extract the json content from the file and I need to parse it using logstash json filter. I wrote one grok pattern but which it is not working properly. Below is my log file. 2016-12… --- ## [Multi filebeat send log to 1 logstash](https://discuss.elastic.co/t/multi-filebeat-send-log-to-1-logstash/69730)
**Author:** [@Tr\_ng\_Trang](https://discuss.elastic.co/u/Tr_ng_Trang)\ **Replies:** 3\ **Last updated:** [December 23, 2016, 10:37am UTC](https://discuss.elastic.co/t/multi-filebeat-send-log-to-1-logstash/69730 "2016-12-23T10:37:29Z")
i want to use file beat in 2 server difference to send log from 2 file in each server to 1 server have logstash running on. How i configure in logstash configure file to determine exactly for each file beat then can to h… --- ## [Logstash not creating new field](https://discuss.elastic.co/t/logstash-not-creating-new-field/69352)
**Author:** [@kitex](https://discuss.elastic.co/u/kitex)\ **Replies:** 2\ **Last updated:** [December 23, 2016, 7:26am UTC](https://discuss.elastic.co/t/logstash-not-creating-new-field/69352 "2016-12-23T07:26:48Z")
My Log Line: 2016-12-18 05:30:46 kannel 2016-12-18 05:30:46 SMS HTTP-request sender:44176845678 request: 'The Today Date "18/12/2016",Adam Smith "18/12/2016",and Time "05:30" I have installed logstash from rpm package … --- ## [Logstash JDBC Input - SQL Query](https://discuss.elastic.co/t/logstash-jdbc-input-sql-query/41798)
**Author:** [@Architha](https://discuss.elastic.co/u/Architha)\ **Replies:** 3\ **Last updated:** [December 22, 2016, 11:56pm UTC](https://discuss.elastic.co/t/logstash-jdbc-input-sql-query/41798 "2016-12-22T23:56:26Z")
Hi all, I have a table where the data is in the following manner : My requirement is a documnet on Elastic Search that is like : { "\_index" : "Library", "\_type" : "books", "\_id" : "1", "\_score" : 1.0, "\_sourc… --- ## [RESOLVED: Select a grok pattern and add “my\_body” field](https://discuss.elastic.co/t/resolved-select-a-grok-pattern-and-add-my-body-field/69220)
**Author:** [@bo9354](https://discuss.elastic.co/u/bo9354)\ **Replies:** 5\ **Last updated:** [December 22, 2016, 11:44pm UTC](https://discuss.elastic.co/t/resolved-select-a-grok-pattern-and-add-my-body-field/69220 "2016-12-22T23:44:32Z")
I want to be able to select a grok pattern and add “my\_body” field to it to force an action later. I can get it to add multiple tags or no tags, but not a single tag. Below is the latest filter version of many iterations… --- ## [Conditionals: check field type](https://discuss.elastic.co/t/conditionals-check-field-type/54527)
**Author:** [@ebuildy](https://discuss.elastic.co/u/ebuildy)\ **Replies:** 3\ **Last updated:** [December 22, 2016, 9:25pm UTC](https://discuss.elastic.co/t/conditionals-check-field-type/54527 "2016-12-22T21:25:24Z")
With the following logstash config: filter { if \[client\] { if \[ip\] in \[client\] {} } } Which is converted as: if (((x = event\["\[client\]"\]; x.respond\_to?(:include?) && x.include?(event\["\[ip\]"\])))) # if \[ip… --- ## [Backslashes in the query string JSONs not supported?](https://discuss.elastic.co/t/backslashes-in-the-query-string-jsons-not-supported/69841)
**Author:** [@Dom-nik](https://discuss.elastic.co/u/Dom-nik)\ **Replies:** 0\ **Last updated:** [December 22, 2016, 7:40pm UTC](https://discuss.elastic.co/t/backslashes-in-the-query-string-jsons-not-supported/69841 "2016-12-22T19:40:54Z")
I'm having a hard time using the elasticsearch filter plugin, but it seems that the problem is more generic (Logstash JSON parser seems not to understand backslashes in the query strings that it passes to ES), so I'm pos… --- ## [Grok multiple matches issue](https://discuss.elastic.co/t/grok-multiple-matches-issue/69838)
**Author:** [@Nil1](https://discuss.elastic.co/u/Nil1)\ **Replies:** 0\ **Last updated:** [December 22, 2016, 7:20pm UTC](https://discuss.elastic.co/t/grok-multiple-matches-issue/69838 "2016-12-22T19:20:07Z")
Hellow, so i have a Log file with something like this --57da9965-A-- \[19/Dec/2016:12:43:11 +0000\] WFfVasd338AAQEAAffdd9yBYAAAAF XX.XX.XX.XX 29364 XX.XX.XX.XX 80 --57da9965-B-- HEAD / HTTP/1.0 --a5519525-A-- \[19/Dec/2… --- ## [Logstash Bulk load balancing](https://discuss.elastic.co/t/logstash-bulk-load-balancing/69828)
**Author:** [@eperry](https://discuss.elastic.co/u/eperry)\ **Replies:** 0\ **Last updated:** [December 22, 2016, 5:31pm UTC](https://discuss.elastic.co/t/logstash-bulk-load-balancing/69828 "2016-12-22T17:31:22Z")
I have 12 Logstash Indexers (Reading off of kafka) and have been noticing that sometimes only one Data node is processing all of the bulk requests. Is there something missing in my logstash configurations I guess I c… --- ## [No log entry after adding date match filter](https://discuss.elastic.co/t/no-log-entry-after-adding-date-match-filter/69616)
**Author:** [@Len\_Rugen](https://discuss.elastic.co/u/Len_Rugen)\ **Replies:** 3\ **Last updated:** [December 22, 2016, 4:55pm UTC](https://discuss.elastic.co/t/no-log-entry-after-adding-date-match-filter/69616 "2016-12-22T16:55:44Z")
With the date fields below commented out, I get events logged, but with the wrong timestamp. Removing the comment I get nothing logged and no error messages, at least that I can find. The timezone line doesn't matter… --- ## [Sincedb is not created](https://discuss.elastic.co/t/sincedb-is-not-created/52648)
**Author:** [@cokeroman](https://discuss.elastic.co/u/cokeroman)\ **Replies:** 5\ **Last updated:** [December 22, 2016, 3:52pm UTC](https://discuss.elastic.co/t/sincedb-is-not-created/52648 "2016-12-22T15:52:10Z")
Hello all, I just update my logstash server from 1.5.4 to 2.3.2. I have to update some config parameters and I am collect log from several file and indexing to elasticsearch. My problem is when the logstash processs… --- ## [The Pipeline is Blocked, due to node\_not\_connected\_exception with connection to Data Nodes](https://discuss.elastic.co/t/the-pipeline-is-blocked-due-to-node-not-connected-exception-with-connection-to-data-nodes/69602)
**Author:** [@seth.yes](https://discuss.elastic.co/u/seth.yes)\ **Replies:** 3\ **Last updated:** [December 22, 2016, 3:26pm UTC](https://discuss.elastic.co/t/the-pipeline-is-blocked-due-to-node-not-connected-exception-with-connection-to-data-nodes/69602 "2016-12-22T15:26:42Z")
After noticing an extreme slowdown in my pipeline (from 2500 events/sec to ~600 events/sec), I started logstash with verbosity and am seeing that the events I'm expecting to index are being dropped due to a node\_not\_conn… --- ## [Elaticsearch index for MongoDB Cluster- best practice](https://discuss.elastic.co/t/elaticsearch-index-for-mongodb-cluster-best-practice/69812)
**Author:** [@Arun\_Ramaswamy](https://discuss.elastic.co/u/Arun_Ramaswamy)\ **Replies:** 0\ **Last updated:** [December 22, 2016, 3:22pm UTC](https://discuss.elastic.co/t/elaticsearch-index-for-mongodb-cluster-best-practice/69812 "2016-12-22T15:22:25Z")
Hi, We have MongoDB in a 3 node cluster environment and I have created 3 individual index for each of the node. Can you please advice what is the best practice that I need to follow on keeping individual index for each… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1059) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1061)