# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1064 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1065 --- ## [Synchronize Multiple jdbc inputs - Pool session error](https://discuss.elastic.co/t/synchronize-multiple-jdbc-inputs-pool-session-error/68837)
**Author:** [@mehdi-aouadi](https://discuss.elastic.co/u/mehdi-aouadi)\ **Replies:** 0\ **Last updated:** [December 13, 2016, 9:26am UTC](https://discuss.elastic.co/t/synchronize-multiple-jdbc-inputs-pool-session-error/68837 "2016-12-13T09:26:00Z")
I am using multiple jdbc inputs : jdbc { jdbc\_driver\_library =\> "../vendor/oracle/ojdbc7.jar" jdbc\_driver\_class =\> "Java::oracle.jdbc.driver.OracleDriver" connection\_retry\_attempts =\> 10 connection\_retry\_attempts\_… --- ## [Logstash Random Error](https://discuss.elastic.co/t/logstash-random-error/69080)
**Author:** [@chromechris](https://discuss.elastic.co/u/chromechris)\ **Replies:** 2\ **Last updated:** [December 15, 2016, 3:48pm UTC](https://discuss.elastic.co/t/logstash-random-error/69080 "2016-12-15T15:48:07Z")
I received this random error in my Logstash logs. My Logstash has been running fine, i'm not sure what could have caused this error. {:timestamp=\>"2016-09-30T14:42:14.342000-0700", :message=\>"Exception in pipelineworke… --- ## [Using kill -1 pid to force logstash to reload the configuration file does not take effect](https://discuss.elastic.co/t/using-kill-1-pid-to-force-logstash-to-reload-the-configuration-file-does-not-take-effect/68906)
**Author:** [@sockaddr\_in](https://discuss.elastic.co/u/sockaddr_in)\ **Replies:** 7\ **Last updated:** [December 15, 2016, 2:36pm UTC](https://discuss.elastic.co/t/using-kill-1-pid-to-force-logstash-to-reload-the-configuration-file-does-not-take-effect/68906 "2016-12-15T14:36:22Z")
I use the following method to make the logstash reload configuration file, but did not take effect, what is the reason? My logstash version: 5.1.1 The method comes from https://www.elastic.co/guide/en/logstash/current/… --- ## [Getting Maximum Bytes length Exception in Logstash Indexer](https://discuss.elastic.co/t/getting-maximum-bytes-length-exception-in-logstash-indexer/69011)
**Author:** [@NITIN-BHAISARE](https://discuss.elastic.co/u/NITIN-BHAISARE)\ **Replies:** 3\ **Last updated:** [December 15, 2016, 2:18pm UTC](https://discuss.elastic.co/t/getting-maximum-bytes-length-exception-in-logstash-indexer/69011 "2016-12-15T14:18:58Z")
Hey, I am continuously getting this error on the logstash indexer, I don't know how to resolve this. please, can somebody please help me out how to get this resolved. I have 3Millions messages waiting in the RabbitMQ wai… --- ## [Mark IP Value with an external list](https://discuss.elastic.co/t/mark-ip-value-with-an-external-list/69055)
**Author:** [@Vomitar](https://discuss.elastic.co/u/Vomitar)\ **Replies:** 9\ **Last updated:** [December 15, 2016, 1:49pm UTC](https://discuss.elastic.co/t/mark-ip-value-with-an-external-list/69055 "2016-12-15T13:49:59Z")
Hallo to everyone, it's my first topic here. scenario I have to check if some IP are SECURE and i do it checking the value (send me by apache logs) by an external list and so i have to mark or add a field . Here an … --- ## [How to use date-filter-plugin?](https://discuss.elastic.co/t/how-to-use-date-filter-plugin/35054)
**Author:** [@Alvin82](https://discuss.elastic.co/u/Alvin82)\ **Replies:** 3\ **Last updated:** [December 15, 2016, 1:37pm UTC](https://discuss.elastic.co/t/how-to-use-date-filter-plugin/35054 "2016-12-15T13:37:09Z")
I'm using date plugin, but i'm not able to match this timestamp log\_ts = 2015-11-19-11:14:23.8704 If i use this snippet code in the conf file date { match =\> \["log\_ts", "yyyy-MM-dd-HH:mm:ss.SSSS"\] } I obt… --- ## [Logstash XML file](https://discuss.elastic.co/t/logstash-xml-file/69149)
**Author:** [@magikbyte](https://discuss.elastic.co/u/magikbyte)\ **Replies:** 1\ **Last updated:** [December 15, 2016, 1:22pm UTC](https://discuss.elastic.co/t/logstash-xml-file/69149 "2016-12-15T13:22:09Z")
Hello, I need to parse XML file and send content to EL. It's work for XML input without space before xml tag like that : \ \ \tag1\ … --- ## [Probleme with grock logstash 5.0](https://discuss.elastic.co/t/probleme-with-grock-logstash-5-0/68149)
**Author:** [@pierre](https://discuss.elastic.co/u/pierre)\ **Replies:** 6\ **Last updated:** [December 15, 2016, 12:08pm UTC](https://discuss.elastic.co/t/probleme-with-grock-logstash-5-0/68149 "2016-12-15T12:08:07Z")
hey, i have a problem with logstash, syntax of logstash. my log is : 14\>1 2016-03-02T14:26:10.620+01:00 AAAAAAA-AAAA AA\_AAAA- AA\_FLOW\_SESSION\_CLOSE \[blablabla@2222.2.1.1.2.222 reason="idle Timeout" source-address="… --- ## [Logstash not reading the logs from file input](https://discuss.elastic.co/t/logstash-not-reading-the-logs-from-file-input/68524)
**Author:** [@shashi0905](https://discuss.elastic.co/u/shashi0905)\ **Replies:** 6\ **Last updated:** [December 15, 2016, 11:15am UTC](https://discuss.elastic.co/t/logstash-not-reading-the-logs-from-file-input/68524 "2016-12-15T11:15:56Z")
I am trying to configure logstash to push data from log files to elasticsearch, but logstash is not reading the log files specified in the file input. When run in debug mode, I see this message - "Plugin not defined i… --- ## [Java::oracle.jdbc.driver.OracleDriver not loaded](https://discuss.elastic.co/t/java-oracle-jdbc-driver-oracledriver-not-loaded/68866)
**Author:** [@Rudolf\_Reddy\_Macejka](https://discuss.elastic.co/u/Rudolf_Reddy_Macejka)\ **Replies:** 1\ **Last updated:** [December 15, 2016, 10:23am UTC](https://discuss.elastic.co/t/java-oracle-jdbc-driver-oracledriver-not-loaded/68866 "2016-12-15T10:23:46Z")
Hello, since I am trying to use logstash 5 my connection to Oracle stopped to work. On 2.1 it works perfectly with this configuration input { jdbc { jdbc\_driver\_library =\> "/home/tva/prototype/logstash-5.0.… --- ## [What are the disadvantages of this logstash configuration file?](https://discuss.elastic.co/t/what-are-the-disadvantages-of-this-logstash-configuration-file/69133)
**Author:** [@sockaddr\_in](https://discuss.elastic.co/u/sockaddr_in)\ **Replies:** 0\ **Last updated:** [December 15, 2016, 9:25am UTC](https://discuss.elastic.co/t/what-are-the-disadvantages-of-this-logstash-configuration-file/69133 "2016-12-15T09:25:04Z")
I use the redis subscription subscription model, the two machines catalina.out logs are written to a server on the same channel. Then in the output when I wrote a configuration file, the log will be two machines were sto… --- ## [Problem with cipher in beat input](https://discuss.elastic.co/t/problem-with-cipher-in-beat-input/67841)
**Author:** [@clemh78](https://discuss.elastic.co/u/clemh78)\ **Replies:** 5\ **Last updated:** [December 15, 2016, 9:22am UTC](https://discuss.elastic.co/t/problem-with-cipher-in-beat-input/67841 "2016-12-15T09:22:11Z")
Hello, I have a problem with the beat input in logstash. When i starting logstash, the beat input has an error with the cipher. This is the error in log : Pipeline aborted due to error {:exception=\>#LogStash::Con… --- ## [Timing issue caused by UTC in last\_run\_metadata\_path?](https://discuss.elastic.co/t/timing-issue-caused-by-utc-in-last-run-metadata-path/69124)
**Author:** [@hwudri](https://discuss.elastic.co/u/hwudri)\ **Replies:** 0\ **Last updated:** [December 15, 2016, 7:58am UTC](https://discuss.elastic.co/t/timing-issue-caused-by-utc-in-last-run-metadata-path/69124 "2016-12-15T07:58:02Z")
We have a setup where SLQ rows are shipped to a logserver every couple of minutes. The SQL is picked up, filtered by adding fields and replacing timestamp with the last election date of the SQL (from db), and sent on. Co… --- ## [Is there any way to check if SQL result data (unique id) already exists in ES document type (as a document\_id) when i insert data by using logstash?](https://discuss.elastic.co/t/is-there-any-way-to-check-if-sql-result-data-unique-id-already-exists-in-es-document-type-as-a-document-id-when-i-insert-data-by-using-logstash/69101)
**Author:** [@tanimoto](https://discuss.elastic.co/u/tanimoto)\ **Replies:** 0\ **Last updated:** [December 15, 2016, 2:07am UTC](https://discuss.elastic.co/t/is-there-any-way-to-check-if-sql-result-data-unique-id-already-exists-in-es-document-type-as-a-document-id-when-i-insert-data-by-using-logstash/69101 "2016-12-15T02:07:06Z")
found solution by myself. --- ## [When I use Codec plugins of multiline through TCP Input plugins to receive date from org.apache.log4j.net.SocketAppender(Log4j 1.x ) ,what charset of Codec plugins of multiline should be set?](https://discuss.elastic.co/t/when-i-use-codec-plugins-of-multiline-through-tcp-input-plugins-to-receive-date-from-org-apache-log4j-net-socketappender-log4j-1-x-what-charset-of-codec-plugins-of-multiline-should-be-set/68633)
**Author:** [@wenhuaixiang](https://discuss.elastic.co/u/wenhuaixiang)\ **Replies:** 1\ **Last updated:** [December 14, 2016, 10:15pm UTC](https://discuss.elastic.co/t/when-i-use-codec-plugins-of-multiline-through-tcp-input-plugins-to-receive-date-from-org-apache-log4j-net-socketappender-log4j-1-x-what-charset-of-codec-plugins-of-multiline-should-be-set/68633 "2016-12-14T22:15:23Z")
The log is that "Received an event that has a different character encoding than you configured {:text=\>"\\xAC\\xED\\u0000\\u0005sr\\u0000!org.apache.log4j.spi.LoggingEvent\\xF3\\xF2\\xB9#t\\v\\xB5?\\u0003\\u0000\\nZ\\u0000\\u0015mdcC… --- ## [Importing csv with geo locations using logstash 5 / kibana 5](https://discuss.elastic.co/t/importing-csv-with-geo-locations-using-logstash-5-kibana-5/68223)
**Author:** [@Snyder](https://discuss.elastic.co/u/Snyder)\ **Replies:** 9\ **Last updated:** [December 14, 2016, 9:49pm UTC](https://discuss.elastic.co/t/importing-csv-with-geo-locations-using-logstash-5-kibana-5/68223 "2016-12-14T21:49:11Z")
Hello, Can someone help me with the configuration of a logstash 5 conf file and/or kibana 5? I'm running logstash, elasticsearch and kibana locally on a mac 10.10.x. The topic is about the combination of loading csv fi… --- ## [GeoIp is not working with packetbeat](https://discuss.elastic.co/t/geoip-is-not-working-with-packetbeat/68451)
**Author:** [@kmroz](https://discuss.elastic.co/u/kmroz)\ **Replies:** 3\ **Last updated:** [December 14, 2016, 7:56pm UTC](https://discuss.elastic.co/t/geoip-is-not-working-with-packetbeat/68451 "2016-12-14T19:56:21Z")
input { beats { port =\> 7467 } } filter { geoip { source =\> "dest.ip" target =\> "dest.ip\_location" database =\> "/opt/geoip/GeoLite2-City.mmdb" (ive trie… --- ## [Logstash and multiple pipelines. Why are my pipelines merging?](https://discuss.elastic.co/t/logstash-and-multiple-pipelines-why-are-my-pipelines-merging/68920)
**Author:** [@djmcgreal](https://discuss.elastic.co/u/djmcgreal)\ **Replies:** 5\ **Last updated:** [December 14, 2016, 6:41pm UTC](https://discuss.elastic.co/t/logstash-and-multiple-pipelines-why-are-my-pipelines-merging/68920 "2016-12-14T18:41:16Z")
Hi stashers, I have two pipelines, A & B, both configured to process separate CSV files of different formats into separate indexes on the same Elastic Cloud cluster. Something very peculiar (to me...) is happening when t… --- ## [Logstash pusher performance: 2.2.4 vs 5.0.2](https://discuss.elastic.co/t/logstash-pusher-performance-2-2-4-vs-5-0-2/68481)
**Author:** [@Bevan](https://discuss.elastic.co/u/Bevan)\ **Replies:** 1\ **Last updated:** [December 14, 2016, 6:34pm UTC](https://discuss.elastic.co/t/logstash-pusher-performance-2-2-4-vs-5-0-2/68481 "2016-12-14T18:34:06Z")
We have a fairly active ELK stack set up with the following configuration: 1) Local pushers running on the application servers with: \* file input using multiline codec over multiple logfiles \* minimal filter adding host-… --- ## [XML filter doesnt parse PacketBeat output](https://discuss.elastic.co/t/xml-filter-doesnt-parse-packetbeat-output/69045)
**Author:** [@Vasyl](https://discuss.elastic.co/u/Vasyl)\ **Replies:** 0\ **Last updated:** [December 14, 2016, 4:12pm UTC](https://discuss.elastic.co/t/xml-filter-doesnt-parse-packetbeat-output/69045 "2016-12-14T16:12:54Z")
Hello, I have Packetbeat that ships data to logstash. In the http body from PacketBeat I have XML that I want to apply xml filter, but it doesn't seem to work. Here is the configuration. filter { xml { source =\>… --- ## [Logstash filter issue with tags](https://discuss.elastic.co/t/logstash-filter-issue-with-tags/69035)
**Author:** [@bob-bza](https://discuss.elastic.co/u/bob-bza)\ **Replies:** 0\ **Last updated:** [December 14, 2016, 3:14pm UTC](https://discuss.elastic.co/t/logstash-filter-issue-with-tags/69035 "2016-12-14T15:14:48Z")
I was not able to see tags what ever i passed in fileter "add\_tag" i can see tag what i was passing in filebeat "beat" input { beats { port =\> 5044 tags =\> \[ "beat" \] } } filter{ if "beat" in \[tags\] { if \[ty… --- ## [Syslog\_facility always set to kernel](https://discuss.elastic.co/t/syslog-facility-always-set-to-kernel/68955)
**Author:** [@norus](https://discuss.elastic.co/u/norus)\ **Replies:** 3\ **Last updated:** [December 14, 2016, 1:31pm UTC](https://discuss.elastic.co/t/syslog-facility-always-set-to-kernel/68955 "2016-12-14T13:31:56Z")
For some reason facility is always showing kernel (0) but in this test it should show syslog (5). "hits" : \[ { "\_index" : "filebeat-2016.12.14", "\_type" : "fbsyslog", "\_id" : "AVj6wwB4Si\_4urkNEHOu", "\_score" : … --- ## [How to setup Kafka input in Logstash](https://discuss.elastic.co/t/how-to-setup-kafka-input-in-logstash/67155)
**Author:** [@elasticheart](https://discuss.elastic.co/u/elasticheart)\ **Replies:** 2\ **Last updated:** [December 14, 2016, 12:59pm UTC](https://discuss.elastic.co/t/how-to-setup-kafka-input-in-logstash/67155 "2016-12-14T12:59:13Z")
Hi, I want to read from Kafka and I have the following configuration; kafka{ group\_id =\> "test-consumer-group" topics =\> \["testtopic"\] bootstrap\_servers =\> "192.168.0.1:\" codec =\> json } What port should I… --- ## [Logstash Configuration of 5.0.1](https://discuss.elastic.co/t/logstash-configuration-of-5-0-1/68883)
**Author:** [@ssasporta](https://discuss.elastic.co/u/ssasporta)\ **Replies:** 5\ **Last updated:** [December 14, 2016, 12:49pm UTC](https://discuss.elastic.co/t/logstash-configuration-of-5-0-1/68883 "2016-12-14T12:49:55Z")
After upgrading logstash to 5.0.1 , I am getting the following : WARNING: Could not find logstash.yml which is typically located in $LS\_HOME/config or /etc/logstash. You can specify the path using --path.settings. Cont… --- ## [Retrieve ES index with LS input plugin NOT(!) everytime from the beginning?](https://discuss.elastic.co/t/retrieve-es-index-with-ls-input-plugin-not-everytime-from-the-beginning/69009)
**Author:** [@fxiger](https://discuss.elastic.co/u/fxiger)\ **Replies:** 0\ **Last updated:** [December 14, 2016, 11:45am UTC](https://discuss.elastic.co/t/retrieve-es-index-with-ls-input-plugin-not-everytime-from-the-beginning/69009 "2016-12-14T11:45:41Z")
Hi, i'm currently retrieving data from an "external" elastic index and write the events into csv files (for later postprocessing). This works fine so far. My problem is: When i shutdown LS and restart it at a later po… --- ## [Triggering a command in logstash](https://discuss.elastic.co/t/triggering-a-command-in-logstash/69001)
**Author:** [@ilalorel](https://discuss.elastic.co/u/ilalorel)\ **Replies:** 2\ **Last updated:** [December 14, 2016, 10:26am UTC](https://discuss.elastic.co/t/triggering-a-command-in-logstash/69001 "2016-12-14T10:26:52Z")
Hello, I'm fairly new to the ELK stack (and also pretty new to Linux) . I have 2 servers 1 contains my ELK stack the other one is a honeypot with beats on it. Now my question, is it possible with logstash when someone co… --- ## [Logstash aggregate filter not working](https://discuss.elastic.co/t/logstash-aggregate-filter-not-working/68850)
**Author:** [@azeemdin](https://discuss.elastic.co/u/azeemdin)\ **Replies:** 1\ **Last updated:** [December 14, 2016, 9:59am UTC](https://discuss.elastic.co/t/logstash-aggregate-filter-not-working/68850 "2016-12-14T09:59:57Z")
Hi, I am using logstash logstash-2.4.1. I am running the instance using -w 1 flag as recommened for aggregate plugin. I am trying to parse my log file sample below START\*\*\*\*\*\*\* Multi line messsage could be XML EN… --- ## [Netflow codec - ipfix documentation?](https://discuss.elastic.co/t/netflow-codec-ipfix-documentation/68995)
**Author:** [@sliddjur](https://discuss.elastic.co/u/sliddjur)\ **Replies:** 0\ **Last updated:** [December 14, 2016, 9:54am UTC](https://discuss.elastic.co/t/netflow-codec-ipfix-documentation/68995 "2016-12-14T09:54:34Z")
According to this https://github.com/logstash-plugins/logstash-codec-netflow/commit/1ce994c643d32f4db1f0301f789b659c61c8accc it seems ipfix is supported in the codec. The official documentation says nothing about it th… --- ## [Output workers in elastic search plugin](https://discuss.elastic.co/t/output-workers-in-elastic-search-plugin/66478)
**Author:** [@Mayank\_Agrawal](https://discuss.elastic.co/u/Mayank_Agrawal)\ **Replies:** 3\ **Last updated:** [December 14, 2016, 9:32am UTC](https://discuss.elastic.co/t/output-workers-in-elastic-search-plugin/66478 "2016-12-14T09:32:00Z")
In the document of elastic search output plugin (document link), it is mentioned under 'workers' that "Output workers are no longer supported. Please use plugin workers". I did not understand the meaning of it. What do… --- ## [Elasticsearch filter fails randomly when using multiple workers](https://discuss.elastic.co/t/elasticsearch-filter-fails-randomly-when-using-multiple-workers/68025)
**Author:** [@GoYomE](https://discuss.elastic.co/u/GoYomE)\ **Replies:** 1\ **Last updated:** [December 14, 2016, 9:02am UTC](https://discuss.elastic.co/t/elasticsearch-filter-fails-randomly-when-using-multiple-workers/68025 "2016-12-14T09:02:36Z")
Hi, I've just upgraded my elastic stack from 1.5 to 2.4 and experienced some problems with the filter elasticsearch. After some tests, I finally realized that it was linked to the number of workers used. The problem on… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1063) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1065)