# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1065 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1066 --- ## [Logstash not ingesting syslog](https://discuss.elastic.co/t/logstash-not-ingesting-syslog/68613)
**Author:** [@sfchrisgleason](https://discuss.elastic.co/u/sfchrisgleason)\ **Replies:** 15\ **Last updated:** [December 14, 2016, 5:19am UTC](https://discuss.elastic.co/t/logstash-not-ingesting-syslog/68613 "2016-12-14T05:19:07Z")
Good evening. This is my first post here, so forgive me if I'm missing some rules here. I'll try to be as concise as possible: Issue: I am not able to get logstash to ingest Syslog files from servers using the syslog s… --- ## [Grok -\> patterns\_dir not working in logstash 1.5.0](https://discuss.elastic.co/t/grok-patterns-dir-not-working-in-logstash-1-5-0/1428)
**Author:** [@anoban](https://discuss.elastic.co/u/anoban)\ **Replies:** 3\ **Last updated:** [December 14, 2016, 4:08am UTC](https://discuss.elastic.co/t/grok-patterns-dir-not-working-in-logstash-1-5-0/1428 "2016-12-14T04:08:18Z")
... in the same way as it did in 1.4.2 I had a complex directory structure in 1.4.2, as I noticed grok would aggregate the patterns in alphabetical order. This gave me the ability to build a directory structure like: … --- ## [Logstash 5.1 custom patterns auto reload](https://discuss.elastic.co/t/logstash-5-1-custom-patterns-auto-reload/68794)
**Author:** [@ld\_pvl](https://discuss.elastic.co/u/ld_pvl)\ **Replies:** 1\ **Last updated:** [December 13, 2016, 9:53pm UTC](https://discuss.elastic.co/t/logstash-5-1-custom-patterns-auto-reload/68794 "2016-12-13T21:53:39Z")
Hi Elastic Community, I've been using logstash with the --config.reload.automatic (or -r) option to automatically reload the configuration however after some testing I came to understand that that option does not apply… --- ## [Could logstash log a warning when the file input plugin has 0 readable files?](https://discuss.elastic.co/t/could-logstash-log-a-warning-when-the-file-input-plugin-has-0-readable-files/68772)
**Author:** [@coder-98103](https://discuss.elastic.co/u/coder-98103)\ **Replies:** 2\ **Last updated:** [December 13, 2016, 8:57pm UTC](https://discuss.elastic.co/t/could-logstash-log-a-warning-when-the-file-input-plugin-has-0-readable-files/68772 "2016-12-13T20:57:32Z")
I am new to the Elastic Stack, so far it has been super-fun to learn. Thanks for making this great toolkit available! When getting started, I struggled with a number of newbie mistakes. There are quite a few things whi… --- ## [Logstash - adding shared field to link related logs](https://discuss.elastic.co/t/logstash-adding-shared-field-to-link-related-logs/68933)
**Author:** [@colm](https://discuss.elastic.co/u/colm)\ **Replies:** 0\ **Last updated:** [December 13, 2016, 8:05pm UTC](https://discuss.elastic.co/t/logstash-adding-shared-field-to-link-related-logs/68933 "2016-12-13T20:05:13Z")
i'm processing logs from multiple voice switches with logstash 5.0.1. the logs are often related to other logs by "call\_ids". i extract these into an array: event.set("call\_ids", event.get("message").scan(/\\s+Z\\S+\\s+(… --- ## [Error loading configuration after upgrading to 5.0.1](https://discuss.elastic.co/t/error-loading-configuration-after-upgrading-to-5-0-1/68886)
**Author:** [@ssasporta](https://discuss.elastic.co/u/ssasporta)\ **Replies:** 7\ **Last updated:** [December 13, 2016, 5:54pm UTC](https://discuss.elastic.co/t/error-loading-configuration-after-upgrading-to-5-0-1/68886 "2016-12-13T17:54:42Z")
I am getting the following error: "Couldn't find any filter plugin named 'multiline'. Are you sure this is correct? Trying to load the multiline filter plugin resulted in this error: LoadError"} What wrong? Thanks … --- ## [Does http\_poller handle https?](https://discuss.elastic.co/t/does-http-poller-handle-https/28864)
**Author:** [@CraigFoote](https://discuss.elastic.co/u/CraigFoote)\ **Replies:** 24\ **Last updated:** [December 13, 2016, 5:25pm UTC](https://discuss.elastic.co/t/does-http-poller-handle-https/28864 "2016-12-13T17:25:09Z")
This input plugin looks perfect for what I need except I need to call https and so must provide certificate information. I found this closed github issue, https://github.com/logstash-plugins/logstash-input-http\_poller/is… --- ## [Kafka plugin doesn't get updated to 0.10.1.0 in logstash 5.1.1](https://discuss.elastic.co/t/kafka-plugin-doesnt-get-updated-to-0-10-1-0-in-logstash-5-1-1/68908)
**Author:** [@sandeepkanabar](https://discuss.elastic.co/u/sandeepkanabar)\ **Replies:** 0\ **Last updated:** [December 13, 2016, 5:07pm UTC](https://discuss.elastic.co/t/kafka-plugin-doesnt-get-updated-to-0-10-1-0-in-logstash-5-1-1/68908 "2016-12-13T17:07:25Z")
Logstash 5.1.1 release page has a section on kafka enhancements that says If you need 0.10.1.0 support, you can install the latest version on 5.1 by using bin/logstash update logstash-input-kafka bin/logstash update … --- ## [Is there any way to kill / shut down logstash in graceful manner?](https://discuss.elastic.co/t/is-there-any-way-to-kill-shut-down-logstash-in-graceful-manner/28628)
**Author:** [@thiruna](https://discuss.elastic.co/u/thiruna)\ **Replies:** 5\ **Last updated:** [December 13, 2016, 4:45pm UTC](https://discuss.elastic.co/t/is-there-any-way-to-kill-shut-down-logstash-in-graceful-manner/28628 "2016-12-13T16:45:50Z")
Hi, We used to kill logstash process using kill -9 in our linux server. It looks we are forcefully shutting down the logstash. Is there anyway to shut down logstash in graceful manner. is kill -2 will be used for grace… --- ## [How can i replace all values in a table with null using logstash](https://discuss.elastic.co/t/how-can-i-replace-all-values-in-a-table-with-null-using-logstash/68654)
**Author:** [@saisn](https://discuss.elastic.co/u/saisn)\ **Replies:** 4\ **Last updated:** [December 13, 2016, 4:20pm UTC](https://discuss.elastic.co/t/how-can-i-replace-all-values-in-a-table-with-null-using-logstash/68654 "2016-12-13T16:20:50Z")
Hi, Lets say i have a table A and it has 5 fields and 100 rows. I need to put a filter on the whole records and replace null values with 'no data available'. How can i do this on the whole table? Thanks, Sai --- ## [Problem converting latitude and longitude into a geo point for Kibana](https://discuss.elastic.co/t/problem-converting-latitude-and-longitude-into-a-geo-point-for-kibana/52856)
**Author:** [@storri](https://discuss.elastic.co/u/storri)\ **Replies:** 14\ **Last updated:** [December 13, 2016, 3:58pm UTC](https://discuss.elastic.co/t/problem-converting-latitude-and-longitude-into-a-geo-point-for-kibana/52856 "2016-12-13T15:58:24Z")
I am having difficulty getting Logstash (2.2.4) to convert two parsed values, longitude and latitude, into a geo point for Kibana. The documentation for Elasticsearch presents an example for Geo Points where you make som… --- ## [Can't load costum output plugin with win32ole](https://discuss.elastic.co/t/cant-load-costum-output-plugin-with-win32ole/68890)
**Author:** [@itzikHan](https://discuss.elastic.co/u/itzikHan)\ **Replies:** 0\ **Last updated:** [December 13, 2016, 3:19pm UTC](https://discuss.elastic.co/t/cant-load-costum-output-plugin-with-win32ole/68890 "2016-12-13T15:19:37Z")
I have a new plugin file i did for LogStash, in which i am calling an external C# dll i have made. (Noob in both c# and ruby, So bare with me) In the plugin, I'm trying to require the following: require "logstash/outp… --- ## [Logstash parse\_exception geo\_point expected](https://discuss.elastic.co/t/logstash-parse-exception-geo-point-expected/65293)
**Author:** [@hishak](https://discuss.elastic.co/u/hishak)\ **Replies:** 13\ **Last updated:** [December 13, 2016, 2:49pm UTC](https://discuss.elastic.co/t/logstash-parse-exception-geo-point-expected/65293 "2016-12-13T14:49:20Z")
Hi, getting a parse\_exception error using Logstash 5.0.0. saying geo\_point expected. Here is the log from Logstash: \[2016-11-07T21:55:30,742\]\[WARN \]\[logstash.outputs.elasticsearch\] Failed action. {:status=\>400, :action… --- ## [Logstash grok pattern - optional fields](https://discuss.elastic.co/t/logstash-grok-pattern-optional-fields/68880)
**Author:** [@txisme](https://discuss.elastic.co/u/txisme)\ **Replies:** 1\ **Last updated:** [December 13, 2016, 2:39pm UTC](https://discuss.elastic.co/t/logstash-grok-pattern-optional-fields/68880 "2016-12-13T14:39:33Z")
Hey, im using Logstash 2.4 and i need to process log files so i am using grok patterns. I am having trouble with optional fields, i have several logs wich can have or not have a specific field, in this case "correlation… --- ## [Pipeline workers](https://discuss.elastic.co/t/pipeline-workers/68509)
**Author:** [@Fuzzy66](https://discuss.elastic.co/u/Fuzzy66)\ **Replies:** 7\ **Last updated:** [December 13, 2016, 2:20pm UTC](https://discuss.elastic.co/t/pipeline-workers/68509 "2016-12-13T14:20:29Z")
I am trying to read over 400+ files with logstash and it feels like its not able to keep up with all of them. I have updated my pipeline workers but nothing seems to help. Should I break it down into multiple logstas… --- ## [Logstash 5.0 configuration.invalid\_plugin\_register error in logs when using date filter](https://discuss.elastic.co/t/logstash-5-0-configuration-invalid-plugin-register-error-in-logs-when-using-date-filter/68276)
**Author:** [@orl1978](https://discuss.elastic.co/u/orl1978)\ **Replies:** 7\ **Last updated:** [December 13, 2016, 1:25pm UTC](https://discuss.elastic.co/t/logstash-5-0-configuration-invalid-plugin-register-error-in-logs-when-using-date-filter/68276 "2016-12-13T13:25:46Z")
hi there, I have the following config for logstash: \`input { file { path =\> "/csvfiles/\*.csv" type =\> "agents" start\_position =\> "beginning" sincedb\_path =\> "/csvfiles/dbfile" } } filter … --- ## [How to avoid multiple escaping](https://discuss.elastic.co/t/how-to-avoid-multiple-escaping/68737)
**Author:** [@Nikolay\_Shushkin](https://discuss.elastic.co/u/Nikolay_Shushkin)\ **Replies:** 2\ **Last updated:** [December 13, 2016, 1:17pm UTC](https://discuss.elastic.co/t/how-to-avoid-multiple-escaping/68737 "2016-12-13T13:17:31Z")
Hi, There is the following pipeline for Apache log: Logstash 2.2.2 input { beats { port =\> 4000 } } output { kafka { topic\_id =\> "my-topic" bootstrap\_servers =\> "kafka-server" } } Kafka 0.10.0.0 L… --- ## [Grok or CSV?](https://discuss.elastic.co/t/grok-or-csv/68738)
**Author:** [@Mario\_van\_Gemert](https://discuss.elastic.co/u/Mario_van_Gemert)\ **Replies:** 2\ **Last updated:** [December 13, 2016, 8:55am UTC](https://discuss.elastic.co/t/grok-or-csv/68738 "2016-12-13T08:55:33Z")
I have some data which looks like this: John Doe;Debrah ;19,95;13-07-2016 M.C. Hammer;Susan;19;14-07-2015 The first represents a customer name, which sometimes exist of one name, two names, or names with periods (.) T… --- ## [\_grokparsefailure but grokconstruktor is matching fine](https://discuss.elastic.co/t/-grokparsefailure-but-grokconstruktor-is-matching-fine/68691)
**Author:** [@danielw](https://discuss.elastic.co/u/danielw)\ **Replies:** 1\ **Last updated:** [December 13, 2016, 8:32am UTC](https://discuss.elastic.co/t/-grokparsefailure-but-grokconstruktor-is-matching-fine/68691 "2016-12-13T08:32:13Z")
I have some logs i want to ship to elastic. the format is quite simple 12.12.2016 10:57:11: OCR for ActID=4618887 ..\\n (2 pages 9,14s) The Match-Pattern looks like this (but i have allready tried… --- ## [Install logstash on Docker return LOGSTASH\_VERSION: not found](https://discuss.elastic.co/t/install-logstash-on-docker-return-logstash-version-not-found/68826)
**Author:** [@ruphin15](https://discuss.elastic.co/u/ruphin15)\ **Replies:** 0\ **Last updated:** [December 13, 2016, 8:00am UTC](https://discuss.elastic.co/t/install-logstash-on-docker-return-logstash-version-not-found/68826 "2016-12-13T08:00:18Z")
Hi, I'm new to Docker and Logstash, currently I'm trying to install logstash 5.1.1 on Docker. When I run the logstash it returned: "/opt/logstash/vendor/jruby/bin/jruby: line 14: LOGSTASH\_VERSION: not found" here… --- ## [How to keep ElasticSearch in sync with a database using LogStash](https://discuss.elastic.co/t/how-to-keep-elasticsearch-in-sync-with-a-database-using-logstash/66717)
**Author:** [@Erates](https://discuss.elastic.co/u/Erates)\ **Replies:** 3\ **Last updated:** [December 13, 2016, 6:52am UTC](https://discuss.elastic.co/t/how-to-keep-elasticsearch-in-sync-with-a-database-using-logstash/66717 "2016-12-13T06:52:50Z")
Hi, I'm relatively new to Logstash, and even though I've browsed the web for a few days now, I can not seem to find out how my problem should be handled. I have a database with roughly 35 million records. Every minut… --- ## [LogStash does not appear to be receiving files from FileBeat](https://discuss.elastic.co/t/logstash-does-not-appear-to-be-receiving-files-from-filebeat/68485)
**Author:** [@Airn5475](https://discuss.elastic.co/u/Airn5475)\ **Replies:** 12\ **Last updated:** [December 13, 2016, 6:32am UTC](https://discuss.elastic.co/t/logstash-does-not-appear-to-be-receiving-files-from-filebeat/68485 "2016-12-13T06:32:43Z")
I am new to Filebeats and LogStash and am feeling overwhelmed. My goal is to take .json files in through Filebeats to LogStash and finally onto Elasticsearch. I am currently working on my local dev machine running Wind… --- ## [Date filter not doing what it said it did](https://discuss.elastic.co/t/date-filter-not-doing-what-it-said-it-did/68526)
**Author:** [@todd-bowles-console](https://discuss.elastic.co/u/todd-bowles-console)\ **Replies:** 3\ **Last updated:** [December 13, 2016, 6:14am UTC](https://discuss.elastic.co/t/date-filter-not-doing-what-it-said-it-did/68526 "2016-12-13T06:14:43Z")
I have a particularly ruinous issue that is causing a me a lot of confusion. I have a number of logstash instances that pull out of Redis and insert into Elasticsearch as part of a greater ELK system. Some events sto… --- ## [File output not ordered with -w 1](https://discuss.elastic.co/t/file-output-not-ordered-with-w-1/68699)
**Author:** [@billy6](https://discuss.elastic.co/u/billy6)\ **Replies:** 1\ **Last updated:** [December 13, 2016, 3:51am UTC](https://discuss.elastic.co/t/file-output-not-ordered-with-w-1/68699 "2016-12-13T03:51:04Z")
Hello, I have a logstash configuration input{ elasticsearch { hosts=\> \[ "SERVERHOST"\] index =\> "logstash-syslog-2016.12.01" query =\> '{"filter" : { "term" : { "host.raw" : … --- ## [Logstash Plugin Installation takes a lot of time](https://discuss.elastic.co/t/logstash-plugin-installation-takes-a-lot-of-time/68721)
**Author:** [@gupta.yuvraj](https://discuss.elastic.co/u/gupta.yuvraj)\ **Replies:** 1\ **Last updated:** [December 13, 2016, 3:40am UTC](https://discuss.elastic.co/t/logstash-plugin-installation-takes-a-lot-of-time/68721 "2016-12-13T03:40:43Z")
I am using Elastic Stack 5.1.1 version. Observing that the Logstash plugin installation takes a lot of time. To specify around 1hr 23 minutes it took and still it didn't install the plugin. I have a decent internet conne… --- ## [Logstash Elasticsearch output error](https://discuss.elastic.co/t/logstash-elasticsearch-output-error/68726)
**Author:** [@dongz9](https://discuss.elastic.co/u/dongz9)\ **Replies:** 1\ **Last updated:** [December 13, 2016, 3:38am UTC](https://discuss.elastic.co/t/logstash-elasticsearch-output-error/68726 "2016-12-13T03:38:18Z")
Hi, I'm trying to setup a simple Elastic Stack where Logstash pulls data from Twitter and outputs to ES. output { elasticsearch { hosts =\> XXXXXX user =\> XXXXXX … --- ## [Logstash Plugin is not visible even after Successful installation](https://discuss.elastic.co/t/logstash-plugin-is-not-visible-even-after-successful-installation/68666)
**Author:** [@s8sg](https://discuss.elastic.co/u/s8sg)\ **Replies:** 1\ **Last updated:** [December 13, 2016, 2:17am UTC](https://discuss.elastic.co/t/logstash-plugin-is-not-visible-even-after-successful-installation/68666 "2016-12-13T02:17:02Z")
While installing plugin using logstash-plugin its says successful logstash/bin# ./logstash-plugin install logstash-filter-naxsi-0.9.2.gem Validating logstash-filter-naxsi-0.9.2.gem Installing logstash-filter… --- ## [Comma as delimiter in grok and null values](https://discuss.elastic.co/t/comma-as-delimiter-in-grok-and-null-values/68604)
**Author:** [@Miguel\_Bessa](https://discuss.elastic.co/u/Miguel_Bessa)\ **Replies:** 3\ **Last updated:** [December 12, 2016, 11:33pm UTC](https://discuss.elastic.co/t/comma-as-delimiter-in-grok-and-null-values/68604 "2016-12-12T23:33:34Z")
Hello everyone, I have a txt file with a log structure like this: field1,field2,field3,field4,field5,field6,field7,field8,field9,field10,field11,field12, field13,field14 As you can see, every field is delimited by c… --- ## [How to debug "Grok regexp threw exception"](https://discuss.elastic.co/t/how-to-debug-grok-regexp-threw-exception/47399)
**Author:** [@danielmotaleite](https://discuss.elastic.co/u/danielmotaleite)\ **Replies:** 2\ **Last updated:** [December 12, 2016, 8:26pm UTC](https://discuss.elastic.co/t/how-to-debug-grok-regexp-threw-exception/47399 "2016-12-12T20:26:03Z")
Hi, i have many grok rules and recently i notice this in the logs: {:timestamp=\>"2016-04-14T16:19:46.989000+0200", :message=\>"Grok regexp threw exception", :exception=\>"", :level=\>:warn} i have no exception text, so … --- ## [Logstash 5.x monitoring API - performance check](https://discuss.elastic.co/t/logstash-5-x-monitoring-api-performance-check/68701)
**Author:** [@Martin\_Duris](https://discuss.elastic.co/u/Martin_Duris)\ **Replies:** 2\ **Last updated:** [December 12, 2016, 8:10pm UTC](https://discuss.elastic.co/t/logstash-5-x-monitoring-api-performance-check/68701 "2016-12-12T20:10:35Z")
Hi do you know / it is possible to use new logstash monitoring API (https://www.elastic.co/guide/en/logstash/5.x/node-stats-api.html) to get information if Logstash is "capable" to digest all data that are send to him … [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1064) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1066)