# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1066 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1067 --- ## [Documentation for accepted conditionals syntax in logstash filter](https://discuss.elastic.co/t/documentation-for-accepted-conditionals-syntax-in-logstash-filter/68736)
**Author:** [@valugi](https://discuss.elastic.co/u/valugi)\ **Replies:** 1\ **Last updated:** [December 12, 2016, 4:45pm UTC](https://discuss.elastic.co/t/documentation-for-accepted-conditionals-syntax-in-logstash-filter/68736 "2016-12-12T16:45:52Z")
I failed to find the full documentation on how to use conditionals inside filter block. Is this syntax valid: filter { if \[tags\] == "A" and \[tags\] == "B" { grok { .... } } or should I use if "A" in \[tags… --- ## [Using Logstash as a bulk index buffer to ES](https://discuss.elastic.co/t/using-logstash-as-a-bulk-index-buffer-to-es/68090)
**Author:** [@Quentin\_Leffray](https://discuss.elastic.co/u/Quentin_Leffray)\ **Replies:** 13\ **Last updated:** [December 12, 2016, 4:44pm UTC](https://discuss.elastic.co/t/using-logstash-as-a-bulk-index-buffer-to-es/68090 "2016-12-12T16:44:36Z")
Hi, I'm trying to use Logstash as a buffering tool to spread large spikes of bulk requests across time, so they don't crash my ES cluster. The idea is to consume documents from a Redis queue and upload them directly to… --- ## [Adding a new field from multiple fields and including a newline](https://discuss.elastic.co/t/adding-a-new-field-from-multiple-fields-and-including-a-newline/68418)
**Author:** [@elvarb](https://discuss.elastic.co/u/elvarb)\ **Replies:** 2\ **Last updated:** [December 12, 2016, 4:06pm UTC](https://discuss.elastic.co/t/adding-a-new-field-from-multiple-fields-and-including-a-newline/68418 "2016-12-12T16:06:41Z")
I have an event with multiple fields and I want to create a new summary field with specific details but also want to add the newline character in that field. No matter what I try the add\_field option in mutate does not w… --- ## [Running Logstash as a service spawns different processes](https://discuss.elastic.co/t/running-logstash-as-a-service-spawns-different-processes/68641)
**Author:** [@gupta.yuvraj](https://discuss.elastic.co/u/gupta.yuvraj)\ **Replies:** 2\ **Last updated:** [December 12, 2016, 2:17pm UTC](https://discuss.elastic.co/t/running-logstash-as-a-service-spawns-different-processes/68641 "2016-12-12T14:17:06Z")
When running logstash as a service on Ubuntu 14.04 using following command:- sudo initctl start logstash Observing that a new logstash process is spawned after every 15 seconds. If logstash has started with process… --- ## [Logstash not processing JSON files](https://discuss.elastic.co/t/logstash-not-processing-json-files/68717)
**Author:** [@Airn5475](https://discuss.elastic.co/u/Airn5475)\ **Replies:** 0\ **Last updated:** [December 12, 2016, 2:01pm UTC](https://discuss.elastic.co/t/logstash-not-processing-json-files/68717 "2016-12-12T14:01:50Z")
I am trying to get FileBeat working with Logstash, but not having much luck. I decided to see if I could simply get Logstash to take in JSON files and dump them to Elasticsearch. I started with a basic console to Elast… --- ## [Logstash-filter-cipher won't install (for me) against logstash 5.0.2](https://discuss.elastic.co/t/logstash-filter-cipher-wont-install-for-me-against-logstash-5-0-2/68576)
**Author:** [@kallax](https://discuss.elastic.co/u/kallax)\ **Replies:** 2\ **Last updated:** [December 12, 2016, 1:45pm UTC](https://discuss.elastic.co/t/logstash-filter-cipher-wont-install-for-me-against-logstash-5-0-2/68576 "2016-12-12T13:45:23Z")
apologies in advance if this is not the correct forum for this question... i'm unable to install logstash-filter-cipher. when i try, i get the below error. i'm running centos7. any help appreciated $ ./logstash --… --- ## [Codec configuration problem](https://discuss.elastic.co/t/codec-configuration-problem/68714)
**Author:** [@Felipe\_Santos](https://discuss.elastic.co/u/Felipe_Santos)\ **Replies:** 1\ **Last updated:** [December 12, 2016, 1:35pm UTC](https://discuss.elastic.co/t/codec-configuration-problem/68714 "2016-12-12T13:35:30Z")
I create a codec for protobuf3 and I'm with same problem of this issue here I'm using logstash 2.4 Any tips about this? --- ## [Filtering multiple logs](https://discuss.elastic.co/t/filtering-multiple-logs/68685)
**Author:** [@ilalorel](https://discuss.elastic.co/u/ilalorel)\ **Replies:** 4\ **Last updated:** [December 12, 2016, 11:01am UTC](https://discuss.elastic.co/t/filtering-multiple-logs/68685 "2016-12-12T11:01:21Z")
Hello i'm fairly new to logstash, so far i've managed to set up 2 servers, one is running the elastic stack and the other one is sending logs with beats to my elk stack. Now I have 2 different logs that i'm filtering bot… --- ## [Date parsing error : Invalid format](https://discuss.elastic.co/t/date-parsing-error-invalid-format/68183)
**Author:** [@mehdi-aouadi](https://discuss.elastic.co/u/mehdi-aouadi)\ **Replies:** 1\ **Last updated:** [December 12, 2016, 10:32am UTC](https://discuss.elastic.co/t/date-parsing-error-invalid-format/68183 "2016-12-12T10:32:50Z")
I am trying to parse a date field from a jdbc input : SELECT TO\_CHAR(date\_column, 'YYYY-MM-DD') || 'T' || TO\_CHAR(date\_column, 'HH24:MI:SS') || 'Z' as "my\_date" FROM my\_table When I try to parse it in the filter so i… --- ## [Logstash Grok pattern not reflecting in kibana](https://discuss.elastic.co/t/logstash-grok-pattern-not-reflecting-in-kibana/68577)
**Author:** [@Spandana](https://discuss.elastic.co/u/Spandana)\ **Replies:** 2\ **Last updated:** [December 12, 2016, 9:11am UTC](https://discuss.elastic.co/t/logstash-grok-pattern-not-reflecting-in-kibana/68577 "2016-12-12T09:11:59Z")
Hi, I am using a simple pattern which works on grok debugger well but I don't see the fields in Kibana. I did config test before starting the log stash. filter { grok { match =\> { "message" =\> "%{LOGLEVEL:logleve… --- ## [Gelf & multiline plugin @ 5.x](https://discuss.elastic.co/t/gelf-multiline-plugin-5-x/68678)
**Author:** [@antdavidl](https://discuss.elastic.co/u/antdavidl)\ **Replies:** 0\ **Last updated:** [December 12, 2016, 8:23am UTC](https://discuss.elastic.co/t/gelf-multiline-plugin-5-x/68678 "2016-12-12T08:23:35Z")
Hi all! after some weeks trying to figure out how to use the multiline codec with the gelf input, I finally have thrown in the towel ... it should be something easy; there should be an easy way to do it, but I have not … --- ## [Writing to multiple Elasticsearch Nodes](https://discuss.elastic.co/t/writing-to-multiple-elasticsearch-nodes/68553)
**Author:** [@tomx1](https://discuss.elastic.co/u/tomx1)\ **Replies:** 2\ **Last updated:** [December 12, 2016, 7:54am UTC](https://discuss.elastic.co/t/writing-to-multiple-elasticsearch-nodes/68553 "2016-12-12T07:54:43Z")
I was just reading this article: https://www.elastic.co/guide/en/logstash/current/deploying-and-scaling.html I'm wondering how writing to multiple Elasticsearch nodes works in Logstash. In particular, let's assume I am… --- ## [Logstash persistent queue feature](https://discuss.elastic.co/t/logstash-persistent-queue-feature/68572)
**Author:** [@tomx1](https://discuss.elastic.co/u/tomx1)\ **Replies:** 2\ **Last updated:** [December 12, 2016, 7:41am UTC](https://discuss.elastic.co/t/logstash-persistent-queue-feature/68572 "2016-12-12T07:41:09Z")
I was just reading this article of the new Logstash persistent queue feature: Persistent queues (PQ) | Logstash Reference \[8.11\] | Elastic I think it's great that Logstash is now offering that feature, but theres a part… --- ## [Java sleep (Redundancy in logging “Flushing buffer at interval”)](https://discuss.elastic.co/t/java-sleep-redundancy-in-logging-flushing-buffer-at-interval/68527)
**Author:** [@extremeblue](https://discuss.elastic.co/u/extremeblue)\ **Replies:** 4\ **Last updated:** [December 12, 2016, 6:29am UTC](https://discuss.elastic.co/t/java-sleep-redundancy-in-logging-flushing-buffer-at-interval/68527 "2016-12-12T06:29:24Z")
I'm using logstash 2.3.2(jdbc input/elasticsearch output) and elasticsearch 2.3.3 from CentOS7. process status: Name: java State: S (sleeping) Tgid: 4486 Ngid: 0 Pid: 4486 PPid: 4485 TracerPid: … --- ## [Elasticsearch output workers for logstash 5.1](https://discuss.elastic.co/t/elasticsearch-output-workers-for-logstash-5-1/68638)
**Author:** [@rpuserh](https://discuss.elastic.co/u/rpuserh)\ **Replies:** 1\ **Last updated:** [December 12, 2016, 4:36am UTC](https://discuss.elastic.co/t/elasticsearch-output-workers-for-logstash-5-1/68638 "2016-12-12T04:36:01Z")
Hi, I want to open multiple connection to elastcsearch I used before workers =\> num but now it giving error. I found in documentation this workers Value type is string Default value is 1 Output workers are no lo… --- ## [Error on logstash during elasticsearch insert](https://discuss.elastic.co/t/error-on-logstash-during-elasticsearch-insert/68548)
**Author:** [@fdamico](https://discuss.elastic.co/u/fdamico)\ **Replies:** 1\ **Last updated:** [December 12, 2016, 4:28am UTC](https://discuss.elastic.co/t/error-on-logstash-during-elasticsearch-insert/68548 "2016-12-12T04:28:08Z")
Hi there I'm running locally Elastic Search 5.0.1 and Logstash 5.0.1. This is my logstash filter: input { file { path =\> "/Users/macosx/Desktop/logs/\*" start\_position =\> "beginning" ignore\_older =\> 0 … --- ## [Installing latest version 5.1.1 of Logstash on windows](https://discuss.elastic.co/t/installing-latest-version-5-1-1-of-logstash-on-windows/68647)
**Author:** [@yameya](https://discuss.elastic.co/u/yameya)\ **Replies:** 1\ **Last updated:** [December 12, 2016, 3:58am UTC](https://discuss.elastic.co/t/installing-latest-version-5-1-1-of-logstash-on-windows/68647 "2016-12-12T03:58:44Z")
I am trying to install the latest version of Logstash ie 5.1.1 on windows (Windows 7 Professional). I unziped the logstash installtion file in the path : C:\\Program Files\\logstash-5.1.1. Now when i try to test the logst… --- ## [Error while running logstash in Win7](https://discuss.elastic.co/t/error-while-running-logstash-in-win7/68508)
**Author:** [@dnafication](https://discuss.elastic.co/u/dnafication)\ **Replies:** 2\ **Last updated:** [December 11, 2016, 10:34pm UTC](https://discuss.elastic.co/t/error-while-running-logstash-in-win7/68508 "2016-12-11T22:34:25Z")
Getting the following error while running logstash: C:\\logstash-5.0.2\\bin\>java -version java version "1.8.0\_101" Java(TM) SE Runtime Environment (build 1.8.0\_101-b13) Java HotSpot(TM) 64-Bit Server VM (build 25.101-b13… --- ## [Logstash kafka-input-plugin problem](https://discuss.elastic.co/t/logstash-kafka-input-plugin-problem/68640)
**Author:** [@antimion](https://discuss.elastic.co/u/antimion)\ **Replies:** 0\ **Last updated:** [December 11, 2016, 9:30am UTC](https://discuss.elastic.co/t/logstash-kafka-input-plugin-problem/68640 "2016-12-11T09:30:47Z")
Hi all, i have a problem with kafka-input, my kafka version is 0.9.0.1 (cloudera distribution), and they need zk\_connect string to connect to the brokers, but in new version zk\_connect changed to bootstrap\_servers. and… --- ## [How does change the default of @timestamp?](https://discuss.elastic.co/t/how-does-change-the-default-of-timestamp/68626)
**Author:** [@wenhuaixiang](https://discuss.elastic.co/u/wenhuaixiang)\ **Replies:** 3\ **Last updated:** [December 11, 2016, 1:56am UTC](https://discuss.elastic.co/t/how-does-change-the-default-of-timestamp/68626 "2016-12-11T01:56:31Z")
The timezone of Linux system is +0800,but the timezone of Logstash is +0000.How can I change the logstash timezone? --- ## [Solr6 & Logstash 5: timestamp error](https://discuss.elastic.co/t/solr6-logstash-5-timestamp-error/67223)
**Author:** [@seanoc5](https://discuss.elastic.co/u/seanoc5)\ **Replies:** 1\ **Last updated:** [December 10, 2016, 11:25am UTC](https://discuss.elastic.co/t/solr6-logstash-5-timestamp-error/67223 "2016-12-10T11:25:18Z")
Hi all, I am new to logstash (and completely new to ruby) and hit a slight snag when using solr\_http. Apparently the tmiestamp code around line 65 in solr\_hhtp.rb has the following code: document\["@timestamp"\] = documen… --- ## [Pushing flush onto pipeline pipeline](https://discuss.elastic.co/t/pushing-flush-onto-pipeline-pipeline/68606)
**Author:** [@chromechris](https://discuss.elastic.co/u/chromechris)\ **Replies:** 0\ **Last updated:** [December 9, 2016, 9:13pm UTC](https://discuss.elastic.co/t/pushing-flush-onto-pipeline-pipeline/68606 "2016-12-09T21:13:32Z")
Hello, What does "pushing flush onto pipeline pipeline" mean in Logstash. I was running a Logstash instance in Debug Mode and saw that all my documents had been processed and shipped by Logstash, but kept getting the \<\<… --- ## [Array field in event](https://discuss.elastic.co/t/array-field-in-event/68475)
**Author:** [@kahndor](https://discuss.elastic.co/u/kahndor)\ **Replies:** 5\ **Last updated:** [December 9, 2016, 5:06pm UTC](https://discuss.elastic.co/t/array-field-in-event/68475 "2016-12-09T17:06:05Z")
I have an event that has many fields. These fields need to be arrays with other fields. Here is an example of what I want: "//ip//dst" : \[ { "type" : "ipv4", "value" : "192.168.1.2", "vis" : "U&FOUO" … --- ## [Duplicate Lines](https://discuss.elastic.co/t/duplicate-lines/68592)
**Author:** [@mavvv](https://discuss.elastic.co/u/mavvv)\ **Replies:** 0\ **Last updated:** [December 9, 2016, 5:00pm UTC](https://discuss.elastic.co/t/duplicate-lines/68592 "2016-12-09T17:00:32Z")
Hi all, I have a problem with my ELK configuration. I use : logstash 2.4.X Elasticsearch : 2.4.1 Kibana : 4.6.1 My Logstash.conf input { file { type =\> "MyAppLogs" path =\> "/var/log/myApp/\*.log" } } fi… --- ## [SOLVED: Logstash: how to expand numeric ranges? eg. 1-5 → 1 2 3 4 5](https://discuss.elastic.co/t/solved-logstash-how-to-expand-numeric-ranges-eg-1-5-1-2-3-4-5/67198)
**Author:** [@jose\_d](https://discuss.elastic.co/u/jose_d)\ **Replies:** 2\ **Last updated:** [December 9, 2016, 3:27pm UTC](https://discuss.elastic.co/t/solved-logstash-how-to-expand-numeric-ranges-eg-1-5-1-2-3-4-5/67198 "2016-12-09T15:27:28Z")
Hi, i'm trying to analyze aggregated information from slurm HPC scheduler, and need to expand ranges like n\[1-3,10-11\] to n1,n2,n3,n10,n11. Could it be done with some existing filter? --- ## [Issue parsing Apache log coming from Filebeat](https://discuss.elastic.co/t/issue-parsing-apache-log-coming-from-filebeat/68297)
**Author:** [@bicofino](https://discuss.elastic.co/u/bicofino)\ **Replies:** 4\ **Last updated:** [December 9, 2016, 12:14pm UTC](https://discuss.elastic.co/t/issue-parsing-apache-log-coming-from-filebeat/68297 "2016-12-09T12:14:53Z")
Hello all, I'm trying use ELK with Filebeat to parse some apache logs, but the filter never gets fired. ELK Server: Packages installed: logstash-5.0.2-1.noarch kibana-5.0.2-1.x86\_64 elasticsearch-5.0.2-1.noarch T… --- ## [High cpu and Beats input: the pipeline is blocked, temporary refusing new connection](https://discuss.elastic.co/t/high-cpu-and-beats-input-the-pipeline-is-blocked-temporary-refusing-new-connection/55270)
**Author:** [@xiongzhichaoelk](https://discuss.elastic.co/u/xiongzhichaoelk)\ **Replies:** 12\ **Last updated:** [December 9, 2016, 10:57am UTC](https://discuss.elastic.co/t/high-cpu-and-beats-input-the-pipeline-is-blocked-temporary-refusing-new-connection/55270 "2016-12-09T10:57:01Z")
when I start logstash after about 5 minutes ,the log :slight\_smile: the cpu 100% :slight\_smile: the config: the ela is normal: --- ## [Windows logstash Reload of .conf file](https://discuss.elastic.co/t/windows-logstash-reload-of-conf-file/68519)
**Author:** [@gauravkb](https://discuss.elastic.co/u/gauravkb)\ **Replies:** 1\ **Last updated:** [December 9, 2016, 7:11am UTC](https://discuss.elastic.co/t/windows-logstash-reload-of-conf-file/68519 "2016-12-09T07:11:50Z")
In linux logstash can read all configuration files under the /etc/logstash/conf.d/ directory automatically. but there is no such option available in windows, how do i reload the configuration file in windows automaticall… --- ## [Can we schedule and run multiple conf files simultaneously for Logstash?](https://discuss.elastic.co/t/can-we-schedule-and-run-multiple-conf-files-simultaneously-for-logstash/39865)
**Author:** [@Architha](https://discuss.elastic.co/u/Architha)\ **Replies:** 3\ **Last updated:** [December 9, 2016, 6:48am UTC](https://discuss.elastic.co/t/can-we-schedule-and-run-multiple-conf-files-simultaneously-for-logstash/39865 "2016-12-09T06:48:50Z")
Hi All, Can i schedule my logstash config files and run them ? Is there any tool for such purposes ? Please reply if you have a solution. Thanks in advance ! --- ## [Chinese characters as field names using logstash](https://discuss.elastic.co/t/chinese-characters-as-field-names-using-logstash/68506)
**Author:** [@HungryHumps](https://discuss.elastic.co/u/HungryHumps)\ **Replies:** 1\ **Last updated:** [December 9, 2016, 6:38am UTC](https://discuss.elastic.co/t/chinese-characters-as-field-names-using-logstash/68506 "2016-12-09T06:38:18Z")
Hello, I am trying to parse a csv file with its field names as Chinese characters, but logstash does not accept non-ASCII characters in the configuration file. Is there really no way of storing field names in chinese… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1065) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1067)