# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1068 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1069 --- ## [Logstash installation error on ELK - Could not find logstash.yml](https://discuss.elastic.co/t/logstash-installation-error-on-elk-could-not-find-logstash-yml/68042)
**Author:** [@dasteven86](https://discuss.elastic.co/u/dasteven86)\ **Replies:** 2\ **Last updated:** [December 6, 2016, 8:12pm UTC](https://discuss.elastic.co/t/logstash-installation-error-on-elk-could-not-find-logstash-yml/68042 "2016-12-06T20:12:10Z")
hi i'm a total newbie regarding to ELK. i have setup a new debian system and installed the ELK Services with the official Documentation from here: https://www.elastic.co/guide/en/elastic-stack/current/installing-elastic… --- ## [Creates multiple messages](https://discuss.elastic.co/t/creates-multiple-messages/68204)
**Author:** [@Honda\_fred\_elk](https://discuss.elastic.co/u/Honda_fred_elk)\ **Replies:** 3\ **Last updated:** [December 6, 2016, 8:02pm UTC](https://discuss.elastic.co/t/creates-multiple-messages/68204 "2016-12-06T20:02:43Z")
Hi, I'm new to logstash exploring EKL As a starting.. I have simple config setup for logstash. input { file { path =\> "/appl/log/TestLogs/\*.log" start\_position =\> "beginning" } } output { elasticsea… --- ## [Filebeat to logstash multiple indexs](https://discuss.elastic.co/t/filebeat-to-logstash-multiple-indexs/67399)
**Author:** [@bob-bza](https://discuss.elastic.co/u/bob-bza)\ **Replies:** 21\ **Last updated:** [December 6, 2016, 6:21pm UTC](https://discuss.elastic.co/t/filebeat-to-logstash-multiple-indexs/67399 "2016-12-06T18:21:21Z")
i'm new to ELK was trying to configure filebeat on multiple instances. i have different types of logs. 1. kafka logs 2. zookeeper logs 3. hdfs logs 4. yarn logs . . . on all these instances i was trying to configure f… --- ## [Plugin JDBC](https://discuss.elastic.co/t/plugin-jdbc/67513)
**Author:** [@Diego\_Gomez](https://discuss.elastic.co/u/Diego_Gomez)\ **Replies:** 5\ **Last updated:** [December 6, 2016, 5:58pm UTC](https://discuss.elastic.co/t/plugin-jdbc/67513 "2016-12-06T17:58:03Z")
Hello, to a query because I can not make JDBC work, in the data where this "?" I do not know what to put so that logstash I take the data that are recorded in the database every 10 seconds, could help me to see the su… --- ## [Logstash creating 2 events for each line in json codec](https://discuss.elastic.co/t/logstash-creating-2-events-for-each-line-in-json-codec/68104)
**Author:** [@krishna\_chaitanya](https://discuss.elastic.co/u/krishna_chaitanya)\ **Replies:** 4\ **Last updated:** [December 6, 2016, 5:21pm UTC](https://discuss.elastic.co/t/logstash-creating-2-events-for-each-line-in-json-codec/68104 "2016-12-06T17:21:14Z")
I want to stream each json line being written to a log file into Logstash. I am using json codec in file input plugin. If I want to load entire file which is new at once, I can do with start\_position =\> beginning But… --- ## [How to setup logstash SSL with x-pack 5.0?](https://discuss.elastic.co/t/how-to-setup-logstash-ssl-with-x-pack-5-0/68185)
**Author:** [@robertchen117](https://discuss.elastic.co/u/robertchen117)\ **Replies:** 0\ **Last updated:** [December 6, 2016, 3:24pm UTC](https://discuss.elastic.co/t/how-to-setup-logstash-ssl-with-x-pack-5-0/68185 "2016-12-06T15:24:44Z")
I enabled the elasticsearch 5.0.1 SSL with following this doc: xpack.ssl.key: /home/es/config/x-pack/node01.key xpack.ssl.certificate: /home/es/config/x-pack/node01.crt xpack.ssl.certi… --- ## [Logstash ERROR - logstash.instrument.periodicpoller.jvm](https://discuss.elastic.co/t/logstash-error-logstash-instrument-periodicpoller-jvm/68180)
**Author:** [@FrankC](https://discuss.elastic.co/u/FrankC)\ **Replies:** 0\ **Last updated:** [December 6, 2016, 2:49pm UTC](https://discuss.elastic.co/t/logstash-error-logstash-instrument-periodicpoller-jvm/68180 "2016-12-06T14:49:17Z")
Hi, While loading csv files to logstash today I ran into the error message below. The load to ES did not stop. Any suggestions or help is appreciated. \> \[2016-12-06T08:34:09,976\]\[ERROR\]\[logstash.instrument.perio… --- ## [Logstash can't install the plugin](https://discuss.elastic.co/t/logstash-cant-install-the-plugin/68176)
**Author:** [@sitanxin](https://discuss.elastic.co/u/sitanxin)\ **Replies:** 0\ **Last updated:** [December 6, 2016, 1:47pm UTC](https://discuss.elastic.co/t/logstash-cant-install-the-plugin/68176 "2016-12-06T13:47:50Z")
I am trying to install 4 plugins for fresh logstash. But it does not work. The server can connect to internet. Logstash: Fresh untar, did not change. System: \[bpmuser@VM\_148\_227\_centos logstash-5.0.2\]$ cat /etc/redhat… --- ## [Logstash / grok pattern file](https://discuss.elastic.co/t/logstash-grok-pattern-file/68175)
**Author:** [@Deepak\_Mann](https://discuss.elastic.co/u/Deepak_Mann)\ **Replies:** 1\ **Last updated:** [December 6, 2016, 1:31pm UTC](https://discuss.elastic.co/t/logstash-grok-pattern-file/68175 "2016-12-06T13:31:01Z")
^(?:%{LOGLEVEL:level}):\\s\*%{DATA:message}\\s\*(?:%{JAVACLASS:caller\_class})\\s+\[%{WORD:loglevel}\]\\s+(\[\\s\*\\S+\\s+%{BASE10NUM:tstamp}.?\]\\s+)+(\[\\s\\S+\\s+%{BASE10NUM:memory}\\S\*\\s+\\S+\\s+%{BASE10NUM:total}.\*?\]) I have got this g… --- ## [Not able to post data](https://discuss.elastic.co/t/not-able-to-post-data/68162)
**Author:** [@Prateek\_Kshtriya](https://discuss.elastic.co/u/Prateek_Kshtriya)\ **Replies:** 2\ **Last updated:** [December 6, 2016, 11:46am UTC](https://discuss.elastic.co/t/not-able-to-post-data/68162 "2016-12-06T11:46:40Z")
Hi All, I am not able to post data using logstash 5.0.2 to elasticsearch5.0.1. I am getting below error- \\Logstash\\logstash-5.0.2\\bin\>logstash -f apache.conf Could not find log4j2 configuration at path /ELK/Logstash/… --- ## [Translate filter for most accurate NUMBER](https://discuss.elastic.co/t/translate-filter-for-most-accurate-number/67917)
**Author:** [@Hans](https://discuss.elastic.co/u/Hans)\ **Replies:** 0\ **Last updated:** [December 3, 2016, 5:31am UTC](https://discuss.elastic.co/t/translate-filter-for-most-accurate-number/67917 "2016-12-03T05:31:28Z")
Hi, I would like to use the translate filter to identify a match. So I have extracted the first 5 numbers and added this to different fields as per example below. Now I would like to lookup the value starting with the mo… --- ## [Filter for logstash](https://discuss.elastic.co/t/filter-for-logstash/68016)
**Author:** [@Deepak\_Mann](https://discuss.elastic.co/u/Deepak_Mann)\ **Replies:** 11\ **Last updated:** [December 6, 2016, 10:21am UTC](https://discuss.elastic.co/t/filter-for-logstash/68016 "2016-12-06T10:21:36Z")
launch TIMESTAMP START: 2016.11.15 05:30:23 INFO: 200000 packets. Current packet is class com.navtech.kernel.flat.FlatCombo \[Loader\] \[tstamp: 1866 time: 1851.4 (30:51) split: 03.2\] \[Memory: 3.320G total: 22.20G free: 18.… --- ## [Logstash filter (extractnumbers) install does not work](https://discuss.elastic.co/t/logstash-filter-extractnumbers-install-does-not-work/68073)
**Author:** [@Caspar\_Lourens](https://discuss.elastic.co/u/Caspar_Lourens)\ **Replies:** 10\ **Last updated:** [December 6, 2016, 10:02am UTC](https://discuss.elastic.co/t/logstash-filter-extractnumbers-install-does-not-work/68073 "2016-12-06T10:02:57Z")
Installed ELK 5.0.2 (Build 14476, Commit SHA 8f2ace74 ) on a clean server. Logstash is accepting data and elasticsearch is showing it's data. Now I want to make use of the config I already built in an older version. This… --- ## [Import xml file in to Elasticsearch through logstash](https://discuss.elastic.co/t/import-xml-file-in-to-elasticsearch-through-logstash/67827)
**Author:** [@amol\_sonawane1](https://discuss.elastic.co/u/amol_sonawane1)\ **Replies:** 4\ **Last updated:** [December 6, 2016, 8:40am UTC](https://discuss.elastic.co/t/import-xml-file-in-to-elasticsearch-through-logstash/67827 "2016-12-06T08:40:58Z")
I want to import xml file in to Elasticsearch through logstash. I created config file as follows: input { file { path =\> "D:/logstash-5.0.0/logstash-5.0.0/bin/data.xml" start\_position =\> "begin… --- ## [How to install logstash plugin in off line](https://discuss.elastic.co/t/how-to-install-logstash-plugin-in-off-line/68130)
**Author:** [@sitanxin](https://discuss.elastic.co/u/sitanxin)\ **Replies:** 1\ **Last updated:** [December 6, 2016, 6:49am UTC](https://discuss.elastic.co/t/how-to-install-logstash-plugin-in-off-line/68130 "2016-12-06T06:49:37Z")
When I use Internet to install logstash plugin, we met the blew issue: $ ./logstash-plugin install logstash-output-kafka Validating logstash-output-kafka Installing logstash-output-kafka Error Bundler::InstallError, retr… --- ## [Logstash crashes when receiving a bad message](https://discuss.elastic.co/t/logstash-crashes-when-receiving-a-bad-message/68050)
**Author:** [@graham.dalessandro](https://discuss.elastic.co/u/graham.dalessandro)\ **Replies:** 4\ **Last updated:** [December 6, 2016, 6:37am UTC](https://discuss.elastic.co/t/logstash-crashes-when-receiving-a-bad-message/68050 "2016-12-06T06:37:12Z")
Hello Fellow Logstashians, I am working on exporting Dynatrace data to SPLUNK via logstash. I am using the Dynatrace Real Time Business Transaction Feed and 2 instances of logstash with a redis queue in between. Every… --- ## [Logstash output Elasticsearch MapperParsingException\[Field name \[classes.loaded\] cannot contain '.'\]](https://discuss.elastic.co/t/logstash-output-elasticsearch-mapperparsingexception-field-name-classes-loaded-cannot-contain/68086)
**Author:** [@gearoid](https://discuss.elastic.co/u/gearoid)\ **Replies:** 1\ **Last updated:** [December 5, 2016, 9:08pm UTC](https://discuss.elastic.co/t/logstash-output-elasticsearch-mapperparsingexception-field-name-classes-loaded-cannot-contain/68086 "2016-12-05T21:08:47Z")
Hi I am running the latest version of Logstash \[5.02\] Elasticsearch \[5.0.2\] and Kibana \[5.0.2\], I'm using the http\_poller plugin in Logstash, nstalled it and got confirmation. I am trying to get spring actuator (metr… --- ## [Logstash 2.4 grok mutate real with comma delimiter](https://discuss.elastic.co/t/logstash-2-4-grok-mutate-real-with-comma-delimiter/67847)
**Author:** [@caecilie](https://discuss.elastic.co/u/caecilie)\ **Replies:** 3\ **Last updated:** [December 5, 2016, 9:07pm UTC](https://discuss.elastic.co/t/logstash-2-4-grok-mutate-real-with-comma-delimiter/67847 "2016-12-05T21:07:37Z")
I need to parse the following line: 2016-12-02 11:54:03,107 Tests run: 2344, Failures: 0, Errors: 1, Skipped: 14, Time elapsed: 1,480.535 sec \<\<\< FAILURE! - in com.werum.pasx.servicetests.ebrequipment.TestSuiteEbrEquipme… --- ## [Logstash stop sending the logs to the ElasticSearch](https://discuss.elastic.co/t/logstash-stop-sending-the-logs-to-the-elasticsearch/38393)
**Author:** [@maxcherednik](https://discuss.elastic.co/u/maxcherednik)\ **Replies:** 10\ **Last updated:** [December 5, 2016, 9:06pm UTC](https://discuss.elastic.co/t/logstash-stop-sending-the-logs-to-the-elasticsearch/38393 "2016-12-05T21:06:25Z")
Version: logstash-2.1.1 After elasticsearch was out for a while and the logstash generates error like this: {:timestamp=\>"2015-12-25T17:32:47.451000+0200", :message=\>"Attempted to send a bulk request to Elasticsearch c… --- ## [Will the Index get overwritten when multiple filebeats are inserting into same index?](https://discuss.elastic.co/t/will-the-index-get-overwritten-when-multiple-filebeats-are-inserting-into-same-index/68095)
**Author:** [@pramod\_kumar](https://discuss.elastic.co/u/pramod_kumar)\ **Replies:** 1\ **Last updated:** [December 5, 2016, 9:04pm UTC](https://discuss.elastic.co/t/will-the-index-get-overwritten-when-multiple-filebeats-are-inserting-into-same-index/68095 "2016-12-05T21:04:30Z")
Hi All, I have an ELK setup which has multiple filebeats in it and all these filebeat insert everything(All records) into one index, Will elasticsearch miss anything(Any Record) while reading records from multiple huge… --- ## [Is there a Puppet Module to install Logstash on Windows Servers?](https://discuss.elastic.co/t/is-there-a-puppet-module-to-install-logstash-on-windows-servers/68105)
**Author:** [@vikram\_yerneni](https://discuss.elastic.co/u/vikram_yerneni)\ **Replies:** 0\ **Last updated:** [December 5, 2016, 8:55pm UTC](https://discuss.elastic.co/t/is-there-a-puppet-module-to-install-logstash-on-windows-servers/68105 "2016-12-05T20:55:09Z")
Folks, Repeating same here again: Is there a Puppet Module to install Logstash on Windows Servers? :slight\_smile: This is for indexing the IIS& Application logs into the Elasticsearch setups. Please do let me know. T… --- ## [How to remove subfield using ruby](https://discuss.elastic.co/t/how-to-remove-subfield-using-ruby/68072)
**Author:** [@saisn](https://discuss.elastic.co/u/saisn)\ **Replies:** 4\ **Last updated:** [December 5, 2016, 8:51pm UTC](https://discuss.elastic.co/t/how-to-remove-subfield-using-ruby/68072 "2016-12-05T20:51:46Z")
Hi , I am using ruby filter to remove fields that start with 'ID'. In the same way how can i remove subfield of a field called 'outputdata'. Below, code couldn't remove. ruby { code =\> " event.to\_hash.keys.ea… --- ## [IIS Logs - Using Logstash as Forwarder and second Logstash Server indexing the data into Elasticsearch Cluster](https://discuss.elastic.co/t/iis-logs-using-logstash-as-forwarder-and-second-logstash-server-indexing-the-data-into-elasticsearch-cluster/67004)
**Author:** [@vikram\_yerneni](https://discuss.elastic.co/u/vikram_yerneni)\ **Replies:** 2\ **Last updated:** [December 5, 2016, 8:51pm UTC](https://discuss.elastic.co/t/iis-logs-using-logstash-as-forwarder-and-second-logstash-server-indexing-the-data-into-elasticsearch-cluster/67004 "2016-12-05T20:51:19Z")
Hello All, Here is the issue I am facing: I am using Logstash Agent as a forwarder on our Windows Server 2008 R2 for indexing the IIS logs. And for the logstash forwarder conf file I relied on this site: https://blog.s… --- ## [IIS Logs - Using Logstash as Forwarder and second Logstash Server indexing the data into Elasticsearch](https://discuss.elastic.co/t/iis-logs-using-logstash-as-forwarder-and-second-logstash-server-indexing-the-data-into-elasticsearch/66914)
**Author:** [@vikram\_yerneni](https://discuss.elastic.co/u/vikram_yerneni)\ **Replies:** 3\ **Last updated:** [December 5, 2016, 8:50pm UTC](https://discuss.elastic.co/t/iis-logs-using-logstash-as-forwarder-and-second-logstash-server-indexing-the-data-into-elasticsearch/66914 "2016-12-05T20:50:21Z")
Hello All, Here is the issue I am facing: I am using Logstash Agent as a forwarder on our Windows Server 2008 R2 for indexing the IIS logs. And for the logstash forwarder conf file I relied on this site: https://blog.sst… --- ## [LogStash Kafka and Json on windowws](https://discuss.elastic.co/t/logstash-kafka-and-json-on-windowws/68074)
**Author:** [@Kim-Kruse-Hansen](https://discuss.elastic.co/u/Kim-Kruse-Hansen)\ **Replies:** 0\ **Last updated:** [December 5, 2016, 4:59pm UTC](https://discuss.elastic.co/t/logstash-kafka-and-json-on-windowws/68074 "2016-12-05T16:59:59Z")
Hi there I am considering setting a Kafka setup in front my LogStash instances , so I tried enabling this on a 5.0 platform running on windows in a proof of concept setup. I am using filebeat and winlogbeat to send l… --- ## [How to enable TLS 1.2 on Logstash?](https://discuss.elastic.co/t/how-to-enable-tls-1-2-on-logstash/66883)
**Author:** [@fmhwong](https://discuss.elastic.co/u/fmhwong)\ **Replies:** 1\ **Last updated:** [December 5, 2016, 4:39pm UTC](https://discuss.elastic.co/t/how-to-enable-tls-1-2-on-logstash/66883 "2016-12-05T16:39:57Z")
I am running a Logstash 2.4.0 using the default configuration. However, it was reported that port 5043 doesn't have TLS 1.2 enabled. Do you have instructions on how to enable TLS 1.2? --- ## [Installting Logstash Plugins](https://discuss.elastic.co/t/installting-logstash-plugins/67957)
**Author:** [@xsallowed](https://discuss.elastic.co/u/xsallowed)\ **Replies:** 1\ **Last updated:** [December 5, 2016, 1:56pm UTC](https://discuss.elastic.co/t/installting-logstash-plugins/67957 "2016-12-05T13:56:52Z")
Hi I am trying to install logstash plugin and getting following error: Installing logstash-codec-nmap Plugin version conflict, aborting ERROR: Installation Aborted, message: Bundler could not find compatible versions … --- ## [How should I use sql\_last\_value in logstash?](https://discuss.elastic.co/t/how-should-i-use-sql-last-value-in-logstash/64595)
**Author:** [@Kulasangar\_Gowrisang](https://discuss.elastic.co/u/Kulasangar_Gowrisang)\ **Replies:** 10\ **Last updated:** [December 5, 2016, 9:45am UTC](https://discuss.elastic.co/t/how-should-i-use-sql-last-value-in-logstash/64595 "2016-12-05T09:45:31Z")
I'm quite unclear of what sql\_last\_value does when I give my statement as such: statement =\> "SELECT \* from mytable where id \> :sql\_last\_value" I can slightly understand the reason behind using it, where it doesn't br… --- ## [Set a filter to parses out a timestamp and uses it as the timestamp for the event](https://discuss.elastic.co/t/set-a-filter-to-parses-out-a-timestamp-and-uses-it-as-the-timestamp-for-the-event/67956)
**Author:** [@ssasporta](https://discuss.elastic.co/u/ssasporta)\ **Replies:** 11\ **Last updated:** [December 5, 2016, 10:24am UTC](https://discuss.elastic.co/t/set-a-filter-to-parses-out-a-timestamp-and-uses-it-as-the-timestamp-for-the-event/67956 "2016-12-05T10:24:27Z")
Hi, I am trying to configure logstash to parse out a field from the event and use it as timestamp. My input looks like that: \ \ \ \ \ **Author:** [@theo.bot](https://discuss.elastic.co/u/theo.bot)\ **Replies:** 5\ **Last updated:** [December 5, 2016, 9:19am UTC](https://discuss.elastic.co/t/logstash-mixin-csv-data/67614 "2016-12-05T09:19:43Z") Hi Is it possible to mix in csv data to enrich events? Kind regards Theo [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1067) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1069)