# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1074 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1075 --- ## [If clause seems not to be working](https://discuss.elastic.co/t/if-clause-seems-not-to-be-working/66757)
**Author:** [@Kernel\_Panic](https://discuss.elastic.co/u/Kernel_Panic)\ **Replies:** 2\ **Last updated:** [November 22, 2016, 8:31pm UTC](https://discuss.elastic.co/t/if-clause-seems-not-to-be-working/66757 "2016-11-22T20:31:19Z")
Hi guys. I'm just wanting to log different event to different indexes and I'm trying to achieve it by using tags. input { udp { port =\> 25826 type =\> "collectd" buffer\_size =\> 1452 codec =\> collectd {… --- ## [Getting "reason"=\>"geo\_point expected" error from geoip whilst indexing](https://discuss.elastic.co/t/getting-reason-geo-point-expected-error-from-geoip-whilst-indexing/66847)
**Author:** [@thomas.knowles](https://discuss.elastic.co/u/thomas.knowles)\ **Replies:** 2\ **Last updated:** [November 22, 2016, 7:46pm UTC](https://discuss.elastic.co/t/getting-reason-geo-point-expected-error-from-geoip-whilst-indexing/66847 "2016-11-22T19:46:01Z")
I have filebeat running on one of my servers which collects iptables and telnet logs, both feeds use the geoip filter plugin and both feed into the logstash for parsing and then subsequently into elasticsearch for storin… --- ## [Parsing the string with not specific delimeters](https://discuss.elastic.co/t/parsing-the-string-with-not-specific-delimeters/66683)
**Author:** [@saisn](https://discuss.elastic.co/u/saisn)\ **Replies:** 4\ **Last updated:** [November 22, 2016, 6:05pm UTC](https://discuss.elastic.co/t/parsing-the-string-with-not-specific-delimeters/66683 "2016-11-22T18:05:56Z")
I have a field which is of type string and holds a log data from which i need to identify specific fields as below. what could be the best way to do this when string doesn't have a fixed delimiter "Log": "2016-01-01T… --- ## [Input file plugin not reading bigger json events](https://discuss.elastic.co/t/input-file-plugin-not-reading-bigger-json-events/66787)
**Author:** [@satheeshravir](https://discuss.elastic.co/u/satheeshravir)\ **Replies:** 1\ **Last updated:** [November 22, 2016, 5:39pm UTC](https://discuss.elastic.co/t/input-file-plugin-not-reading-bigger-json-events/66787 "2016-11-22T17:39:42Z")
Hi, I am trying to process JSON logs using input-file plugin. Log is written to a json file. Input file plugin reads small JSON object without any issue (I don't know the exact size). When the JSON objects gets bigger it… --- ## [How to set elasticsearch upsert content in logstash](https://discuss.elastic.co/t/how-to-set-elasticsearch-upsert-content-in-logstash/66792)
**Author:** [@satheeshravir](https://discuss.elastic.co/u/satheeshravir)\ **Replies:** 1\ **Last updated:** [November 22, 2016, 5:33pm UTC](https://discuss.elastic.co/t/how-to-set-elasticsearch-upsert-content-in-logstash/66792 "2016-11-22T17:33:19Z")
I am trying to index/update same event as json chunks (due to event size limit set by input file plugin) using elastic search output plugin. I can see only the last updated chunk in the elastisearch index. I would like t… --- ## [How to check where logstash conf file is running or not through program](https://discuss.elastic.co/t/how-to-check-where-logstash-conf-file-is-running-or-not-through-program/66849)
**Author:** [@Roshan](https://discuss.elastic.co/u/Roshan)\ **Replies:** 3\ **Last updated:** [November 22, 2016, 1:44pm UTC](https://discuss.elastic.co/t/how-to-check-where-logstash-conf-file-is-running-or-not-through-program/66849 "2016-11-22T13:44:13Z")
Hi all, Is there any way to check any logstash conf file running or not through command or any other way. I have multiple logastash file which are working on simultaneously. Please suggest. --- ## [Elasticsearch output without 'type' field](https://discuss.elastic.co/t/elasticsearch-output-without-type-field/66841)
**Author:** [@pdesoyres](https://discuss.elastic.co/u/pdesoyres)\ **Replies:** 0\ **Last updated:** [November 22, 2016, 11:03am UTC](https://discuss.elastic.co/t/elasticsearch-output-without-type-field/66841 "2016-11-22T11:03:02Z")
Hi, I have the following configuration : input { http { code =\> "json" } } output { elasticsearch { index =\> "doc" } } This creates documents in the doc index with the default \_type '… --- ## [Logstash2.4 File Input doesn't work](https://discuss.elastic.co/t/logstash2-4-file-input-doesnt-work/66087)
**Author:** [@yiju](https://discuss.elastic.co/u/yiju)\ **Replies:** 6\ **Last updated:** [November 22, 2016, 10:41am UTC](https://discuss.elastic.co/t/logstash2-4-file-input-doesnt-work/66087 "2016-11-22T10:41:33Z")
Hi, I'm running logstash 2.4 as a service in Ubuntu 14.04. Here is my config: input { file { path =\> "/mnt/resource/hadoop/yarn/log/\*/\*/stderr" start\_position =\> beginning stat\_interval =\>… --- ## [Analyse the log files](https://discuss.elastic.co/t/analyse-the-log-files/66815)
**Author:** [@parmeet81](https://discuss.elastic.co/u/parmeet81)\ **Replies:** 5\ **Last updated:** [November 22, 2016, 10:36am UTC](https://discuss.elastic.co/t/analyse-the-log-files/66815 "2016-11-22T10:36:13Z")
Hi, I just finished setting up ELK on log server(one folder for each new issue) and edited my filebeat.yml file for the log folder. So the next step is to create index so that it can be easily searched. so do I need to… --- ## [FixProtocol delimiter confusion](https://discuss.elastic.co/t/fixprotocol-delimiter-confusion/66529)
**Author:** [@Ramesh\_Janagam](https://discuss.elastic.co/u/Ramesh_Janagam)\ **Replies:** 1\ **Last updated:** [November 22, 2016, 9:01am UTC](https://discuss.elastic.co/t/fixprotocol-delimiter-confusion/66529 "2016-11-22T09:01:04Z")
Hi All, We are processing FIX protocol messages in logstash( without Fix protocol plugin). but still I am not able to figure out 'delimiter'. We know its '\\001' in ascii but still it not working. In logstash its displ… --- ## [Collect logs from dmz](https://discuss.elastic.co/t/collect-logs-from-dmz/65241)
**Author:** [@nick76](https://discuss.elastic.co/u/nick76)\ **Replies:** 5\ **Last updated:** [November 22, 2016, 8:46am UTC](https://discuss.elastic.co/t/collect-logs-from-dmz/65241 "2016-11-22T08:46:13Z")
Hello all, I'm totally new about logstash. I want to install ELK on a local server (behind our firewall) and collect data from the DMZ. the data should be picked by logstash and not pushed by the front server. I read tha… --- ## [Logstash Config File json](https://discuss.elastic.co/t/logstash-config-file-json/38911)
**Author:** [@jpsphar1](https://discuss.elastic.co/u/jpsphar1)\ **Replies:** 10\ **Last updated:** [November 22, 2016, 8:00am UTC](https://discuss.elastic.co/t/logstash-config-file-json/38911 "2016-11-22T08:00:03Z")
Having issues with the following config file after following a tutorial from someone on the web. Main goal was to take a json file and load into logstash and bring over all fields from the original json file. My input is… --- ## [Multiple output in logstash config, pls help!](https://discuss.elastic.co/t/multiple-output-in-logstash-config-pls-help/66615)
**Author:** [@reo7189](https://discuss.elastic.co/u/reo7189)\ **Replies:** 6\ **Last updated:** [November 22, 2016, 7:42am UTC](https://discuss.elastic.co/t/multiple-output-in-logstash-config-pls-help/66615 "2016-11-22T07:42:01Z")
I managed to put multiple inputs/filters/outputs in one logstash conf, with no error or warning while running elasticsearch and logstash, but there is only one index in elasticsearch, pls help: my con is as below: in… --- ## [(5.x) Filter config fails/terminates silently](https://discuss.elastic.co/t/5-x-filter-config-fails-terminates-silently/66788)
**Author:** [@strarsis](https://discuss.elastic.co/u/strarsis)\ **Replies:** 0\ **Last updated:** [November 21, 2016, 9:50pm UTC](https://discuss.elastic.co/t/5-x-filter-config-fails-terminates-silently/66788 "2016-11-21T21:50:32Z")
With Logstash 5.x, filter configuration in conf.d fails silently and Logstash terminates without further notice, it worked in Logstash prior to 5.x. Input + output configuration also exists and Logstash runs fine and wit… --- ## [Issues with dates/times that don't have a timezone (Logstash/Kibana)](https://discuss.elastic.co/t/issues-with-dates-times-that-dont-have-a-timezone-logstash-kibana/66008)
**Author:** [@s33butler](https://discuss.elastic.co/u/s33butler)\ **Replies:** 7\ **Last updated:** [November 22, 2016, 12:21am UTC](https://discuss.elastic.co/t/issues-with-dates-times-that-dont-have-a-timezone-logstash-kibana/66008 "2016-11-22T00:21:11Z")
The basic issue is when I try and replace @timestamp with another date setting the timezone option all other dates are 5 hours off in Kibana because they are stored without a timezone and Kibana assumes they must be UT… --- ## [Logstash jdbc plugin password](https://discuss.elastic.co/t/logstash-jdbc-plugin-password/66448)
**Author:** [@FrankC](https://discuss.elastic.co/u/FrankC)\ **Replies:** 2\ **Last updated:** [November 21, 2016, 10:40pm UTC](https://discuss.elastic.co/t/logstash-jdbc-plugin-password/66448 "2016-11-21T22:40:26Z")
Hello, I am fairly new to logstash and plan to use the jdbc plugin to connect to oracle. Maybe I missed something, but I do not want to store the db password in the config file. What are the best options to provide … --- ## [Multiline codec - max\_age setting not recognized](https://discuss.elastic.co/t/multiline-codec-max-age-setting-not-recognized/65923)
**Author:** [@fhomam](https://discuss.elastic.co/u/fhomam)\ **Replies:** 2\ **Last updated:** [November 21, 2016, 9:23pm UTC](https://discuss.elastic.co/t/multiline-codec-max-age-setting-not-recognized/65923 "2016-11-21T21:23:21Z")
03:40:16.497 \[LogStash::Runner\] ERROR logstash.codecs.multiline - Unknown setting 'max\_age' for multiline CentOS release 6.8 (Final) logstash 5.0.0 --- ## [Start\_position: beggining](https://discuss.elastic.co/t/start-position-beggining/66763)
**Author:** [@chromechris](https://discuss.elastic.co/u/chromechris)\ **Replies:** 2\ **Last updated:** [November 21, 2016, 9:18pm UTC](https://discuss.elastic.co/t/start-position-beggining/66763 "2016-11-21T21:18:07Z")
Hello, I am wondering if I set my in my Logstash configuration, if I restart Logstash, will files that have already been processed be reprocessed, or will sincedb protect from reprocessing previously processed files, … --- ## [Inserting a Complex Nested Json from Postgres to Elasticsearch via Logstash](https://discuss.elastic.co/t/inserting-a-complex-nested-json-from-postgres-to-elasticsearch-via-logstash/58405)
**Author:** [@anushav85](https://discuss.elastic.co/u/anushav85)\ **Replies:** 11\ **Last updated:** [November 21, 2016, 6:42pm UTC](https://discuss.elastic.co/t/inserting-a-complex-nested-json-from-postgres-to-elasticsearch-via-logstash/58405 "2016-11-21T18:42:19Z")
Hi All, I am inserting a table into ES which contains a column that is of type Nested Jsonb (I am converting it to Json while extracting the data) in Postgres. This is my logstash conf file: input { jdbc { … --- ## [Logstash continously showing message , status as sleep](https://discuss.elastic.co/t/logstash-continously-showing-message-status-as-sleep/66755)
**Author:** [@nethis](https://discuss.elastic.co/u/nethis)\ **Replies:** 0\ **Last updated:** [November 21, 2016, 5:04pm UTC](https://discuss.elastic.co/t/logstash-continously-showing-message-status-as-sleep/66755 "2016-11-21T17:04:33Z")
I am using logstash to inpu data to elastic search from a file. From last 2 days , it is continously showing the below message, as status =\> Sleep. From few blogs, I could understand that it is due improper shutdown of e… --- ## [Indexing a local xml-file](https://discuss.elastic.co/t/indexing-a-local-xml-file/66710)
**Author:** [@Denny](https://discuss.elastic.co/u/Denny)\ **Replies:** 1\ **Last updated:** [November 21, 2016, 4:55pm UTC](https://discuss.elastic.co/t/indexing-a-local-xml-file/66710 "2016-11-21T16:55:57Z")
Hi, I have experience with indexing csv-files into elasticsearch but not with local xml-files. I am following this tutorial which explains how to index xml-data from a website with Logstash. My environment does not … --- ## [Logstash and elasticsearch behind HA-proxy](https://discuss.elastic.co/t/logstash-and-elasticsearch-behind-ha-proxy/66744)
**Author:** [@pdesoyres](https://discuss.elastic.co/u/pdesoyres)\ **Replies:** 2\ **Last updated:** [November 21, 2016, 4:52pm UTC](https://discuss.elastic.co/t/logstash-and-elasticsearch-behind-ha-proxy/66744 "2016-11-21T16:52:38Z")
Hello, I am trying to output events to elasticsearch : input { heartbeat { interval =\> 5 message =\> 'Hello from Logstash' } } output {elasticsearch {hosts =\> \[ 'http://registry.marathon.… --- ## [Logstash grok filter for metrics data](https://discuss.elastic.co/t/logstash-grok-filter-for-metrics-data/66621)
**Author:** [@M\_Situation](https://discuss.elastic.co/u/M_Situation)\ **Replies:** 2\ **Last updated:** [November 21, 2016, 4:48pm UTC](https://discuss.elastic.co/t/logstash-grok-filter-for-metrics-data/66621 "2016-11-21T16:48:43Z")
I'm processing some metrics data and store them into Elasticsearch. Now I want to get those data from Elasticsearch and apply a filter on them, the goal is to have more relevant fields after the logstash filtering. Fo… --- ## [Calling a python function in logstash](https://discuss.elastic.co/t/calling-a-python-function-in-logstash/66682)
**Author:** [@Mahdy\_S](https://discuss.elastic.co/u/Mahdy_S)\ **Replies:** 5\ **Last updated:** [November 21, 2016, 2:00pm UTC](https://discuss.elastic.co/t/calling-a-python-function-in-logstash/66682 "2016-11-21T14:00:22Z")
I'm using logstash to parse some files into elasticsearch. I would like to call a python function passing to it some arguments from logstash and then to add the value returned by the function in a new field in elasticsea… --- ## [How to parse the multiline json file through logstash](https://discuss.elastic.co/t/how-to-parse-the-multiline-json-file-through-logstash/60843)
**Author:** [@sharath3185](https://discuss.elastic.co/u/sharath3185)\ **Replies:** 6\ **Last updated:** [November 21, 2016, 12:55pm UTC](https://discuss.elastic.co/t/how-to-parse-the-multiline-json-file-through-logstash/60843 "2016-11-21T12:55:49Z")
Hi, I have a json file with below multiline json format: \[ { "status": "fail", "executiontime": 1117, "errormsg": "dummy error1", "testname": "test1", "errorcode": 0, … --- ## [Something is wrong with your configuration](https://discuss.elastic.co/t/something-is-wrong-with-your-configuration/66693)
**Author:** [@imperfection\_perfect](https://discuss.elastic.co/u/imperfection_perfect)\ **Replies:** 5\ **Last updated:** [November 21, 2016, 11:52am UTC](https://discuss.elastic.co/t/something-is-wrong-with-your-configuration/66693 "2016-11-21T11:52:47Z")
its difficult to post it on the phone but here is a link to stack overflow. http://stackoverflow.com/questions/40628896/reason-something-is-wrong-with-your-configuration-geoip-dat-mutate-logstash Can you please help. … --- ## [ElasticSearch filter - add tag](https://discuss.elastic.co/t/elasticsearch-filter-add-tag/66705)
**Author:** [@txisme](https://discuss.elastic.co/u/txisme)\ **Replies:** 0\ **Last updated:** [November 21, 2016, 11:24am UTC](https://discuss.elastic.co/t/elasticsearch-filter-add-tag/66705 "2016-11-21T11:24:39Z")
Hey, is it possible to do something like this: elasticsearch { hosts =\> \["es-server"\] query =\> "type:start AND operation:%{\[opid\]}" fields =\> { "@timestamp" =\> "started" } … --- ## [Indices folder names are random](https://discuss.elastic.co/t/indices-folder-names-are-random/66690)
**Author:** [@bopa](https://discuss.elastic.co/u/bopa)\ **Replies:** 6\ **Last updated:** [November 21, 2016, 9:36am UTC](https://discuss.elastic.co/t/indices-folder-names-are-random/66690 "2016-11-21T09:36:12Z")
I upgrade my ELK stack from 2.4 to 5.0. after the upgrade all my event log indices are saved as random words. like UcA4wqnpQs2D4AUdBpuRwg U6a2PE9mTduqAGfbDLT22g ZzOUMMSRRPukjy6muHRS2w Before the upgrade it was winlogb… --- ## [Problem reading SQL Server Data](https://discuss.elastic.co/t/problem-reading-sql-server-data/66220)
**Author:** [@Mark\_Austin](https://discuss.elastic.co/u/Mark_Austin)\ **Replies:** 7\ **Last updated:** [November 21, 2016, 8:50am UTC](https://discuss.elastic.co/t/problem-reading-sql-server-data/66220 "2016-11-21T08:50:06Z")
Morning all I have a simple table CREATE TABLE \[dbo\].\[DataAuditTable\]( \[Id\] \[int\] IDENTITY(1,1) NOT NULL, \[SystemAuditId\] \[int\] NOT NULL, \[RevisionStamp\] \[datetime\] NOT NULL, \[TableName\] \[nvarchar\](50) NOT NULL, … --- ## [Dissect Debugger coming in the future?](https://discuss.elastic.co/t/dissect-debugger-coming-in-the-future/66678)
**Author:** [@german23](https://discuss.elastic.co/u/german23)\ **Replies:** 1\ **Last updated:** [November 21, 2016, 7:32am UTC](https://discuss.elastic.co/t/dissect-debugger-coming-in-the-future/66678 "2016-11-21T07:32:27Z")
Hi folks, as i read the post on the elastic homepage about the new dissect filter and its advantages in performance over grok in some cases, i really want to start playing with it. As many of u know there is a grok d… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1073) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1075)