# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1079 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1080 --- ## [Ignoring text and carriage return characters with Grok](https://discuss.elastic.co/t/ignoring-text-and-carriage-return-characters-with-grok/65917)
**Author:** [@espogian](https://discuss.elastic.co/u/espogian)\ **Replies:** 1\ **Last updated:** [November 14, 2016, 7:59am UTC](https://discuss.elastic.co/t/ignoring-text-and-carriage-return-characters-with-grok/65917 "2016-11-14T07:59:29Z")
Hello, how can I manage log lines which have multiple /n and /r characters with Grok? My situation is like: CSeq:696603683 ACK\\r\\nMax-Forwards:70\\r\\nContent-Length:0 And I'm interested in CSeq and Content-Length. Max… --- ## [LogStash::ConfigurationError but ConfigurationOK - Logstash 2.4.0](https://discuss.elastic.co/t/logstash-configurationerror-but-configurationok-logstash-2-4-0/65727)
**Author:** [@csamson](https://discuss.elastic.co/u/csamson)\ **Replies:** 1\ **Last updated:** [November 14, 2016, 6:47am UTC](https://discuss.elastic.co/t/logstash-configurationerror-but-configurationok-logstash-2-4-0/65727 "2016-11-14T06:47:05Z")
I am tring to upgrade from Logstash 1.4.4 to Logstash 2.4.0 I have reused the same configuration file that we used before for parsing our application logs I am running Logstash 2.4.0 in debug mode and getting that bl… --- ## [Csv output plugin prints wrong stuff](https://discuss.elastic.co/t/csv-output-plugin-prints-wrong-stuff/65574)
**Author:** [@molejnik](https://discuss.elastic.co/u/molejnik)\ **Replies:** 1\ **Last updated:** [November 14, 2016, 6:43am UTC](https://discuss.elastic.co/t/csv-output-plugin-prints-wrong-stuff/65574 "2016-11-14T06:43:23Z")
I want to extract some fields from my log file and write them to a file in csv format. Say I have a simple log file: SimpleLog.txt: Test.cpp:1234 error Test.cpp:1277 success Other.cpp:12 Error Last.java:57 Succ My lo… --- ## [What is heap\_max\_in\_bytes in logstash monitor api?](https://discuss.elastic.co/t/what-is-heap-max-in-bytes-in-logstash-monitor-api/65927)
**Author:** [@YuWatanabe](https://discuss.elastic.co/u/YuWatanabe)\ **Replies:** 0\ **Last updated:** [November 14, 2016, 3:00am UTC](https://discuss.elastic.co/t/what-is-heap-max-in-bytes-in-logstash-monitor-api/65927 "2016-11-14T03:00:22Z")
I am testing the performance of logstash and realized that heap\_max\_in\_bytes are above the -Xmx parameter of jvm. Below is my snippet of jvm.options ## JVM configuration # Xms represents the initial size of total h… --- ## [How to set logstash v5 logfile name?](https://discuss.elastic.co/t/how-to-set-logstash-v5-logfile-name/64965)
**Author:** [@ankh](https://discuss.elastic.co/u/ankh)\ **Replies:** 1\ **Last updated:** [November 14, 2016, 2:42am UTC](https://discuss.elastic.co/t/how-to-set-logstash-v5-logfile-name/64965 "2016-11-14T02:42:27Z")
For a variety of reasons, I am running a series of logstash jobs to handle a large amount of data in a series of buckets. Under 2.4 I used something like: logstash -f my-index.conf &\> my-index-bucket-100-12000-14000.lo… --- ## [TCP : Error: closed stream](https://discuss.elastic.co/t/tcp-error-closed-stream/64431)
**Author:** [@Towser](https://discuss.elastic.co/u/Towser)\ **Replies:** 2\ **Last updated:** [November 14, 2016, 2:36am UTC](https://discuss.elastic.co/t/tcp-error-closed-stream/64431 "2016-11-14T02:36:45Z")
Hello everybody, I have been looking for a solution at my problem for days but without any success. I tried upgrading to the newly 5.0 stack, setting up 1 VM for every level ( logstash, elastic, kibana), tried to chan… --- ## [Different field names depending on Record\_Type in CSV file](https://discuss.elastic.co/t/different-field-names-depending-on-record-type-in-csv-file/65907)
**Author:** [@Hans](https://discuss.elastic.co/u/Hans)\ **Replies:** 1\ **Last updated:** [November 13, 2016, 10:54pm UTC](https://discuss.elastic.co/t/different-field-names-depending-on-record-type-in-csv-file/65907 "2016-11-13T22:54:18Z")
Hi, I have a CSV file with different information depending on the second field value of the CSV file Record\_Type. Here is an example of the input CSV file: 08-11-2016 21:08:04,2,4475632030300,655101002121838,25697419 … --- ## [How to convert a splunk transform into logstash](https://discuss.elastic.co/t/how-to-convert-a-splunk-transform-into-logstash/65905)
**Author:** [@rolfberkenbosch](https://discuss.elastic.co/u/rolfberkenbosch)\ **Replies:** 1\ **Last updated:** [November 13, 2016, 10:51pm UTC](https://discuss.elastic.co/t/how-to-convert-a-splunk-transform-into-logstash/65905 "2016-11-13T22:51:00Z")
Hi all, I have the following in the transform.conf of splunk: REGEX = (\[a-z\]+)=(\[a-z\]+) FORMAT = $1::$2 What is bassicly does is convert the following search: device="SFW" date=2016-11-13 time=12:53:08 timezone="C… --- ## [Logstash Syntax Error](https://discuss.elastic.co/t/logstash-syntax-error/65839)
**Author:** [@Kernel\_Panic](https://discuss.elastic.co/u/Kernel_Panic)\ **Replies:** 6\ **Last updated:** [November 13, 2016, 5:28pm UTC](https://discuss.elastic.co/t/logstash-syntax-error/65839 "2016-11-13T17:28:45Z")
Hi there guys, Can you help me with this issue? output { if \[@metadata\]\[beat\] { elasticsearch { hosts =\> \["server"\] sniffing =\> true manage\_template =\> false index =\> "%{\[@metadata\]\[beat\]}… --- ## [Logstash jdbc scheduler issue](https://discuss.elastic.co/t/logstash-jdbc-scheduler-issue/65774)
**Author:** [@Jayadeep\_Reddy](https://discuss.elastic.co/u/Jayadeep_Reddy)\ **Replies:** 1\ **Last updated:** [November 13, 2016, 7:57am UTC](https://discuss.elastic.co/t/logstash-jdbc-scheduler-issue/65774 "2016-11-13T07:57:42Z")
when the network glitches the scheduler is not trying to open the new connection. It is always returning the below error even if the network is Up ←\[33mException when executing JDBC query {:exception=\>#\ **Author:** [@manish\_jindal](https://discuss.elastic.co/u/manish_jindal)\ **Replies:** 1\ **Last updated:** [November 13, 2016, 7:49am UTC](https://discuss.elastic.co/t/add-a-new-field-from-two-field-one-is-long-type-other-is-string-type/65880 "2016-11-13T07:49:56Z") Hi, I am trying to join two field fetched from database, one is long type and other is string type . I am using following filter. filter { mutate { add\_field =\> { "IssueLink" =\> "%{project\_key}-%{issue\_num}" … --- ## [How to check Logstash output status](https://discuss.elastic.co/t/how-to-check-logstash-output-status/65337)
**Author:** [@mvenkat\_in](https://discuss.elastic.co/u/mvenkat_in)\ **Replies:** 1\ **Last updated:** [November 13, 2016, 4:43am UTC](https://discuss.elastic.co/t/how-to-check-logstash-output-status/65337 "2016-11-13T04:43:59Z")
Use Case: - Logstash reads input from the log files and indexes the data to elasticsearch output - Once the data indexing is completed, a trigger should be raised to notify the new data has been inserted to elasticsea… --- ## [Logstash 5.0.0 - Need to stop the logstash agent once parsing is completed](https://discuss.elastic.co/t/logstash-5-0-0-need-to-stop-the-logstash-agent-once-parsing-is-completed/65842)
**Author:** [@JMeter\_Dude](https://discuss.elastic.co/u/JMeter_Dude)\ **Replies:** 1\ **Last updated:** [November 12, 2016, 6:19pm UTC](https://discuss.elastic.co/t/logstash-5-0-0-need-to-stop-the-logstash-agent-once-parsing-is-completed/65842 "2016-11-12T18:19:48Z")
Hi. I am building a EL as a service for a specific set of users. The logs that I parse are often not real time logs and I would like to stop the logstash agent as soon as all of the logs are parsed. How do I achieve … --- ## [Logstash http input for files containing multiple events](https://discuss.elastic.co/t/logstash-http-input-for-files-containing-multiple-events/65818)
**Author:** [@cgspohn](https://discuss.elastic.co/u/cgspohn)\ **Replies:** 1\ **Last updated:** [November 12, 2016, 6:17pm UTC](https://discuss.elastic.co/t/logstash-http-input-for-files-containing-multiple-events/65818 "2016-11-12T18:17:35Z")
We have a file containing multiple json formatted events and we would like to use the http-input in logstash to receive it. From reading the documentation it seems like the http-input is designed to only receive one eve… --- ## [Running logstash in docker container - but apache logs don't get indexed](https://discuss.elastic.co/t/running-logstash-in-docker-container-but-apache-logs-dont-get-indexed/65846)
**Author:** [@linuxdev](https://discuss.elastic.co/u/linuxdev)\ **Replies:** 1\ **Last updated:** [November 12, 2016, 6:16pm UTC](https://discuss.elastic.co/t/running-logstash-in-docker-container-but-apache-logs-dont-get-indexed/65846 "2016-11-12T18:16:26Z")
Hi. Im running logstash in docker container - but apache logs don't get indexed Here's how I launch logstash in docker: docker run -d \\ -v /srv/logstash/config:/config-dir \\ -v /var/log/:/var/log \\ --nam… --- ## [What's the right way to read a file on a remote system?](https://discuss.elastic.co/t/whats-the-right-way-to-read-a-file-on-a-remote-system/65827)
**Author:** [@TonyEnnis](https://discuss.elastic.co/u/TonyEnnis)\ **Replies:** 1\ **Last updated:** [November 12, 2016, 6:14pm UTC](https://discuss.elastic.co/t/whats-the-right-way-to-read-a-file-on-a-remote-system/65827 "2016-11-12T18:14:44Z")
I want to read this syslog file: http://this.that.theother/dir/derp/syslog.log The normal file plug-in (input?) does not like the URI; it wants a file: \ **Author:** [@Pavel\_Amorok](https://discuss.elastic.co/u/Pavel_Amorok)\ **Replies:** 1\ **Last updated:** [November 12, 2016, 6:10pm UTC](https://discuss.elastic.co/t/logstash-5-installation-and-configuration-problem/65624 "2016-11-12T18:10:47Z") java -version java version "1.8.0\_73" Java(TM) SE Runtime Environment (build 1.8.0\_73-b02) Java HotSpot(TM) 64-Bit Server VM (build 25.73-b02, mixed mode) CentOS Linux release 7.2.1511 (Core) /usr/share/logstash/bin/… --- ## [Deleted logstash.log does not get replaced automatically](https://discuss.elastic.co/t/deleted-logstash-log-does-not-get-replaced-automatically/65524)
**Author:** [@rhubarb18x](https://discuss.elastic.co/u/rhubarb18x)\ **Replies:** 1\ **Last updated:** [November 12, 2016, 6:08pm UTC](https://discuss.elastic.co/t/deleted-logstash-log-does-not-get-replaced-automatically/65524 "2016-11-12T18:08:42Z")
Hi, I wanted to clean up the log file to speed up my troubleshooting and I deleted the logstash.log file. Actually I moved it and then deleted it. I tried many things to spark it's recreation. I created a new file a… --- ## [Extracting first few digits from a long number through filters](https://discuss.elastic.co/t/extracting-first-few-digits-from-a-long-number-through-filters/51862)
**Author:** [@Hans](https://discuss.elastic.co/u/Hans)\ **Replies:** 5\ **Last updated:** [November 12, 2016, 5:29pm UTC](https://discuss.elastic.co/t/extracting-first-few-digits-from-a-long-number-through-filters/51862 "2016-11-12T17:29:23Z")
Hi, I am looking for a logstash filter that would enable me to extract the most accurate matching result starting from left hand side of the number. Here is an example of a IMSI number has 15 digits, the first three digi… --- ## [Autostart Logstash configuration](https://discuss.elastic.co/t/autostart-logstash-configuration/65569)
**Author:** [@gmmurugan](https://discuss.elastic.co/u/gmmurugan)\ **Replies:** 4\ **Last updated:** [November 12, 2016, 4:40pm UTC](https://discuss.elastic.co/t/autostart-logstash-configuration/65569 "2016-11-12T16:40:32Z")
How exactly i can make the logstash\_server to start the pipeline automatically with configurations. i think im using logstash 2.3.2 and the path in my server is /opt/logstash/server/etc/conf.d/test.conf normally im s… --- ## [How do you update plugins in CentOS](https://discuss.elastic.co/t/how-do-you-update-plugins-in-centos/65732)
**Author:** [@seanziee](https://discuss.elastic.co/u/seanziee)\ **Replies:** 5\ **Last updated:** [November 11, 2016, 7:09pm UTC](https://discuss.elastic.co/t/how-do-you-update-plugins-in-centos/65732 "2016-11-11T19:09:17Z")
Hi, This may be obvious to some of you, but I dont know how to update grok when ELK is run as a service becuase there is no /bin file. Please help! :slight\_smile: --- ## [Logstash updating data](https://discuss.elastic.co/t/logstash-updating-data/65828)
**Author:** [@gnievoj](https://discuss.elastic.co/u/gnievoj)\ **Replies:** 1\ **Last updated:** [November 11, 2016, 5:00pm UTC](https://discuss.elastic.co/t/logstash-updating-data/65828 "2016-11-11T17:00:47Z")
Hello, It's my logstash config file \> input { jdbc { jdbc\_connection\_string =\> "jdbc:mysql://localhost:3306/ejabberd" jdbc\_user =\> "ejabber" … --- ## [\[SOLVED\] Multiple Instances for Logstash](https://discuss.elastic.co/t/solved-multiple-instances-for-logstash/65539)
**Author:** [@fabian](https://discuss.elastic.co/u/fabian)\ **Replies:** 2\ **Last updated:** [November 11, 2016, 4:10pm UTC](https://discuss.elastic.co/t/solved-multiple-instances-for-logstash/65539 "2016-11-11T16:10:47Z")
Hey, I'm using two Instances of Logstash on one Debian Server and I want to upgrade to v5. I'm using the repositories 2.3 now. With version 2.3 all I had to do was copy and edit the init script files and using two diff… --- ## [Elasticsearch output filter](https://discuss.elastic.co/t/elasticsearch-output-filter/65822)
**Author:** [@Ollm4c](https://discuss.elastic.co/u/Ollm4c)\ **Replies:** 1\ **Last updated:** [November 11, 2016, 3:31pm UTC](https://discuss.elastic.co/t/elasticsearch-output-filter/65822 "2016-11-11T15:31:52Z")
Hi everyone, is there a way to send some fields from logstash to elasticsearch without dropping unnecessary fields? Thanks in advance --- ## [Input JSON](https://discuss.elastic.co/t/input-json/65528)
**Author:** [@TimE](https://discuss.elastic.co/u/TimE)\ **Replies:** 5\ **Last updated:** [November 11, 2016, 2:02pm UTC](https://discuss.elastic.co/t/input-json/65528 "2016-11-11T14:02:44Z")
Hey, After trying for a long time trying to get a nested JSON working I've just created a flat one - http://pastebin.com/0VVF4HNZ. I feel like this should be trivial but trying input codec json, filter json, some att… --- ## [Grok with Else conditionals. How?](https://discuss.elastic.co/t/grok-with-else-conditionals-how/65797)
**Author:** [@mgagliardi](https://discuss.elastic.co/u/mgagliardi)\ **Replies:** 7\ **Last updated:** [November 11, 2016, 2:01pm UTC](https://discuss.elastic.co/t/grok-with-else-conditionals-how/65797 "2016-11-11T14:01:58Z")
Hello all. I'm new to Logstash/ELK and a pretty weak coder. I'm trying to tidy up a filter which uses Grok and running into an error. Basically I've got a given log file and a filter that works but after adding a coup… --- ## [Sql\_last\_value is literal in query in stead of bind variable](https://discuss.elastic.co/t/sql-last-value-is-literal-in-query-in-stead-of-bind-variable/65489)
**Author:** [@nlmpij](https://discuss.elastic.co/u/nlmpij)\ **Replies:** 1\ **Last updated:** [November 11, 2016, 1:09pm UTC](https://discuss.elastic.co/t/sql-last-value-is-literal-in-query-in-stead-of-bind-variable/65489 "2016-11-11T13:09:55Z")
IN my configuration file I'm using jdbc as input statement =\> "select x.\* from table x where x.snapshot \> :sql\_last\_value" last\_run\_metadata\_path =\> "d:/tools/elastic/logstash\_x.lastrun" use\_column\_value =\> true tracki… --- ## [\[SOLVED\] The filter plugin mutate-convert doesn't work in 5.0](https://discuss.elastic.co/t/solved-the-filter-plugin-mutate-convert-doesnt-work-in-5-0/65496)
**Author:** [@tileaga](https://discuss.elastic.co/u/tileaga)\ **Replies:** 16\ **Last updated:** [November 11, 2016, 1:21pm UTC](https://discuss.elastic.co/t/solved-the-filter-plugin-mutate-convert-doesnt-work-in-5-0/65496 "2016-11-11T13:21:31Z")
In my logstash config I have something like this: mutate { add\_field =\> { "\[%{name}\]\[long\]" =\> "%{valueLong}" } remove\_field =\> \[valueLong\] convert =\> \["\[%{name}\]\[long\]", "in… --- ## [Bug in grok pattern for german/austrian month](https://discuss.elastic.co/t/bug-in-grok-pattern-for-german-austrian-month/65785)
**Author:** [@AdminValida](https://discuss.elastic.co/u/AdminValida)\ **Replies:** 1\ **Last updated:** [November 11, 2016, 11:25am UTC](https://discuss.elastic.co/t/bug-in-grok-pattern-for-german-austrian-month/65785 "2016-11-11T11:25:02Z")
Hi, we are using Logstash 5.0.0 and a grok pattern to parse a timestamp. That's a sample log line: 18 Jän 2016 16:14:40,408 INFO LOGINFOSAMPLE With the grok pattern %{MONTH} we are unable to parse the timestamp sin… --- ## [Logstash stopped working](https://discuss.elastic.co/t/logstash-stopped-working/65755)
**Author:** [@Lego](https://discuss.elastic.co/u/Lego)\ **Replies:** 0\ **Last updated:** [November 11, 2016, 5:55am UTC](https://discuss.elastic.co/t/logstash-stopped-working/65755 "2016-11-11T05:55:41Z")
Hello. Could you help me to solve starnge problem? I've got logstash which works with filebeat only. I see that logstash stopps after some hours of working. I take place once a day (at night). I tried to see log file… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1078) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1080)