# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1080 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1081 --- ## [Difference between the logstash config file](https://discuss.elastic.co/t/difference-between-the-logstash-config-file/65735)
**Author:** [@s802645](https://discuss.elastic.co/u/s802645)\ **Replies:** 0\ **Last updated:** [November 10, 2016, 11:49pm UTC](https://discuss.elastic.co/t/difference-between-the-logstash-config-file/65735 "2016-11-10T23:49:51Z")
What is the difference between /etc/sysconfig/logstash file and the one in /etc/init.d/logstash? Can I remove /etc/sysconfig/logstash if I had set all my parameters in /etc/init.d/logstash file? --- ## [\[ERROR\]\[org.logstash.beats.BeatsHandler\] Exception: not an SSL/TLS record: X](https://discuss.elastic.co/t/error-org-logstash-beats-beatshandler-exception-not-an-ssl-tls-record-x/65108)
**Author:** [@alexus](https://discuss.elastic.co/u/alexus)\ **Replies:** 2\ **Last updated:** [November 10, 2016, 8:10pm UTC](https://discuss.elastic.co/t/error-org-logstash-beats-beatshandler-exception-not-an-ssl-tls-record-x/65108 "2016-11-10T20:10:12Z")
I'm trying to resolve my own topic: I'm getting following inside of my logstash's log: \[2016-11-05T20:44:42,999\]\[ERROR\]\[org.logstash.beats.BeatsHandler\] Exception: not an SSL/TLS record: X something to do with SSL… --- ## [Logstash stops pipeline after exception](https://discuss.elastic.co/t/logstash-stops-pipeline-after-exception/64321)
**Author:** [@Akshaykapoor](https://discuss.elastic.co/u/Akshaykapoor)\ **Replies:** 1\ **Last updated:** [November 10, 2016, 7:20pm UTC](https://discuss.elastic.co/t/logstash-stops-pipeline-after-exception/64321 "2016-11-10T19:20:56Z")
I get this issue time and again, and the only way to get it to work again is to restart logstash. This is what i see in my logs, \> {:timestamp=\>"2016-10-28T18:44:24.951000+0000", :message=\>"CircuitBreaker::rescuin… --- ## [Logstash package install -e not working](https://discuss.elastic.co/t/logstash-package-install-e-not-working/65704)
**Author:** [@jobou](https://discuss.elastic.co/u/jobou)\ **Replies:** 1\ **Last updated:** [November 10, 2016, 6:48pm UTC](https://discuss.elastic.co/t/logstash-package-install-e-not-working/65704 "2016-11-10T18:48:59Z")
Hi, I have just installed logstash on an Ubuntu 16.10 using the APT repository. I wanted to do the "Stashing your first event" tutorial. So I ran : /usr/share/logstash/bin/logstash --path.settings /etc/logstash -e … --- ## [ELK 5--multiline codec not working with imap](https://discuss.elastic.co/t/elk-5-multiline-codec-not-working-with-imap/65419)
**Author:** [@seanziee](https://discuss.elastic.co/u/seanziee)\ **Replies:** 1\ **Last updated:** [November 10, 2016, 4:22pm UTC](https://discuss.elastic.co/t/elk-5-multiline-codec-not-working-with-imap/65419 "2016-11-10T16:22:13Z")
Hi, I keep getting these two messages in my logstash log when trying to run my config file. I have tried just about every combination I can think of and I still cannot get this error to go away. I have run this code wit… --- ## [\[SOLVED\] Syslog filter additional filtering](https://discuss.elastic.co/t/solved-syslog-filter-additional-filtering/65526)
**Author:** [@aeva\_assured](https://discuss.elastic.co/u/aeva_assured)\ **Replies:** 5\ **Last updated:** [November 10, 2016, 3:05pm UTC](https://discuss.elastic.co/t/solved-syslog-filter-additional-filtering/65526 "2016-11-10T15:05:40Z")
Hello all. I'm very new to logstash and I'm trying to add additional fields to an existing syslog filter. My base filter is: Rubrik Syslog Input input { tcp { host =\> "192.168.1.180" port =\> 1514 } } … --- ## [Yet another multiline plea for help please](https://discuss.elastic.co/t/yet-another-multiline-plea-for-help-please/65536)
**Author:** [@ZillaG](https://discuss.elastic.co/u/ZillaG)\ **Replies:** 5\ **Last updated:** [November 10, 2016, 2:38pm UTC](https://discuss.elastic.co/t/yet-another-multiline-plea-for-help-please/65536 "2016-11-10T14:38:06Z")
I've looked over multiple posts including this one on how to parse multiline log patterns like I have below. Seems like I'm following the solutions given, but Kibana still shows my logs into multiple documents. Here's … --- ## [Timezone with logstash](https://discuss.elastic.co/t/timezone-with-logstash/65666)
**Author:** [@dmitry1980](https://discuss.elastic.co/u/dmitry1980)\ **Replies:** 6\ **Last updated:** [November 10, 2016, 2:13pm UTC](https://discuss.elastic.co/t/timezone-with-logstash/65666 "2016-11-10T14:13:16Z")
I have a problem with the @timestamp field. Value of @timestamp is always the real event timestamp -2 hrs. input{ file {...}} filter{ if \[type\]=="apachelogs"{ grok{ match =\> \[ "message", "%{COMBINEDAPACHEL… --- ## [\[SOLVED\] Geoip.location doesn't work anymore after upgrade to 5.0](https://discuss.elastic.co/t/solved-geoip-location-doesnt-work-anymore-after-upgrade-to-5-0/65651)
**Author:** [@tileaga](https://discuss.elastic.co/u/tileaga)\ **Replies:** 2\ **Last updated:** [November 10, 2016, 1:59pm UTC](https://discuss.elastic.co/t/solved-geoip-location-doesnt-work-anymore-after-upgrade-to-5-0/65651 "2016-11-10T13:59:16Z")
I have two float fields: valueLatitude and valueLongitude and try to send them to elasticsearch as geoip.location. In logstash configuration I have this: mutate { add\_field =\> \[ "\[location\]", "%{val… --- ## [Installing Plugins for Logstash 5.0](https://discuss.elastic.co/t/installing-plugins-for-logstash-5-0/65642)
**Author:** [@Mahdy\_S](https://discuss.elastic.co/u/Mahdy_S)\ **Replies:** 0\ **Last updated:** [November 10, 2016, 11:11am UTC](https://discuss.elastic.co/t/installing-plugins-for-logstash-5-0/65642 "2016-11-10T11:11:32Z")
Hi There, I'm trying to install the memorize plugin for Logstash on Ubuntu 14.04. The problem is that my Logstash server is connected through a proxy. So when using the normal bin/logstash-plugin install logstash-filter… --- ## [Logstash - mutate - add\_field problem](https://discuss.elastic.co/t/logstash-mutate-add-field-problem/65665)
**Author:** [@Nadir](https://discuss.elastic.co/u/Nadir)\ **Replies:** 4\ **Last updated:** [November 10, 2016, 1:57pm UTC](https://discuss.elastic.co/t/logstash-mutate-add-field-problem/65665 "2016-11-10T13:57:06Z")
Hi ! I do have the following event and I want to add another field and populate this with the content of event\_data.IpAddress: { "process\_id" =\> 476, "level" =\> "Information", "event\_data" =\> { … --- ## [MongoDB Input Plugin to Logstash](https://discuss.elastic.co/t/mongodb-input-plugin-to-logstash/65662)
**Author:** [@aHazeem](https://discuss.elastic.co/u/aHazeem)\ **Replies:** 0\ **Last updated:** [November 10, 2016, 12:55pm UTC](https://discuss.elastic.co/t/mongodb-input-plugin-to-logstash/65662 "2016-11-10T12:55:46Z")
We are new adopters to ELK and coming from MS background. However, we are trying to switch to the open source world. We've been already using MongoDB with a new system and we're also trying to use ELK to analyse the d… --- ## [Reached open files limit Logstash](https://discuss.elastic.co/t/reached-open-files-limit-logstash/65648)
**Author:** [@espogian](https://discuss.elastic.co/u/espogian)\ **Replies:** 0\ **Last updated:** [November 10, 2016, 11:28am UTC](https://discuss.elastic.co/t/reached-open-files-limit-logstash/65648 "2016-11-10T11:28:45Z")
Hello, my pipeline is stuck due to this error: Reached open files limit: 4095, set by the 'max\_open\_files' option or default, files yet to open: 66922 From the documentation, especially this interesting blog post: ht… --- ## [Assume the date is current date if there is no date in log](https://discuss.elastic.co/t/assume-the-date-is-current-date-if-there-is-no-date-in-log/65599)
**Author:** [@alex88](https://discuss.elastic.co/u/alex88)\ **Replies:** 4\ **Last updated:** [November 10, 2016, 10:17am UTC](https://discuss.elastic.co/t/assume-the-date-is-current-date-if-there-is-no-date-in-log/65599 "2016-11-10T10:17:20Z")
I have log: 08:42:21.706 \[qtp1335954408-120\] DEBUG i.s.client.http.JestHttpClient - POST method created based It contains just time I need to add month and day . How can i do it with logstash filters? --- ## [Log4j Logstash plugin error](https://discuss.elastic.co/t/log4j-logstash-plugin-error/65591)
**Author:** [@profic](https://discuss.elastic.co/u/profic)\ **Replies:** 4\ **Last updated:** [November 10, 2016, 9:59am UTC](https://discuss.elastic.co/t/log4j-logstash-plugin-error/65591 "2016-11-10T09:59:51Z")
Hi, I am getting \[2016-11-09T14:37:28,009\]\[DEBUG\]\[logstash.inputs.log4j \] Closing connection {:client=\>"172.17.0.1:43658", :exception=\>#\… --- ## [Kibana with Logstash 5.0 elasticsearch 5.0 error](https://discuss.elastic.co/t/kibana-with-logstash-5-0-elasticsearch-5-0-error/65261)
**Author:** [@azteam](https://discuss.elastic.co/u/azteam)\ **Replies:** 6\ **Last updated:** [November 10, 2016, 8:39am UTC](https://discuss.elastic.co/t/kibana-with-logstash-5-0-elasticsearch-5-0-error/65261 "2016-11-10T08:39:49Z")
I setup ELK on Ubuntu 15. So I have some problems. Logs logstash returns: \[2016-11-08T02:00:02,607\]\[WARN \]\[logstash.outputs.elasticsearch\] UNEXPECTED POOL ERROR {:e=\>#} \[2016-11-08T02:00:02,607\]\[ERROR\]\[logstash.outputs.… --- ## [How to use jdbc input plugin for to migrate data from progresql to elasticsearch?](https://discuss.elastic.co/t/how-to-use-jdbc-input-plugin-for-to-migrate-data-from-progresql-to-elasticsearch/65309)
**Author:** [@kartheek91](https://discuss.elastic.co/u/kartheek91)\ **Replies:** 1\ **Last updated:** [November 10, 2016, 6:38am UTC](https://discuss.elastic.co/t/how-to-use-jdbc-input-plugin-for-to-migrate-data-from-progresql-to-elasticsearch/65309 "2016-11-10T06:38:49Z")
I have Installed logstash 5.0 and I'm trying to get the data from progresql table to json lines.This is the error I'm getting please help. and the conf file is like this file: simple-out.conf input { jdbc { # Post… --- ## [Metric Filter - Unable to get field references](https://discuss.elastic.co/t/metric-filter-unable-to-get-field-references/65586)
**Author:** [@washal](https://discuss.elastic.co/u/washal)\ **Replies:** 0\ **Last updated:** [November 10, 2016, 6:34am UTC](https://discuss.elastic.co/t/metric-filter-unable-to-get-field-references/65586 "2016-11-10T06:34:54Z")
Hello, I'm using the metrics filter in Logstash to count the number of events triggered per firewall rule. So, I've got a LS config as below: if \[policyid\] { metrics { add\_tag =\> \["metric"\] add\_field =\> {"devnam… --- ## [Oniguruma Regx Parsing multiline logs](https://discuss.elastic.co/t/oniguruma-regx-parsing-multiline-logs/65249)
**Author:** [@w0lverine](https://discuss.elastic.co/u/w0lverine)\ **Replies:** 1\ **Last updated:** [November 10, 2016, 6:32am UTC](https://discuss.elastic.co/t/oniguruma-regx-parsing-multiline-logs/65249 "2016-11-10T06:32:18Z")
I am trying to parse multi-line logs in oniguruma regx and I understand logstash has a mutline filter but which way is better? To parse the logs with regx before logstash(or at?) or use the multi-line filter in the con… --- ## [Add logstash custom pattern error](https://discuss.elastic.co/t/add-logstash-custom-pattern-error/65447)
**Author:** [@Tr\_ng\_Trang](https://discuss.elastic.co/u/Tr_ng_Trang)\ **Replies:** 7\ **Last updated:** [November 10, 2016, 3:44am UTC](https://discuss.elastic.co/t/add-logstash-custom-pattern-error/65447 "2016-11-10T03:44:38Z")
hi all, i am beginner with logstash, i have a question about custom pattern for logstash. I want to define new pattern for file\_type like this: DEFGH (?:asd?|bat|chm|cmd|com|dll|do|exe|hlp|hta|js|jse|lnk|ocx|pif|reg|s… --- ## [Bug with split filter and XML](https://discuss.elastic.co/t/bug-with-split-filter-and-xml/65107)
**Author:** [@espogian](https://discuss.elastic.co/u/espogian)\ **Replies:** 2\ **Last updated:** [November 9, 2016, 9:43pm UTC](https://discuss.elastic.co/t/bug-with-split-filter-and-xml/65107 "2016-11-09T21:43:59Z")
Hi, parsing some XMLs Logstash randomly stops the pipeline with the following error: LogStash::ConfigurationError: Only String and Array types are splittable. field:\[User\] is of type = NilClass filter at /opt/… --- ## [Officially maintained Logstash Chef cookbook by Elastic](https://discuss.elastic.co/t/officially-maintained-logstash-chef-cookbook-by-elastic/65549)
**Author:** [@hartfordfive](https://discuss.elastic.co/u/hartfordfive)\ **Replies:** 0\ **Last updated:** [November 9, 2016, 7:27pm UTC](https://discuss.elastic.co/t/officially-maintained-logstash-chef-cookbook-by-elastic/65549 "2016-11-09T19:27:47Z")
I know that Elastic currently has an official Chef cookbook for Elasticsearch, although I wonder why there isn't one for Logstash, and potentially even Filbeat and Kibana. I'm currently in the process of attempting to u… --- ## [Logstash not a service on Amazon AMI :(](https://discuss.elastic.co/t/logstash-not-a-service-on-amazon-ami/64483)
**Author:** [@Patrick\_Salomon](https://discuss.elastic.co/u/Patrick_Salomon)\ **Replies:** 17\ **Last updated:** [November 9, 2016, 6:52pm UTC](https://discuss.elastic.co/t/logstash-not-a-service-on-amazon-ami/64483 "2016-11-09T18:52:27Z")
Hello I'm trying to install Logstash 5 on AWS Amazon Linux. The install is successful, however, the service does not exist. (I used both the rpm install and the repo with yum). It' s the latest AMI (2016.09, running R… --- ## [Output -\> file -\> codec -\> json writing in a single line instead of writing as new line for every set](https://discuss.elastic.co/t/output-file-codec-json-writing-in-a-single-line-instead-of-writing-as-new-line-for-every-set/65440)
**Author:** [@gmmurugan](https://discuss.elastic.co/u/gmmurugan)\ **Replies:** 2\ **Last updated:** [November 9, 2016, 4:09pm UTC](https://discuss.elastic.co/t/output-file-codec-json-writing-in-a-single-line-instead-of-writing-as-new-line-for-every-set/65440 "2016-11-09T16:09:49Z")
output -\> file -\> codec -\> json writing in a single line instead of writing as new line for every set. its hard for nxlog to parse thru thee output because there is no new line . its always a single line and never ending… --- ## [Logstash 2.4 eventually (intermittent issue) read partial log lines](https://discuss.elastic.co/t/logstash-2-4-eventually-intermittent-issue-read-partial-log-lines/65525)
**Author:** [@Andre\_Buzzo](https://discuss.elastic.co/u/Andre_Buzzo)\ **Replies:** 0\ **Last updated:** [November 9, 2016, 4:05pm UTC](https://discuss.elastic.co/t/logstash-2-4-eventually-intermittent-issue-read-partial-log-lines/65525 "2016-11-09T16:05:33Z")
I guess this is an issue but I can't find anything about it. Unfortunately I don't have steps to reproduce it, happens eventually across different prod servers in different log files a few times a day. I can see that i… --- ## [Kafka error](https://discuss.elastic.co/t/kafka-error/43582)
**Author:** [@tgdesrochers](https://discuss.elastic.co/u/tgdesrochers)\ **Replies:** 16\ **Last updated:** [November 9, 2016, 3:38pm UTC](https://discuss.elastic.co/t/kafka-error/43582 "2016-11-09T15:38:10Z")
I am using kafka as a queue. My data is getting into the kafka cluster just fine, and the majority of it is being output to my ES cluster just fine except for one topic. My config for the logstash node consuming the … --- ## [Is it possible to use the old GeoIP format rather than the new GeoIP database format with Logstash 5?](https://discuss.elastic.co/t/is-it-possible-to-use-the-old-geoip-format-rather-than-the-new-geoip-database-format-with-logstash-5/65516)
**Author:** [@Justin\_Henderson](https://discuss.elastic.co/u/Justin_Henderson)\ **Replies:** 0\ **Last updated:** [November 9, 2016, 3:34pm UTC](https://discuss.elastic.co/t/is-it-possible-to-use-the-old-geoip-format-rather-than-the-new-geoip-database-format-with-logstash-5/65516 "2016-11-09T15:34:52Z")
In Logstash versions prior to 5 myself and others use the free geoipasnum.dat from MaxMind considerably. The main reason we haven't switched to version 5 is it seems Logstash 5.0 requires the new geoip database format w… --- ## [Logstash with IBM JDK 1.8 and TLS connections](https://discuss.elastic.co/t/logstash-with-ibm-jdk-1-8-and-tls-connections/64571)
**Author:** [@dcarissi](https://discuss.elastic.co/u/dcarissi)\ **Replies:** 11\ **Last updated:** [November 9, 2016, 2:25pm UTC](https://discuss.elastic.co/t/logstash-with-ibm-jdk-1-8-and-tls-connections/64571 "2016-11-09T14:25:49Z")
Hi, I'm having a problem with Logstash (version 1.5.4, 2.4.0 or 5.0.0-rc1) and the IBM JDK version 1.8 where a NodeJS application can not connect using TLS. In the Logstash log file, I get a message about "no cipher sui… --- ## [Converting varchar to datetime in logstash jdbc input?](https://discuss.elastic.co/t/converting-varchar-to-datetime-in-logstash-jdbc-input/65497)
**Author:** [@Kulasangar\_Gowrisang](https://discuss.elastic.co/u/Kulasangar_Gowrisang)\ **Replies:** 0\ **Last updated:** [November 9, 2016, 1:32pm UTC](https://discuss.elastic.co/t/converting-varchar-to-datetime-in-logstash-jdbc-input/65497 "2016-11-09T13:32:10Z")
I've got my db table which has a column named time, type of (varchar). Value of the column looks something like 2016-09-02 00:00:01. I tried casting it from varchar to datetime along with the select statement, assuming… --- ## [Logstash-5.0.0.deb not installing correctly on Raspbian 8](https://discuss.elastic.co/t/logstash-5-0-0-deb-not-installing-correctly-on-raspbian-8/65427)
**Author:** [@dom1](https://discuss.elastic.co/u/dom1)\ **Replies:** 1\ **Last updated:** [November 9, 2016, 1:21pm UTC](https://discuss.elastic.co/t/logstash-5-0-0-deb-not-installing-correctly-on-raspbian-8/65427 "2016-11-09T13:21:50Z")
Hi, I'm trying to get logstash installed on my Rpi. I got an error at installation and when running "sudo dpkg-reconfigure logstash". The error is the following : Using provided startup.options file: /etc/logstash/sta… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1079) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1081)