# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1082 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1083 --- ## [Logstash configuration to defaul current date](https://discuss.elastic.co/t/logstash-configuration-to-defaul-current-date/65297)
**Author:** [@Ramesh\_Janagam](https://discuss.elastic.co/u/Ramesh_Janagam)\ **Replies:** 1\ **Last updated:** [November 8, 2016, 6:30am UTC](https://discuss.elastic.co/t/logstash-configuration-to-defaul-current-date/65297 "2016-11-08T06:30:59Z")
Hi All, My application logs have only timestamp information but not date ( hh:mm:ss.SSS). By default logstash is considering the date as 2016-01-01 instead of current date. "@timestamp" =\> "2016-01-01T01:… --- ## [I could not start logstash properly via rpm installed](https://discuss.elastic.co/t/i-could-not-start-logstash-properly-via-rpm-installed/65120)
**Author:** [@Generalibm\_Jang](https://discuss.elastic.co/u/Generalibm_Jang)\ **Replies:** 15\ **Last updated:** [November 8, 2016, 6:10am UTC](https://discuss.elastic.co/t/i-could-not-start-logstash-properly-via-rpm-installed/65120 "2016-11-08T06:10:08Z")
Hi, all I could not start logstash properly via rpm installed. Any helps here? Description sudo systemctl start logstash.service the command above would generate logs at /var/log/logstash/logstash-plain.log \[2… --- ## [How to read microseconds in grok like hh:mm:ss.SSSSSS](https://discuss.elastic.co/t/how-to-read-microseconds-in-grok-like-hh-mm-ss-ssssss/64792)
**Author:** [@Ramesh\_Janagam](https://discuss.elastic.co/u/Ramesh_Janagam)\ **Replies:** 2\ **Last updated:** [November 8, 2016, 5:38am UTC](https://discuss.elastic.co/t/how-to-read-microseconds-in-grok-like-hh-mm-ss-ssssss/64792 "2016-11-08T05:38:08Z")
Hi I need help on how to read microseconds from my log. Seconds format ss.SSS is working fine but not ss.SSSSSS. Is there anyway read value? When verify %{TIME:logtime} its working fine in online grok debugger but failed… --- ## [Logstash-5.0.0 not creating ES index on Windows 10](https://discuss.elastic.co/t/logstash-5-0-0-not-creating-es-index-on-windows-10/65260)
**Author:** [@Aerologic](https://discuss.elastic.co/u/Aerologic)\ **Replies:** 3\ **Last updated:** [November 8, 2016, 12:09am UTC](https://discuss.elastic.co/t/logstash-5-0-0-not-creating-es-index-on-windows-10/65260 "2016-11-08T00:09:58Z")
Hey all, I've been playing around with Logstash-5.0.0 on Windows 10 for awhile, trying to get it to index some data into Elasticsearch. I currently have Elasticsearch-5.0.0 and Kibana-5.0.0 running and working, but wh… --- ## [5.0.0 version and input websocket](https://discuss.elastic.co/t/5-0-0-version-and-input-websocket/64919)
**Author:** [@xmulot](https://discuss.elastic.co/u/xmulot)\ **Replies:** 1\ **Last updated:** [November 7, 2016, 7:04pm UTC](https://discuss.elastic.co/t/5-0-0-version-and-input-websocket/64919 "2016-11-07T19:04:59Z")
more info here: I have the following environment: /usr/share/logstash# bin/logstash --path.settings=/etc/logstash -f /etc/logstash/conf.d/stream.conf -V Sending Logstash logs to /var/log/logstash which is now co… --- ## [Input jdbc plugin network issue](https://discuss.elastic.co/t/input-jdbc-plugin-network-issue/65225)
**Author:** [@Jayadeep\_Reddy](https://discuss.elastic.co/u/Jayadeep_Reddy)\ **Replies:** 0\ **Last updated:** [November 7, 2016, 1:22pm UTC](https://discuss.elastic.co/t/input-jdbc-plugin-network-issue/65225 "2016-11-07T13:22:23Z")
we are using the logstash JDBC scheduler to fetch data every 10 seconds. It is working fine, but with the network glitches it is not able to make a connection again after the network is up. Always it is returning ←\[33m… --- ## [Where do incoming events go when Logstash is cpu-bound?](https://discuss.elastic.co/t/where-do-incoming-events-go-when-logstash-is-cpu-bound/65197)
**Author:** [@dandrestor](https://discuss.elastic.co/u/dandrestor)\ **Replies:** 4\ **Last updated:** [November 7, 2016, 1:19pm UTC](https://discuss.elastic.co/t/where-do-incoming-events-go-when-logstash-is-cpu-bound/65197 "2016-11-07T13:19:02Z")
Hi, I have a logstash instance which is taking in quite a bit of traffic via the tcp input. Logstash is currently cpu-bound on this particular server, which I understand is not at all an unusual situation. By cpu-bound… --- ## [Single forward slash in field not accessable in conditional filter](https://discuss.elastic.co/t/single-forward-slash-in-field-not-accessable-in-conditional-filter/65188)
**Author:** [@nick.e](https://discuss.elastic.co/u/nick.e)\ **Replies:** 4\ **Last updated:** [November 7, 2016, 12:58pm UTC](https://discuss.elastic.co/t/single-forward-slash-in-field-not-accessable-in-conditional-filter/65188 "2016-11-07T12:58:51Z")
Hi, I'm sending oracle auditing events with filebeat 5.0.0. The events itself are written to an xml-file by the oracle database. Sometimes, one field (DB\_User) contains a single /. It'd like to filter this slash in a … --- ## [:message=\>"undefined method for twitter input plugin](https://discuss.elastic.co/t/message-undefined-method-for-twitter-input-plugin/62481)
**Author:** [@anon45667325](https://discuss.elastic.co/u/anon45667325)\ **Replies:** 1\ **Last updated:** [November 7, 2016, 12:50pm UTC](https://discuss.elastic.co/t/message-undefined-method-for-twitter-input-plugin/62481 "2016-11-07T12:50:19Z")
Hello ! I'm not sure what is going on, I cannot ingest tweets from Twitter with my basic configuration: input { twitter { consumer\_key =\> "my consumer key" consumer\_secret =\> "m… --- ## [\[2.3.1\] Reload Twitter input conf =\> undefined method \`sample' for nil:NilClass](https://discuss.elastic.co/t/2-3-1-reload-twitter-input-conf-undefined-method-sample-for-nil-nilclass/65218)
**Author:** [@jlegrand](https://discuss.elastic.co/u/jlegrand)\ **Replies:** 0\ **Last updated:** [November 7, 2016, 12:49pm UTC](https://discuss.elastic.co/t/2-3-1-reload-twitter-input-conf-undefined-method-sample-for-nil-nilclass/65218 "2016-11-07T12:49:13Z")
Hello I'm using Logstash v2.3.1 with a Twitter input. I use --auto-reload option to dynamically modify and reload the Twitter input configuration. If I change twitter input proxy settings (use\_proxy, proxy\_address an… --- ## [Logstash\[2.4.0\] JDBC input plugin not working](https://discuss.elastic.co/t/logstash-2-4-0-jdbc-input-plugin-not-working/65213)
**Author:** [@Sasi\_Kumar](https://discuss.elastic.co/u/Sasi_Kumar)\ **Replies:** 2\ **Last updated:** [November 7, 2016, 12:41pm UTC](https://discuss.elastic.co/t/logstash-2-4-0-jdbc-input-plugin-not-working/65213 "2016-11-07T12:41:21Z")
Hi all, https://www.elastic.co/blog/logstash-jdbc-input-plugin Am new to logstash, not able to inject the data into elasticsearch from logstash. Elastic was up and running in the port numb… --- ## [Can't make conditionnal filtering to work](https://discuss.elastic.co/t/cant-make-conditionnal-filtering-to-work/65191)
**Author:** [@Houss](https://discuss.elastic.co/u/Houss)\ **Replies:** 6\ **Last updated:** [November 7, 2016, 11:30am UTC](https://discuss.elastic.co/t/cant-make-conditionnal-filtering-to-work/65191 "2016-11-07T11:30:15Z")
Hello, I plan on migrating to logstash (from graylog) and I'm facing a problem with the conditionnal filtering. Without the condition, the grok pattern works fine and as expected. However, if I put the condition, it wi… --- ## [Logstash input udp drops?](https://discuss.elastic.co/t/logstash-input-udp-drops/65046)
**Author:** [@irom77](https://discuss.elastic.co/u/irom77)\ **Replies:** 8\ **Last updated:** [November 7, 2016, 11:14am UTC](https://discuss.elastic.co/t/logstash-input-udp-drops/65046 "2016-11-07T11:14:36Z")
How do I find if packets are dropped from my input udp queue or not ? input { udp { port =\> 5514 type =\> "pa-traffic" queue\_size =\> 8000 # default 2000 } } --- ## [Index not returning results - ELK - Can Index creation be automated?](https://discuss.elastic.co/t/index-not-returning-results-elk-can-index-creation-be-automated/60497)
**Author:** [@Karpagavinayagam\_U](https://discuss.elastic.co/u/Karpagavinayagam_U)\ **Replies:** 14\ **Last updated:** [November 7, 2016, 9:34am UTC](https://discuss.elastic.co/t/index-not-returning-results-elk-can-index-creation-be-automated/60497 "2016-11-07T09:34:00Z")
Hey users Been trying to figure out below issue but not successful. I created an index to match a data pattern in elasticsearch - but not fetching results when i discover Results are displaying for default logstash-\* p… --- ## [Filebeat - first setup](https://discuss.elastic.co/t/filebeat-first-setup/65153)
**Author:** [@sliddjur](https://discuss.elastic.co/u/sliddjur)\ **Replies:** 3\ **Last updated:** [November 7, 2016, 9:28am UTC](https://discuss.elastic.co/t/filebeat-first-setup/65153 "2016-11-07T09:28:28Z")
Hello, Im trying to setup my first test site. This is my filebeat.yml filebeat.prospectors: - input\_type: log - /var/log/\*.log - /var/log/auth.log output.logstash: # The Logstash hosts hosts: \["172.23.253.… --- ## [Templates/mappings defined by logstash](https://discuss.elastic.co/t/templates-mappings-defined-by-logstash/64739)
**Author:** [@mostolog](https://discuss.elastic.co/u/mostolog)\ **Replies:** 8\ **Last updated:** [November 7, 2016, 9:21am UTC](https://discuss.elastic.co/t/templates-mappings-defined-by-logstash/64739 "2016-11-07T09:21:35Z")
Hi I'm running several logstash instances, each one parsing logs from one application. On each instance, I grok to get all fields I need, before indexing them on elasticsearch. As each logstash is isolated from others… --- ## [Use "-" as delimiter in timestamp](https://discuss.elastic.co/t/use-as-delimiter-in-timestamp/65158)
**Author:** [@dhillon](https://discuss.elastic.co/u/dhillon)\ **Replies:** 4\ **Last updated:** [November 7, 2016, 5:41am UTC](https://discuss.elastic.co/t/use-as-delimiter-in-timestamp/65158 "2016-11-07T05:41:57Z")
I am using filebeat to feed csv files into logstash .Timestamp in the logs i need to process is as below. 11/05/2016-00:00:00,80,78,78,89 11/05/2016-00:05:00,80,78,78,89 11/05/2016-00:10:00,80,78,78,89 i use a simp… --- ## [Logstash Multiple files config](https://discuss.elastic.co/t/logstash-multiple-files-config/65104)
**Author:** [@brunopsitech](https://discuss.elastic.co/u/brunopsitech)\ **Replies:** 1\ **Last updated:** [November 7, 2016, 3:55am UTC](https://discuss.elastic.co/t/logstash-multiple-files-config/65104 "2016-11-07T03:55:57Z")
Hi, i try to make multiple files for every service. I have two files ( squid.conf and dansguardian.conf ). When i execute logstash with only one config file, i have 63 fiels in Squid and 33 in Dansguardian. But if if put… --- ## [SOLVED: Logstash can not connect to elasticsearch url](https://discuss.elastic.co/t/solved-logstash-can-not-connect-to-elasticsearch-url/65154)
**Author:** [@w0lverine](https://discuss.elastic.co/u/w0lverine)\ **Replies:** 1\ **Last updated:** [November 7, 2016, 1:11am UTC](https://discuss.elastic.co/t/solved-logstash-can-not-connect-to-elasticsearch-url/65154 "2016-11-07T01:11:48Z")
Every time ./logstash -f sample.conf is run I get this error: The stdin plugin is now waiting for input: \[2016-11-06T19:35:35,739\]\[INFO \]\[logstash.outputs.elasticsearch\] Elasticsearch pool URLs updated {:changes=\>{:re… --- ## [Some Grok filter explanation needed](https://discuss.elastic.co/t/some-grok-filter-explanation-needed/64892)
**Author:** [@sancroth](https://discuss.elastic.co/u/sancroth)\ **Replies:** 1\ **Last updated:** [November 6, 2016, 10:21am UTC](https://discuss.elastic.co/t/some-grok-filter-explanation-needed/64892 "2016-11-06T10:21:35Z")
Ok a colleague of mine made a certain grok filter to create a few fields from suricata logs. An example of an a log input would be this : Nov 3 15:20:33 192.168.1.1 suricata\[42959\]: \[1:2200029:1\] SURICATA ICMPv6 unkno… --- ## [Elasticsearch output Plugin cant send data](https://discuss.elastic.co/t/elasticsearch-output-plugin-cant-send-data/64680)
**Author:** [@BADMAN](https://discuss.elastic.co/u/BADMAN)\ **Replies:** 9\ **Last updated:** [November 6, 2016, 10:14am UTC](https://discuss.elastic.co/t/elasticsearch-output-plugin-cant-send-data/64680 "2016-11-06T10:14:32Z")
Hi i upgraded my local ELK Stack to 5.0.0 . Now Logstash removes the elasticsearch hosturl so it doesnt push data to the Server. 2016-11-02T08:57:56,936\]\[DEBUG\]\[org.apache.http.impl.conn.DefaultHttpClientConnectionOp… --- ## [Match timestamp and assign it as @datetime field](https://discuss.elastic.co/t/match-timestamp-and-assign-it-as-datetime-field/65087)
**Author:** [@Emmanuel\_CHANSON](https://discuss.elastic.co/u/Emmanuel_CHANSON)\ **Replies:** 3\ **Last updated:** [November 6, 2016, 3:56am UTC](https://discuss.elastic.co/t/match-timestamp-and-assign-it-as-datetime-field/65087 "2016-11-06T03:56:18Z")
I have the following array: { "index": "indexjson", "\_type": "json", "\_id": "AVgzYPhrIoaQPqcpVgK8", "\_score": null, "\_source": { "path": "/tmp/CSV/data.json", "@timestamp": "2016-11-05T07:25:41.023Z", … --- ## [Maintaining split events using document id](https://discuss.elastic.co/t/maintaining-split-events-using-document-id/64986)
**Author:** [@Grid32](https://discuss.elastic.co/u/Grid32)\ **Replies:** 1\ **Last updated:** [November 6, 2016, 3:40am UTC](https://discuss.elastic.co/t/maintaining-split-events-using-document-id/64986 "2016-11-06T03:40:22Z")
My Logstash config file that I'm using currently uses a split filter to break the event into several different events. These are then sent to ElasticSearch to store as documents. The question is how do we maintain the … --- ## [Decoding with logstash-avro Flume Avro Sink events](https://discuss.elastic.co/t/decoding-with-logstash-avro-flume-avro-sink-events/65024)
**Author:** [@dcam](https://discuss.elastic.co/u/dcam)\ **Replies:** 0\ **Last updated:** [November 4, 2016, 4:02pm UTC](https://discuss.elastic.co/t/decoding-with-logstash-avro-flume-avro-sink-events/65024 "2016-11-04T16:02:01Z")
I am getting apache Flume events from Avro Sink into Logstash but messages are not correctly decoded from logstash-codec-avro. Some ideas how to solve it would be very helpful My logstash conf looks like: input… --- ## [Debugging csv output](https://discuss.elastic.co/t/debugging-csv-output/64901)
**Author:** [@mehulved](https://discuss.elastic.co/u/mehulved)\ **Replies:** 2\ **Last updated:** [November 5, 2016, 1:27pm UTC](https://discuss.elastic.co/t/debugging-csv-output/64901 "2016-11-05T13:27:46Z")
I downloaded logstash 5.0.0 today and set it up to work with the configuration file from 2.4.0. Here's what the configuration looks like: input { tcp { port =\> 24224 host =\> "127.0.0.1" mode =\> "server" … --- ## [GeoIP2 plugin install throws an error on LS 5.0](https://discuss.elastic.co/t/geoip2-plugin-install-throws-an-error-on-ls-5-0/64328)
**Author:** [@brian.jones](https://discuss.elastic.co/u/brian.jones)\ **Replies:** 4\ **Last updated:** [November 5, 2016, 10:00am UTC](https://discuss.elastic.co/t/geoip2-plugin-install-throws-an-error-on-ls-5-0/64328 "2016-11-05T10:00:46Z")
After upgrading to Logstash 5 I am unable to install the geoip2 plugin (to handle IPv6 addresses). Any help would be great. Error output: ./logstash-plugin install logstash-filter-geoip2 Validating logstash-fil… --- ## [Logstash and JSON array split \[SOLVED\]](https://discuss.elastic.co/t/logstash-and-json-array-split-solved/64841)
**Author:** [@Emmanuel\_CHANSON](https://discuss.elastic.co/u/Emmanuel_CHANSON)\ **Replies:** 10\ **Last updated:** [November 5, 2016, 9:56am UTC](https://discuss.elastic.co/t/logstash-and-json-array-split-solved/64841 "2016-11-05T09:56:19Z")
Hello, I have the following input in JSON file: {"jobs":\[ {"name":"Onboarding\_Build","builds":\[{"duration":127431,"number":2480,"timestamp":1477608643723},{"duration":132275,"number":2479,"timestamp":1477605046524},{"d… --- ## [Querying in logstash](https://discuss.elastic.co/t/querying-in-logstash/64953)
**Author:** [@mak140430](https://discuss.elastic.co/u/mak140430)\ **Replies:** 1\ **Last updated:** [November 5, 2016, 8:53am UTC](https://discuss.elastic.co/t/querying-in-logstash/64953 "2016-11-05T08:53:17Z")
My task is to configure logstash to receive twitter posts that are related to a certain event. Based on that I need to be able to search for terms specified. From what I've read so far, I need the whole ELK stack to quer… --- ## [Repeat insert data use logstash-input-jdbc plugin dump data from mysql to elasticsearch](https://discuss.elastic.co/t/repeat-insert-data-use-logstash-input-jdbc-plugin-dump-data-from-mysql-to-elasticsearch/35723)
**Author:** [@506764932](https://discuss.elastic.co/u/506764932)\ **Replies:** 1\ **Last updated:** [November 5, 2016, 3:54am UTC](https://discuss.elastic.co/t/repeat-insert-data-use-logstash-input-jdbc-plugin-dump-data-from-mysql-to-elasticsearch/35723 "2016-11-05T03:54:56Z")
hi i use logstash-input-jdbc plugin dump data from mysql to elasticsearch here is my input content inlogstash.conf : jdbc { jdbc\_connection\_string =\> "jdbc:mysql://192.168.0.49:3306/dfb" jdbc\_user =\> "test" jdbc\_passw… --- ## [Kv plugin recursive bug?](https://discuss.elastic.co/t/kv-plugin-recursive-bug/52452)
**Author:** [@Shane\_Daniel](https://discuss.elastic.co/u/Shane_Daniel)\ **Replies:** 1\ **Last updated:** [November 4, 2016, 11:56pm UTC](https://discuss.elastic.co/t/kv-plugin-recursive-bug/52452 "2016-11-04T23:56:00Z")
I am getting an unexpected output using the kv plugin with recursive = true. With multiple levels of recursion it does not appear to parse as expected. I am using Logstash version 2.3.2, logstash-filter-kv (2.0.7) My t… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1081) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1083)