# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1084 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1085 --- ## [What is the difference between peer and force\_peer](https://discuss.elastic.co/t/what-is-the-difference-between-peer-and-force-peer/64547)
**Author:** [@firslien](https://discuss.elastic.co/u/firslien)\ **Replies:** 1\ **Last updated:** [November 3, 2016, 6:39am UTC](https://discuss.elastic.co/t/what-is-the-difference-between-peer-and-force-peer/64547 "2016-11-03T06:39:01Z")
logstash input settings, the document is described: ssl\_verify\_mode peer will make the server ask the client to provide a certificate, if the client provides a certificate it will be validated. force\_peer will make… --- ## [Filebeat \> Logstash \> Elasticsearch : Which index template?](https://discuss.elastic.co/t/filebeat-logstash-elasticsearch-which-index-template/64482)
**Author:** [@Patrick\_Salomon](https://discuss.elastic.co/u/Patrick_Salomon)\ **Replies:** 1\ **Last updated:** [November 3, 2016, 6:37am UTC](https://discuss.elastic.co/t/filebeat-logstash-elasticsearch-which-index-template/64482 "2016-11-03T06:37:00Z")
Hi I'm using the new ELK stack, with Filebeat that send data to Logstash, and Logstash sends that to Elasticsearch. Which template should I use? The one from Filebeat or the one from Logstash (with the auto send) Thx … --- ## [Logstash input plugin "elasticsearch" to query only selective fields](https://discuss.elastic.co/t/logstash-input-plugin-elasticsearch-to-query-only-selective-fields/64470)
**Author:** [@krlplm](https://discuss.elastic.co/u/krlplm)\ **Replies:** 1\ **Last updated:** [November 3, 2016, 6:34am UTC](https://discuss.elastic.co/t/logstash-input-plugin-elasticsearch-to-query-only-selective-fields/64470 "2016-11-03T06:34:08Z")
Hi, I am on Logstash 2.4 and trying to query only selective fields \["@timestamp", "user"\] from Elasticsearch 2.4 using the input plugin "elasticsearch". Using the search API for Elasticsearch, I could search for spec… --- ## [Metrics plugin -\> how to copy fields from source event?](https://discuss.elastic.co/t/metrics-plugin-how-to-copy-fields-from-source-event/64424)
**Author:** [@asp](https://discuss.elastic.co/u/asp)\ **Replies:** 1\ **Last updated:** [November 3, 2016, 6:32am UTC](https://discuss.elastic.co/t/metrics-plugin-how-to-copy-fields-from-source-event/64424 "2016-11-03T06:32:06Z")
Hi there, I have a logfile for which I would like to have a metric. Each log event is also having a field named "Stage" which identifies if the event comes from dev, qa or production. Here comes my filter code (i rem… --- ## [Is it mandatory to specify elasticsearch port in logstash output plugin?](https://discuss.elastic.co/t/is-it-mandatory-to-specify-elasticsearch-port-in-logstash-output-plugin/64703)
**Author:** [@elasticheart](https://discuss.elastic.co/u/elasticheart)\ **Replies:** 2\ **Last updated:** [November 3, 2016, 4:46am UTC](https://discuss.elastic.co/t/is-it-mandatory-to-specify-elasticsearch-port-in-logstash-output-plugin/64703 "2016-11-03T04:46:07Z")
Hi, I have setup logstash for fetching files from 2 separate input sources and these are output to two elasticsearch indexes. For one output, I have set; hosts =\> \["192.168.1.1:9200"\] and for other, I have set just … --- ## [Performace: add\_field vs. replace](https://discuss.elastic.co/t/performace-add-field-vs-replace/64736)
**Author:** [@mostolog](https://discuss.elastic.co/u/mostolog)\ **Replies:** 1\ **Last updated:** [November 2, 2016, 9:57pm UTC](https://discuss.elastic.co/t/performace-add-field-vs-replace/64736 "2016-11-02T21:57:27Z")
Hi I have a logstash chain: logstashA output is logstashB input, whose output is logstashC input... What it's better? Setting target value like (on each logstash step): mutate{ add\_field =\> { "\[@metadata\]\[\_in… --- ## [Logstash grok filter with syslog](https://discuss.elastic.co/t/logstash-grok-filter-with-syslog/64386)
**Author:** [@tolasto](https://discuss.elastic.co/u/tolasto)\ **Replies:** 8\ **Last updated:** [November 2, 2016, 8:02pm UTC](https://discuss.elastic.co/t/logstash-grok-filter-with-syslog/64386 "2016-11-02T20:02:37Z")
Hi, I'm tryin to get a filter for this logfile with logstash: 2016-10-30T13:23:47+01:00 router.lan pppd\[12566\]: local IP address 1.2.3.4 The Grok debugger can resolve the fields nicely with this expression: %{DATE:… --- ## [What is multiline size in logstash 2.4.0](https://discuss.elastic.co/t/what-is-multiline-size-in-logstash-2-4-0/64726)
**Author:** [@Roshan](https://discuss.elastic.co/u/Roshan)\ **Replies:** 1\ **Last updated:** [November 2, 2016, 6:07pm UTC](https://discuss.elastic.co/t/what-is-multiline-size-in-logstash-2-4-0/64726 "2016-11-02T18:07:17Z")
hi , currently am using Logstash 2.4.0 and fetching error "multiline\_codec\_max\_lines\_reached". my text is: \[jsp:154\] java.lang.IllegalStateException: getAttribute: Session already invalidated at org.apache.catalina.se… --- ## [SNMPTrap logstash failed](https://discuss.elastic.co/t/snmptrap-logstash-failed/64713)
**Author:** [@Hao\_Zhang](https://discuss.elastic.co/u/Hao_Zhang)\ **Replies:** 1\ **Last updated:** [November 2, 2016, 4:15pm UTC](https://discuss.elastic.co/t/snmptrap-logstash-failed/64713 "2016-11-02T16:15:20Z")
Hi everyone. I am a beginner of Logstash and try to utilize it to receive the SNMP traps from the managed devices. For convenience, I send the simulated SNMP traps to Logstash server. The problem is I can receive the sim… --- ## [Logs not moved from Logstash to Elasticsearch](https://discuss.elastic.co/t/logs-not-moved-from-logstash-to-elasticsearch/64683)
**Author:** [@manojvenkat](https://discuss.elastic.co/u/manojvenkat)\ **Replies:** 6\ **Last updated:** [November 2, 2016, 3:43pm UTC](https://discuss.elastic.co/t/logs-not-moved-from-logstash-to-elasticsearch/64683 "2016-11-02T15:43:44Z")
Dear All, I have installed ELK on single server. Now I am just trying to read a sample log file in my tmp folder andoutput it to elasticsearch and display in Kibana . Below is my logstash configuration file: input… --- ## [Tone down the "Running health check" messages](https://discuss.elastic.co/t/tone-down-the-running-health-check-messages/64604)
**Author:** [@ave19](https://discuss.elastic.co/u/ave19)\ **Replies:** 2\ **Last updated:** [November 2, 2016, 1:21pm UTC](https://discuss.elastic.co/t/tone-down-the-running-health-check-messages/64604 "2016-11-02T13:21:20Z")
I'm getting this every 5 sec: \[2016-11-01T14:25:39,416\]\[INFO \]\[logstash.outputs.elasticsearch\] Running health check to see if an Elasticsearch connection is working {:url=\>#\ **Author:** [@fmeehan](https://discuss.elastic.co/u/fmeehan)\ **Replies:** 3\ **Last updated:** [November 2, 2016, 1:15pm UTC](https://discuss.elastic.co/t/problem-running-wmi-plugin/63643 "2016-11-02T13:15:47Z") Hi all , I am trying to use logstash-input-wmi version 3.0 with logstash 2.4.0 on a Windows Server 2012r2. I have downloaded the Gem file and ran the logstash-plugin install script, it ran fine, when I run logstash-… --- ## [Get events through Logstash to Qradar](https://discuss.elastic.co/t/get-events-through-logstash-to-qradar/62502)
**Author:** [@christiaan.spriet](https://discuss.elastic.co/u/christiaan.spriet)\ **Replies:** 9\ **Last updated:** [November 2, 2016, 12:33pm UTC](https://discuss.elastic.co/t/get-events-through-logstash-to-qradar/62502 "2016-11-02T12:33:39Z")
Hi, we're planning on using Logstash as a central shippier to send logs to a SIEM (qradar in this case) & Logstash. Qradar however doesn't want to automatically parse these events as it doesn't recognize the source (it… --- ## ["logstash-output-gelf" plugin not working with "logstash-5.0.0"](https://discuss.elastic.co/t/logstash-output-gelf-plugin-not-working-with-logstash-5-0-0/64575)
**Author:** [@Bragolgirith](https://discuss.elastic.co/u/Bragolgirith)\ **Replies:** 2\ **Last updated:** [November 2, 2016, 11:34am UTC](https://discuss.elastic.co/t/logstash-output-gelf-plugin-not-working-with-logstash-5-0-0/64575 "2016-11-02T11:34:57Z")
I'm trying to forward a log file by using logstash-5.0.0 with the logstash-output-gelf-3.1.1 plugin on Windows 7 and get the following error: \[2016-10-28T14:52:17,756\]\[INFO \]\[logstash.pipeline \] Pipeline main s… --- ## [StatusLogger error while starting Logstash 5, but indexting working](https://discuss.elastic.co/t/statuslogger-error-while-starting-logstash-5-but-indexting-working/64686)
**Author:** [@elasticheart](https://discuss.elastic.co/u/elasticheart)\ **Replies:** 4\ **Last updated:** [November 2, 2016, 11:17am UTC](https://discuss.elastic.co/t/statuslogger-error-while-starting-logstash-5-but-indexting-working/64686 "2016-11-02T11:17:08Z")
Hi, When I start logstash using the command; ./logstash --path.settings=../config/ -f ../logstash.conf I am getting the error; ERROR StatusLogger Unable to access file://../config/log4j2.properties But after some… --- ## [Kafka -\> ES/HDFS with Logstash or Kafka Stream/Connect](https://discuss.elastic.co/t/kafka-es-hdfs-with-logstash-or-kafka-stream-connect/64682)
**Author:** [@imehl](https://discuss.elastic.co/u/imehl)\ **Replies:** 1\ **Last updated:** [November 2, 2016, 10:46am UTC](https://discuss.elastic.co/t/kafka-es-hdfs-with-logstash-or-kafka-stream-connect/64682 "2016-11-02T10:46:59Z")
Hi, I use Kafka for message queue/processing. My question is about performance/best practice. I will do my own performance tests but maybe someone has results/experience already. The data is raw in a Kafka (0.10) top… --- ## [Does logstash has connector to appdynamics](https://discuss.elastic.co/t/does-logstash-has-connector-to-appdynamics/64667)
**Author:** [@saisn](https://discuss.elastic.co/u/saisn)\ **Replies:** 1\ **Last updated:** [November 2, 2016, 10:06am UTC](https://discuss.elastic.co/t/does-logstash-has-connector-to-appdynamics/64667 "2016-11-02T10:06:01Z")
Hi I need to know if logstash has connector to appdynamics. It would be also helpful if you can point to some good reference sites Thank you --- ## [JDBC Input question](https://discuss.elastic.co/t/jdbc-input-question/64613)
**Author:** [@tglasgow](https://discuss.elastic.co/u/tglasgow)\ **Replies:** 1\ **Last updated:** [November 2, 2016, 9:22am UTC](https://discuss.elastic.co/t/jdbc-input-question/64613 "2016-11-02T09:22:14Z")
Working to test this functionality and have a basic question. The inout documentation states "This scheduling syntax is powered by rufus-scheduler." I am wondering if Rufus needs to be installed or is this already a part… --- ## [CURL command not working](https://discuss.elastic.co/t/curl-command-not-working/64519)
**Author:** [@VijayKarthikeyan](https://discuss.elastic.co/u/VijayKarthikeyan)\ **Replies:** 7\ **Last updated:** [November 2, 2016, 6:40am UTC](https://discuss.elastic.co/t/curl-command-not-working/64519 "2016-11-02T06:40:43Z")
While doing some handson with ELK, I happen to delete an Index from ELK. I used the below command curl -XDELETE 'http://localhost:9200/logstash-2016.10.20' but this throws the below error Invoke-WebRequest : A para… --- ## [Logstash not executing after pipeline main started](https://discuss.elastic.co/t/logstash-not-executing-after-pipeline-main-started/64531)
**Author:** [@vann](https://discuss.elastic.co/u/vann)\ **Replies:** 6\ **Last updated:** [November 2, 2016, 5:41am UTC](https://discuss.elastic.co/t/logstash-not-executing-after-pipeline-main-started/64531 "2016-11-02T05:41:25Z")
I get stuck in this situation for logstash not executing after pipeline main started. Settings: Default pipeline workers: 4 Pipeline main started I have checked I have "touch" the .csv so the file last modify date… --- ## [Need help with parsing multiline XML file](https://discuss.elastic.co/t/need-help-with-parsing-multiline-xml-file/64599)
**Author:** [@pikuchan](https://discuss.elastic.co/u/pikuchan)\ **Replies:** 3\ **Last updated:** [November 2, 2016, 5:01am UTC](https://discuss.elastic.co/t/need-help-with-parsing-multiline-xml-file/64599 "2016-11-02T05:01:52Z")
Hey everyone, I am new to logstash and am trying to figure out how to get an xml file to load properly and I just can't seem to get it. I'm sure there's plenty of user error here, but I've done a ton of trial and error. … --- ## [Logstash not starting. Cannot find config files](https://discuss.elastic.co/t/logstash-not-starting-cannot-find-config-files/64596)
**Author:** [@skeer](https://discuss.elastic.co/u/skeer)\ **Replies:** 0\ **Last updated:** [November 1, 2016, 5:13pm UTC](https://discuss.elastic.co/t/logstash-not-starting-cannot-find-config-files/64596 "2016-11-01T17:13:24Z")
Following the tutorial here: https://www.elastic.co/guide/en/logstash/5.0/installing-logstash.html I installs LS via the yum repo, and I think the location of the conf files got confused. I have an /etc/logstash/confi… --- ## [Logstash date parser not parsing correctly](https://discuss.elastic.co/t/logstash-date-parser-not-parsing-correctly/64227)
**Author:** [@YuWatanabe](https://discuss.elastic.co/u/YuWatanabe)\ **Replies:** 4\ **Last updated:** [November 1, 2016, 11:50pm UTC](https://discuss.elastic.co/t/logstash-date-parser-not-parsing-correctly/64227 "2016-11-01T23:50:45Z")
I am using logstash for parsing events but having problem with the date parser. My environment is below. \[root@elk-analytic logstash\]# rpm -qi logstash Name : logstash Epoch : 1 Version : 5.0.0 Release… --- ## [How to set metric in logstash datadog\_metrics plugin](https://discuss.elastic.co/t/how-to-set-metric-in-logstash-datadog-metrics-plugin/50793)
**Author:** [@Amos\_Shahar](https://discuss.elastic.co/u/Amos_Shahar)\ **Replies:** 2\ **Last updated:** [November 1, 2016, 11:08pm UTC](https://discuss.elastic.co/t/how-to-set-metric-in-logstash-datadog-metrics-plugin/50793 "2016-11-01T23:08:47Z")
I am trying to send custom metrics to datadog using the datadog\_metrics output plugin, All parameters seems to work fine as I can see the host and metric\_name in the datadog. my problem is with the metric\_value paramete… --- ## [RPM packaging problems for CentOS 6/7](https://discuss.elastic.co/t/rpm-packaging-problems-for-centos-6-7/63736)
**Author:** [@shog](https://discuss.elastic.co/u/shog)\ **Replies:** 10\ **Last updated:** [November 1, 2016, 10:43pm UTC](https://discuss.elastic.co/t/rpm-packaging-problems-for-centos-6-7/63736 "2016-11-01T22:43:06Z")
Hi, I've noticed that new packaging system (tested rc1) has probably few flaws: On CentOS6: - "service logstash stop/start" doesn't work anymore due to being handled by upstart start/stop, which breaks most automati… --- ## [Logstash and Kibana Visualization: A Simple Flag](https://discuss.elastic.co/t/logstash-and-kibana-visualization-a-simple-flag/64382)
**Author:** [@Mike\_Thoma](https://discuss.elastic.co/u/Mike_Thoma)\ **Replies:** 7\ **Last updated:** [November 1, 2016, 9:18pm UTC](https://discuss.elastic.co/t/logstash-and-kibana-visualization-a-simple-flag/64382 "2016-11-01T21:18:48Z")
WARNING: extreme ELK newbie.... Good afternoon ELK friends, I am extremely new to ELK... and I apologize in advanced if any of my questions seem elementary. What I'm trying to do, is simply visualize in Kibana fro… --- ## [Service logstash configtest gone](https://discuss.elastic.co/t/service-logstash-configtest-gone/64488)
**Author:** [@rsaeks](https://discuss.elastic.co/u/rsaeks)\ **Replies:** 3\ **Last updated:** [November 1, 2016, 6:40pm UTC](https://discuss.elastic.co/t/service-logstash-configtest-gone/64488 "2016-11-01T18:40:18Z")
In pre 5.0 instances of logstash, after making changes to a config file it was possible to run: service logstash configtest After updating to version 5, this no longer works and returns back: The service command s… --- ## [On ingest I need to create a new field based on the value of a field in the document](https://discuss.elastic.co/t/on-ingest-i-need-to-create-a-new-field-based-on-the-value-of-a-field-in-the-document/64041)
**Author:** [@Christopher\_Pinto](https://discuss.elastic.co/u/Christopher_Pinto)\ **Replies:** 4\ **Last updated:** [November 1, 2016, 6:39pm UTC](https://discuss.elastic.co/t/on-ingest-i-need-to-create-a-new-field-based-on-the-value-of-a-field-in-the-document/64041 "2016-11-01T18:39:24Z")
I have a field X that has the value fw.auth.deny or fw.auth.allow How can I create a new field that is called y that has the value fw in it using logstash or mapping templates? Thanks in advance. Chris P.S. I looke… --- ## [KV Plugin take only first key from a split\_field Logstash 5.0](https://discuss.elastic.co/t/kv-plugin-take-only-first-key-from-a-split-field-logstash-5-0/64499)
**Author:** [@jattilioz](https://discuss.elastic.co/u/jattilioz)\ **Replies:** 2\ **Last updated:** [November 1, 2016, 6:13pm UTC](https://discuss.elastic.co/t/kv-plugin-take-only-first-key-from-a-split-field-logstash-5-0/64499 "2016-11-01T18:13:47Z")
Hi All, Trying to work through this issue I am having parsing with KV plugin. My kv pairs are split with "=" and fields are delimited by "|". A small example below. src=192.168.1.1|dst=192.168.1.2|resource=http://ww… --- ## [Nested Objects Script Merge](https://discuss.elastic.co/t/nested-objects-script-merge/64581)
**Author:** [@dejwoo](https://discuss.elastic.co/u/dejwoo)\ **Replies:** 0\ **Last updated:** [November 1, 2016, 3:36pm UTC](https://discuss.elastic.co/t/nested-objects-script-merge/64581 "2016-11-01T15:36:28Z")
Hey all! Simple Question :). I have in elastic nested field called account. Documents come from logstash which is set to doc\_as\_upsert: true, how to add every new account to the nested object? Using scripts? If so, h… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1083) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1085)