# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1087 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1088 --- ## [Multiple drivers/jar in jdbc\_driver\_library](https://discuss.elastic.co/t/multiple-drivers-jar-in-jdbc-driver-library/64060)
**Author:** [@gmmurugan](https://discuss.elastic.co/u/gmmurugan)\ **Replies:** 0\ **Last updated:** [October 26, 2016, 8:26pm UTC](https://discuss.elastic.co/t/multiple-drivers-jar-in-jdbc-driver-library/64060 "2016-10-26T20:26:09Z")
in logstash input plugin for jdbc jdbc\_driver\_library =\> "/home/user/aa.jar:/home/user/bb.jar" ?? how can i exactly add multiple jar without addding in os classpath env ? --- ## [How is collate filter supposed to work?](https://discuss.elastic.co/t/how-is-collate-filter-supposed-to-work/34038)
**Author:** [@erikstephens](https://discuss.elastic.co/u/erikstephens)\ **Replies:** 2\ **Last updated:** [October 26, 2016, 8:09pm UTC](https://discuss.elastic.co/t/how-is-collate-filter-supposed-to-work/34038 "2016-10-26T20:09:06Z")
With the following config and data file, logstash emits 10 events. I was expecting 2 events with orig-events 1-5 as the message for event 1 and orig-events 6-10 as the message for event 2. Test against 1.5.4 and 2.0.0.… --- ## [ES 5.0.0-rc1 Index Created, but not considered while importing data to ES](https://discuss.elastic.co/t/es-5-0-0-rc1-index-created-but-not-considered-while-importing-data-to-es/64042)
**Author:** [@sps90](https://discuss.elastic.co/u/sps90)\ **Replies:** 0\ **Last updated:** [October 26, 2016, 6:01pm UTC](https://discuss.elastic.co/t/es-5-0-0-rc1-index-created-but-not-considered-while-importing-data-to-es/64042 "2016-10-26T18:01:19Z")
I'm using the 5.0.0-rc1 version of ELK stack I am able to create an index which is visible in the ES server But when i try to import data using the said index, it's not considered and the data is also not loaded … --- ## [How to send \\n(newline chara) in XMPP/Jabbar output filter?](https://discuss.elastic.co/t/how-to-send-n-newline-chara-in-xmpp-jabbar-output-filter/63721)
**Author:** [@lshekhar](https://discuss.elastic.co/u/lshekhar)\ **Replies:** 1\ **Last updated:** [October 26, 2016, 5:38pm UTC](https://discuss.elastic.co/t/how-to-send-n-newline-chara-in-xmpp-jabbar-output-filter/63721 "2016-10-26T17:38:38Z")
Wanted to split message with multiple line. I am inserting \\n(also tried with \\r, \\r\\n nothing helped) , but it is taken as normal string. Where can I get info on how to send special character as it is? RequestId: 222… --- ## [Migrating from Graylog to Logstash (SOLVED)](https://discuss.elastic.co/t/migrating-from-graylog-to-logstash-solved/64005)
**Author:** [@Houss](https://discuss.elastic.co/u/Houss)\ **Replies:** 2\ **Last updated:** [October 26, 2016, 4:19pm UTC](https://discuss.elastic.co/t/migrating-from-graylog-to-logstash-solved/64005 "2016-10-26T16:19:52Z")
Hello, At the moment our cluster is composed of: - 4 elasticsearch nodes - 3 graylog instances for the logs processing/extractors - Kibana for the visualization (graph, dashboard) I want to upgrade our elastic nodes … --- ## [Is it possible to launch a Ruby debugger from within the Logstash Ruby filter plugin?](https://discuss.elastic.co/t/is-it-possible-to-launch-a-ruby-debugger-from-within-the-logstash-ruby-filter-plugin/64017)
**Author:** [@davidpellerin](https://discuss.elastic.co/u/davidpellerin)\ **Replies:** 0\ **Last updated:** [October 26, 2016, 2:30pm UTC](https://discuss.elastic.co/t/is-it-possible-to-launch-a-ruby-debugger-from-within-the-logstash-ruby-filter-plugin/64017 "2016-10-26T14:30:15Z")
Is it possible to launch a Ruby debugger from within the Logstash Ruby filter plugin? It would be very handy for debugging. --- ## [Http\_poller with kerberos / NTLM authentication](https://discuss.elastic.co/t/http-poller-with-kerberos-ntlm-authentication/62867)
**Author:** [@Rom1](https://discuss.elastic.co/u/Rom1)\ **Replies:** 1\ **Last updated:** [October 26, 2016, 1:53pm UTC](https://discuss.elastic.co/t/http-poller-with-kerberos-ntlm-authentication/62867 "2016-10-26T13:53:18Z")
Hi all, I need to collect data from a server through http\_poller (http and not https) I've tried with basic authent (login/pwd) but, of course, it failed (I can connect to the web server with this login/pwd with SSO) … --- ## [Adding new field in Logstash 5.0.0\_rc1 with Ruby plugin](https://discuss.elastic.co/t/adding-new-field-in-logstash-5-0-0-rc1-with-ruby-plugin/63911)
**Author:** [@alesnav](https://discuss.elastic.co/u/alesnav)\ **Replies:** 2\ **Last updated:** [October 26, 2016, 8:02am UTC](https://discuss.elastic.co/t/adding-new-field-in-logstash-5-0-0-rc1-with-ruby-plugin/63911 "2016-10-26T08:02:23Z")
Hello there! I am trying to set up a new field called fingerprint for each event received by Logstash. This new field must be calculated using HMAC with sha256 and a salt. I was able to configure it without any probl… --- ## [Could not able to use geo\_ip in logstash 2.4](https://discuss.elastic.co/t/could-not-able-to-use-geo-ip-in-logstash-2-4/63689)
**Author:** [@Kim\_Daniel](https://discuss.elastic.co/u/Kim_Daniel)\ **Replies:** 10\ **Last updated:** [October 26, 2016, 11:06am UTC](https://discuss.elastic.co/t/could-not-able-to-use-geo-ip-in-logstash-2-4/63689 "2016-10-26T11:06:54Z")
hi all, I'm trying to use geoip from apache access log with logstash 2.4, elasticsearch 2.4, kibna 4.6. my logstash filter is... input { file { path =\> "/var/log/httpd/access\_log" type =\> "apache" … --- ## [\[suggestion\] custom pipeline labels/aliases/names in STATS API](https://discuss.elastic.co/t/suggestion-custom-pipeline-labels-aliases-names-in-stats-api/63991)
**Author:** [@shog](https://discuss.elastic.co/u/shog)\ **Replies:** 0\ **Last updated:** [October 26, 2016, 10:48am UTC](https://discuss.elastic.co/t/suggestion-custom-pipeline-labels-aliases-names-in-stats-api/63991 "2016-10-26T10:48:54Z")
Hi, First of all thanks for providing new stats API, especially all the stats related to pipeline processing. This is super awesome! I already made a lot of improvements by investigating biggest time consumers. I hav… --- ## [Hardware suggestion](https://discuss.elastic.co/t/hardware-suggestion/63989)
**Author:** [@Raj\_Kumar](https://discuss.elastic.co/u/Raj_Kumar)\ **Replies:** 1\ **Last updated:** [October 26, 2016, 10:41am UTC](https://discuss.elastic.co/t/hardware-suggestion/63989 "2016-10-26T10:41:04Z")
Hi All, Its been a few months we are using the ELK stack and its pretty amazing.We do planning to get commercial plugins which is seems to be awesome. So we thought we could implement with Production.By seeing some blo… --- ## [ES "merging" indexes](https://discuss.elastic.co/t/es-merging-indexes/63866)
**Author:** [@hgpit](https://discuss.elastic.co/u/hgpit)\ **Replies:** 1\ **Last updated:** [October 26, 2016, 10:01am UTC](https://discuss.elastic.co/t/es-merging-indexes/63866 "2016-10-26T10:01:38Z")
Hello, Very new to Logstash and ElasticSearch (2.4.1), so am just experimenting at this stage. We are trying to create two indexes in ES, which are sourced from MySQL in Logstash, then outputted to ES. At first, it… --- ## [Jdbc plugin for logstash on Linux](https://discuss.elastic.co/t/jdbc-plugin-for-logstash-on-linux/63918)
**Author:** [@shankargouda](https://discuss.elastic.co/u/shankargouda)\ **Replies:** 1\ **Last updated:** [October 26, 2016, 9:15am UTC](https://discuss.elastic.co/t/jdbc-plugin-for-logstash-on-linux/63918 "2016-10-26T09:15:04Z")
Hi Team, while executing the ./logstash -f simple-out.conf to connect to DB2 table, Facing the below error : Couldn't find any input plugin named 'jdbc'. Are you sure this is correct? Trying to load the jdbc inpu… --- ## [Json load in elasticserach thru logstash](https://discuss.elastic.co/t/json-load-in-elasticserach-thru-logstash/60570)
**Author:** [@ppramanick](https://discuss.elastic.co/u/ppramanick)\ **Replies:** 20\ **Last updated:** [October 26, 2016, 8:40am UTC](https://discuss.elastic.co/t/json-load-in-elasticserach-thru-logstash/60570 "2016-10-26T08:40:33Z")
My SImple JSON FILE IS as below :- {"hello":"world", "goodnight": "moon"} configuration file in bin/logstash.conf as below :- input { file { path =\> \["/home/cloudera/Desktop/Data/LOGSTASH\_DATA/… --- ## [Logstahs complains of short memory and stalls](https://discuss.elastic.co/t/logstahs-complains-of-short-memory-and-stalls/63966)
**Author:** [@ndarkness](https://discuss.elastic.co/u/ndarkness)\ **Replies:** 0\ **Last updated:** [October 26, 2016, 7:25am UTC](https://discuss.elastic.co/t/logstahs-complains-of-short-memory-and-stalls/63966 "2016-10-26T07:25:53Z")
Hello, Recently I have a crash in logstash, looking the logs I saw that it was due to memory, the log said the below root@VSPB:/var/log/logstash# cat logstash.err.1 Error: Your application used more memory… --- ## [What is wrong in my grok filter work for logstash?](https://discuss.elastic.co/t/what-is-wrong-in-my-grok-filter-work-for-logstash/63583)
**Author:** [@ndarkness](https://discuss.elastic.co/u/ndarkness)\ **Replies:** 7\ **Last updated:** [October 26, 2016, 7:26am UTC](https://discuss.elastic.co/t/what-is-wrong-in-my-grok-filter-work-for-logstash/63583 "2016-10-26T07:26:46Z")
I would like to create a grok filter in Logstash to set as field, a concrete part of a syslog message TTN-GW string should be that field, the sort of message that is being sent to Logstash is as follows ( it comes from a… --- ## [Filter out Large Messages and Add Tag](https://discuss.elastic.co/t/filter-out-large-messages-and-add-tag/63853)
**Author:** [@dawiro](https://discuss.elastic.co/u/dawiro)\ **Replies:** 2\ **Last updated:** [October 26, 2016, 7:03am UTC](https://discuss.elastic.co/t/filter-out-large-messages-and-add-tag/63853 "2016-10-26T07:03:29Z")
Hi, We have problems caused by very large log messages. Can someone help me with how to formulate the following filter logic: Drop the message field when it is over "n" bytes Add a tag showing that the message field h… --- ## [Data import by Logstash error](https://discuss.elastic.co/t/data-import-by-logstash-error/63017)
**Author:** [@Hyojoung\_Shin](https://discuss.elastic.co/u/Hyojoung_Shin)\ **Replies:** 3\ **Last updated:** [October 26, 2016, 6:50am UTC](https://discuss.elastic.co/t/data-import-by-logstash-error/63017 "2016-10-26T06:50:58Z")
Hi. I am using Logstash for importing data from Oracle to Elastic Cloud. The working environment is macbook. I made a conf file for importing. It works fine(I checked it with Kibana in realtime - I can see graph … --- ## [Logstash translate plugin dictionary](https://discuss.elastic.co/t/logstash-translate-plugin-dictionary/63896)
**Author:** [@Ollm4c](https://discuss.elastic.co/u/Ollm4c)\ **Replies:** 1\ **Last updated:** [October 26, 2016, 6:05am UTC](https://discuss.elastic.co/t/logstash-translate-plugin-dictionary/63896 "2016-10-26T06:05:03Z")
Hi everyone, Is there a way to specify "dictionary\_path" value as a field previously read? Thank you in advance --- ## [Logstash with Grok and \_jsonparsefailure](https://discuss.elastic.co/t/logstash-with-grok-and--jsonparsefailure/63719)
**Author:** [@Guillermo\_Ortiz](https://discuss.elastic.co/u/Guillermo_Ortiz)\ **Replies:** 1\ **Last updated:** [October 26, 2016, 6:01am UTC](https://discuss.elastic.co/t/logstash-with-grok-and--jsonparsefailure/63719 "2016-10-26T06:01:15Z")
I'm trying to parse the access log from NGINX with Logstash but, I get an \_jsonparsefailure although I'm not using a JSON format. Why do I get that \_jsonparsefailure? My input lines are like nginx: 127.0.0.1 - - \[24/Oc… --- ## [Manually checking if confs work properly](https://discuss.elastic.co/t/manually-checking-if-confs-work-properly/63785)
**Author:** [@sancroth](https://discuss.elastic.co/u/sancroth)\ **Replies:** 4\ **Last updated:** [October 26, 2016, 5:58am UTC](https://discuss.elastic.co/t/manually-checking-if-confs-work-properly/63785 "2016-10-26T05:58:57Z")
Is there a possible way to check if some new grok rule or filter-mutate works without waiting index rotation? We added some new stuff and we wanna check out if the new index will work properly as expected. --- ## [Logstash failed to stop the service](https://discuss.elastic.co/t/logstash-failed-to-stop-the-service/63958)
**Author:** [@bopa](https://discuss.elastic.co/u/bopa)\ **Replies:** 1\ **Last updated:** [October 26, 2016, 5:50am UTC](https://discuss.elastic.co/t/logstash-failed-to-stop-the-service/63958 "2016-10-26T05:50:24Z")
I'm experiencing the logstash service failed to start after I issue systemctl restart logstash Output: systemctl status logstash ● logstash.service - LSB: Starts Logstash as a daemon. \*\* Loaded: loaded (/etc/rc.… --- ## [Help reviewing filter/input/ouput Packetbeat nor working with LS](https://discuss.elastic.co/t/help-reviewing-filter-input-ouput-packetbeat-nor-working-with-ls/62489)
**Author:** [@Kernel\_Panic](https://discuss.elastic.co/u/Kernel_Panic)\ **Replies:** 8\ **Last updated:** [October 25, 2016, 6:24pm UTC](https://discuss.elastic.co/t/help-reviewing-filter-input-ouput-packetbeat-nor-working-with-ls/62489 "2016-10-25T18:24:37Z")
Hi there guys, I've been having this issue https://discuss.elastic.co/t/packetbeat-index-not-created-and-no-info-from-kibana/62197/10 , I cannot ingest the data sent by packetbeat into elasticsearch through logstash,… --- ## [Re-Indexing Via ES Document Numbers](https://discuss.elastic.co/t/re-indexing-via-es-document-numbers/63915)
**Author:** [@Kryten](https://discuss.elastic.co/u/Kryten)\ **Replies:** 0\ **Last updated:** [October 25, 2016, 6:00pm UTC](https://discuss.elastic.co/t/re-indexing-via-es-document-numbers/63915 "2016-10-25T18:00:15Z")
Hi, I am trying to re-index some data by reading the information out of ES using an input of:- input { elasticsearch { hosts =\> "\" index =\> "\" } } This appe… --- ## [A beginner needs help](https://discuss.elastic.co/t/a-beginner-needs-help/63798)
**Author:** [@mmehraban](https://discuss.elastic.co/u/mmehraban)\ **Replies:** 2\ **Last updated:** [October 25, 2016, 12:38pm UTC](https://discuss.elastic.co/t/a-beginner-needs-help/63798 "2016-10-25T12:38:59Z")
Hi guys, I'm completely new to Elasticsearch world.At work akse me to install ELK and compare it with Splunk that we have running.I have followed this link https://www.digitalocean.com/community/tutorials/how-to-instal… --- ## [Config Files contains non-ascii charaters](https://discuss.elastic.co/t/config-files-contains-non-ascii-charaters/63847)
**Author:** [@saunderstd](https://discuss.elastic.co/u/saunderstd)\ **Replies:** 4\ **Last updated:** [October 25, 2016, 11:50am UTC](https://discuss.elastic.co/t/config-files-contains-non-ascii-charaters/63847 "2016-10-25T11:50:14Z")
Morning I have two issues. One that the logs are not being populated in kibana and the second is that I am throwing errors shown below. Any help is appreciated. An unexpected error occurred! {:error=\>#, :class=\>"Runti… --- ## [How do I get statsd to increment a number](https://discuss.elastic.co/t/how-do-i-get-statsd-to-increment-a-number/63826)
**Author:** [@Sam\_Saffron](https://discuss.elastic.co/u/Sam_Saffron)\ **Replies:** 7\ **Last updated:** [October 25, 2016, 9:22am UTC](https://discuss.elastic.co/t/how-do-i-get-statsd-to-increment-a-number/63826 "2016-10-25T09:22:37Z")
I have an output rule for statsd statsd { host =\> "graphite-statsd" port =\> 8125 namespace =\> "" sender =\> "%{backend\_name}" increment =\> \[ "%{http\_st… --- ## [No living connections in the connection pool](https://discuss.elastic.co/t/no-living-connections-in-the-connection-pool/63760)
**Author:** [@rpoveda](https://discuss.elastic.co/u/rpoveda)\ **Replies:** 1\ **Last updated:** [October 24, 2016, 2:45pm UTC](https://discuss.elastic.co/t/no-living-connections-in-the-connection-pool/63760 "2016-10-24T14:45:31Z")
Hi ELK Server (Ubuntu Server 16.04) Nginx /usr/sbin/nginx LISTEN ON: 0.0.0.0:80 Kibana /usr/share/kibana/bin/kibana --version 5.0.0-rc1 LISTEN ON: 127.0.0.1:5601 cat /etc/kibana/kibana.yml ¦ grep -v ^# … --- ## [How to open websocket with authorization token](https://discuss.elastic.co/t/how-to-open-websocket-with-authorization-token/59769)
**Author:** [@spuder](https://discuss.elastic.co/u/spuder)\ **Replies:** 1\ **Last updated:** [October 25, 2016, 9:06am UTC](https://discuss.elastic.co/t/how-to-open-websocket-with-authorization-token/59769 "2016-10-25T09:06:02Z")
I'm trying to get logstash to listen to a websocket that requires authentication. WebSocket documentation http://seeed-studio.github.io/Wio\_Link/#node-event-api-use-websocket Javascript example var ws = new WebSocket… --- ## [LS 2.4.0 beats SSL plugin: unsupported ciphersuite](https://discuss.elastic.co/t/ls-2-4-0-beats-ssl-plugin-unsupported-ciphersuite/63843)
**Author:** [@buzzdeee](https://discuss.elastic.co/u/buzzdeee)\ **Replies:** 0\ **Last updated:** [October 25, 2016, 7:56am UTC](https://discuss.elastic.co/t/ls-2-4-0-beats-ssl-plugin-unsupported-ciphersuite/63843 "2016-10-25T07:56:27Z")
Hi, I recently updated from LS 2.3.4 to 2.4.0 and found my beats plugin not working anymore. My LS config for the input plugin looks like: beats { port =\> 12344 ssl =\> true ssl\_certificate =\> "/etc/lo… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1086) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1088)