# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1092 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1093 --- ## [LoadError: no such file to load -- bundler/dep\_proxy](https://discuss.elastic.co/t/loaderror-no-such-file-to-load-bundler-dep-proxy/62666)
**Author:** [@lyxhaven](https://discuss.elastic.co/u/lyxhaven)\ **Replies:** 0\ **Last updated:** [October 10, 2016, 9:15pm UTC](https://discuss.elastic.co/t/loaderror-no-such-file-to-load-bundler-dep-proxy/62666 "2016-10-10T21:15:40Z")
I have installed logstash-2.4.0 and logstash-input-jdbc plugin When I was trying to run logstash by: bin/logstash -f jdbc\_oracle.conf or bin/logstash --configtest -f jdbc\_oracle.conf I got this error: LoadError: no s… --- ## [Issue connecting logstash with Oracle db](https://discuss.elastic.co/t/issue-connecting-logstash-with-oracle-db/62869)
**Author:** [@Daz9o1](https://discuss.elastic.co/u/Daz9o1)\ **Replies:** 0\ **Last updated:** [October 12, 2016, 8:51pm UTC](https://discuss.elastic.co/t/issue-connecting-logstash-with-oracle-db/62869 "2016-10-12T20:51:52Z")
Hi, I am a newbie to logstash/ELK and have a requirement of creating a working poc to monitor db trends, MQs and specific folders. I created a basic config file below and tried running it with a vpn connection to cli… --- ## [Multiple patterns for log file](https://discuss.elastic.co/t/multiple-patterns-for-log-file/62831)
**Author:** [@dmitry1980](https://discuss.elastic.co/u/dmitry1980)\ **Replies:** 1\ **Last updated:** [October 12, 2016, 6:27pm UTC](https://discuss.elastic.co/t/multiple-patterns-for-log-file/62831 "2016-10-12T18:27:05Z")
I have two patterns for the logs file. Grok debugger shows a match, but I see Kibana show grokparsefailure for pattern TEST2. What could be the problem? input { file { type =\> "nginx\_access" path =\> "/var/log/… --- ## [Supported field types?](https://discuss.elastic.co/t/supported-field-types/62839)
**Author:** [@DigiAngel](https://discuss.elastic.co/u/DigiAngel)\ **Replies:** 4\ **Last updated:** [October 12, 2016, 5:54pm UTC](https://discuss.elastic.co/t/supported-field-types/62839 "2016-10-12T17:54:59Z")
Topic says it...specifically looking at mutate -\> convert: Convert a field’s value to a different type, like turning a string to an integer. I'm suspecting that my config with converting to type "ip" is no longer supp… --- ## [Parsing Cisco ACS logs](https://discuss.elastic.co/t/parsing-cisco-acs-logs/60887)
**Author:** [@ANU\_SARA\_VARGHESE](https://discuss.elastic.co/u/ANU_SARA_VARGHESE)\ **Replies:** 2\ **Last updated:** [October 12, 2016, 3:05pm UTC](https://discuss.elastic.co/t/parsing-cisco-acs-logs/60887 "2016-10-12T15:05:53Z")
Hi, Is there is any predefined patterns through which Cisco ACS logs can be filtered like the syslog? --- ## [Logstash Flush Logs Explanation](https://discuss.elastic.co/t/logstash-flush-logs-explanation/62751)
**Author:** [@chromechris](https://discuss.elastic.co/u/chromechris)\ **Replies:** 2\ **Last updated:** [October 12, 2016, 3:47pm UTC](https://discuss.elastic.co/t/logstash-flush-logs-explanation/62751 "2016-10-12T15:47:35Z")
Hello Loggers, I was wondering if someone could explain what the logs produced by logstash in "logstash.log" mean when you restart Logstash and there is an event flush after sending the SIGTERM to Logstash. Sample Log: … --- ## [NGINX Log mapping](https://discuss.elastic.co/t/nginx-log-mapping/61638)
**Author:** [@dmitry1980](https://discuss.elastic.co/u/dmitry1980)\ **Replies:** 4\ **Last updated:** [October 12, 2016, 3:17pm UTC](https://discuss.elastic.co/t/nginx-log-mapping/61638 "2016-10-12T15:17:09Z")
I setup ELK server (kibana-4.6.1,logstash-2.4,elasticsearch-2.4) I have setup one index pattern (logstash-\*) and using one time-field name (@timestamp) NGUSERNAME \[a-zA-Z.@-+\_%\]+ NGUSER %{NGUSERNAME} NGINXACCESS %{IPO… --- ## [Logstash showing only parse failures from log](https://discuss.elastic.co/t/logstash-showing-only-parse-failures-from-log/62800)
**Author:** [@ddelaria](https://discuss.elastic.co/u/ddelaria)\ **Replies:** 4\ **Last updated:** [October 12, 2016, 1:33pm UTC](https://discuss.elastic.co/t/logstash-showing-only-parse-failures-from-log/62800 "2016-10-12T13:33:33Z")
Hi All, not sure what's happening on my stack, but yesterday I've included a new log file on the filebeat config on a couple of client machines. Everything was working fine, but including this new log file I'm experien… --- ## [Parsing timestamp from file and put in @timestamp](https://discuss.elastic.co/t/parsing-timestamp-from-file-and-put-in-timestamp/62788)
**Author:** [@Artyom\_Davydov](https://discuss.elastic.co/u/Artyom_Davydov)\ **Replies:** 6\ **Last updated:** [October 12, 2016, 11:49am UTC](https://discuss.elastic.co/t/parsing-timestamp-from-file-and-put-in-timestamp/62788 "2016-10-12T11:49:07Z")
Hi all. I use folowing scheme to collect logs: filebeat -\> logstash -\> graylog So i have problem with parsing date and put it to the @timestamp example of log: 20161012T082829Z|urn:oasis:names:tc:SAML:2.0:bindings:H… --- ## [Problem with input file logstash version 1.5.3](https://discuss.elastic.co/t/problem-with-input-file-logstash-version-1-5-3/62796)
**Author:** [@billy6](https://discuss.elastic.co/u/billy6)\ **Replies:** 1\ **Last updated:** [October 12, 2016, 10:52am UTC](https://discuss.elastic.co/t/problem-with-input-file-logstash-version-1-5-3/62796 "2016-10-12T10:52:44Z")
Hello, I'm trying to take the logs from a file and send them to an elasticsearh instance in another machine, but I don't know why everytime I try it logstash service keep running without finishing the service and no new… --- ## [Is it possible to append date pattern to the name of log file?](https://discuss.elastic.co/t/is-it-possible-to-append-date-pattern-to-the-name-of-log-file/62795)
**Author:** [@Rayen\_Yang](https://discuss.elastic.co/u/Rayen_Yang)\ **Replies:** 0\ **Last updated:** [October 12, 2016, 9:44am UTC](https://discuss.elastic.co/t/is-it-possible-to-append-date-pattern-to-the-name-of-log-file/62795 "2016-10-12T09:44:04Z")
Now we can add --log flag to run Logstash in order to write logs to a file, just like: --log run.log. But I want to write logs to another file every day without restart Lostash, just like that: --log run-%{+YYYY.MM.dd}… --- ## [Plugin WMI : exception=\>"NoMethodError"](https://discuss.elastic.co/t/plugin-wmi-exception-nomethoderror/62705)
**Author:** [@folly3](https://discuss.elastic.co/u/folly3)\ **Replies:** 0\ **Last updated:** [October 11, 2016, 11:46am UTC](https://discuss.elastic.co/t/plugin-wmi-exception-nomethoderror/62705 "2016-10-11T11:46:24Z")
Hey guys, i try to exec this logstash conf : input { wmi { query =\> "select \* from Win32\_PerfFormattedData\_PerfOS\_Processor" } } output { stdout { codec =\> rubydebug } } but i have an exception ; Pipe… --- ## [Logstash output to file but not right hostname](https://discuss.elastic.co/t/logstash-output-to-file-but-not-right-hostname/62783)
**Author:** [@viet\_anh\_phan](https://discuss.elastic.co/u/viet_anh_phan)\ **Replies:** 2\ **Last updated:** [October 12, 2016, 7:45am UTC](https://discuss.elastic.co/t/logstash-output-to-file-but-not-right-hostname/62783 "2016-10-12T07:45:58Z")
Hi everyone, I'm a newer of using logstash, here is my case: - In right case: log nginx (hostname: staging) --\> filebeat ---\> logstash ---\> output to file: /opt/logs/staging/2016-09-27.log ( right folder "staging" as I … --- ## [How to print error message only?](https://discuss.elastic.co/t/how-to-print-error-message-only/62781)
**Author:** [@Rayen\_Yang](https://discuss.elastic.co/u/Rayen_Yang)\ **Replies:** 0\ **Last updated:** [October 12, 2016, 6:17am UTC](https://discuss.elastic.co/t/how-to-print-error-message-only/62781 "2016-10-12T06:17:25Z")
I use --quiet flag to run logstash,but some other messages are still printed,like that: {"timestamp":"2016-10-12T14:04:20.168000+0800","message":"Pipeline main started"} anthing I miss? --- ## [Import a csv into ElasticSearch using logstash - Windows](https://discuss.elastic.co/t/import-a-csv-into-elasticsearch-using-logstash-windows/43401)
**Author:** [@evripides](https://discuss.elastic.co/u/evripides)\ **Replies:** 4\ **Last updated:** [October 12, 2016, 5:59am UTC](https://discuss.elastic.co/t/import-a-csv-into-elasticsearch-using-logstash-windows/43401 "2016-10-12T05:59:24Z")
I am trying to import a csv into ElasticSearch using logstash - Windows but receive the following error Error: No config files found Command I run is logstash -f agent logstash-simple.conf The config is as f… --- ## [For ELK,sometimes Logstash says “no such index”, how to set automatic create index in ES while “no such index”?](https://discuss.elastic.co/t/for-elk-sometimes-logstash-says-no-such-index-how-to-set-automatic-create-index-in-es-while-no-such-index/62713)
**Author:** [@RJ\_W](https://discuss.elastic.co/u/RJ_W)\ **Replies:** 3\ **Last updated:** [October 12, 2016, 1:39am UTC](https://discuss.elastic.co/t/for-elk-sometimes-logstash-says-no-such-index-how-to-set-automatic-create-index-in-es-while-no-such-index/62713 "2016-10-12T01:39:32Z")
I found some pb with ELK, can anyone help me? thanks! logstash 2.4.0 elasticsearch 2.4.0 3 elasticsearch instance for cluster some time logstash warning “ "status"=\>404, "error"=\>{"type"=\>"index\_not\_found\_exception… --- ## [Cloudtrail codec - failed to parse \[requestParameters.buckeyPolicy.Statement.Principal\]](https://discuss.elastic.co/t/cloudtrail-codec-failed-to-parse-requestparameters-buckeypolicy-statement-principal/62498)
**Author:** [@stivi21](https://discuss.elastic.co/u/stivi21)\ **Replies:** 3\ **Last updated:** [October 11, 2016, 9:05pm UTC](https://discuss.elastic.co/t/cloudtrail-codec-failed-to-parse-requestparameters-buckeypolicy-statement-principal/62498 "2016-10-11T21:05:23Z")
Hello I have problems with parse in some situation, where I have error: "type"=\>"mapper\_parsing\_exception", "reason"=\>"failed to parse \[requestParameters.buckeyPolicy.Statement.Principal\]", "caused\_by"=\>{"type"=\>"illegal… --- ## [Deleted sincedb files, no new are getting created](https://discuss.elastic.co/t/deleted-sincedb-files-no-new-are-getting-created/62536)
**Author:** [@chromechris](https://discuss.elastic.co/u/chromechris)\ **Replies:** 5\ **Last updated:** [October 11, 2016, 7:01pm UTC](https://discuss.elastic.co/t/deleted-sincedb-files-no-new-are-getting-created/62536 "2016-10-11T19:01:24Z")
Ok, so I decided to delte my .sincedb files, and they never reappeared. :frowning: --- ## [Logstash CSV String Text containing commas](https://discuss.elastic.co/t/logstash-csv-string-text-containing-commas/62730)
**Author:** [@Wayne\_Taylor](https://discuss.elastic.co/u/Wayne_Taylor)\ **Replies:** 0\ **Last updated:** [October 11, 2016, 3:39pm UTC](https://discuss.elastic.co/t/logstash-csv-string-text-containing-commas/62730 "2016-10-11T15:39:01Z")
Dear Logstash Community, Need your help. I am facing an issue with Network Switch Traffic that comes in the form of CSV files. The problem is some of the fields contain commas in it e.g. a URL and the string isn't enc… --- ## [Broken Pipe errors while talking to AWS-ElsaticSearch service](https://discuss.elastic.co/t/broken-pipe-errors-while-talking-to-aws-elsaticsearch-service/62179)
**Author:** [@rgstreekstra](https://discuss.elastic.co/u/rgstreekstra)\ **Replies:** 2\ **Last updated:** [October 11, 2016, 3:22pm UTC](https://discuss.elastic.co/t/broken-pipe-errors-while-talking-to-aws-elsaticsearch-service/62179 "2016-10-11T15:22:01Z")
Hi all, I am getting the following error: "INFO: I/O exception (java.net.SocketException) caught when processing request to {}-\>http://:80: Broken pipe" In logstash.err file during the same time in the logstash.log fil… --- ## [Add\_tag](https://discuss.elastic.co/t/add-tag/61837)
**Author:** [@13koushik](https://discuss.elastic.co/u/13koushik)\ **Replies:** 9\ **Last updated:** [October 11, 2016, 2:56pm UTC](https://discuss.elastic.co/t/add-tag/61837 "2016-10-11T14:56:43Z")
Is there any way one could rename a tag. When I'm using add\_tag of mutate and assigning it an array, the name of the tag is "tags" by default. I would like to rename it. Could someone help me out? --- ## [National charset convertation](https://discuss.elastic.co/t/national-charset-convertation/62715)
**Author:** [@Lego](https://discuss.elastic.co/u/Lego)\ **Replies:** 2\ **Last updated:** [October 11, 2016, 2:06pm UTC](https://discuss.elastic.co/t/national-charset-convertation/62715 "2016-10-11T14:06:20Z")
Hello everyone. Please help me to read correctly file with national charset. The file is Windows-1251 (Russia). I use encoding options in Filebeat. My Filebeat config is posted below: filebeat: prospectors: - paths… --- ## [Delete / Rename File after Reading](https://discuss.elastic.co/t/delete-rename-file-after-reading/62693)
**Author:** [@TWalter](https://discuss.elastic.co/u/TWalter)\ **Replies:** 2\ **Last updated:** [October 11, 2016, 1:53pm UTC](https://discuss.elastic.co/t/delete-rename-file-after-reading/62693 "2016-10-11T13:53:47Z")
Hello there, is there any possibility where you can rename or delete files, which are finished by reading with Logstash? Thanks to all. --- ## [Having trouble with basic guide, doesn't appear to read any logs](https://discuss.elastic.co/t/having-trouble-with-basic-guide-doesnt-appear-to-read-any-logs/62646)
**Author:** [@chrisan](https://discuss.elastic.co/u/chrisan)\ **Replies:** 4\ **Last updated:** [October 11, 2016, 12:15pm UTC](https://discuss.elastic.co/t/having-trouble-with-basic-guide-doesnt-appear-to-read-any-logs/62646 "2016-10-11T12:15:58Z")
hi everyone, I'm trying to setup logstash and am following this guide https://www.elastic.co/guide/en/logstash/current/advanced-pipeline.html However, I am not seeing any output from logstash (should I?) when I run th… --- ## [Logstash-Filebeat-circuit breaker detection error](https://discuss.elastic.co/t/logstash-filebeat-circuit-breaker-detection-error/62635)
**Author:** [@srikanth\_ramineni](https://discuss.elastic.co/u/srikanth_ramineni)\ **Replies:** 1\ **Last updated:** [October 11, 2016, 11:20am UTC](https://discuss.elastic.co/t/logstash-filebeat-circuit-breaker-detection-error/62635 "2016-10-11T11:20:53Z")
Hi , We are facing below error for one of our data ingestion using logstash and filebeat. we are getting this issue only when we do thread dumps and we are using multi line filter. Below is the error. can any one provi… --- ## [GROK matches nothing. Ever](https://discuss.elastic.co/t/grok-matches-nothing-ever/62696)
**Author:** [@banditd](https://discuss.elastic.co/u/banditd)\ **Replies:** 3\ **Last updated:** [October 11, 2016, 11:18am UTC](https://discuss.elastic.co/t/grok-matches-nothing-ever/62696 "2016-10-11T11:18:03Z")
Hi, I am new to logstash and want to read to read FHEM logs. A logline looks like this: 2016-10-08\_22:06:23 Sensor\_Garden T: 7.9 H: 89 This is my logstash configuration: input { file { path =\> \[ "c:/… --- ## [Get substrings from the log](https://discuss.elastic.co/t/get-substrings-from-the-log/62068)
**Author:** [@Lego](https://discuss.elastic.co/u/Lego)\ **Replies:** 4\ **Last updated:** [October 11, 2016, 9:04am UTC](https://discuss.elastic.co/t/get-substrings-from-the-log/62068 "2016-10-11T09:04:07Z")
Hello. Could you kindly help me to solve one little problem? I have log strings look like as: 20160919;11:09:32;Username;E;Creating Report;ReportName;3;ReportNameAgain|11:09:32|1|02.07.2016|02.08.2016;; I load th… --- ## [Logstash netflow plugin configuration error](https://discuss.elastic.co/t/logstash-netflow-plugin-configuration-error/62284)
**Author:** [@tvs](https://discuss.elastic.co/u/tvs)\ **Replies:** 1\ **Last updated:** [October 11, 2016, 5:35am UTC](https://discuss.elastic.co/t/logstash-netflow-plugin-configuration-error/62284 "2016-10-11T05:35:43Z")
Hello, I'm new with logstash, so excuse me if this problem is very simple to fix, unfortunately I couldn't figure out why this is happening. I'm trying to use logstash to collect traffic information from ESXi using the… --- ## [Logstash not creating index - json parse failure](https://discuss.elastic.co/t/logstash-not-creating-index-json-parse-failure/46860)
**Author:** [@bluethundr](https://discuss.elastic.co/u/bluethundr)\ **Replies:** 3\ **Last updated:** [October 11, 2016, 4:53am UTC](https://discuss.elastic.co/t/logstash-not-creating-index-json-parse-failure/46860 "2016-10-11T04:53:35Z")
Hello, Suddenly logstash is not creating an index in ES. And I'm seeing errors like this in the debug output of logstash: JSON parse failure. Falling back to plain-text {:error=\>#\ **Author:** [@satheeshravir](https://discuss.elastic.co/u/satheeshravir)\ **Replies:** 4\ **Last updated:** [October 10, 2016, 11:12pm UTC](https://discuss.elastic.co/t/logstash-not-indexing-the-input-data-to-elastic-search/62659 "2016-10-10T23:12:53Z") Hi, I am trying to feed json array to elastic search. Its not throwing any error and not indexing the data to elastic search. I have given my config below. Please let me know if am making any mistake in my config. inpu… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1091) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1093)