# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1093 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1094 --- ## [Capture response from HTTP requests using HTTP Output Plugin in Logstash](https://discuss.elastic.co/t/capture-response-from-http-requests-using-http-output-plugin-in-logstash/40609)
**Author:** [@Vaibhav\_Chawla](https://discuss.elastic.co/u/Vaibhav_Chawla)\ **Replies:** 2\ **Last updated:** [October 10, 2016, 8:38pm UTC](https://discuss.elastic.co/t/capture-response-from-http-requests-using-http-output-plugin-in-logstash/40609 "2016-10-10T20:38:45Z")
Hello, I could not figure out a way to capture the response by issuing a HTTP request to a target endpoint using the HTTP Output plugin. I just want to get the status code displayed (200 OK / 404 Not Found) on the consol… --- ## [Logstash CSV](https://discuss.elastic.co/t/logstash-csv/62644)
**Author:** [@Mario\_van\_Gemert](https://discuss.elastic.co/u/Mario_van_Gemert)\ **Replies:** 1\ **Last updated:** [October 10, 2016, 8:11pm UTC](https://discuss.elastic.co/t/logstash-csv/62644 "2016-10-10T20:11:55Z")
I am trying to import a csv with logstash but am not able to import my records(documents). Do not know what I am doing wrong. Do not receive any error messages. Settings: Default pipeline workers: 8 Pipeline main started… --- ## [I need help with my logstash config](https://discuss.elastic.co/t/i-need-help-with-my-logstash-config/62516)
**Author:** [@keyboard112](https://discuss.elastic.co/u/keyboard112)\ **Replies:** 8\ **Last updated:** [October 10, 2016, 7:12pm UTC](https://discuss.elastic.co/t/i-need-help-with-my-logstash-config/62516 "2016-10-10T19:12:07Z")
Hello, Could someone help me with the message below. Im not sure if the issue is my configuration or the .csv file. This is a snippet from my debug Pushing flush onto pipeline {:level=\>:debug, :file=\>"logstash/pip… --- ## [Netflow codec output to the root of the message](https://discuss.elastic.co/t/netflow-codec-output-to-the-root-of-the-message/61954)
**Author:** [@GambitK](https://discuss.elastic.co/u/GambitK)\ **Replies:** 2\ **Last updated:** [October 10, 2016, 4:26pm UTC](https://discuss.elastic.co/t/netflow-codec-output-to-the-root-of-the-message/61954 "2016-10-10T16:26:21Z")
I'm testing the netflow codec to receive some netflow data, but I don't want the output to be inside of a nested field, I would prefer it to be on the root of the message. I've tried setting the field config of the cod… --- ## [Issue with GROK parsing of IIS NXLOG data](https://discuss.elastic.co/t/issue-with-grok-parsing-of-iis-nxlog-data/62535)
**Author:** [@mcasa](https://discuss.elastic.co/u/mcasa)\ **Replies:** 2\ **Last updated:** [October 10, 2016, 2:49pm UTC](https://discuss.elastic.co/t/issue-with-grok-parsing-of-iis-nxlog-data/62535 "2016-10-10T14:49:58Z")
I'm using NXLOG to send my IIS logs to my ELK server. Everything is fine except for one part of the message. The port identified in the IIS Message is getting changed. See Bellow Logstash Filter: filter { if \[ty… --- ## [How connect logstash to elasticsearch cluster?](https://discuss.elastic.co/t/how-connect-logstash-to-elasticsearch-cluster/62608)
**Author:** [@Amin1](https://discuss.elastic.co/u/Amin1)\ **Replies:** 5\ **Last updated:** [October 10, 2016, 9:33am UTC](https://discuss.elastic.co/t/how-connect-logstash-to-elasticsearch-cluster/62608 "2016-10-10T09:33:42Z")
hi i use this scale to manage my log in medium network :slight\_smile: Source ----\>Logstash------\>Redis--------\>Logstash--------\> Elasticsearch cluster I have one Client Node, 3 Data -node, 1 master node. now i have fol… --- ## [Logstash - LoadError: Unsupported platform: unknown-linux](https://discuss.elastic.co/t/logstash-loaderror-unsupported-platform-unknown-linux/62610)
**Author:** [@yrh1234](https://discuss.elastic.co/u/yrh1234)\ **Replies:** 0\ **Last updated:** [October 10, 2016, 8:01am UTC](https://discuss.elastic.co/t/logstash-loaderror-unsupported-platform-unknown-linux/62610 "2016-10-10T08:01:46Z")
I tried running logstash-all-plugins-2.3.3 on ARM architecture (aarch64) system (linux) but I am getting the following error: I know that is Platform.class in jruby.jar don't have arm64（aarch64 ）： Can anyone pleas… --- ## [Pipeline aborted due to error](https://discuss.elastic.co/t/pipeline-aborted-due-to-error/62599)
**Author:** [@bopa](https://discuss.elastic.co/u/bopa)\ **Replies:** 2\ **Last updated:** [October 10, 2016, 7:48am UTC](https://discuss.elastic.co/t/pipeline-aborted-due-to-error/62599 "2016-10-10T07:48:26Z")
My logstash service status change into "Active (Exited)" after few seconds of starting the service. I got a logstash error as follows in the logstash.log {:timestamp=\>"2016-10-10T11:11:04.510000+0530", :message=\>"stopp… --- ## [The output don't match the source code IN SYSLOG INPUT plugin](https://discuss.elastic.co/t/the-output-dont-match-the-source-code-in-syslog-input-plugin/62593)
**Author:** [@xiaozhuqq48](https://discuss.elastic.co/u/xiaozhuqq48)\ **Replies:** 1\ **Last updated:** [October 10, 2016, 6:19am UTC](https://discuss.elastic.co/t/the-output-dont-match-the-source-code-in-syslog-input-plugin/62593 "2016-10-10T06:19:13Z")
When the event flow through the syslogInput, get the "grokparsefailuresysloginput", the priority is "0", the severity is "0", the facility is "0", like in the below: "\_source": { "message": "\<77\>Jul 22 22:01:01 i… --- ## [Logstash Date Result in one day late](https://discuss.elastic.co/t/logstash-date-result-in-one-day-late/62465)
**Author:** [@gringo](https://discuss.elastic.co/u/gringo)\ **Replies:** 9\ **Last updated:** [October 10, 2016, 5:37am UTC](https://discuss.elastic.co/t/logstash-date-result-in-one-day-late/62465 "2016-10-10T05:37:48Z")
my field "sdatetime" value is "2016 Aug 31 00:47:17Aug 31 00:47:17" I did the following date { match =\> \[ "sdatetime", "YYYY MMM dd HH:mm:ss" \] target =\> "sdatetime2" } The result is "sdatetime… --- ## [Issue with dates parsing](https://discuss.elastic.co/t/issue-with-dates-parsing/62540)
**Author:** [@Wayne\_Taylor](https://discuss.elastic.co/u/Wayne_Taylor)\ **Replies:** 1\ **Last updated:** [October 9, 2016, 7:15pm UTC](https://discuss.elastic.co/t/issue-with-dates-parsing/62540 "2016-10-09T19:15:12Z")
Sorry if this has been asked a million times. I am stuck I checked out every post: I have a scheduled logstash configuration from Microsoft SQL Server. Date is in the following example format: 2016-07-30T02:25:06.000Z … --- ## [Configuring TLS on a Logstash Docker container](https://discuss.elastic.co/t/configuring-tls-on-a-logstash-docker-container/62580)
**Author:** [@espogian](https://discuss.elastic.co/u/espogian)\ **Replies:** 2\ **Last updated:** [October 9, 2016, 6:03pm UTC](https://discuss.elastic.co/t/configuring-tls-on-a-logstash-docker-container/62580 "2016-10-09T18:03:16Z")
Hello, maybe this is a dumb question. I'm in the situation in which I want to use TLS between Filebeat and Logstash, the latter being on a Docker container. To enable TLS on Logstash, I'm supposed to configure it as foll… --- ## [Using Multiline to group events by number not by timestamp](https://discuss.elastic.co/t/using-multiline-to-group-events-by-number-not-by-timestamp/62150)
**Author:** [@9474](https://discuss.elastic.co/u/9474)\ **Replies:** 1\ **Last updated:** [October 9, 2016, 2:34pm UTC](https://discuss.elastic.co/t/using-multiline-to-group-events-by-number-not-by-timestamp/62150 "2016-10-09T14:34:11Z")
Hello, (Apologies for any faux pas but first time posting in any forum). I'm pulling an event log stored in a table from an Oracle DB via a JDBC connection. A simplistic example of the data: EVENTID USER TYPE MESSAGE… --- ## [Logtstash config for websocket output plug-in](https://discuss.elastic.co/t/logtstash-config-for-websocket-output-plug-in/62143)
**Author:** [@pandith\_asrar](https://discuss.elastic.co/u/pandith_asrar)\ **Replies:** 1\ **Last updated:** [October 9, 2016, 2:32pm UTC](https://discuss.elastic.co/t/logtstash-config-for-websocket-output-plug-in/62143 "2016-10-09T14:32:47Z")
Hi, I am trying to use the Logstash websocket Output plugin to transfer data from one server to another. Host 1: created a config file given below input { stdin {} } filter {} output { websocket { codec =\> … --- ## [Limitation of fields in grok for Logstash.conf](https://discuss.elastic.co/t/limitation-of-fields-in-grok-for-logstash-conf/62565)
**Author:** [@chinmoyd](https://discuss.elastic.co/u/chinmoyd)\ **Replies:** 1\ **Last updated:** [October 8, 2016, 6:28pm UTC](https://discuss.elastic.co/t/limitation-of-fields-in-grok-for-logstash-conf/62565 "2016-10-08T18:28:48Z")
Is there any limitation on the maximum number of fields I can mention in a grok in logstash.conf? My message length is around 438 characters and having 41 fields in it. When I am adding another field in the grok, looks l… --- ## [How do i make mapping for geo\_point?](https://discuss.elastic.co/t/how-do-i-make-mapping-for-geo-point/62139)
**Author:** [@Tal\_Bar\_Or](https://discuss.elastic.co/u/Tal_Bar_Or)\ **Replies:** 2\ **Last updated:** [October 9, 2016, 1:24pm UTC](https://discuss.elastic.co/t/how-do-i-make-mapping-for-geo-point/62139 "2016-10-09T13:24:41Z")
Hello, I am using Logstash to index (index name "ids\_sensors")Snort syslog events to Elsticsearch , all seems to work fine In the logstash I have following input regarding "Geioip " input below , the stdout of log sta… --- ## [Can i replace logstash timestamp with timestamp of my logfile?](https://discuss.elastic.co/t/can-i-replace-logstash-timestamp-with-timestamp-of-my-logfile/32649)
**Author:** [@Anmol\_Gupta](https://discuss.elastic.co/u/Anmol_Gupta)\ **Replies:** 16\ **Last updated:** [October 9, 2016, 10:01am UTC](https://discuss.elastic.co/t/can-i-replace-logstash-timestamp-with-timestamp-of-my-logfile/32649 "2016-10-09T10:01:01Z")
i want my log event timestamp to replace @timestamp of logstash , what should i do? { "message" =\> "DEBUG", "@version" =\> "1", "@timestamp" =\> "2015-10-21T07:00:59.979Z", ###this timestamp is of logsta… --- ## [Manage multiple beats on a single Logstash instance](https://discuss.elastic.co/t/manage-multiple-beats-on-a-single-logstash-instance/62545)
**Author:** [@espogian](https://discuss.elastic.co/u/espogian)\ **Replies:** 4\ **Last updated:** [October 8, 2016, 6:20am UTC](https://discuss.elastic.co/t/manage-multiple-beats-on-a-single-logstash-instance/62545 "2016-10-08T06:20:49Z")
Hello, I have multiple porspectors on a filebeat.yml configuration file. Each of these prospector has a unique type: filebeat: prospectors: - paths: - file\*.csv input\_type: log document\_… --- ## [Convert sting to date time in logstash](https://discuss.elastic.co/t/convert-sting-to-date-time-in-logstash/62523)
**Author:** [@Senz79](https://discuss.elastic.co/u/Senz79)\ **Replies:** 4\ **Last updated:** [October 8, 2016, 5:11am UTC](https://discuss.elastic.co/t/convert-sting-to-date-time-in-logstash/62523 "2016-10-08T05:11:52Z")
how can i convert the below string into date time Wed Aug 03 11:48:58 2016 I am using the below pattern to put it in a column ?\[%{DAY} %{MONTH} %{MONTHDAY} %{TIME} %{YEAR}\]) --- ## [Can not parse the whole file but stopped at 1 am(logstash 2.4)](https://discuss.elastic.co/t/can-not-parse-the-whole-file-but-stopped-at-1-am-logstash-2-4/62542)
**Author:** [@duwupeng](https://discuss.elastic.co/u/duwupeng)\ **Replies:** 0\ **Last updated:** [October 8, 2016, 4:27am UTC](https://discuss.elastic.co/t/can-not-parse-the-whole-file-but-stopped-at-1-am-logstash-2-4/62542 "2016-10-08T04:27:24Z")
The following config can run smoothly filter { if(" - response:" in \[message\]){ grok { match =\> { "message" =\> "%{GREEDYDATA:timestamp} %{GREEDYDATA:thread} INFO - response:%{GREEDYDATA:serviceName} %{GREEDYDATA:serv… --- ## [Sincedb\_path files are not created (logstash 2.4)](https://discuss.elastic.co/t/sincedb-path-files-are-not-created-logstash-2-4/59889)
**Author:** [@Guenhael](https://discuss.elastic.co/u/Guenhael)\ **Replies:** 13\ **Last updated:** [October 7, 2016, 11:09pm UTC](https://discuss.elastic.co/t/sincedb-path-files-are-not-created-logstash-2-4/59889 "2016-10-07T23:09:20Z")
My config file in logstash/conf.d directory contains a sincedb\_path directive in an input/file section : input { file { path =\> "/var/log/myfile" sincedb\_path =\> "/root/sincedb/sinced… --- ## [Exporting data from one elk cluster to another elk cluster](https://discuss.elastic.co/t/exporting-data-from-one-elk-cluster-to-another-elk-cluster/62433)
**Author:** [@shankarbala](https://discuss.elastic.co/u/shankarbala)\ **Replies:** 5\ **Last updated:** [October 7, 2016, 9:05pm UTC](https://discuss.elastic.co/t/exporting-data-from-one-elk-cluster-to-another-elk-cluster/62433 "2016-10-07T21:05:47Z")
HI i am trying to import data from one elk cluster to another elk cluster using logstash..but it gives error as below..(i am using logstash 2.4)..here is the logstash conf input { elasticsearch { hosts =\> \["old… --- ## [How to manage large config files](https://discuss.elastic.co/t/how-to-manage-large-config-files/34263)
**Author:** [@michaellizhou](https://discuss.elastic.co/u/michaellizhou)\ **Replies:** 8\ **Last updated:** [October 7, 2016, 6:27pm UTC](https://discuss.elastic.co/t/how-to-manage-large-config-files/34263 "2016-10-07T18:27:27Z")
As I continue to test logstash I want to make it easier to read and edit. Meaning that my config file is getting t0o large because I am pulling logs of many types each having their own unique way of being parsed. So is t… --- ## [Is there a reason not to use NOTSPACE pattern in Grok](https://discuss.elastic.co/t/is-there-a-reason-not-to-use-notspace-pattern-in-grok/62442)
**Author:** [@anhlqn](https://discuss.elastic.co/u/anhlqn)\ **Replies:** 2\ **Last updated:** [October 7, 2016, 6:24pm UTC](https://discuss.elastic.co/t/is-there-a-reason-not-to-use-notspace-pattern-in-grok/62442 "2016-10-07T18:24:36Z")
I have written some grok patterns to parse Barracuda Spam Firewall Mail log. I initially used patterns like NUMBER, IPORHOST, WORD.It turned out that some number fields contained a - or some weird characters, so I replac… --- ## [Adding JSON fields Kibana](https://discuss.elastic.co/t/adding-json-fields-kibana/62437)
**Author:** [@arque](https://discuss.elastic.co/u/arque)\ **Replies:** 2\ **Last updated:** [October 7, 2016, 6:01pm UTC](https://discuss.elastic.co/t/adding-json-fields-kibana/62437 "2016-10-07T18:01:49Z")
Hi, I have a JSON file as input for Logstash, and it looks as follows: \[ { "\_index": "packets-2016-10-06", "\_type": "pcap\_file", "\_score": null, "\_source": { "layers": { "frame": { … --- ## [Problem installing input pcap plugin](https://discuss.elastic.co/t/problem-installing-input-pcap-plugin/62484)
**Author:** [@arque](https://discuss.elastic.co/u/arque)\ **Replies:** 1\ **Last updated:** [October 7, 2016, 5:58pm UTC](https://discuss.elastic.co/t/problem-installing-input-pcap-plugin/62484 "2016-10-07T17:58:35Z")
Hi, I want to install the logstash-input-pcap plugin. However, when I run bin\\logstash-plugin install logstash-input-pcap, I get the error LogStash::GemFileError: duplicate gem logstash-filter-date, and the plugin is … --- ## [LXC container size](https://discuss.elastic.co/t/lxc-container-size/62036)
**Author:** [@syswombat](https://discuss.elastic.co/u/syswombat)\ **Replies:** 7\ **Last updated:** [October 7, 2016, 5:11pm UTC](https://discuss.elastic.co/t/lxc-container-size/62036 "2016-10-07T17:11:57Z")
Hello on a Small Network i would like to Install, Config and use Logtash. if i define a LXC Container how much size (Disk) would i Need, more or less? have a nice day vinc --- ## [Logstash JDBC string column value to array data type](https://discuss.elastic.co/t/logstash-jdbc-string-column-value-to-array-data-type/62436)
**Author:** [@simon80](https://discuss.elastic.co/u/simon80)\ **Replies:** 4\ **Last updated:** [October 7, 2016, 1:58pm UTC](https://discuss.elastic.co/t/logstash-jdbc-string-column-value-to-array-data-type/62436 "2016-10-07T13:58:22Z")
I would like to provide a SQL column value that contains concatenated strings (i.e. "value1,value2,value3") and have this value 'split' into an array data type within ElasticSearch. I've looked at the 'join' mutator an… --- ## [Parsing date - day changes number of digits](https://discuss.elastic.co/t/parsing-date-day-changes-number-of-digits/62303)
**Author:** [@Roberto\_Iglesias](https://discuss.elastic.co/u/Roberto_Iglesias)\ **Replies:** 2\ **Last updated:** [October 7, 2016, 1:19pm UTC](https://discuss.elastic.co/t/parsing-date-day-changes-number-of-digits/62303 "2016-10-07T13:19:53Z")
Hi and thanks for reading I'm building my logstash filter and i just realized that the number of digits in day space changes. For example: Oct 2 13:13:13 #two spaces between month and day Oct 12 22:22:22 #one space be… --- ## [Logstash Batch Size/Workers log message](https://discuss.elastic.co/t/logstash-batch-size-workers-log-message/43175)
**Author:** [@rahulnadella](https://discuss.elastic.co/u/rahulnadella)\ **Replies:** 13\ **Last updated:** [October 7, 2016, 12:25pm UTC](https://discuss.elastic.co/t/logstash-batch-size-workers-log-message/43175 "2016-10-07T12:25:56Z")
Is there a way to work around the message below I am seeing in my logs? I currently working with Logstash 2.2 and am trying to improve the performance of the number of events running through the pipeline. Currently am us… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1092) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1094)