# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1094 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1095 --- ## [Reference Previous loglines](https://discuss.elastic.co/t/reference-previous-loglines/62257)
**Author:** [@debarun](https://discuss.elastic.co/u/debarun)\ **Replies:** 3\ **Last updated:** [October 7, 2016, 12:15pm UTC](https://discuss.elastic.co/t/reference-previous-loglines/62257 "2016-10-07T12:15:00Z")
HI, Is it possible to to reference a previous loglines other than using multiline to club them togethers. Also could we use multiline in an if else loop to make sure lines correspondig to a specific event are clubbed … --- ## [\_csvparsefailure](https://discuss.elastic.co/t/-csvparsefailure/62471)
**Author:** [@setlem](https://discuss.elastic.co/u/setlem)\ **Replies:** 3\ **Last updated:** [October 7, 2016, 11:17am UTC](https://discuss.elastic.co/t/-csvparsefailure/62471 "2016-10-07T11:17:34Z")
Hi all, \_csvparsefailure error is showing for my config file.the config file is \[quote="setlem, post:1, topic:62471, full:true"\] filter { csv { columns =\> \["ORDER\_ID","SUBMITTED\_DATE","STATE","PROFILE\_ID",… --- ## [Mnesia DB connection](https://discuss.elastic.co/t/mnesia-db-connection/62462)
**Author:** [@gnievoj](https://discuss.elastic.co/u/gnievoj)\ **Replies:** 1\ **Last updated:** [October 7, 2016, 7:58am UTC](https://discuss.elastic.co/t/mnesia-db-connection/62462 "2016-10-07T07:58:37Z")
I using ejabberd server for chat communication. I'd like be able dynamicly search my archive messages. Now I'm using elasticsearch and logstash, but it working only on mysql db. It's my logstash config input { … --- ## [Logstash.conf error "Cannot get new connection from pool"](https://discuss.elastic.co/t/logstash-conf-error-cannot-get-new-connection-from-pool/62357)
**Author:** [@lduriez](https://discuss.elastic.co/u/lduriez)\ **Replies:** 4\ **Last updated:** [October 7, 2016, 6:20am UTC](https://discuss.elastic.co/t/logstash-conf-error-cannot-get-new-connection-from-pool/62357 "2016-10-07T06:20:37Z")
Hi, I'm trying to parse a log file with logstash to put it in an elasticsearch database, but I have the following error: Elasticsearch::Transport::Transport::Error: Cannot get new connection from pool. I'm using elast… --- ## [Logstash \_grokparsefailure . Unable to find issue](https://discuss.elastic.co/t/logstash--grokparsefailure-unable-to-find-issue/61845)
**Author:** [@chromechris](https://discuss.elastic.co/u/chromechris)\ **Replies:** 15\ **Last updated:** [October 7, 2016, 5:46am UTC](https://discuss.elastic.co/t/logstash--grokparsefailure-unable-to-find-issue/61845 "2016-10-07T05:46:51Z")
Hello Loggers, I have been receiveing a \_grokparsefailure tag in Logstash but cannot find the issue. My Logstash Grok filter looks like this: grok { match =\> { "message" =\> "%{TIMESTAMP\_ISO8601:timestamp}… --- ## [Logstash document\_id for elasticsearch not incrementing](https://discuss.elastic.co/t/logstash-document-id-for-elasticsearch-not-incrementing/62427)
**Author:** [@aja](https://discuss.elastic.co/u/aja)\ **Replies:** 2\ **Last updated:** [October 6, 2016, 10:07pm UTC](https://discuss.elastic.co/t/logstash-document-id-for-elasticsearch-not-incrementing/62427 "2016-10-06T22:07:30Z")
(Running on windows, latest versions of elasticsearch and logstash) I've seen a lot of posts with issues (and fixes) about the document\_id with elasticsearch, but none seem to be exactly my problem.... Below is my entire… --- ## [Timezone parsing "(DST+01:00)"](https://discuss.elastic.co/t/timezone-parsing-dst-01-00/62423)
**Author:** [@Hans](https://discuss.elastic.co/u/Hans)\ **Replies:** 1\ **Last updated:** [October 6, 2016, 7:32pm UTC](https://discuss.elastic.co/t/timezone-parsing-dst-01-00/62423 "2016-10-06T19:32:57Z")
Hi, I have a challenge to parsing the timezone in my log. Here is an example of what the date looks like: 2016-09-05 18:50:00(DST+01:00) However the filter is not working, I am sure I am only missing a small piece of t… --- ## [Data loss happening somewhere](https://discuss.elastic.co/t/data-loss-happening-somewhere/62390)
**Author:** [@Shimon\_k](https://discuss.elastic.co/u/Shimon_k)\ **Replies:** 1\ **Last updated:** [October 6, 2016, 5:29pm UTC](https://discuss.elastic.co/t/data-loss-happening-somewhere/62390 "2016-10-06T17:29:31Z")
Hi guys, I am totally lost with this issue, I spent countless hours trying to figure it out but I came up empty. It seems like somewhere along the process from input into Logstash to the ingestion into Elastic data is b… --- ## [Heroku plugin login](https://discuss.elastic.co/t/heroku-plugin-login/62392)
**Author:** [@prash101\_2000](https://discuss.elastic.co/u/prash101_2000)\ **Replies:** 0\ **Last updated:** [October 6, 2016, 2:20pm UTC](https://discuss.elastic.co/t/heroku-plugin-login/62392 "2016-10-06T14:20:05Z")
I have created a conf file with input from heroku app.But I see the following message in the logs asking for credentials.Please let me know how to resolve this.Log in logstash is as follows: Enter your Heroku credenti… --- ## [Logstash startup completed does not get dislayed](https://discuss.elastic.co/t/logstash-startup-completed-does-not-get-dislayed/62325)
**Author:** [@platstar](https://discuss.elastic.co/u/platstar)\ **Replies:** 2\ **Last updated:** [October 6, 2016, 1:18pm UTC](https://discuss.elastic.co/t/logstash-startup-completed-does-not-get-dislayed/62325 "2016-10-06T13:18:32Z")
Hi everyone I am using Window and trying to use Logstash 2.4.0. I am using the following config file Conf Content input { file { path =\> \["D:\\ELK\\logstash.log\*.csv"\] start\_position =\> "beginning" } } filter { c… --- ## [Logstash 5 beta 1: Ruby exception occurred: undefined method \`\[\]'](https://discuss.elastic.co/t/logstash-5-beta-1-ruby-exception-occurred-undefined-method/62376)
**Author:** [@asp](https://discuss.elastic.co/u/asp)\ **Replies:** 1\ **Last updated:** [October 6, 2016, 12:30pm UTC](https://discuss.elastic.co/t/logstash-5-beta-1-ruby-exception-occurred-undefined-method/62376 "2016-10-06T12:30:32Z")
Hi, I am currently playing around with logstash 5 beta 1. When I use my filter settings, which are fine with 2.3.4 I get now a ruby exception: Ruby exception occurred: undefined method \`\[\]'... my filter code is as … --- ## [Logstach can't read input file](https://discuss.elastic.co/t/logstach-cant-read-input-file/62364)
**Author:** [@AlexDM](https://discuss.elastic.co/u/AlexDM)\ **Replies:** 1\ **Last updated:** [October 6, 2016, 11:57am UTC](https://discuss.elastic.co/t/logstach-cant-read-input-file/62364 "2016-10-06T11:57:15Z")
I'm so sorry, still start to learn and install ELK. input { stdin { } } is working and I can see resault in Kibana. When I try to use file in input path, logstach can't read log file. Logstach 2.4.0 my simple conf f… --- ## [Grok for JVM console log](https://discuss.elastic.co/t/grok-for-jvm-console-log/62344)
**Author:** [@Senz79](https://discuss.elastic.co/u/Senz79)\ **Replies:** 8\ **Last updated:** [October 6, 2016, 11:55am UTC](https://discuss.elastic.co/t/grok-for-jvm-console-log/62344 "2016-10-06T11:55:18Z")
I want to parse the JVM console logs ignoring the initial load and just considering the actual logs which starts with \[0;31m2016-09-29 04:00:03,264 timestamp. I am not able to understand the starting point and how to i… --- ## [Can Logstash TCP input be made to accept SSLv2Hello?](https://discuss.elastic.co/t/can-logstash-tcp-input-be-made-to-accept-sslv2hello/62365)
**Author:** [@echalmer](https://discuss.elastic.co/u/echalmer)\ **Replies:** 0\ **Last updated:** [October 6, 2016, 11:26am UTC](https://discuss.elastic.co/t/can-logstash-tcp-input-be-made-to-accept-sslv2hello/62365 "2016-10-06T11:26:21Z")
I am trying to use the TCP input plugin to receive SSL-encrypted rsyslog events from a closed appliance. The appliance sending the events is sending SSLv2Hello as part of the handshake. Logstash shuts this down. In the … --- ## [Logstash 1.5.3 file plugin over JDK1.6](https://discuss.elastic.co/t/logstash-1-5-3-file-plugin-over-jdk1-6/62147)
**Author:** [@pons](https://discuss.elastic.co/u/pons)\ **Replies:** 2\ **Last updated:** [October 6, 2016, 9:52am UTC](https://discuss.elastic.co/t/logstash-1-5-3-file-plugin-over-jdk1-6/62147 "2016-10-06T09:52:13Z")
I am getting following error when i try to start in Windows 7 ←\[33mfailed to open C:\\temp\\AuditTest.log: cannot link Java class RubyFileExt {:level=\>:warn}←\[0m config entry input { file { path =\> "C:\\t… --- ## [Logstash-input-http-poller-3.1.0 - how to install in offline mode](https://discuss.elastic.co/t/logstash-input-http-poller-3-1-0-how-to-install-in-offline-mode/62335)
**Author:** [@modalikasi](https://discuss.elastic.co/u/modalikasi)\ **Replies:** 1\ **Last updated:** [October 6, 2016, 7:13am UTC](https://discuss.elastic.co/t/logstash-input-http-poller-3-1-0-how-to-install-in-offline-mode/62335 "2016-10-06T07:13:07Z")
Seems that internet connectivity is required even for offline install. How to install logstash http poller in offline mode?, please help me on the steps to perform to install http poller in offline mode.. --- ## [Jdbc scheduler vs linux cron](https://discuss.elastic.co/t/jdbc-scheduler-vs-linux-cron/62297)
**Author:** [@Igal\_Karlinsky](https://discuss.elastic.co/u/Igal_Karlinsky)\ **Replies:** 4\ **Last updated:** [October 6, 2016, 6:37am UTC](https://discuss.elastic.co/t/jdbc-scheduler-vs-linux-cron/62297 "2016-10-06T06:37:57Z")
Hi, I want to keep my sql DB synced with ELK. I'm wondering, are there any advantages using jdbc scheduler against native linux cron? thanks. --- ## [Elasticsearch correlation getting failed](https://discuss.elastic.co/t/elasticsearch-correlation-getting-failed/61927)
**Author:** [@rajkamalkool6](https://discuss.elastic.co/u/rajkamalkool6)\ **Replies:** 2\ **Last updated:** [October 6, 2016, 6:02am UTC](https://discuss.elastic.co/t/elasticsearch-correlation-getting-failed/61927 "2016-10-06T06:02:49Z")
Hi, I have request and response files which I need to process and correlate both the file fields and to correlate it. In my scenario filebeat picking up the files in random hence sometime my response files getting read … --- ## [Remove field based on name regex](https://discuss.elastic.co/t/remove-field-based-on-name-regex/62326)
**Author:** [@Mormaii](https://discuss.elastic.co/u/Mormaii)\ **Replies:** 3\ **Last updated:** [October 6, 2016, 5:33am UTC](https://discuss.elastic.co/t/remove-field-based-on-name-regex/62326 "2016-10-06T05:33:19Z")
This is the data I'm receiving: "mem" =\> { "total" =\> 8201703424, "used" =\> 6293446656, "free" =\> 1908256768, "used\_p" =\> 0.77, "actual\_used" =\> 5523927040, … --- ## [Sincedb file in windows](https://discuss.elastic.co/t/sincedb-file-in-windows/62280)
**Author:** [@Mayank\_Agrawal](https://discuss.elastic.co/u/Mayank_Agrawal)\ **Replies:** 1\ **Last updated:** [October 5, 2016, 10:09pm UTC](https://discuss.elastic.co/t/sincedb-file-in-windows/62280 "2016-10-05T22:09:57Z")
I am tracking logstash progress by reading since db file. In linux, it is easy to find inode number of a file and then track the corresponding changes in a particular file, but in windows, I am unable to do so. What is… --- ## [Metrics Plugin: Meter vs. Timer?](https://discuss.elastic.co/t/metrics-plugin-meter-vs-timer/61839)
**Author:** [@wakinov](https://discuss.elastic.co/u/wakinov)\ **Replies:** 3\ **Last updated:** [October 5, 2016, 5:20pm UTC](https://discuss.elastic.co/t/metrics-plugin-meter-vs-timer/61839 "2016-10-05T17:20:25Z")
What's the difference between meter and timer? I can find any info on it. Can you provide examples of when one would be used over the other? --- ## [Logstash pipeline bloqued](https://discuss.elastic.co/t/logstash-pipeline-bloqued/58741)
**Author:** [@Nizar\_Khalifa](https://discuss.elastic.co/u/Nizar_Khalifa)\ **Replies:** 1\ **Last updated:** [October 5, 2016, 5:06pm UTC](https://discuss.elastic.co/t/logstash-pipeline-bloqued/58741 "2016-10-05T17:06:15Z")
Hi, Actually, Im sending request to remote Logstash using Filebeat. I have the basic configuration in both of theese tools. I receive my requests but after a while i got this messages: {:timestamp=\>"2016-08-23T21:12… --- ## [Throttle mix counters](https://discuss.elastic.co/t/throttle-mix-counters/57030)
**Author:** [@marcmga](https://discuss.elastic.co/u/marcmga)\ **Replies:** 2\ **Last updated:** [October 5, 2016, 3:08pm UTC](https://discuss.elastic.co/t/throttle-mix-counters/57030 "2016-10-05T15:08:27Z")
Hi, I use throttle to count, send an email when it reach the number of logs. The problem is that i use the key %{host} and it counts all messages, because all messages came with a field "host". I thought it counted it … --- ## [Add new values in the nested field - Logstash to Elasticsearch](https://discuss.elastic.co/t/add-new-values-in-the-nested-field-logstash-to-elasticsearch/62253)
**Author:** [@adrianolimit](https://discuss.elastic.co/u/adrianolimit)\ **Replies:** 0\ **Last updated:** [October 5, 2016, 10:31am UTC](https://discuss.elastic.co/t/add-new-values-in-the-nested-field-logstash-to-elasticsearch/62253 "2016-10-05T10:31:13Z")
Hello Elasticusers, I have a little issue, I have one field in Elasticsearch that is a nested field and I want to add some new values (like an array) into this field using Logstash. However, if the field is empty, Logs… --- ## [How to create a nested array from multiple input fields](https://discuss.elastic.co/t/how-to-create-a-nested-array-from-multiple-input-fields/62178)
**Author:** [@ehausig](https://discuss.elastic.co/u/ehausig)\ **Replies:** 1\ **Last updated:** [October 5, 2016, 1:50pm UTC](https://discuss.elastic.co/t/how-to-create-a-nested-array-from-multiple-input-fields/62178 "2016-10-05T13:50:56Z")
Hello, I'm having difficulty figuring out how to fill a nested data type with values from multiple fields from a CSV. For example: I have a CSV data source that has the following columns: company\_id company\_name co… --- ## [How to send many metrics from Topbeat to CloudWatch with logstash](https://discuss.elastic.co/t/how-to-send-many-metrics-from-topbeat-to-cloudwatch-with-logstash/62272)
**Author:** [@pseudocodi](https://discuss.elastic.co/u/pseudocodi)\ **Replies:** 0\ **Last updated:** [October 5, 2016, 1:18pm UTC](https://discuss.elastic.co/t/how-to-send-many-metrics-from-topbeat-to-cloudwatch-with-logstash/62272 "2016-10-05T13:18:57Z")
Dears, I'm trying to send some inputs from Topbeat to Cloudwatch, but I do not know how to obtain more than one metric, as if I put them into an array, only the first one is obtained. I attach my config file (In clo… --- ## [Logstash Error "The signal HUP is in use by the JVM and will not work correctly on this platform"-SOLVED](https://discuss.elastic.co/t/logstash-error-the-signal-hup-is-in-use-by-the-jvm-and-will-not-work-correctly-on-this-platform-solved/57622)
**Author:** [@kmk3173](https://discuss.elastic.co/u/kmk3173)\ **Replies:** 2\ **Last updated:** [October 5, 2016, 1:18pm UTC](https://discuss.elastic.co/t/logstash-error-the-signal-hup-is-in-use-by-the-jvm-and-will-not-work-correctly-on-this-platform-solved/57622 "2016-10-05T13:18:02Z")
Does anyone know a fix for this? I am running ELK on a Windows 7 machine Elasticsearch 2.3.3 Logstash 2.3.2 Kibana 4.5.1 I am trying to run my config file to import … --- ## [The Signal HUP is in Use by JVM And can't be use by this Platform](https://discuss.elastic.co/t/the-signal-hup-is-in-use-by-jvm-and-cant-be-use-by-this-platform/59764)
**Author:** [@Dillip](https://discuss.elastic.co/u/Dillip)\ **Replies:** 4\ **Last updated:** [October 5, 2016, 1:17pm UTC](https://discuss.elastic.co/t/the-signal-hup-is-in-use-by-jvm-and-cant-be-use-by-this-platform/59764 "2016-10-05T13:17:52Z")
Hello , I am facing this problem while running in my windows machine, Window 8.1, Logstash 2.4,ES 2.3.5 And Kibana 4.5.4 Both ES and Kibana is running fine but when I am hitting below command from bin folder it is giv… --- ## [Logstash giving HUP error](https://discuss.elastic.co/t/logstash-giving-hup-error/60559)
**Author:** [@Senz79](https://discuss.elastic.co/u/Senz79)\ **Replies:** 8\ **Last updated:** [October 5, 2016, 1:17pm UTC](https://discuss.elastic.co/t/logstash-giving-hup-error/60559 "2016-10-05T13:17:27Z")
Hello I am trying to run LOGSTASH on Windows but i am constantly getting the below error "The signal HUP is in use by the JVM and will not work correctly on this platform" I have tried all means to resolve the is… --- ## [Error - The signal HUP is in use by the JVM and will not work correctly on this platform](https://discuss.elastic.co/t/error-the-signal-hup-is-in-use-by-the-jvm-and-will-not-work-correctly-on-this-platform/47128)
**Author:** [@Amit2015](https://discuss.elastic.co/u/Amit2015)\ **Replies:** 13\ **Last updated:** [October 5, 2016, 1:14pm UTC](https://discuss.elastic.co/t/error-the-signal-hup-is-in-use-by-the-jvm-and-will-not-work-correctly-on-this-platform/47128 "2016-10-05T13:14:37Z")
Hi, I am trying command in LogStash: logstash -e 'input { stdin { } } output { elasticsearch { host =\> localhost } }' Getting error like - io/console not supported; tty will not be manipulated The signal HUP is in … [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1093) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1095)