# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1095 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1096 --- ## [Dynamic Indexing based on user input](https://discuss.elastic.co/t/dynamic-indexing-based-on-user-input/62238)
**Author:** [@Mayank\_Agrawal](https://discuss.elastic.co/u/Mayank_Agrawal)\ **Replies:** 6\ **Last updated:** [October 5, 2016, 12:17pm UTC](https://discuss.elastic.co/t/dynamic-indexing-based-on-user-input/62238 "2016-10-05T12:17:48Z")
I am developing an application using node.js (an custom interface) to visualize logs. There are two issues that I am facing: 1) How to dynamically change the index based on user input??? Through the interface, user w… --- ## [Time without a date field](https://discuss.elastic.co/t/time-without-a-date-field/27282)
**Author:** [@michaellizhou](https://discuss.elastic.co/u/michaellizhou)\ **Replies:** 3\ **Last updated:** [October 5, 2016, 11:02am UTC](https://discuss.elastic.co/t/time-without-a-date-field/27282 "2016-10-05T11:02:21Z")
I have logs that only have a time field i.e. HH:mm:ss.SSS but for some reason there are no dates! I want to include today's date to this field called logstoretime. Because if I do not specify a date filter the time diffe… --- ## [When logstash-5.0.0-beta1 image would be available on docker hub?](https://discuss.elastic.co/t/when-logstash-5-0-0-beta1-image-would-be-available-on-docker-hub/62207)
**Author:** [@Tarini\_Dash](https://discuss.elastic.co/u/Tarini_Dash)\ **Replies:** 1\ **Last updated:** [October 5, 2016, 10:09am UTC](https://discuss.elastic.co/t/when-logstash-5-0-0-beta1-image-would-be-available-on-docker-hub/62207 "2016-10-05T10:09:18Z")
Current docker hub has logstash-5.0.0-alpha5 as latest image. We would like to try the beta release image to test. --- ## [Http\_poller input giving read time out for url which are taking more that 10 sec to load the page](https://discuss.elastic.co/t/http-poller-input-giving-read-time-out-for-url-which-are-taking-more-that-10-sec-to-load-the-page/62250)
**Author:** [@RohanKumbhar](https://discuss.elastic.co/u/RohanKumbhar)\ **Replies:** 0\ **Last updated:** [October 5, 2016, 9:24am UTC](https://discuss.elastic.co/t/http-poller-input-giving-read-time-out-for-url-which-are-taking-more-that-10-sec-to-load-the-page/62250 "2016-10-05T09:24:16Z")
Hi All, I'm facing one issue while using http\_poller input plugin . Issue is whenever the api response time is greater than 10 sec then in the output it shows "read timed out" error. I tried increasing request\_timeo… --- ## [Nothing Happens After Restart](https://discuss.elastic.co/t/nothing-happens-after-restart/62240)
**Author:** [@Romain\_PZK](https://discuss.elastic.co/u/Romain_PZK)\ **Replies:** 4\ **Last updated:** [October 5, 2016, 8:52am UTC](https://discuss.elastic.co/t/nothing-happens-after-restart/62240 "2016-10-05T08:52:43Z")
Hello, I've tried some modifications on my logstash config file and when I restart logstash nothing happens after "Pipeline main started". If I do a roll back on the config file, it's the same problem. Logstash not sta… --- ## [Logstash Pipeline Sequence](https://discuss.elastic.co/t/logstash-pipeline-sequence/62114)
**Author:** [@chromechris](https://discuss.elastic.co/u/chromechris)\ **Replies:** 1\ **Last updated:** [October 5, 2016, 8:17am UTC](https://discuss.elastic.co/t/logstash-pipeline-sequence/62114 "2016-10-05T08:17:26Z")
Hello Loggers, I am wondering what happens when a Logstash thread get stuck at the input/filter-output level. Does Logstash create new threads to continue, or does it stay stuck indefinitely. I am asking this because I… --- ## [Malformed dateformat](https://discuss.elastic.co/t/malformed-dateformat/62234)
**Author:** [@pbmsys](https://discuss.elastic.co/u/pbmsys)\ **Replies:** 2\ **Last updated:** [October 5, 2016, 7:33am UTC](https://discuss.elastic.co/t/malformed-dateformat/62234 "2016-10-05T07:33:36Z")
Hi. We are seeing errors on malformed dateformats on our Logstash hosts even though we should be matching the pattern. Logstash: 2.4 Elasticsearch: 2.4 The Logstash Config: if \[message\] { grok { patterns\_dir =\> \[… --- ## [Add\_field and then gsub in one pass is not supported?](https://discuss.elastic.co/t/add-field-and-then-gsub-in-one-pass-is-not-supported/62206)
**Author:** [@kevinpauli](https://discuss.elastic.co/u/kevinpauli)\ **Replies:** 2\ **Last updated:** [October 5, 2016, 6:09am UTC](https://discuss.elastic.co/t/add-field-and-then-gsub-in-one-pass-is-not-supported/62206 "2016-10-05T06:09:17Z")
Logstash version 2.2.4 on ubuntu 14.04 I have an existing @timestamp field in some documents, with values like "2016-09-29T05:25:52.000Z". I would like to extract just the "day" portion of the timestamp and store it i… --- ## [Best log practice for log messages](https://discuss.elastic.co/t/best-log-practice-for-log-messages/62040)
**Author:** [@Bajarang\_Agarwal](https://discuss.elastic.co/u/Bajarang_Agarwal)\ **Replies:** 1\ **Last updated:** [October 5, 2016, 6:07am UTC](https://discuss.elastic.co/t/best-log-practice-for-log-messages/62040 "2016-10-05T06:07:56Z")
We are starting with a new application and we want to use ELK stack for logging. We are not sure that we should use the plain text format or json format to log. We know that plain text format was previously very popular… --- ## [Elasticsearch output - load balancing selection](https://discuss.elastic.co/t/elasticsearch-output-load-balancing-selection/61847)
**Author:** [@kobyb](https://discuss.elastic.co/u/kobyb)\ **Replies:** 1\ **Last updated:** [October 5, 2016, 6:01am UTC](https://discuss.elastic.co/t/elasticsearch-output-load-balancing-selection/61847 "2016-10-05T06:01:14Z")
Say I have three logstash servers loadbalanced behind and F5. All three servers are identical, and contain an elasticsearch output plugin with a host array of something like: hosts =\> \["host1","host2",host3"\]. Ho… --- ## [How to split an array in logstash which is of type string](https://discuss.elastic.co/t/how-to-split-an-array-in-logstash-which-is-of-type-string/62111)
**Author:** [@saisn](https://discuss.elastic.co/u/saisn)\ **Replies:** 3\ **Last updated:** [October 5, 2016, 5:35am UTC](https://discuss.elastic.co/t/how-to-split-an-array-in-logstash-which-is-of-type-string/62111 "2016-10-05T05:35:10Z")
I have a field dates as string but i need to convert it as an array and save to another filed lets say 'all dates'. How can i achieve this dates:\["2016-03-09T20:52:43","2016-03-09T21:23:32","2016-03-09T22:24:21"\] I t… --- ## [Organizing Inputs](https://discuss.elastic.co/t/organizing-inputs/62191)
**Author:** [@jnpetty](https://discuss.elastic.co/u/jnpetty)\ **Replies:** 2\ **Last updated:** [October 4, 2016, 9:28pm UTC](https://discuss.elastic.co/t/organizing-inputs/62191 "2016-10-04T21:28:14Z")
With all of the different types of data that we ingest(Windows/Linus servers, firewalls, load-balancers, custom application logs, ect) how do you all organize your inputs to keep things from getting out of hand? I origin… --- ## [Beta issues](https://discuss.elastic.co/t/beta-issues/61987)
**Author:** [@DigiAngel](https://discuss.elastic.co/u/DigiAngel)\ **Replies:** 6\ **Last updated:** [October 4, 2016, 9:05pm UTC](https://discuss.elastic.co/t/beta-issues/61987 "2016-10-04T21:05:45Z")
Guess that's why they call it a beta :wink: Per first-event \[07:07:33 @tester:/usr/share/logstash$\] bin/logstash -e 'input { stdin { } } output { stdout {} }' ArgumentError: Path "/usr/share/logstash/data" is not a di… --- ## [Inputting file into logstash](https://discuss.elastic.co/t/inputting-file-into-logstash/62214)
**Author:** [@arque](https://discuss.elastic.co/u/arque)\ **Replies:** 1\ **Last updated:** [October 4, 2016, 7:55pm UTC](https://discuss.elastic.co/t/inputting-file-into-logstash/62214 "2016-10-04T19:55:56Z")
Hi, I have here a software (NetWtiness) that generates logs in the extension .nwmdb, and I've been trying to use it as input to Logstash to visualize it in Kibana. This .nwmdb file is not human readable. Should I use f… --- ## [\--config.test\_and\_exit validation fails on certain valid output plugin settings](https://discuss.elastic.co/t/config-test-and-exit-validation-fails-on-certain-valid-output-plugin-settings/62204)
**Author:** [@Tarini\_Dash](https://discuss.elastic.co/u/Tarini_Dash)\ **Replies:** 0\ **Last updated:** [October 4, 2016, 6:11pm UTC](https://discuss.elastic.co/t/config-test-and-exit-validation-fails-on-certain-valid-output-plugin-settings/62204 "2016-10-04T18:11:09Z")
Product - logstash-5.0.0-beta1 Checked in Gemfile that logstash-input-kafka plugin is available. my logstash-pipeline.conf has below output config. output { elasticsearch { hosts =\> \["x.x.x.x:9200","y.y.y.y:92… --- ## [Logstash beat input plugin ignoring "client\_inactivity\_timeout" value](https://discuss.elastic.co/t/logstash-beat-input-plugin-ignoring-client-inactivity-timeout-value/61593)
**Author:** [@AlexFloyd](https://discuss.elastic.co/u/AlexFloyd)\ **Replies:** 1\ **Last updated:** [October 4, 2016, 5:09pm UTC](https://discuss.elastic.co/t/logstash-beat-input-plugin-ignoring-client-inactivity-timeout-value/61593 "2016-10-04T17:09:21Z")
In despite of setting "client\_inactivity\_timeout" value in config file logstash closing session from filebeat after 15 seconds of inactivity. logstash-2.4.0 OEL 6.8 kernel: 3.8.13 - 118 Oracle JDK 1.8.0\_101 input … --- ## [NXLog Best Practices and Multiple Log Inputs](https://discuss.elastic.co/t/nxlog-best-practices-and-multiple-log-inputs/61872)
**Author:** [@jnpetty](https://discuss.elastic.co/u/jnpetty)\ **Replies:** 8\ **Last updated:** [October 4, 2016, 4:48pm UTC](https://discuss.elastic.co/t/nxlog-best-practices-and-multiple-log-inputs/61872 "2016-10-04T16:48:28Z")
Has anyone seen a best practices for how to configure NXLog? Im looking for recommendations on the best way to configure CPU and memory buffers, Inputs, Outputs, Routes, ect. Also we will have multiple Input log files … --- ## [How to limit the request size to less than a 100Mb in AWS](https://discuss.elastic.co/t/how-to-limit-the-request-size-to-less-than-a-100mb-in-aws/62182)
**Author:** [@rgstreekstra](https://discuss.elastic.co/u/rgstreekstra)\ **Replies:** 0\ **Last updated:** [October 4, 2016, 3:20pm UTC](https://discuss.elastic.co/t/how-to-limit-the-request-size-to-less-than-a-100mb-in-aws/62182 "2016-10-04T15:20:58Z")
Hi all, Is there a better way to limit the request size to 100Mb than by playing with the flush\_size parameter? AWS limits the input request to 100MB. Thanks Roelof. --- ## [Removal of @timestamp field](https://discuss.elastic.co/t/removal-of-timestamp-field/62149)
**Author:** [@sunilmchaudhari](https://discuss.elastic.co/u/sunilmchaudhari)\ **Replies:** 1\ **Last updated:** [October 4, 2016, 12:37pm UTC](https://discuss.elastic.co/t/removal-of-timestamp-field/62149 "2016-10-04T12:37:32Z")
Hi, I have added custom field eventLogTime which shows the time of logs generated. At the same time I want to remove @timestamp field. However I am getting error when I tyr to remove @timestamp in logstash filter. Lo… --- ## [Gelf listener died](https://discuss.elastic.co/t/gelf-listener-died/61580)
**Author:** [@Jeremy\_Lecour](https://discuss.elastic.co/u/Jeremy_Lecour)\ **Replies:** 1\ **Last updated:** [October 4, 2016, 12:28pm UTC](https://discuss.elastic.co/t/gelf-listener-died/61580 "2016-10-04T12:28:13Z")
Hi, I have a lot of errors like this (every 5 seconds) : { :timestamp=\>"2016-09-27T10:36:52.024000+0200", :message=\>"gelf listener died", :exception=\>#\, :backtr… --- ## [Logstash as a service in linux](https://discuss.elastic.co/t/logstash-as-a-service-in-linux/62126)
**Author:** [@elastic-fan](https://discuss.elastic.co/u/elastic-fan)\ **Replies:** 15\ **Last updated:** [October 4, 2016, 11:20am UTC](https://discuss.elastic.co/t/logstash-as-a-service-in-linux/62126 "2016-10-04T11:20:43Z")
Hello, Is it possible to run logstash as service in linux? i am finding it difficult, in windows its super easy and even can run multiple instances, but in linux i have no clue at all --- ## [Please help to grok my TMG Logs. How to use GeoIP?](https://discuss.elastic.co/t/please-help-to-grok-my-tmg-logs-how-to-use-geoip/61206)
**Author:** [@toasti](https://discuss.elastic.co/u/toasti)\ **Replies:** 20\ **Last updated:** [October 4, 2016, 10:14am UTC](https://discuss.elastic.co/t/please-help-to-grok-my-tmg-logs-how-to-use-geoip/61206 "2016-10-04T10:14:19Z")
Hello there, I am absolutely new to the ELK-Stack, but as described in my other thread I have an ELK-Stack running since yesterday and absolutely flashed what is possible with this. Since yesterday I also send my TMG… --- ## [Quotes in Grok](https://discuss.elastic.co/t/quotes-in-grok/62136)
**Author:** [@Tim\_James](https://discuss.elastic.co/u/Tim_James)\ **Replies:** 2\ **Last updated:** [October 4, 2016, 10:22am UTC](https://discuss.elastic.co/t/quotes-in-grok/62136 "2016-10-04T10:22:01Z")
Hi, I'm having trouble trying to parse log lines like this (but much longer): "timestamp":"2016-02-10 00:10:33","level":"ERROR" So everything is in double quotes. I just want a simple way to get the fields separ… --- ## [Trim from only one field](https://discuss.elastic.co/t/trim-from-only-one-field/62125)
**Author:** [@chromechris](https://discuss.elastic.co/u/chromechris)\ **Replies:** 0\ **Last updated:** [October 4, 2016, 5:34am UTC](https://discuss.elastic.co/t/trim-from-only-one-field/62125 "2016-10-04T05:34:20Z")
Hello Loggers, I am wondering how I could be able to trim the value of a string up to a certain point: Example: 2016-03-19-06.00.00.000000 trim only: 2016-03-19-06.00.00.000 In my mappings the format is: "Timestamp… --- ## [JDBC plugin not supports unsigned int?](https://discuss.elastic.co/t/jdbc-plugin-not-supports-unsigned-int/62123)
**Author:** [@Rayen\_Yang](https://discuss.elastic.co/u/Rayen_Yang)\ **Replies:** 0\ **Last updated:** [October 4, 2016, 3:37am UTC](https://discuss.elastic.co/t/jdbc-plugin-not-supports-unsigned-int/62123 "2016-10-04T03:37:12Z")
I have a table which has a unsigned int column in MySQL.Its a pity that exception occurred when I used Logstash to read this table: e\[33mException when executing JDBC query {:exception=\>#\ **Author:** [@meathouse](https://discuss.elastic.co/u/meathouse)\ **Replies:** 1\ **Last updated:** [October 4, 2016, 3:13am UTC](https://discuss.elastic.co/t/have-logstash-output-aws-s3-elb-log-to-multiple-elastic-indexes/62108 "2016-10-04T03:13:01Z") I have logstash properly working to send ELB logs in s3 to a single elasticsearch index. Relevant configs are shown below. This works great. But now I'd like to filter some of the ELB logs to specific indexes. Let's say … --- ## [How to remove only one character from string using GSUB?](https://discuss.elastic.co/t/how-to-remove-only-one-character-from-string-using-gsub/61962)
**Author:** [@chromechris](https://discuss.elastic.co/u/chromechris)\ **Replies:** 2\ **Last updated:** [October 3, 2016, 11:30pm UTC](https://discuss.elastic.co/t/how-to-remove-only-one-character-from-string-using-gsub/61962 "2016-10-03T23:30:50Z")
Ok, so the issue I have is I want to remove a character once from a field value, and this specific character that I want to remove appears multiple times in the field value. I don't want to remove this character from all… --- ## [Logstash, MongoDB and JDBC/UnityJDBC](https://discuss.elastic.co/t/logstash-mongodb-and-jdbc-unityjdbc/62082)
**Author:** [@DooGZ](https://discuss.elastic.co/u/DooGZ)\ **Replies:** 1\ **Last updated:** [October 3, 2016, 9:09pm UTC](https://discuss.elastic.co/t/logstash-mongodb-and-jdbc-unityjdbc/62082 "2016-10-03T21:09:14Z")
Hi, Any tips on how to use JDBC to import MongoDB to ES? MongoDB: test Tried using mongo-java-driver from http://mongodb.github.io/mongo-java-driver/3.3/driver/getting-started/installation-guide/ Downloaded these fil… --- ## [How to Fetch ISP Details in GeoIP plugin](https://discuss.elastic.co/t/how-to-fetch-isp-details-in-geoip-plugin/62053)
**Author:** [@abhi\_chinchole](https://discuss.elastic.co/u/abhi_chinchole)\ **Replies:** 1\ **Last updated:** [October 3, 2016, 9:07pm UTC](https://discuss.elastic.co/t/how-to-fetch-isp-details-in-geoip-plugin/62053 "2016-10-03T21:07:58Z")
I need to get ISP info from geoip plug-in. I am bit confused how to achieve this. --- ## [Netflow Asa & routers](https://discuss.elastic.co/t/netflow-asa-routers/62103)
**Author:** [@mrognone](https://discuss.elastic.co/u/mrognone)\ **Replies:** 1\ **Last updated:** [October 3, 2016, 7:28pm UTC](https://discuss.elastic.co/t/netflow-asa-routers/62103 "2016-10-03T19:28:48Z")
Hi all, I have multiples indexes receiving information from Cisco ASAs & Cisco routers. I created different dashboards with useful information to my company, but i have the same issue in all of these dashboards " band… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1094) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1096)