# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1099 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1100 --- ## [Logstash date filter](https://discuss.elastic.co/t/logstash-date-filter/61247)
**Author:** [@Kyle\_Hanson](https://discuss.elastic.co/u/Kyle_Hanson)\ **Replies:** 3\ **Last updated:** [September 23, 2016, 1:02pm UTC](https://discuss.elastic.co/t/logstash-date-filter/61247 "2016-09-23T13:02:51Z")
If I have this value in my data: Dec 29 14:20:41 2005 Can you give me conf settings I'd need to have it get used as the @timestamp? I've tried many combinations and no luck getting the date filter to work for this f… --- ## [Logstash behaviour on SIGHUP?](https://discuss.elastic.co/t/logstash-behaviour-on-sighup/61352)
**Author:** [@paulkeogh](https://discuss.elastic.co/u/paulkeogh)\ **Replies:** 0\ **Last updated:** [September 23, 2016, 9:37am UTC](https://discuss.elastic.co/t/logstash-behaviour-on-sighup/61352 "2016-09-23T09:37:12Z")
Does Logstash re-register custom filter plugins on receipt of SIGHUP ? If not, is there any hook I can add to my custom filters to handle SIGHUP (assuming its propagated down) Thanks, --- ## [What causes the 403 template error?](https://discuss.elastic.co/t/what-causes-the-403-template-error/34541)
**Author:** [@iamthealex](https://discuss.elastic.co/u/iamthealex)\ **Replies:** 1\ **Last updated:** [September 23, 2016, 7:29am UTC](https://discuss.elastic.co/t/what-causes-the-403-template-error/34541 "2016-09-23T07:29:41Z")
$ bin/logstash -f httpin.conf Default settings used: Filter workers: 2 Failed to install template: \[403\] {"error":{"root\_cause":\[{"type":"security\_exception","reason":"action \[indices:admin/template/get\] is unauthorized… --- ## [Logstash is not reading all the logs](https://discuss.elastic.co/t/logstash-is-not-reading-all-the-logs/61302)
**Author:** [@vk126y](https://discuss.elastic.co/u/vk126y)\ **Replies:** 2\ **Last updated:** [September 23, 2016, 6:36am UTC](https://discuss.elastic.co/t/logstash-is-not-reading-all-the-logs/61302 "2016-09-23T06:36:13Z")
I want my logstash to read the following pattern of files from the logs directory Current Date File -\> server.log Historical File Name -\> server.log.yyyy-mm-dd In my system I have 22 files in my logs folder server.lo… --- ## [NoMethodError: undefined method \`eventget' for #\\>](https://discuss.elastic.co/t/nomethoderror-undefined-method-eventget-for-logstash-filters-mutate-0x65caadda/60862)
**Author:** [@chenjianbin](https://discuss.elastic.co/u/chenjianbin)\ **Replies:** 3\ **Last updated:** [September 23, 2016, 2:27am UTC](https://discuss.elastic.co/t/nomethoderror-undefined-method-eventget-for-logstash-filters-mutate-0x65caadda/60862 "2016-09-23T02:27:14Z")
my logstash version is 5.0.0-alpha5 and the following is my configuration . input { redis { batch\_count =\> 1000 host =\> "127.0.0.1" port =\> 6379 password =\> "xx" db =\> 0 … --- ## [Logstash fails to find zabbix plugin](https://discuss.elastic.co/t/logstash-fails-to-find-zabbix-plugin/61321)
**Author:** [@kevinthierry](https://discuss.elastic.co/u/kevinthierry)\ **Replies:** 0\ **Last updated:** [September 23, 2016, 2:17am UTC](https://discuss.elastic.co/t/logstash-fails-to-find-zabbix-plugin/61321 "2016-09-23T02:17:19Z")
Hello, I'm trying to send messages to zabbix but logstash doesn't seem to find the zabbix plugin: $ sudo /opt/logstash/bin/logstash -t -f /etc/logstash/conf.d/logstash.conf --verbose The given configuration is invali… --- ## [Space separated fields](https://discuss.elastic.co/t/space-separated-fields/61276)
**Author:** [@joshuaclark](https://discuss.elastic.co/u/joshuaclark)\ **Replies:** 3\ **Last updated:** [September 22, 2016, 7:31pm UTC](https://discuss.elastic.co/t/space-separated-fields/61276 "2016-09-22T19:31:27Z")
Hi I'm having a problem with shipping a log to elasticsearch. I have the config setup to use (?.{64}) when the field has /carbon/admin/login.jsp it's separating every slash. How can I get it to keep the slashes in the… --- ## [The templates won't take effect when I configure 3 file inputs](https://discuss.elastic.co/t/the-templates-wont-take-effect-when-i-configure-3-file-inputs/61292)
**Author:** [@Angelina](https://discuss.elastic.co/u/Angelina)\ **Replies:** 0\ **Last updated:** [September 22, 2016, 4:40pm UTC](https://discuss.elastic.co/t/the-templates-wont-take-effect-when-i-configure-3-file-inputs/61292 "2016-09-22T16:40:23Z")
Hi, I have a config file with three file inputs (all of them are log files) and three filters (each of them with a different pattern) and three elasticsearch outputs (each of them goes to a different index). Each index… --- ## [Reading json file through logstash](https://discuss.elastic.co/t/reading-json-file-through-logstash/59995)
**Author:** [@saisn](https://discuss.elastic.co/u/saisn)\ **Replies:** 2\ **Last updated:** [September 22, 2016, 2:23pm UTC](https://discuss.elastic.co/t/reading-json-file-through-logstash/59995 "2016-09-22T14:23:45Z")
I have a json in the below format abc def{"DeviceId": "00D0","From": "LA","NotificationType": "Message","PublishTime": "2016-08-12T16:00:01.0995115+00:00",{"Version": "1.0","DeviceId": "00D0","From": "00D0"} how can … --- ## [The signal HUP is in use by the JVM and will not work correctly on this platform](https://discuss.elastic.co/t/the-signal-hup-is-in-use-by-the-jvm-and-will-not-work-correctly-on-this-platform/60910)
**Author:** [@rockdale](https://discuss.elastic.co/u/rockdale)\ **Replies:** 6\ **Last updated:** [September 22, 2016, 1:53pm UTC](https://discuss.elastic.co/t/the-signal-hup-is-in-use-by-the-jvm-and-will-not-work-correctly-on-this-platform/60910 "2016-09-22T13:53:22Z")
I just installed LogStash 2.4.0 on Windows 7 to try out. But got this HUP error when trying to load data from a CSV file. The CSV file is downloaded from http://data.donorschoose.org/open-data/overview/ (the donation dat… --- ## [Logstash Memorization](https://discuss.elastic.co/t/logstash-memorization/61234)
**Author:** [@RdrgPorto](https://discuss.elastic.co/u/RdrgPorto)\ **Replies:** 6\ **Last updated:** [September 22, 2016, 1:32pm UTC](https://discuss.elastic.co/t/logstash-memorization/61234 "2016-09-22T13:32:09Z")
Hi everyone, I need any help about Logstash. I have to add a common field to all lines. For example: Monday \[Oct 11 14:32:52 2000\] \[error\] \[client 127.0.0.1\] client denied by server \[Oct 11 14:32:52 2000\] \[error\] \[cl… --- ## [Reloading the translate dictionary path](https://discuss.elastic.co/t/reloading-the-translate-dictionary-path/61262)
**Author:** [@Or\_Weinberger](https://discuss.elastic.co/u/Or_Weinberger)\ **Replies:** 0\ **Last updated:** [September 22, 2016, 1:30pm UTC](https://discuss.elastic.co/t/reloading-the-translate-dictionary-path/61262 "2016-09-22T13:30:04Z")
I'm using the latest Logstash 2.4.0 version using the latest 3.0.1 version of the translate plugin. I have the following configuration: filter { translate { dictionary\_path =\> "/dict/ip\_to\_plugin.yaml" fie… --- ## [Require Help in understanding logstash](https://discuss.elastic.co/t/require-help-in-understanding-logstash/24322)
**Author:** [@Lee\_PS](https://discuss.elastic.co/u/Lee_PS)\ **Replies:** 11\ **Last updated:** [September 22, 2016, 1:24pm UTC](https://discuss.elastic.co/t/require-help-in-understanding-logstash/24322 "2016-09-22T13:24:01Z")
Hi I am new to logstash . I gone through some documentation about logstash and feel good to learn more about it. The requirement which i am trying is . To read the log file and mathc the keyword Access in the log fil… --- ## [Add field "remote\_ip" if message contains ip addr](https://discuss.elastic.co/t/add-field-remote-ip-if-message-contains-ip-addr/61225)
**Author:** [@himbeere](https://discuss.elastic.co/u/himbeere)\ **Replies:** 3\ **Last updated:** [September 22, 2016, 10:47am UTC](https://discuss.elastic.co/t/add-field-remote-ip-if-message-contains-ip-addr/61225 "2016-09-22T10:47:45Z")
Hello all. I am trying to add a new field if an ip addr is in the message field. Something like that. filter { grok { match =\> { "message" =\> "%{IP:client} } add\_field =\> { "remote\_ip" =\> "%{client}" } }… --- ## [Is there anyway I can tag the elasticsearch server name in the field?](https://discuss.elastic.co/t/is-there-anyway-i-can-tag-the-elasticsearch-server-name-in-the-field/61196)
**Author:** [@macymin](https://discuss.elastic.co/u/macymin)\ **Replies:** 7\ **Last updated:** [September 22, 2016, 10:39am UTC](https://discuss.elastic.co/t/is-there-anyway-i-can-tag-the-elasticsearch-server-name-in-the-field/61196 "2016-09-22T10:39:00Z")
my data flows from source server --\> redis (on elasticsearch server A) --\> elasticsearch (same server as redis run). what i know is logstash can only parse whatever available in the message or path, elasticsearch is no… --- ## [Re Indexing Help](https://discuss.elastic.co/t/re-indexing-help/61228)
**Author:** [@sancroth](https://discuss.elastic.co/u/sancroth)\ **Replies:** 3\ **Last updated:** [September 22, 2016, 10:37am UTC](https://discuss.elastic.co/t/re-indexing-help/61228 "2016-09-22T10:37:13Z")
Hello dear Elastic community. I am pretty new to using elastic and log stash and i am currently facing a huge problem. We have setup log stash to parse networking logs to elastic and then we can use them to check our t… --- ## [Multiple Beat Imports different codec](https://discuss.elastic.co/t/multiple-beat-imports-different-codec/61219)
**Author:** [@ado](https://discuss.elastic.co/u/ado)\ **Replies:** 1\ **Last updated:** [September 22, 2016, 9:25am UTC](https://discuss.elastic.co/t/multiple-beat-imports-different-codec/61219 "2016-09-22T09:25:42Z")
Hi, I do use on client side top, packet and filebeat. The filebeat service ready log file which is json formatted per line. filebeat.yml filebeat: prospectors: - paths: - /srv… --- ## [Csv file with multiline values getting parsed as single message](https://discuss.elastic.co/t/csv-file-with-multiline-values-getting-parsed-as-single-message/61200)
**Author:** [@Immortal](https://discuss.elastic.co/u/Immortal)\ **Replies:** 4\ **Last updated:** [September 22, 2016, 8:43am UTC](https://discuss.elastic.co/t/csv-file-with-multiline-values-getting-parsed-as-single-message/61200 "2016-09-22T08:43:16Z")
Hi again, I am facing problem to parse a csv file that has values spread across multiline. While trying with csv plugin ,the file is getting parsed as a single message(i.e: after the mentioned column names in csv plugi… --- ## [Logstash logrotate](https://discuss.elastic.co/t/logstash-logrotate/2530)
**Author:** [@lpurbaelk](https://discuss.elastic.co/u/lpurbaelk)\ **Replies:** 3\ **Last updated:** [September 22, 2016, 8:01am UTC](https://discuss.elastic.co/t/logstash-logrotate/2530 "2016-09-22T08:01:43Z")
Hello all, I have been googling topic about logrotate on logstash file, such as logstash.log and logstash.stdout, for some reason I couldn't make logrotate working. My logstash.log and logstash.stdout are pretty inte… --- ## [Beats input: the pipeline is blocked](https://discuss.elastic.co/t/beats-input-the-pipeline-is-blocked/59277)
**Author:** [@Clement\_Ros](https://discuss.elastic.co/u/Clement_Ros)\ **Replies:** 3\ **Last updated:** [September 22, 2016, 7:35am UTC](https://discuss.elastic.co/t/beats-input-the-pipeline-is-blocked/59277 "2016-09-22T07:35:11Z")
Hi, I'm using logstash 2.2.0 and logstash-input-beats (2.1.2). This error occured when y add a grok filter. My original filter look like this : \> filter { \> if "java\_devices" in \[source\] { \> … --- ## [Not able to create index with logstash.conf](https://discuss.elastic.co/t/not-able-to-create-index-with-logstash-conf/61103)
**Author:** [@sahilarora0928](https://discuss.elastic.co/u/sahilarora0928)\ **Replies:** 2\ **Last updated:** [September 22, 2016, 6:18am UTC](https://discuss.elastic.co/t/not-able-to-create-index-with-logstash-conf/61103 "2016-09-22T06:18:16Z")
Doing a poc need some help asap. I have logstash.conf file with following stuff. input { file { path =\> "D:/elasticsearch/logstash-tutorial.log/nginxAccess.log" start\_position =\> "beginning" … --- ## [How to read the rotated logs by logstash](https://discuss.elastic.co/t/how-to-read-the-rotated-logs-by-logstash/61203)
**Author:** [@vk126y](https://discuss.elastic.co/u/vk126y)\ **Replies:** 0\ **Last updated:** [September 22, 2016, 6:09am UTC](https://discuss.elastic.co/t/how-to-read-the-rotated-logs-by-logstash/61203 "2016-09-22T06:09:49Z")
I have a logstash configuration to read the log files as follow. file { type =\> "serverlog" path =\> \["////guvctapfil03.bravurasolutions.local//LOG\_DIR//server.log"\] start\_position =\> "beginning" } Now at 0… --- ## [Translate plugin for non yml files](https://discuss.elastic.co/t/translate-plugin-for-non-yml-files/61195)
**Author:** [@gringo](https://discuss.elastic.co/u/gringo)\ **Replies:** 1\ **Last updated:** [September 22, 2016, 5:30am UTC](https://discuss.elastic.co/t/translate-plugin-for-non-yml-files/61195 "2016-09-22T05:30:05Z")
I have a blacklist file that is in the following format 10.211.22.1#Port Scanning#country#10.0102#1.19281000 Can I use the regex function of the translate plugin for this? --- ## [Create geo\_point from nested coordinates](https://discuss.elastic.co/t/create-geo-point-from-nested-coordinates/60835)
**Author:** [@Crai](https://discuss.elastic.co/u/Crai)\ **Replies:** 12\ **Last updated:** [September 21, 2016, 11:16pm UTC](https://discuss.elastic.co/t/create-geo-point-from-nested-coordinates/60835 "2016-09-21T23:16:39Z")
I am trying to create a geo\_point field to add coords using the http poller to pull some data in json format. so the json is coming in a format like this. Multiple JSON documents representing each item and it's proper… --- ## [Log4j2 input](https://discuss.elastic.co/t/log4j2-input/61187)
**Author:** [@sbecker](https://discuss.elastic.co/u/sbecker)\ **Replies:** 0\ **Last updated:** [September 21, 2016, 10:51pm UTC](https://discuss.elastic.co/t/log4j2-input/61187 "2016-09-21T22:51:13Z")
I'm trying to get log4j2 logging enabled in logstash. I upgraded to logstash-all-plugins-2.4.0-1.noarch. The logstash plugins github page (https://github.com/logstash-plugins?utf8=%E2%9C%93&query=log4) shows logstash-i… --- ## [Configure Kafka Output to send ByteArray](https://discuss.elastic.co/t/configure-kafka-output-to-send-bytearray/60758)
**Author:** [@fsellecchia](https://discuss.elastic.co/u/fsellecchia)\ **Replies:** 1\ **Last updated:** [September 21, 2016, 7:44pm UTC](https://discuss.elastic.co/t/configure-kafka-output-to-send-bytearray/60758 "2016-09-21T19:44:00Z")
I'm working with logstash version 2.3.4 and trying to write an Array of Bytes to kafka. For doing this, I built a filter that encodes a message in avro. All the enconding / deconding unit tests on the filter work fine. I… --- ## [Logstash-Elasticsearch Output Using Templates](https://discuss.elastic.co/t/logstash-elasticsearch-output-using-templates/61160)
**Author:** [@Maxwell\_Flanders](https://discuss.elastic.co/u/Maxwell_Flanders)\ **Replies:** 3\ **Last updated:** [September 21, 2016, 6:09pm UTC](https://discuss.elastic.co/t/logstash-elasticsearch-output-using-templates/61160 "2016-09-21T18:09:54Z")
I have been wondering something about the "template" and "template\_overwrite" option in the elasticsearch output plugin for logstash. Because this is part of the output configuration, it should be invoked for every singl… --- ## [Logstash cluster suggestion](https://discuss.elastic.co/t/logstash-cluster-suggestion/61138)
**Author:** [@Phani\_Nadiminti](https://discuss.elastic.co/u/Phani_Nadiminti)\ **Replies:** 4\ **Last updated:** [September 21, 2016, 2:40pm UTC](https://discuss.elastic.co/t/logstash-cluster-suggestion/61138 "2016-09-21T14:40:04Z")
Hi All, I have use case like i have to fetch data from kafka topic by using logstash and pushing to ES since i am using logstash as a forwarder to ship logs to ES in this case how we can achieve failover if one logstas… --- ## [Log Stash config error](https://discuss.elastic.co/t/log-stash-config-error/61135)
**Author:** [@alvaroca1](https://discuss.elastic.co/u/alvaroca1)\ **Replies:** 5\ **Last updated:** [September 21, 2016, 2:37pm UTC](https://discuss.elastic.co/t/log-stash-config-error/61135 "2016-09-21T14:37:51Z")
Good day, I'm trying to load a logstash config with multiple grok filters and it gives me an error when I run a config test .\\logstash.bat : io/console not supported; tty will not be manipulated At line:1 char:1 + .\\l… --- ## [Elapsed filter error](https://discuss.elastic.co/t/elapsed-filter-error/61140)
**Author:** [@il.bert](https://discuss.elastic.co/u/il.bert)\ **Replies:** 1\ **Last updated:** [September 21, 2016, 2:22pm UTC](https://discuss.elastic.co/t/elapsed-filter-error/61140 "2016-09-21T14:22:25Z")
Hi everybody, I'm trying to use the elapsed filter but I think it has a bug this is my -cleaned- result "@timestamp": "2016-09-20T01:52:21.000Z", "tags": \[ "elapsed", "elapsed\_match" \], "elapsed\_time": 128143.655… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1098) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1100)