# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1107 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1108 --- ## [Is it possible to use "nested if" in logstash.conf](https://discuss.elastic.co/t/is-it-possible-to-use-nested-if-in-logstash-conf/59655)
**Author:** [@gayathri](https://discuss.elastic.co/u/gayathri)\ **Replies:** 2\ **Last updated:** [September 2, 2016, 11:34am UTC](https://discuss.elastic.co/t/is-it-possible-to-use-nested-if-in-logstash-conf/59655 "2016-09-02T11:34:48Z")
Hi Team, Is it possible to use "nested if" in output section inside logstash.conf ? --- ## [EXCEPTION : java.lang.OutOfMemoryError: GC overhead limit exceeded](https://discuss.elastic.co/t/exception-java-lang-outofmemoryerror-gc-overhead-limit-exceeded/58954)
**Author:** [@sanju1323](https://discuss.elastic.co/u/sanju1323)\ **Replies:** 8\ **Last updated:** [September 2, 2016, 10:15am UTC](https://discuss.elastic.co/t/exception-java-lang-outofmemoryerror-gc-overhead-limit-exceeded/58954 "2016-09-02T10:15:24Z")
Hi, I'm indexing data from sql server to Elasticsearch using JDBC plugin. While running a particular query, I'm facing this issue. Have tried increasing ES\_MIN\_MEM to 10g, ES\_MAX\_MEM to 10g, ES\_HEAP\_SIZE to 10g. But … --- ## [Pipeline main has been shutdown, how to troubleshoot this?](https://discuss.elastic.co/t/pipeline-main-has-been-shutdown-how-to-troubleshoot-this/59599)
**Author:** [@ahegazi](https://discuss.elastic.co/u/ahegazi)\ **Replies:** 2\ **Last updated:** [September 2, 2016, 7:37am UTC](https://discuss.elastic.co/t/pipeline-main-has-been-shutdown-how-to-troubleshoot-this/59599 "2016-09-02T07:37:56Z")
Hola Folks, Thats actually my first week as ELK stack work so I am testing some stuff to end up with a live analysis for all our servers with help of collectd (that's the plan) Anyways, here is my first logstash con… --- ## [About logstash-out-mongodb exception](https://discuss.elastic.co/t/about-logstash-out-mongodb-exception/59634)
**Author:** [@hhj1988](https://discuss.elastic.co/u/hhj1988)\ **Replies:** 1\ **Last updated:** [September 2, 2016, 7:27am UTC](https://discuss.elastic.co/t/about-logstash-out-mongodb-exception/59634 "2016-09-02T07:27:41Z")
hello ,can you help me? logstash-out-mongodb input { stdin{} } output{ mongodb { collection =\> "std" database =\> "fragment" generateId =\> true uri =\> "mongodb://192.168.199.7:27017" } } ~ Fa… --- ## [Stuck in the beginning](https://discuss.elastic.co/t/stuck-in-the-beginning/59570)
**Author:** [@SivadNai](https://discuss.elastic.co/u/SivadNai)\ **Replies:** 2\ **Last updated:** [September 2, 2016, 7:14am UTC](https://discuss.elastic.co/t/stuck-in-the-beginning/59570 "2016-09-02T07:14:55Z")
I am in the shameful state of getting stuck in the tutorial - https://www.elastic.co/guide/en/logstash/current/advanced-pipeline.html The configuration file was fine.. Ran the "Testing your intitial Pipeline" section a… --- ## [Using geo\_point and pulling lat/long from existing fields](https://discuss.elastic.co/t/using-geo-point-and-pulling-lat-long-from-existing-fields/59346)
**Author:** [@khall](https://discuss.elastic.co/u/khall)\ **Replies:** 2\ **Last updated:** [September 2, 2016, 5:53am UTC](https://discuss.elastic.co/t/using-geo-point-and-pulling-lat-long-from-existing-fields/59346 "2016-09-02T05:53:41Z")
I've reviewed different pieces of documentation and am unable to put it all together to figure out how to create a geo\_point field. I have used logstash to pull in a CSV file that contains statistical data for cities a… --- ## [Self-name index?](https://discuss.elastic.co/t/self-name-index/59248)
**Author:** [@Allie\_Yang1](https://discuss.elastic.co/u/Allie_Yang1)\ **Replies:** 5\ **Last updated:** [September 2, 2016, 5:50am UTC](https://discuss.elastic.co/t/self-name-index/59248 "2016-09-02T05:50:53Z")
Hi Currently my index are named by date (from @timestamp i suspect). How can i self-name them so that i can only analyze certain portion of yesterday's parsed data (not searchable from ES UI)? In another word, how can i … --- ## [Gz file input problem (terminal shows no response)](https://discuss.elastic.co/t/gz-file-input-problem-terminal-shows-no-response/59472)
**Author:** [@Allie\_Yang](https://discuss.elastic.co/u/Allie_Yang)\ **Replies:** 3\ **Last updated:** [September 1, 2016, 7:00pm UTC](https://discuss.elastic.co/t/gz-file-input-problem-terminal-shows-no-response/59472 "2016-09-01T19:00:39Z")
This might be a basic problem. I have the error code of "invalid config" when i try to parse gz file into logstash. Below is my config: input { file { type =\> "gzip" path =\> "/Users/yangyan/Desktop/log\_file/s… --- ## [Snmptrap input does not seem to output useful data](https://discuss.elastic.co/t/snmptrap-input-does-not-seem-to-output-useful-data/59608)
**Author:** [@jerrac](https://discuss.elastic.co/u/jerrac)\ **Replies:** 0\ **Last updated:** [September 1, 2016, 10:47pm UTC](https://discuss.elastic.co/t/snmptrap-input-does-not-seem-to-output-useful-data/59608 "2016-09-01T22:47:42Z")
I'm experimenting with the snmptrap input plugin. I've been able to receive data from snmptrap, but Logstash doesn't seem to be giving me anything useful as output. I could just not know how to read the snmp output, o… --- ## [Kv field\_split with bracketed internal data](https://discuss.elastic.co/t/kv-field-split-with-bracketed-internal-data/59603)
**Author:** [@Michael\_Tracey](https://discuss.elastic.co/u/Michael_Tracey)\ **Replies:** 0\ **Last updated:** [September 1, 2016, 9:26pm UTC](https://discuss.elastic.co/t/kv-field-split-with-bracketed-internal-data/59603 "2016-09-01T21:26:45Z")
I've got some incoming data that looks like this: author:(neil stephenson) title:(snow crash) I would like to KV on spaces, but only on spaces not wrapped in parenthesis. These settings doesn't seem to cut it: … --- ## [Timestamp at Input section](https://discuss.elastic.co/t/timestamp-at-input-section/59600)
**Author:** [@sombilat](https://discuss.elastic.co/u/sombilat)\ **Replies:** 7\ **Last updated:** [September 1, 2016, 9:17pm UTC](https://discuss.elastic.co/t/timestamp-at-input-section/59600 "2016-09-01T21:17:31Z")
Hello Guys, I am utilizing the @timestamp field in a DB2 Query. I am using the JDBC plugin, where in I am relying on the @timestamp field for my date parameters. Now, thing is I cannot use the @timestamp because it … --- ## [Failed to upgrade on Ubuntu (displaying older version)](https://discuss.elastic.co/t/failed-to-upgrade-on-ubuntu-displaying-older-version/59470)
**Author:** [@mikesparr](https://discuss.elastic.co/u/mikesparr)\ **Replies:** 7\ **Last updated:** [September 1, 2016, 7:35pm UTC](https://discuss.elastic.co/t/failed-to-upgrade-on-ubuntu-displaying-older-version/59470 "2016-09-01T19:35:31Z")
Problem Logstash upgrade appears to fail with apt package installer. After updating apt sources to latest 2.4 for Logstash, and then performing update and upgrade, it does not appear in upgrade list and says on latest v… --- ## [How can do a dynamic ingestion in Logstash?](https://discuss.elastic.co/t/how-can-do-a-dynamic-ingestion-in-logstash/59566)
**Author:** [@Deezy](https://discuss.elastic.co/u/Deezy)\ **Replies:** 1\ **Last updated:** [September 1, 2016, 4:43pm UTC](https://discuss.elastic.co/t/how-can-do-a-dynamic-ingestion-in-logstash/59566 "2016-09-01T16:43:34Z")
I'm a beginner with Logstash and I would like to have some more information on how to do dynamic ingestion --- ## [Remove the older syslog from the logstash shipper](https://discuss.elastic.co/t/remove-the-older-syslog-from-the-logstash-shipper/59558)
**Author:** [@ANU\_SARA\_VARGHESE](https://discuss.elastic.co/u/ANU_SARA_VARGHESE)\ **Replies:** 1\ **Last updated:** [September 1, 2016, 4:41pm UTC](https://discuss.elastic.co/t/remove-the-older-syslog-from-the-logstash-shipper/59558 "2016-09-01T16:41:27Z")
Hi, How could I remove the older syslog from the Logstash Shipper after I have send it to my redis server? --- ## [Import CSV with Long and Lat](https://discuss.elastic.co/t/import-csv-with-long-and-lat/59488)
**Author:** [@amran1](https://discuss.elastic.co/u/amran1)\ **Replies:** 4\ **Last updated:** [September 1, 2016, 3:49pm UTC](https://discuss.elastic.co/t/import-csv-with-long-and-lat/59488 "2016-09-01T15:49:06Z")
Hello, How to show Tile Map with load CSV file include Longitude and Latitude? And how to show out each split field in Kibana I have write this script, It couldn't run well. input { file { path =\> "/tmp/earthqu… --- ## [Put output in a sub field from JDBC input](https://discuss.elastic.co/t/put-output-in-a-sub-field-from-jdbc-input/59460)
**Author:** [@ave19](https://discuss.elastic.co/u/ave19)\ **Replies:** 2\ **Last updated:** [September 1, 2016, 2:12pm UTC](https://discuss.elastic.co/t/put-output-in-a-sub-field-from-jdbc-input/59460 "2016-09-01T14:12:02Z")
This is just a feature request sort of thing. I would like to put all the data I pull from the JDBC input inside a subfield with a configurable name. Something like: input.conf input { jdbc { ... … --- ## [User Agent Raw Mapping](https://discuss.elastic.co/t/user-agent-raw-mapping/59533)
**Author:** [@JoeeGrigg](https://discuss.elastic.co/u/JoeeGrigg)\ **Replies:** 4\ **Last updated:** [September 1, 2016, 1:47pm UTC](https://discuss.elastic.co/t/user-agent-raw-mapping/59533 "2016-09-01T13:47:10Z")
HI, I have recently set up Elasticsearch, Logstash and Kibana. My Logstash includes the useragent plugin and all that seems to be working fine. My problem is when it comes to visualising the user agent the separate… --- ## [Logstash: filter a dynamic field in the log line](https://discuss.elastic.co/t/logstash-filter-a-dynamic-field-in-the-log-line/59492)
**Author:** [@Dilesh\_Verma](https://discuss.elastic.co/u/Dilesh_Verma)\ **Replies:** 4\ **Last updated:** [September 1, 2016, 11:11am UTC](https://discuss.elastic.co/t/logstash-filter-a-dynamic-field-in-the-log-line/59492 "2016-09-01T11:11:32Z")
In the below input, we need to filter out “COUNT\_XXX123=1,SUCCESS\_XXX123=1” even if we don’t have “sellerId=XXX123” field available. Input: OtherMessages1=1,sellerId=XXX123,COUNT\_XXX123=1,SUCCESS\_XXX123=1,OtherMessage… --- ## [Seriously want to know how to change logstash @timestamp to specified timezone](https://discuss.elastic.co/t/seriously-want-to-know-how-to-change-logstash-timestamp-to-specified-timezone/59534)
**Author:** [@JayMiao](https://discuss.elastic.co/u/JayMiao)\ **Replies:** 0\ **Last updated:** [September 1, 2016, 10:39am UTC](https://discuss.elastic.co/t/seriously-want-to-know-how-to-change-logstash-timestamp-to-specified-timezone/59534 "2016-09-01T10:39:14Z")
the input @timestamp = "2016-09-01T10:05:16.490Z" and I want to change it to "+08:00" timezone. so ,the output @timestamp should be "2016-09-01T18:05:16.490Z" And the answer or discuss are not allowed to talk about "d… --- ## [Advanced field manipulation](https://discuss.elastic.co/t/advanced-field-manipulation/59515)
**Author:** [@Lorenzo\_Mainardi](https://discuss.elastic.co/u/Lorenzo_Mainardi)\ **Replies:** 3\ **Last updated:** [September 1, 2016, 9:41am UTC](https://discuss.elastic.co/t/advanced-field-manipulation/59515 "2016-09-01T09:41:15Z")
Good morning, I'm pretty newbie about ELK. I'm trying to use ELK to analyze DNS query log. I would like to add a field created splitting another field. I have a field like this: "query" =\> "clients1.google.com.", I… --- ## [Logstash Grok Parcing Based on SYSLOGPROG condition](https://discuss.elastic.co/t/logstash-grok-parcing-based-on-syslogprog-condition/59489)
**Author:** [@Bhuvanesh](https://discuss.elastic.co/u/Bhuvanesh)\ **Replies:** 4\ **Last updated:** [September 1, 2016, 8:34am UTC](https://discuss.elastic.co/t/logstash-grok-parcing-based-on-syslogprog-condition/59489 "2016-09-01T08:34:32Z")
Hi All, I am now trying to integate Rsyslog centralized server output to Logstash. Th Rsyslog output contains (apache\_access\_logs, /var/log/messages , secure log etc and from systemd log sources like local3 to 7), fro… --- ## [Is logstash running, not getting messages after default pipeline workers](https://discuss.elastic.co/t/is-logstash-running-not-getting-messages-after-default-pipeline-workers/59496)
**Author:** [@Siva\_Dorai](https://discuss.elastic.co/u/Siva_Dorai)\ **Replies:** 8\ **Last updated:** [September 1, 2016, 8:34am UTC](https://discuss.elastic.co/t/is-logstash-running-not-getting-messages-after-default-pipeline-workers/59496 "2016-09-01T08:34:26Z")
When i try to run my conf file, dont get any action after the settings line. E:\\ArchWorld\\logstash-2.3.4\\bin\>logstash -f ../first.conf io/console not supported; tty will not be manipulated Settings: Default pipeline wo… --- ## [Logstash Parse Error](https://discuss.elastic.co/t/logstash-parse-error/59345)
**Author:** [@pramod\_kumar](https://discuss.elastic.co/u/pramod_kumar)\ **Replies:** 1\ **Last updated:** [August 30, 2016, 11:38pm UTC](https://discuss.elastic.co/t/logstash-parse-error/59345 "2016-08-30T23:38:21Z")
If i try to parse the Log file with Logstash which basically takes input from Filebeat. But, am getting the following Error. FYI, It parses few and it ignores the other. Example: if a file has 100 records it parse(consum… --- ## [Load CSV File with Logstash and mutate fields in numbers](https://discuss.elastic.co/t/load-csv-file-with-logstash-and-mutate-fields-in-numbers/34427)
**Author:** [@adellarocca](https://discuss.elastic.co/u/adellarocca)\ **Replies:** 4\ **Last updated:** [September 1, 2016, 5:31am UTC](https://discuss.elastic.co/t/load-csv-file-with-logstash-and-mutate-fields-in-numbers/34427 "2016-09-01T05:31:20Z")
Hi! I'm trying to import a csv file with logstash. I've used csv filter but I need to convert some fields types in float. This is my conf file input{ file { path =\> "/home/alessandro/Scrivania/dataset/aft\_air\_data… --- ## [Filter Twitter Data with @account or hashtag](https://discuss.elastic.co/t/filter-twitter-data-with-account-or-hashtag/59452)
**Author:** [@rkhapre](https://discuss.elastic.co/u/rkhapre)\ **Replies:** 1\ **Last updated:** [September 1, 2016, 5:27am UTC](https://discuss.elastic.co/t/filter-twitter-data-with-account-or-hashtag/59452 "2016-09-01T05:27:06Z")
Hi All Is there any way i can filter twitter data with @account or hashtag? --- ## [Logstash parses only the header of log files at the morning of each day](https://discuss.elastic.co/t/logstash-parses-only-the-header-of-log-files-at-the-morning-of-each-day/59458)
**Author:** [@RileyShu](https://discuss.elastic.co/u/RileyShu)\ **Replies:** 0\ **Last updated:** [August 31, 2016, 7:00pm UTC](https://discuss.elastic.co/t/logstash-parses-only-the-header-of-log-files-at-the-morning-of-each-day/59458 "2016-08-31T19:00:14Z")
The log file I'm parsing are constantly writing new logs. My logstash works perfectly for other logs, except that everyday morning at around 7am, it will have about 5 consequent messages that only contain header of the l… --- ## [How do I setup Logstash to segregate logs from multiple servers?](https://discuss.elastic.co/t/how-do-i-setup-logstash-to-segregate-logs-from-multiple-servers/59432)
**Author:** [@ZillaG](https://discuss.elastic.co/u/ZillaG)\ **Replies:** 3\ **Last updated:** [August 31, 2016, 6:14pm UTC](https://discuss.elastic.co/t/how-do-i-setup-logstash-to-segregate-logs-from-multiple-servers/59432 "2016-08-31T18:14:28Z")
I building a central ELK stack that will be used to aggregate the logs from different customer installations, with each installation having multiple servers. I use rsyslog as the shipper. I wan to be able to "see" the fo… --- ## [Logstash apply multiple filters based on condition](https://discuss.elastic.co/t/logstash-apply-multiple-filters-based-on-condition/59299)
**Author:** [@mrunalgosar](https://discuss.elastic.co/u/mrunalgosar)\ **Replies:** 7\ **Last updated:** [August 31, 2016, 3:10pm UTC](https://discuss.elastic.co/t/logstash-apply-multiple-filters-based-on-condition/59299 "2016-08-31T15:10:51Z")
I have log lines as belows: 11:05:44,924 DEBUG DataFeed:? - Data received: data=TextMessage={ Header={ JMSMessageID={ID:someId} JMSDestination={Topic\[someTopic\]} JMSReplyTo={null} JMSDeliveryMode={NON\_PERSISTENT} JM… --- ## [Can't get any log from one special filter](https://discuss.elastic.co/t/cant-get-any-log-from-one-special-filter/59193)
**Author:** [@cazorla19](https://discuss.elastic.co/u/cazorla19)\ **Replies:** 4\ **Last updated:** [August 31, 2016, 12:40pm UTC](https://discuss.elastic.co/t/cant-get-any-log-from-one-special-filter/59193 "2016-08-31T12:40:35Z")
The issue: I have one filter which is responsible to process Nginx error logs. I set it up the same way as the access log filter. But! When "access" filter parsing logs well, error filter just skips logs. There is no \_gr… --- ## [Copy Info From Header To all Rows in CSV](https://discuss.elastic.co/t/copy-info-from-header-to-all-rows-in-csv/59396)
**Author:** [@uppaljs](https://discuss.elastic.co/u/uppaljs)\ **Replies:** 3\ **Last updated:** [August 31, 2016, 12:28pm UTC](https://discuss.elastic.co/t/copy-info-from-header-to-all-rows-in-csv/59396 "2016-08-31T12:28:43Z")
Hi, I am trying to import a CSV file , in which first row in each file contains information about the file ( where it came from etc ) and next row onwards are records. \[HEADER ROW\] HD;1;2;BGRCM;AFGAW;04682;2016083106… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1106) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1108)