# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1112 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1113 --- ## [Date filter not parsing](https://discuss.elastic.co/t/date-filter-not-parsing/58644)
**Author:** [@ash.vaidya94](https://discuss.elastic.co/u/ash.vaidya94)\ **Replies:** 6\ **Last updated:** [August 23, 2016, 8:22am UTC](https://discuss.elastic.co/t/date-filter-not-parsing/58644 "2016-08-23T08:22:48Z")
Hi all, I've been trying to parse my date, the logfile is in the following format: 15 Aug 2016 00:00:03,821|INFO |snjcprddex1| This is my conf file: input { file { path =\> "I:/LOGFILES/AthenaScenario/\*.\*" start\_po… --- ## [Logstash 5.0.0-alpha4 + geoip = Something is wrong with your configuration](https://discuss.elastic.co/t/logstash-5-0-0-alpha4-geoip-something-is-wrong-with-your-configuration/55991)
**Author:** [@mostolog](https://discuss.elastic.co/u/mostolog)\ **Replies:** 4\ **Last updated:** [August 23, 2016, 7:39am UTC](https://discuss.elastic.co/t/logstash-5-0-0-alpha4-geoip-something-is-wrong-with-your-configuration/55991 "2016-08-23T07:39:13Z")
Hi I'm experiencing some issues with logstash 5.0.0-alpha4 and geoip plugin. Posting it here before opening any issue in case is my fault. Get to the point. Run logstash container with GeoIP volume: docker run --… --- ## [How to improve performance of elasticsearch input in Logstash](https://discuss.elastic.co/t/how-to-improve-performance-of-elasticsearch-input-in-logstash/58513)
**Author:** [@MikeM](https://discuss.elastic.co/u/MikeM)\ **Replies:** 3\ **Last updated:** [August 22, 2016, 9:24pm UTC](https://discuss.elastic.co/t/how-to-improve-performance-of-elasticsearch-input-in-logstash/58513 "2016-08-22T21:24:35Z")
I want to use logstash to pull current elasticsearch documents, run them through filters, and then update them in the same cluster. I am trying to figure out how to get the best performance, and I'm first looking at the… --- ## [Logstash filter : Split plugin doesn't seems to work](https://discuss.elastic.co/t/logstash-filter-split-plugin-doesnt-seems-to-work/58578)
**Author:** [@LetMeR00t](https://discuss.elastic.co/u/LetMeR00t)\ **Replies:** 8\ **Last updated:** [August 22, 2016, 8:11pm UTC](https://discuss.elastic.co/t/logstash-filter-split-plugin-doesnt-seems-to-work/58578 "2016-08-22T20:11:07Z")
Hi everyone, I tried to use the split plugin for splitting an array into multiple events. However, it seems that it's not capable of interpreting field like "%{type\[1\]}". As entry, I use this kind of message (this is … --- ## [Logstash never processes some csv files](https://discuss.elastic.co/t/logstash-never-processes-some-csv-files/58613)
**Author:** [@AscendingRivers](https://discuss.elastic.co/u/AscendingRivers)\ **Replies:** 2\ **Last updated:** [August 22, 2016, 7:52pm UTC](https://discuss.elastic.co/t/logstash-never-processes-some-csv-files/58613 "2016-08-22T19:52:57Z")
I have a very simple setup for Logstash 2.3.2 to process CSV files. But some of the files never get processed. This topic has been discussed elsewhere on this forum, but not solved that I can see. (Each CSV has a newline… --- ## [\[Solved\] Grok match failure for Squid log](https://discuss.elastic.co/t/solved-grok-match-failure-for-squid-log/58598)
**Author:** [@Saurabh\_Jambhule](https://discuss.elastic.co/u/Saurabh_Jambhule)\ **Replies:** 0\ **Last updated:** [August 22, 2016, 5:11pm UTC](https://discuss.elastic.co/t/solved-grok-match-failure-for-squid-log/58598 "2016-08-22T17:11:52Z")
Please remove this post. I am not getting why my SQUID log is not matching. Please help in this, I am stuck. Config: grok { match =\> { "message" =\> "%{POSINT:timestamp}.%{WORD:timestamp\_ms}\\s+%{… --- ## [Logstash 5.0 Alpha 4 csv input and mutate split error](https://discuss.elastic.co/t/logstash-5-0-alpha-4-csv-input-and-mutate-split-error/55923)
**Author:** [@tcaudrey](https://discuss.elastic.co/u/tcaudrey)\ **Replies:** 3\ **Last updated:** [August 22, 2016, 5:32pm UTC](https://discuss.elastic.co/t/logstash-5-0-alpha-4-csv-input-and-mutate-split-error/55923 "2016-08-22T17:32:18Z")
Hi - I have simple .csv input files and a Logstash config that worked fine with Logstash 2.3.x, but when trying to use the same input files and config file in Logstash 5.0 aplha 4 produces the following error and crashes… --- ## [Logstash plugin is successfully installed but not found](https://discuss.elastic.co/t/logstash-plugin-is-successfully-installed-but-not-found/58596)
**Author:** [@sen](https://discuss.elastic.co/u/sen)\ **Replies:** 0\ **Last updated:** [August 22, 2016, 5:01pm UTC](https://discuss.elastic.co/t/logstash-plugin-is-successfully-installed-but-not-found/58596 "2016-08-22T17:01:59Z")
Hi folks, I am using logstash 2.3.2 and for one of my project I have to save some data in RAM. I asked a question on stackoverflow (Logstash: is it possible to save documents in memory?) to get a filter for that and the… --- ## [How to rotate and compress logs using Logstash](https://discuss.elastic.co/t/how-to-rotate-and-compress-logs-using-logstash/58583)
**Author:** [@daiyue](https://discuss.elastic.co/u/daiyue)\ **Replies:** 3\ **Last updated:** [August 22, 2016, 4:41pm UTC](https://discuss.elastic.co/t/how-to-rotate-and-compress-logs-using-logstash/58583 "2016-08-22T16:41:28Z")
Hi, I am wondering is it able to set log file rotation in terms of time in logstash, e.g. fetching and storing logs in the past 30 days, and then compressing the logs that exceed the time period and put them in some dire… --- ## [Logstash kafka output - producer type for version 2.x](https://discuss.elastic.co/t/logstash-kafka-output-producer-type-for-version-2-x/58236)
**Author:** [@ronnysh](https://discuss.elastic.co/u/ronnysh)\ **Replies:** 1\ **Last updated:** [August 22, 2016, 3:43pm UTC](https://discuss.elastic.co/t/logstash-kafka-output-producer-type-for-version-2-x/58236 "2016-08-22T15:43:44Z")
Hi guys, we need to configure sync producer type for kafka output plugin (or understand what is the default in version 2.x.) there was such variable in version 1.5 but it was removed - https://www.elastic.co/guide/en/l… --- ## [Not able to consume input from a kafka-topic](https://discuss.elastic.co/t/not-able-to-consume-input-from-a-kafka-topic/58202)
**Author:** [@sokio](https://discuss.elastic.co/u/sokio)\ **Replies:** 3\ **Last updated:** [August 22, 2016, 3:38pm UTC](https://discuss.elastic.co/t/not-able-to-consume-input-from-a-kafka-topic/58202 "2016-08-22T15:38:15Z")
Hi, I am running logstash 2.3.4. I have kafka- 0.9 as the broker. I also installed the logstash-kafka-input plugin using the matrix given on the github. 0.9 0.9 2.0.0 - 2.3.x 3.x.x using the following command: /o… --- ## [Logstash-output-elasticssearch on Windows cannot load Java class](https://discuss.elastic.co/t/logstash-output-elasticssearch-on-windows-cannot-load-java-class/55684)
**Author:** [@Erkan\_Aslanel](https://discuss.elastic.co/u/Erkan_Aslanel)\ **Replies:** 4\ **Last updated:** [August 22, 2016, 2:58pm UTC](https://discuss.elastic.co/t/logstash-output-elasticssearch-on-windows-cannot-load-java-class/55684 "2016-08-22T14:58:56Z")
I started to implement ELK on windows.I got error C:\\logstash\\logstash-2.3.4\\bin\>logstash -f logstash-simple.conf io/console not supported; tty will not be manipulated ←\[31mfetched an invalid config {:config=\>"input {… --- ## [Issue in parsing the file which has # character at the beginning of the line](https://discuss.elastic.co/t/issue-in-parsing-the-file-which-has-character-at-the-beginning-of-the-line/58486)
**Author:** [@kamesh](https://discuss.elastic.co/u/kamesh)\ **Replies:** 6\ **Last updated:** [August 22, 2016, 2:32pm UTC](https://discuss.elastic.co/t/issue-in-parsing-the-file-which-has-character-at-the-beginning-of-the-line/58486 "2016-08-22T14:32:44Z")
Hi All, I am new to logstash and recently started scripiting in logstash. we have a requirement where some logs files have # in the beginning of the line. Say \\ \ \ **Author:** [@Lucifer\_hbp](https://discuss.elastic.co/u/Lucifer_hbp)\ **Replies:** 2\ **Last updated:** [August 22, 2016, 1:29pm UTC](https://discuss.elastic.co/t/how-can-i-parse-one-field-further-into-different-fields-in-another-grok-pattern/58441 "2016-08-22T13:29:08Z") I have following match statement for an log event in which data2 field will be having some events repeated with similar pattern: match =\>\["message","%{GREEDYDATA:data}process id %{NUMBER:pid}%{GREEDYDATA:data1}BBBBBB%… --- ## [Converting MMM to MM in Logstash](https://discuss.elastic.co/t/converting-mmm-to-mm-in-logstash/58570)
**Author:** [@vvs14](https://discuss.elastic.co/u/vvs14)\ **Replies:** 3\ **Last updated:** [August 22, 2016, 12:08pm UTC](https://discuss.elastic.co/t/converting-mmm-to-mm-in-logstash/58570 "2016-08-22T12:08:47Z")
I have typical Apache logs as follows 10.240.135.132 - - \[22/Aug/2016:10:46:10 +0000\] "GET /v1/cc\_services/neutron\_controller HTTP/1.1" 200 729 "-" "python-requests/2.9.1" As the month is in MMM format, I would like … --- ## [Disappearing logs when using regex in grok match](https://discuss.elastic.co/t/disappearing-logs-when-using-regex-in-grok-match/58460)
**Author:** [@harrytewkesbury](https://discuss.elastic.co/u/harrytewkesbury)\ **Replies:** 3\ **Last updated:** [August 22, 2016, 11:38am UTC](https://discuss.elastic.co/t/disappearing-logs-when-using-regex-in-grok-match/58460 "2016-08-22T11:38:53Z")
Hi - I have a strange issue that I can't make heads or tails of. When I parse a log type for %{HTTPDATE} it works fine, but when I also want to add %{IPORHOST}, then the entire log never makes it to elasticsearch - I loo… --- ## [Logstash Output to SQL](https://discuss.elastic.co/t/logstash-output-to-sql/58558)
**Author:** [@gringo](https://discuss.elastic.co/u/gringo)\ **Replies:** 0\ **Last updated:** [August 22, 2016, 8:42am UTC](https://discuss.elastic.co/t/logstash-output-to-sql/58558 "2016-08-22T08:42:33Z")
Is there a best practice to send logstash output to SQL? --- ## [Email output @timestamp field as non UTC timezone?](https://discuss.elastic.co/t/email-output-timestamp-field-as-non-utc-timezone/58554)
**Author:** [@abcfy2](https://discuss.elastic.co/u/abcfy2)\ **Replies:** 2\ **Last updated:** [August 22, 2016, 8:29am UTC](https://discuss.elastic.co/t/email-output-timestamp-field-as-non-utc-timezone/58554 "2016-08-22T08:29:13Z")
Hi all: I'm using logstash email output for alerting, and everything works very well. The only question is that, how do I use non UTC timezone for my email body? Here is my config: output { if "email\_alert"… --- ## [Logstash: is it possible to save documents in memory?](https://discuss.elastic.co/t/logstash-is-it-possible-to-save-documents-in-memory/58477)
**Author:** [@sen](https://discuss.elastic.co/u/sen)\ **Replies:** 2\ **Last updated:** [August 22, 2016, 8:03am UTC](https://discuss.elastic.co/t/logstash-is-it-possible-to-save-documents-in-memory/58477 "2016-08-22T08:03:06Z")
Hello Folks, I am trying to save data in memory that I would be able to retrieve quickly in my filter part. Indeed, when i receive new documents i want to retrieve former documents related in order to compute some new … --- ## [Logstash HTTP(s) output not working](https://discuss.elastic.co/t/logstash-http-s-output-not-working/57900)
**Author:** [@venkaty](https://discuss.elastic.co/u/venkaty)\ **Replies:** 3\ **Last updated:** [August 22, 2016, 7:59am UTC](https://discuss.elastic.co/t/logstash-http-s-output-not-working/57900 "2016-08-22T07:59:42Z")
Hi, I downloaded latest logstash 2.3.4 and deployed on Windows machine with the following output configuration http { url =\> "https://127.0.0.1:443/collectionstats" http\_method =\> "post" … --- ## [Log duplicated in multiple indexes](https://discuss.elastic.co/t/log-duplicated-in-multiple-indexes/58341)
**Author:** [@Clement\_Ros](https://discuss.elastic.co/u/Clement_Ros)\ **Replies:** 11\ **Last updated:** [August 22, 2016, 7:41am UTC](https://discuss.elastic.co/t/log-duplicated-in-multiple-indexes/58341 "2016-08-22T07:41:31Z")
Hi, In my output section, i have multiple conditions. Each conditions alows me to route one type of log in the correct Elasticsearch indexe. This is my logstash output : \> output { \> if "nginx" in \[tags\]… --- ## [Elastic search indices, what variables are available?](https://discuss.elastic.co/t/elastic-search-indices-what-variables-are-available/58412)
**Author:** [@sjlongland](https://discuss.elastic.co/u/sjlongland)\ **Replies:** 4\ **Last updated:** [August 22, 2016, 6:23am UTC](https://discuss.elastic.co/t/elastic-search-indices-what-variables-are-available/58412 "2016-08-22T06:23:06Z")
Hi all, I've hunted high and low through the documentation (written; not all of us have the luxury of watching videos) for information on this. In short, I have a prototype monitoring system using the elk-docker contai… --- ## [Beats Input Plugin stops when Go client killed](https://discuss.elastic.co/t/beats-input-plugin-stops-when-go-client-killed/58537)
**Author:** [@FredPlex](https://discuss.elastic.co/u/FredPlex)\ **Replies:** 1\ **Last updated:** [August 21, 2016, 9:24pm UTC](https://discuss.elastic.co/t/beats-input-plugin-stops-when-go-client-killed/58537 "2016-08-21T21:24:25Z")
Hey folks... We have written a Go client that streams records to logstash the setup is as such: Go client written in go using https://github.com/elastic/go-lumber sending records to logstash:5044 logstash 2.3.4 … --- ## [Access nested fields in mutate filter](https://discuss.elastic.co/t/access-nested-fields-in-mutate-filter/58172)
**Author:** [@rudo](https://discuss.elastic.co/u/rudo)\ **Replies:** 4\ **Last updated:** [August 21, 2016, 10:24am UTC](https://discuss.elastic.co/t/access-nested-fields-in-mutate-filter/58172 "2016-08-21T10:24:26Z")
Hello, I would like to ask a question regarding accessing nested fields in logstash. There is "processes" object in my JSON which has nested field "Name". I would like to extract the field value from the nested objec… --- ## [Logstash v5 installing filter-multiline plugin](https://discuss.elastic.co/t/logstash-v5-installing-filter-multiline-plugin/58523)
**Author:** [@gilisade](https://discuss.elastic.co/u/gilisade)\ **Replies:** 2\ **Last updated:** [August 21, 2016, 8:59am UTC](https://discuss.elastic.co/t/logstash-v5-installing-filter-multiline-plugin/58523 "2016-08-21T08:59:21Z")
hi i'm trying on my Test environment tne new elastic stack v5 when updating logstash i got the error message that the logstash-filter-multiline plugin is not built-in any more i downloded from git-hub the plugin (manua… --- ## [Convert Ticks to @timestamp in logstash with Ruby-plugin](https://discuss.elastic.co/t/convert-ticks-to-timestamp-in-logstash-with-ruby-plugin/58457)
**Author:** [@cvanhalt](https://discuss.elastic.co/u/cvanhalt)\ **Replies:** 4\ **Last updated:** [August 20, 2016, 9:43pm UTC](https://discuss.elastic.co/t/convert-ticks-to-timestamp-in-logstash-with-ruby-plugin/58457 "2016-08-20T21:43:25Z")
I query every minute against a MSSQL Database with jdbc-plugin. In this Database my timestamp is stored in ticks. Field-name is lastupdate. Now I wanted to convert the lastupdate field to a timestamp-format and then over… --- ## [Grok pattern for java exceptions](https://discuss.elastic.co/t/grok-pattern-for-java-exceptions/58510)
**Author:** [@tpk543](https://discuss.elastic.co/u/tpk543)\ **Replies:** 1\ **Last updated:** [August 20, 2016, 8:27pm UTC](https://discuss.elastic.co/t/grok-pattern-for-java-exceptions/58510 "2016-08-20T20:27:15Z")
As the java exception doesn't log with timestamp. Could you help me on creating grok pattern for it? All the lines in my log file are similar but I want to parse the logs only when either STUCK or Outofmemory. Could you … --- ## [Logstash shcedule](https://discuss.elastic.co/t/logstash-shcedule/58483)
**Author:** [@vtangutoori](https://discuss.elastic.co/u/vtangutoori)\ **Replies:** 1\ **Last updated:** [August 19, 2016, 10:14pm UTC](https://discuss.elastic.co/t/logstash-shcedule/58483 "2016-08-19T22:14:49Z")
Hi , can we schedule LogStash config file to import data from SQL server every 10 min for one day? If so how can we do it? --- ## [Elasticsearch output Document missing exception 404](https://discuss.elastic.co/t/elasticsearch-output-document-missing-exception-404/42747)
**Author:** [@iomismo](https://discuss.elastic.co/u/iomismo)\ **Replies:** 5\ **Last updated:** [August 19, 2016, 7:29pm UTC](https://discuss.elastic.co/t/elasticsearch-output-document-missing-exception-404/42747 "2016-08-19T19:29:15Z")
Hi everyone! I am facing a problem with logstash and elasticsearch output plugin. Basically i want to index couchdb changes. Using this config: input { couchdb\_changes { db =\> "database" … --- ## [Can't install Logstash-codec-nmap](https://discuss.elastic.co/t/cant-install-logstash-codec-nmap/56280)
**Author:** [@timogoosen](https://discuss.elastic.co/u/timogoosen)\ **Replies:** 2\ **Last updated:** [August 19, 2016, 5:30pm UTC](https://discuss.elastic.co/t/cant-install-logstash-codec-nmap/56280 "2016-08-19T17:30:22Z")
I tried installing logstash-codec nmap see link: https://github.com/logstash-plugins/logstash-codec-nmap I've tried installing using bin/plugin and I've also tried installing it using gem and also tried installing it f… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1111) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1113)