# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1116 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1117 --- ## [Logstash conf file with not\_analyzed field](https://discuss.elastic.co/t/logstash-conf-file-with-not-analyzed-field/51902)
**Author:** [@chenbe2204](https://discuss.elastic.co/u/chenbe2204)\ **Replies:** 11\ **Last updated:** [August 12, 2016, 2:01pm UTC](https://discuss.elastic.co/t/logstash-conf-file-with-not-analyzed-field/51902 "2016-08-12T14:01:20Z")
Hi , I want to load my Json file to the Elasticsearch and add i need that one of the fields will be not\_analyzed This is my conf file: input { file{ path =\> \["/root/scripts/vdm-server\_10-4\_parasoft\_103.json"\] type =\> … --- ## [Parsing hostname](https://discuss.elastic.co/t/parsing-hostname/57924)
**Author:** [@rth](https://discuss.elastic.co/u/rth)\ **Replies:** 1\ **Last updated:** [August 12, 2016, 1:27pm UTC](https://discuss.elastic.co/t/parsing-hostname/57924 "2016-08-12T13:27:45Z")
Hello, I parse the hostname of the syslog source event with the following grok: grok { match =\> \[ "message", "%{SYSLOGTIMESTAMP:timestamp} %{SYSLOGHOST:hostname} %{GREEDYDATA:mess}" \] } It works well for hostname … --- ## [How to convert string to date in logstash](https://discuss.elastic.co/t/how-to-convert-string-to-date-in-logstash/57914)
**Author:** [@Ganesh2303](https://discuss.elastic.co/u/Ganesh2303)\ **Replies:** 1\ **Last updated:** [August 12, 2016, 11:24am UTC](https://discuss.elastic.co/t/how-to-convert-string-to-date-in-logstash/57914 "2016-08-12T11:24:00Z")
HI, I want to convert my string field into date field how could i perform that in logstash coding. --- ## [Date Filtering from a Text File](https://discuss.elastic.co/t/date-filtering-from-a-text-file/57895)
**Author:** [@ash.vaidya94](https://discuss.elastic.co/u/ash.vaidya94)\ **Replies:** 3\ **Last updated:** [August 12, 2016, 11:22am UTC](https://discuss.elastic.co/t/date-filtering-from-a-text-file/57895 "2016-08-12T11:22:29Z")
Hi, My text file reads something like - 03 Aug 2016 05:55:38,759|INFO |snjcprddex36|DataElt|||||03 Aug 2016 05:55:38,759|INFO |snjcprddex36|DataElt|||||OUT\_OF\_SCOPE Is there any way I can manually filter the date a… --- ## [Trying to start logstash in Azure - error](https://discuss.elastic.co/t/trying-to-start-logstash-in-azure-error/57889)
**Author:** [@kevwhelan](https://discuss.elastic.co/u/kevwhelan)\ **Replies:** 3\ **Last updated:** [August 12, 2016, 7:11am UTC](https://discuss.elastic.co/t/trying-to-start-logstash-in-azure-error/57889 "2016-08-12T07:11:55Z")
I am using your instructions to try and install the stack. Having got elasticsearch up and running, i am now trying to run logstash. I get the following error: kev@Kubuntu:~/logstash-2.3.1$ ./bin/logstash -f logstas… --- ## [Logstash 2.3.4, 2.3.3 service fails](https://discuss.elastic.co/t/logstash-2-3-4-2-3-3-service-fails/57890)
**Author:** [@imewish](https://discuss.elastic.co/u/imewish)\ **Replies:** 0\ **Last updated:** [August 12, 2016, 6:38am UTC](https://discuss.elastic.co/t/logstash-2-3-4-2-3-3-service-fails/57890 "2016-08-12T06:38:46Z")
Hi, I have tried to install logstash 2.3.4 with this cookbook(https://github.com/lusis/chef-logstash) with test kitchen and EC2. The installation went well but i couldn't see the logstash services running. And the th… --- ## [Logstash logrotation doesn't work properly](https://discuss.elastic.co/t/logstash-logrotation-doesnt-work-properly/57870)
**Author:** [@reallistic](https://discuss.elastic.co/u/reallistic)\ **Replies:** 1\ **Last updated:** [August 12, 2016, 5:42am UTC](https://discuss.elastic.co/t/logstash-logrotation-doesnt-work-properly/57870 "2016-08-12T05:42:25Z")
When attempting to do log rotation on logstash's logs I get weirdness due to the Null-bytes problem. I am using the following logrotate config: /var/log/logstash/\*.err /var/log/logstash/\*.log /var/log/logstash/\*.stdout… --- ## [File codec multiline issue](https://discuss.elastic.co/t/file-codec-multiline-issue/57752)
**Author:** [@whatever](https://discuss.elastic.co/u/whatever)\ **Replies:** 5\ **Last updated:** [August 12, 2016, 5:30am UTC](https://discuss.elastic.co/t/file-codec-multiline-issue/57752 "2016-08-12T05:30:37Z")
Hello, I am unable to get file codec multiline to send stacktraces as one line to elastic search. I have log files similar to the lines: 2016-07-26 09:05:44,090 INFO Request ...log4j Information... 2016-07-26 09:05:… --- ## [Kibana 4.5.4 tile map visualization](https://discuss.elastic.co/t/kibana-4-5-4-tile-map-visualization/57740)
**Author:** [@bishaka](https://discuss.elastic.co/u/bishaka)\ **Replies:** 2\ **Last updated:** [August 11, 2016, 1:26am UTC](https://discuss.elastic.co/t/kibana-4-5-4-tile-map-visualization/57740 "2016-08-11T01:26:44Z")
How do I configure Kibana to use the TileMap? I am using Kibana 4.5.4 My logstash config file is as follows geoip { source =\> "clientip" target =\> "geoip" database =\> "/etc/logstash/GeoLiteCity.dat" add\_field =\> … --- ## [Specific GROK filter for multi-line Postgresql log](https://discuss.elastic.co/t/specific-grok-filter-for-multi-line-postgresql-log/56286)
**Author:** [@111126](https://discuss.elastic.co/u/111126)\ **Replies:** 12\ **Last updated:** [August 11, 2016, 5:44pm UTC](https://discuss.elastic.co/t/specific-grok-filter-for-multi-line-postgresql-log/56286 "2016-08-11T17:44:57Z")
Hi All, I am having hard times trying to merge multi-line Postgresql logs with GROK into one Logstash event. My log file look like this: Jul 22 17:03:27 my.host example.com\[24977\]: \[137-1\] 2016-07-22 17:03:27.339 MSK … --- ## [Architecture for Logstash Setup in Azure](https://discuss.elastic.co/t/architecture-for-logstash-setup-in-azure/57747)
**Author:** [@brettbim](https://discuss.elastic.co/u/brettbim)\ **Replies:** 4\ **Last updated:** [August 11, 2016, 2:29pm UTC](https://discuss.elastic.co/t/architecture-for-logstash-setup-in-azure/57747 "2016-08-11T14:29:40Z")
I’m setting up a POC of ELK running on Azure and I’m trying to figure out an architecture that works for the POC but also may work for future uses. Right now I have ELK set up on a single Azure VM and I’m shipping a few… --- ## [Find the number between two dates using ruby](https://discuss.elastic.co/t/find-the-number-between-two-dates-using-ruby/57820)
**Author:** [@Ganesh2303](https://discuss.elastic.co/u/Ganesh2303)\ **Replies:** 7\ **Last updated:** [August 11, 2016, 1:59pm UTC](https://discuss.elastic.co/t/find-the-number-between-two-dates-using-ruby/57820 "2016-08-11T13:59:00Z")
HI, I want to find the days between to dates. I have written the code by using ruby in logstash but i didnt get the value. Can anyone help me to resolve it. field1:August 8th 2016, 03:52:35.000 field2:August 6th 2016, … --- ## [Grok regex ignore characters in named capture group](https://discuss.elastic.co/t/grok-regex-ignore-characters-in-named-capture-group/57719)
**Author:** [@Tyngd\_Punkt](https://discuss.elastic.co/u/Tyngd_Punkt)\ **Replies:** 2\ **Last updated:** [August 11, 2016, 12:10pm UTC](https://discuss.elastic.co/t/grok-regex-ignore-characters-in-named-capture-group/57719 "2016-08-11T12:10:45Z")
I have a row of data being sent to logstash. The row can contain several IP addresses. However one ip address is always prefixed with IPv4: and i want to only capture this IP address so i have created this Grok regex: m… --- ## [Sending logs with SSL/TLS from Logstash](https://discuss.elastic.co/t/sending-logs-with-ssl-tls-from-logstash/57779)
**Author:** [@ramongo](https://discuss.elastic.co/u/ramongo)\ **Replies:** 3\ **Last updated:** [August 11, 2016, 11:26am UTC](https://discuss.elastic.co/t/sending-logs-with-ssl-tls-from-logstash/57779 "2016-08-11T11:26:26Z")
Hi Specialists! I'm trying to send data from Logstash using SSL/TLS to a rsyslog server (it needs certificates). I read a lot of articles/posts/official docs/etc and couldn't found the way to accomplish this with Logstas… --- ## [IPv4 and IPv6](https://discuss.elastic.co/t/ipv4-and-ipv6/57795)
**Author:** [@Kevin\_Csuka](https://discuss.elastic.co/u/Kevin_Csuka)\ **Replies:** 0\ **Last updated:** [August 11, 2016, 10:34am UTC](https://discuss.elastic.co/t/ipv4-and-ipv6/57795 "2016-08-11T10:34:35Z")
Hi, Scenario: The input i'm receiving in Logstash is sometimes IPv4 and sometimes IPv6, on the same column. It differs sometimes from time to time. Right now, I have an IPv4 GROK pattern. Problem: When an IPv6 addres… --- ## [\[SOLVED\] Logstash logging in JSON format](https://discuss.elastic.co/t/solved-logstash-logging-in-json-format/57736)
**Author:** [@hartfordfive](https://discuss.elastic.co/u/hartfordfive)\ **Replies:** 2\ **Last updated:** [August 11, 2016, 7:34am UTC](https://discuss.elastic.co/t/solved-logstash-logging-in-json-format/57736 "2016-08-11T07:34:35Z")
Currently, Logstash application logs are in Ruby debug format although I'd like to have them in JSON format instead. From what I can see, this isn't currently possible, although could this be added as potential feature? … --- ## [Filebeat shipped json file : how to get needed fields?](https://discuss.elastic.co/t/filebeat-shipped-json-file-how-to-get-needed-fields/57702)
**Author:** [@pramesh1](https://discuss.elastic.co/u/pramesh1)\ **Replies:** 1\ **Last updated:** [August 11, 2016, 5:55am UTC](https://discuss.elastic.co/t/filebeat-shipped-json-file-how-to-get-needed-fields/57702 "2016-08-11T05:55:56Z")
i am running some program that generate output in json format. i want to push that elasticsearch and get analysed by kibana. i want to make graph in kibana of tests Vs time and total fail and success. my json file… --- ## [Logstah JVM](https://discuss.elastic.co/t/logstah-jvm/57709)
**Author:** [@Nizar\_Khalifa](https://discuss.elastic.co/u/Nizar_Khalifa)\ **Replies:** 2\ **Last updated:** [August 10, 2016, 9:05pm UTC](https://discuss.elastic.co/t/logstah-jvm/57709 "2016-08-10T21:05:05Z")
Hello, How can i set the xmx variable for logstash ? I tried to uncomment LS\_HEAP\_SIZE="1g" in /etc/default/logstash file but it doesn't work. Any help please ? Best regards. Nizar. --- ## [Logstash Indexer High Availability](https://discuss.elastic.co/t/logstash-indexer-high-availability/57701)
**Author:** [@harrytewkesbury](https://discuss.elastic.co/u/harrytewkesbury)\ **Replies:** 1\ **Last updated:** [August 10, 2016, 8:58pm UTC](https://discuss.elastic.co/t/logstash-indexer-high-availability/57701 "2016-08-10T20:58:50Z")
Hi, I have seen a few older solutions for HA with logstash, and wonder if they hold true still. The official documentation on scaling up logstash (Deploying and Scaling Logstash | Logstash Reference \[8.11\] | Elastic) sh… --- ## [Logstash unable to connect to Elasticsearch over https](https://discuss.elastic.co/t/logstash-unable-to-connect-to-elasticsearch-over-https/56105)
**Author:** [@prabhakar349](https://discuss.elastic.co/u/prabhakar349)\ **Replies:** 4\ **Last updated:** [August 10, 2016, 8:15pm UTC](https://discuss.elastic.co/t/logstash-unable-to-connect-to-elasticsearch-over-https/56105 "2016-08-10T20:15:32Z")
HI All , We are trying to connect to elastic serach server from logstash, but it throws following error even after specifying the path to certificate , we have tried giving We first tried using the following : tru… --- ## [Viewing Logstash logger output](https://discuss.elastic.co/t/viewing-logstash-logger-output/57144)
**Author:** [@3ygun](https://discuss.elastic.co/u/3ygun)\ **Replies:** 4\ **Last updated:** [August 10, 2016, 5:12pm UTC](https://discuss.elastic.co/t/viewing-logstash-logger-output/57144 "2016-08-10T17:12:27Z")
Could anyone direct me to where I can see the logger.warn statements (specifically the one on line 79 of split) I've tried looking at the file generated by: bin/logstash --verbose --log log.txt -f PATH\_TO\_FILE.con… --- ## [Quick question. Logstash Multiple output to ES](https://discuss.elastic.co/t/quick-question-logstash-multiple-output-to-es/57521)
**Author:** [@gh0stid](https://discuss.elastic.co/u/gh0stid)\ **Replies:** 3\ **Last updated:** [August 10, 2016, 4:33pm UTC](https://discuss.elastic.co/t/quick-question-logstash-multiple-output-to-es/57521 "2016-08-10T16:33:48Z")
Hello, once again, its me ! ( yeah .. i know .. ) anyway! I would like to know how would someone succeed in re-indexing to a second index only part of the "logs" that match XY filter. lemme give you an exemple... … --- ## [What pattern applies for log4j2 configuration of %d{DEFAULT}{UTC}](https://discuss.elastic.co/t/what-pattern-applies-for-log4j2-configuration-of-d-default-utc/57722)
**Author:** [@sundud](https://discuss.elastic.co/u/sundud)\ **Replies:** 0\ **Last updated:** [August 10, 2016, 4:15pm UTC](https://discuss.elastic.co/t/what-pattern-applies-for-log4j2-configuration-of-d-default-utc/57722 "2016-08-10T16:15:21Z")
My log4j2.xml has PatternLayout like this: \[%d{DEFAULT}{UTC}\] .. resulting in \[2016-08-08 22:24:58,668\].. What pattern would be used in codec \> pattern grok \> match \> message Sorry if this is a RTFM question … --- ## [Multiple Elasticsearch documents in Logstash output](https://discuss.elastic.co/t/multiple-elasticsearch-documents-in-logstash-output/57638)
**Author:** [@rpazhyannur](https://discuss.elastic.co/u/rpazhyannur)\ **Replies:** 2\ **Last updated:** [August 10, 2016, 3:37pm UTC](https://discuss.elastic.co/t/multiple-elasticsearch-documents-in-logstash-output/57638 "2016-08-10T15:37:22Z")
I am receiving a JSON object via HTTP Poller and I need to split it up and write into the multiple documents in Elasticsearch. For example, what I get from HTTP poller is something like this { bank:\[ { id: 100, … --- ## [Logstash callback](https://discuss.elastic.co/t/logstash-callback/57653)
**Author:** [@k007](https://discuss.elastic.co/u/k007)\ **Replies:** 11\ **Last updated:** [August 10, 2016, 2:20pm UTC](https://discuss.elastic.co/t/logstash-callback/57653 "2016-08-10T14:20:02Z")
Hi, I am using UDP input plugin to listen data . Now i want to send acknowledgment to remote end point from which i have received data on upd port. How can i achieve this using logstash? --- ## [Logstash exec input timeout](https://discuss.elastic.co/t/logstash-exec-input-timeout/57374)
**Author:** [@vinnyoodles](https://discuss.elastic.co/u/vinnyoodles)\ **Replies:** 3\ **Last updated:** [August 10, 2016, 2:16pm UTC](https://discuss.elastic.co/t/logstash-exec-input-timeout/57374 "2016-08-10T14:16:57Z")
I'm getting this error with the exec input for logstash. It's pretty sporadic when the error comes up. For example, it'll timeout once in about every 10 executions. Is there anyway I can kill any commands that are taking… --- ## [Logstash parsing syslog](https://discuss.elastic.co/t/logstash-parsing-syslog/57686)
**Author:** [@rth](https://discuss.elastic.co/u/rth)\ **Replies:** 7\ **Last updated:** [August 10, 2016, 12:45pm UTC](https://discuss.elastic.co/t/logstash-parsing-syslog/57686 "2016-08-10T12:45:29Z")
Hello all, I have a syslog server and the ELK stack on the same server. I create a directory for each syslog source. I'm trying to parse syslog events with Logstash, and I'd like to keep the ip adress of the syslog sou… --- ## [Attempted to send a bulk request to Elasticsearch configured at](https://discuss.elastic.co/t/attempted-to-send-a-bulk-request-to-elasticsearch-configured-at/57671)
**Author:** [@bujar\_metaj](https://discuss.elastic.co/u/bujar_metaj)\ **Replies:** 11\ **Last updated:** [August 10, 2016, 12:31pm UTC](https://discuss.elastic.co/t/attempted-to-send-a-bulk-request-to-elasticsearch-configured-at/57671 "2016-08-10T12:31:11Z")
hi I have an issue with logstash -\>searchguard (elasticserach) ? works fine without searchguard output { elasticsearch { manage\_template =\> false index =\> "%{\[@metadata\]\[beat\]}-%{+YYYY.MM.dd}" doc… --- ## [How to read the file from linux machine in logstash](https://discuss.elastic.co/t/how-to-read-the-file-from-linux-machine-in-logstash/57691)
**Author:** [@AnantPatil](https://discuss.elastic.co/u/AnantPatil)\ **Replies:** 3\ **Last updated:** [August 10, 2016, 12:16pm UTC](https://discuss.elastic.co/t/how-to-read-the-file-from-linux-machine-in-logstash/57691 "2016-08-10T12:16:48Z")
For reading the file from window machine I am using the following input filter and able to read the file from remote machine and writing to elasticsearch similarly I want to read the file from linux machine. input { fi… --- ## [Formatting dates in logstash.conf](https://discuss.elastic.co/t/formatting-dates-in-logstash-conf/57337)
**Author:** [@dlastIDBS](https://discuss.elastic.co/u/dlastIDBS)\ **Replies:** 7\ **Last updated:** [August 10, 2016, 10:28am UTC](https://discuss.elastic.co/t/formatting-dates-in-logstash-conf/57337 "2016-08-10T10:28:16Z")
Hi, I am trying to import historical data into elastic and having issues getting the dates to be accepted so I can use them as @timestamp for histograms and the like. First I am creating the index by doing a PUT requ… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1115) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1117)