# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1117 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1118 --- ## [How to parse this date pattern](https://discuss.elastic.co/t/how-to-parse-this-date-pattern/57491)
**Author:** [@Fred\_Dionisio](https://discuss.elastic.co/u/Fred_Dionisio)\ **Replies:** 2\ **Last updated:** [August 10, 2016, 9:57am UTC](https://discuss.elastic.co/t/how-to-parse-this-date-pattern/57491 "2016-08-10T09:57:41Z")
I've the following XML \ \2016-08-08T13:40:00.000+01:00\ \ and inside the filter, have the multiline plugin and the xml as followed: xml { source =\> "… --- ## [Help this case with logstash.conf](https://discuss.elastic.co/t/help-this-case-with-logstash-conf/57677)
**Author:** [@Inbeo\_Beo](https://discuss.elastic.co/u/Inbeo_Beo)\ **Replies:** 1\ **Last updated:** [August 10, 2016, 9:46am UTC](https://discuss.elastic.co/t/help-this-case-with-logstash-conf/57677 "2016-08-10T09:46:03Z")
dear i have 01 logstash config file with code below input { tcp { host =\> "10.151.130.121" port =\> "514" type =\> "rsyslog" } udp { host =\> "10.151.130.121" port =\> … --- ## [String to date time](https://discuss.elastic.co/t/string-to-date-time/57656)
**Author:** [@vandana\_sethi](https://discuss.elastic.co/u/vandana_sethi)\ **Replies:** 9\ **Last updated:** [August 10, 2016, 9:06am UTC](https://discuss.elastic.co/t/string-to-date-time/57656 "2016-08-10T09:06:53Z")
My log pattern is as |other|test|test1|20160808134300 i have chopped these pipe separated value in different fields and have fields like field0 = other field1 = test field2 = test1 field3 = 20160808134300 field… --- ## [Logstash tc handler not updated when crash (JBOSS handler)](https://discuss.elastic.co/t/logstash-tc-handler-not-updated-when-crash-jboss-handler/57224)
**Author:** [@fdlprod](https://discuss.elastic.co/u/fdlprod)\ **Replies:** 1\ **Last updated:** [August 10, 2016, 7:19am UTC](https://discuss.elastic.co/t/logstash-tc-handler-not-updated-when-crash-jboss-handler/57224 "2016-08-10T07:19:34Z")
I had a logstash handler on 2 wildlfy servers i had one ELK on another server if logstash crash, then i restart it i take not anymore logs, i have to restart the wildfly (jboss server) version 2.3.3 of logstash and… --- ## [Compare two fields in logstash](https://discuss.elastic.co/t/compare-two-fields-in-logstash/57506)
**Author:** [@niraj\_kumar](https://discuss.elastic.co/u/niraj_kumar)\ **Replies:** 4\ **Last updated:** [August 10, 2016, 6:33am UTC](https://discuss.elastic.co/t/compare-two-fields-in-logstash/57506 "2016-08-10T06:33:15Z")
Guys, Is it possible to compare two fields in logstash and create a new field out of it. I have a AWS S3 logs where the bytes downloaded is sometimes not equal to the actual file downloaded. So what i am trying to find… --- ## [Logstash consuming CPU usage over 100%](https://discuss.elastic.co/t/logstash-consuming-cpu-usage-over-100/57084)
**Author:** [@YuWatanabe](https://discuss.elastic.co/u/YuWatanabe)\ **Replies:** 10\ **Last updated:** [August 10, 2016, 6:12am UTC](https://discuss.elastic.co/t/logstash-consuming-cpu-usage-over-100/57084 "2016-08-10T06:12:03Z")
Hi! I would like ask question about logstash plugin. I am now using logstash but looks like it is consuming high CPU usage. Below is part of lines from my config. input { file { path =\> \["/var/log/logstash/da… --- ## [How to parse nested json](https://discuss.elastic.co/t/how-to-parse-nested-json/57505)
**Author:** [@eladio](https://discuss.elastic.co/u/eladio)\ **Replies:** 1\ **Last updated:** [August 10, 2016, 5:51am UTC](https://discuss.elastic.co/t/how-to-parse-nested-json/57505 "2016-08-10T05:51:32Z")
this is my json {"objId":"5586560001","id":"48013895","ts":"2016-03-08 14:45:05.799888","type":"001","comp":"DVD","message":"{\\"id\_Ext\\":\\"5586560001\\",\\"id\\":\\"001099223100316 12\\",\\"entryContainerID\\":\\"1\\",\\"moveme… --- ## [Using Arrays in Logstash](https://discuss.elastic.co/t/using-arrays-in-logstash/57434)
**Author:** [@elad\_sheinfeld](https://discuss.elastic.co/u/elad_sheinfeld)\ **Replies:** 1\ **Last updated:** [August 10, 2016, 5:49am UTC](https://discuss.elastic.co/t/using-arrays-in-logstash/57434 "2016-08-10T05:49:09Z")
Hi All, I've got a field which represents a list of destinations, represented by a decimal values I now need to "translate" each of those destinations to their IP equivalent. I'm trying to use the following code: ruby … --- ## [Issue when sending email alert on some particular event using gmail smtp server](https://discuss.elastic.co/t/issue-when-sending-email-alert-on-some-particular-event-using-gmail-smtp-server/57306)
**Author:** [@r1kumar](https://discuss.elastic.co/u/r1kumar)\ **Replies:** 2\ **Last updated:** [August 10, 2016, 4:32am UTC](https://discuss.elastic.co/t/issue-when-sending-email-alert-on-some-particular-event-using-gmail-smtp-server/57306 "2016-08-10T04:32:27Z")
Hi, I am facing problem when trying to send email alert on particular event using gmail smtp, Below is my email configuration inside output block following exception. output { email { port =\> 58… --- ## [ELK Pipeline error](https://discuss.elastic.co/t/elk-pipeline-error/57631)
**Author:** [@Kenpachi429](https://discuss.elastic.co/u/Kenpachi429)\ **Replies:** 0\ **Last updated:** [August 9, 2016, 9:25pm UTC](https://discuss.elastic.co/t/elk-pipeline-error/57631 "2016-08-09T21:25:31Z")
Hi Guys, I am fairly new to Linux and New to ELK. I followed the guide outlined here : https://www.digitalocean.com/community/tutorials/how-to-install-elasticsearch-logstash-and-kibana-elk-stack-on-centos-7 I added… --- ## [No response after "Pipeline main started"](https://discuss.elastic.co/t/no-response-after-pipeline-main-started/57167)
**Author:** [@nikdgl](https://discuss.elastic.co/u/nikdgl)\ **Replies:** 2\ **Last updated:** [August 9, 2016, 6:26pm UTC](https://discuss.elastic.co/t/no-response-after-pipeline-main-started/57167 "2016-08-09T18:26:57Z")
Hi All, We are unable to get Logstash to respond after feeding an analysis file to it. This file and the syntax used by us seems alright since we are getting a "Configuration OK!" message in the configuration tester. Y… --- ## [BOSH deployment manifest "logsearch-boshrelease"](https://discuss.elastic.co/t/bosh-deployment-manifest-logsearch-boshrelease/57604)
**Author:** [@Aljaz\_Gantar](https://discuss.elastic.co/u/Aljaz_Gantar)\ **Replies:** 1\ **Last updated:** [August 9, 2016, 2:44pm UTC](https://discuss.elastic.co/t/bosh-deployment-manifest-logsearch-boshrelease/57604 "2016-08-09T14:44:26Z")
I wanted to deploy ELK stack with BOSH on my AWS CloudFoundry environment from the following repository: https://github.com/logsearch/logsearch-boshrelease/tree/v203.0.0 but I get the following error: "Error 100: Missi… --- ## [Retry handler JBOSS server on TCP port remote hos](https://discuss.elastic.co/t/retry-handler-jboss-server-on-tcp-port-remote-hos/57312)
**Author:** [@fdlprod](https://discuss.elastic.co/u/fdlprod)\ **Replies:** 2\ **Last updated:** [August 9, 2016, 9:35am UTC](https://discuss.elastic.co/t/retry-handler-jboss-server-on-tcp-port-remote-hos/57312 "2016-08-09T09:35:09Z")
HI, i have one big issue, indeed, i have one ELK on 1 standalone host (A).... Then i have 2 jboss (wildfly) cluster different hosts (B,C) and for each one one logstash handler which send on remote host logstash liste… --- ## [Writing And Reading Compressed Data to/from Kinesis Stream](https://discuss.elastic.co/t/writing-and-reading-compressed-data-to-from-kinesis-stream/57560)
**Author:** [@Saman](https://discuss.elastic.co/u/Saman)\ **Replies:** 0\ **Last updated:** [August 9, 2016, 7:44am UTC](https://discuss.elastic.co/t/writing-and-reading-compressed-data-to-from-kinesis-stream/57560 "2016-08-09T07:44:42Z")
I am using EC2 Instance(Linux) and Logstash v2.3.4 . Logstash does not support directly writing compressed data to kinesis stream.One of the updates to input configuration that I have made is to read input data from S3 … --- ## [\_rubyexception when accessing ‘event’ array in ruby code](https://discuss.elastic.co/t/-rubyexception-when-accessing-event-array-in-ruby-code/57553)
**Author:** [@k007](https://discuss.elastic.co/u/k007)\ **Replies:** 1\ **Last updated:** [August 9, 2016, 8:45am UTC](https://discuss.elastic.co/t/-rubyexception-when-accessing-event-array-in-ruby-code/57553 "2016-08-09T08:45:08Z")
Hello , I am trying to use below code in logstash 5 but getting \_rubyexception. code =\> "event\['dest-field'\] = event\['message'\]\[0..1\]" --- ## [How to read logs from a UNIX\\LINUX box](https://discuss.elastic.co/t/how-to-read-logs-from-a-unix-linux-box/57416)
**Author:** [@vk126y](https://discuss.elastic.co/u/vk126y)\ **Replies:** 2\ **Last updated:** [August 9, 2016, 8:04am UTC](https://discuss.elastic.co/t/how-to-read-logs-from-a-unix-linux-box/57416 "2016-08-09T08:04:53Z")
In my application I am supposed to read the logs from a UNIX or LINUX box and my ELK stack is running on my local Windows 8 Machine. I have my username and password for the UNIX\\LINUX box but how can I put this informati… --- ## [Logstash only listens on IPv6 port](https://discuss.elastic.co/t/logstash-only-listens-on-ipv6-port/57507)
**Author:** [@Lonck](https://discuss.elastic.co/u/Lonck)\ **Replies:** 1\ **Last updated:** [August 9, 2016, 2:51am UTC](https://discuss.elastic.co/t/logstash-only-listens-on-ipv6-port/57507 "2016-08-09T02:51:14Z")
Hi for All, I installed the Elastic Stack in Debian 8.5 by repositories.The Logstash do not listen on udp port setting in the conf file (port =\> 9878) for IPv4, but IPv6 only. I found the solution to fix the problem (JAV… --- ## [\_rubyexception when accessing 'event' array in ruby code](https://discuss.elastic.co/t/-rubyexception-when-accessing-event-array-in-ruby-code/57071)
**Author:** [@YuWatanabe](https://discuss.elastic.co/u/YuWatanabe)\ **Replies:** 2\ **Last updated:** [August 9, 2016, 1:02am UTC](https://discuss.elastic.co/t/-rubyexception-when-accessing-event-array-in-ruby-code/57071 "2016-08-09T01:02:50Z")
Hi! I would like to get help with the code in ruby filter. logstash version is 5.0.0 alpha4. I am testing the code in ruby filter as below but I am getting \_rubyexception. ruby { code =\> " event\['new… --- ## [Custom plugin installed fails to start logstash](https://discuss.elastic.co/t/custom-plugin-installed-fails-to-start-logstash/38505)
**Author:** [@vinod8427](https://discuss.elastic.co/u/vinod8427)\ **Replies:** 1\ **Last updated:** [August 9, 2016, 12:36am UTC](https://discuss.elastic.co/t/custom-plugin-installed-fails-to-start-logstash/38505 "2016-08-09T00:36:26Z")
I have developed a custom logstash output plugin for cassandra. Gem gets built successfully and plugin gets installed successfully too. However When I start the logstash, it crashes with the below message: :message=\>"… --- ## [Trying to load Configuration file this error has arrives in Logstash-5.0.0-alpha-4 CMD on windows](https://discuss.elastic.co/t/trying-to-load-configuration-file-this-error-has-arrives-in-logstash-5-0-0-alpha-4-cmd-on-windows/57406)
**Author:** [@Danyal-Javeed](https://discuss.elastic.co/u/Danyal-Javeed)\ **Replies:** 19\ **Last updated:** [August 8, 2016, 10:17pm UTC](https://discuss.elastic.co/t/trying-to-load-configuration-file-this-error-has-arrives-in-logstash-5-0-0-alpha-4-cmd-on-windows/57406 "2016-08-08T22:17:45Z")
C:\\logstash-5.0.0-alpha4\>bin\\logstash agent -f logstash.conf --- jar coordinate com.fasterxml.jackson.core:jackson-annotations already loaded with version 2.7.1 - omit version 2.7.0 --- jar coordinate com.fasterxml.jacks… --- ## [JDBC Connection from Linux to SQL Server db](https://discuss.elastic.co/t/jdbc-connection-from-linux-to-sql-server-db/57527)
**Author:** [@lolhypocrisy](https://discuss.elastic.co/u/lolhypocrisy)\ **Replies:** 0\ **Last updated:** [August 8, 2016, 8:50pm UTC](https://discuss.elastic.co/t/jdbc-connection-from-linux-to-sql-server-db/57527 "2016-08-08T20:50:38Z")
I'm trying to connect to a SQL Server database using a JDBC connection from Logstash installed on a Linux server. I'm running into issues with the security portion of it. This is my current connection string: jdbc\_conn… --- ## [Http\_request\_failure when trying to get logs with http\_poller plugin logstash](https://discuss.elastic.co/t/http-request-failure-when-trying-to-get-logs-with-http-poller-plugin-logstash/57134)
**Author:** [@bishaka](https://discuss.elastic.co/u/bishaka)\ **Replies:** 9\ **Last updated:** [August 8, 2016, 8:09pm UTC](https://discuss.elastic.co/t/http-request-failure-when-trying-to-get-logs-with-http-poller-plugin-logstash/57134 "2016-08-08T20:09:56Z")
Hi, I want to fetch JSON formatted logs from a URL. What is the best approach to do it? I tried the http\_poller plugin..but I am not sure if it doesn't work or i am doing something wrong. Can you please help? I tried u… --- ## [Logstash - too many loopback tcp connections in time\_wait state](https://discuss.elastic.co/t/logstash-too-many-loopback-tcp-connections-in-time-wait-state/57309)
**Author:** [@venkaty](https://discuss.elastic.co/u/venkaty)\ **Replies:** 3\ **Last updated:** [August 8, 2016, 3:47pm UTC](https://discuss.elastic.co/t/logstash-too-many-loopback-tcp-connections-in-time-wait-state/57309 "2016-08-08T15:47:34Z")
Hi, Too many loopback connections in time\_wait state when logstash started from windows console. TCP 127.0.0.1:61227 HYD-ARCH-08:61228 TIME\_WAIT 0 TCP 127.0.0.1:61234 HYD-ARCH-08:61… --- ## [Field name cannot contain '.'](https://discuss.elastic.co/t/field-name-cannot-contain/33251)
**Author:** [@radu.stefanache](https://discuss.elastic.co/u/radu.stefanache)\ **Replies:** 46\ **Last updated:** [August 4, 2016, 4:31pm UTC](https://discuss.elastic.co/t/field-name-cannot-contain/33251 "2016-08-04T16:31:15Z")
Hello everyone, today I've upgraded to ELK 2.0 and did some tests . I am currently parsing a line that looks like this : key=value&key=value&key=value Obviously I am using the kv filter . There is one issue though,… --- ## [Extracting the content from Facebook and Linkedin](https://discuss.elastic.co/t/extracting-the-content-from-facebook-and-linkedin/57444)
**Author:** [@mruthyu](https://discuss.elastic.co/u/mruthyu)\ **Replies:** 1\ **Last updated:** [August 8, 2016, 6:26am UTC](https://discuss.elastic.co/t/extracting-the-content-from-facebook-and-linkedin/57444 "2016-08-08T06:26:24Z")
How to extract the content from Facebook and Linkedin using logstash? Whether using http\_poller input plugin is a viable solution? --- ## [Logstash Parsing Error for Field which contains Spaces](https://discuss.elastic.co/t/logstash-parsing-error-for-field-which-contains-spaces/57083)
**Author:** [@rathna](https://discuss.elastic.co/u/rathna)\ **Replies:** 4\ **Last updated:** [August 8, 2016, 4:53am UTC](https://discuss.elastic.co/t/logstash-parsing-error-for-field-which-contains-spaces/57083 "2016-08-08T04:53:23Z")
Hi I am trying to parse the below log line by mutating the pipe symbol with space. However some time there are few field value contains some spaces in between(The last field in the example given below) and after parsi… --- ## [Winlogbeat to Logstash to Elasticsearch error](https://discuss.elastic.co/t/winlogbeat-to-logstash-to-elasticsearch-error/57432)
**Author:** [@theflakes](https://discuss.elastic.co/u/theflakes)\ **Replies:** 1\ **Last updated:** [August 7, 2016, 10:19pm UTC](https://discuss.elastic.co/t/winlogbeat-to-logstash-to-elasticsearch-error/57432 "2016-08-07T22:19:35Z")
I have a Win2012 R2 Server sending logs to to logstash via Winlogbeat. I see the logs in the logstash.log file but each gets the below error. :response=\>{"index"=\>{"index"=\>"winlogbeat-2016.08.07", "type"=\>"wineventlo… --- ## [Logstash going OOM - help confirming issue](https://discuss.elastic.co/t/logstash-going-oom-help-confirming-issue/56902)
**Author:** [@David\_McClain](https://discuss.elastic.co/u/David_McClain)\ **Replies:** 19\ **Last updated:** [August 7, 2016, 2:33pm UTC](https://discuss.elastic.co/t/logstash-going-oom-help-confirming-issue/56902 "2016-08-07T14:33:52Z")
I've recently begun having problems where logstash continues to go out of memory a few seconds (or maybe a minute) after startup. I have an idea of what may be happening, but I'm hoping that some of the more seasoned pro… --- ## [Logstash JSON parser error](https://discuss.elastic.co/t/logstash-json-parser-error/57412)
**Author:** [@elssar](https://discuss.elastic.co/u/elssar)\ **Replies:** 1\ **Last updated:** [August 7, 2016, 9:35am UTC](https://discuss.elastic.co/t/logstash-json-parser-error/57412 "2016-08-07T09:35:16Z")
My logs are full of this one particular error - exception=\>#\, :level=\>:warn} I checked the message, it is va… --- ## [When trying to load Configuration file this error is coming in Logstash CMD on windows](https://discuss.elastic.co/t/when-trying-to-load-configuration-file-this-error-is-coming-in-logstash-cmd-on-windows/57405)
**Author:** [@Danyal-Javeed](https://discuss.elastic.co/u/Danyal-Javeed)\ **Replies:** 1\ **Last updated:** [August 6, 2016, 11:09pm UTC](https://discuss.elastic.co/t/when-trying-to-load-configuration-file-this-error-is-coming-in-logstash-cmd-on-windows/57405 "2016-08-06T23:09:31Z")
C:\\logstash-2.3.4\>bin\\logstash agent -f logstash.conf io/console not supported; tty will not be manipulated Settings: Default pipeline workers: 4 Pipeline aborted due to error {:exception=\>#, :backtrace=\>\["C:/logstash-2.… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1116) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1118)