# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1120 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1121 --- ## [What command logstash uses to read log files?](https://discuss.elastic.co/t/what-command-logstash-uses-to-read-log-files/57061)
**Author:** [@yusuf77](https://discuss.elastic.co/u/yusuf77)\ **Replies:** 0\ **Last updated:** [August 2, 2016, 11:02pm UTC](https://discuss.elastic.co/t/what-command-logstash-uses-to-read-log-files/57061 "2016-08-02T23:02:42Z")
We have logfiles that has permissions 600 (only owner can read and not readable by group or everyone). The permission "600" is set by automated scripts and cannot be changed in our setup. Logstash forwarder can forward l… --- ## [Conf file issues](https://discuss.elastic.co/t/conf-file-issues/57035)
**Author:** [@Zesix](https://discuss.elastic.co/u/Zesix)\ **Replies:** 1\ **Last updated:** [August 2, 2016, 10:42pm UTC](https://discuss.elastic.co/t/conf-file-issues/57035 "2016-08-02T22:42:44Z")
\# This conf is for PISC logs. input { beats { stdin { codec =\> multiline { pattern =\> "^\\s" what =\> "previous" } } codec =\> multiline { … --- ## [Rsync changing inode numbers causing multiple imports](https://discuss.elastic.co/t/rsync-changing-inode-numbers-causing-multiple-imports/26939)
**Author:** [@jason\_wilson](https://discuss.elastic.co/u/jason_wilson)\ **Replies:** 2\ **Last updated:** [August 2, 2016, 8:44pm UTC](https://discuss.elastic.co/t/rsync-changing-inode-numbers-causing-multiple-imports/26939 "2016-08-02T20:44:21Z")
Hi All, Fairly new to the whole ELK stack and running into an issue. To test things out I am rsync'ing a bunch of logs from various Windows IIS servers back to my host running the ELK software. Things are working f… --- ## [Updating Start Event Using Elapsed Plugin After Stop Event Received](https://discuss.elastic.co/t/updating-start-event-using-elapsed-plugin-after-stop-event-received/57051)
**Author:** [@camiller](https://discuss.elastic.co/u/camiller)\ **Replies:** 0\ **Last updated:** [August 2, 2016, 8:07pm UTC](https://discuss.elastic.co/t/updating-start-event-using-elapsed-plugin-after-stop-event-received/57051 "2016-08-02T20:07:19Z")
Hi, I am using the elapsed plugin to calculate the elapsed time between start and stop events. I am interested in visualizing start events that are currently running (do not yet have stop events). I have not been able… --- ## [Logstash-input-rss undefined method author](https://discuss.elastic.co/t/logstash-input-rss-undefined-method-author/56916)
**Author:** [@John\_McAfee](https://discuss.elastic.co/u/John_McAfee)\ **Replies:** 3\ **Last updated:** [August 2, 2016, 6:03pm UTC](https://discuss.elastic.co/t/logstash-input-rss-undefined-method-author/56916 "2016-08-02T18:03:04Z")
I am using logstash 2.3.4 with the rss plugin. My config file is as follows: input { rss { interval =\> 600 url =\> "http://advances.sciencemag.org/rss/current.xml" } } When I … --- ## [Read/Match Data](https://discuss.elastic.co/t/read-match-data/56962)
**Author:** [@Kishore](https://discuss.elastic.co/u/Kishore)\ **Replies:** 4\ **Last updated:** [August 2, 2016, 4:51pm UTC](https://discuss.elastic.co/t/read-match-data/56962 "2016-08-02T16:51:21Z")
Hi Elastic, I want to match IP address from below type of data with field, i tried Translate filter but it is not supporting for .txt format, Kindly help me to fix this. I am downloading this from URL, using http\_po… --- ## [Txt data parsing Issue](https://discuss.elastic.co/t/txt-data-parsing-issue/57038)
**Author:** [@Kishore](https://discuss.elastic.co/u/Kishore)\ **Replies:** 0\ **Last updated:** [August 2, 2016, 4:31pm UTC](https://discuss.elastic.co/t/txt-data-parsing-issue/57038 "2016-08-02T16:31:10Z")
I am trying to parse below data from txt file, i can able to parse the data in Grok debugger but not able to get the same result using logstash. Data: 185.93.185.235 219.151.8.160 93.174.93.136 no-reverse-dns-conf… --- ## [Grok Parse Failure](https://discuss.elastic.co/t/grok-parse-failure/56775)
**Author:** [@Sully1](https://discuss.elastic.co/u/Sully1)\ **Replies:** 2\ **Last updated:** [August 2, 2016, 4:13pm UTC](https://discuss.elastic.co/t/grok-parse-failure/56775 "2016-08-02T16:13:45Z")
Hello Logstash Community! I'm having trouble parsing my logs in Kibana. The logs are being sent to log stash (file beat) just fine. Additionally, the grok patterns/filters are showing up in Kibana (settings--Indicies).… --- ## [CSV-Filter fails converting Strings to Integer with greater value than 10](https://discuss.elastic.co/t/csv-filter-fails-converting-strings-to-integer-with-greater-value-than-10/57032)
**Author:** [@marv](https://discuss.elastic.co/u/marv)\ **Replies:** 0\ **Last updated:** [August 2, 2016, 4:04pm UTC](https://discuss.elastic.co/t/csv-filter-fails-converting-strings-to-integer-with-greater-value-than-10/57032 "2016-08-02T16:04:48Z")
Hi Guys, I have a problem parsing a simple csv-file with logstash and the csv filter. The parsing works fine until a certain point. I have all fields present that I would exspect. As I want to visualize this data in K… --- ## [Logstash 5.0 config issue](https://discuss.elastic.co/t/logstash-5-0-config-issue/57017)
**Author:** [@DreadPirateRob](https://discuss.elastic.co/u/DreadPirateRob)\ **Replies:** 2\ **Last updated:** [August 2, 2016, 3:26pm UTC](https://discuss.elastic.co/t/logstash-5-0-config-issue/57017 "2016-08-02T15:26:00Z")
my java version \[root@logstash logstash\] # java -version openjdk version "1.8.0\_101" OpenJDK Runtime Environment (build 1.8.0\_101-b13) OpenJDK 64-Bit Server VM (build 25.101-b13, mixed mode) Installed via the instr… --- ## [Logstash:runner Utilizing high cpu](https://discuss.elastic.co/t/logstash-runner-utilizing-high-cpu/57006)
**Author:** [@rajan](https://discuss.elastic.co/u/rajan)\ **Replies:** 0\ **Last updated:** [August 2, 2016, 12:29pm UTC](https://discuss.elastic.co/t/logstash-runner-utilizing-high-cpu/57006 "2016-08-02T12:29:33Z")
LogStash::Runner utilizes 100% of cpu on RHEL machine. I am using file plugin with multi line codec --- ## [Logstash timestamp error when CEST is at the end](https://discuss.elastic.co/t/logstash-timestamp-error-when-cest-is-at-the-end/27843)
**Author:** [@michaelzoet](https://discuss.elastic.co/u/michaelzoet)\ **Replies:** 5\ **Last updated:** [August 2, 2016, 12:14pm UTC](https://discuss.elastic.co/t/logstash-timestamp-error-when-cest-is-at-the-end/27843 "2016-08-02T12:14:13Z")
Hi all, I have a weird timestamp problem and maybe someone can help on this: The PostgreSQL logs are in CSV format and I get a fixed date string from Postgres with CEST at the end. How do I need to set the timestamp … --- ## [Trying to connect to mssql server with JDBC](https://discuss.elastic.co/t/trying-to-connect-to-mssql-server-with-jdbc/57003)
**Author:** [@valky05](https://discuss.elastic.co/u/valky05)\ **Replies:** 0\ **Last updated:** [August 2, 2016, 12:02pm UTC](https://discuss.elastic.co/t/trying-to-connect-to-mssql-server-with-jdbc/57003 "2016-08-02T12:02:52Z")
I'm currently trying to connect to a remote MSsql server with the JDBC plugin of Logstash. For the config file, I use the syntax proposed by mick66 on this thread: https://discuss.elastic.co/t/jdbc-mssql-server-connect… --- ## [How to parse a field in YAML syntax with Logstash](https://discuss.elastic.co/t/how-to-parse-a-field-in-yaml-syntax-with-logstash/57000)
**Author:** [@widhalmt](https://discuss.elastic.co/u/widhalmt)\ **Replies:** 0\ **Last updated:** [August 2, 2016, 11:41am UTC](https://discuss.elastic.co/t/how-to-parse-a-field-in-yaml-syntax-with-logstash/57000 "2016-08-02T11:41:19Z")
Hi, I want to parse Puppet reports with Logstash. Since they are in YAML I need a way to parse a YAML field in Logstash. I found https://github.com/logstash-plugins/logstash-filter-yaml but this seems to work only with… --- ## [Regarding reading files from a directory to which new files are being added continuously after processing all of previous files](https://discuss.elastic.co/t/regarding-reading-files-from-a-directory-to-which-new-files-are-being-added-continuously-after-processing-all-of-previous-files/56861)
**Author:** [@yesyesdhar](https://discuss.elastic.co/u/yesyesdhar)\ **Replies:** 6\ **Last updated:** [August 2, 2016, 11:17am UTC](https://discuss.elastic.co/t/regarding-reading-files-from-a-directory-to-which-new-files-are-being-added-continuously-after-processing-all-of-previous-files/56861 "2016-08-02T11:17:02Z")
input { file { path =\> "/Users/shashi/CSVFiles/Core2/\*.txt" I know above can be used to read input from multiple files in Core2 directory of type txt. My requirement is that multiple new files are being continuously ad… --- ## [Logstash : Parsing fails while parsing Json data received through web service like twitter / facebook etc](https://discuss.elastic.co/t/logstash-parsing-fails-while-parsing-json-data-received-through-web-service-like-twitter-facebook-etc/56918)
**Author:** [@Prashant\_Agrawal](https://discuss.elastic.co/u/Prashant_Agrawal)\ **Replies:** 10\ **Last updated:** [August 2, 2016, 11:03am UTC](https://discuss.elastic.co/t/logstash-parsing-fails-while-parsing-json-data-received-through-web-service-like-twitter-facebook-etc/56918 "2016-08-02T11:03:48Z")
I am receiving the Web service data say from Twitter and logging to file and there after I need to send that data to Logstash so as same can be indexed to Elasticsearch. I am using below config and that is giving jsonpa… --- ## [Geo IP throwing wrong Country names](https://discuss.elastic.co/t/geo-ip-throwing-wrong-country-names/56990)
**Author:** [@Kishore](https://discuss.elastic.co/u/Kishore)\ **Replies:** 3\ **Last updated:** [August 2, 2016, 10:42am UTC](https://discuss.elastic.co/t/geo-ip-throwing-wrong-country-names/56990 "2016-08-02T10:42:42Z")
Hi Elastic, Geo IP Plugin is not populating correct information. and for some of the IPs it is not showing the City Name. Ex: 170.251.154.205 This IP belongs to Bangalore and India, but in Kibana it is showing as Da… --- ## [Reading from files to a directory to which files are being added continuously](https://discuss.elastic.co/t/reading-from-files-to-a-directory-to-which-files-are-being-added-continuously/56949)
**Author:** [@yesyesdhar](https://discuss.elastic.co/u/yesyesdhar)\ **Replies:** 1\ **Last updated:** [August 2, 2016, 10:38am UTC](https://discuss.elastic.co/t/reading-from-files-to-a-directory-to-which-files-are-being-added-continuously/56949 "2016-08-02T10:38:55Z")
I have a small question. suppose if we give below in logstash configuration file, input { file { path =\> "/Users/shashi/CSVFiles/Core2/\*.txt" I know above can be used to read input from multiple files in Core2 direc… --- ## [OpenSSL::SSL::SSLError: Received fatal alert: handshake\_failure](https://discuss.elastic.co/t/openssl-ssl-sslerror-received-fatal-alert-handshake-failure/56831)
**Author:** [@HUANG](https://discuss.elastic.co/u/HUANG)\ **Replies:** 2\ **Last updated:** [August 2, 2016, 10:26am UTC](https://discuss.elastic.co/t/openssl-ssl-sslerror-received-fatal-alert-handshake-failure/56831 "2016-08-02T10:26:43Z")
I used Logstash to send alert email when application exception via smtp with ssl.But Logstash reported ':exception=\>#\ **Author:** [@fikse](https://discuss.elastic.co/u/fikse)\ **Replies:** 1\ **Last updated:** [August 2, 2016, 10:13am UTC](https://discuss.elastic.co/t/not-receiving-messages-in-zeromq-output-plugin/56843 "2016-08-02T10:13:28Z") I have a simple client subscribing to messages on port 2120: zmq = require('zmq'); port = 2120; sock = zmq.socket('sub'); sock.connect("tcp://127.0.0.1:" + port); sock.on('message', function (topic, msg) { consol… --- ## [Zeromq subscriber limitations](https://discuss.elastic.co/t/zeromq-subscriber-limitations/56841)
**Author:** [@fikse](https://discuss.elastic.co/u/fikse)\ **Replies:** 1\ **Last updated:** [August 2, 2016, 10:12am UTC](https://discuss.elastic.co/t/zeromq-subscriber-limitations/56841 "2016-08-02T10:12:54Z")
I am using the zeromq output plugin for logstash which utilizes the pub/sub topology. I want to listen for events and increment a count in a database, but I'm afraid it would not be accurate if I had more than one subscr… --- ## [Another timestamp parse question](https://discuss.elastic.co/t/another-timestamp-parse-question/56468)
**Author:** [@whoman](https://discuss.elastic.co/u/whoman)\ **Replies:** 2\ **Last updated:** [August 2, 2016, 7:53am UTC](https://discuss.elastic.co/t/another-timestamp-parse-question/56468 "2016-08-02T07:53:19Z")
I'm trying to parse a log with lines like this: \[03:03:2016:20:18:56.131400\] 0.1 ServerName HostName !ERROR \[24667-4107126528\] DNS resolution error ... I want to parse the first field into a Kibana timestamp but hav… --- ## [How to give customize name to fields and loop through logs](https://discuss.elastic.co/t/how-to-give-customize-name-to-fields-and-loop-through-logs/56948)
**Author:** [@vandana\_sethi](https://discuss.elastic.co/u/vandana_sethi)\ **Replies:** 2\ **Last updated:** [August 2, 2016, 6:45am UTC](https://discuss.elastic.co/t/how-to-give-customize-name-to-fields-and-loop-through-logs/56948 "2016-08-02T06:45:35Z")
I have a log pattern like this OTHERS|5HUNVWW|5HUNVWW|1469784588193|1469784588193| these pipe separated values represent a key so I want to create fields like field1 = OTHERS field2 = 5HUNVWW and so on . How ca… --- ## [Removing null fields from nexted fields - xml filter](https://discuss.elastic.co/t/removing-null-fields-from-nexted-fields-xml-filter/56747)
**Author:** [@whyapenny](https://discuss.elastic.co/u/whyapenny)\ **Replies:** 5\ **Last updated:** [August 1, 2016, 9:41pm UTC](https://discuss.elastic.co/t/removing-null-fields-from-nexted-fields-xml-filter/56747 "2016-08-01T21:41:43Z")
im using the xml filter to parse xml with logstash. This places the xml info in a nested field, such as: \[entry\]\[xmlField1\] \[entry\]\[xmlField2\] i am having issues with mappings and data when the fields are periodically… --- ## [Create dynamic column and save output in ES](https://discuss.elastic.co/t/create-dynamic-column-and-save-output-in-es/56007)
**Author:** [@rakesh76](https://discuss.elastic.co/u/rakesh76)\ **Replies:** 3\ **Last updated:** [August 1, 2016, 8:50pm UTC](https://discuss.elastic.co/t/create-dynamic-column-and-save-output-in-es/56007 "2016-08-01T20:50:24Z")
Here is my question. I have following column which has Int type. 1) DurationA 2) DurationB 3) Duration C = DurationB-DurationA DurationA and DurationB values comes from Different CSV file which I am loading to ES thr… --- ## [How to add timestamp before each event, timestamp is present at the beginning of the interval](https://discuss.elastic.co/t/how-to-add-timestamp-before-each-event-timestamp-is-present-at-the-beginning-of-the-interval/56761)
**Author:** [@Sri\_ram](https://discuss.elastic.co/u/Sri_ram)\ **Replies:** 5\ **Last updated:** [August 1, 2016, 7:21pm UTC](https://discuss.elastic.co/t/how-to-add-timestamp-before-each-event-timestamp-is-present-at-the-beginning-of-the-interval/56761 "2016-08-01T19:21:14Z")
Looking to parse vmstat data using Logstash. There will be a timestamp at the beginning of each interval, followed by metrics. Here, i need a timestamp value from vmstat data so that i can use it to overwrite the defaul… --- ## [Reg unexpected logstash shut down](https://discuss.elastic.co/t/reg-unexpected-logstash-shut-down/56917)
**Author:** [@subbu.nv](https://discuss.elastic.co/u/subbu.nv)\ **Replies:** 2\ **Last updated:** [August 1, 2016, 7:17pm UTC](https://discuss.elastic.co/t/reg-unexpected-logstash-shut-down/56917 "2016-08-01T19:17:02Z")
i am currently building up an application that reads log file regularly from a location and using logstash, and indexing to the elastic search. There are lots of file and we can expect daily feeds to the source. Due to… --- ## [Logstash es\_bulk codec only processing last event](https://discuss.elastic.co/t/logstash-es-bulk-codec-only-processing-last-event/56771)
**Author:** [@esds2000](https://discuss.elastic.co/u/esds2000)\ **Replies:** 2\ **Last updated:** [August 1, 2016, 6:46pm UTC](https://discuss.elastic.co/t/logstash-es-bulk-codec-only-processing-last-event/56771 "2016-08-01T18:46:32Z")
Trying send bulk index request through a logstash pipeline using the http input with es\_bulk codec. Having an issue where only the last event in the payload is being passed through. Sending the same payload to elasticsea… --- ## [Logstash s3 input](https://discuss.elastic.co/t/logstash-s3-input/54984)
**Author:** [@piyush](https://discuss.elastic.co/u/piyush)\ **Replies:** 2\ **Last updated:** [August 1, 2016, 6:36pm UTC](https://discuss.elastic.co/t/logstash-s3-input/54984 "2016-08-01T18:36:04Z")
Hi Team, I am trying to read cloud trail logs from a S3 bucket, i installed cloudtrail plugin too. I can download logs from s3 bucket using "s3 cp" command so there is no connectivity issue. (Though i can't download usi… --- ## [Logstash-input-rss error with tag\](https://discuss.elastic.co/t/logstash-input-rss-error-with-tag-image/56914)
**Author:** [@John\_McAfee](https://discuss.elastic.co/u/John_McAfee)\ **Replies:** 0\ **Last updated:** [August 1, 2016, 5:29pm UTC](https://discuss.elastic.co/t/logstash-input-rss-error-with-tag-image/56914 "2016-08-01T17:29:19Z")
I am using logstash 2.3.4 with the rss plugin to attempt to ingest this rss feed https://www.technologyreview.com/stories.rss. My conf file is defined as the following which I tested with the --configtest option. input … [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1119) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1121)