# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1124 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1125 --- ## [Error while installing plugins](https://discuss.elastic.co/t/error-while-installing-plugins/56175)
**Author:** [@vilure](https://discuss.elastic.co/u/vilure)\ **Replies:** 0\ **Last updated:** [July 22, 2016, 11:55am UTC](https://discuss.elastic.co/t/error-while-installing-plugins/56175 "2016-07-22T11:55:40Z")
I have logstash 5 alpha4 installed and when i try to install plugins: sudo /usr/share/logstash/bin/logstash-plugin install logstash-patterns-core I get this: Validating logstash-patterns-core Installing logstash-patter… --- ## [Extract timestamp from filename](https://discuss.elastic.co/t/extract-timestamp-from-filename/56135)
**Author:** [@subbu.nv](https://discuss.elastic.co/u/subbu.nv)\ **Replies:** 4\ **Last updated:** [July 22, 2016, 9:36pm UTC](https://discuss.elastic.co/t/extract-timestamp-from-filename/56135 "2016-07-22T21:36:27Z")
Hi All, currently i have filename with the below format \[XXXXXXXX\]\[YYYYYYYYYY\]\[2016\_07\_21\]\[19\_21\_12\]\[160721T192103\]\[ZZZZ\]AB\_RTRT.0.log. is there a way, i can extract the datetimestamp and index it to a specific field i… --- ## [Empty value cant be converted to integer or float](https://discuss.elastic.co/t/empty-value-cant-be-converted-to-integer-or-float/55646)
**Author:** [@Ngumba\_Kamau](https://discuss.elastic.co/u/Ngumba_Kamau)\ **Replies:** 2\ **Last updated:** [July 22, 2016, 7:22pm UTC](https://discuss.elastic.co/t/empty-value-cant-be-converted-to-integer-or-float/55646 "2016-07-22T19:22:29Z")
When specifying the schema for the logstash-output-google\_bigquery plugin whenever i select integer or float as the type for the field i get a cannot convert value to integer. This problem has been pinned down to having … --- ## [GeoIP location has added brackets and not able to visualize](https://discuss.elastic.co/t/geoip-location-has-added-brackets-and-not-able-to-visualize/44259)
**Author:** [@Hans](https://discuss.elastic.co/u/Hans)\ **Replies:** 10\ **Last updated:** [July 22, 2016, 6:45pm UTC](https://discuss.elastic.co/t/geoip-location-has-added-brackets-and-not-able-to-visualize/44259 "2016-07-22T18:45:07Z")
Hi, I have been trying to figure this out without success and hope there is someone out there that can assist with this matter. I have the GoeIP filter on the source and destination IP address and all works very well wit… --- ## [Configuring Logstash Sylog (v2.1.4) Output plugin for to use ssl-tcp](https://discuss.elastic.co/t/configuring-logstash-sylog-v2-1-4-output-plugin-for-to-use-ssl-tcp/55998)
**Author:** [@Hatitye\_Chindove](https://discuss.elastic.co/u/Hatitye_Chindove)\ **Replies:** 2\ **Last updated:** [July 22, 2016, 6:07pm UTC](https://discuss.elastic.co/t/configuring-logstash-sylog-v2-1-4-output-plugin-for-to-use-ssl-tcp/55998 "2016-07-22T18:07:19Z")
I have been trying to setup logstash to output plugin to work with ssl-tcp but I can't seem to get any community documentation on how to do this. A vendor provided me with their public certificate but I simply can't find… --- ## [How to find out if the sql\_last\_value is correctly interpreted?](https://discuss.elastic.co/t/how-to-find-out-if-the-sql-last-value-is-correctly-interpreted/55917)
**Author:** [@Ram\_Ibaset](https://discuss.elastic.co/u/Ram_Ibaset)\ **Replies:** 1\ **Last updated:** [July 22, 2016, 5:45pm UTC](https://discuss.elastic.co/t/how-to-find-out-if-the-sql-last-value-is-correctly-interpreted/55917 "2016-07-22T17:45:20Z")
I have created the following logstash config script: SELECT a, b, c, last\_updated FROM tablex where cast(last\_updated AS TIMESTAMP) \>=:sql\_last\_value How can I find out what the sql\_last\_value is ? i.e. is there a… --- ## [Where to change location of the logstash log file](https://discuss.elastic.co/t/where-to-change-location-of-the-logstash-log-file/56190)
**Author:** [@zoplex](https://discuss.elastic.co/u/zoplex)\ **Replies:** 4\ **Last updated:** [July 22, 2016, 5:41pm UTC](https://discuss.elastic.co/t/where-to-change-location-of-the-logstash-log-file/56190 "2016-07-22T17:41:18Z")
can't find the way to change default location for logstash log file. Thanks. --- ## [Ship log continually](https://discuss.elastic.co/t/ship-log-continually/56138)
**Author:** [@bishaka](https://discuss.elastic.co/u/bishaka)\ **Replies:** 5\ **Last updated:** [July 22, 2016, 5:24pm UTC](https://discuss.elastic.co/t/ship-log-continually/56138 "2016-07-22T17:24:07Z")
Hi, I am trying to ship logs to a different server using a Logstash forwarder and a redis queue...everything is working fine. Logs are shipping. However, I want to continuously ship logs. Currently what i have is, it sh… --- ## [Scaling out logstash](https://discuss.elastic.co/t/scaling-out-logstash/56188)
**Author:** [@DK\_3](https://discuss.elastic.co/u/DK_3)\ **Replies:** 1\ **Last updated:** [July 22, 2016, 4:09pm UTC](https://discuss.elastic.co/t/scaling-out-logstash/56188 "2016-07-22T16:09:57Z")
Looking for the easiest approach to scale ELK with Docker (host network mode) Currently I have 2 servers and each runs a single elasticsearch, logstash and kibana container. The elasticsearch containers on each serve… --- ## [Problem pushing log from logstash to zabbix](https://discuss.elastic.co/t/problem-pushing-log-from-logstash-to-zabbix/55894)
**Author:** [@Jpuch](https://discuss.elastic.co/u/Jpuch)\ **Replies:** 1\ **Last updated:** [July 22, 2016, 2:41pm UTC](https://discuss.elastic.co/t/problem-pushing-log-from-logstash-to-zabbix/55894 "2016-07-22T14:41:30Z")
Hello there, I'm trying send log from logstash to zabbix but i face a problem i can't solve. so these are my conf files : Input : input { udp { port =\> 514 type =\> "syslog" } } output : output { … --- ## [Logstash elatcisearch index a revit file](https://discuss.elastic.co/t/logstash-elatcisearch-index-a-revit-file/56153)
**Author:** [@josefboukersi](https://discuss.elastic.co/u/josefboukersi)\ **Replies:** 2\ **Last updated:** [July 22, 2016, 10:22am UTC](https://discuss.elastic.co/t/logstash-elatcisearch-index-a-revit-file/56153 "2016-07-22T10:22:23Z")
Hey, i try to index a revit file (.rvt) it's a Building Information Modeling; I wonder if elasitcsearch logstash or can do ? or if there is a plugin that do that thanks a lot for your help ps : i use elasticsearch 2.3.… --- ## [Loading a .csv file into Elasticsearch using Logstash](https://discuss.elastic.co/t/loading-a-csv-file-into-elasticsearch-using-logstash/56128)
**Author:** [@puja.jena](https://discuss.elastic.co/u/puja.jena)\ **Replies:** 2\ **Last updated:** [July 22, 2016, 8:48am UTC](https://discuss.elastic.co/t/loading-a-csv-file-into-elasticsearch-using-logstash/56128 "2016-07-22T08:48:21Z")
Hi, I'm trying to import this one CSV file to Elasticsearch using Logstash, but it seems to be failing despite the fact that my configuration file is okay. My .conf file in Elasticsearch looks like the following: input… --- ## [Logstash Null Value](https://discuss.elastic.co/t/logstash-null-value/56083)
**Author:** [@Kishore](https://discuss.elastic.co/u/Kishore)\ **Replies:** 5\ **Last updated:** [July 22, 2016, 8:42am UTC](https://discuss.elastic.co/t/logstash-null-value/56083 "2016-07-22T08:42:29Z")
I want to display null value from the below log in Kibana. "Roles changed for user 'AIPTEST\\geetanjali.j.podal' from "" to "ContentAdmin"" I can able to capture at 'https://grokdebug.herokuapp.com/' by using below Patt… --- ## [Multiline codec issue](https://discuss.elastic.co/t/multiline-codec-issue/56154)
**Author:** [@fantaghost](https://discuss.elastic.co/u/fantaghost)\ **Replies:** 0\ **Last updated:** [July 22, 2016, 7:49am UTC](https://discuss.elastic.co/t/multiline-codec-issue/56154 "2016-07-22T07:49:25Z")
Dear all, I have configured Logstash for a csv input file. Each field is double quoted, comma separated and terminated by /r/n. Sometimes the last field is a multiline text. This is an example record (timestamp is on t… --- ## [Problem with beats logstash plugins](https://discuss.elastic.co/t/problem-with-beats-logstash-plugins/55555)
**Author:** [@orsa](https://discuss.elastic.co/u/orsa)\ **Replies:** 4\ **Last updated:** [July 21, 2016, 9:27pm UTC](https://discuss.elastic.co/t/problem-with-beats-logstash-plugins/55555 "2016-07-21T21:27:55Z")
Hi i have a problem with beat logstash plugin. He dosen\`t send windows event log to ES. My Schema Winlogbeat =\> Logstash =\> ES if i send log directly to ES - all work. TCP packages to LS is come. logstash 2.3.4 logst… --- ## [Add Unique Id to logs in logstash](https://discuss.elastic.co/t/add-unique-id-to-logs-in-logstash/56001)
**Author:** [@prabhakar349](https://discuss.elastic.co/u/prabhakar349)\ **Replies:** 4\ **Last updated:** [July 21, 2016, 7:13pm UTC](https://discuss.elastic.co/t/add-unique-id-to-logs-in-logstash/56001 "2016-07-21T19:13:56Z")
we are trying to add a new feild to the json document which we get from kafka, where this field needs to have an unique id we tried with following options with in filter mutate grok json nothing worked for us below i… --- ## [Consume many logs from file](https://discuss.elastic.co/t/consume-many-logs-from-file/56004)
**Author:** [@Jeferson\_Martins](https://discuss.elastic.co/u/Jeferson_Martins)\ **Replies:** 1\ **Last updated:** [July 21, 2016, 6:46pm UTC](https://discuss.elastic.co/t/consume-many-logs-from-file/56004 "2016-07-21T18:46:35Z")
Hello, Today I have a problema where I have to consume a nginx log, but this log file writes more lines than logstash can collect. There's some way to have more performance in collect logs? --- ## [Multiple pattern matching log file](https://discuss.elastic.co/t/multiple-pattern-matching-log-file/56008)
**Author:** [@bishaka](https://discuss.elastic.co/u/bishaka)\ **Replies:** 2\ **Last updated:** [July 21, 2016, 6:31pm UTC](https://discuss.elastic.co/t/multiple-pattern-matching-log-file/56008 "2016-07-21T18:31:54Z")
Hi, So my log file contains multiple patterns (2 diff types) so i made 2 different match patterns to accompany both of them. Everythings working fine and I don't get \_grokparsefailure tags errors. However.. it is return… --- ## [How can I create a date object from my logs with this format?](https://discuss.elastic.co/t/how-can-i-create-a-date-object-from-my-logs-with-this-format/55810)
**Author:** [@David\_McClain](https://discuss.elastic.co/u/David_McClain)\ **Replies:** 2\ **Last updated:** [July 21, 2016, 6:29pm UTC](https://discuss.elastic.co/t/how-can-i-create-a-date-object-from-my-logs-with-this-format/55810 "2016-07-21T18:29:59Z")
I'm sure I'm overthinking this and missing something.. I'm getting logs from a tomcat application where the timestamp is in this format: 2016-07-18 17:55:23.423 -0400 Right now, I'm parsing them as 2 separate fields… --- ## [Which hits get picked up by grok filter in multiline events](https://discuss.elastic.co/t/which-hits-get-picked-up-by-grok-filter-in-multiline-events/55823)
**Author:** [@markus](https://discuss.elastic.co/u/markus)\ **Replies:** 1\ **Last updated:** [July 21, 2016, 6:28pm UTC](https://discuss.elastic.co/t/which-hits-get-picked-up-by-grok-filter-in-multiline-events/55823 "2016-07-21T18:28:13Z")
Hi, I have a question regarding the grok filter. I have event messages that contain mutliple matches for a certain pattern. I am confused as to which match is supposed to get picked up by the grok filter. The first match… --- ## [Logstash file wont run](https://discuss.elastic.co/t/logstash-file-wont-run/55927)
**Author:** [@bishaka](https://discuss.elastic.co/u/bishaka)\ **Replies:** 5\ **Last updated:** [July 21, 2016, 6:24pm UTC](https://discuss.elastic.co/t/logstash-file-wont-run/55927 "2016-07-21T18:24:06Z")
I have the following logstash configuration file. When i try to run it..it won't show up on stdout...what it wrong with it? It worked before...what happened now? PLEASE HELP! input { file { path =\> \[ "/opt/cast/r… --- ## [Redis process is 50 GB; how to trim down?](https://discuss.elastic.co/t/redis-process-is-50-gb-how-to-trim-down/55840)
**Author:** [@ravenpi](https://discuss.elastic.co/u/ravenpi)\ **Replies:** 3\ **Last updated:** [July 21, 2016, 6:19pm UTC](https://discuss.elastic.co/t/redis-process-is-50-gb-how-to-trim-down/55840 "2016-07-21T18:19:18Z")
As I understand it, Redis is the broker that feeds Logstash -- so, in theory, assuming that Logstash is running, it shouldn't be getting all that large. So why 50 GB? Any ideas on how to flush/squash/whatever that down… --- ## [Logstash Mutliline Inquiry](https://discuss.elastic.co/t/logstash-mutliline-inquiry/55750)
**Author:** [@sombilat](https://discuss.elastic.co/u/sombilat)\ **Replies:** 16\ **Last updated:** [July 21, 2016, 6:12pm UTC](https://discuss.elastic.co/t/logstash-mutliline-inquiry/55750 "2016-07-21T18:12:42Z")
Hello, I would like to ask a question on the Multiline function of Logstash. How does it work? When does it "compile" the pattern into the event? I noticed that during execution, the events are singular and when … --- ## [How to parse this date format and target it to @timestamp](https://discuss.elastic.co/t/how-to-parse-this-date-format-and-target-it-to-timestamp/56021)
**Author:** [@Sridhar\_Yadav\_Manoha](https://discuss.elastic.co/u/Sridhar_Yadav_Manoha)\ **Replies:** 3\ **Last updated:** [July 21, 2016, 6:00pm UTC](https://discuss.elastic.co/t/how-to-parse-this-date-format-and-target-it-to-timestamp/56021 "2016-07-21T18:00:34Z")
How to parse this date format and target it to @timestamp : 19/Jul/2016:17:39:02 --- ## [Dell networking OS 9.8 use with Logstash](https://discuss.elastic.co/t/dell-networking-os-9-8-use-with-logstash/55435)
**Author:** [@apomerenk](https://discuss.elastic.co/u/apomerenk)\ **Replies:** 3\ **Last updated:** [July 21, 2016, 2:19pm UTC](https://discuss.elastic.co/t/dell-networking-os-9-8-use-with-logstash/55435 "2016-07-21T14:19:55Z")
We are trying to monitor a Dell Switch and send some statistics to a central Logstash Repo running on a http IP address listening on a port. However, the way that we were doing it before was with the "curl -XPUT ..." com… --- ## [Treat string as JSON](https://discuss.elastic.co/t/treat-string-as-json/56091)
**Author:** [@dwjvaughan](https://discuss.elastic.co/u/dwjvaughan)\ **Replies:** 2\ **Last updated:** [July 21, 2016, 2:11pm UTC](https://discuss.elastic.co/t/treat-string-as-json/56091 "2016-07-21T14:11:17Z")
I have JSON stored in an Oracle database as a CLOB (serialised JSON string). I'd like to get this into Elasticsearch as a JSON object. I have the input specified as jdbc (with the oracle connection string etc) and the… --- ## [Possible Bug? Filter Not Applying Before Output into Elasticsearch](https://discuss.elastic.co/t/possible-bug-filter-not-applying-before-output-into-elasticsearch/55890)
**Author:** [@af7](https://discuss.elastic.co/u/af7)\ **Replies:** 2\ **Last updated:** [July 21, 2016, 12:48pm UTC](https://discuss.elastic.co/t/possible-bug-filter-not-applying-before-output-into-elasticsearch/55890 "2016-07-21T12:48:25Z")
So I'm getting input from Redis, filtering and transforming it, and then outputting it into Elasticsearch. However, I have run into a problem where the filter is not being applied for output to Elasticsearch. I tested it… --- ## [Update to elasticsearch fails when lines are parsed one after another](https://discuss.elastic.co/t/update-to-elasticsearch-fails-when-lines-are-parsed-one-after-another/56055)
**Author:** [@aviv.ratzon](https://discuss.elastic.co/u/aviv.ratzon)\ **Replies:** 1\ **Last updated:** [July 21, 2016, 12:53pm UTC](https://discuss.elastic.co/t/update-to-elasticsearch-fails-when-lines-are-parsed-one-after-another/56055 "2016-07-21T12:53:26Z")
Hi there, I'm using logstash to send parsed log data to ES. If some field is the same as the one of the previous line, only a few fields are kept and logstash should update the document that was created by the previous l… --- ## [Multiple pattern in log file - logstash config file](https://discuss.elastic.co/t/multiple-pattern-in-log-file-logstash-config-file/55919)
**Author:** [@bishaka](https://discuss.elastic.co/u/bishaka)\ **Replies:** 1\ **Last updated:** [July 21, 2016, 11:32am UTC](https://discuss.elastic.co/t/multiple-pattern-in-log-file-logstash-config-file/55919 "2016-07-21T11:32:14Z")
Hi, I have 2 different patterns in my logs..how do I take them both into account in my logstash configuration file? Pattern 1: 2016-06-03 08:44:52 | INFO | \[\[ACTIVE\] ExecuteThread: '0' for queue: 'weblogic.kernel.Defa… --- ## [Slow Pipeline after adding output parameter](https://discuss.elastic.co/t/slow-pipeline-after-adding-output-parameter/55850)
**Author:** [@NicoYUE](https://discuss.elastic.co/u/NicoYUE)\ **Replies:** 2\ **Last updated:** [July 21, 2016, 7:58am UTC](https://discuss.elastic.co/t/slow-pipeline-after-adding-output-parameter/55850 "2016-07-21T07:58:45Z")
Hello, I'm using Logstash to retrieve data from a SQL database to push into Elasticsearch. I had some good result with around 1000 inputs per second into my cluster. Next step was to put an id on my documents so th… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1123) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1125)