# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1127 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1128 --- ## [Logstash fails to start with init script (RHEL/CentOS)](https://discuss.elastic.co/t/logstash-fails-to-start-with-init-script-rhel-centos/55516)
**Author:** [@pysysops](https://discuss.elastic.co/u/pysysops)\ **Replies:** 3\ **Last updated:** [July 15, 2016, 9:22am UTC](https://discuss.elastic.co/t/logstash-fails-to-start-with-init-script-rhel-centos/55516 "2016-07-15T09:22:34Z")
Hey! When run as a user that belongs to a group with spaces in the name (a la Windows / Samba), Logstash fails to start. I have fixed this locally by amending line: 61 Before (not working due to names): SGROUPS=$(id… --- ## [Error in WMI input plugin](https://discuss.elastic.co/t/error-in-wmi-input-plugin/45779)
**Author:** [@Suren92](https://discuss.elastic.co/u/Suren92)\ **Replies:** 1\ **Last updated:** [July 15, 2016, 8:14am UTC](https://discuss.elastic.co/t/error-in-wmi-input-plugin/45779 "2016-07-15T08:14:40Z")
Hi, I am trying to collect the performance counters on the windows system using the below configuration. But I am getting the following error. Please suggest me any solution to overcome the error. The error reported … --- ## [How to revome the prefix of nested json fields](https://discuss.elastic.co/t/how-to-revome-the-prefix-of-nested-json-fields/55489)
**Author:** [@suntuo](https://discuss.elastic.co/u/suntuo)\ **Replies:** 3\ **Last updated:** [July 15, 2016, 7:30am UTC](https://discuss.elastic.co/t/how-to-revome-the-prefix-of-nested-json-fields/55489 "2016-07-15T07:30:54Z")
input: {"cookies":{"mfov":"ZTE Q705U","sver":"5915","appid":"1","mfo":"ZTE","sysver":"4.2.2","plat":"1","sys":"android"}} filter{ json { source =\> \["message"\] } } how to remove prefix "cookie." of filed\_name … --- ## [Filter and tag events which occurs less frequently](https://discuss.elastic.co/t/filter-and-tag-events-which-occurs-less-frequently/55538)
**Author:** [@vikas\_J](https://discuss.elastic.co/u/vikas_J)\ **Replies:** 1\ **Last updated:** [July 15, 2016, 6:43am UTC](https://discuss.elastic.co/t/filter-and-tag-events-which-occurs-less-frequently/55538 "2016-07-15T06:43:28Z")
Hi, Using logstash is it possible to tag events which occur less frequently. Like say if an event occurs less than 10 times in a period of 2 minutes, then tag all such events as "LOWFREQ" . --- ## [Date Parse Failure for dd-MMM-yy h:mm:ss a z](https://discuss.elastic.co/t/date-parse-failure-for-dd-mmm-yy-h-mm-ss-a-z/55526)
**Author:** [@sallehuddin](https://discuss.elastic.co/u/sallehuddin)\ **Replies:** 3\ **Last updated:** [July 15, 2016, 6:19am UTC](https://discuss.elastic.co/t/date-parse-failure-for-dd-mmm-yy-h-mm-ss-a-z/55526 "2016-07-15T06:19:00Z")
I've been scratching my head for hours trying to figure out why the following datetime format failed to be properly detected by date filter of logstash. I have the following sample data from csv file: 09-Jul-16 10:00:0… --- ## [Multiline negation](https://discuss.elastic.co/t/multiline-negation/55447)
**Author:** [@Mormaii](https://discuss.elastic.co/u/Mormaii)\ **Replies:** 6\ **Last updated:** [July 15, 2016, 6:16am UTC](https://discuss.elastic.co/t/multiline-negation/55447 "2016-07-15T06:16:45Z")
This is the data I have (this is one entry each). "MAIN\_cache\_hit" =\> 1472612747 "MAIN\_client\_req" =\> 1524049030 "MAIN\_fetch\_1xx" =\> 0 "MAIN\_fetch\_204" =\> 0 I'm trying to group MAIN\_cache\_hit and MAIN\_client\_req on a … --- ## [The environment LS\_HEAP\_SIZE setting](https://discuss.elastic.co/t/the-environment-ls-heap-size-setting/55363)
**Author:** [@xiaozhuqq48](https://discuss.elastic.co/u/xiaozhuqq48)\ **Replies:** 5\ **Last updated:** [July 15, 2016, 6:16am UTC](https://discuss.elastic.co/t/the-environment-ls-heap-size-setting/55363 "2016-07-15T06:16:17Z")
I'm using bin/logstash -f xx.conf -b 2000 -m 6, but i get a warning, "CAUTION: Recommended inflight events max exceeded!.xxxxxxxxxxxxxxxxx this may cause instability with the default heap size. please consider setting… --- ## [Logstash 2.3.x throughput drops significantly compared to 2.2.0](https://discuss.elastic.co/t/logstash-2-3-x-throughput-drops-significantly-compared-to-2-2-0/55250)
**Author:** [@anhlqn](https://discuss.elastic.co/u/anhlqn)\ **Replies:** 2\ **Last updated:** [July 15, 2016, 6:14am UTC](https://discuss.elastic.co/t/logstash-2-3-x-throughput-drops-significantly-compared-to-2-2-0/55250 "2016-07-15T06:14:34Z")
Hi everyone, Does anyone experience throughput drop in Logstash 2.3.x ( 2.3.0, 2.3.1, 2.3.3) compared to 2.2.0. I'm using Logstash to receive, process, and send IIS logs to Elasticsearch. On the same physical server wi… --- ## [Checking if an nested field which is an array contains a value](https://discuss.elastic.co/t/checking-if-an-nested-field-which-is-an-array-contains-a-value/55561)
**Author:** [@Ramdev\_Wudali](https://discuss.elastic.co/u/Ramdev_Wudali)\ **Replies:** 1\ **Last updated:** [July 15, 2016, 5:49am UTC](https://discuss.elastic.co/t/checking-if-an-nested-field-which-is-an-array-contains-a-value/55561 "2016-07-15T05:49:10Z")
Hi: I am trying to check if a nested field in the input can be used for conditional checks and how to do it: here is an example logstash config : input { generator { message =\> '{"metadata": { "origins": \[… --- ## [Anyone using IPFIX?](https://discuss.elastic.co/t/anyone-using-ipfix/25366)
**Author:** [@tpnoonan](https://discuss.elastic.co/u/tpnoonan)\ **Replies:** 5\ **Last updated:** [July 15, 2016, 4:50am UTC](https://discuss.elastic.co/t/anyone-using-ipfix/25366 "2016-07-15T04:50:16Z")
I'm attempting to setup logstash(1.5.2) to accept netflow(ipfix) data from a Barracuda Network Gateway (F280). When i fire up logstash, I get the following warnings over and over. ←\[33mIgnoring Netflow version v10 {:l… --- ## [Getting connection refused](https://discuss.elastic.co/t/getting-connection-refused/55579)
**Author:** [@dubul](https://discuss.elastic.co/u/dubul)\ **Replies:** 1\ **Last updated:** [July 15, 2016, 2:39am UTC](https://discuss.elastic.co/t/getting-connection-refused/55579 "2016-07-15T02:39:03Z")
io/console not supported; tty will not be manipulated Settings: Default pipeline workers: 2 ←\[31mConnection refused: connect {:class=\>"Manticore::SocketException", :level=\>:error}←\[0m Pipeline main started I have used … --- ## [NoMethodError using Avro codec with Kafka plugin](https://discuss.elastic.co/t/nomethoderror-using-avro-codec-with-kafka-plugin/55558)
**Author:** [@CraigWh](https://discuss.elastic.co/u/CraigWh)\ **Replies:** 0\ **Last updated:** [July 14, 2016, 7:08pm UTC](https://discuss.elastic.co/t/nomethoderror-using-avro-codec-with-kafka-plugin/55558 "2016-07-14T19:08:50Z")
Hi, I'm using the Kafka input plugin version 2.0.8 to pull Avro-encoded messages from Kafka 0.8. I have the Avro codec version 2.0.4 installed, but when I push a message into Kafka, Logstash gives the following error: … --- ## [Compare current event against previously one](https://discuss.elastic.co/t/compare-current-event-against-previously-one/43176)
**Author:** [@Thales\_Fernando](https://discuss.elastic.co/u/Thales_Fernando)\ **Replies:** 5\ **Last updated:** [July 14, 2016, 6:15pm UTC](https://discuss.elastic.co/t/compare-current-event-against-previously-one/43176 "2016-07-14T18:15:23Z")
Hello Guys! We are processing some MSSQL tables via JDBC input plugin. Some times, 3 rolls will be almost equal. Our goal is merge these lines together and transform the values that are different in an array. So, giv… --- ## [Help on Geo Point Set up](https://discuss.elastic.co/t/help-on-geo-point-set-up/55307)
**Author:** [@spraveenjd](https://discuss.elastic.co/u/spraveenjd)\ **Replies:** 2\ **Last updated:** [July 14, 2016, 6:00pm UTC](https://discuss.elastic.co/t/help-on-geo-point-set-up/55307 "2016-07-14T18:00:59Z")
I have logstatsh configured as below, and also I have deleted the logstatsh template using "curl -XDELETE 'http://localhost:9200/\_template/logstash'" input { jdbc { jdbc\_driver\_library =\> "/app/… --- ## [Logstash metrics filter not working after logstash 2.2.0 upgrade](https://discuss.elastic.co/t/logstash-metrics-filter-not-working-after-logstash-2-2-0-upgrade/41220)
**Author:** [@biswajit86](https://discuss.elastic.co/u/biswajit86)\ **Replies:** 5\ **Last updated:** [July 14, 2016, 5:06pm UTC](https://discuss.elastic.co/t/logstash-metrics-filter-not-working-after-logstash-2-2-0-upgrade/41220 "2016-07-14T17:06:48Z")
I have an existing logstash config that reads data from topbeat and outputs data to kafka(config below). I have added the metrics filter to get the throughput of documents processed. After upgrading to logstash 2.2.0 ,I … --- ## [Stream Identity in Multiline Codec?](https://discuss.elastic.co/t/stream-identity-in-multiline-codec/55437)
**Author:** [@Maxwell\_Flanders](https://discuss.elastic.co/u/Maxwell_Flanders)\ **Replies:** 3\ **Last updated:** [July 14, 2016, 2:30pm UTC](https://discuss.elastic.co/t/stream-identity-in-multiline-codec/55437 "2016-07-14T14:30:32Z")
does the multiline codec have any ability to give your own definition of stream identity?? I am feeding logstash from a SINGLE kafka topic using a multiline codec, but some are from different sources. Can I configure th… --- ## [DatabaseConnectionError with oracle BBDD](https://discuss.elastic.co/t/databaseconnectionerror-with-oracle-bbdd/55038)
**Author:** [@jjgil](https://discuss.elastic.co/u/jjgil)\ **Replies:** 1\ **Last updated:** [July 14, 2016, 12:04pm UTC](https://discuss.elastic.co/t/databaseconnectionerror-with-oracle-bbdd/55038 "2016-07-14T12:04:29Z")
Dears! I'm new to EKL and I have a problem trying to connect to an Oracle database. My code: input { jdbc{ jdbc\_driver\_library =\> "C:\\EKL\\logstash\\vendor\\jar\\jdbc\\ojdbc6.jar" jdbc\_driver\_class =\> "Java::oracle.jdb… --- ## [Fields value doesn't update when I change parsing rule in logstash](https://discuss.elastic.co/t/fields-value-doesnt-update-when-i-change-parsing-rule-in-logstash/55484)
**Author:** [@vandana\_sethi](https://discuss.elastic.co/u/vandana_sethi)\ **Replies:** 5\ **Last updated:** [July 14, 2016, 9:17am UTC](https://discuss.elastic.co/t/fields-value-doesnt-update-when-i-change-parsing-rule-in-logstash/55484 "2016-07-14T09:17:53Z")
Hi fellas , I am newbie here . When i change field value in logstash config file and restart logstash some time I can see the changed value but some time it doesn't work. Just for an example i simply added a static field… --- ## [Calculation of first\_switched and last\_switched is not correct in netflow.rb cocde](https://discuss.elastic.co/t/calculation-of-first-switched-and-last-switched-is-not-correct-in-netflow-rb-cocde/37151)
**Author:** [@abhisheyke](https://discuss.elastic.co/u/abhisheyke)\ **Replies:** 1\ **Last updated:** [July 13, 2016, 11:16am UTC](https://discuss.elastic.co/t/calculation-of-first-switched-and-last-switched-is-not-correct-in-netflow-rb-cocde/37151 "2016-07-13T11:16:06Z")
Looking at below snap of netfow.rb, It seems that overflow of bit is taken care during calculation of first\_switched and last\_switched. I can think a case where system up time may be smaller than first switched time in … --- ## [Syslog output timezone not maintained like file output](https://discuss.elastic.co/t/syslog-output-timezone-not-maintained-like-file-output/55485)
**Author:** [@cg-max](https://discuss.elastic.co/u/cg-max)\ **Replies:** 0\ **Last updated:** [July 14, 2016, 7:10am UTC](https://discuss.elastic.co/t/syslog-output-timezone-not-maintained-like-file-output/55485 "2016-07-14T07:10:24Z")
I'm using logstash 2.2.2 with the syslog output on a centos 7 system. Logstash is receiving data from other servers forwarded by rsyslog. Using the file output results in data such as: \<85\>Jul 14 08:49:07 td032 sudo: … --- ## [Logstash 5 Alpha 4 connection with zookeeper is getting error](https://discuss.elastic.co/t/logstash-5-alpha-4-connection-with-zookeeper-is-getting-error/55421)
**Author:** [@gaurav\_S\_javheri](https://discuss.elastic.co/u/gaurav_S_javheri)\ **Replies:** 2\ **Last updated:** [July 14, 2016, 5:16am UTC](https://discuss.elastic.co/t/logstash-5-alpha-4-connection-with-zookeeper-is-getting-error/55421 "2016-07-14T05:16:10Z")
Below is configuration to connect to zookeeper server which configured with Kafka 0.10 input { kafka { bootstrap\_servers =\> "zk\_server:2181" topics =\> \['logstash\_log\_2'\] } } output{ … --- ## [Logstash error after upgrade to 2.3.4](https://discuss.elastic.co/t/logstash-error-after-upgrade-to-2-3-4/55238)
**Author:** [@tbernhardson](https://discuss.elastic.co/u/tbernhardson)\ **Replies:** 3\ **Last updated:** [July 13, 2016, 10:17pm UTC](https://discuss.elastic.co/t/logstash-error-after-upgrade-to-2-3-4/55238 "2016-07-13T22:17:58Z")
I just rebuilt my test & dev ELK box on new hardware, after the install (which upgraded Logstash from 2.2.3 to 2.3.4) logstash now gets a "RegexpError: Undefined group option" with the config file that worked fine before… --- ## [Mutate change field to another](https://discuss.elastic.co/t/mutate-change-field-to-another/55121)
**Author:** [@belette](https://discuss.elastic.co/u/belette)\ **Replies:** 3\ **Last updated:** [July 13, 2016, 10:01pm UTC](https://discuss.elastic.co/t/mutate-change-field-to-another/55121 "2016-07-13T22:01:47Z")
Hi, I am trying to change filed but I am not able to do it I think it is an issue of my if statement where I probably not put the right way to find it... I would like to change "fieldId" : 16 to "fieldId' : "Applicatio… --- ## [Default codecs are different for 3.0 Kafka plugins](https://discuss.elastic.co/t/default-codecs-are-different-for-3-0-kafka-plugins/54468)
**Author:** [@sundar](https://discuss.elastic.co/u/sundar)\ **Replies:** 3\ **Last updated:** [July 13, 2016, 5:11pm UTC](https://discuss.elastic.co/t/default-codecs-are-different-for-3-0-kafka-plugins/54468 "2016-07-13T17:11:54Z")
Hello Logstash Team! Thanks for your help in pointing me to the correct plugin versions which support Kafka 0.9 in this topic: One peculiar thing we noticed (after much hair-pulling on why field extraction with KV fil… --- ## [Logstash 5.0 alpha4 issues with Kafka 0.9](https://discuss.elastic.co/t/logstash-5-0-alpha4-issues-with-kafka-0-9/55272)
**Author:** [@Mick\_Mahoney](https://discuss.elastic.co/u/Mick_Mahoney)\ **Replies:** 4\ **Last updated:** [July 13, 2016, 4:59pm UTC](https://discuss.elastic.co/t/logstash-5-0-alpha4-issues-with-kafka-0-9/55272 "2016-07-13T16:59:21Z")
Having an issue connecting to Kafka 0.9 from 5.0 alpha4 release Getting following error: "Exception in thread "Ruby-0-Thread-13: /usr/share/logstash/vendor/bundle/jruby/1.9/gems/logstash-input-kafka-5.0.0/lib/logstash/… --- ## [Only strings and arrays are splittalbe for XML input into logstash](https://discuss.elastic.co/t/only-strings-and-arrays-are-splittalbe-for-xml-input-into-logstash/55428)
**Author:** [@asoong-94](https://discuss.elastic.co/u/asoong-94)\ **Replies:** 1\ **Last updated:** [July 13, 2016, 4:44pm UTC](https://discuss.elastic.co/t/only-strings-and-arrays-are-splittalbe-for-xml-input-into-logstash/55428 "2016-07-13T16:44:34Z")
trying to read in a simple XML document, and outputting it after splitting. However I get an error message "only strings and arrays are splittable" input { file { path =\> "H:\\logstash\\zipped\_folders\\logstash-2.3.1\\… --- ## [Logstash not using given template json file on output section](https://discuss.elastic.co/t/logstash-not-using-given-template-json-file-on-output-section/25730)
**Author:** [@gugansankar](https://discuss.elastic.co/u/gugansankar)\ **Replies:** 8\ **Last updated:** [July 13, 2016, 4:37pm UTC](https://discuss.elastic.co/t/logstash-not-using-given-template-json-file-on-output-section/25730 "2016-07-13T16:37:17Z")
I have tried to create custom index pattern in Elasticsearch based on my input data. So I wrote some custom json and point it to template section of logstash output plugin. But not sure why the index are not created … --- ## [Loading events from database to elasticsearch crashing](https://discuss.elastic.co/t/loading-events-from-database-to-elasticsearch-crashing/50424)
**Author:** [@ruival](https://discuss.elastic.co/u/ruival)\ **Replies:** 2\ **Last updated:** [July 13, 2016, 4:23pm UTC](https://discuss.elastic.co/t/loading-events-from-database-to-elasticsearch-crashing/50424 "2016-07-13T16:23:49Z")
Hi all, building a proof of concept to validate log analysis by ELK. My config: elasticsearch 2.3.1 logstash 2.3.1 input { jdbc { type =\> "MonitoringBroker" jdbc\_driver\_library =\> "C:\\Oracle… --- ## [Add a field as a "parent" parameter with add\_field (for geo\_point)](https://discuss.elastic.co/t/add-a-field-as-a-parent-parameter-with-add-field-for-geo-point/55195)
**Author:** [@LouF](https://discuss.elastic.co/u/LouF)\ **Replies:** 2\ **Last updated:** [July 13, 2016, 2:04pm UTC](https://discuss.elastic.co/t/add-a-field-as-a-parent-parameter-with-add-field-for-geo-point/55195 "2016-07-13T14:04:16Z")
Hi, I have a problem with the geo\_point type. I already applied a template on elasticsearch to transform the data i get into a geo\_point. This data is supposed to be the parameter location. I don't receive it from the … --- ## [Indexing application log files to elasticsearch](https://discuss.elastic.co/t/indexing-application-log-files-to-elasticsearch/55377)
**Author:** [@shane\_lee](https://discuss.elastic.co/u/shane_lee)\ **Replies:** 6\ **Last updated:** [July 13, 2016, 1:47pm UTC](https://discuss.elastic.co/t/indexing-application-log-files-to-elasticsearch/55377 "2016-07-13T13:47:47Z")
Hi, I am investigating what to use to index application log files into elasticsearch. ===Use Case=== I have a miroservice developed using spring boot. Logging framework I use is logback. Options to log applicati… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1126) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1128)