# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1131 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1132 --- ## [Logstash bind error](https://discuss.elastic.co/t/logstash-bind-error/54864)
**Author:** [@Dalton\_Culp](https://discuss.elastic.co/u/Dalton_Culp)\ **Replies:** 1\ **Last updated:** [July 6, 2016, 7:00pm UTC](https://discuss.elastic.co/t/logstash-bind-error/54864 "2016-07-06T19:00:34Z")
when i run logstash in the foreground i get an error that says "Address already in use - bind - Address already in use". Any idea on how to fix this? --- ## [Comment are interpreted?](https://discuss.elastic.co/t/comment-are-interpreted/54853)
**Author:** [@antonin42](https://discuss.elastic.co/u/antonin42)\ **Replies:** 0\ **Last updated:** [July 6, 2016, 5:02pm UTC](https://discuss.elastic.co/t/comment-are-interpreted/54853 "2016-07-06T17:02:44Z")
Hello, just found out that this : filter { mutate { add\_field =\> { # some comment "\[@metadata\]\[uuid\]" =\> "%{NUM\_TEL}\_%{DATE\_APPEL}" "\[@metadata\]\[es\]" =\> "true" } } } works just fine, and thi… --- ## [UDP Input and Multiline codec](https://discuss.elastic.co/t/udp-input-and-multiline-codec/54758)
**Author:** [@eperry](https://discuss.elastic.co/u/eperry)\ **Replies:** 2\ **Last updated:** [July 6, 2016, 2:52pm UTC](https://discuss.elastic.co/t/udp-input-and-multiline-codec/54758 "2016-07-06T14:52:19Z")
I did not have time to look though the code yet but was hoping for a quick answer Does the multi line codec apply to all incoming data (IE possible to have 2 different servers mix data together. Or does the UDP Listener… --- ## [Logstash fails to parse array index from URL](https://discuss.elastic.co/t/logstash-fails-to-parse-array-index-from-url/54832)
**Author:** [@ihanli](https://discuss.elastic.co/u/ihanli)\ **Replies:** 0\ **Last updated:** [July 6, 2016, 2:00pm UTC](https://discuss.elastic.co/t/logstash-fails-to-parse-array-index-from-url/54832 "2016-07-06T14:00:22Z")
I'm trying to extract query parameters from an URL. The troubling line from the log file I'm parsing, looks something like this: 127.0.0.1 - - \[09/May/2016:09:32:19 +0200\] "GET /ps?attrib\[vendor\]\[\]=GOK&attrib\[vendor\]\[0\]… --- ## [Recollect data, events, logs from a host network](https://discuss.elastic.co/t/recollect-data-events-logs-from-a-host-network/54759)
**Author:** [@Juan\_Diaz\_Gonzalez](https://discuss.elastic.co/u/Juan_Diaz_Gonzalez)\ **Replies:** 2\ **Last updated:** [July 6, 2016, 7:10am UTC](https://discuss.elastic.co/t/recollect-data-events-logs-from-a-host-network/54759 "2016-07-06T07:10:29Z")
I need recollect data from logs and events in a host network. What do you me recomend Logstashs or Beats ?? Thanks in advance --- ## [Logstah do not parse csv](https://discuss.elastic.co/t/logstah-do-not-parse-csv/54762)
**Author:** [@antonin42](https://discuss.elastic.co/u/antonin42)\ **Replies:** 2\ **Last updated:** [July 6, 2016, 7:07am UTC](https://discuss.elastic.co/t/logstah-do-not-parse-csv/54762 "2016-07-06T07:07:04Z")
Hi there with a simple config, to check that logstash works correctly, I get no output : input { file { path =\> \["/home/dive/fromJenkins/es\_files/data/MRC\_reit\_test/output/reiteration\_t1\_mono\*.csv"\] start\_po… --- ## [File Grew, but sincedb does not keep up with file](https://discuss.elastic.co/t/file-grew-but-sincedb-does-not-keep-up-with-file/54780)
**Author:** [@Rena](https://discuss.elastic.co/u/Rena)\ **Replies:** 0\ **Last updated:** [July 5, 2016, 8:47pm UTC](https://discuss.elastic.co/t/file-grew-but-sincedb-does-not-keep-up-with-file/54780 "2016-07-05T20:47:34Z")
I started logstash in debug against a small directory of files. 3 of the files were written to and consumed. One of the files is continuing to grow. I see the corresponding logging when the file grows {:timestamp=\>"2… --- ## [Logstash Too many open files](https://discuss.elastic.co/t/logstash-too-many-open-files/35589)
**Author:** [@Chris\_Clifton](https://discuss.elastic.co/u/Chris_Clifton)\ **Replies:** 7\ **Last updated:** [July 5, 2016, 7:10pm UTC](https://discuss.elastic.co/t/logstash-too-many-open-files/35589 "2016-07-05T19:10:46Z")
Hi, running logstash 2.0.0-1 on Ubuntu 12.04.3 LTS , logstash running for about 24 hours then dying with 'Too many open files' paste -\> http://pastebin.com/YsyKPUTL ES is running on this same host, with two hosts s… --- ## [Can not ship logs to elasticsearch ? any idea](https://discuss.elastic.co/t/can-not-ship-logs-to-elasticsearch-any-idea/54561)
**Author:** [@nanshan](https://discuss.elastic.co/u/nanshan)\ **Replies:** 2\ **Last updated:** [July 5, 2016, 7:04pm UTC](https://discuss.elastic.co/t/can-not-ship-logs-to-elasticsearch-any-idea/54561 "2016-07-05T19:04:30Z")
{:timestamp=\>"2016-07-01T18:57:37.916000+0000", :message=\>"Failed to flush outgoing items", :outgoing\_count=\>1, :exception=\>"NoMethodError", :backtrace=\>\["/opt/logstash/vendor/bundle/jruby/1.9/gems/aws-sdk-core-2.1.36/li… --- ## [Logstash stops unexpectedly](https://discuss.elastic.co/t/logstash-stops-unexpectedly/53583)
**Author:** [@nanshan](https://discuss.elastic.co/u/nanshan)\ **Replies:** 2\ **Last updated:** [July 5, 2016, 7:02pm UTC](https://discuss.elastic.co/t/logstash-stops-unexpectedly/53583 "2016-07-05T19:02:59Z")
22:33:34 dev-ore-logstash-i-fa73bf55 root ~ \> service logstash status logstash is running 22:33:35 dev-ore-logstash-i-fa73bf55 root ~ \> service logstash status logstash is not running 22:33:36 dev-ore-logstash-i-fa73bf55… --- ## [Logstash filters for VMware VPXA logs](https://discuss.elastic.co/t/logstash-filters-for-vmware-vpxa-logs/54769)
**Author:** [@Geezer](https://discuss.elastic.co/u/Geezer)\ **Replies:** 0\ **Last updated:** [July 5, 2016, 5:38pm UTC](https://discuss.elastic.co/t/logstash-filters-for-vmware-vpxa-logs/54769 "2016-07-05T17:38:07Z")
Hello, We are ingesting vmware vpxa logs from our ESX servers into Elasticsearch but parsing is problematic as every agent on the ESX servers seems to have a different message format. Sexilog produced an ELK applian… --- ## [Logstash stopped due to throttle](https://discuss.elastic.co/t/logstash-stopped-due-to-throttle/36257)
**Author:** [@marcmga](https://discuss.elastic.co/u/marcmga)\ **Replies:** 21\ **Last updated:** [July 5, 2016, 3:29pm UTC](https://discuss.elastic.co/t/logstash-stopped-due-to-throttle/36257 "2016-07-05T15:29:26Z")
Hi, I have an issue in logstash. It stopped suddenly and no event are parsed. If i check logstas.err and .stadout no entries apear, BUT in .log it appears an error which is causing this behaviour in logstash. I copy … --- ## [Logstash Imap for shared mailbox](https://discuss.elastic.co/t/logstash-imap-for-shared-mailbox/51808)
**Author:** [@Alex.C](https://discuss.elastic.co/u/Alex.C)\ **Replies:** 1\ **Last updated:** [July 5, 2016, 3:21pm UTC](https://discuss.elastic.co/t/logstash-imap-for-shared-mailbox/51808 "2016-07-05T15:21:31Z")
Hello, I have a mailbox bind with shared mailbox on office365. My mailbox is define: user@mydomain.com My shared mailbox is define: sharedmailbox01@subdomain.mydomain.com Reffering to this article : Access Shared mai… --- ## [Http\_poller input plugin: connect\_timeout ignored](https://discuss.elastic.co/t/http-poller-input-plugin-connect-timeout-ignored/54738)
**Author:** [@mguiwin](https://discuss.elastic.co/u/mguiwin)\ **Replies:** 1\ **Last updated:** [July 5, 2016, 3:06pm UTC](https://discuss.elastic.co/t/http-poller-input-plugin-connect-timeout-ignored/54738 "2016-07-05T15:06:28Z")
Hi, It seems like the http\_poller input plugin ignores the connect\_timeout setting. Using: logstash 2.3.2 logstash-input-http\_poller 2.0.6 Here is my http\_poller conf: input { http\_poller { urls =\> { … --- ## [Logstash 2.3.3 does not run as a service on red hat](https://discuss.elastic.co/t/logstash-2-3-3-does-not-run-as-a-service-on-red-hat/54718)
**Author:** [@arek](https://discuss.elastic.co/u/arek)\ **Replies:** 2\ **Last updated:** [July 5, 2016, 2:49pm UTC](https://discuss.elastic.co/t/logstash-2-3-3-does-not-run-as-a-service-on-red-hat/54718 "2016-07-05T14:49:37Z")
Hi, I downloaded .tar version of logstash 2.3.3 and trying to running it as service, but it fails. My system is Red Hat Enterprise Linux Server release 6.6 (Santiago). When I am testing configuration file everything's o… --- ## [Logstash input twitter authorized error](https://discuss.elastic.co/t/logstash-input-twitter-authorized-error/41074)
**Author:** [@kamyabali7](https://discuss.elastic.co/u/kamyabali7)\ **Replies:** 2\ **Last updated:** [July 5, 2016, 2:04pm UTC](https://discuss.elastic.co/t/logstash-input-twitter-authorized-error/41074 "2016-07-05T14:04:46Z")
Any one have experience with below error ? Please help me Logstash startup completed ←\[33m {:exception=\>Twitter::Error::Unauthorized, :backtrace=\>\["C:/logstash-1.5.1 /vendor/bundle/jruby/1.9/gems/twitter-5.12.0/lib/… --- ## [Detect the last character of a field](https://discuss.elastic.co/t/detect-the-last-character-of-a-field/54731)
**Author:** [@noemie](https://discuss.elastic.co/u/noemie)\ **Replies:** 1\ **Last updated:** [July 5, 2016, 1:30pm UTC](https://discuss.elastic.co/t/detect-the-last-character-of-a-field/54731 "2016-07-05T13:30:29Z")
Hello, I'd like to detect of the last character of a field is "/" so I can know whether I'm accessing a directory or a file. Is it possible? Thanks for your help, Noémie --- ## [Target required xml-filter option](https://discuss.elastic.co/t/target-required-xml-filter-option/54700)
**Author:** [@tollef](https://discuss.elastic.co/u/tollef)\ **Replies:** 4\ **Last updated:** [July 5, 2016, 12:21pm UTC](https://discuss.elastic.co/t/target-required-xml-filter-option/54700 "2016-07-05T12:21:37Z")
I'm using a quite simple xml-filter filter { xml { source =\> "recordedmessage" } } But when I run logstash I get "ConfigurationError: translation missing" and logstash stops. So I changed the filter to filter… --- ## [Mutate switch statement?](https://discuss.elastic.co/t/mutate-switch-statement/54720)
**Author:** [@memelet](https://discuss.elastic.co/u/memelet)\ **Replies:** 2\ **Last updated:** [July 5, 2016, 11:58am UTC](https://discuss.elastic.co/t/mutate-switch-statement/54720 "2016-07-05T11:58:41Z")
I am trying to convert the mongodb log levels from single characters to normal values. Is there a simpler way to do this than: if \[level\] == "D" { mutate { gsub =\> \[ "level", "D", "DEBUG" \] } } … --- ## [\[SOLVED\] SNMP trap input plugin](https://discuss.elastic.co/t/solved-snmp-trap-input-plugin/53742)
**Author:** [@def](https://discuss.elastic.co/u/def)\ **Replies:** 3\ **Last updated:** [July 5, 2016, 11:32am UTC](https://discuss.elastic.co/t/solved-snmp-trap-input-plugin/53742 "2016-07-05T11:32:33Z")
Hello, I have a question : Is it possible to limit the fields value for the output in logstash? I'm using SNMP trap and I have a lot of different type of MIB, so I have a lot of indexed fields in Kibana and after few … --- ## [Logstash (grokparsefailure)](https://discuss.elastic.co/t/logstash-grokparsefailure/54717)
**Author:** [@gfst1](https://discuss.elastic.co/u/gfst1)\ **Replies:** 3\ **Last updated:** [July 5, 2016, 11:23am UTC](https://discuss.elastic.co/t/logstash-grokparsefailure/54717 "2016-07-05T11:23:10Z")
Hi!!! I have a problem, please help=( message 2W\\u0000\\u0000\\u0000\\u00012C\\u0000\\u0000\\u0000\\xFAx^l\\x90\\xCFN\\xC30\\f\\x87ǛT\>g\]\\x93u\\xCD\\xC8i\\xE2\\xC8\\u0015N Te\\xAD\[\\"\\xF2\\xA7J\\xD2ISŻ\\xE3\\x8E\\v\\b\\xA4\\u001C\\xA2\\xCF\\xF2g\\xF… --- ## [Need VHOST field with COMBINEDAPACHELOG](https://discuss.elastic.co/t/need-vhost-field-with-combinedapachelog/54675)
**Author:** [@infinitetutts](https://discuss.elastic.co/u/infinitetutts)\ **Replies:** 2\ **Last updated:** [July 5, 2016, 10:49am UTC](https://discuss.elastic.co/t/need-vhost-field-with-combinedapachelog/54675 "2016-07-05T10:49:39Z")
How do I add 'site.com' as a new field ? Logstash Config: filter { if \[type\] == "apache" { grok { match =\> \[ "message", "%{URIHOST} %{COMBINEDAPACHELOG}" \] } } } Apache Log: … --- ## [Single logstash forwarder sending log to multiple servers](https://discuss.elastic.co/t/single-logstash-forwarder-sending-log-to-multiple-servers/54708)
**Author:** [@bubu.senapati](https://discuss.elastic.co/u/bubu.senapati)\ **Replies:** 3\ **Last updated:** [July 5, 2016, 10:06am UTC](https://discuss.elastic.co/t/single-logstash-forwarder-sending-log-to-multiple-servers/54708 "2016-07-05T10:06:54Z")
Hi Magnus, I have a logstash forwarder which sends multiple log files to multiple servers. There are two log files- application1.log and application2.log application1.log needs to sent to logstash1 in server1. appli… --- ## [Mapping to type long fails when dynamic template is used](https://discuss.elastic.co/t/mapping-to-type-long-fails-when-dynamic-template-is-used/54694)
**Author:** [@YuWatanabe](https://discuss.elastic.co/u/YuWatanabe)\ **Replies:** 1\ **Last updated:** [July 5, 2016, 8:51am UTC](https://discuss.elastic.co/t/mapping-to-type-long-fails-when-dynamic-template-is-used/54694 "2016-07-05T08:51:40Z")
Hello. I would like to ask question about creating a index in elasticsearch. My Question Why is elasicsearch rejecting the indexing for field which has type : long? What am I trying to do? I am indexing the linux s… --- ## [Index not returning results - No results found](https://discuss.elastic.co/t/index-not-returning-results-no-results-found/54630)
**Author:** [@Karpagavinayagam\_U](https://discuss.elastic.co/u/Karpagavinayagam_U)\ **Replies:** 1\ **Last updated:** [July 5, 2016, 7:20am UTC](https://discuss.elastic.co/t/index-not-returning-results-no-results-found/54630 "2016-07-05T07:20:43Z")
Hey users Been trying to figure out below issues but not successful. I created an index to match a data pattern in elasticsearch - but not fetching results when i discover Results are displaying for default logstash-\*… --- ## [Logstash keep logging into default index](https://discuss.elastic.co/t/logstash-keep-logging-into-default-index/53643)
**Author:** [@siasic](https://discuss.elastic.co/u/siasic)\ **Replies:** 5\ **Last updated:** [July 5, 2016, 6:55am UTC](https://discuss.elastic.co/t/logstash-keep-logging-into-default-index/53643 "2016-07-05T06:55:44Z")
Hello, I have got an issue with logstash when i want to output logs into elasticsearch. In my configuration below i specify an index for my logs from filebeat, but it seems that they are finally store in that index AND… --- ## [Timestamp question](https://discuss.elastic.co/t/timestamp-question/54618)
**Author:** [@Uros\_Meglic](https://discuss.elastic.co/u/Uros_Meglic)\ **Replies:** 2\ **Last updated:** [July 5, 2016, 6:31am UTC](https://discuss.elastic.co/t/timestamp-question/54618 "2016-07-05T06:31:59Z")
Hello, I was just wondering what would be the correct setup for when the original logs that are being passed to logstash have a date time field that is all ready saved as UTC. Thats 2 hours behind local time. I set t… --- ## [Is it possible to set variables in file path?](https://discuss.elastic.co/t/is-it-possible-to-set-variables-in-file-path/54682)
**Author:** [@Morriaty](https://discuss.elastic.co/u/Morriaty)\ **Replies:** 1\ **Last updated:** [July 5, 2016, 6:13am UTC](https://discuss.elastic.co/t/is-it-possible-to-set-variables-in-file-path/54682 "2016-07-05T06:13:36Z")
I have a directory contains too many logs which were named as log-YYYYMMDD ranging from 5 years ago to now. I do not want Logstash to parse the old logs. So I need something like this input { file { param =\> {… --- ## [Adding a custom plug from juniper to my logstash](https://discuss.elastic.co/t/adding-a-custom-plug-from-juniper-to-my-logstash/54681)
**Author:** [@lucas\_restrepo](https://discuss.elastic.co/u/lucas_restrepo)\ **Replies:** 1\ **Last updated:** [July 5, 2016, 1:34am UTC](https://discuss.elastic.co/t/adding-a-custom-plug-from-juniper-to-my-logstash/54681 "2016-07-05T01:34:54Z")
Hi, I am working on my own kibana dashboard. I got the plugin from an instalation of this plug on a juniper instalation. I check all the documentation and they created the plugin from logstash syslog-filter, geoip, and s… --- ## [Logstash 5 Alpha3 is not starting up](https://discuss.elastic.co/t/logstash-5-alpha3-is-not-starting-up/54646)
**Author:** [@gaurav\_S\_javheri](https://discuss.elastic.co/u/gaurav_S_javheri)\ **Replies:** 1\ **Last updated:** [July 4, 2016, 10:58pm UTC](https://discuss.elastic.co/t/logstash-5-alpha3-is-not-starting-up/54646 "2016-07-04T22:58:18Z")
On starting /etc/init.d/logstash start . It is giving below error message=\>"An unexpected error occurred!", :error=\>#, :backtrace=\>\["org/jruby/ext/socket/RubyTCPServer.java:118:in initialize'", "org/jruby/RubyIO.java:… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1130) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1132)