# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1135 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1136 --- ## [Grok filter do not get a tag if parsing failed (tag\_on\_failure)](https://discuss.elastic.co/t/grok-filter-do-not-get-a-tag-if-parsing-failed-tag-on-failure/54168)
**Author:** [@elkonaut](https://discuss.elastic.co/u/elkonaut)\ **Replies:** 0\ **Last updated:** [June 28, 2016, 1:51pm UTC](https://discuss.elastic.co/t/grok-filter-do-not-get-a-tag-if-parsing-failed-tag-on-failure/54168 "2016-06-28T13:51:25Z")
I am using filebeat to transfer files to logstash. In logstash I am using the following configuration: filter { grok { match =\> { "message" =\> "%{DATESTAMP:date1}%{SPACE}%{LOGLEVEL:severity}%{SPACE}\[(?\[a-zA-Z0-… --- ## [Logstash-output-kafka stops producing data without error if topic is not valid](https://discuss.elastic.co/t/logstash-output-kafka-stops-producing-data-without-error-if-topic-is-not-valid/54167)
**Author:** [@fld](https://discuss.elastic.co/u/fld)\ **Replies:** 0\ **Last updated:** [June 28, 2016, 1:35pm UTC](https://discuss.elastic.co/t/logstash-output-kafka-stops-producing-data-without-error-if-topic-is-not-valid/54167 "2016-06-28T13:35:09Z")
When using kafka output plugin, if your topic is extracted using a grok filter and if for some reason the filter fails (grokparsefailure), then the output plugin is blocked and no explicit error is produced. Steps to re… --- ## [E-mail plugin conditional expression](https://discuss.elastic.co/t/e-mail-plugin-conditional-expression/47120)
**Author:** [@rafaellamuniz](https://discuss.elastic.co/u/rafaellamuniz)\ **Replies:** 6\ **Last updated:** [June 28, 2016, 12:11pm UTC](https://discuss.elastic.co/t/e-mail-plugin-conditional-expression/47120 "2016-06-28T12:11:15Z")
Hello, I'm trying to configure the e-mail plugin for Topbeat. I would like to receive an e-mail when the variable fs.used\_p is greather than 70%. However the sintax is not working for the conditional: if \[fs\]\[used\_p\]… --- ## [File output message\_format replacement](https://discuss.elastic.co/t/file-output-message-format-replacement/54135)
**Author:** [@devjr](https://discuss.elastic.co/u/devjr)\ **Replies:** 1\ **Last updated:** [June 28, 2016, 10:25am UTC](https://discuss.elastic.co/t/file-output-message-format-replacement/54135 "2016-06-28T10:25:28Z")
Hello, I am seeing in the latest documentation that the message\_format setting is deprecated in file output. What can I use as a replacement ? I tried to google that with no luck :frowning: Thank you --- ## [File plugin doesn't read file](https://discuss.elastic.co/t/file-plugin-doesnt-read-file/49052)
**Author:** [@noemie](https://discuss.elastic.co/u/noemie)\ **Replies:** 6\ **Last updated:** [June 28, 2016, 8:21am UTC](https://discuss.elastic.co/t/file-plugin-doesnt-read-file/49052 "2016-06-28T08:21:30Z")
Hello, I just upgraded logstash version to 2.3.2. My config file worked fine on the previous version I had (2.3.1 i think) but since I upgraded, it seems like the log files I specified for the file plugin aren't read. … --- ## [Anyone have IPFIX working?](https://discuss.elastic.co/t/anyone-have-ipfix-working/53916)
**Author:** [@zbare](https://discuss.elastic.co/u/zbare)\ **Replies:** 1\ **Last updated:** [June 28, 2016, 7:15am UTC](https://discuss.elastic.co/t/anyone-have-ipfix-working/53916 "2016-06-28T07:15:38Z")
I apologize if this is the wrong place to ask this or if my question has already been answered. I did a search and didn't find anything that answered my questions. Is anyone successfully using ELK to collect and visual… --- ## [Logstash - parsing data for more than one alerts in a single message](https://discuss.elastic.co/t/logstash-parsing-data-for-more-than-one-alerts-in-a-single-message/54114)
**Author:** [@bhawanaus](https://discuss.elastic.co/u/bhawanaus)\ **Replies:** 0\ **Last updated:** [June 28, 2016, 6:47am UTC](https://discuss.elastic.co/t/logstash-parsing-data-for-more-than-one-alerts-in-a-single-message/54114 "2016-06-28T06:47:57Z")
I've a scenario where I've to parse logs in logstash and create some visualizations. Below is an example log .. 25 Jun 2016 20:53:10,674 \[http-bio-8080-exec-20\] INFO com.employee.controller.EmloyeeController - \[2016-0… --- ## [Remote file collection (rsync, scp, ...)](https://discuss.elastic.co/t/remote-file-collection-rsync-scp/54063)
**Author:** [@echalmer](https://discuss.elastic.co/u/echalmer)\ **Replies:** 1\ **Last updated:** [June 28, 2016, 6:27am UTC](https://discuss.elastic.co/t/remote-file-collection-rsync-scp/54063 "2016-06-28T06:27:33Z")
I need to collect log files from a closed appliance. I cannot configure the appliance to send log events out with syslog. I cannot install software on the appliance. I can copy files from the appliance, e.g. with rsync o… --- ## [Export/Import kibana dashboards](https://discuss.elastic.co/t/export-import-kibana-dashboards/53786)
**Author:** [@ervin](https://discuss.elastic.co/u/ervin)\ **Replies:** 1\ **Last updated:** [June 28, 2016, 3:33am UTC](https://discuss.elastic.co/t/export-import-kibana-dashboards/53786 "2016-06-28T03:33:46Z")
Hi, I am trying to migrate dashboards from one development environment to other and of-course I want to automate that for the future use :slight\_smile: I found out from https://www.elastic.co/guide/en/beats/libbeat/m… --- ## [Logstash Bind Issue? (solved](https://discuss.elastic.co/t/logstash-bind-issue-solved/53222)
**Author:** [@killmasta93](https://discuss.elastic.co/u/killmasta93)\ **Replies:** 13\ **Last updated:** [June 28, 2016, 3:03am UTC](https://discuss.elastic.co/t/logstash-bind-issue-solved/53222 "2016-06-28T03:03:25Z")
Hi, I was wondering if someone has had this issue before? So everything is working on my Ubuntu server 14.04 and the logs are coming in no issue there. But when i need to check something with tail -f /var/log/logstas… --- ## [Templates and not\_analyzed not working](https://discuss.elastic.co/t/templates-and-not-analyzed-not-working/54069)
**Author:** [@Janet](https://discuss.elastic.co/u/Janet)\ **Replies:** 1\ **Last updated:** [June 27, 2016, 9:19pm UTC](https://discuss.elastic.co/t/templates-and-not-analyzed-not-working/54069 "2016-06-27T21:19:21Z")
I'm using logstash & es 2.3.3. I can't seem to successfully set any field to not\_analyzed in a template. It's not just me, I can use the default logstash template, and kibana still shows the @version field is analyzed,… --- ## [Bulk handling of logstash conf files](https://discuss.elastic.co/t/bulk-handling-of-logstash-conf-files/52803)
**Author:** [@Kennedy\_Kan1](https://discuss.elastic.co/u/Kennedy_Kan1)\ **Replies:** 4\ **Last updated:** [June 27, 2016, 8:36pm UTC](https://discuss.elastic.co/t/bulk-handling-of-logstash-conf-files/52803 "2016-06-27T20:36:16Z")
I have like 10 clients using logstash to send data to a central ES server, however, everytime when I have some modification to the conf files, I needed to modify each clients logstash conf files. That could be so time co… --- ## [Parent-Child Relationship with logstash](https://discuss.elastic.co/t/parent-child-relationship-with-logstash/33545)
**Author:** [@Hornov](https://discuss.elastic.co/u/Hornov)\ **Replies:** 5\ **Last updated:** [June 27, 2016, 7:52pm UTC](https://discuss.elastic.co/t/parent-child-relationship-with-logstash/33545 "2016-06-27T19:52:50Z")
I try to integrade child data with logstash but I can't. For example I tried to use a \_parent field with the value of the parent id but it did'nt work. Do you have any idea ? --- ## [\[CLOSED \]Logstash crash after service start logstash](https://discuss.elastic.co/t/closed-logstash-crash-after-service-start-logstash/51324)
**Author:** [@zendel](https://discuss.elastic.co/u/zendel)\ **Replies:** 10\ **Last updated:** [June 27, 2016, 3:31pm UTC](https://discuss.elastic.co/t/closed-logstash-crash-after-service-start-logstash/51324 "2016-06-27T15:31:02Z")
hello, i'm using logstash on ubuntu (14.04LTS) with logstash\_2.3.1-1\_all.deb After installation with dpkg, i'm trying to start logstash but logstash always stop after 30 secondes. I already check my conf file, it's OK.… --- ## [Need some help with Geo Enrichment - SOLVED](https://discuss.elastic.co/t/need-some-help-with-geo-enrichment-solved/42340)
**Author:** [@Wayne\_Taylor](https://discuss.elastic.co/u/Wayne_Taylor)\ **Replies:** 11\ **Last updated:** [June 27, 2016, 1:28pm UTC](https://discuss.elastic.co/t/need-some-help-with-geo-enrichment-solved/42340 "2016-06-27T13:28:33Z")
Hi All, I have a logstash configuration which is getting sales activity from a JDBC connection. This data has a locatorID. My configuration looks like: \`input { jdbc { jdbc\_connection\_string =\> "… --- ## [Converting string field to integer](https://discuss.elastic.co/t/converting-string-field-to-integer/53853)
**Author:** [@Gaurav\_SK](https://discuss.elastic.co/u/Gaurav_SK)\ **Replies:** 2\ **Last updated:** [June 27, 2016, 11:12am UTC](https://discuss.elastic.co/t/converting-string-field-to-integer/53853 "2016-06-27T11:12:11Z")
I am getting the value of a field name "fcs" through pattern but i want this to be in integer format, but when i open settings in kibana, it says this field has string type. Can anyone tell how to resolve this issue ? … --- ## [Logstash File plugin custom delimiter](https://discuss.elastic.co/t/logstash-file-plugin-custom-delimiter/50013)
**Author:** [@revendar](https://discuss.elastic.co/u/revendar)\ **Replies:** 1\ **Last updated:** [June 27, 2016, 9:45am UTC](https://discuss.elastic.co/t/logstash-file-plugin-custom-delimiter/50013 "2016-06-27T09:45:12Z")
I'm using logstash for quite a time. I tried using a custom delimiter in File plugin. I'm reading a static file. I see file plugin extracts 32KB data and passes it to tokenizer for splitting by delimiter. data = watch… --- ## [\[SOLVED\] Drop when a field is equal to](https://discuss.elastic.co/t/solved-drop-when-a-field-is-equal-to/54003)
**Author:** [@Alex\_Lum](https://discuss.elastic.co/u/Alex_Lum)\ **Replies:** 2\ **Last updated:** [June 27, 2016, 8:12am UTC](https://discuss.elastic.co/t/solved-drop-when-a-field-is-equal-to/54003 "2016-06-27T08:12:36Z")
Hello all. A new question, i need to drop lines when a fieldname is equal to something. example : Jun 27 09:27:37 10.0.6.1 date=2016-06-27 time=09:27:37 logid=0000000013 type=traffic subtype=forward level=notice dsti… --- ## [Keeping values across events](https://discuss.elastic.co/t/keeping-values-across-events/53901)
**Author:** [@DMJ](https://discuss.elastic.co/u/DMJ)\ **Replies:** 4\ **Last updated:** [June 26, 2016, 5:44am UTC](https://discuss.elastic.co/t/keeping-values-across-events/53901 "2016-06-26T05:44:43Z")
How can I store a date and assign it to upcoming events? Also I want to update the variable to new date when I find a new one. --- ## [Grokparsefailure always](https://discuss.elastic.co/t/grokparsefailure-always/53939)
**Author:** [@bmonikraj](https://discuss.elastic.co/u/bmonikraj)\ **Replies:** 1\ **Last updated:** [June 25, 2016, 4:14pm UTC](https://discuss.elastic.co/t/grokparsefailure-always/53939 "2016-06-25T16:14:34Z")
When I have developed my own custom pattern for logstash to parse Cordys error logs(XML Type) , and used %{COMBINEDAPACHELOG} for Apache server log parsing, I am getting the answer perfectly in Grok debugger available on… --- ## [What is better Transport protocol or http with SSL for communcation between logstash and elasticsearch?](https://discuss.elastic.co/t/what-is-better-transport-protocol-or-http-with-ssl-for-communcation-between-logstash-and-elasticsearch/53686)
**Author:** [@shankar\_roy](https://discuss.elastic.co/u/shankar_roy)\ **Replies:** 1\ **Last updated:** [June 25, 2016, 11:06am UTC](https://discuss.elastic.co/t/what-is-better-transport-protocol-or-http-with-ssl-for-communcation-between-logstash-and-elasticsearch/53686 "2016-06-25T11:06:26Z")
What is better Transport protocol or http with SSL for communcation between logstash and elasticsearch? According to the documentation at Using Logstash with Shield | Shield \[2.4\] | Elastic Connecting with Transport pr… --- ## [Postfix grok patterns not working](https://discuss.elastic.co/t/postfix-grok-patterns-not-working/53741)
**Author:** [@raamee](https://discuss.elastic.co/u/raamee)\ **Replies:** 3\ **Last updated:** [June 24, 2016, 12:49pm UTC](https://discuss.elastic.co/t/postfix-grok-patterns-not-working/53741 "2016-06-24T12:49:09Z")
Hello, I'm trying to filter postfix logs using the grok patterns posted here: https://github.com/whyscream/postfix-grok-patterns The thing is, its not filtering the postfix logs properly. It is not segregating the me… --- ## [Mutate gsub Email Address](https://discuss.elastic.co/t/mutate-gsub-email-address/53878)
**Author:** [@Pedro\_Lopes](https://discuss.elastic.co/u/Pedro_Lopes)\ **Replies:** 1\ **Last updated:** [June 24, 2016, 10:49am UTC](https://discuss.elastic.co/t/mutate-gsub-email-address/53878 "2016-06-24T10:49:48Z")
Hello guys, I'm using ELK for 2 days now, to parse a CSV and see it in Kibana. My doubt is about mutate. I have a field with a email address I can easily do this: mutate{ gsub=\> \["col2",".\*@","@"\] } In this c… --- ## [Logstash-all-plugins-2.3.1 connect to Sybase error](https://discuss.elastic.co/t/logstash-all-plugins-2-3-1-connect-to-sybase-error/49879)
**Author:** [@zhanght1](https://discuss.elastic.co/u/zhanght1)\ **Replies:** 1\ **Last updated:** [June 24, 2016, 9:55am UTC](https://discuss.elastic.co/t/logstash-all-plugins-2-3-1-connect-to-sybase-error/49879 "2016-06-24T09:55:59Z")
After I configure the logstash.conf input{ jdbc { jdbc\_driver\_library =\> "/data/logstash/vendor/jar/jdbc/jconn3.jar" jdbc\_driver\_class =\> "com.sybase.jdbc3.jdbc.SybDriver" jdbc\_connection\_string =\> "jdbc:sy… --- ## [How to set the where filter about sql\_last\_value?](https://discuss.elastic.co/t/how-to-set-the-where-filter-about-sql-last-value/53621)
**Author:** [@laoyang360](https://discuss.elastic.co/u/laoyang360)\ **Replies:** 2\ **Last updated:** [June 24, 2016, 5:39am UTC](https://discuss.elastic.co/t/how-to-set-the-where-filter-about-sql-last-value/53621 "2016-06-24T05:39:17Z")
I have been already installed Logstash JDBC Input Plugin successfully. And I set sql as follows: select \* from cc where cc.last\_modify\_time \>= :smile: sql\_last\_value I already know the cc.last\_modify\_time setting i… --- ## [Cannot install custom plugin on logstash stable (2.3.2) because logstash-filter-example depends on logstash-core-plugin-api, "~\> 2.0"](https://discuss.elastic.co/t/cannot-install-custom-plugin-on-logstash-stable-2-3-2-because-logstash-filter-example-depends-on-logstash-core-plugin-api-2-0/53804)
**Author:** [@patc](https://discuss.elastic.co/u/patc)\ **Replies:** 0\ **Last updated:** [June 23, 2016, 4:20pm UTC](https://discuss.elastic.co/t/cannot-install-custom-plugin-on-logstash-stable-2-3-2-because-logstash-filter-example-depends-on-logstash-core-plugin-api-2-0/53804 "2016-06-23T16:20:14Z")
I just finished writing a logstash-filter plugin with the most recent logstash-filter-example from github. When I went to install the plugin on logstash 2.3.2, I was unable to complete the installation because logstash 2… --- ## [Webhdfs - error](https://discuss.elastic.co/t/webhdfs-error/53796)
**Author:** [@jay224](https://discuss.elastic.co/u/jay224)\ **Replies:** 0\ **Last updated:** [June 23, 2016, 3:35pm UTC](https://discuss.elastic.co/t/webhdfs-error/53796 "2016-06-23T15:35:52Z")
I am getting following error while writing output to webhdfs. "Webhdfs check request failed. (namenode: 1\*\*\*\*\*:50070, Exception: {"RemoteException":{"exception":"StandbyException","javaClassName":"org.apache.hadoop.ipc.S… --- ## [Logstash active exited using filebeat input](https://discuss.elastic.co/t/logstash-active-exited-using-filebeat-input/53552)
**Author:** [@William\_Leclerc](https://discuss.elastic.co/u/William_Leclerc)\ **Replies:** 1\ **Last updated:** [June 21, 2016, 7:05pm UTC](https://discuss.elastic.co/t/logstash-active-exited-using-filebeat-input/53552 "2016-06-21T19:05:45Z")
I have a Logstash, Elasticsearch and Kibana service running on a server and Filebeat running on another server to test configurations. Everything is running fine with the following config, logs are forwarded to my elasti… --- ## [Logstash input jdbc](https://discuss.elastic.co/t/logstash-input-jdbc/33831)
**Author:** [@vikas.saini](https://discuss.elastic.co/u/vikas.saini)\ **Replies:** 3\ **Last updated:** [June 23, 2016, 2:25pm UTC](https://discuss.elastic.co/t/logstash-input-jdbc/33831 "2016-06-23T14:25:33Z")
file: contacts-index-logstash.conf input { jdbc { jdbc\_connection\_string =\> "jdbc:oracle:thin:@//192.168.54.74:1521/od6oracle" jdbc\_user =\> "od6oracle" jdbc\_password =\> "od6oracle" jd… --- ## [Integrate logstash with zabbix 2.2 for getting alerts](https://discuss.elastic.co/t/integrate-logstash-with-zabbix-2-2-for-getting-alerts/53772)
**Author:** [@Sarath\_S](https://discuss.elastic.co/u/Sarath_S)\ **Replies:** 2\ **Last updated:** [June 23, 2016, 1:06pm UTC](https://discuss.elastic.co/t/integrate-logstash-with-zabbix-2-2-for-getting-alerts/53772 "2016-06-23T13:06:23Z")
OS: Ubuntu 14.04 I would like to Integrate logstash with zabbix for getting alerts while logstash getting error messages from openstack node logs. I have already configured ELK stack and Zabbix which are working calm.… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1134) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1136)