# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1146 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1147 --- ## [Question about geopoint](https://discuss.elastic.co/t/question-about-geopoint/51700)
**Author:** [@dihpierrick](https://discuss.elastic.co/u/dihpierrick)\ **Replies:** 0\ **Last updated:** [June 2, 2016, 1:27pm UTC](https://discuss.elastic.co/t/question-about-geopoint/51700 "2016-06-02T13:27:17Z")
Hi everyone , I have a question about geopoint fields. In the Elasticsearch definitive guide we can read : A geo-point is a single latitude/longitude point on the Earth’s surface. So it is quite clear \[:smile:\] But in… --- ## [Logstash jruby behavior on windows](https://discuss.elastic.co/t/logstash-jruby-behavior-on-windows/50955)
**Author:** [@mmarkzon](https://discuss.elastic.co/u/mmarkzon)\ **Replies:** 3\ **Last updated:** [June 2, 2016, 7:22pm UTC](https://discuss.elastic.co/t/logstash-jruby-behavior-on-windows/50955 "2016-06-02T19:22:24Z")
I have two identical Windows 2012 R2 boxes that I am seeing different behavior on when I try to run Logstash 2.3.2. Both have JRE 1.8.0\_73 with JAVA\_HOME set. On one box, when I run logstash I get a java.exe process … --- ## [Multiline grok problem](https://discuss.elastic.co/t/multiline-grok-problem/51608)
**Author:** [@James\_Beal](https://discuss.elastic.co/u/James_Beal)\ **Replies:** 2\ **Last updated:** [June 2, 2016, 5:43pm UTC](https://discuss.elastic.co/t/multiline-grok-problem/51608 "2016-06-02T17:43:25Z")
I am reading in the mysql slow log with a multiline filebeat, I would like to parse it in logstash. My log line looks like: # Time: 160601 19:29:43 # User@Host: root\[root\] @ localhost \[\] Id: 1055005 # Schema: Last\_… --- ## [Logstash's log files in Windows](https://discuss.elastic.co/t/logstashs-log-files-in-windows/51330)
**Author:** [@BanksySan](https://discuss.elastic.co/u/BanksySan)\ **Replies:** 6\ **Last updated:** [June 2, 2016, 5:35pm UTC](https://discuss.elastic.co/t/logstashs-log-files-in-windows/51330 "2016-06-02T17:35:01Z")
Where are the logstash log files in Windows? --- ## [\[Solved\] Logstash 5 alpha3 not starting](https://discuss.elastic.co/t/solved-logstash-5-alpha3-not-starting/51641)
**Author:** [@zozo6015](https://discuss.elastic.co/u/zozo6015)\ **Replies:** 4\ **Last updated:** [June 2, 2016, 5:33pm UTC](https://discuss.elastic.co/t/solved-logstash-5-alpha3-not-starting/51641 "2016-06-02T17:33:51Z")
Hello, I am trying to configure logstah 5.0.0 apha3 and when I start the logstash init I get the following message: "Logstash has a new settings file which defines start up time settings. This file is typically locat… --- ## [Handling log messages wrapped in metadata](https://discuss.elastic.co/t/handling-log-messages-wrapped-in-metadata/50771)
**Author:** [@vaibhav316](https://discuss.elastic.co/u/vaibhav316)\ **Replies:** 1\ **Last updated:** [June 2, 2016, 5:31pm UTC](https://discuss.elastic.co/t/handling-log-messages-wrapped-in-metadata/50771 "2016-06-02T17:31:54Z")
Hi, I have the following data pipeline working: s3 (log archives) -- Ec2Instance -- kinesis -- logstash -- ELK Logs are saved on s3, which the EC2Instance fetches and pushes them to kinesis. Different streams are u… --- ## [Logstash Forwarder forwarding multiple files, ends up jammed together in one single entry](https://discuss.elastic.co/t/logstash-forwarder-forwarding-multiple-files-ends-up-jammed-together-in-one-single-entry/51646)
**Author:** [@Nww\_Pot\_Fung\_Nng](https://discuss.elastic.co/u/Nww_Pot_Fung_Nng)\ **Replies:** 1\ **Last updated:** [June 2, 2016, 1:47pm UTC](https://discuss.elastic.co/t/logstash-forwarder-forwarding-multiple-files-ends-up-jammed-together-in-one-single-entry/51646 "2016-06-02T13:47:17Z")
Hi, I have forwarder monitoring on multiple files. "files": \[ { "paths": \["/tmp/file1\*.log" \],"fields": { "server":"server1" } }, { "paths": \["/tmp/file2\*.log" \],"fields": { "server":"server2" } … --- ## [\_dateparsefailure when shipping logs from Docker via GELF](https://discuss.elastic.co/t/-dateparsefailure-when-shipping-logs-from-docker-via-gelf/51664)
**Author:** [@privatwolke](https://discuss.elastic.co/u/privatwolke)\ **Replies:** 1\ **Last updated:** [June 2, 2016, 12:49pm UTC](https://discuss.elastic.co/t/-dateparsefailure-when-shipping-logs-from-docker-via-gelf/51664 "2016-06-02T12:49:19Z")
Hey there! I am trying to ship logs from Docker to logstash via the gelf input plugin: input { gelf {} } This is what I am getting in my logs: {:timestamp=\>"2016-06-02T09:14:00.434000+0000", :message=\>"Failed par… --- ## [Calculate delta time](https://discuss.elastic.co/t/calculate-delta-time/51668)
**Author:** [@linhntt41](https://discuss.elastic.co/u/linhntt41)\ **Replies:** 0\ **Last updated:** [June 2, 2016, 10:52am UTC](https://discuss.elastic.co/t/calculate-delta-time/51668 "2016-06-02T10:52:27Z")
Hi! I want to calculate delta 2 events, use ruby to calculate delta time This my config: if \[status\] == "out"{ elasticsearch { hosts =\> \["localhost"\] query =\> 'status:in AND username:"%{username}"' fields =\> \["@timestamp"… --- ## [Convert a field datatype to object or nested in logstash](https://discuss.elastic.co/t/convert-a-field-datatype-to-object-or-nested-in-logstash/51419)
**Author:** [@star](https://discuss.elastic.co/u/star)\ **Replies:** 6\ **Last updated:** [June 2, 2016, 10:42am UTC](https://discuss.elastic.co/t/convert-a-field-datatype-to-object-or-nested-in-logstash/51419 "2016-06-02T10:42:56Z")
I am unable to convert datatype of field to object or nested datatype. I get following error. Any suggestions appreciated. --- ## [Problem in using filter-cipher](https://discuss.elastic.co/t/problem-in-using-filter-cipher/51553)
**Author:** [@sanju1323](https://discuss.elastic.co/u/sanju1323)\ **Replies:** 2\ **Last updated:** [June 2, 2016, 10:36am UTC](https://discuss.elastic.co/t/problem-in-using-filter-cipher/51553 "2016-06-02T10:36:32Z")
Hi, I'm working on logstash-filter-cipher to encode and decode the data. But nothing is coming up. I have an "ID" field and I want to encode it. The code that I was using is as follows. input { elasticsearch { … --- ## [\[Solved\] ETW windows logging](https://discuss.elastic.co/t/solved-etw-windows-logging/51666)
**Author:** [@elastic-fan](https://discuss.elastic.co/u/elastic-fan)\ **Replies:** 1\ **Last updated:** [June 2, 2016, 10:21am UTC](https://discuss.elastic.co/t/solved-etw-windows-logging/51666 "2016-06-02T10:21:21Z")
Can logstash collect ETW logs from windows? --- ## [Bug parsing json](https://discuss.elastic.co/t/bug-parsing-json/50921)
**Author:** [@JvonRudno](https://discuss.elastic.co/u/JvonRudno)\ **Replies:** 4\ **Last updated:** [June 2, 2016, 10:17am UTC](https://discuss.elastic.co/t/bug-parsing-json/50921 "2016-06-02T10:17:10Z")
Hi everybody After search a lot about this problem I get the conclusion that this is a bug for logstash. I have asked in this forum and unfortunately I didn't got any answer, so I decided to give step by step the way … --- ## [SIGKILL twice to kill or use SIGINT and SIGTERM](https://discuss.elastic.co/t/sigkill-twice-to-kill-or-use-sigint-and-sigterm/51611)
**Author:** [@wmcdonald](https://discuss.elastic.co/u/wmcdonald)\ **Replies:** 1\ **Last updated:** [June 2, 2016, 9:29am UTC](https://discuss.elastic.co/t/sigkill-twice-to-kill-or-use-sigint-and-sigterm/51611 "2016-06-02T09:29:16Z")
It seems logstash (technically launched via java) traps the SIGKILL unix signal (ie. kill -9) and tries to shutdown gracefully. However, I have experienced times when it never shuts down. I suggest that the policy b… --- ## [Input plugin JDBC with MSSQL 2000](https://discuss.elastic.co/t/input-plugin-jdbc-with-mssql-2000/51658)
**Author:** [@raphaelkh2ad](https://discuss.elastic.co/u/raphaelkh2ad)\ **Replies:** 0\ **Last updated:** [June 2, 2016, 8:46am UTC](https://discuss.elastic.co/t/input-plugin-jdbc-with-mssql-2000/51658 "2016-06-02T08:46:35Z")
Hi there, Im wondering if something achieved to use the jdbc input plugin with MSSQL 2000 (yeah quite old). I got the sqljdbc.jar from microsoft, but, with the default java installed (jdk 1.7) I've got an error type Java… --- ## [Logstash is escaping message!](https://discuss.elastic.co/t/logstash-is-escaping-message/51640)
**Author:** [@jonathanpmartins](https://discuss.elastic.co/u/jonathanpmartins)\ **Replies:** 1\ **Last updated:** [June 2, 2016, 7:10am UTC](https://discuss.elastic.co/t/logstash-is-escaping-message/51640 "2016-06-02T07:10:50Z")
Can I have access to the raw message before filters? My message is full with "\\x22". The easy way to deal with it is to use ruby and unpack the string, but... Logstash escape everything an put another backslash in front … --- ## [Turn Packetbeat IP data from String to IP field type](https://discuss.elastic.co/t/turn-packetbeat-ip-data-from-string-to-ip-field-type/51546)
**Author:** [@Kennedy\_Kan1](https://discuss.elastic.co/u/Kennedy_Kan1)\ **Replies:** 4\ **Last updated:** [June 1, 2016, 2:27pm UTC](https://discuss.elastic.co/t/turn-packetbeat-ip-data-from-string-to-ip-field-type/51546 "2016-06-01T14:27:54Z")
I have been working on logstash to read packetbeat data, however, 90% of the data are strings. I would wanna know how can I turn the fields related to IP address back into the data field as IP. One of the filters I hav… --- ## [Grok filter is not working](https://discuss.elastic.co/t/grok-filter-is-not-working/48702)
**Author:** [@Juan\_Andres\_Ramirez](https://discuss.elastic.co/u/Juan_Andres_Ramirez)\ **Replies:** 3\ **Last updated:** [June 2, 2016, 4:15am UTC](https://discuss.elastic.co/t/grok-filter-is-not-working/48702 "2016-06-02T04:15:52Z")
Hello Guys, I have Filebeat installed in a Windows server, this Filebeat send data from files in this Windows server to server with Logstash, here are the files config: logstash.conf, be careful I did cut the match fil… --- ## [Question About Logstash](https://discuss.elastic.co/t/question-about-logstash/51593)
**Author:** [@Espresso\_Machine](https://discuss.elastic.co/u/Espresso_Machine)\ **Replies:** 5\ **Last updated:** [June 2, 2016, 3:41am UTC](https://discuss.elastic.co/t/question-about-logstash/51593 "2016-06-02T03:41:06Z")
Is Logstash able to show the current system status of the machine that it is installed onto? Information such as storage access for all connected hard drives, memory usage, processor usage, temperature or does it only re… --- ## [Network data with Logstash and Packetbeat](https://discuss.elastic.co/t/network-data-with-logstash-and-packetbeat/51514)
**Author:** [@Kennedy\_Kan1](https://discuss.elastic.co/u/Kennedy_Kan1)\ **Replies:** 8\ **Last updated:** [June 2, 2016, 3:19am UTC](https://discuss.elastic.co/t/network-data-with-logstash-and-packetbeat/51514 "2016-06-02T03:19:04Z")
I have configured packetbeat to send data to logstash and I have setup a conf file in logstash; however, seems nothing is generated, can anyone advise me for how to collect network data with packetbeat and logstash? in… --- ## [How to use custom ISP database in geoip?](https://discuss.elastic.co/t/how-to-use-custom-isp-database-in-geoip/51548)
**Author:** [@Morriaty](https://discuss.elastic.co/u/Morriaty)\ **Replies:** 2\ **Last updated:** [June 2, 2016, 1:54am UTC](https://discuss.elastic.co/t/how-to-use-custom-isp-database-in-geoip/51548 "2016-06-02T01:54:05Z")
The ISP database from MAXMIND is only suitable for USA ISP, and not correct out of USA The ISP name is about 95% accurate in the US. Outside the US, accuracy ranges from 50% to 80%, depending on the country. The data i… --- ## [Convert String to IP](https://discuss.elastic.co/t/convert-string-to-ip/51527)
**Author:** [@Kennedy\_Kan1](https://discuss.elastic.co/u/Kennedy_Kan1)\ **Replies:** 1\ **Last updated:** [June 2, 2016, 12:54am UTC](https://discuss.elastic.co/t/convert-string-to-ip/51527 "2016-06-02T00:54:06Z")
I have started up packetbeat to send data to logstash and here is part of the logs "answers" =\> \[ \[0\] { "class" =\> "IN", "data" =\> "clients.l.google.com", "name" =\> "c… --- ## [Collect network operation data with logstash in Windows](https://discuss.elastic.co/t/collect-network-operation-data-with-logstash-in-windows/51502)
**Author:** [@Kennedy\_Kan1](https://discuss.elastic.co/u/Kennedy_Kan1)\ **Replies:** 1\ **Last updated:** [June 2, 2016, 12:53am UTC](https://discuss.elastic.co/t/collect-network-operation-data-with-logstash-in-windows/51502 "2016-06-02T00:53:08Z")
I am trying to get network operation data from my localhost. I know packetbeat can do some of the jobs. However, I would like to collect data with logstash but my configuration didn't output anything. Is there anyone who… --- ## [Logstash plugged on a kerberized kafka](https://discuss.elastic.co/t/logstash-plugged-on-a-kerberized-kafka/51622)
**Author:** [@easyoups](https://discuss.elastic.co/u/easyoups)\ **Replies:** 0\ **Last updated:** [June 1, 2016, 10:08pm UTC](https://discuss.elastic.co/t/logstash-plugged-on-a-kerberized-kafka/51622 "2016-06-01T22:08:15Z")
Hi everybody I want to define a kerberized kafka as an output for logstash. I tested my securized kafka that seams to work fine, but how to pass transparently a ticket with logstash in such a case. I do not find any op… --- ## [JDBC Plugin Default Timezone Milliseconds Value not Persisting](https://discuss.elastic.co/t/jdbc-plugin-default-timezone-milliseconds-value-not-persisting/51613)
**Author:** [@Alaska](https://discuss.elastic.co/u/Alaska)\ **Replies:** 0\ **Last updated:** [June 1, 2016, 8:42pm UTC](https://discuss.elastic.co/t/jdbc-plugin-default-timezone-milliseconds-value-not-persisting/51613 "2016-06-01T20:42:41Z")
I am trying to ingest data from a sql database that has a field of type datetime2. When the data is ingested into logstash via the JDBC input plugin, it will auto-correct the format based on the host's local timezone (i… --- ## [Logstash tag events if it occurs more than certain limit](https://discuss.elastic.co/t/logstash-tag-events-if-it-occurs-more-than-certain-limit/51598)
**Author:** [@vikas\_J](https://discuss.elastic.co/u/vikas_J)\ **Replies:** 1\ **Last updated:** [June 1, 2016, 8:21pm UTC](https://discuss.elastic.co/t/logstash-tag-events-if-it-occurs-more-than-certain-limit/51598 "2016-06-01T20:21:51Z")
The event timestamp is modified initially using date { match =\> \[ "date","dd MMM YYYY HH:mm:ss,SSS"\] locale =\> "es" } Im using throttle, to tag log events with a tag if the events occurs more than 1… --- ## [\[Solved\] Fingerprint does not work as expected II](https://discuss.elastic.co/t/solved-fingerprint-does-not-work-as-expected-ii/51560)
**Author:** [@Swen](https://discuss.elastic.co/u/Swen)\ **Replies:** 6\ **Last updated:** [June 1, 2016, 4:04pm UTC](https://discuss.elastic.co/t/solved-fingerprint-does-not-work-as-expected-ii/51560 "2016-06-01T16:04:07Z")
I want to use a fingerprint to put it into the document\_id. fingerprint { key =\> "78787878" method =\> "SHA1" } I expect this to make a hash from my 'message' and to see a 'fingerprint' variable with the hash in t… --- ## [Error: Expected one of #, input, filter, output at line 1, column 1 (byte 1) after {:level=\>:error}](https://discuss.elastic.co/t/error-expected-one-of-input-filter-output-at-line-1-column-1-byte-1-after-level-error/51431)
**Author:** [@Diego\_Gomez](https://discuss.elastic.co/u/Diego_Gomez)\ **Replies:** 2\ **Last updated:** [June 1, 2016, 3:20pm UTC](https://discuss.elastic.co/t/error-expected-one-of-input-filter-output-at-line-1-column-1-byte-1-after-level-error/51431 "2016-06-01T15:20:37Z")
Hi all, I have a problem , run logstash and no problem I could see data Kibana but off to logstash and when I run again pulls me this error. Error: Expected one of #, input, filter, output at line 1, column 1 (byte 1) … --- ## [Issue with grok and timestamp field in apache logs](https://discuss.elastic.co/t/issue-with-grok-and-timestamp-field-in-apache-logs/51566)
**Author:** [@Alexander\_Trumper](https://discuss.elastic.co/u/Alexander_Trumper)\ **Replies:** 2\ **Last updated:** [June 1, 2016, 2:32pm UTC](https://discuss.elastic.co/t/issue-with-grok-and-timestamp-field-in-apache-logs/51566 "2016-06-01T14:32:20Z")
I've been going through this example: And I used the whole config from the example (beside removing the geoip data) input { file { path =\> "/home/trueal/elk/support\_scripts/\*.log" start\_position =\> beginning ign… --- ## [Decode ascii hex from string or Convert Charset of a Field on the fly (filters)](https://discuss.elastic.co/t/decode-ascii-hex-from-string-or-convert-charset-of-a-field-on-the-fly-filters/51540)
**Author:** [@jonathanpmartins](https://discuss.elastic.co/u/jonathanpmartins)\ **Replies:** 1\ **Last updated:** [June 1, 2016, 10:14am UTC](https://discuss.elastic.co/t/decode-ascii-hex-from-string-or-convert-charset-of-a-field-on-the-fly-filters/51540 "2016-06-01T10:14:17Z")
I have a case, that a numb cliente sends me a http request with all UTF-8 chaset, but the payload comes with ascii hex, like: "\\x22", "\\xC3" "\\xA2", and so on... How can I DECODE only this string field, so I can procee… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1145) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1147)