# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1147 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1148 --- ## [Setting a field as non analyzed before sending it to elasticsearch](https://discuss.elastic.co/t/setting-a-field-as-non-analyzed-before-sending-it-to-elasticsearch/51336)
**Author:** [@pecwich](https://discuss.elastic.co/u/pecwich)\ **Replies:** 4\ **Last updated:** [June 1, 2016, 5:51am UTC](https://discuss.elastic.co/t/setting-a-field-as-non-analyzed-before-sending-it-to-elasticsearch/51336 "2016-06-01T05:51:51Z")
How can I Set a field as non-analyzed in Logstash before sending it to elasticsearch. --- ## [1 Error: Expected one of #, input, filter, output at line 1, column 1 (byte 1) after {:level=\>:error}](https://discuss.elastic.co/t/1-error-expected-one-of-input-filter-output-at-line-1-column-1-byte-1-after-level-error/51433)
**Author:** [@Diego\_Gomez](https://discuss.elastic.co/u/Diego_Gomez)\ **Replies:** 1\ **Last updated:** [June 1, 2016, 5:49am UTC](https://discuss.elastic.co/t/1-error-expected-one-of-input-filter-output-at-line-1-column-1-byte-1-after-level-error/51433 "2016-06-01T05:49:10Z")
Hola a todos , tengo un problema , logstash funciono bien pude ver los datos en Kibana pero apague logstash y cuando lo vuelvo a correr me tira este error . Error: Expected one of #, input, filter, output at line 1,… --- ## [Reading MSSQL Server info about disk, cpu and memory utilization](https://discuss.elastic.co/t/reading-mssql-server-info-about-disk-cpu-and-memory-utilization/51307)
**Author:** [@Kennedy\_Kan1](https://discuss.elastic.co/u/Kennedy_Kan1)\ **Replies:** 1\ **Last updated:** [June 1, 2016, 5:32am UTC](https://discuss.elastic.co/t/reading-mssql-server-info-about-disk-cpu-and-memory-utilization/51307 "2016-06-01T05:32:08Z")
I know there is a jdbc input plugin and I do know the SQL in reading the data as stated in the topic but I have no idea how to use logstash to map them. Is there anyone who know how to resolve? For example, I have crea… --- ## [Failed to query elasticsearch for previous event](https://discuss.elastic.co/t/failed-to-query-elasticsearch-for-previous-event/48409)
**Author:** [@linhntt41](https://discuss.elastic.co/u/linhntt41)\ **Replies:** 0\ **Last updated:** [April 26, 2016, 9:47am UTC](https://discuss.elastic.co/t/failed-to-query-elasticsearch-for-previous-event/48409 "2016-04-26T09:47:37Z")
Hi all, I'm using logstash 2.3 elasticsearch 2.3 I use filter-plugin-elasticsearch to query previous event This is file log: 2016-04-26 16:30:00 userA in 2016-04-26 16:35:00 userA out This is file config: input{ … --- ## [Logstash apache access referrer value parsing](https://discuss.elastic.co/t/logstash-apache-access-referrer-value-parsing/51474)
**Author:** [@bhawanaus](https://discuss.elastic.co/u/bhawanaus)\ **Replies:** 3\ **Last updated:** [June 1, 2016, 3:38am UTC](https://discuss.elastic.co/t/logstash-apache-access-referrer-value-parsing/51474 "2016-06-01T03:38:15Z")
Hello, I'm trying to create visualization on Kibana based upon referrer value from apache logs. Below is a sample log from apache access logs. 127.0.0.1 - - \[20/May/2016:00:00:14 +0000\] "GET /secure/queue/handleQueue… --- ## [Would someone please paste a verbose sample of filter metrics?](https://discuss.elastic.co/t/would-someone-please-paste-a-verbose-sample-of-filter-metrics/51508)
**Author:** [@Morriaty](https://discuss.elastic.co/u/Morriaty)\ **Replies:** 0\ **Last updated:** [June 1, 2016, 3:33am UTC](https://discuss.elastic.co/t/would-someone-please-paste-a-verbose-sample-of-filter-metrics/51508 "2016-06-01T03:33:49Z")
I'm analyzing nginx logs with ELK. For the logs were too large (10GB per day), I don't want to save all the detail data into es, but only the aggregations.And I found metrics filter is suitable for my occasion. What … --- ## [Logstash 'holds' log entries until a later entry or shutdown](https://discuss.elastic.co/t/logstash-holds-log-entries-until-a-later-entry-or-shutdown/51495)
**Author:** [@danp](https://discuss.elastic.co/u/danp)\ **Replies:** 1\ **Last updated:** [May 31, 2016, 11:37pm UTC](https://discuss.elastic.co/t/logstash-holds-log-entries-until-a-later-entry-or-shutdown/51495 "2016-05-31T23:37:55Z")
Hi, I'm having a bit of a problem with logstash. I have a log file that is very uniform. The log file is updated rather infrequently - maybe only ten times a day. However, there are times when the log file is updat… --- ## [How to make Logstash highly available](https://discuss.elastic.co/t/how-to-make-logstash-highly-available/29926)
**Author:** [@vikas\_gopal](https://discuss.elastic.co/u/vikas_gopal)\ **Replies:** 5\ **Last updated:** [September 25, 2015, 12:14am UTC](https://discuss.elastic.co/t/how-to-make-logstash-highly-available/29926 "2015-09-25T00:14:57Z")
Hi Experts, My plan is to make LS highly available as I did it for ES and Kibana. So I have load balancer for ES and for Kibana. Not sure how I achieve this for LS. Please suggest. Thanks VG --- ## [Grok path matching](https://discuss.elastic.co/t/grok-path-matching/51476)
**Author:** [@mightyschwartz](https://discuss.elastic.co/u/mightyschwartz)\ **Replies:** 2\ **Last updated:** [May 31, 2016, 8:07pm UTC](https://discuss.elastic.co/t/grok-path-matching/51476 "2016-05-31T20:07:46Z")
When I define a grok pattern for windows file path matching, I cannot get it to work... even with the default. The log is as follows: { "message" =\> "Prepared StagingJob for spreadsheet 'C:\\\\App\\\\Folder\\\\test… --- ## [Tcp retry count](https://discuss.elastic.co/t/tcp-retry-count/51477)
**Author:** [@bbhandari0121](https://discuss.elastic.co/u/bbhandari0121)\ **Replies:** 2\ **Last updated:** [May 31, 2016, 8:01pm UTC](https://discuss.elastic.co/t/tcp-retry-count/51477 "2016-05-31T20:01:50Z")
Hi team, I was wondering how many attempts will the tcp connector try before failing. We know it retries every 10 second but how many retires ? --- ## [Timestamp is not parsing: grok](https://discuss.elastic.co/t/timestamp-is-not-parsing-grok/51188)
**Author:** [@shikha.agarwal1](https://discuss.elastic.co/u/shikha.agarwal1)\ **Replies:** 5\ **Last updated:** [May 31, 2016, 5:10pm UTC](https://discuss.elastic.co/t/timestamp-is-not-parsing-grok/51188 "2016-05-31T17:10:53Z")
I have flat file(jobs.log) which has below data 2016-05-25 17:52:11,467 \[INFO \] \[main\] \[FileName.java:50\] - Application: abc Rule: 123 Status: SUCCESS I want log time stamp to show in kibana, so I am trying to replace… --- ## [Siebel log monitoring through ELK stack](https://discuss.elastic.co/t/siebel-log-monitoring-through-elk-stack/49612)
**Author:** [@Bharath\_Paruchuri](https://discuss.elastic.co/u/Bharath_Paruchuri)\ **Replies:** 6\ **Last updated:** [May 31, 2016, 4:27pm UTC](https://discuss.elastic.co/t/siebel-log-monitoring-through-elk-stack/49612 "2016-05-31T16:27:11Z")
Hi All, Using ELK stack, we are monitoring all our Weblogic & SOA logs. Now we are planning to monitor SIEBEL logs using ELK stack. For every 5 mins, logs with format " /tmp/htimObjMgr\_enu\_0299\_\*.log " are generating… --- ## [LogStash reading data from Oracle database using Oracle Wallet](https://discuss.elastic.co/t/logstash-reading-data-from-oracle-database-using-oracle-wallet/51181)
**Author:** [@kkr78](https://discuss.elastic.co/u/kkr78)\ **Replies:** 4\ **Last updated:** [May 31, 2016, 3:25pm UTC](https://discuss.elastic.co/t/logstash-reading-data-from-oracle-database-using-oracle-wallet/51181 "2016-05-31T15:25:07Z")
Our security team has strict policy using the password in the configuration file so we have to use wallet. I am trying to setup Logstah to work with Oracle wallet. has anyone successfully configured with Oracle wallet? … --- ## [Problem with Grok filter with my logfile](https://discuss.elastic.co/t/problem-with-grok-filter-with-my-logfile/51420)
**Author:** [@yde](https://discuss.elastic.co/u/yde)\ **Replies:** 1\ **Last updated:** [May 31, 2016, 12:57pm UTC](https://discuss.elastic.co/t/problem-with-grok-filter-with-my-logfile/51420 "2016-05-31T12:57:00Z")
Hello everybody, I am new here, I am actually trying to understand how works filebeat, logstack, elastic and kibana. I am actually testing the logstack module and i am actually blocked, I don't understand how i can ext… --- ## [Decoding avro events with infile schema](https://discuss.elastic.co/t/decoding-avro-events-with-infile-schema/51427)
**Author:** [@Helmut\_Wahrmann](https://discuss.elastic.co/u/Helmut_Wahrmann)\ **Replies:** 0\ **Last updated:** [May 31, 2016, 12:15pm UTC](https://discuss.elastic.co/t/decoding-avro-events-with-infile-schema/51427 "2016-05-31T12:15:23Z")
I have to process events from an avro file, where the schema is included in the avro file itself. So i can't point the avro codec to a schema\_uri. Is there a way to accomplish this? --- ## [Mathemathical Operation on Date or Timestamp](https://discuss.elastic.co/t/mathemathical-operation-on-date-or-timestamp/51334)
**Author:** [@sombilat](https://discuss.elastic.co/u/sombilat)\ **Replies:** 2\ **Last updated:** [May 31, 2016, 11:57am UTC](https://discuss.elastic.co/t/mathemathical-operation-on-date-or-timestamp/51334 "2016-05-31T11:57:28Z")
Hello, I want to perform a Mathemathical operation on a date field. I am getting a timestamp field like so: add\_field =\> \[ "received\_at", "%{@timestamp}" \] Now, I will create a seperate field with a Date before… --- ## [IndexName with current date](https://discuss.elastic.co/t/indexname-with-current-date/51413)
**Author:** [@Prateek\_Kshtriya](https://discuss.elastic.co/u/Prateek_Kshtriya)\ **Replies:** 2\ **Last updated:** [May 31, 2016, 11:41am UTC](https://discuss.elastic.co/t/indexname-with-current-date/51413 "2016-05-31T11:41:02Z")
Hi All, Please suggest how to create index name with current date. PFB snippet from my logstash config file- output { elasticsearch { action =\> "index" index =\> "\[datewise-\]YYYY.MM.DD" } I … --- ## [Multiple file input and GROK filters and single ES output](https://discuss.elastic.co/t/multiple-file-input-and-grok-filters-and-single-es-output/51059)
**Author:** [@sukhada369](https://discuss.elastic.co/u/sukhada369)\ **Replies:** 3\ **Last updated:** [May 31, 2016, 11:36am UTC](https://discuss.elastic.co/t/multiple-file-input-and-grok-filters-and-single-es-output/51059 "2016-05-31T11:36:04Z")
I am using a single Logstash config file for multiple file inputs and grok filters and single ES output. The problem is that, it goes in infinite loop and I don't know why. I created separate files to check on if GROK is… --- ## [\[Solved\] Question about a filter](https://discuss.elastic.co/t/solved-question-about-a-filter/50939)
**Author:** [@Uros\_Meglic](https://discuss.elastic.co/u/Uros_Meglic)\ **Replies:** 6\ **Last updated:** [May 31, 2016, 11:32am UTC](https://discuss.elastic.co/t/solved-question-about-a-filter/50939 "2016-05-31T11:32:42Z")
Hello, just a quick question. What is the best filter for this type of logs: I figured I would make a grok pattern, but I would just like to check if there is a better option, since the log is always formed as vari… --- ## [Using logstash elasticsearch output over HTTPS](https://discuss.elastic.co/t/using-logstash-elasticsearch-output-over-https/51319)
**Author:** [@dandrestor](https://discuss.elastic.co/u/dandrestor)\ **Replies:** 1\ **Last updated:** [May 31, 2016, 11:26am UTC](https://discuss.elastic.co/t/using-logstash-elasticsearch-output-over-https/51319 "2016-05-31T11:26:37Z")
Hello, I've set up elasticsearch with shield, and I am now using HTTPS to access the REST API. I've also set up Kibana, and I am connecting via HTTPS to elasticsearch. I'm having some trouble with the Logstash part tho… --- ## [\[Solved\] Custom Logstash filter validation question](https://discuss.elastic.co/t/solved-custom-logstash-filter-validation-question/51338)
**Author:** [@paulkeogh](https://discuss.elastic.co/u/paulkeogh)\ **Replies:** 3\ **Last updated:** [May 31, 2016, 10:23am UTC](https://discuss.elastic.co/t/solved-custom-logstash-filter-validation-question/51338 "2016-05-31T10:23:29Z")
Hi, I have a working Logstash filter on which I want to enhance the validation; I have a config item of; config :da\_order, :validate =\> :array, :default =\> \["Destination IMSI", "Destination MSC Address", "Destina… --- ## [\[Solved\] Logstash can't start up: not enough memory](https://discuss.elastic.co/t/solved-logstash-cant-start-up-not-enough-memory/51372)
**Author:** [@Morriaty](https://discuss.elastic.co/u/Morriaty)\ **Replies:** 4\ **Last updated:** [May 31, 2016, 10:09am UTC](https://discuss.elastic.co/t/solved-logstash-cant-start-up-not-enough-memory/51372 "2016-05-31T10:09:15Z")
This is what top showed top - 13:28:06 up 837 days, 15:14, 6 users, load average: 0.17, 0.13, 0.16 Tasks: 352 total, 2 running, 350 sleeping, 0 stopped, 0 zombie Cpu(s): 0.3%us, 0.1%sy, 0.0%ni, 99.3%id, 0.… --- ## [Failed parsing date from field using logstash](https://discuss.elastic.co/t/failed-parsing-date-from-field-using-logstash/51384)
**Author:** [@r.ganeshbabu](https://discuss.elastic.co/u/r.ganeshbabu)\ **Replies:** 7\ **Last updated:** [May 31, 2016, 9:27am UTC](https://discuss.elastic.co/t/failed-parsing-date-from-field-using-logstash/51384 "2016-05-31T09:27:04Z")
Hi All, I trying to index sample log files to ES using logstash and below is the logstash conf file, input { file { type =\> "apache" path =\> "/opt/esadmin/elasticsearch-1.7.3/bin/logstash-1.5.5/logging\_Adm… --- ## [Filtering using grok](https://discuss.elastic.co/t/filtering-using-grok/51327)
**Author:** [@GINS007](https://discuss.elastic.co/u/GINS007)\ **Replies:** 4\ **Last updated:** [May 31, 2016, 9:09am UTC](https://discuss.elastic.co/t/filtering-using-grok/51327 "2016-05-31T09:09:06Z")
Hi, I want to perform different operation based on the entry in my log file. 2016-05-12 18:32:11,452 \[http-8080-2\] INFO AwsLifeCycleManager Aws VMProvisioning SUCCESS AssetID IP AssetName If the operat… --- ## [Need program variables from config file](https://discuss.elastic.co/t/need-program-variables-from-config-file/51300)
**Author:** [@billzy](https://discuss.elastic.co/u/billzy)\ **Replies:** 4\ **Last updated:** [May 31, 2016, 7:47am UTC](https://discuss.elastic.co/t/need-program-variables-from-config-file/51300 "2016-05-31T07:47:35Z")
I'm using logstash as output method for packetbeat and I want to filter transactions in logstash, for example, I received 3 packets described as below packet A is from 192.168.0.3 to 192.168.0.4 packet B is from 192.16… --- ## [Logstash 2.3.2 redis input crash](https://discuss.elastic.co/t/logstash-2-3-2-redis-input-crash/51379)
**Author:** [@Ronald\_Moesbergen](https://discuss.elastic.co/u/Ronald_Moesbergen)\ **Replies:** 3\ **Last updated:** [May 31, 2016, 6:59am UTC](https://discuss.elastic.co/t/logstash-2-3-2-redis-input-crash/51379 "2016-05-31T06:59:09Z")
Hi, I've recently upgraded logstash to version 2.3.2 and notice that since this upgrade, whenever a redis error occurs, logstash crashes wit the following exception: :exception=\># 'maxmemory'.\>, :backtrace=\>\["/usr/lo… --- ## [Elasticsearch plugin for Logstash: SearchParseException\[No mapping found for](https://discuss.elastic.co/t/elasticsearch-plugin-for-logstash-searchparseexception-no-mapping-found-for/51375)
**Author:** [@Mark\_Morris](https://discuss.elastic.co/u/Mark_Morris)\ **Replies:** 1\ **Last updated:** [May 31, 2016, 6:16am UTC](https://discuss.elastic.co/t/elasticsearch-plugin-for-logstash-searchparseexception-no-mapping-found-for/51375 "2016-05-31T06:16:25Z")
I have two data sets; one is meta data on end points e.g. mac-address, O/S, computer type etc. The other is network authentication events, which include pass/fail, ip address, mac address etc. Both sets of data are loa… --- ## [Document\_id in redis](https://discuss.elastic.co/t/document-id-in-redis/51323)
**Author:** [@Swen](https://discuss.elastic.co/u/Swen)\ **Replies:** 3\ **Last updated:** [May 31, 2016, 5:44am UTC](https://discuss.elastic.co/t/document-id-in-redis/51323 "2016-05-31T05:44:06Z")
My input comes from a rest service that is digging in a database. Every time I request the service, I get events from the last 24 hours (for instance). That means, when I request the service every hour I will get a few … --- ## [Error while running logstash config file](https://discuss.elastic.co/t/error-while-running-logstash-config-file/51360)
**Author:** [@cwp](https://discuss.elastic.co/u/cwp)\ **Replies:** 2\ **Last updated:** [May 31, 2016, 3:39am UTC](https://discuss.elastic.co/t/error-while-running-logstash-config-file/51360 "2016-05-31T03:39:18Z")
I am new to Kibana and want to import data from Excel. I was told to get Logstash and create a config file (Below is the file). When executing I get this error message. Please advise Thanks bin/logstash agent -f logstas… --- ## [How to convert multiple time fields into Logstash timestamp format](https://discuss.elastic.co/t/how-to-convert-multiple-time-fields-into-logstash-timestamp-format/51365)
**Author:** [@jpatani](https://discuss.elastic.co/u/jpatani)\ **Replies:** 1\ **Last updated:** [May 31, 2016, 3:30am UTC](https://discuss.elastic.co/t/how-to-convert-multiple-time-fields-into-logstash-timestamp-format/51365 "2016-05-31T03:30:03Z")
I have two different date fields per entry. How do I translate both fields into Logstash' timestamp format. Right now, only one of the time fields is going to "@timestamp" Here are the date parts of the config file: … [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1146) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1148)