# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1150 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1151 --- ## [Debug if output reaches elastic search from logstash](https://discuss.elastic.co/t/debug-if-output-reaches-elastic-search-from-logstash/50986)
**Author:** [@vikas\_J](https://discuss.elastic.co/u/vikas_J)\ **Replies:** 2\ **Last updated:** [May 25, 2016, 10:30pm UTC](https://discuss.elastic.co/t/debug-if-output-reaches-elastic-search-from-logstash/50986 "2016-05-25T22:30:18Z")
I have log stash configured to send output to both love beat and elastic search. On feeding log stash through filebeat, log stash sends output to love beat immediately, however i don't see the the data sent to elastic se… --- ## [Logstash 2.2.4 running out of memory](https://discuss.elastic.co/t/logstash-2-2-4-running-out-of-memory/50994)
**Author:** [@angusm](https://discuss.elastic.co/u/angusm)\ **Replies:** 0\ **Last updated:** [May 25, 2016, 9:43pm UTC](https://discuss.elastic.co/t/logstash-2-2-4-running-out-of-memory/50994 "2016-05-25T21:43:18Z")
I'm trying to run logstash 2.2.4 on a number of Amazon instances. On one set of instances (t2.medium, plus two t2.small instances) logstash seems to run correctly. On the other (all t2.small instances), logstash starts u… --- ## [Firewall Logs](https://discuss.elastic.co/t/firewall-logs/50931)
**Author:** [@Kennedy\_Kan](https://discuss.elastic.co/u/Kennedy_Kan)\ **Replies:** 1\ **Last updated:** [May 25, 2016, 9:42pm UTC](https://discuss.elastic.co/t/firewall-logs/50931 "2016-05-25T21:42:04Z")
Is there anyway that I can read data from firewall or antivirus and analyse it in kibana? Thanks in advance. --- ## [Does logstash filebeat support reading from redis](https://discuss.elastic.co/t/does-logstash-filebeat-support-reading-from-redis/50975)
**Author:** [@divya\_hc](https://discuss.elastic.co/u/divya_hc)\ **Replies:** 3\ **Last updated:** [May 25, 2016, 9:38pm UTC](https://discuss.elastic.co/t/does-logstash-filebeat-support-reading-from-redis/50975 "2016-05-25T21:38:56Z")
Hi, I am new to ELK. Have been reading the docs. But was not clear if this use case is supported and what plugin to use? We have client servers which stores events data in redis. We would like to store these centrall… --- ## [Logstash only uploading SOME files to s3](https://discuss.elastic.co/t/logstash-only-uploading-some-files-to-s3/50992)
**Author:** [@jstmatt](https://discuss.elastic.co/u/jstmatt)\ **Replies:** 1\ **Last updated:** [May 25, 2016, 9:34pm UTC](https://discuss.elastic.co/t/logstash-only-uploading-some-files-to-s3/50992 "2016-05-25T21:34:59Z")
So we have a setup that works pretty well: Data comes in through the beats plugin, and gets shipped to s3. I have it setup so that it outputs the local files to different directories, so that they stay within their li… --- ## [Logstash file input not reading files when run as service](https://discuss.elastic.co/t/logstash-file-input-not-reading-files-when-run-as-service/50651)
**Author:** [@tmo](https://discuss.elastic.co/u/tmo)\ **Replies:** 2\ **Last updated:** [May 25, 2016, 8:54pm UTC](https://discuss.elastic.co/t/logstash-file-input-not-reading-files-when-run-as-service/50651 "2016-05-25T20:54:51Z")
This one is a bit odd. If I run logstash as any user from the command line, it will index the files, changes, etc., but when I run it as a service via the repo install on Ubuntu it just doesn't do anything with regard t… --- ## [Geoip configuration problem](https://discuss.elastic.co/t/geoip-configuration-problem/50946)
**Author:** [@Giulio](https://discuss.elastic.co/u/Giulio)\ **Replies:** 0\ **Last updated:** [May 25, 2016, 2:29pm UTC](https://discuss.elastic.co/t/geoip-configuration-problem/50946 "2016-05-25T14:29:50Z")
Hi Sorry if I disturb you again but I after read many and many threads about this problem I still can't understand why my configuration simply won't work! This i my logastash cofiguration: input { file { … --- ## [Please share how to monitor Logstash from CLI](https://discuss.elastic.co/t/please-share-how-to-monitor-logstash-from-cli/50936)
**Author:** [@sreenivasu](https://discuss.elastic.co/u/sreenivasu)\ **Replies:** 0\ **Last updated:** [May 25, 2016, 1:00pm UTC](https://discuss.elastic.co/t/please-share-how-to-monitor-logstash-from-cli/50936 "2016-05-25T13:00:03Z")
For Example: In case of Elasticsearch it shows 200 OK, root@BLR-SOFT-203:~# curl -I http://localhost:9200 HTTP/1.1 200 OK Content-Type: text/plain; charset=UTF-8 Content-Length: 0 In case of Logstash curl -XGET htt… --- ## [Logstash XPATH Querying XML element value based on a CSV field Value](https://discuss.elastic.co/t/logstash-xpath-querying-xml-element-value-based-on-a-csv-field-value/50621)
**Author:** [@jyothish](https://discuss.elastic.co/u/jyothish)\ **Replies:** 9\ **Last updated:** [May 25, 2016, 12:25pm UTC](https://discuss.elastic.co/t/logstash-xpath-querying-xml-element-value-based-on-a-csv-field-value/50621 "2016-05-25T12:25:09Z")
I have a CSV file to parse using logstash. i am able to get each of the rows to elastic search from CSV .my current requirement is to get a field value from xml based on CSV input value for each row.. how can i do it kin… --- ## [Read files from another machine](https://discuss.elastic.co/t/read-files-from-another-machine/50922)
**Author:** [@Kennedy\_Kan1](https://discuss.elastic.co/u/Kennedy_Kan1)\ **Replies:** 1\ **Last updated:** [May 25, 2016, 10:33am UTC](https://discuss.elastic.co/t/read-files-from-another-machine/50922 "2016-05-25T10:33:08Z")
I have created a logstash, i.e. file.conf, to read through a file in local machine (172.16.1.135). input{ stdin{} file{ type =\> "txt" path =\> "C:\\Job\\Code.txt" start\_position =\> "beginning" } } filter{ grok{ … --- ## [Setup questions](https://discuss.elastic.co/t/setup-questions/50920)
**Author:** [@Marteijn\_Nouwens](https://discuss.elastic.co/u/Marteijn_Nouwens)\ **Replies:** 2\ **Last updated:** [May 25, 2016, 10:31am UTC](https://discuss.elastic.co/t/setup-questions/50920 "2016-05-25T10:31:53Z")
We are setting up logstach/Elastisearch and Kibana. Ik have the basics setup and am trying to adres some question/wishes from other developers. The 2 most important ones are: Question 1: Can we send binary or stuff… --- ## [Logstash 2.3.2 hung with no useful logging](https://discuss.elastic.co/t/logstash-2-3-2-hung-with-no-useful-logging/50924)
**Author:** [@danygor](https://discuss.elastic.co/u/danygor)\ **Replies:** 3\ **Last updated:** [May 25, 2016, 10:23am UTC](https://discuss.elastic.co/t/logstash-2-3-2-hung-with-no-useful-logging/50924 "2016-05-25T10:23:37Z")
Hi all, I was tuning my logstash instance working on pipeline-workers, pipeline-batch-size, elasticsearch output workers. I run logstash several times over the days, every time killing -9 it when I collected eno… --- ## [How to mapping a json field when using logstash?](https://discuss.elastic.co/t/how-to-mapping-a-json-field-when-using-logstash/47618)
**Author:** [@JvonRudno](https://discuss.elastic.co/u/JvonRudno)\ **Replies:** 11\ **Last updated:** [May 25, 2016, 10:10am UTC](https://discuss.elastic.co/t/how-to-mapping-a-json-field-when-using-logstash/47618 "2016-05-25T10:10:07Z")
Hi everybody!!! I have a postgres table that have a json field. it looks like this: customer\_id ==\> integer categories ==\> json ==\> please note that this field is type json and the table have some records like … --- ## [pfSense Logging - UDP Listener Died](https://discuss.elastic.co/t/pfsense-logging-udp-listener-died/50818)
**Author:** [@VanDerSexx](https://discuss.elastic.co/u/VanDerSexx)\ **Replies:** 1\ **Last updated:** [May 25, 2016, 9:06am UTC](https://discuss.elastic.co/t/pfsense-logging-udp-listener-died/50818 "2016-05-25T09:06:17Z")
Hi there, I keep getting issues to get logstash working. I am actually trying to run ELK stack to get logs from pfsense. But I kept hitting into this issue of UDP Listener Died: {:timestamp=\>"2016-05-24T05:31:07.… --- ## [Logstash 2.3 S3 cloudtrail input](https://discuss.elastic.co/t/logstash-2-3-s3-cloudtrail-input/50782)
**Author:** [@redbeard](https://discuss.elastic.co/u/redbeard)\ **Replies:** 1\ **Last updated:** [May 25, 2016, 9:00am UTC](https://discuss.elastic.co/t/logstash-2-3-s3-cloudtrail-input/50782 "2016-05-25T09:00:59Z")
Hi All, Hoping someone might be able to help me debug my logstash/S3/cloudtrail issue. This is my first time trying to set this up but I am not making any progress. My setup : RHEL 7 logstash 2.3 running in AWS on EC… --- ## [Logstash accessing DB2 on z/OS; classpath, license issues?](https://discuss.elastic.co/t/logstash-accessing-db2-on-z-os-classpath-license-issues/39042)
**Author:** [@Russ](https://discuss.elastic.co/u/Russ)\ **Replies:** 3\ **Last updated:** [May 25, 2016, 8:40am UTC](https://discuss.elastic.co/t/logstash-accessing-db2-on-z-os-classpath-license-issues/39042 "2016-05-25T08:40:37Z")
Has anyone setup Logstash to extract data from DB2 on z/OS? I had it working about four weeks ago, but after the holidays, something had changed so that I was getting this error related to the .jar / license files. The… --- ## [How to fetch remote machine data](https://discuss.elastic.co/t/how-to-fetch-remote-machine-data/50705)
**Author:** [@Prateek\_Kshtriya](https://discuss.elastic.co/u/Prateek_Kshtriya)\ **Replies:** 1\ **Last updated:** [May 25, 2016, 5:36am UTC](https://discuss.elastic.co/t/how-to-fetch-remote-machine-data/50705 "2016-05-25T05:36:41Z")
Hi All, Please suggest how to fetch remote machine data to elasticsearch at local system. Scenario- Elasticsearch is hosted on one of the boxes & required to fetch similar data from different boxes to create a dash… --- ## [Logstash JDBC input plugin - Set database date data timezone](https://discuss.elastic.co/t/logstash-jdbc-input-plugin-set-database-date-data-timezone/35672)
**Author:** [@razafinr](https://discuss.elastic.co/u/razafinr)\ **Replies:** 3\ **Last updated:** [May 25, 2016, 5:03am UTC](https://discuss.elastic.co/t/logstash-jdbc-input-plugin-set-database-date-data-timezone/35672 "2016-05-25T05:03:17Z")
I am using the logstash JDBC plugin to retrieve data from my SQL database to Elasticsearch. It is working fine except I have the following problem: I am storing my dates in UTC timezone in my database but when I use… --- ## [I have no connection to elastisearch logstash](https://discuss.elastic.co/t/i-have-no-connection-to-elastisearch-logstash/50459)
**Author:** [@Diego\_Gomez](https://discuss.elastic.co/u/Diego_Gomez)\ **Replies:** 7\ **Last updated:** [May 24, 2016, 8:24pm UTC](https://discuss.elastic.co/t/i-have-no-connection-to-elastisearch-logstash/50459 "2016-05-24T20:24:30Z")
Hello everyone I have a problem I can not connect the logstash to elastisearch even tell me the logstash that the configuration is ok and starts perfect, but I do not see myself or elasticsearch or Kibana , here I leave … --- ## [Gelf to multiline filter messes up newlines](https://discuss.elastic.co/t/gelf-to-multiline-filter-messes-up-newlines/39393)
**Author:** [@tino](https://discuss.elastic.co/u/tino)\ **Replies:** 1\ **Last updated:** [May 24, 2016, 8:09pm UTC](https://discuss.elastic.co/t/gelf-to-multiline-filter-messes-up-newlines/39393 "2016-05-24T20:09:39Z")
I'm trying to get the output of python stacktraces to show up nicely in Kibana. I am using the docker gelf log driver, and I am able to get the messages through logstash into ES. With the following config, tracebacks are… --- ## [String interpolation failing in event dependent config](https://discuss.elastic.co/t/string-interpolation-failing-in-event-dependent-config/50768)
**Author:** [@joshzitting](https://discuss.elastic.co/u/joshzitting)\ **Replies:** 3\ **Last updated:** [May 24, 2016, 7:17pm UTC](https://discuss.elastic.co/t/string-interpolation-failing-in-event-dependent-config/50768 "2016-05-24T19:17:52Z")
I am attempting to use a dynamic/event dependent config (as shown here https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html) however I keep getting an errror. I am trying to output data to… --- ## [Why do I get a variable this binding exception after upgrading to Logstash 2.2?](https://discuss.elastic.co/t/why-do-i-get-a-variable-this-binding-exception-after-upgrading-to-logstash-2-2/50875)
**Author:** [@PhaedrusTheGreek](https://discuss.elastic.co/u/PhaedrusTheGreek)\ **Replies:** 1\ **Last updated:** [May 24, 2016, 6:34pm UTC](https://discuss.elastic.co/t/why-do-i-get-a-variable-this-binding-exception-after-upgrading-to-logstash-2-2/50875 "2016-05-24T18:34:26Z")
I make use of sql\_last\_start in my SQL statement, but after upgrading (or downgrading) Logstash, I get an exception. statement =\> "SELECT \* FROM myTable where myDate \> :sql\_last\_value" {:timestamp=\>"2016-05-18T17:21… --- ## [Do RabbitMQ Input and Output plugins support TLSv1.1 or TLSv1.2?](https://discuss.elastic.co/t/do-rabbitmq-input-and-output-plugins-support-tlsv1-1-or-tlsv1-2/41919)
**Author:** [@marke72](https://discuss.elastic.co/u/marke72)\ **Replies:** 1\ **Last updated:** [May 24, 2016, 5:49pm UTC](https://discuss.elastic.co/t/do-rabbitmq-input-and-output-plugins-support-tlsv1-1-or-tlsv1-2/41919 "2016-05-24T17:49:13Z")
I can't seem to find much information about it but I have been trying to connect my Logstash servers to RabbitMQ through either TLSv1.1 or TLSv1.2 because there are some security issues with TLSv1. How I currently have i… --- ## [Logstash sendmail grok procesing multiple field value](https://discuss.elastic.co/t/logstash-sendmail-grok-procesing-multiple-field-value/50859)
**Author:** [@Emilio\_Ampudia\_Marti](https://discuss.elastic.co/u/Emilio_Ampudia_Marti)\ **Replies:** 1\ **Last updated:** [May 24, 2016, 3:13pm UTC](https://discuss.elastic.co/t/logstash-sendmail-grok-procesing-multiple-field-value/50859 "2016-05-24T15:13:26Z")
I have this sendmail log line: May 24 16:17:28 mailserver sendmail\[11337\]: u4OEHO27011330: to=XXX@ific.uv.es,YYY@ific.uv.es,AAA@ific.uv.es,POPP.AD@ific.uv.es, delay=00:00:04, xdelay=00:00:03, mailer=esmtp, pri=238177,… --- ## [Influxdb coerce\_values is causing exception](https://discuss.elastic.co/t/influxdb-coerce-values-is-causing-exception/50748)
**Author:** [@astickler](https://discuss.elastic.co/u/astickler)\ **Replies:** 2\ **Last updated:** [May 24, 2016, 11:15am UTC](https://discuss.elastic.co/t/influxdb-coerce-values-is-causing-exception/50748 "2016-05-24T11:15:10Z")
I have logstash working fine with influxDB, but it is sending numeric values as strings so I can't use the influxDB aggregation functions like mean(). The solution to this seems to be coerce\_values in the influxdb outpu… --- ## [Logstash don't send data to elastic, but send it to stdout](https://discuss.elastic.co/t/logstash-dont-send-data-to-elastic-but-send-it-to-stdout/50739)
**Author:** [@SirEdvin](https://discuss.elastic.co/u/SirEdvin)\ **Replies:** 3\ **Last updated:** [May 24, 2016, 10:00am UTC](https://discuss.elastic.co/t/logstash-dont-send-data-to-elastic-but-send-it-to-stdout/50739 "2016-05-24T10:00:33Z")
Hello, I have some problem with logstash configuration. Here is my logstash configuration input { beats { port =\> 5044 } } filter { } output { elasticsearch { hosts =\> \["loc… --- ## [Get seconds from the timestamp and put the into separate field](https://discuss.elastic.co/t/get-seconds-from-the-timestamp-and-put-the-into-separate-field/35056)
**Author:** [@nkoleff](https://discuss.elastic.co/u/nkoleff)\ **Replies:** 5\ **Last updated:** [May 13, 2016, 10:43am UTC](https://discuss.elastic.co/t/get-seconds-from-the-timestamp-and-put-the-into-separate-field/35056 "2016-05-13T10:43:16Z")
Hello, I am trying to do the following: If the field mymessage contains My string, create another field called seconds and put there the bolded value of my timestamp - November 15th 2015, 08:42:29.779. In other words I … --- ## [How to manage multiline events based on a random field](https://discuss.elastic.co/t/how-to-manage-multiline-events-based-on-a-random-field/43519)
**Author:** [@jpry](https://discuss.elastic.co/u/jpry)\ **Replies:** 23\ **Last updated:** [May 24, 2016, 8:33am UTC](https://discuss.elastic.co/t/how-to-manage-multiline-events-based-on-a-random-field/43519 "2016-05-24T08:33:00Z")
Hello all, I've been facing a problem related to multiline events lately, and I am needing a little bit of your help for this. My syslog server is sending multi-line events. One single event gathers several lines, and… --- ## [Jdbc input plugin -- cannot locate last\_run\_metadata\_path](https://discuss.elastic.co/t/jdbc-input-plugin-cannot-locate-last-run-metadata-path/50716)
**Author:** [@Neil\_Alex](https://discuss.elastic.co/u/Neil_Alex)\ **Replies:** 3\ **Last updated:** [May 24, 2016, 8:34am UTC](https://discuss.elastic.co/t/jdbc-input-plugin-cannot-locate-last-run-metadata-path/50716 "2016-05-24T08:34:55Z")
Hello , I am using logstash 2.3 in an Ubuntu 14.04 , not as a service ( just extracted the tar.gz ). I successfully ran logstash jdbc input plugin and fetched some data from my sql server. Now I wanna re run the sam… --- ## [\[Solved\] Logstash geoip vs. ES 2.x "no dot in fields"](https://discuss.elastic.co/t/solved-logstash-geoip-vs-es-2-x-no-dot-in-fields/50735)
**Author:** [@ppuschmann](https://discuss.elastic.co/u/ppuschmann)\ **Replies:** 2\ **Last updated:** [May 24, 2016, 7:11am UTC](https://discuss.elastic.co/t/solved-logstash-geoip-vs-es-2-x-no-dot-in-fields/50735 "2016-05-24T07:11:29Z")
Hi there, we're currently using the following Logstash-Filter for geoip-processing: geoip { source =\> "client\_ip" lru\_cache\_size =\> 10000 } This creates for example the following output: "geoip" =\> { "ip" =\> … [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1149) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1151)