# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1152 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1153 --- ## [\[SOLVED\] v1.X -\> v2.3 output elasticsearch cluster name](https://discuss.elastic.co/t/solved-v1-x-v2-3-output-elasticsearch-cluster-name/50442)
**Author:** [@zendel](https://discuss.elastic.co/u/zendel)\ **Replies:** 2\ **Last updated:** [May 19, 2016, 3:43pm UTC](https://discuss.elastic.co/t/solved-v1-x-v2-3-output-elasticsearch-cluster-name/50442 "2016-05-19T15:43:26Z")
Hello everyone, I recently maj my logstash to the latest version (version 1.x to 2.3.1). My configuration is : output { stdout { codec =\> rubydebug } elasticsearch { cluster my\_cluster\_name} } So,… --- ## [\[2.1.3\] JSON filtering](https://discuss.elastic.co/t/2-1-3-json-filtering/50453)
**Author:** [@dawiro](https://discuss.elastic.co/u/dawiro)\ **Replies:** 1\ **Last updated:** [May 19, 2016, 3:03pm UTC](https://discuss.elastic.co/t/2-1-3-json-filtering/50453 "2016-05-19T15:03:14Z")
Hi, I have a situation where log lines are hitting my beats input sent via journalbeat. The input uses the json codec and so expects json. However, some of the log lines in the client systems journal are plain text. S… --- ## [Elasticsearch plugin doesn't create file with correct name](https://discuss.elastic.co/t/elasticsearch-plugin-doesnt-create-file-with-correct-name/47500)
**Author:** [@ameconi](https://discuss.elastic.co/u/ameconi)\ **Replies:** 5\ **Last updated:** [May 19, 2016, 2:52pm UTC](https://discuss.elastic.co/t/elasticsearch-plugin-doesnt-create-file-with-correct-name/47500 "2016-05-19T14:52:17Z")
Hello. I'm using the Logstash 5.0 on Ubuntu 14.04. This is my config output { stdout { codec =\> rubydebug } elasticsearch { } } but index filename is wrong. It is logstash-2006.09.07, but it'd be… --- ## [Allow tab as separator in grok patterns file?](https://discuss.elastic.co/t/allow-tab-as-separator-in-grok-patterns-file/50447)
**Author:** [@L8apex32](https://discuss.elastic.co/u/L8apex32)\ **Replies:** 0\ **Last updated:** [May 19, 2016, 2:43pm UTC](https://discuss.elastic.co/t/allow-tab-as-separator-in-grok-patterns-file/50447 "2016-05-19T14:43:22Z")
The current docs require a space to separate the symbol from the semantic in a grok patterns file. This makes the patterns file less readable than it could be. Can we consider changing the spec from " " to the equival… --- ## [\[2.1.3\] Regarding Outputs to Multiple ES Clusters](https://discuss.elastic.co/t/2-1-3-regarding-outputs-to-multiple-es-clusters/50408)
**Author:** [@dawiro](https://discuss.elastic.co/u/dawiro)\ **Replies:** 5\ **Last updated:** [May 19, 2016, 1:14pm UTC](https://discuss.elastic.co/t/2-1-3-regarding-outputs-to-multiple-es-clusters/50408 "2016-05-19T13:14:32Z")
Hi, Atm, most of our traffic is hitting logstash via the beats input. We output to two clusters, one of which is significantly bigger than the other. And periodically, we see congestion reported by beats and it backs off… --- ## [Problem with twitter-plugin and https-proxies](https://discuss.elastic.co/t/problem-with-twitter-plugin-and-https-proxies/50426)
**Author:** [@kodo65](https://discuss.elastic.co/u/kodo65)\ **Replies:** 0\ **Last updated:** [May 19, 2016, 11:29am UTC](https://discuss.elastic.co/t/problem-with-twitter-plugin-and-https-proxies/50426 "2016-05-19T11:29:14Z")
I have logstash v2.3.2 installed and wanted to try the twitter-plugin again after abandoning it earlier in favor for a custom developed twitterstream-client. Setting the proxy-relevant settings to: use\_proxy =\> true p… --- ## [Query database from a filter](https://discuss.elastic.co/t/query-database-from-a-filter/50367)
**Author:** [@wmikew5672](https://discuss.elastic.co/u/wmikew5672)\ **Replies:** 4\ **Last updated:** [May 19, 2016, 11:04am UTC](https://discuss.elastic.co/t/query-database-from-a-filter/50367 "2016-05-19T11:04:08Z")
I'm just new to Elasticsearch, and I'm looking to find a way to get info from a database, based on a value stored in an index tab. I've looked at the jdbc input plugin, however I'd like to do it within a condition in a f… --- ## [Problem in updating beat.hostname](https://discuss.elastic.co/t/problem-in-updating-beat-hostname/50409)
**Author:** [@preehana](https://discuss.elastic.co/u/preehana)\ **Replies:** 1\ **Last updated:** [May 19, 2016, 10:38am UTC](https://discuss.elastic.co/t/problem-in-updating-beat-hostname/50409 "2016-05-19T10:38:59Z")
Hello, I am facing a problem in updating beat.hostname using mutate filter.I have made the following changes in my logstash configuration file . input { beats { port =\> "5044" } } … --- ## [Logstash log waring,how can i do?](https://discuss.elastic.co/t/logstash-log-waring-how-can-i-do/50393)
**Author:** [@Robert\_Wong](https://discuss.elastic.co/u/Robert_Wong)\ **Replies:** 2\ **Last updated:** [May 19, 2016, 7:31am UTC](https://discuss.elastic.co/t/logstash-log-waring-how-can-i-do/50393 "2016-05-19T07:31:07Z")
hi,all i have this log 172.16.36.144 - - \[19/May/2016:10:32:43 +0800\] "GET /seeyon/meetingroom.do?method=checkMeetingRoomIsZY&startDate=2016-05-20%2010:15&endDate=2016-05-20%2013:00&roomId=-5456742528427275524&date=Thu… --- ## [Working with child fields](https://discuss.elastic.co/t/working-with-child-fields/50353)
**Author:** [@ronwest99](https://discuss.elastic.co/u/ronwest99)\ **Replies:** 3\ **Last updated:** [May 19, 2016, 5:35am UTC](https://discuss.elastic.co/t/working-with-child-fields/50353 "2016-05-19T05:35:56Z")
My log looks something like this. "request": { "hostip": "10.7.37.74", "enduserip": "", } Obviously "enduserip": "" is not a valid IP address. I would like to delete the field in this case. This syntax isn… --- ## [Hdfs input plugin for logstash](https://discuss.elastic.co/t/hdfs-input-plugin-for-logstash/50401)
**Author:** [@saggarsunil](https://discuss.elastic.co/u/saggarsunil)\ **Replies:** 0\ **Last updated:** [May 19, 2016, 5:29am UTC](https://discuss.elastic.co/t/hdfs-input-plugin-for-logstash/50401 "2016-05-19T05:29:11Z")
I am planning to read HDFS data using logstash ( & add geoip and other filters, etc) and then send the data to elasticsearch. Earlier, I tried ES-hadoop plugin for moving the data by creating hive tables and it worked.… --- ## [~105 Cisco Grok pattern key/field names](https://discuss.elastic.co/t/105-cisco-grok-pattern-key-field-names/50397)
**Author:** [@dm0000](https://discuss.elastic.co/u/dm0000)\ **Replies:** 0\ **Last updated:** [May 19, 2016, 4:44am UTC](https://discuss.elastic.co/t/105-cisco-grok-pattern-key-field-names/50397 "2016-05-19T04:44:41Z")
There are ~105 distinct Cisco types extracted from the log messages (+/- a few generics). I'm asking this question because I ran into this issue with some custom fields. Is there a functional difference between inter… --- ## [Advanced-Pipeline: Logstash-\>Elasticsearch](https://discuss.elastic.co/t/advanced-pipeline-logstash-elasticsearch/50258)
**Author:** [@Jamen\_McGranahan](https://discuss.elastic.co/u/Jamen_McGranahan)\ **Replies:** 12\ **Last updated:** [May 18, 2016, 8:51pm UTC](https://discuss.elastic.co/t/advanced-pipeline-logstash-elasticsearch/50258 "2016-05-18T20:51:54Z")
I have been trying to follow this guide in order to try to understand this system: https://www.elastic.co/guide/en/logstash/current/advanced-pipeline.html In the middle of the page, it suggests that you issue a test … --- ## [Debugging logstash](https://discuss.elastic.co/t/debugging-logstash/50369)
**Author:** [@jchoinski](https://discuss.elastic.co/u/jchoinski)\ **Replies:** 0\ **Last updated:** [May 18, 2016, 7:52pm UTC](https://discuss.elastic.co/t/debugging-logstash/50369 "2016-05-18T19:52:05Z")
Hello, Is there anyway to attach an IDE to logstash to be able to step through plugin code? I raised an issue here, but I wanted to try to solve the problem myself if I could. Thanks, Juliusz --- ## [Which codec has the best performance?](https://discuss.elastic.co/t/which-codec-has-the-best-performance/50196)
**Author:** [@Piyush\_Goyal](https://discuss.elastic.co/u/Piyush_Goyal)\ **Replies:** 4\ **Last updated:** [May 18, 2016, 7:00pm UTC](https://discuss.elastic.co/t/which-codec-has-the-best-performance/50196 "2016-05-18T19:00:29Z")
Hi Team, In one of our new projects we are trying to use ELK stack with Redis as the buffering interface. I was going through the documentation and different examples over the internet and saw that at most of the place… --- ## [@timestamp converts timezones when it shouldn't - Weird issue](https://discuss.elastic.co/t/timestamp-converts-timezones-when-it-shouldnt-weird-issue/50028)
**Author:** [@thcurrie](https://discuss.elastic.co/u/thcurrie)\ **Replies:** 11\ **Last updated:** [May 18, 2016, 5:15pm UTC](https://discuss.elastic.co/t/timestamp-converts-timezones-when-it-shouldnt-weird-issue/50028 "2016-05-18T17:15:05Z")
Hello, I'm new to Elastic Search Logstash and Kibana and would appreciate some help with an issue I've been unable to resolve. I'm forwarding logs from various labs in Canada (EDT), Turkey (EEST), and Vietnam (IST) usi… --- ## [Date filter not working \[Solved\]](https://discuss.elastic.co/t/date-filter-not-working-solved/50348)
**Author:** [@ruival](https://discuss.elastic.co/u/ruival)\ **Replies:** 1\ **Last updated:** [May 18, 2016, 4:41pm UTC](https://discuss.elastic.co/t/date-filter-not-working-solved/50348 "2016-05-18T16:41:46Z")
Hi all, my first post on logstash forum :spy: i'm reading events from database using logstash. The events are indexed in elasticsearch. There is a event\_timestamp in the table , the column name is "EVENT\_TIMESTAMP" … --- ## [SQS input plugin only pulls one JSON object from SQS Payload](https://discuss.elastic.co/t/sqs-input-plugin-only-pulls-one-json-object-from-sqs-payload/50352)
**Author:** [@packplusplus](https://discuss.elastic.co/u/packplusplus)\ **Replies:** 2\ **Last updated:** [May 18, 2016, 4:15pm UTC](https://discuss.elastic.co/t/sqs-input-plugin-only-pulls-one-json-object-from-sqs-payload/50352 "2016-05-18T16:15:10Z")
When using the SQS input plugin from the 2.0 branch, and (some of the) 1.5 branch. Payloads with multiple json objects only return a single json object. When using the json codec, it returns the last json object in the p… --- ## [\[solved\] Nxlog -\> logstash -\> elasticsearch](https://discuss.elastic.co/t/solved-nxlog-logstash-elasticsearch/50263)
**Author:** [@bbach](https://discuss.elastic.co/u/bbach)\ **Replies:** 5\ **Last updated:** [May 18, 2016, 4:09pm UTC](https://discuss.elastic.co/t/solved-nxlog-logstash-elasticsearch/50263 "2016-05-18T16:09:25Z")
Update: Really was a misunderstanding. Needed codec =\> rubydebug in my stdout output to see what I was expecting Of course this was all working but I upgraded -- sigh. ubuntu 14.04 nxlog-ce 2.7.1191 logstash 2.3.2 … --- ## [ElasticSearch partial re-index with Logstash](https://discuss.elastic.co/t/elasticsearch-partial-re-index-with-logstash/50085)
**Author:** [@jetnet](https://discuss.elastic.co/u/jetnet)\ **Replies:** 8\ **Last updated:** [May 18, 2016, 3:41pm UTC](https://discuss.elastic.co/t/elasticsearch-partial-re-index-with-logstash/50085 "2016-05-18T15:41:08Z")
Hi All! I'm trying to re-index data from one ES cluster to another with { "match\_all": {} } query, but I'd like to limit the result set by a certain number. Currently, all "total" hits are being fetched from the sourc… --- ## [Indexing stops after 1000 records](https://discuss.elastic.co/t/indexing-stops-after-1000-records/50341)
**Author:** [@sanju1323](https://discuss.elastic.co/u/sanju1323)\ **Replies:** 0\ **Last updated:** [May 18, 2016, 2:01pm UTC](https://discuss.elastic.co/t/indexing-stops-after-1000-records/50341 "2016-05-18T14:01:34Z")
I'm trying to reindex using logstash. I have total 25000 recodrs that are to be indexed. Whenever I run the following logstash file, it stops at 1000 records. Is there anything that I have to change in the following logs… --- ## [Logstash application log writting to same file continueosly](https://discuss.elastic.co/t/logstash-application-log-writting-to-same-file-continueosly/50321)
**Author:** [@baneshbanna](https://discuss.elastic.co/u/baneshbanna)\ **Replies:** 1\ **Last updated:** [May 18, 2016, 11:23am UTC](https://discuss.elastic.co/t/logstash-application-log-writting-to-same-file-continueosly/50321 "2016-05-18T11:23:42Z")
Logstash application writting continuosly logs to one file. After some days it becoming a bigger file.Not able to read or open. How make it to rolling every day. logstash instance running as a service. Thanks in advanc… --- ## [Logstash IdentityMapCodec has reached 80% capacity"](https://discuss.elastic.co/t/logstash-identitymapcodec-has-reached-80-capacity/50320)
**Author:** [@baneshbanna](https://discuss.elastic.co/u/baneshbanna)\ **Replies:** 1\ **Last updated:** [May 18, 2016, 11:23am UTC](https://discuss.elastic.co/t/logstash-identitymapcodec-has-reached-80-capacity/50320 "2016-05-18T11:23:17Z")
{:timestamp=\>"2016-05-18T09:54:51.819000+0100", :message=\>"IdentityMapCodec has reached 80% capacity", :current\_size=\>16763, :upper\_limit=\>20000, :level=\>:warn} This error printing in the logstash log file continuosly … --- ## [Logstash as a service, how to supply flags?](https://discuss.elastic.co/t/logstash-as-a-service-how-to-supply-flags/50301)
**Author:** [@YvesC](https://discuss.elastic.co/u/YvesC)\ **Replies:** 1\ **Last updated:** [May 18, 2016, 7:44am UTC](https://discuss.elastic.co/t/logstash-as-a-service-how-to-supply-flags/50301 "2016-05-18T07:44:46Z")
Hi all, I haven't been working long with logstash but I can't seem to find a solution for the following problem. I've set up a docker with log stash (version 2.3), where it runs as a service Now I am trying to read an e… --- ## [\[solved\]](https://discuss.elastic.co/t/solved/48400)
**Author:** [@stefansaye](https://discuss.elastic.co/u/stefansaye)\ **Replies:** 0\ **Last updated:** [April 26, 2016, 9:09am UTC](https://discuss.elastic.co/t/solved/48400 "2016-04-26T09:09:03Z")
\[SOLVED\] duplicate question --- ## [Jdbc input in multi-node Logstash tier](https://discuss.elastic.co/t/jdbc-input-in-multi-node-logstash-tier/50309)
**Author:** [@R\_T](https://discuss.elastic.co/u/R_T)\ **Replies:** 0\ **Last updated:** [May 18, 2016, 6:57am UTC](https://discuss.elastic.co/t/jdbc-input-in-multi-node-logstash-tier/50309 "2016-05-18T06:57:30Z")
I have a multi-node Logstash tier where the deployment process distributes identical configuration between the nodes. This is fine for where all the logstash config is passive and content is fed from syslog and beats … --- ## [Logstash configure error?](https://discuss.elastic.co/t/logstash-configure-error/50180)
**Author:** [@Robert\_Wong](https://discuss.elastic.co/u/Robert_Wong)\ **Replies:** 2\ **Last updated:** [May 18, 2016, 6:43am UTC](https://discuss.elastic.co/t/logstash-configure-error/50180 "2016-05-18T06:43:11Z")
hi, i's my logstash filter conf,like this if \[url\_M\] == "isOldPasswordCorrect" { metrics { meter =\> \[ "passauth" \] add\_tag =\> "metric" } if "metric" in \[tags\] { … --- ## [Syslog input filling disk](https://discuss.elastic.co/t/syslog-input-filling-disk/50286)
**Author:** [@ironbeast](https://discuss.elastic.co/u/ironbeast)\ **Replies:** 4\ **Last updated:** [May 18, 2016, 5:57am UTC](https://discuss.elastic.co/t/syslog-input-filling-disk/50286 "2016-05-18T05:57:58Z")
Hi All, I have possible a dumb question... :-). We have 4 logstash servers running and are configured to receive syslog messages. But, the catch is that apparently logstash doesn't send the logs directly (parsed) to el… --- ## [Logstash mutate - rename field that occurs as an array](https://discuss.elastic.co/t/logstash-mutate-rename-field-that-occurs-as-an-array/50096)
**Author:** [@lpiera](https://discuss.elastic.co/u/lpiera)\ **Replies:** 5\ **Last updated:** [May 18, 2016, 5:57am UTC](https://discuss.elastic.co/t/logstash-mutate-rename-field-that-occurs-as-an-array/50096 "2016-05-18T05:57:31Z")
Hi, I'm trying to rename a field within an Elasticsearch type using the mutate filter. This particular field occurs within a zero-to-many array. Here is a mapping that closely resembles mine (the names have been change… --- ## [Consolidate rows for elasticsearch output](https://discuss.elastic.co/t/consolidate-rows-for-elasticsearch-output/50251)
**Author:** [@piyush](https://discuss.elastic.co/u/piyush)\ **Replies:** 1\ **Last updated:** [May 18, 2016, 5:51am UTC](https://discuss.elastic.co/t/consolidate-rows-for-elasticsearch-output/50251 "2016-05-18T05:51:18Z")
Dear Team, I am trying to create index name from various fields which i am retrieving from different rows (grok-match). But as fields are coming from various rows, what is the best way to give logical name as index name? … [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1151) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1153)