# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1156 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1157 --- ## [Why should I not run Logstash as root?](https://discuss.elastic.co/t/why-should-i-not-run-logstash-as-root/49615)
**Author:** [@brayndasilva](https://discuss.elastic.co/u/brayndasilva)\ **Replies:** 1\ **Last updated:** [May 10, 2016, 7:36am UTC](https://discuss.elastic.co/t/why-should-i-not-run-logstash-as-root/49615 "2016-05-10T07:36:38Z")
Hi, I have read that it is not recommended to run Logstash as root, but I need it to capture syslogs from a privileged port. I could set up a rsyslog server that can redirect any messages to a higher port, non-privi… --- ## [Some trouble with if / else in logstash filter block](https://discuss.elastic.co/t/some-trouble-with-if-else-in-logstash-filter-block/48975)
**Author:** [@kheraud](https://discuss.elastic.co/u/kheraud)\ **Replies:** 2\ **Last updated:** [May 10, 2016, 7:29am UTC](https://discuss.elastic.co/t/some-trouble-with-if-else-in-logstash-filter-block/48975 "2016-05-10T07:29:20Z")
Hello, First of all I discover ELK a bit late but I am very enthusiastic about these products. I am starting to play with it but I face a weird issue : impossible to do a simple if / else in my logstash filter block. I t… --- ## [Mutate not converting string to number](https://discuss.elastic.co/t/mutate-not-converting-string-to-number/49309)
**Author:** [@dlastIDBS](https://discuss.elastic.co/u/dlastIDBS)\ **Replies:** 8\ **Last updated:** [May 10, 2016, 7:04am UTC](https://discuss.elastic.co/t/mutate-not-converting-string-to-number/49309 "2016-05-10T07:04:53Z")
Hi, I'm trying to put the .csv output of a JMeter test run into ELK for dashboarding etc. However, when the file is pushed through logstash it sets all the fields to be strings when I want things like 'elapsed' or 'sam… --- ## [Miltiline filter timeout?](https://discuss.elastic.co/t/miltiline-filter-timeout/49614)
**Author:** [@diwertowski](https://discuss.elastic.co/u/diwertowski)\ **Replies:** 0\ **Last updated:** [May 10, 2016, 6:55am UTC](https://discuss.elastic.co/t/miltiline-filter-timeout/49614 "2016-05-10T06:55:13Z")
Hi, I have three multiline filter and they work fine. I test it with 4 "blocks" of logs. The last block don't reach elasticsearch, only if I'll shutdown logstash. I think the last block is waiting for another event. It's… --- ## [Logstash output to AWS S3 bucket not working](https://discuss.elastic.co/t/logstash-output-to-aws-s3-bucket-not-working/47398)
**Author:** [@rains555](https://discuss.elastic.co/u/rains555)\ **Replies:** 6\ **Last updated:** [May 10, 2016, 6:24am UTC](https://discuss.elastic.co/t/logstash-output-to-aws-s3-bucket-not-working/47398 "2016-05-10T06:24:18Z")
Hi, I've tried a couple different ways to output data to an S3 bucket on Amazon. I followed the documentation for output plug-ins to s3 but the function is not working. any suggestions please? filter { } output { stdout… --- ## [Logstash Config for specific log file](https://discuss.elastic.co/t/logstash-config-for-specific-log-file/49522)
**Author:** [@anoopmk007](https://discuss.elastic.co/u/anoopmk007)\ **Replies:** 1\ **Last updated:** [May 10, 2016, 1:53am UTC](https://discuss.elastic.co/t/logstash-config-for-specific-log-file/49522 "2016-05-10T01:53:50Z")
Hello, I am having problem with loading log file from logstash to elasticsearch. Could you please help? Input file line {TYPE:POS, LOCATION:001, DESK:4010, TRAN:1516} Out put expecting:- "TYPE" : POS "LOCATION" : … --- ## [Unable to output csv file from Logstash](https://discuss.elastic.co/t/unable-to-output-csv-file-from-logstash/49588)
**Author:** [@Dark\_Light](https://discuss.elastic.co/u/Dark_Light)\ **Replies:** 4\ **Last updated:** [May 9, 2016, 11:55pm UTC](https://discuss.elastic.co/t/unable-to-output-csv-file-from-logstash/49588 "2016-05-09T23:55:37Z")
I am unable to figure out how to generate \*.csv files from Logstash. My goal is to generate csv files from multiple inputs i.e. winlogbeat, filebeat (from Mac Syslogs) and syslog (from our router). I have these 3 input… --- ## [CSV filter plugin config file error](https://discuss.elastic.co/t/csv-filter-plugin-config-file-error/49451)
**Author:** [@gmackers](https://discuss.elastic.co/u/gmackers)\ **Replies:** 4\ **Last updated:** [May 9, 2016, 10:35pm UTC](https://discuss.elastic.co/t/csv-filter-plugin-config-file-error/49451 "2016-05-09T22:35:00Z")
Hi, newbie logstasher here. I'm trying to run my first logstash instance and having a problem with the config file. When I add a "convert" property to my CSV filter config I get an error. This is fine: convert =\> { "Wh… --- ## [Grok Parsing an Internal JSON Part (IMAP Plugin)](https://discuss.elastic.co/t/grok-parsing-an-internal-json-part-imap-plugin/49471)
**Author:** [@m0tek](https://discuss.elastic.co/u/m0tek)\ **Replies:** 7\ **Last updated:** [May 9, 2016, 9:47pm UTC](https://discuss.elastic.co/t/grok-parsing-an-internal-json-part-imap-plugin/49471 "2016-05-09T21:47:07Z")
I Am familiar with Grok and Regexes , I Have the following Logstash Conf file : Basically it uses the IMAP Plugin in order to read Emails that are sent into the mailbox , As you can see - it tries to parse out (grok) a… --- ## [Add field to the message in logstash](https://discuss.elastic.co/t/add-field-to-the-message-in-logstash/49443)
**Author:** [@stecino](https://discuss.elastic.co/u/stecino)\ **Replies:** 2\ **Last updated:** [May 9, 2016, 9:32pm UTC](https://discuss.elastic.co/t/add-field-to-the-message-in-logstash/49443 "2016-05-09T21:32:48Z")
Hello, I have the following config: input { udp { host =\> "0.0.0.0" port =\> 5544 type =\> "f5-logs" } udp { host =\> "0.0.0.0" port =\> 514 type =\> "firewall-lo… --- ## [Logstash-input-jdbc plugin Error: Unknown setting 'use\_column\_value' for jdbc](https://discuss.elastic.co/t/logstash-input-jdbc-plugin-error-unknown-setting-use-column-value-for-jdbc/49579)
**Author:** [@pandith\_asrar](https://discuss.elastic.co/u/pandith_asrar)\ **Replies:** 2\ **Last updated:** [May 9, 2016, 7:51pm UTC](https://discuss.elastic.co/t/logstash-input-jdbc-plugin-error-unknown-setting-use-column-value-for-jdbc/49579 "2016-05-09T19:51:15Z")
Hi, I am trying to use the option available with the jdbc input plugin and getting the below error: Unknown setting 'use\_column\_value' for jdbc {:level=\>:error} Unknown setting 'tracking\_column' for jdbc {:level=\>:error} … --- ## [Failed to start logstash - invalid dictionary format for translate plugin](https://discuss.elastic.co/t/failed-to-start-logstash-invalid-dictionary-format-for-translate-plugin/49088)
**Author:** [@thomas.dotreppe](https://discuss.elastic.co/u/thomas.dotreppe)\ **Replies:** 4\ **Last updated:** [May 9, 2016, 3:32pm UTC](https://discuss.elastic.co/t/failed-to-start-logstash-invalid-dictionary-format-for-translate-plugin/49088 "2016-05-09T15:32:38Z")
I'm using translate to convert protocols ID (and other stuff) to a name. The configuration for this piece look like: translate { field =\> "protoid" destination =\> "proto" fallback =\> "Unassigned" d… --- ## [Logstash is not reading the last line if EOL character is not found](https://discuss.elastic.co/t/logstash-is-not-reading-the-last-line-if-eol-character-is-not-found/48992)
**Author:** [@asureshkumaran](https://discuss.elastic.co/u/asureshkumaran)\ **Replies:** 2\ **Last updated:** [May 9, 2016, 12:42pm UTC](https://discuss.elastic.co/t/logstash-is-not-reading-the-last-line-if-eol-character-is-not-found/48992 "2016-05-09T12:42:58Z")
I noticed logstash is not reading the last line if EOL character is not present. Here is my configuration. Please help to resolve the issue. input { file { path =\> "C:/temp/file/test/\*.txt" start\_position =\> … --- ## [Host showing as %{host2} in kibana web](https://discuss.elastic.co/t/host-showing-as-host2-in-kibana-web/49092)
**Author:** [@bsmitty111](https://discuss.elastic.co/u/bsmitty111)\ **Replies:** 6\ **Last updated:** [May 9, 2016, 12:39pm UTC](https://discuss.elastic.co/t/host-showing-as-host2-in-kibana-web/49092 "2016-05-09T12:39:33Z")
hello, when I open Kibana, the host mapping field in a search is showing as %{host2} and not the host name, I am not sure what config to look in to resolve this. --- ## [Logstash- JDBC plugin](https://discuss.elastic.co/t/logstash-jdbc-plugin/49540)
**Author:** [@venkatesh](https://discuss.elastic.co/u/venkatesh)\ **Replies:** 1\ **Last updated:** [May 9, 2016, 12:12pm UTC](https://discuss.elastic.co/t/logstash-jdbc-plugin/49540 "2016-05-09T12:12:18Z")
Hi Team, I am new to Elastic Search.I am using MYSQL database. I have 10 records and and i updated the existing record. But in elastic search i am not getting the updated table. below is my config file of logstash i… --- ## [Logstash Conf Error For Tweet](https://discuss.elastic.co/t/logstash-conf-error-for-tweet/49086)
**Author:** [@teatone](https://discuss.elastic.co/u/teatone)\ **Replies:** 30\ **Last updated:** [May 9, 2016, 11:23am UTC](https://discuss.elastic.co/t/logstash-conf-error-for-tweet/49086 "2016-05-09T11:23:22Z")
Hi, I'm trying to do this . But when i wrote all configurations and restart logstash. This error appears "Configuration error. Not restarting. Re-run with configtest parameter for details" . I tryied to find out this … --- ## [Aggregating the log and delete the not required entries](https://discuss.elastic.co/t/aggregating-the-log-and-delete-the-not-required-entries/49536)
**Author:** [@Gaurav\_Harsola](https://discuss.elastic.co/u/Gaurav_Harsola)\ **Replies:** 0\ **Last updated:** [May 9, 2016, 10:17am UTC](https://discuss.elastic.co/t/aggregating-the-log-and-delete-the-not-required-entries/49536 "2016-05-09T10:17:02Z")
Hi, Following are the content of my sample log file which has 2 fields cardNumber and Amount: 825888372935 900 825888372935 2900 825888372936 800 After processing above log ,i want the following as my output 8258883… --- ## [Logstash 2.0.0 vs elasticsearch](https://discuss.elastic.co/t/logstash-2-0-0-vs-elasticsearch/33899)
**Author:** [@PavelPolyakov](https://discuss.elastic.co/u/PavelPolyakov)\ **Replies:** 5\ **Last updated:** [May 9, 2016, 9:46am UTC](https://discuss.elastic.co/t/logstash-2-0-0-vs-elasticsearch/33899 "2016-05-09T09:46:32Z")
Hi, Currently I have logstash 1.5.0 running successfully, with the next elasticsearch output config: elasticsearch { host =\> "host" protocol =\> "http" user =\> … --- ## [Problem with codec multiline](https://discuss.elastic.co/t/problem-with-codec-multiline/49525)
**Author:** [@Alessandro\_Colombo](https://discuss.elastic.co/u/Alessandro_Colombo)\ **Replies:** 0\ **Last updated:** [May 9, 2016, 7:51am UTC](https://discuss.elastic.co/t/problem-with-codec-multiline/49525 "2016-05-09T07:51:17Z")
Hi, I've a strange problem with a multiline codec that doesn't work as i expect. the same pattern work perfectly in a multiline filter. i've logstash 2.1.0 the log begins with this date: 05/06/2016 17:31:15.690 CEST th… --- ## [Help for parsing](https://discuss.elastic.co/t/help-for-parsing/49388)
**Author:** [@Christian16](https://discuss.elastic.co/u/Christian16)\ **Replies:** 4\ **Last updated:** [May 9, 2016, 7:42am UTC](https://discuss.elastic.co/t/help-for-parsing/49388 "2016-05-09T07:42:28Z")
Hello, I'm trying to parse this log thanks to kv plugin: \[TXN\_ID\]: CO151231.2259.A38404\[SERV\]:CASHOUT\[AMT\]:2800\[PR\_MSISDN\]:IND03 So i created a pattern as following: VAR \\\[%{DATA}\\\]%{GREEDYDATA} And my logstash con… --- ## [Problem with exec output](https://discuss.elastic.co/t/problem-with-exec-output/49072)
**Author:** [@marcmga](https://discuss.elastic.co/u/marcmga)\ **Replies:** 2\ **Last updated:** [May 9, 2016, 7:25am UTC](https://discuss.elastic.co/t/problem-with-exec-output/49072 "2016-05-09T07:25:25Z")
Hello, I'm having problems when using exec output. What i'm trying is exec a command. This command is aws cli (which is installed). However i get no errors when logstash executes the command. I think it deals with th… --- ## [@timestamp field not matching with the Actual log field in Kibana](https://discuss.elastic.co/t/timestamp-field-not-matching-with-the-actual-log-field-in-kibana/49511)
**Author:** [@Rohit\_Singh](https://discuss.elastic.co/u/Rohit_Singh)\ **Replies:** 2\ **Last updated:** [May 9, 2016, 6:00am UTC](https://discuss.elastic.co/t/timestamp-field-not-matching-with-the-actual-log-field-in-kibana/49511 "2016-05-09T06:00:42Z")
Continuing the discussion from @timestamp field not matching with the Actual log field: Hi, I have been using ELK for quite a sometime now. My logs are in following pattern May 9 03:45:25 rjedi-04 docker/3fdf29fdc1eb\[… --- ## [Reading shipper files from sub directories](https://discuss.elastic.co/t/reading-shipper-files-from-sub-directories/49458)
**Author:** [@Muhasin\_Cm](https://discuss.elastic.co/u/Muhasin_Cm)\ **Replies:** 4\ **Last updated:** [May 9, 2016, 5:59am UTC](https://discuss.elastic.co/t/reading-shipper-files-from-sub-directories/49458 "2016-05-09T05:59:00Z")
Hi, How can i make logstash read shipper conf files inside the sub directories of /etc/logstash/conf.d/ I have copied the conf file inside /etc/logstash/conf.d/ on sub directories. I need this to be work on the log… --- ## [File input monitoring a file or folder always reads from beginning](https://discuss.elastic.co/t/file-input-monitoring-a-file-or-folder-always-reads-from-beginning/49002)
**Author:** [@gsgokul](https://discuss.elastic.co/u/gsgokul)\ **Replies:** 1\ **Last updated:** [May 8, 2016, 8:11pm UTC](https://discuss.elastic.co/t/file-input-monitoring-a-file-or-folder-always-reads-from-beginning/49002 "2016-05-08T20:11:55Z")
I have a config that reads a folder in linux, issue is logstash always reads from beginning for each modification, After first successful run I add a log entry to the file, logstash reads from beginning instead of readin… --- ## [Patterns Mongo DB errors in Kibana](https://discuss.elastic.co/t/patterns-mongo-db-errors-in-kibana/49266)
**Author:** [@vadimso](https://discuss.elastic.co/u/vadimso)\ **Replies:** 3\ **Last updated:** [May 9, 2016, 5:20am UTC](https://discuss.elastic.co/t/patterns-mongo-db-errors-in-kibana/49266 "2016-05-09T05:20:05Z")
Hello , Your assistance will be appreciated for pattern syntax for Mongo DB errors in Kibana Tnx Vadim --- ## [Aggregate data based on some field](https://discuss.elastic.co/t/aggregate-data-based-on-some-field/49399)
**Author:** [@Gaurav\_Harsola](https://discuss.elastic.co/u/Gaurav_Harsola)\ **Replies:** 6\ **Last updated:** [May 9, 2016, 4:50am UTC](https://discuss.elastic.co/t/aggregate-data-based-on-some-field/49399 "2016-05-09T04:50:40Z")
Hi, Grok pattern (?\\d{0-6}) %{WORD:loglevel} %{BASE10NUM:amount} I have following set of colums col1=cardNUmber,col2=Info,col3=Amount Data are: 123456 Failed 123.40 123456 Failed 1234 123456 Success 1200 123 … --- ## [Kv filter url parsing with dot inside field name](https://discuss.elastic.co/t/kv-filter-url-parsing-with-dot-inside-field-name/49425)
**Author:** [@jmduno](https://discuss.elastic.co/u/jmduno)\ **Replies:** 2\ **Last updated:** [May 9, 2016, 4:27am UTC](https://discuss.elastic.co/t/kv-filter-url-parsing-with-dot-inside-field-name/49425 "2016-05-09T04:27:43Z")
Hello, I am parsing url, and i have warning message : Failed action. {:status=\>400, :action=\>\["index", {:\_id=\>nil, :\_index=\>"logstash-2015.10.07", :\_type=\>"apache-access", :\_routing=\>nil}, 2015-10-07T13:12:35.000Z XX… --- ## [SNMP Trap listener died](https://discuss.elastic.co/t/snmp-trap-listener-died/49376)
**Author:** [@sawwinnnaung](https://discuss.elastic.co/u/sawwinnnaung)\ **Replies:** 2\ **Last updated:** [May 9, 2016, 3:02am UTC](https://discuss.elastic.co/t/snmp-trap-listener-died/49376 "2016-05-09T03:02:38Z")
I use snmp trap input plugin to import log from switch.This is my logstash config input { snmptrap { type =\> "snmptrap" port =\> 162 host =\> "192.168.1.254" community =\> "cisco" yamlmibdir =\> "/opt/logstash/vendor/… --- ## [Kafka to Logstash pipeline not working](https://discuss.elastic.co/t/kafka-to-logstash-pipeline-not-working/49480)
**Author:** [@nateuni](https://discuss.elastic.co/u/nateuni)\ **Replies:** 2\ **Last updated:** [May 9, 2016, 2:46am UTC](https://discuss.elastic.co/t/kafka-to-logstash-pipeline-not-working/49480 "2016-05-09T02:46:05Z")
HI, I have this pipeline: Apache Webserver + Filebeats -\> Logstash1 (no filters) -\> Kafka -\> Logstash2 (Filters) -\> ES + Kibana Via my Kafka consumer, I can see the logs going to the Kafka channel. And in Kibana I ca… --- ## [Logstash InsertingToQueueTakeTooLong error message](https://discuss.elastic.co/t/logstash-insertingtoqueuetaketoolong-error-message/49477)
**Author:** [@nateuni](https://discuss.elastic.co/u/nateuni)\ **Replies:** 2\ **Last updated:** [May 9, 2016, 2:42am UTC](https://discuss.elastic.co/t/logstash-insertingtoqueuetaketoolong-error-message/49477 "2016-05-09T02:42:53Z")
I have been using this pipeline for weeks no issue, today I log on, fire everything up and I am not getting this error message in Logstash: {:timestamp=\>"2016-05-08T07:43:12.806000+0000", :message=\>"CircuitBreaker::re… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1155) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1157)