# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1157 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1158 --- ## [Logstash 5.0.0-alpha2 - Can't update plugins](https://discuss.elastic.co/t/logstash-5-0-0-alpha2-cant-update-plugins/49502)
**Author:** [@ceekay](https://discuss.elastic.co/u/ceekay)\ **Replies:** 0\ **Last updated:** [May 9, 2016, 1:10am UTC](https://discuss.elastic.co/t/logstash-5-0-0-alpha2-cant-update-plugins/49502 "2016-05-09T01:10:02Z")
I'm trying to update plugins to resolve an existing problem with 5.0.0-alpha2, but getting two different issues: Updating a specific plugin with bin/logstash-plugin update logstash-output-rabbitmq responds with Update… --- ## [Grok match](https://discuss.elastic.co/t/grok-match/49499)
**Author:** [@Valeriy](https://discuss.elastic.co/u/Valeriy)\ **Replies:** 2\ **Last updated:** [May 8, 2016, 11:54pm UTC](https://discuss.elastic.co/t/grok-match/49499 "2016-05-08T23:54:35Z")
Hello! I'm just starting to work with a stack of ELK. Config was created by another engineer. Explain how it works, please. grok { match =\> { "message" =\> "\\A.\*%{IP:hostI… --- ## [Logstash 5.0.0 alpha2 won't start with RMQ output](https://discuss.elastic.co/t/logstash-5-0-0-alpha2-wont-start-with-rmq-output/49120)
**Author:** [@ceekay](https://discuss.elastic.co/u/ceekay)\ **Replies:** 2\ **Last updated:** [May 8, 2016, 11:31pm UTC](https://discuss.elastic.co/t/logstash-5-0-0-alpha2-wont-start-with-rmq-output/49120 "2016-05-08T23:31:29Z")
Unsure if this is a Logstash or RMQ plugin issue. Since upgrading from LS 5.0.0 alpha1 to alpha2, Logstash is aborting startup if the RMQ output w/SSL is enabled. Pipeline aborted due to error {:exception=\>java.securi… --- ## [WARNING: SSLSocket#session= is not supported when installing logstash plugin](https://discuss.elastic.co/t/warning-sslsocket-session-is-not-supported-when-installing-logstash-plugin/49498)
**Author:** [@geekpete](https://discuss.elastic.co/u/geekpete)\ **Replies:** 0\ **Last updated:** [May 8, 2016, 10:05pm UTC](https://discuss.elastic.co/t/warning-sslsocket-session-is-not-supported-when-installing-logstash-plugin/49498 "2016-05-08T22:05:44Z")
This is super low priority because the plugin actually installs just fine even with these warnings, but perhaps this output could be altered to be more user friendly. I still see this warning with logstash 2.3.2 with t… --- ## [Parse Logstash.log with logstash](https://discuss.elastic.co/t/parse-logstash-log-with-logstash/49061)
**Author:** [@webofmars](https://discuss.elastic.co/u/webofmars)\ **Replies:** 1\ **Last updated:** [May 8, 2016, 8:13pm UTC](https://discuss.elastic.co/t/parse-logstash-log-with-logstash/49061 "2016-05-08T20:13:30Z")
Hello, That might sounds a bit silly question (or circular one...) but how do you parse logstah.log with logstash itself. I always thought that it was json format but the ':' at the start seems to say that it isn't. … --- ## [Installing logstash plugins locally](https://discuss.elastic.co/t/installing-logstash-plugins-locally/49495)
**Author:** [@imad](https://discuss.elastic.co/u/imad)\ **Replies:** 0\ **Last updated:** [May 8, 2016, 7:54pm UTC](https://discuss.elastic.co/t/installing-logstash-plugins-locally/49495 "2016-05-08T19:54:35Z")
Hi, I am having trouble with latest logstash-coucdb plugin ie., when data is deleted from couchdb its not deleted in ES and an extra dummy sort of record gets created in ES as follows. \`{ "index": "userindex", … --- ## [No .raw field](https://discuss.elastic.co/t/no-raw-field/49342)
**Author:** [@Andre\_de\_Martini](https://discuss.elastic.co/u/Andre_de_Martini)\ **Replies:** 3\ **Last updated:** [May 8, 2016, 7:45pm UTC](https://discuss.elastic.co/t/no-raw-field/49342 "2016-05-08T19:45:35Z")
Hi people!! Don't know why but my latest logstash/elasticsearch/kibana are not using the .raw fields (I guess that it is true by default isnt?). The real problem is that my string fields are been split by the spaces … --- ## [Logstash testing a configuration pipeline failing(Translation missing)](https://discuss.elastic.co/t/logstash-testing-a-configuration-pipeline-failing-translation-missing/49489)
**Author:** [@bhargavay5](https://discuss.elastic.co/u/bhargavay5)\ **Replies:** 1\ **Last updated:** [May 8, 2016, 7:26pm UTC](https://discuss.elastic.co/t/logstash-testing-a-configuration-pipeline-failing-translation-missing/49489 "2016-05-08T19:26:20Z")
Please see http://stackoverflow.com/questions/37101865/logstash-testing-a-configuration-pipeline-failingtranslation-missing for even images of stack trace and my config files New to logstash and following the tutorial … --- ## [How do I get an invite to the irc channel?](https://discuss.elastic.co/t/how-do-i-get-an-invite-to-the-irc-channel/49475)
**Author:** [@nateuni](https://discuss.elastic.co/u/nateuni)\ **Replies:** 6\ **Last updated:** [May 8, 2016, 7:54am UTC](https://discuss.elastic.co/t/how-do-i-get-an-invite-to-the-irc-channel/49475 "2016-05-08T07:54:08Z")
I used to just be able to log in no issues... anyone know what is going on? --- ## [Translate filter error with dictionary file](https://discuss.elastic.co/t/translate-filter-error-with-dictionary-file/47507)
**Author:** [@GambitK](https://discuss.elastic.co/u/GambitK)\ **Replies:** 5\ **Last updated:** [May 8, 2016, 12:04am UTC](https://discuss.elastic.co/t/translate-filter-error-with-dictionary-file/47507 "2016-05-08T00:04:19Z")
Logstash is giving me an error with the translate filter, it says that the dictionary file format is not correct: Pipeline aborted due to error {:exception=\>#, :backtrace=\>\["/opt/logstash/vendor/bundle/jruby/1.9/gems/l… --- ## [Null validation in logstash](https://discuss.elastic.co/t/null-validation-in-logstash/49456)
**Author:** [@baneshbanna](https://discuss.elastic.co/u/baneshbanna)\ **Replies:** 7\ **Last updated:** [May 7, 2016, 10:26pm UTC](https://discuss.elastic.co/t/null-validation-in-logstash/49456 "2016-05-07T22:26:55Z")
How to check null dates in logstash. Null validation in logstash. I added below configuration is it correct if\[datetime\]!='null' and \[datetime\]!='NULL'{ --- ## [Logstash NGINX Generic and NAXSI Error pattern parse failure](https://discuss.elastic.co/t/logstash-nginx-generic-and-naxsi-error-pattern-parse-failure/49278)
**Author:** [@reinier](https://discuss.elastic.co/u/reinier)\ **Replies:** 2\ **Last updated:** [May 7, 2016, 12:07pm UTC](https://discuss.elastic.co/t/logstash-nginx-generic-and-naxsi-error-pattern-parse-failure/49278 "2016-05-07T12:07:06Z")
Hi All, We are using NGINX in combination with NAXSI and just started using Logstash inside an ELK Stack. When NAXSI blocks a specific request it logs this in the NGINX error log. These logs are shipped using Filebeat … --- ## [How to convert a field string to long in logstash](https://discuss.elastic.co/t/how-to-convert-a-field-string-to-long-in-logstash/49453)
**Author:** [@baneshbanna](https://discuss.elastic.co/u/baneshbanna)\ **Replies:** 3\ **Last updated:** [May 7, 2016, 8:24am UTC](https://discuss.elastic.co/t/how-to-convert-a-field-string-to-long-in-logstash/49453 "2016-05-07T08:24:23Z")
HI, How to convert string field to long in logstash. When i configured data type as long like below logstash not running. mutate { convert =\> { "clientid" =\> "long" } convert =\> { "groupid" =\> "long" } … --- ## [Varnishlog is not working for varnish4](https://discuss.elastic.co/t/varnishlog-is-not-working-for-varnish4/49398)
**Author:** [@vikalp](https://discuss.elastic.co/u/vikalp)\ **Replies:** 1\ **Last updated:** [May 7, 2016, 7:19am UTC](https://discuss.elastic.co/t/varnishlog-is-not-working-for-varnish4/49398 "2016-05-07T07:19:55Z")
I want to process the varnishlog ( varnish 4) , i am able to process logs generated by varnishncsa, through filebeat - logstash and elastisearch,. But i want to process varnishlog too we have these logs in file as wel… --- ## [Problem with large files & output](https://discuss.elastic.co/t/problem-with-large-files-output/49378)
**Author:** [@Janet](https://discuss.elastic.co/u/Janet)\ **Replies:** 4\ **Last updated:** [May 7, 2016, 4:15am UTC](https://discuss.elastic.co/t/problem-with-large-files-output/49378 "2016-05-07T04:15:40Z")
I have a case that works fine on logstash 1.5.x but breaks in 2.2, 2.3, and 5.0 (I haven't tried 2.0 or 2.1). I have hourly syslog files that are approximately 3 gig each. I'm trying to backfill logs going back to Janu… --- ## [My translate plugin doesn't seem to work with a dictionary file](https://discuss.elastic.co/t/my-translate-plugin-doesnt-seem-to-work-with-a-dictionary-file/49359)
**Author:** [@lask001](https://discuss.elastic.co/u/lask001)\ **Replies:** 2\ **Last updated:** [May 7, 2016, 12:45am UTC](https://discuss.elastic.co/t/my-translate-plugin-doesnt-seem-to-work-with-a-dictionary-file/49359 "2016-05-07T00:45:55Z")
I can't explain why this doesn't work, and it's really irking me, hoping someone could take a look and help me out. mutate { add\_field =\> \[ "dictionary\_lookup", "%{host} %{sitename}" \] } translate { f… --- ## [Grab value from message field and add it to a new field](https://discuss.elastic.co/t/grab-value-from-message-field-and-add-it-to-a-new-field/49358)
**Author:** [@niraj\_kumar](https://discuss.elastic.co/u/niraj_kumar)\ **Replies:** 4\ **Last updated:** [May 6, 2016, 9:37pm UTC](https://discuss.elastic.co/t/grab-value-from-message-field-and-add-it-to-a-new-field/49358 "2016-05-06T21:37:59Z")
Hi, How do i grab a particular value from my initial message field and use to configure it in a new field. My message field looks like this: 2016-05-05 23:47:30,939 INFO \[qtp796460995-1114\] \[puppet-server\] Puppe… --- ## [Logstash 2.3.1, my logstash.conf throwing error as i try to connect to remote nagios core which uses nagios output pluting](https://discuss.elastic.co/t/logstash-2-3-1-my-logstash-conf-throwing-error-as-i-try-to-connect-to-remote-nagios-core-which-uses-nagios-output-pluting/49435)
**Author:** [@rbdickson2](https://discuss.elastic.co/u/rbdickson2)\ **Replies:** 1\ **Last updated:** [May 6, 2016, 9:04pm UTC](https://discuss.elastic.co/t/logstash-2-3-1-my-logstash-conf-throwing-error-as-i-try-to-connect-to-remote-nagios-core-which-uses-nagios-output-pluting/49435 "2016-05-06T21:04:37Z")
below is my logstash.conf file along with error I am receiving from the logs once logstash is bounced to pick up the new config file. Can some one provide or give some logstash conf example real world code using Nagios … --- ## [Logstash Netflow](https://discuss.elastic.co/t/logstash-netflow/49360)
**Author:** [@tpnoonan](https://discuss.elastic.co/u/tpnoonan)\ **Replies:** 2\ **Last updated:** [May 6, 2016, 9:03pm UTC](https://discuss.elastic.co/t/logstash-netflow/49360 "2016-05-06T21:03:08Z")
There was some recent ipfix changes picked up from the logstash-netflow repository. Stupid question, how would i know when those changes are actually picked up they a GA release of Logstash? I'm trying to be patient an… --- ## [Logstash to make plugin or not to make plugin for nagios](https://discuss.elastic.co/t/logstash-to-make-plugin-or-not-to-make-plugin-for-nagios/24465)
**Author:** [@eperry](https://discuss.elastic.co/u/eperry)\ **Replies:** 1\ **Last updated:** [May 6, 2016, 8:51pm UTC](https://discuss.elastic.co/t/logstash-to-make-plugin-or-not-to-make-plugin-for-nagios/24465 "2016-05-06T20:51:47Z")
So I am debating the idea of making a Nagios plugin but I am not sure what kind I should make I am wondering how far I should take it, I think it would be really cool if I re-wrote the nagios "scheduler" and was a… --- ## [Setting variables in logstash configuration files](https://discuss.elastic.co/t/setting-variables-in-logstash-configuration-files/49431)
**Author:** [@Ryan\_Groten](https://discuss.elastic.co/u/Ryan_Groten)\ **Replies:** 1\ **Last updated:** [May 6, 2016, 8:49pm UTC](https://discuss.elastic.co/t/setting-variables-in-logstash-configuration-files/49431 "2016-05-06T20:49:58Z")
I have multiple logstash clients that use identical logstash configurations except for small things like the path to the file to monitor. I'm wondering if this value can be parameterized for easier templating? Current… --- ## [Logstash elasticsearch output, parent/child](https://discuss.elastic.co/t/logstash-elasticsearch-output-parent-child/47667)
**Author:** [@raleel](https://discuss.elastic.co/u/raleel)\ **Replies:** 1\ **Last updated:** [May 6, 2016, 5:33pm UTC](https://discuss.elastic.co/t/logstash-elasticsearch-output-parent-child/47667 "2016-05-06T17:33:32Z")
It appears to me that the elasticsearch output module is not properly passing at least the parent parameter along with it. I'm not sure why. The document\_id and parent parameters are in the data, and confirmed to be cons… --- ## [Need help on Logstash server](https://discuss.elastic.co/t/need-help-on-logstash-server/49169)
**Author:** [@vmankala](https://discuss.elastic.co/u/vmankala)\ **Replies:** 8\ **Last updated:** [May 6, 2016, 12:53pm UTC](https://discuss.elastic.co/t/need-help-on-logstash-server/49169 "2016-05-06T12:53:40Z")
I have installed filebeat on 172-31-0-204 and logstash on 172-31-0-207. I created the ES domain in AWS and gave that domain in logstash config file on 172-31-0-207. The issue is when I give below command in logstash serv… --- ## [Where can I find logs on Linux machine](https://discuss.elastic.co/t/where-can-i-find-logs-on-linux-machine/49312)
**Author:** [@nitesh](https://discuss.elastic.co/u/nitesh)\ **Replies:** 8\ **Last updated:** [May 6, 2016, 12:39pm UTC](https://discuss.elastic.co/t/where-can-i-find-logs-on-linux-machine/49312 "2016-05-06T12:39:14Z")
I want to find where are all logs stored on ELK linux box. I want to perform some task on logs like tar and zip. paths: - /var/log/log1.log - /var/log/nova/log2.log I want to see where they are sto… --- ## [LOGSTASH and REDIS input - connection refused from redis](https://discuss.elastic.co/t/logstash-and-redis-input-connection-refused-from-redis/49315)
**Author:** [@sin](https://discuss.elastic.co/u/sin)\ **Replies:** 2\ **Last updated:** [May 6, 2016, 9:06am UTC](https://discuss.elastic.co/t/logstash-and-redis-input-connection-refused-from-redis/49315 "2016-05-06T09:06:52Z")
Hello, Here's my set-up: I'm running 1 vagrant vbox containing ELK, and another vagrant vbox containing a redis machine. On my local machine I'm running a website with a service that sends data to the redis machin… --- ## [Using zeromq out put failed due to 'zmq\_ctx\_new' nout found](https://discuss.elastic.co/t/using-zeromq-out-put-failed-due-to-zmq-ctx-new-nout-found/49380)
**Author:** [@mizeng](https://discuss.elastic.co/u/mizeng)\ **Replies:** 0\ **Last updated:** [May 6, 2016, 8:17am UTC](https://discuss.elastic.co/t/using-zeromq-out-put-failed-due-to-zmq-ctx-new-nout-found/49380 "2016-05-06T08:17:50Z")
Hi dears, I've using logstash config file as below output { zeromq { address =\> \['tcp://127.0.0.1:2120'\] topology =\> "pushpull" } } But met error as below: FFI::NotFoundError: Function 'zmq\_ctx\_new' not fo… --- ## [Using JDBC input meet Incorrect key file for table '/tmp/#sql\_c33\_0.MYI'](https://discuss.elastic.co/t/using-jdbc-input-meet-incorrect-key-file-for-table-tmp-sql-c33-0-myi/49277)
**Author:** [@caoliuxue](https://discuss.elastic.co/u/caoliuxue)\ **Replies:** 1\ **Last updated:** [May 6, 2016, 6:34am UTC](https://discuss.elastic.co/t/using-jdbc-input-meet-incorrect-key-file-for-table-tmp-sql-c33-0-myi/49277 "2016-05-06T06:34:59Z")
Im trying to use a jdbc input to migrate data to ES, I googled but not found a nice solution. This is my conf file: input { jdbc { jdbc\_driver\_library =\> "mysql-connector-java-5.1.36.jar" jdbc\_driver… --- ## [No matching template for flow id 257](https://discuss.elastic.co/t/no-matching-template-for-flow-id-257/49233)
**Author:** [@stecino](https://discuss.elastic.co/u/stecino)\ **Replies:** 1\ **Last updated:** [May 6, 2016, 1:49am UTC](https://discuss.elastic.co/t/no-matching-template-for-flow-id-257/49233 "2016-05-06T01:49:39Z")
Hello, I have the following Netflow config: input { udp { host =\> "0.0.0.0" port =\> 5599 codec =\> netflow { definitions =\> "/home/t/logstash-2.2.2/vendor/bundle/jruby/1.9/gems/logstash-… --- ## [Question related to sizing considerations for LS/ES and expectations of performance](https://discuss.elastic.co/t/question-related-to-sizing-considerations-for-ls-es-and-expectations-of-performance/49201)
**Author:** [@mnantel](https://discuss.elastic.co/u/mnantel)\ **Replies:** 1\ **Last updated:** [May 6, 2016, 12:25am UTC](https://discuss.elastic.co/t/question-related-to-sizing-considerations-for-ls-es-and-expectations-of-performance/49201 "2016-05-06T00:25:35Z")
Hello ES community, First of all, disclaimer: my communications in this forum are solely mine, and do not represent the views of my employer. This is my first post for what really has been significant research made o… --- ## [Need to configure the alert in logstash](https://discuss.elastic.co/t/need-to-configure-the-alert-in-logstash/49357)
**Author:** [@asifalis](https://discuss.elastic.co/u/asifalis)\ **Replies:** 1\ **Last updated:** [May 5, 2016, 11:49pm UTC](https://discuss.elastic.co/t/need-to-configure-the-alert-in-logstash/49357 "2016-05-05T23:49:21Z")
Hi Expert ! I want to configure the alert in logstash, if some condition matched like "404" or "SWIC023" in log message then logstash server generate the alert on specific email. so is it possible that we configure the… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1156) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1158)