# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1158 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1159 --- ## [Append json to log message](https://discuss.elastic.co/t/append-json-to-log-message/49209)
**Author:** [@Brandon\_Metcalf](https://discuss.elastic.co/u/Brandon_Metcalf)\ **Replies:** 1\ **Last updated:** [May 5, 2016, 11:24pm UTC](https://discuss.elastic.co/t/append-json-to-log-message/49209 "2016-05-05T23:24:55Z")
We are using an output filter on our senders that looks like output { tcp { host =\> "log.host" port =\> 2009 mode =\> "client" codec =\> "json\_lines" workers =\> 1 } } and on the re… --- ## [How can I get the Logstash Documentation updated](https://discuss.elastic.co/t/how-can-i-get-the-logstash-documentation-updated/49344)
**Author:** [@mwd5650](https://discuss.elastic.co/u/mwd5650)\ **Replies:** 2\ **Last updated:** [May 5, 2016, 10:34pm UTC](https://discuss.elastic.co/t/how-can-i-get-the-logstash-documentation-updated/49344 "2016-05-05T22:34:35Z")
I've been using logstash through several versions and there is an over riding theme, the documentation is inadequate. For example the logstash sqs input and output plugins both have a parameter to specify an asw\_credenti… --- ## [Logstash reports \[0\] \_grokparsefailure](https://discuss.elastic.co/t/logstash-reports-0--grokparsefailure/49245)
**Author:** [@Kennedy\_Kan1](https://discuss.elastic.co/u/Kennedy_Kan1)\ **Replies:** 1\ **Last updated:** [May 5, 2016, 8:49pm UTC](https://discuss.elastic.co/t/logstash-reports-0--grokparsefailure/49245 "2016-05-05T20:49:37Z")
I am using Logstash 2.3 and I have the following conf file. I would expect to see in Kibana in the "Fields" section on the left the options for "JobID" displaying my job codebut I don't. I see @timestamp @version \_… --- ## [Logstash - No results for current time period in kibana](https://discuss.elastic.co/t/logstash-no-results-for-current-time-period-in-kibana/49306)
**Author:** [@bluethundr](https://discuss.elastic.co/u/bluethundr)\ **Replies:** 1\ **Last updated:** [May 5, 2016, 5:42pm UTC](https://discuss.elastic.co/t/logstash-no-results-for-current-time-period-in-kibana/49306 "2016-05-05T17:42:55Z")
Hey all, I'm not seeing any results for the current time period in KIbana for Logstash. I'm seeing messages like this in the Logstash log: {:timestamp=\>"2016-05-05T10:26:39.975000-0400", :message=\>"Beats input: The … --- ## [Iterations of Translate dictionary paths](https://discuss.elastic.co/t/iterations-of-translate-dictionary-paths/49322)
**Author:** [@lask001](https://discuss.elastic.co/u/lask001)\ **Replies:** 3\ **Last updated:** [May 5, 2016, 5:35pm UTC](https://discuss.elastic.co/t/iterations-of-translate-dictionary-paths/49322 "2016-05-05T17:35:20Z")
Hi - I am trying to create a dynamic dictionary\_path for the translate function that will allow me to import IIS sitename values. As it stands right now, I have the following filter working: translate{ dictionary\_pa… --- ## [Accepting a batch of logs](https://discuss.elastic.co/t/accepting-a-batch-of-logs/49319)
**Author:** [@timjohnson](https://discuss.elastic.co/u/timjohnson)\ **Replies:** 1\ **Last updated:** [May 5, 2016, 5:34pm UTC](https://discuss.elastic.co/t/accepting-a-batch-of-logs/49319 "2016-05-05T17:34:39Z")
I have a need to send directly from the browser a batch of logs directly into logstash http input. So we have developers logging a bunch of information, we then batch those logs and until we reach say 1000 entries, we ta… --- ## [Logstash Grok pattern](https://discuss.elastic.co/t/logstash-grok-pattern/49068)
**Author:** [@James\_Hamilton](https://discuss.elastic.co/u/James_Hamilton)\ **Replies:** 2\ **Last updated:** [May 5, 2016, 5:15pm UTC](https://discuss.elastic.co/t/logstash-grok-pattern/49068 "2016-05-05T17:15:40Z")
I have the following log entry and grok pattern below, using the multiline filter in logstash. It works on http://grokconstructor.appspot.com/ but not when I use logstash. WCCOAui (5), 2016.04.12 10:10:37.630, CTR… --- ## [Filter Not Working (Version 2.3.1)](https://discuss.elastic.co/t/filter-not-working-version-2-3-1/48889)
**Author:** [@VenkataMR](https://discuss.elastic.co/u/VenkataMR)\ **Replies:** 4\ **Last updated:** [May 5, 2016, 5:09pm UTC](https://discuss.elastic.co/t/filter-not-working-version-2-3-1/48889 "2016-05-05T17:09:35Z")
New to Logstash, was trying to filer certain messages which have matching either of INFO, ERROR, WARNING and having time stamp in certain format only. I don't want any other message by having bellow filter. filter { … --- ## [Creating new field with logstash](https://discuss.elastic.co/t/creating-new-field-with-logstash/49194)
**Author:** [@Kennedy\_Kan1](https://discuss.elastic.co/u/Kennedy_Kan1)\ **Replies:** 2\ **Last updated:** [May 5, 2016, 5:03pm UTC](https://discuss.elastic.co/t/creating-new-field-with-logstash/49194 "2016-05-05T17:03:18Z")
I have a file named "Job Code.txt" job\_id=0001,description=Ship data from server to elknode1,result=OK job\_id=0002,description=Ship data from server to elknode2,result=Error: Msg... job\_id=0003,description=Ship data … --- ## [@timestamp not overwriten by date filter](https://discuss.elastic.co/t/timestamp-not-overwriten-by-date-filter/48197)
**Author:** [@daq](https://discuss.elastic.co/u/daq)\ **Replies:** 11\ **Last updated:** [May 5, 2016, 1:48am UTC](https://discuss.elastic.co/t/timestamp-not-overwriten-by-date-filter/48197 "2016-05-05T01:48:51Z")
I'm trying to back fill catalina.out from Tomcat so I need to overwrite timestamp with the one from the logs. Example message is: \[INFO\] 2016-04-22 17:50:20,769 \[Blah1\] \[Blah2\] ... My filter is: filter { if \[type… --- ## [\`service logstash start\` doesn't work](https://discuss.elastic.co/t/service-logstash-start-doesnt-work/48384)
**Author:** [@g0c00l.g33k](https://discuss.elastic.co/u/g0c00l.g33k)\ **Replies:** 6\ **Last updated:** [May 5, 2016, 1:26pm UTC](https://discuss.elastic.co/t/service-logstash-start-doesnt-work/48384 "2016-05-05T13:26:54Z")
Hi, I recently updated logstash to 2.2.4, after which sudo service logstash start doesn't work as expected. It says logstash started but after few seconds if I check the status it says logstash is not runnig. Howe… --- ## [Example for remote path in logstash conf file](https://discuss.elastic.co/t/example-for-remote-path-in-logstash-conf-file/49260)
**Author:** [@vadimso](https://discuss.elastic.co/u/vadimso)\ **Replies:** 8\ **Last updated:** [May 5, 2016, 9:54am UTC](https://discuss.elastic.co/t/example-for-remote-path-in-logstash-conf-file/49260 "2016-05-05T09:54:21Z")
Hello All, Can someone give me pls example how to specify remote path in logstash conf file? i mean in section :input { file { path =\> REMOTE PATH (to other server in linux environment) Tnx Vadim --- ## [JSON Error](https://discuss.elastic.co/t/json-error/48788)
**Author:** [@praveen\_siem](https://discuss.elastic.co/u/praveen_siem)\ **Replies:** 10\ **Last updated:** [May 5, 2016, 8:46am UTC](https://discuss.elastic.co/t/json-error/48788 "2016-05-05T08:46:52Z")
Hello, We are in a process of OSSEC-ELK integration. We have finished the initial installations. We are facing below issues: When we are executing the command : service logstash-forwarder start we are getting the e… --- ## [Grok for code to get formatted output](https://discuss.elastic.co/t/grok-for-code-to-get-formatted-output/49132)
**Author:** [@prakashkumar](https://discuss.elastic.co/u/prakashkumar)\ **Replies:** 14\ **Last updated:** [May 5, 2016, 8:30am UTC](https://discuss.elastic.co/t/grok-for-code-to-get-formatted-output/49132 "2016-05-05T08:30:28Z")
My filebeat0.yml filebeat: prospectors: - paths: - c:/Users/akashsoni/Downloads/k/logstash-tutorial/tutorial/\*.log - c:/Users/akashsoni/Downloads/k/logstash-tutorial/tutorial/\*.err input\_type: log … --- ## [Error "Unknown setting 'protocol' for elasticsearch"](https://discuss.elastic.co/t/error-unknown-setting-protocol-for-elasticsearch/49264)
**Author:** [@RdrgPorto](https://discuss.elastic.co/u/RdrgPorto)\ **Replies:** 8\ **Last updated:** [May 5, 2016, 8:27am UTC](https://discuss.elastic.co/t/error-unknown-setting-protocol-for-elasticsearch/49264 "2016-05-05T08:27:08Z")
Hi, I have installed Logstash 2.3.1 and logstash-output-elasticsearch\_java.gem because I would like to use the options: protocol, cluster and node\_name in my output. When Logstash starts I receive the next error: {… --- ## [Multiple filter files for different host](https://discuss.elastic.co/t/multiple-filter-files-for-different-host/49262)
**Author:** [@Muhasin\_Cm](https://discuss.elastic.co/u/Muhasin_Cm)\ **Replies:** 3\ **Last updated:** [May 5, 2016, 7:34am UTC](https://discuss.elastic.co/t/multiple-filter-files-for-different-host/49262 "2016-05-05T07:34:06Z")
Hi , I have installed ELK stack on a linux machine and sending events using filebeat from different files.I have installed filebeat on different machines. The process is like below filebeat =\> logstash shipper =\> r… --- ## [Beat and lumber jack input at the same time](https://discuss.elastic.co/t/beat-and-lumber-jack-input-at-the-same-time/49138)
**Author:** [@sunilmchaudhari](https://discuss.elastic.co/u/sunilmchaudhari)\ **Replies:** 1\ **Last updated:** [May 5, 2016, 3:25am UTC](https://discuss.elastic.co/t/beat-and-lumber-jack-input-at-the-same-time/49138 "2016-05-05T03:25:38Z")
Hi, I am migrating from LSF to FB. Can I have 2 inputs in LS-Shipper so that it will accept data from LSF and FB at the same time? I need this because I want to migrate clients from LSF to FB one by one and not all in … --- ## [Plugin pack missing installed plugins](https://discuss.elastic.co/t/plugin-pack-missing-installed-plugins/49221)
**Author:** [@Nathan\_Reese](https://discuss.elastic.co/u/Nathan_Reese)\ **Replies:** 0\ **Last updated:** [May 4, 2016, 7:31pm UTC](https://discuss.elastic.co/t/plugin-pack-missing-installed-plugins/49221 "2016-05-04T19:31:56Z")
I am trying to use plugin pack to export plugins to systems without connectivity. I am attempting to test out the functionality with a simple plugin provided by Elastic - logstash-input-example. After building and inst… --- ## [Logstash grok parse error parsing log file](https://discuss.elastic.co/t/logstash-grok-parse-error-parsing-log-file/49016)
**Author:** [@stefansaye](https://discuss.elastic.co/u/stefansaye)\ **Replies:** 3\ **Last updated:** [May 4, 2016, 5:35pm UTC](https://discuss.elastic.co/t/logstash-grok-parse-error-parsing-log-file/49016 "2016-05-04T17:35:16Z")
Hello, i try to parse my log and get these values looks like interfaces =\> PP/0/P1/CPU0 timestamp =\> 2016-05-03 19:37:08.879 message =\> mp\[1051\]: %ROUTING-MP-5-INIT\_PEER\_UP\_DOWN : MP peer down: 1.2.3.4 : recei… --- ## [Logstash not indexing data](https://discuss.elastic.co/t/logstash-not-indexing-data/49093)
**Author:** [@dhy3ives](https://discuss.elastic.co/u/dhy3ives)\ **Replies:** 4\ **Last updated:** [May 4, 2016, 3:34pm UTC](https://discuss.elastic.co/t/logstash-not-indexing-data/49093 "2016-05-04T15:34:00Z")
Trying input some log files into my elastic+logstash+kibana, but i have some problems. I make my pattern in http://grokdebug.herokuapp.com, in the web test all works perfect, but when i run the logstash the server not w… --- ## ['bin/logstash -f logstash.conf --configtest' takes ages to execute](https://discuss.elastic.co/t/bin-logstash-f-logstash-conf-configtest-takes-ages-to-execute/49191)
**Author:** [@dcollado](https://discuss.elastic.co/u/dcollado)\ **Replies:** 0\ **Last updated:** [May 4, 2016, 2:48pm UTC](https://discuss.elastic.co/t/bin-logstash-f-logstash-conf-configtest-takes-ages-to-execute/49191 "2016-05-04T14:48:52Z")
I was testing Logstash 5.0.0-alpha2 in my CentOS Linux release 7.2.1511 (Core) VM with 8 GB RAM and 4 VCPUs. I have installed java version "1.8.0\_92" Java(TM) SE Runtime Environment (build 1.8.0\_92-b14) Java HotSpot(T… --- ## [How to combine text file result?](https://discuss.elastic.co/t/how-to-combine-text-file-result/49117)
**Author:** [@Kennedy\_Kan1](https://discuss.elastic.co/u/Kennedy_Kan1)\ **Replies:** 2\ **Last updated:** [May 4, 2016, 9:25am UTC](https://discuss.elastic.co/t/how-to-combine-text-file-result/49117 "2016-05-04T09:25:49Z")
I have some scheduled batch jobs running automatically during the night and will show the results in separate .txt files. Is there anyway to grab the data from the .txt file and consolidate them to display in kibana? Any… --- ## [EventLog input/plugin only supports Application, System and Security.... why?!?!?](https://discuss.elastic.co/t/eventlog-input-plugin-only-supports-application-system-and-security-why/49105)
**Author:** [@Luis\_Pereira](https://discuss.elastic.co/u/Luis_Pereira)\ **Replies:** 3\ **Last updated:** [May 4, 2016, 9:36am UTC](https://discuss.elastic.co/t/eventlog-input-plugin-only-supports-application-system-and-security-why/49105 "2016-05-04T09:36:27Z")
Hi, I've got a custom Windows Event log file, but when I specify this logfile name, logstash stash complains with the following error message... any knows why its restrictive to 3 known logfiles? ←\[31mInvalid settin… --- ## [How to use percolator while indexing the document using logstash(pre-processing )](https://discuss.elastic.co/t/how-to-use-percolator-while-indexing-the-document-using-logstash-pre-processing/24554)
**Author:** [@Navneet\_Mathpal](https://discuss.elastic.co/u/Navneet_Mathpal)\ **Replies:** 1\ **Last updated:** [May 4, 2016, 9:09am UTC](https://discuss.elastic.co/t/how-to-use-percolator-while-indexing-the-document-using-logstash-pre-processing/24554 "2016-05-04T09:09:03Z")
Hi, I indexed the document using Logstash, but if I need to do some preprocessing using PERCOLATOR how can I do it, is there any possiblities to use percolator in logstash, if not what can be the possible solution for … --- ## [How to clean logs generated by Logstash?](https://discuss.elastic.co/t/how-to-clean-logs-generated-by-logstash/48548)
**Author:** [@djvidov](https://discuss.elastic.co/u/djvidov)\ **Replies:** 11\ **Last updated:** [May 4, 2016, 8:35am UTC](https://discuss.elastic.co/t/how-to-clean-logs-generated-by-logstash/48548 "2016-05-04T08:35:13Z")
Today my logstash stops to work because it's log folder was full with old logs since 2015. There is a setting in logstash to delete logs older that x days? Thanks, Ovidiu --- ## [Logstash error : not showing output](https://discuss.elastic.co/t/logstash-error-not-showing-output/49129)
**Author:** [@prakashkumar](https://discuss.elastic.co/u/prakashkumar)\ **Replies:** 4\ **Last updated:** [May 4, 2016, 7:11am UTC](https://discuss.elastic.co/t/logstash-error-not-showing-output/49129 "2016-05-04T07:11:34Z")
input { file { codec =\> json type =\> "log4j-json" path =\> "C:/Users/akashsoni/Downloads/k/logstash-tutorial/20160402050401.log" start\_position =\>beginning } } output { stdout {} } Hi, This is my… --- ## [Collect Network Device Data - Req Keep Raw and Feed Into Elastic](https://discuss.elastic.co/t/collect-network-device-data-req-keep-raw-and-feed-into-elastic/48990)
**Author:** [@tarheeljeff](https://discuss.elastic.co/u/tarheeljeff)\ **Replies:** 3\ **Last updated:** [May 3, 2016, 9:55pm UTC](https://discuss.elastic.co/t/collect-network-device-data-req-keep-raw-and-feed-into-elastic/48990 "2016-05-03T21:55:25Z")
I have ELK running on a single server at this point in time. I also have rsyslog server running on this same host. We have many network devices (Cisco Switches Routers/ASA's/etc.) in our environment. My requirement … --- ## [Merge Pull](https://discuss.elastic.co/t/merge-pull/48987)
**Author:** [@jchoinski](https://discuss.elastic.co/u/jchoinski)\ **Replies:** 3\ **Last updated:** [May 3, 2016, 9:45pm UTC](https://discuss.elastic.co/t/merge-pull/48987 "2016-05-03T21:45:41Z")
Hello! I ran into a problem where I need to specify an index in the elasticsearch filter plugin. There is a pull request that let's the user specify which index they want to search, but it hasn't been merged. Will this… --- ## [How to loop through json arrays and apply filter](https://discuss.elastic.co/t/how-to-loop-through-json-arrays-and-apply-filter/48558)
**Author:** [@abhuyan](https://discuss.elastic.co/u/abhuyan)\ **Replies:** 3\ **Last updated:** [May 3, 2016, 6:42pm UTC](https://discuss.elastic.co/t/how-to-loop-through-json-arrays-and-apply-filter/48558 "2016-05-03T18:42:19Z")
My JSON log looks like this: { "ns\_records": \[{ "nsip": "208.84.0.53", "nsname": "ns1.msft.net" }, { "nsip": "208.84.2.53", "nsname": "ns2.msft.net" }\], "domain": "mx1.hotmail.com", "country\_iso": "US", "ip": … --- ## [Field names with dots](https://discuss.elastic.co/t/field-names-with-dots/48999)
**Author:** [@genesis](https://discuss.elastic.co/u/genesis)\ **Replies:** 3\ **Last updated:** [May 3, 2016, 2:37pm UTC](https://discuss.elastic.co/t/field-names-with-dots/48999 "2016-05-03T14:37:28Z")
I am unable to find examples on the web. Is there any way to delete fields names that contains dots using logstash? My indices are failing the migration tool test, I am unable to upgrade to 2.2 yet. My plan is to re-inde… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1157) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1159)