# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1165 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1166 --- ## [Filter an IP with Variable part](https://discuss.elastic.co/t/filter-an-ip-with-variable-part/47552)
**Author:** [@vtmtwwf](https://discuss.elastic.co/u/vtmtwwf)\ **Replies:** 2\ **Last updated:** [April 18, 2016, 9:09pm UTC](https://discuss.elastic.co/t/filter-an-ip-with-variable-part/47552 "2016-04-18T21:09:20Z")
Hello everybody! I am receiving logs from several routers in a building with 20 companies. I would like to identify my top 10 Internet destinations, but I would like to see the Name of the destination in my Kibana graphs… --- ## [SNMP Trap listener died?](https://discuss.elastic.co/t/snmp-trap-listener-died/47245)
**Author:** [@stefansaye](https://discuss.elastic.co/u/stefansaye)\ **Replies:** 1\ **Last updated:** [April 18, 2016, 9:05pm UTC](https://discuss.elastic.co/t/snmp-trap-listener-died/47245 "2016-04-18T21:05:31Z")
Dear logstash, when i start logstash ,I got the error msg as follow, /opt/logstash/bin/logstash -f /etc/logstash/conf.d/logstash-snmptrap.conf -d SNMP Trap listener died {:exception=\>#\ **Author:** [@diwertowski](https://discuss.elastic.co/u/diwertowski)\ **Replies:** 1\ **Last updated:** [April 18, 2016, 9:01pm UTC](https://discuss.elastic.co/t/elasticsearch-filter-plugin/47386 "2016-04-18T21:01:20Z") I have problems with the syntax of the logstash-elasticsearch-filter-plugin In my case, I've a field named 'executed' and I will check this field of a special value. How does this work? Something like that? elastic… --- ## [Multiple grok and multiple match option in one grok](https://discuss.elastic.co/t/multiple-grok-and-multiple-match-option-in-one-grok/47228)
**Author:** [@macymin](https://discuss.elastic.co/u/macymin)\ **Replies:** 1\ **Last updated:** [April 18, 2016, 5:54pm UTC](https://discuss.elastic.co/t/multiple-grok-and-multiple-match-option-in-one-grok/47228 "2016-04-18T17:54:19Z")
does any one know what is the difference with multiple grok or multiple match option in one grok? if I have a log file has different pattern for each line and for same field the pattern need to be different, for such c… --- ## [Extracting Domain from URL](https://discuss.elastic.co/t/extracting-domain-from-url/36219)
**Author:** [@Hans](https://discuss.elastic.co/u/Hans)\ **Replies:** 14\ **Last updated:** [April 18, 2016, 5:41pm UTC](https://discuss.elastic.co/t/extracting-domain-from-url/36219 "2016-04-18T17:41:06Z")
Is it possible to extract the domain only from a URL using lostash: URL: e10.whatsapp.net mtalk.google.com teredo.ipv6.microsoft.com extshort.weixin.qq.com Domain whatsapp.net google.com microsoft.com qq.com --- ## [Can't pull from kafka topic that has date stamp](https://discuss.elastic.co/t/cant-pull-from-kafka-topic-that-has-date-stamp/46757)
**Author:** [@stecino](https://discuss.elastic.co/u/stecino)\ **Replies:** 6\ **Last updated:** [April 18, 2016, 5:38pm UTC](https://discuss.elastic.co/t/cant-pull-from-kafka-topic-that-has-date-stamp/46757 "2016-04-18T17:38:35Z")
Hello, I have this issue, when I am able to generate a kafka topic that has date stamp in the name, but when I try to read from it, it fails to. verified that topic created, and i can read from it. Snipped bellow k… --- ## [Snappy compressed avro file read by logstash](https://discuss.elastic.co/t/snappy-compressed-avro-file-read-by-logstash/47579)
**Author:** [@no\_jihun](https://discuss.elastic.co/u/no_jihun)\ **Replies:** 0\ **Last updated:** [April 17, 2016, 10:27am UTC](https://discuss.elastic.co/t/snappy-compressed-avro-file-read-by-logstash/47579 "2016-04-17T10:27:14Z")
Hello. Is it possible to read snappy compressed avro file with logstash file input plugin? There are snappy avro files on hdfs and I want to index that files to elasticsearch via logstash. of course after download th… --- ## [WebSocket output with Logstash - use ws://host:port](https://discuss.elastic.co/t/websocket-output-with-logstash-use-ws-host-port/47260)
**Author:** [@Diyal](https://discuss.elastic.co/u/Diyal)\ **Replies:** 1\ **Last updated:** [April 18, 2016, 9:53am UTC](https://discuss.elastic.co/t/websocket-output-with-logstash-use-ws-host-port/47260 "2016-04-18T09:53:31Z")
Hello, I 'm trying use logstash to send data in a websocket and also in Elasticsearch. I have already install logstash-output-websocket and logstash-input-websocket 's plugin, adding the websocket's syntax in my logst… --- ## [Couldn't extract filename from "source" field](https://discuss.elastic.co/t/couldnt-extract-filename-from-source-field/47218)
**Author:** [@rajkamalkool6](https://discuss.elastic.co/u/rajkamalkool6)\ **Replies:** 2\ **Last updated:** [April 18, 2016, 9:25am UTC](https://discuss.elastic.co/t/couldnt-extract-filename-from-source-field/47218 "2016-04-18T09:25:56Z")
Hi, I am using Logstash 2.3.0 were I am using grok match to extract the filename from source field which was generated by default. I am using below configuration to extract the filename but I am not getting the fiel… --- ## [Logstash not reading complete Tomcat catalina log files](https://discuss.elastic.co/t/logstash-not-reading-complete-tomcat-catalina-log-files/45791)
**Author:** [@aviral\_srivastava](https://discuss.elastic.co/u/aviral_srivastava)\ **Replies:** 4\ **Last updated:** [April 18, 2016, 7:48am UTC](https://discuss.elastic.co/t/logstash-not-reading-complete-tomcat-catalina-log-files/45791 "2016-04-18T07:48:53Z")
Hi , I have the following logstash configuration file to read catalina log files:- input { file { type =\> "tomcat" path =\> \[ "D:/krushnat/catalina.2016-03-16.log" \] codec =\> multiline { … --- ## [Need help in logstash configuration](https://discuss.elastic.co/t/need-help-in-logstash-configuration/47594)
**Author:** [@navox19](https://discuss.elastic.co/u/navox19)\ **Replies:** 1\ **Last updated:** [April 18, 2016, 12:55am UTC](https://discuss.elastic.co/t/need-help-in-logstash-configuration/47594 "2016-04-18T00:55:17Z")
I have 3 files under /conf.d 30-elasticsearch-output.conf output { elasticsearch { hosts =\> \["localhost:9200"\] sniffing =\> true manage\_template =\> false index =\> "%{\[@metadata\]\[beat\]}-%{+YYYY.MM.dd}" document\_type =\> … --- ## [Preventing the Logstash Log File from Filling Up Disk](https://discuss.elastic.co/t/preventing-the-logstash-log-file-from-filling-up-disk/47504)
**Author:** [@Michael1](https://discuss.elastic.co/u/Michael1)\ **Replies:** 4\ **Last updated:** [April 17, 2016, 9:25am UTC](https://discuss.elastic.co/t/preventing-the-logstash-log-file-from-filling-up-disk/47504 "2016-04-17T09:25:12Z")
Hello All, Recently I had an issue on one of my ELK nodes where it would not start for some reason. The issue was investigated further and it turns out that the Logstash log file was eating up all of the disk space for… --- ## [Logstash-filter-memorize for Logstash v2.2](https://discuss.elastic.co/t/logstash-filter-memorize-for-logstash-v2-2/47512)
**Author:** [@twa-nxp](https://discuss.elastic.co/u/twa-nxp)\ **Replies:** 1\ **Last updated:** [April 17, 2016, 6:16am UTC](https://discuss.elastic.co/t/logstash-filter-memorize-for-logstash-v2-2/47512 "2016-04-17T06:16:18Z")
Hi everyone, I am running an ELK stack with logstash v2.2. I would like to use the logstash-filter-memorize plugin I used to use in logstash v1.5 but it seems that this plugin is not available from logstash v2.0 (https… --- ## [Multiline probelm with Syslog+log4js combination](https://discuss.elastic.co/t/multiline-probelm-with-syslog-log4js-combination/47478)
**Author:** [@sunilmchaudhari](https://discuss.elastic.co/u/sunilmchaudhari)\ **Replies:** 1\ **Last updated:** [April 17, 2016, 6:15am UTC](https://discuss.elastic.co/t/multiline-probelm-with-syslog-log4js-combination/47478 "2016-04-17T06:15:37Z")
Logging pattern configured in log4js.json is below: "appenders": \[ { "type" : "logLevelFilter", "level" : "INFO", "appender": { "… --- ## [Adding .raw fields to existing data](https://discuss.elastic.co/t/adding-raw-fields-to-existing-data/47568)
**Author:** [@tsegal](https://discuss.elastic.co/u/tsegal)\ **Replies:** 3\ **Last updated:** [April 16, 2016, 8:34pm UTC](https://discuss.elastic.co/t/adding-raw-fields-to-existing-data/47568 "2016-04-16T20:34:45Z")
Hi all, I created a cluster where I host my logs. I have around 8 index patterns and ~40 million documents currently. I noticed that my fields are being analyzed and broken down (so foo-bar is broken down to "foo" and … --- ## [Logstash Grok And Translate](https://discuss.elastic.co/t/logstash-grok-and-translate/47503)
**Author:** [@Gnosis](https://discuss.elastic.co/u/Gnosis)\ **Replies:** 1\ **Last updated:** [April 16, 2016, 8:25pm UTC](https://discuss.elastic.co/t/logstash-grok-and-translate/47503 "2016-04-16T20:25:48Z")
Hi All, I'd like to use translate to look for a pattern in a file. Once i have the pattern in field i'd like to use this field as a pattern in my grok but it doesn't seems to work properly. I explain, i have a YAML f… --- ## [Logstash OutOfMemoryError](https://discuss.elastic.co/t/logstash-outofmemoryerror/45265)
**Author:** [@yammy](https://discuss.elastic.co/u/yammy)\ **Replies:** 4\ **Last updated:** [April 16, 2016, 12:31pm UTC](https://discuss.elastic.co/t/logstash-outofmemoryerror/45265 "2016-04-16T12:31:03Z")
I've just started using logstash 2.2.2 with 3 hosts uploading a combined average of 20,000 events per day. Using Filebeat 1.1 to forward events. Typically after about 12 hours I will get the OutOfMemoryError in the logst… --- ## [No output to Elasticsearch](https://discuss.elastic.co/t/no-output-to-elasticsearch/47498)
**Author:** [@johnslippers](https://discuss.elastic.co/u/johnslippers)\ **Replies:** 1\ **Last updated:** [April 16, 2016, 4:56am UTC](https://discuss.elastic.co/t/no-output-to-elasticsearch/47498 "2016-04-16T04:56:44Z")
Hi, I hope somebody can assist? I have setup Elasticsearch, Kibana, Logstash and Filebeat but can't get Logstash to write to Elasticsearch. Filebeat logs to Logstash. I know that because in my Filebeat log file I g… --- ## [Logstash 2.0.0 and Cisco ASA syslog](https://discuss.elastic.co/t/logstash-2-0-0-and-cisco-asa-syslog/35604)
**Author:** [@edgoad](https://discuss.elastic.co/u/edgoad)\ **Replies:** 4\ **Last updated:** [April 15, 2016, 10:26pm UTC](https://discuss.elastic.co/t/logstash-2-0-0-and-cisco-asa-syslog/35604 "2016-04-15T22:26:09Z")
I have all my Cisco devices forwarding syslog to a central server, and then using Logstash-Forwarder to forward them to logstash. For general syslog features this works great, but I can't get logstash to properly grok th… --- ## [Logstash 2.0 Cisco Asa - data does not appear in kibana](https://discuss.elastic.co/t/logstash-2-0-cisco-asa-data-does-not-appear-in-kibana/33581)
**Author:** [@jdambly](https://discuss.elastic.co/u/jdambly)\ **Replies:** 6\ **Last updated:** [April 15, 2016, 10:19pm UTC](https://discuss.elastic.co/t/logstash-2-0-cisco-asa-data-does-not-appear-in-kibana/33581 "2016-04-15T22:19:07Z")
I'm using the following logtash config, and I can see it working on stdout, but nothing is show up in kibana/elastic search, I created an index called logstash\* but there seems to be nothing in it input { tcp { port =\> … --- ## [High Logstash CPU Usage](https://discuss.elastic.co/t/high-logstash-cpu-usage/47533)
**Author:** [@Maxwell\_Flanders](https://discuss.elastic.co/u/Maxwell_Flanders)\ **Replies:** 1\ **Last updated:** [April 15, 2016, 8:34pm UTC](https://discuss.elastic.co/t/high-logstash-cpu-usage/47533 "2016-04-15T20:34:32Z")
I've been running a logstash framework for a while now that had 5 instances of logstash reading from a kafka queue, processing that data, and pushing it to elasticsearch. I discovered recently that that kafka queue only … --- ## [Relationship](https://discuss.elastic.co/t/relationship/47529)
**Author:** [@Bvdv](https://discuss.elastic.co/u/Bvdv)\ **Replies:** 1\ **Last updated:** [April 15, 2016, 8:10pm UTC](https://discuss.elastic.co/t/relationship/47529 "2016-04-15T20:10:45Z")
I have been using logstash to import data with JDBC. When I import flat datasets this is no problem. But I also import " couple tables \[relational\]", which include the keys from the flat datasets. So I do not want to use… --- ## [Logstash Filters and Geoip database option](https://discuss.elastic.co/t/logstash-filters-and-geoip-database-option/46090)
**Author:** [@tlv324](https://discuss.elastic.co/u/tlv324)\ **Replies:** 4\ **Last updated:** [April 15, 2016, 4:48pm UTC](https://discuss.elastic.co/t/logstash-filters-and-geoip-database-option/46090 "2016-04-15T16:48:57Z")
I want to be able to use a more updated version of the GeoLiteCity Database. However, when running Logstash with this configuration I get what seems to be a permissions error and I'm not sure how to fix that because I'm … --- ## [Logstash + wildcard certificates (HTTPS)](https://discuss.elastic.co/t/logstash-wildcard-certificates-https/47520)
**Author:** [@Busindre](https://discuss.elastic.co/u/Busindre)\ **Replies:** 0\ **Last updated:** [April 15, 2016, 3:38pm UTC](https://discuss.elastic.co/t/logstash-wildcard-certificates-https/47520 "2016-04-15T15:38:10Z")
Hi! Elasticsearch can be used as logstash-output using wildcard certificates (HTTPS) ? Failed to install template: hostname in certificate didn't match: \ != \<\*\> OR \ OR \<\*.DOMAIN\> OR \ OR \ … --- ## [Logstash mutate not working](https://discuss.elastic.co/t/logstash-mutate-not-working/47250)
**Author:** [@manthan\_patel](https://discuss.elastic.co/u/manthan_patel)\ **Replies:** 5\ **Last updated:** [April 15, 2016, 9:11am UTC](https://discuss.elastic.co/t/logstash-mutate-not-working/47250 "2016-04-15T09:11:24Z")
Below are my 2 config file but when i add mutet it stops working ----------config 1 input { tcp { 'port' =\> '9563' } } filter { json { source =\> 'message' } mutate { … --- ## [How to gracefully exit a scheduled Logstash Output](https://discuss.elastic.co/t/how-to-gracefully-exit-a-scheduled-logstash-output/47485)
**Author:** [@jrgns](https://discuss.elastic.co/u/jrgns)\ **Replies:** 0\ **Last updated:** [April 15, 2016, 8:49am UTC](https://discuss.elastic.co/t/how-to-gracefully-exit-a-scheduled-logstash-output/47485 "2016-04-15T08:49:11Z")
I feel I need to know this, but I don't \[:frowning:\] The Cloudwatch Logstash output doesn't exit when Logstash gets a kill signal (Ctrl+C), causing Logstash to eventually kill the process. If there's still metrics in t… --- ## [Arabic date](https://discuss.elastic.co/t/arabic-date/46987)
**Author:** [@veve90](https://discuss.elastic.co/u/veve90)\ **Replies:** 3\ **Last updated:** [April 15, 2016, 7:55am UTC](https://discuss.elastic.co/t/arabic-date/46987 "2016-04-15T07:55:35Z")
Hello, I have an arabic date, and I would like to know if there is a way to do a date match... my date: \\"٢٠١٦-٠٤-٠٧t١٩:٤٤:٢٠.٤٠٢z Thank you! --- ## [MIB contains errors when smidump](https://discuss.elastic.co/t/mib-contains-errors-when-smidump/47463)
**Author:** [@stefansaye](https://discuss.elastic.co/u/stefansaye)\ **Replies:** 0\ **Last updated:** [April 15, 2016, 6:34am UTC](https://discuss.elastic.co/t/mib-contains-errors-when-smidump/47463 "2016-04-15T06:34:41Z")
Hi all, I got error when i using import.rb to convert a mib file as following: /opt/logstash/vendor/bundle/jruby/1.9/gems/snmp-1.2.0# ruby -d import.rb convermib/ Exception LoadError' at /usr/lib/ruby/2.1.0/rubygems.… --- ## [Alerting with Logstash](https://discuss.elastic.co/t/alerting-with-logstash/47368)
**Author:** [@diwertowski](https://discuss.elastic.co/u/diwertowski)\ **Replies:** 2\ **Last updated:** [April 15, 2016, 6:26am UTC](https://discuss.elastic.co/t/alerting-with-logstash/47368 "2016-04-15T06:26:00Z")
Hi, I'll do an ELK-Stack with an alertingsystem. So my suggestion was somthing like this: Shipper =\> Redis =\> Indexer =\> ES \<= Alerting (Logstash) Can Logstash read logstash(Alerting) read or use logfiles, if my conf… --- ## [Time zone adjustment](https://discuss.elastic.co/t/time-zone-adjustment/47459)
**Author:** [@Sai\_Birada](https://discuss.elastic.co/u/Sai_Birada)\ **Replies:** 4\ **Last updated:** [April 15, 2016, 6:21am UTC](https://discuss.elastic.co/t/time-zone-adjustment/47459 "2016-04-15T06:21:56Z")
I have logs coming from various time zones into my ELK Stack in live. I have a table with time differences between those timezones and my local timezone from where i am running my ELK Stack. So using this table when ever… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1164) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1166)