# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1167 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1168 --- ## [Logstash port 5000 not opening](https://discuss.elastic.co/t/logstash-port-5000-not-opening/47201)
**Author:** [@shekade](https://discuss.elastic.co/u/shekade)\ **Replies:** 2\ **Last updated:** [April 13, 2016, 7:45am UTC](https://discuss.elastic.co/t/logstash-port-5000-not-opening/47201 "2016-04-13T07:45:00Z")
I have been following this link for centos 6 https://www.digitalocean.com/community/tutorials/how-to-use-logstash-and-kibana-to-centralize-logs-on-centos-6 When I do Service logstash restart -- I cant see port 5000… --- ## [Ho to aggregate multi lines in one](https://discuss.elastic.co/t/ho-to-aggregate-multi-lines-in-one/47204)
**Author:** [@Neal\_Shan](https://discuss.elastic.co/u/Neal_Shan)\ **Replies:** 0\ **Last updated:** [April 13, 2016, 7:36am UTC](https://discuss.elastic.co/t/ho-to-aggregate-multi-lines-in-one/47204 "2016-04-13T07:36:30Z")
store type 1 1 1 2 2 1 2 3 group by type, output 1 1,2 2 1 3 2 how to use a filter do this in logstash. please help! --- ## [\[drop\] the same message](https://discuss.elastic.co/t/drop-the-same-message/46955)
**Author:** [@stefansaye](https://discuss.elastic.co/u/stefansaye)\ **Replies:** 0\ **Last updated:** [April 11, 2016, 8:11am UTC](https://discuss.elastic.co/t/drop-the-same-message/46955 "2016-04-11T08:11:34Z")
\[drop\] --- ## [The error about data type filed](https://discuss.elastic.co/t/the-error-about-data-type-filed/46337)
**Author:** [@lester015](https://discuss.elastic.co/u/lester015)\ **Replies:** 3\ **Last updated:** [April 13, 2016, 6:46am UTC](https://discuss.elastic.co/t/the-error-about-data-type-filed/46337 "2016-04-13T06:46:32Z")
hi everyone, I foud the weird problem about my es mapping,it's as flows: curl -XPUT 'localhost:9200/v\_ajusted\_fund\_v1' -d '{ "mappings" : { "v\_ajusted\_fund" : { "properties" : { … --- ## [Multiline Codec Issues](https://discuss.elastic.co/t/multiline-codec-issues/47170)
**Author:** [@Maxwell\_Flanders](https://discuss.elastic.co/u/Maxwell_Flanders)\ **Replies:** 3\ **Last updated:** [April 13, 2016, 5:49am UTC](https://discuss.elastic.co/t/multiline-codec-issues/47170 "2016-04-13T05:49:42Z")
So for example, if I have a BASIC stack trace like this: Caused by: java.lang.IllegalArgumentException: field \[@timestamp\] doesn't exist at org.elasticsearch.action.fieldstats.TransportFieldStatsTransportAction.shardO… --- ## [Cannot get file input work properly on OSX](https://discuss.elastic.co/t/cannot-get-file-input-work-properly-on-osx/46969)
**Author:** [@dr\_rock](https://discuss.elastic.co/u/dr_rock)\ **Replies:** 3\ **Last updated:** [April 13, 2016, 5:43am UTC](https://discuss.elastic.co/t/cannot-get-file-input-work-properly-on-osx/46969 "2016-04-13T05:43:32Z")
Hi, I have been using Logstash for some time. I am trying to run the following configuration on my OSX (Yosemite) laptop : input { file { path =\> "\" start\_position =\> "beginning" } } o… --- ## [File input not working despite all efforts in both Windows and Linux](https://discuss.elastic.co/t/file-input-not-working-despite-all-efforts-in-both-windows-and-linux/47039)
**Author:** [@Jerry\_Hatchett](https://discuss.elastic.co/u/Jerry_Hatchett)\ **Replies:** 6\ **Last updated:** [April 13, 2016, 5:36am UTC](https://discuss.elastic.co/t/file-input-not-working-despite-all-efforts-in-both-windows-and-linux/47039 "2016-04-13T05:36:23Z")
Right now I'm working with an instance in Ubuntu 14.04, but I've also tried with the SIFT Workstation embodiment of 14.04, Windows 10, and Ubuntu 15. No matter what, and despite days tinkering, I still cannot get logstas… --- ## [Does logstash have anything as Pattern\_dir for Match\_Dir?](https://discuss.elastic.co/t/does-logstash-have-anything-as-pattern-dir-for-match-dir/47136)
**Author:** [@Sameer\_Panicker](https://discuss.elastic.co/u/Sameer_Panicker)\ **Replies:** 4\ **Last updated:** [April 13, 2016, 4:23am UTC](https://discuss.elastic.co/t/does-logstash-have-anything-as-pattern-dir-for-match-dir/47136 "2016-04-13T04:23:11Z")
I have multiple GROK match patterns. e.g. grok { match =\> { "message" =\> \[ "GROK Pattern 1", "GROK Pattern 2" \] } } Do we have anything as patterns\_dir for above match patterns. i.e. patterns\_dir =\> \["/opt/logstash… --- ## [Running mutliple CONF file for logstash](https://discuss.elastic.co/t/running-mutliple-conf-file-for-logstash/47139)
**Author:** [@Sameer\_Panicker](https://discuss.elastic.co/u/Sameer_Panicker)\ **Replies:** 6\ **Last updated:** [April 13, 2016, 4:22am UTC](https://discuss.elastic.co/t/running-mutliple-conf-file-for-logstash/47139 "2016-04-13T04:22:11Z")
I have mutliple log files present under different folder. To make things simpler and easy to manage, based on the patterns I have created 5 different conf files. e,g. logstash-Exception.conf, logstash-eventsource.conf… --- ## [Logstash debug file is not created after deletion](https://discuss.elastic.co/t/logstash-debug-file-is-not-created-after-deletion/46571)
**Author:** [@vilas](https://discuss.elastic.co/u/vilas)\ **Replies:** 1\ **Last updated:** [April 13, 2016, 3:48am UTC](https://discuss.elastic.co/t/logstash-debug-file-is-not-created-after-deletion/46571 "2016-04-13T03:48:23Z")
Hi, We are currently working on Logstash 1.5.4. We enabled the logstash debug, using -l option creating the debug log file. But we observed that it grew large in size and so deleted the debug file. But Logstash is not … --- ## [Logstash 2.1.1 behind ELB](https://discuss.elastic.co/t/logstash-2-1-1-behind-elb/46458)
**Author:** [@digitalageexperts](https://discuss.elastic.co/u/digitalageexperts)\ **Replies:** 3\ **Last updated:** [April 13, 2016, 2:15am UTC](https://discuss.elastic.co/t/logstash-2-1-1-behind-elb/46458 "2016-04-13T02:15:39Z")
We're trying to put a logstash cluster behind an ELB, the server only has logstash on it and is listening to filebeat for input. The issue is there's no port for the ELB to listen to for health check, 5044 (the port we'… --- ## [Relationship between pipleline workers and Kafka/ES plugin workers](https://discuss.elastic.co/t/relationship-between-pipleline-workers-and-kafka-es-plugin-workers/46608)
**Author:** [@dr\_work](https://discuss.elastic.co/u/dr_work)\ **Replies:** 1\ **Last updated:** [April 13, 2016, 1:21am UTC](https://discuss.elastic.co/t/relationship-between-pipleline-workers-and-kafka-es-plugin-workers/46608 "2016-04-13T01:21:29Z")
For Logstash 2.3, what is the relationship between the number of pipeline workers (which by default is equal to the number of cores) and the following: Kafka output plugin parameter "workers". Elasticsearch output p… --- ## [Can't pull kafka messages into logstash and then to elasticsearch](https://discuss.elastic.co/t/cant-pull-kafka-messages-into-logstash-and-then-to-elasticsearch/46291)
**Author:** [@stecino](https://discuss.elastic.co/u/stecino)\ **Replies:** 1\ **Last updated:** [April 13, 2016, 1:04am UTC](https://discuss.elastic.co/t/cant-pull-kafka-messages-into-logstash-and-then-to-elasticsearch/46291 "2016-04-13T01:04:57Z")
Hello, I am getting this in my logstash log "{:timestamp=\>"2016-04-04T19:27:10.116000+0000", :message=\>"Flushing buffer at interval", :instance=\>"#\ **Author:** [@Vivek\_Raj](https://discuss.elastic.co/u/Vivek_Raj)\ **Replies:** 5\ **Last updated:** [April 13, 2016, 12:06am UTC](https://discuss.elastic.co/t/logstash-configuration-filters-using-grok-different-logs-from-one-type-of-log-file/47055 "2016-04-13T00:06:59Z") it showing double values in kibana help me out input { file { path =\> "/var/log/aupm.log\*" } } filter { grok { match =\> { "message" =\> "%{DATESTAMP:timestamp} %{WORD:info} %{SPACE} %{NOTS… --- ## [Logstash Shipping All Logs Except One](https://discuss.elastic.co/t/logstash-shipping-all-logs-except-one/46293)
**Author:** [@JT1234567890](https://discuss.elastic.co/u/JT1234567890)\ **Replies:** 3\ **Last updated:** [April 12, 2016, 8:27pm UTC](https://discuss.elastic.co/t/logstash-shipping-all-logs-except-one/46293 "2016-04-12T20:27:31Z")
Hello, I have a working Logstash configuration that ships syslog and Apache logs to a Graylog2 server - we love it, works great. Now we need to scrape an application's log file and ship it to the Graylog server too. … --- ## [Quick help required: Logstash 2.3.1 Grok Plugin Parse Error](https://discuss.elastic.co/t/quick-help-required-logstash-2-3-1-grok-plugin-parse-error/46864)
**Author:** [@GOPAL\_SUDARSANAM](https://discuss.elastic.co/u/GOPAL_SUDARSANAM)\ **Replies:** 1\ **Last updated:** [April 12, 2016, 6:29pm UTC](https://discuss.elastic.co/t/quick-help-required-logstash-2-3-1-grok-plugin-parse-error/46864 "2016-04-12T18:29:12Z")
Hi, Your quick help on the following issue is greatly appreciated. We are getting the following error, when Logstash is executing grok filter. The grok configuration was perfectly working earlier. S/W versions: 1.… --- ## [Filter not working](https://discuss.elastic.co/t/filter-not-working/46850)
**Author:** [@brain](https://discuss.elastic.co/u/brain)\ **Replies:** 1\ **Last updated:** [April 12, 2016, 6:20pm UTC](https://discuss.elastic.co/t/filter-not-working/46850 "2016-04-12T18:20:20Z")
hello internet! can someone point out why the below filter which look for an IP is not working if \[answers\] =~ "127\\.0\\.0\\.1" { mutate { add\_tag =\> \[ "non-routable" \] } } if \[answers\] { mutate… --- ## [Multiple Beats Input (filebeat, topbeat)](https://discuss.elastic.co/t/multiple-beats-input-filebeat-topbeat/47149)
**Author:** [@nocode](https://discuss.elastic.co/u/nocode)\ **Replies:** 2\ **Last updated:** [April 12, 2016, 6:19pm UTC](https://discuss.elastic.co/t/multiple-beats-input-filebeat-topbeat/47149 "2016-04-12T18:19:14Z")
So I've configured an ELK stack. Initially, I configured my logging to use json format and used filebeat to send to logstash. Once I got that working, I wanted to start collecting system metrics so I disabled the fileb… --- ## [How to remove untranslated trap event from logstash?](https://discuss.elastic.co/t/how-to-remove-untranslated-trap-event-from-logstash/47087)
**Author:** [@andrewarnier](https://discuss.elastic.co/u/andrewarnier)\ **Replies:** 1\ **Last updated:** [April 12, 2016, 6:17pm UTC](https://discuss.elastic.co/t/how-to-remove-untranslated-trap-event-from-logstash/47087 "2016-04-12T18:17:00Z")
i have defined a lot of yaml for snmp trap that i want , and put these yaml in my mib directory(specificmibs), and defined the mib directory in my conf as follows, yamlmibdir =\> "/opt/logstash/vendor/bundle/jruby/1.9/ge… --- ## [Incorrect dependencies for logstash-output-elasticsearch-license](https://discuss.elastic.co/t/incorrect-dependencies-for-logstash-output-elasticsearch-license/47151)
**Author:** [@lsilva](https://discuss.elastic.co/u/lsilva)\ **Replies:** 0\ **Last updated:** [April 12, 2016, 4:43pm UTC](https://discuss.elastic.co/t/incorrect-dependencies-for-logstash-output-elasticsearch-license/47151 "2016-04-12T16:43:12Z")
Hi, The plugin 'logstash-output-elasticsearch-license' fails to install because it has twiddle-wakka for an old version of 'logstash-output-elasticsearch'. From https://rubygems.org/gems/logstash-output-elasticsearc… --- ## [How to remove dynamical field?](https://discuss.elastic.co/t/how-to-remove-dynamical-field/46772)
**Author:** [@stefansaye](https://discuss.elastic.co/u/stefansaye)\ **Replies:** 11\ **Last updated:** [April 12, 2016, 2:34pm UTC](https://discuss.elastic.co/t/how-to-remove-dynamical-field/46772 "2016-04-12T14:34:25Z")
i have got the log looks like this below. { "message" =\> "#, @varbind\_list=\[#, #\>, #, #\>\], @specific\_trap=1, @source\_ip=\\"10.10.10.13\\", @agent\_addr=#, @generic\_trap=6\>", "host" =\> "10.10.10.13", "@version" =\> "1", "@t… --- ## [Currency Conversion from Logstash JDBC Input - SOLVED](https://discuss.elastic.co/t/currency-conversion-from-logstash-jdbc-input-solved/47117)
**Author:** [@Wayne\_Taylor](https://discuss.elastic.co/u/Wayne_Taylor)\ **Replies:** 2\ **Last updated:** [April 12, 2016, 12:59pm UTC](https://discuss.elastic.co/t/currency-conversion-from-logstash-jdbc-input-solved/47117 "2016-04-12T12:59:34Z")
Hi All, I have a purchase data store which has data in multiple currencies. The data is stored in multiple fields such as Purchase Amount, Discount Amount, Tax Amount and then a different field called currency which i… --- ## [Elasticsearch output splits Json content in to 2](https://discuss.elastic.co/t/elasticsearch-output-splits-json-content-in-to-2/47110)
**Author:** [@boazshor](https://discuss.elastic.co/u/boazshor)\ **Replies:** 0\ **Last updated:** [April 12, 2016, 11:03am UTC](https://discuss.elastic.co/t/elasticsearch-output-splits-json-content-in-to-2/47110 "2016-04-12T11:03:49Z")
Hi, I'm working with Logstash and Elasticserch. I'm trying to insert a Json in to an index in Elasticsearch. my output configuration is : elasticsearch { action =\> "index" hosts =\> "54.215.249… --- ## [Quotes in config files v2.3.0](https://discuss.elastic.co/t/quotes-in-config-files-v2-3-0/46563)
**Author:** [@StephenGoodall](https://discuss.elastic.co/u/StephenGoodall)\ **Replies:** 16\ **Last updated:** [April 12, 2016, 10:36am UTC](https://discuss.elastic.co/t/quotes-in-config-files-v2-3-0/46563 "2016-04-12T10:36:56Z")
Hi all, When trying out my config on a windows laptop this seemed to work fine (v2.2.0 by the way): input { s3 { credentials =\> \["XXXXXXXXXXXXXXXXXXXXXXXXXXXXX","XXXXXXXXXXXXXXXXXXXXXX"\] bucket =\> … --- ## [Fields, type mapping](https://discuss.elastic.co/t/fields-type-mapping/46979)
**Author:** [@sunilmchaudhari](https://discuss.elastic.co/u/sunilmchaudhari)\ **Replies:** 5\ **Last updated:** [April 12, 2016, 8:57am UTC](https://discuss.elastic.co/t/fields-type-mapping/46979 "2016-04-12T08:57:32Z")
Hi, We are having one system where error and info logs are created in different files as below /var/log/sales/salesbackedERROR.log, /var/log/sales/salesbackendINFO.log, /var/log/sales/crmERROR.log, /var/log/sales/c… --- ## [Greedydata not working as expected](https://discuss.elastic.co/t/greedydata-not-working-as-expected/46972)
**Author:** [@Suren92](https://discuss.elastic.co/u/Suren92)\ **Replies:** 4\ **Last updated:** [April 12, 2016, 8:15am UTC](https://discuss.elastic.co/t/greedydata-not-working-as-expected/46972 "2016-04-12T08:15:00Z")
Hi, I have the following data 2016-02-07 22:45:48,804 \[72\] FATAL GlobalHttpApplication \[(null)\] - cannot set status after HTTP headers have been sent. Region: (null) UserId: (null) Session: {} System.Web… --- ## [Remove logstash automatic fields](https://discuss.elastic.co/t/remove-logstash-automatic-fields/47006)
**Author:** [@Giulio](https://discuss.elastic.co/u/Giulio)\ **Replies:** 2\ **Last updated:** [April 12, 2016, 8:05am UTC](https://discuss.elastic.co/t/remove-logstash-automatic-fields/47006 "2016-04-12T08:05:46Z")
Hi My log are alredy formatted so I need only to rename the field. But logstash add by itself at the begin of the message some elements (that I totally don't need) ... "vhost" =\> "\<133\>Apr 11 17:16:54 centos7test2 ap… --- ## [Ssl\_certificate\_validation not working](https://discuss.elastic.co/t/ssl-certificate-validation-not-working/46304)
**Author:** [@Sameer\_Panicker](https://discuss.elastic.co/u/Sameer_Panicker)\ **Replies:** 9\ **Last updated:** [April 12, 2016, 5:48am UTC](https://discuss.elastic.co/t/ssl-certificate-validation-not-working/46304 "2016-04-12T05:48:13Z")
ssl\_certificate\_validation =\> false is not working in HTTP\_Poller configuration. My service URL is HTTPS but there is no need to pass any certs along with the call. Hence, I wanted to skip it. Even with the above op… --- ## [Logstash filter issue](https://discuss.elastic.co/t/logstash-filter-issue/47065)
**Author:** [@stefansaye](https://discuss.elastic.co/u/stefansaye)\ **Replies:** 0\ **Last updated:** [April 12, 2016, 3:01am UTC](https://discuss.elastic.co/t/logstash-filter-issue/47065 "2016-04-12T03:01:38Z")
I try to parse the log. if the log "didn't" have 'specific' like as follow logstash prints ,then will be drop the event This is what logstash prints: { "message" =\> "...", "host" =\> "10.10.10.20", "@version" =\>… --- ## [Error/Info log separation](https://discuss.elastic.co/t/error-info-log-separation/46983)
**Author:** [@sunilmchaudhari](https://discuss.elastic.co/u/sunilmchaudhari)\ **Replies:** 2\ **Last updated:** [April 12, 2016, 12:27am UTC](https://discuss.elastic.co/t/error-info-log-separation/46983 "2016-04-12T00:27:26Z")
Hi, We have some log files where INFO/ERROR/WARN are recorded in single file. What is the approach generally in ELK to handle such files? What if we want error, info, warn logs separately under separate type mappings?… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1166) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1168)