# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1168 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1169 --- ## [Log stash rabbitmq cluster failing](https://discuss.elastic.co/t/log-stash-rabbitmq-cluster-failing/46611)
**Author:** [@rubiconvale](https://discuss.elastic.co/u/rubiconvale)\ **Replies:** 13\ **Last updated:** [April 11, 2016, 11:50pm UTC](https://discuss.elastic.co/t/log-stash-rabbitmq-cluster-failing/46611 "2016-04-11T23:50:38Z")
I have a 3 node cluster of Rabbitmq behind a HAproxy Load Balancer. When I shut down a node, Rabbitmq successfully switches the queue to the other nodes. However, I notice that Logstash stops pulling messages from the qu… --- ## [Nginx log filter problem](https://discuss.elastic.co/t/nginx-log-filter-problem/46744)
**Author:** [@wby](https://discuss.elastic.co/u/wby)\ **Replies:** 3\ **Last updated:** [April 11, 2016, 6:12pm UTC](https://discuss.elastic.co/t/nginx-log-filter-problem/46744 "2016-04-11T18:12:02Z")
Logstash 2.1.3 on CentOS 7. I'm sending logs to ELK in syslog format (for now, though will switch to JSON at some point) from rsyslog. I'm ingesting some nginx access logs in NCSA combined format. I do still see the … --- ## [Grok Date and time format](https://discuss.elastic.co/t/grok-date-and-time-format/46816)
**Author:** [@Jpuch](https://discuss.elastic.co/u/Jpuch)\ **Replies:** 4\ **Last updated:** [April 11, 2016, 3:58pm UTC](https://discuss.elastic.co/t/grok-date-and-time-format/46816 "2016-04-11T15:58:30Z")
Hello, i have this king of log : Aug 14 00:00:01 10.33.2.254 date=2015-08-14,time=00: 03:01, ... I'm not interrested in the first date and time (Aug 14 00:00:01) but by the second one : ( date=2015-08-14 and time=00… --- ## [RabbitMQ metadata](https://discuss.elastic.co/t/rabbitmq-metadata/46295)
**Author:** [@JoaquinS](https://discuss.elastic.co/u/JoaquinS)\ **Replies:** 4\ **Last updated:** [April 11, 2016, 12:09pm UTC](https://discuss.elastic.co/t/rabbitmq-metadata/46295 "2016-04-11T12:09:27Z")
Hi I'm trying to use the message-id metadata propertie of RabbietMQ input. But it doesn't worked for me. I set metadata\_enable =\> true, and tryied: add\_field =\> {"primary\_key" =\> "%{\[@metadata\]\[rabbitmq\_properties\]\[m… --- ## [How to run Logstash multiple instance](https://discuss.elastic.co/t/how-to-run-logstash-multiple-instance/46959)
**Author:** [@ggilat](https://discuss.elastic.co/u/ggilat)\ **Replies:** 8\ **Last updated:** [April 11, 2016, 9:23am UTC](https://discuss.elastic.co/t/how-to-run-logstash-multiple-instance/46959 "2016-04-11T09:23:01Z")
hello, in trying to run second logstash instance with a different config file (for syslog events) i'm getting this error: "Pipeline aborted due to error {:exception=\># how can i change the port so i want clash? t… --- ## [Problem with Version 2.3. Host and Timestamp](https://discuss.elastic.co/t/problem-with-version-2-3-host-and-timestamp/46961)
**Author:** [@diwertowski](https://discuss.elastic.co/u/diwertowski)\ **Replies:** 0\ **Last updated:** [April 11, 2016, 8:39am UTC](https://discuss.elastic.co/t/problem-with-version-2-3-host-and-timestamp/46961 "2016-04-11T08:39:25Z")
I upgraded logstash to Version 2.3. (Shipper, Indexer is 2.2.) Did not changed anything in my config, but the output on the Indexer is different. Shipper Config: input { file { type =\> "log4j" path =\> ... start\_posit… --- ## [Logstash filter - get field?](https://discuss.elastic.co/t/logstash-filter-get-field/46935)
**Author:** [@stefansaye](https://discuss.elastic.co/u/stefansaye)\ **Replies:** 5\ **Last updated:** [April 11, 2016, 8:24am UTC](https://discuss.elastic.co/t/logstash-filter-get-field/46935 "2016-04-11T08:24:11Z")
I've got log lines in the following format and want to extract fields: { "message" =\> "...", "@version" =\> "1", "@timestamp" =\> "2014-07-07T08:49:28.543Z", "host" =\> "abc", "field1" =\> "content1", "fi… --- ## [Logstash: With Oracle, scheduled pull, 503 error](https://discuss.elastic.co/t/logstash-with-oracle-scheduled-pull-503-error/46949)
**Author:** [@krushnat\_khawale](https://discuss.elastic.co/u/krushnat_khawale)\ **Replies:** 3\ **Last updated:** [April 11, 2016, 7:43am UTC](https://discuss.elastic.co/t/logstash-with-oracle-scheduled-pull-503-error/46949 "2016-04-11T07:43:46Z")
I am trying to fetch data from oracle server in network which is a scheduled task. It is fetching data from database successfully but while inserting into Elasticsearch, following error is displayed. Unable to underst… --- ## [How to set multiple logstash for only one logfile?](https://discuss.elastic.co/t/how-to-set-multiple-logstash-for-only-one-logfile/46940)
**Author:** [@logstash](https://discuss.elastic.co/u/logstash)\ **Replies:** 3\ **Last updated:** [April 11, 2016, 7:20am UTC](https://discuss.elastic.co/t/how-to-set-multiple-logstash-for-only-one-logfile/46940 "2016-04-11T07:20:44Z")
My log-server specification is not good(RAM 8g, cpu 2.4GHz). So I disappointed for slowly collecting log. I checked my logstash performance(about 400/eps) through elasticsearch count. I already tried using two lo… --- ## [Global variables](https://discuss.elastic.co/t/global-variables/46943)
**Author:** [@Sai\_Birada](https://discuss.elastic.co/u/Sai_Birada)\ **Replies:** 2\ **Last updated:** [April 11, 2016, 6:16am UTC](https://discuss.elastic.co/t/global-variables/46943 "2016-04-11T06:16:06Z")
My data is in the format Feb 22 23:13:35 ams2-eu2-c-smsm query\[84218\]: { Zqlquery : { Select: { Fieldnames: \[1, respsize, reqsize\] }, { FieldTypes: \[LONG, U\_INT, U\_INT\] }, { Functionames: \[count, sum, +\] }} , { W… --- ## [How to pass command line arguments to logsatsh](https://discuss.elastic.co/t/how-to-pass-command-line-arguments-to-logsatsh/46924)
**Author:** [@sdaruna](https://discuss.elastic.co/u/sdaruna)\ **Replies:** 1\ **Last updated:** [April 11, 2016, 5:47am UTC](https://discuss.elastic.co/t/how-to-pass-command-line-arguments-to-logsatsh/46924 "2016-04-11T05:47:31Z")
Can we pass command line arguments to logstash.? I am sending the output from logstash to redis server. I would like to use command line arguments to pass the redis host. How can we pass command line arguments to log… --- ## [Logstash twitter 2.2.0 input jruby error NoMethodError](https://discuss.elastic.co/t/logstash-twitter-2-2-0-input-jruby-error-nomethoderror/36814)
**Author:** [@mob](https://discuss.elastic.co/u/mob)\ **Replies:** 8\ **Last updated:** [April 11, 2016, 5:20am UTC](https://discuss.elastic.co/t/logstash-twitter-2-2-0-input-jruby-error-nomethoderror/36814 "2016-04-11T05:20:51Z")
I was able to get my ELK setup to import the samples using the twitter input plugin but when I changed the conf to use my tags, follows I was able to pass the --configtest but logstash.log filled up with these errors D… --- ## [Multiple Indices in Output not working](https://discuss.elastic.co/t/multiple-indices-in-output-not-working/46880)
**Author:** [@Sameer\_Panicker](https://discuss.elastic.co/u/Sameer_Panicker)\ **Replies:** 2\ **Last updated:** [April 11, 2016, 3:53am UTC](https://discuss.elastic.co/t/multiple-indices-in-output-not-working/46880 "2016-04-11T03:53:12Z")
Based on the \[type\], matched events should be stored under "iislogs" index, but it is getting stored into "logstash" index. What am I doing wrong here ? input { file { type =\> "IISLogs" path =\> "C:/IISLogs/\*" … --- ## [Logstash Pattern not working as expected](https://discuss.elastic.co/t/logstash-pattern-not-working-as-expected/46898)
**Author:** [@Sameer\_Panicker](https://discuss.elastic.co/u/Sameer_Panicker)\ **Replies:** 2\ **Last updated:** [April 10, 2016, 8:24pm UTC](https://discuss.elastic.co/t/logstash-pattern-not-working-as-expected/46898 "2016-04-10T20:24:36Z")
Log 1 - Request EventId : 2, Level : Informational, Message : , Payload : \[id : 20a3839e-c391-4573-ac1c-99b389f21c46\] \[request : MyServiceRequest\] , EventName : ResponseInfo, Timestamp : 2015-08-04T22:20:17.8222179Z, Pro… --- ## [Help with Logstash Conf file](https://discuss.elastic.co/t/help-with-logstash-conf-file/46857)
**Author:** [@suneel](https://discuss.elastic.co/u/suneel)\ **Replies:** 9\ **Last updated:** [April 9, 2016, 9:35am UTC](https://discuss.elastic.co/t/help-with-logstash-conf-file/46857 "2016-04-09T09:35:13Z")
HI I need assistance in getting logstash config for reading json format file into logstash. I need to be able to extract 1460157360000 as timestamp and 0.6706035137176514 as metric value within the message. At this sta… --- ## [Logstash jdbc input - ES index template not respected](https://discuss.elastic.co/t/logstash-jdbc-input-es-index-template-not-respected/46796)
**Author:** [@Chandan\_PR](https://discuss.elastic.co/u/Chandan_PR)\ **Replies:** 1\ **Last updated:** [April 9, 2016, 7:21am UTC](https://discuss.elastic.co/t/logstash-jdbc-input-es-index-template-not-respected/46796 "2016-04-09T07:21:54Z")
Hi Guys, With logstash 2.3.1 jdbc input plugin, the column names in the result are converted to lowercase. For e.g - column callDistributorTimeOfCall was appearing same in logstash-2.1.1 where as with logstash-2.3.1 … --- ## [Failed to query elasticsearch for previous even](https://discuss.elastic.co/t/failed-to-query-elasticsearch-for-previous-even/46822)
**Author:** [@Ganesh2303](https://discuss.elastic.co/u/Ganesh2303)\ **Replies:** 1\ **Last updated:** [April 9, 2016, 7:17am UTC](https://discuss.elastic.co/t/failed-to-query-elasticsearch-for-previous-even/46822 "2016-04-09T07:17:24Z")
Hi, I'm using logstash 2.3.0, we are using elastisearch correlation in my config file. While processing facing issue on correlation and its throwing below error, , :level=\>:warn} Failed to query elasticsearch for previou… --- ## [Using multiple 'and' and 'or' statements in a conditional](https://discuss.elastic.co/t/using-multiple-and-and-or-statements-in-a-conditional/46741)
**Author:** [@djhart](https://discuss.elastic.co/u/djhart)\ **Replies:** 4\ **Last updated:** [April 8, 2016, 7:47pm UTC](https://discuss.elastic.co/t/using-multiple-and-and-or-statements-in-a-conditional/46741 "2016-04-08T19:47:52Z")
What is the proper way to use multiple 'and' and 'or' statements in a conditional statement? I've looked around but do not see any examples an I've tried using things like parenthesis with no luck either. Here is an e… --- ## [Field reference sprintf example](https://discuss.elastic.co/t/field-reference-sprintf-example/46808)
**Author:** [@landro](https://discuss.elastic.co/u/landro)\ **Replies:** 1\ **Last updated:** [April 8, 2016, 2:47pm UTC](https://discuss.elastic.co/t/field-reference-sprintf-example/46808 "2016-04-08T14:47:46Z")
Hi there, I'm currently using the http output plugin to send notifications to a monitoring solution whenever topbeat signals disk usage \> some percentage. I reference the field like so: %{\[fs\]\[used\_p\]}, but then the … --- ## [Config for JMS Plugin for Logstash](https://discuss.elastic.co/t/config-for-jms-plugin-for-logstash/46411)
**Author:** [@parthu](https://discuss.elastic.co/u/parthu)\ **Replies:** 4\ **Last updated:** [April 8, 2016, 2:15pm UTC](https://discuss.elastic.co/t/config-for-jms-plugin-for-logstash/46411 "2016-04-08T14:15:20Z")
I could install the input JMS Plugin for Logstash and started it up on the command line using this config: bin/logstash -e 'input {jms {destination =\> output\_queue} } output {stdout {codec =\> rubydebug}}' And I get thi… --- ## [Templates for Elastic Search](https://discuss.elastic.co/t/templates-for-elastic-search/46781)
**Author:** [@PCO](https://discuss.elastic.co/u/PCO)\ **Replies:** 5\ **Last updated:** [April 8, 2016, 12:04pm UTC](https://discuss.elastic.co/t/templates-for-elastic-search/46781 "2016-04-08T12:04:35Z")
I have a full configuration running (logstash/elastic search/kibana) As I would like to set dynamic fields as not\_analyzed, I created a template on logstash side (with a name matching the index name used in elastic sea… --- ## [\[SOLVED\]How to retrive the @value from message?](https://discuss.elastic.co/t/solved-how-to-retrive-the-value-from-message/46111)
**Author:** [@stefansaye](https://discuss.elastic.co/u/stefansaye)\ **Replies:** 1\ **Last updated:** [April 8, 2016, 9:57am UTC](https://discuss.elastic.co/t/solved-how-to-retrive-the-value-from-message/46111 "2016-04-08T09:57:36Z")
Hi i want to retrive the value from snmptrap input , "message" =\> "#@enterprise=\[1.3.6.1.4.1.9.9.187\], @timestamp=#@value=2612151602\>, @varbind\_list=\[#@name=\[1.3.6.1.4.1.9.9.187.1.2.5.1.17.32.1.14.16.255.255.17.0.0.… --- ## [Logstash keeps saying "file grew" but doesn't import data from new files](https://discuss.elastic.co/t/logstash-keeps-saying-file-grew-but-doesnt-import-data-from-new-files/46347)
**Author:** [@vaibhav316](https://discuss.elastic.co/u/vaibhav316)\ **Replies:** 2\ **Last updated:** [April 8, 2016, 9:50am UTC](https://discuss.elastic.co/t/logstash-keeps-saying-file-grew-but-doesnt-import-data-from-new-files/46347 "2016-04-08T09:50:18Z")
Hi, Im having a peculiar problem where logstash is not importing the data. Im running logstash in the following mode sudo /opt/logstash/bin/logstash agent --debug -f conf.d/. It discovers the files fine: each: fi… --- ## [Math & date: ruby & logstash](https://discuss.elastic.co/t/math-date-ruby-logstash/45945)
**Author:** [@garanews](https://discuss.elastic.co/u/garanews)\ **Replies:** 3\ **Last updated:** [April 8, 2016, 7:05am UTC](https://discuss.elastic.co/t/math-date-ruby-logstash/45945 "2016-04-08T07:05:00Z")
Hello, I have some log files that have rows like this: station1 on 15387 15646 130 Y Values are separated by tab With logstash I would transform the first\_seen and last\_seen in timestamp, because they are the num… --- ## [Logstash \_grokparsefailure issues?](https://discuss.elastic.co/t/logstash--grokparsefailure-issues/46645)
**Author:** [@stefansaye](https://discuss.elastic.co/u/stefansaye)\ **Replies:** 1\ **Last updated:** [April 8, 2016, 6:26am UTC](https://discuss.elastic.co/t/logstash--grokparsefailure-issues/46645 "2016-04-08T06:26:49Z")
hi all , I'm having issues with grok parsing. In ElasticSearch/Kibana the lines I match come up with the tag \_grokparsefailure. Here is my logstash config : input { snmptrap { yamlmibdir =\> "/opt/logstash/vendor/bu… --- ## [Logstash error "expecting List or Map"](https://discuss.elastic.co/t/logstash-error-expecting-list-or-map/46679)
**Author:** [@mikula](https://discuss.elastic.co/u/mikula)\ **Replies:** 6\ **Last updated:** [April 8, 2016, 5:24am UTC](https://discuss.elastic.co/t/logstash-error-expecting-list-or-map/46679 "2016-04-08T05:24:11Z")
Hello what could be cause of the error? Error LS config --- ## [Method to collect all logs](https://discuss.elastic.co/t/method-to-collect-all-logs/46705)
**Author:** [@gsronald](https://discuss.elastic.co/u/gsronald)\ **Replies:** 2\ **Last updated:** [April 8, 2016, 2:34am UTC](https://discuss.elastic.co/t/method-to-collect-all-logs/46705 "2016-04-08T02:34:05Z")
To all dear gens, I would like to ask how to collect all logs such as syslog, ad audit logs, web logs, etc... I would like to compete with Splunk. Please advise. --- ## [Filter or output plugin complains: Can't merge a non object mapping with an object mapping](https://discuss.elastic.co/t/filter-or-output-plugin-complains-cant-merge-a-non-object-mapping-with-an-object-mapping/46665)
**Author:** [@DK\_3](https://discuss.elastic.co/u/DK_3)\ **Replies:** 1\ **Last updated:** [April 7, 2016, 8:15pm UTC](https://discuss.elastic.co/t/filter-or-output-plugin-complains-cant-merge-a-non-object-mapping-with-an-object-mapping/46665 "2016-04-07T20:15:23Z")
Not sure if its the json filter or the elasticsearch output plugin. But I'm hitting this Logstash error "Can't merge a non object mapping \[myMap.1.myList\] with an object mapping \[myMap.1.myList\]" Logstash error: {:ti… --- ## [Logstash hangs when uploading csv file](https://discuss.elastic.co/t/logstash-hangs-when-uploading-csv-file/46720)
**Author:** [@matts](https://discuss.elastic.co/u/matts)\ **Replies:** 2\ **Last updated:** [April 7, 2016, 6:17pm UTC](https://discuss.elastic.co/t/logstash-hangs-when-uploading-csv-file/46720 "2016-04-07T18:17:16Z")
I recently installed LogStash 2.3.0 for ElasticSearch 2.3.1 against java version "1.8.0\_73" on Windows 10 64-bit platform. Then tried running a LogStatsh CSV file upload that had about 200K lines. LogStash just hangs wit… --- ## [Multiline plugin not working as expected](https://discuss.elastic.co/t/multiline-plugin-not-working-as-expected/46623)
**Author:** [@Sameer\_Panicker](https://discuss.elastic.co/u/Sameer_Panicker)\ **Replies:** 4\ **Last updated:** [April 7, 2016, 4:49pm UTC](https://discuss.elastic.co/t/multiline-plugin-not-working-as-expected/46623 "2016-04-07T16:49:14Z")
I wanted individual field as a Logstash output. i.e. EventID, Level, Session ID, etc. My GROK pattern works fine on "https://grokdebug.herokuapp.com/" where individual values are extracted. But when placed in logstash, m… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1167) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1169)