# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1171 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1172 --- ## [Storing rollup externally](https://discuss.elastic.co/t/storing-rollup-externally/46078)
**Author:** [@Dani](https://discuss.elastic.co/u/Dani)\ **Replies:** 4\ **Last updated:** [April 4, 2016, 9:48pm UTC](https://discuss.elastic.co/t/storing-rollup-externally/46078 "2016-04-04T21:48:02Z")
How difficult would it be to implement a process that would generate daily rollups in a separate document store, such as mongoDB. I've got a system that processes log files and stores them as aggregated rollups in mong… --- ## [How to provide \*.PFX in http\_poller](https://discuss.elastic.co/t/how-to-provide-pfx-in-http-poller/46179)
**Author:** [@Sameer\_Panicker](https://discuss.elastic.co/u/Sameer_Panicker)\ **Replies:** 1\ **Last updated:** [April 4, 2016, 7:18pm UTC](https://discuss.elastic.co/t/how-to-provide-pfx-in-http-poller/46179 "2016-04-04T19:18:06Z")
I am trying to connect to my HTTPS service. My logstash conf. works fine for the HTTP call, but throws an exception during the secured call i.e. with HTTPS. Error: "PKIX path building failed: sun.security.provider.c e… --- ## [Pass Requset Body to Http\_Poller](https://discuss.elastic.co/t/pass-requset-body-to-http-poller/46180)
**Author:** [@Sameer\_Panicker](https://discuss.elastic.co/u/Sameer_Panicker)\ **Replies:** 4\ **Last updated:** [April 4, 2016, 5:32pm UTC](https://discuss.elastic.co/t/pass-requset-body-to-http-poller/46180 "2016-04-04T17:32:43Z")
I am able to connect to my services using http\_poller for all the GET services. I have some POST service to monitor which accepts a json body Input - { "AreaCode": "111", "CountryCode" : "01", "Number": "1231231" } … --- ## [Logstash configuration for Cloudfront logs](https://discuss.elastic.co/t/logstash-configuration-for-cloudfront-logs/45660)
**Author:** [@manishr](https://discuss.elastic.co/u/manishr)\ **Replies:** 7\ **Last updated:** [April 4, 2016, 5:05pm UTC](https://discuss.elastic.co/t/logstash-configuration-for-cloudfront-logs/45660 "2016-04-04T17:05:00Z")
Hi Guys, Help me getting cloudfront logs parsed in logstash. I want each filed to be searchable even parameters like aid, bid, cid etc. See below Sample cloudfront log 2016-03-29 04:02:08 ABC1 461 … --- ## [\_grokparsefailure - "message": "\\u00002\\u00000](https://discuss.elastic.co/t/-grokparsefailure-message-u00002-u00000/45962)
**Author:** [@Cross](https://discuss.elastic.co/u/Cross)\ **Replies:** 3\ **Last updated:** [April 4, 2016, 1:38pm UTC](https://discuss.elastic.co/t/-grokparsefailure-message-u00002-u00000/45962 "2016-04-04T13:38:57Z")
My log data is like, 2016-03-31 18:04:04,124 - \[Messages\_Router - FN7SVCT2\] - \[590\] DEBUG Ifn.Messages.Router.MessageHandlerFactory \[(null)\] - ProcessQueue: ProcessingW2DocumentRouterMessage 2016-03-31 18:04:04,124 - \[Me… --- ## [Flatten nested fields in a json object](https://discuss.elastic.co/t/flatten-nested-fields-in-a-json-object/46238)
**Author:** [@Benyamin\_Dvoskin](https://discuss.elastic.co/u/Benyamin_Dvoskin)\ **Replies:** 0\ **Last updated:** [April 4, 2016, 12:37pm UTC](https://discuss.elastic.co/t/flatten-nested-fields-in-a-json-object/46238 "2016-04-04T12:37:59Z")
Hi, we are having this issue with Kibana not displaying fields from nested objects correctly. I've opened a topic in the Kibana discuss board, but eventually got to the understanding that this is a known and pending is… --- ## [Logstash error 'configtest'](https://discuss.elastic.co/t/logstash-error-configtest/46232)
**Author:** [@ironbeast](https://discuss.elastic.co/u/ironbeast)\ **Replies:** 1\ **Last updated:** [April 4, 2016, 12:05pm UTC](https://discuss.elastic.co/t/logstash-error-configtest/46232 "2016-04-04T12:05:50Z")
Dear all, After updating to the latest logstash version (logstash-2.3.0-1.noarch), I can't start logstash anymore as a service... When I run 'service logstash configtest' I get: An unexpected error occurred! {:error=\>#:w… --- ## [Using Grok to add SID field to oracle database logmessages](https://discuss.elastic.co/t/using-grok-to-add-sid-field-to-oracle-database-logmessages/46216)
**Author:** [@debarun](https://discuss.elastic.co/u/debarun)\ **Replies:** 6\ **Last updated:** [April 4, 2016, 11:30am UTC](https://discuss.elastic.co/t/using-grok-to-add-sid-field-to-oracle-database-logmessages/46216 "2016-04-04T11:30:24Z")
Hi, I am trying to add a field to every message of my alert log . The test has to be extracted from the file name and appended as a field to every log entry. To do that I am doing:- if \[path\] =~ /alert/ { … --- ## [Performance issues with input-beats plugin](https://discuss.elastic.co/t/performance-issues-with-input-beats-plugin/37516)
**Author:** [@cooper6581](https://discuss.elastic.co/u/cooper6581)\ **Replies:** 5\ **Last updated:** [April 4, 2016, 11:13am UTC](https://discuss.elastic.co/t/performance-issues-with-input-beats-plugin/37516 "2016-04-04T11:13:52Z")
I'm running into strange performance issues with the input-beats plug-in. Logstash: 2.1.1 (duplicated on trunk yesterday FWiW) input-beats: 2.0.3 filebeat: 1.0.1 It seems like throughput it being bottle-necked by s… --- ## [Using tag found in array as index name](https://discuss.elastic.co/t/using-tag-found-in-array-as-index-name/46057)
**Author:** [@blindpet](https://discuss.elastic.co/u/blindpet)\ **Replies:** 17\ **Last updated:** [April 4, 2016, 10:26am UTC](https://discuss.elastic.co/t/using-tag-found-in-array-as-index-name/46057 "2016-04-04T10:26:22Z")
We are trying to automate Logstash configuration template creation for about 200 customers. Each customer will have its own index based on its company name. Is it possible to use the tag found in array as a variable fo… --- ## [Logstash hangs after few days and stops processing logfiles](https://discuss.elastic.co/t/logstash-hangs-after-few-days-and-stops-processing-logfiles/29780)
**Author:** [@wdijkerman](https://discuss.elastic.co/u/wdijkerman)\ **Replies:** 5\ **Last updated:** [April 4, 2016, 9:56am UTC](https://discuss.elastic.co/t/logstash-hangs-after-few-days-and-stops-processing-logfiles/29780 "2016-04-04T09:56:47Z")
Hi, We have an logstash running on an server and after a few days (3 - 5), it stops processing logfiles. The process is still running on the system, but it looks like it is hanging. In Kibana we see an gap for all data… --- ## [Filter IIS Log information](https://discuss.elastic.co/t/filter-iis-log-information/46209)
**Author:** [@freichert](https://discuss.elastic.co/u/freichert)\ **Replies:** 4\ **Last updated:** [April 4, 2016, 9:00am UTC](https://discuss.elastic.co/t/filter-iis-log-information/46209 "2016-04-04T09:00:01Z")
Hello everybody, i just set up the ELK Stack on an Ubuntu machine. Currently Logstash is processing the IIS Logs with a Grok Filter and Splits the information like it should. Now i am Stuck - i would like to "filter" t… --- ## [Failing with multi-file config and auto reload flag](https://discuss.elastic.co/t/failing-with-multi-file-config-and-auto-reload-flag/46168)
**Author:** [@StavSap](https://discuss.elastic.co/u/StavSap)\ **Replies:** 11\ **Last updated:** [April 4, 2016, 8:28am UTC](https://discuss.elastic.co/t/failing-with-multi-file-config-and-auto-reload-flag/46168 "2016-04-04T08:28:13Z")
Hi, i have an issue running in multi-files configuration (using folder with \*.conf files) and auto-reload flag (--auto-reload) this causes a crash and shutdown of log stash when i am sending the syslog event for parsin… --- ## [Logstash makes extra document with \_grokparsefailure on logs rotation](https://discuss.elastic.co/t/logstash-makes-extra-document-with--grokparsefailure-on-logs-rotation/46201)
**Author:** [@vsadokhin](https://discuss.elastic.co/u/vsadokhin)\ **Replies:** 0\ **Last updated:** [April 4, 2016, 6:24am UTC](https://discuss.elastic.co/t/logstash-makes-extra-document-with--grokparsefailure-on-logs-rotation/46201 "2016-04-04T06:24:45Z")
Hello We have logs per hour rotation and logstash configured to grab/filter logs. Sometimes, at the end of the hour logstash gets an event that looks like cut log message (beginning exists, no correct ending) so the ev… --- ## [Date filter configuration error](https://discuss.elastic.co/t/date-filter-configuration-error/46147)
**Author:** [@manishr](https://discuss.elastic.co/u/manishr)\ **Replies:** 3\ **Last updated:** [April 4, 2016, 6:14am UTC](https://discuss.elastic.co/t/date-filter-configuration-error/46147 "2016-04-04T06:14:05Z")
HI Guys, I am trying to replace @timestamp with tstamp but it is not working. What am I missing here? Here is my configuration date { match =\> \["tstamp","yyyy-MM-dd'T'HH:mm:ss.SSSZ"\] targ… --- ## [Logstash XML Filter is not functioning after upgrading to Logstash 2.2.1](https://discuss.elastic.co/t/logstash-xml-filter-is-not-functioning-after-upgrading-to-logstash-2-2-1/46039)
**Author:** [@rajkamalkool6](https://discuss.elastic.co/u/rajkamalkool6)\ **Replies:** 1\ **Last updated:** [April 3, 2016, 7:47pm UTC](https://discuss.elastic.co/t/logstash-xml-filter-is-not-functioning-after-upgrading-to-logstash-2-2-1/46039 "2016-04-03T19:47:44Z")
Hi, I have used logstash 1.5.4 before and I am parsing XML log files which was worked nicely. Currently I have upgraded my Logstash to 2.2.1 and I trying to parse the XML file which was not parsing the fields as before. … --- ## [Add\_tag failing](https://discuss.elastic.co/t/add-tag-failing/46151)
**Author:** [@brain](https://discuss.elastic.co/u/brain)\ **Replies:** 6\ **Last updated:** [April 3, 2016, 7:35am UTC](https://discuss.elastic.co/t/add-tag-failing/46151 "2016-04-03T07:35:21Z")
i have the following in my config file, where i'm using the GeoIPASNum database to add the AS of an IP to its own field (asn\_id.orig\_h.number) if \[id.orig\_h\] { geoip { database =\> "/opt/logstash/vendor/geoip/GeoI… --- ## [Logstash upgrade from 2.2 to 2.3 failed](https://discuss.elastic.co/t/logstash-upgrade-from-2-2-to-2-3-failed/45887)
**Author:** [@abcfy2](https://discuss.elastic.co/u/abcfy2)\ **Replies:** 14\ **Last updated:** [April 3, 2016, 5:47am UTC](https://discuss.elastic.co/t/logstash-upgrade-from-2-2-to-2-3-failed/45887 "2016-04-03T05:47:30Z")
Here is my config, and works well in 2.2. cat /etc/logstash/conf.d/logstash.conf input { redis { data\_type =\> "list" batch\_count =\> 50 host =\> "127.0.0.1" key =\> "logstash" … --- ## [How to convert a nested field type?](https://discuss.elastic.co/t/how-to-convert-a-nested-field-type/46025)
**Author:** [@abcfy2](https://discuss.elastic.co/u/abcfy2)\ **Replies:** 11\ **Last updated:** [April 3, 2016, 2:42am UTC](https://discuss.elastic.co/t/how-to-convert-a-nested-field-type/46025 "2016-04-03T02:42:01Z")
I find mutate filter can convert a field type, but how to convert a nested one? I've tried: mutate { convert =\> {"logdetail.params" =\> "string"} } And mutate { convert =\> {"\[logdetail\]\[params\]" =\> "st… --- ## [Inatalling Logstash codes in offline mode](https://discuss.elastic.co/t/inatalling-logstash-codes-in-offline-mode/46043)
**Author:** [@debarun](https://discuss.elastic.co/u/debarun)\ **Replies:** 1\ **Last updated:** [April 3, 2016, 2:12am UTC](https://discuss.elastic.co/t/inatalling-logstash-codes-in-offline-mode/46043 "2016-04-03T02:12:50Z")
Hi, I am trying to install the logstash-codec-nmap, but my server has no internet access. But when i download to a different server ans then try to install locally: bin/plugin install /root/logstash-codec-nmap Vali… --- ## [Logstash translate plugin](https://discuss.elastic.co/t/logstash-translate-plugin/46131)
**Author:** [@brain](https://discuss.elastic.co/u/brain)\ **Replies:** 2\ **Last updated:** [April 3, 2016, 1:21am UTC](https://discuss.elastic.co/t/logstash-translate-plugin/46131 "2016-04-03T01:21:22Z")
with the translate plugin, are the fields in the dictionary a strict/exact match, or will a "contains" also match? so if my yaml file had something like: "blah.com" : "true" would a log line with www.blah.com also … --- ## [Multiple input and output in logstash](https://discuss.elastic.co/t/multiple-input-and-output-in-logstash/45948)
**Author:** [@daguero](https://discuss.elastic.co/u/daguero)\ **Replies:** 1\ **Last updated:** [April 2, 2016, 6:57pm UTC](https://discuss.elastic.co/t/multiple-input-and-output-in-logstash/45948 "2016-04-02T18:57:55Z")
I need to have different entries in logstash and depending on the input source to apply a given output. For example this is my setup: input { jmx { path =\> "/config-dir/jmx" polling\_frequency =\> 10 type =\> … --- ## [Not able to feed log file to Elasticsearch through Logstash](https://discuss.elastic.co/t/not-able-to-feed-log-file-to-elasticsearch-through-logstash/46062)
**Author:** [@mshar039](https://discuss.elastic.co/u/mshar039)\ **Replies:** 1\ **Last updated:** [April 2, 2016, 6:26pm UTC](https://discuss.elastic.co/t/not-able-to-feed-log-file-to-elasticsearch-through-logstash/46062 "2016-04-02T18:26:55Z")
I am trying to feed a log file through logstash into elasticsearch. My logstash config file is: input { file { path =\> "/root/Desktop/Graylog/SB\_log.txt" start\_position =\> "beginning" type =\> "logs" … --- ## [Logstash/JBDC for ES when using nested attributes?](https://discuss.elastic.co/t/logstash-jbdc-for-es-when-using-nested-attributes/46130)
**Author:** [@BenSeb](https://discuss.elastic.co/u/BenSeb)\ **Replies:** 3\ **Last updated:** [April 2, 2016, 5:54pm UTC](https://discuss.elastic.co/t/logstash-jbdc-for-es-when-using-nested-attributes/46130 "2016-04-02T17:54:37Z")
Hi We wish to index physical events as documents. Each event will have multiple attributes, such as artists who are attending, and dates. We're migrating from Sphinx, and to deal with this, we produced a mysql query … --- ## [Need suggestion for logstash setup](https://discuss.elastic.co/t/need-suggestion-for-logstash-setup/46115)
**Author:** [@ajays](https://discuss.elastic.co/u/ajays)\ **Replies:** 1\ **Last updated:** [April 2, 2016, 2:52pm UTC](https://discuss.elastic.co/t/need-suggestion-for-logstash-setup/46115 "2016-04-02T14:52:15Z")
Hello, I am having one t2.large ec2 machine with 8 GB RAM and 2 CPU on which I have installed ELK. Now I am parsing 30 GB of logs that I downloaded on that machine with file input plugin. Do you think logstash will pro… --- ## [Multiple ElasticSearch Indexes in Logstash Output](https://discuss.elastic.co/t/multiple-elasticsearch-indexes-in-logstash-output/46116)
**Author:** [@Sameer\_Panicker](https://discuss.elastic.co/u/Sameer_Panicker)\ **Replies:** 1\ **Last updated:** [April 2, 2016, 2:50pm UTC](https://discuss.elastic.co/t/multiple-elasticsearch-indexes-in-logstash-output/46116 "2016-04-02T14:50:22Z")
if\[type\] == "IISLogs" { elasticsearch { index =\> "iislogs" hosts =\> \["myserver:9200"\] } } else { elasticsearch { index =\> "filebeat-2016.03.27" hosts =\> \["myserver:9200"\] } } Since, filebeat in… --- ## [Tcp server output, "Address already in use" after upgrade to 2.2](https://discuss.elastic.co/t/tcp-server-output-address-already-in-use-after-upgrade-to-2-2/43501)
**Author:** [@davemac30](https://discuss.elastic.co/u/davemac30)\ **Replies:** 7\ **Last updated:** [April 1, 2016, 1:46pm UTC](https://discuss.elastic.co/t/tcp-server-output-address-already-in-use-after-upgrade-to-2-2/43501 "2016-04-01T13:46:22Z")
After upgrade to 2.2 (logstash-2.2.2-1.noarch from the official yum repo), logstash fails to start with the following error. {:timestamp=\>"2016-03-04T10:45:12.833000+0000", :message=\>"The error reported is: \\n Address… --- ## [ELK No Output](https://discuss.elastic.co/t/elk-no-output/46019)
**Author:** [@johnslippers](https://discuss.elastic.co/u/johnslippers)\ **Replies:** 5\ **Last updated:** [April 1, 2016, 1:45pm UTC](https://discuss.elastic.co/t/elk-no-output/46019 "2016-04-01T13:45:07Z")
Hi, I really hope somebody can help me. I have installed ELK on CentOS 6.5 and even after reinstalling onto another box using a different howto, I still can't get Logstash to send me any output. I am supposed to get… --- ## [Send J-flow(Net-flow) to my Logstash to visualize on Kibana](https://discuss.elastic.co/t/send-j-flow-net-flow-to-my-logstash-to-visualize-on-kibana/45198)
**Author:** [@brayndasilva](https://discuss.elastic.co/u/brayndasilva)\ **Replies:** 2\ **Last updated:** [April 1, 2016, 12:56pm UTC](https://discuss.elastic.co/t/send-j-flow-net-flow-to-my-logstash-to-visualize-on-kibana/45198 "2016-04-01T12:56:12Z")
Hi, I have set up an ELK server along with a Client Server that are working fine. I configured the client to send Syslogs to Logstash and can visualize it on Kibana and it works fine. I'm not done yet! I decided to … --- ## [Logstash JDBC importer MSSQL2012 is not working](https://discuss.elastic.co/t/logstash-jdbc-importer-mssql2012-is-not-working/45926)
**Author:** [@PascalR](https://discuss.elastic.co/u/PascalR)\ **Replies:** 3\ **Last updated:** [April 1, 2016, 12:00pm UTC](https://discuss.elastic.co/t/logstash-jdbc-importer-mssql2012-is-not-working/45926 "2016-04-01T12:00:58Z")
Hi, I'm completely stuck. I tried to import data from an MSSQL2012 database to elasticsearch, but it's not working. Here are the steps I've done: Started Elasticsearch 2.2.0 Downloaded Logstash-all-plugins-2.2.0 Dow… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1170) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1172)