# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1176 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1177 --- ## [Specify windows logs](https://discuss.elastic.co/t/specify-windows-logs/45156)
**Author:** [@augusto](https://discuss.elastic.co/u/augusto)\ **Replies:** 1\ **Last updated:** [March 22, 2016, 8:42pm UTC](https://discuss.elastic.co/t/specify-windows-logs/45156 "2016-03-22T20:42:40Z")
Hello, sorry, but i can't find some answer in the forum about my doubt. I want to send only error and warning logs to logstash from Windows Server (using nxlog), it's possible filter on logstash? To exclude all is not… --- ## [Do Grok patterns have a place in the if =~ conditional matching?](https://discuss.elastic.co/t/do-grok-patterns-have-a-place-in-the-if-conditional-matching/45138)
**Author:** [@David\_McClain](https://discuss.elastic.co/u/David_McClain)\ **Replies:** 2\ **Last updated:** [March 22, 2016, 6:34pm UTC](https://discuss.elastic.co/t/do-grok-patterns-have-a-place-in-the-if-conditional-matching/45138 "2016-03-22T18:34:32Z")
I have the case where.. Sometimes my log has a block of JSON. Sometimes that block of JSON has a field (Lets call it "IPAddress") Sometimes the field "IPAddress" has a valid IP, other times, I've seen it with the value… --- ## [Split filter on an array containing only one element](https://discuss.elastic.co/t/split-filter-on-an-array-containing-only-one-element/35684)
**Author:** [@pdesoyres](https://discuss.elastic.co/u/pdesoyres)\ **Replies:** 3\ **Last updated:** [March 22, 2016, 4:16pm UTC](https://discuss.elastic.co/t/split-filter-on-an-array-containing-only-one-element/35684 "2016-03-22T16:16:03Z")
Hello, I'm trying to split the result of an elasticsearch aggregation into several events. Everything is working fine when there are multiple buckets in the result. I'm facing an issue when there is only one bucket. Th… --- ## [PFSense GOK Filter Breaks All Filters](https://discuss.elastic.co/t/pfsense-gok-filter-breaks-all-filters/45124)
**Author:** [@jnpetty](https://discuss.elastic.co/u/jnpetty)\ **Replies:** 0\ **Last updated:** [March 22, 2016, 3:23pm UTC](https://discuss.elastic.co/t/pfsense-gok-filter-breaks-all-filters/45124 "2016-03-22T15:23:30Z")
Currently I have a very vanilla configuration and im having some trouble adding a GOK filter for PFSense. Currently I have an input: input { #pfSense Firewalls tcp { type =\> "pfSense" port =\> "5002" } … --- ## [Using Logstash to analyse log4j log files](https://discuss.elastic.co/t/using-logstash-to-analyse-log4j-log-files/44914)
**Author:** [@Jemli\_Fathi](https://discuss.elastic.co/u/Jemli_Fathi)\ **Replies:** 5\ **Last updated:** [March 22, 2016, 2:28pm UTC](https://discuss.elastic.co/t/using-logstash-to-analyse-log4j-log-files/44914 "2016-03-22T14:28:49Z")
Hi, Can you give me a basic example on how to configure logstash to handle log4j files as input including how to give an entire directory to look into. Thank you. --- ## [Multiline codec/filter not working](https://discuss.elastic.co/t/multiline-codec-filter-not-working/45110)
**Author:** [@sunilmchaudhari](https://discuss.elastic.co/u/sunilmchaudhari)\ **Replies:** 2\ **Last updated:** [March 22, 2016, 1:56pm UTC](https://discuss.elastic.co/t/multiline-codec-filter-not-working/45110 "2016-03-22T13:56:00Z")
Hi, We have logs form one system as below Mar 22 13:08:14 hostname40 SYSLOG 7194 - - INFO;2016-03-22T15:08:14.604+0200;VM;-;There is no blacklist entry for '12345.9998.67890';-;-;-;-;blacklistRest.js;-;- Mar 22 13:08:1… --- ## [Using http\_poller on an api that does not end with a newline](https://discuss.elastic.co/t/using-http-poller-on-an-api-that-does-not-end-with-a-newline/45102)
**Author:** [@elvarb](https://discuss.elastic.co/u/elvarb)\ **Replies:** 0\ **Last updated:** [March 22, 2016, 1:03pm UTC](https://discuss.elastic.co/t/using-http-poller-on-an-api-that-does-not-end-with-a-newline/45102 "2016-03-22T13:03:01Z")
I'm trying to query the Unifi API but no matter what I did nothing was going through until I tested a few different API's and noticed right away that when querying the Unifi API the reply did not end with a newline. This… --- ## [Log stash plugin update failed with connection error](https://discuss.elastic.co/t/log-stash-plugin-update-failed-with-connection-error/34675)
**Author:** [@Omar\_Al\_Zabir](https://discuss.elastic.co/u/Omar_Al_Zabir)\ **Replies:** 4\ **Last updated:** [March 22, 2016, 11:51am UTC](https://discuss.elastic.co/t/log-stash-plugin-update-failed-with-connection-error/34675 "2016-03-22T11:51:06Z")
I have setup proxy and I can do curl/wget properly with the proxy. I have got both http and https proxy setup. I have also exported them to both lowercase and uppercase, e.g. https\_proxy and HTTPS\_PROXY. But still try… --- ## [Terminates immediately after starting](https://discuss.elastic.co/t/terminates-immediately-after-starting/44994)
**Author:** [@PascalR](https://discuss.elastic.co/u/PascalR)\ **Replies:** 2\ **Last updated:** [March 22, 2016, 10:01am UTC](https://discuss.elastic.co/t/terminates-immediately-after-starting/44994 "2016-03-22T10:01:38Z")
Hello, I tried to install logstash and read the guide. I've created the example .conf - file and started logstash with the command 'logstash -f simple.conf' An error window popped up and said that Jruby launcher has s… --- ## [Windows EventLog Parsing Fields](https://discuss.elastic.co/t/windows-eventlog-parsing-fields/45078)
**Author:** [@BigPete](https://discuss.elastic.co/u/BigPete)\ **Replies:** 0\ **Last updated:** [March 22, 2016, 8:12am UTC](https://discuss.elastic.co/t/windows-eventlog-parsing-fields/45078 "2016-03-22T08:12:37Z")
This may seem like a pretty basic request, but has anyone else had any issues parsing windows event logs? I've been struggling to find a definitive list of all the fields from "Application Information" and beyond. Does… --- ## [Translate Plugin Installation](https://discuss.elastic.co/t/translate-plugin-installation/44997)
**Author:** [@Navarro](https://discuss.elastic.co/u/Navarro)\ **Replies:** 2\ **Last updated:** [March 22, 2016, 8:11am UTC](https://discuss.elastic.co/t/translate-plugin-installation/44997 "2016-03-22T08:11:29Z")
I have a server in a network without Internet connection with ELK. I'm trying to install the translate plugin but its not possible with the command ./plugin install logstash-filter-translate but i cant find a way to d… --- ## [How to decide an optimal settings for workers?](https://discuss.elastic.co/t/how-to-decide-an-optimal-settings-for-workers/45061)
**Author:** [@zpp](https://discuss.elastic.co/u/zpp)\ **Replies:** 4\ **Last updated:** [March 22, 2016, 7:28am UTC](https://discuss.elastic.co/t/how-to-decide-an-optimal-settings-for-workers/45061 "2016-03-22T07:28:39Z")
For logstash ElasticSearch output plugin, how to determine the proper number of workers to use? If I play around the settings, is there a way to know whether the performance is getting better (or worse?) --- ## [How Logstash works during Tomcat Restart?](https://discuss.elastic.co/t/how-logstash-works-during-tomcat-restart/44041)
**Author:** [@ArivazhaganJ](https://discuss.elastic.co/u/ArivazhaganJ)\ **Replies:** 8\ **Last updated:** [March 22, 2016, 4:40am UTC](https://discuss.elastic.co/t/how-logstash-works-during-tomcat-restart/44041 "2016-03-22T04:40:24Z")
I am using logstash 1.5.4. Input plugin is JMX to monitor JVM stats. Output plugin is Elasticsearch and I index the logs directly. My application works on TomcatServer. Whenever I restart Tomcat, as soon as tomcat is… --- ## [Install logstash-filter-de\_dot failed?](https://discuss.elastic.co/t/install-logstash-filter-de-dot-failed/45058)
**Author:** [@stefansaye](https://discuss.elastic.co/u/stefansaye)\ **Replies:** 6\ **Last updated:** [March 22, 2016, 3:30am UTC](https://discuss.elastic.co/t/install-logstash-filter-de-dot-failed/45058 "2016-03-22T03:30:40Z")
Hi, I am trying to install logstash-filter-de\_dot plugin with below command. /opt/logstash/bin/plugin install logstash-filter-de\_dot But it shows below error. Validating logstash-filter-de\_dot Unable to download data … --- ## [Question about sending zipped data over TCP to logstash](https://discuss.elastic.co/t/question-about-sending-zipped-data-over-tcp-to-logstash/45057)
**Author:** [@arn](https://discuss.elastic.co/u/arn)\ **Replies:** 1\ **Last updated:** [March 22, 2016, 12:44am UTC](https://discuss.elastic.co/t/question-about-sending-zipped-data-over-tcp-to-logstash/45057 "2016-03-22T00:44:52Z")
Hi Folks, I've been reading through the logstash documentation but am still a noob so sorry if this is a naive question. Here is what I want to solve : We have about 1000 remote clients. Each client will send zipped … --- ## [S3 input with cloudtrail codec not working with gzipped files](https://discuss.elastic.co/t/s3-input-with-cloudtrail-codec-not-working-with-gzipped-files/44482)
**Author:** [@kevinpauli](https://discuss.elastic.co/u/kevinpauli)\ **Replies:** 2\ **Last updated:** [March 21, 2016, 10:04pm UTC](https://discuss.elastic.co/t/s3-input-with-cloudtrail-codec-not-working-with-gzipped-files/44482 "2016-03-21T22:04:07Z")
TL/DR: I can't seem to get the s3 input with cloudtrail codec working if the file is gzipped (which is the default for cloudtrail). It does work if I download the file, unzip it, and upload it back into a different S3 b… --- ## [Logstash isn't starting](https://discuss.elastic.co/t/logstash-isnt-starting/45039)
**Author:** [@pierrejnelson](https://discuss.elastic.co/u/pierrejnelson)\ **Replies:** 4\ **Last updated:** [March 21, 2016, 8:20pm UTC](https://discuss.elastic.co/t/logstash-isnt-starting/45039 "2016-03-21T20:20:35Z")
Hello all, Pretty new to logstash but I fhave finally gotten my config to check out as ok with no issues or errors. Problem now is that logstash will not start. Below you will see that I check the config and then st… --- ## [Want to reduce logstash-indexer loglevel to WARN or INFO](https://discuss.elastic.co/t/want-to-reduce-logstash-indexer-loglevel-to-warn-or-info/44959)
**Author:** [@sunilmchaudhari](https://discuss.elastic.co/u/sunilmchaudhari)\ **Replies:** 1\ **Last updated:** [March 21, 2016, 6:38pm UTC](https://discuss.elastic.co/t/want-to-reduce-logstash-indexer-loglevel-to-warn-or-info/44959 "2016-03-21T18:38:15Z")
HI , I am using logstash as indexer. Current setting in /etc/init.d/indexer is LS\_OPTS="" previously it was debug What does blank means? INFO/WARN/Debug? br, Sunil --- ## [Multiline filter and dateparse issue in production](https://discuss.elastic.co/t/multiline-filter-and-dateparse-issue-in-production/44927)
**Author:** [@sunilmchaudhari](https://discuss.elastic.co/u/sunilmchaudhari)\ **Replies:** 11\ **Last updated:** [March 21, 2016, 3:16pm UTC](https://discuss.elastic.co/t/multiline-filter-and-dateparse-issue-in-production/44927 "2016-03-21T15:16:18Z")
Hi I am using logstash-1.5.3 as indexer my configuration is filter{ multiline { pattern =\> "^%{TIMESTAMP\_ISO8601}" # negate =\> true what =\> previous } multiline { pattern =\> "^\\s" … --- ## [Handling missing fields in output filters](https://discuss.elastic.co/t/handling-missing-fields-in-output-filters/45004)
**Author:** [@eroussel](https://discuss.elastic.co/u/eroussel)\ **Replies:** 0\ **Last updated:** [March 21, 2016, 2:38pm UTC](https://discuss.elastic.co/t/handling-missing-fields-in-output-filters/45004 "2016-03-21T14:38:36Z")
Hello, What are my options to handle missing fields in output filters? Specifically, if in my log message I have a bunch of fields that may or may not exist depending on the case, do I have to do something like: i… --- ## [Where is my \_rev field from couchdb](https://discuss.elastic.co/t/where-is-my--rev-field-from-couchdb/44995)
**Author:** [@imad](https://discuss.elastic.co/u/imad)\ **Replies:** 1\ **Last updated:** [March 21, 2016, 1:53pm UTC](https://discuss.elastic.co/t/where-is-my--rev-field-from-couchdb/44995 "2016-03-21T13:53:17Z")
Hi, I am using logstash to put my data from couchdb into elasticsearch. I just noticed that my \_rev field in not ported to elasticsearch. Do I need to do something special in my logstash config file to have that in el… --- ## [Transfer TLS Windows Server 2012R2 DNS logs by nxlog towards ELK pile on debian](https://discuss.elastic.co/t/transfer-tls-windows-server-2012r2-dns-logs-by-nxlog-towards-elk-pile-on-debian/44341)
**Author:** [@OncleThorgal](https://discuss.elastic.co/u/OncleThorgal)\ **Replies:** 4\ **Last updated:** [March 21, 2016, 1:18pm UTC](https://discuss.elastic.co/t/transfer-tls-windows-server-2012r2-dns-logs-by-nxlog-towards-elk-pile-on-debian/44341 "2016-03-21T13:18:32Z")
Hello everyone! I'm new to the forum, so, I appeal to you because I meet a problem in viewing my DNS logs on ELK stack. Here is my problem: I have Windows Server 2012R2 VM with nxlog above . The configuration file is t… --- ## [Date Conversion from GMT to PST](https://discuss.elastic.co/t/date-conversion-from-gmt-to-pst/44983)
**Author:** [@Ganesh2303](https://discuss.elastic.co/u/Ganesh2303)\ **Replies:** 1\ **Last updated:** [March 21, 2016, 11:54am UTC](https://discuss.elastic.co/t/date-conversion-from-gmt-to-pst/44983 "2016-03-21T11:54:30Z")
HI, I'm trying to convert the GMT date filed into PST field but it failed to convert the field can anyone help me to resolve it timestamp=\> "2016-03-18 23:59:51" date { match =\> \["timestamp", "YYYY-MM-dd HH:mm:s… --- ## [Logstash spikes to ~800% when adding one more GROK expression?](https://discuss.elastic.co/t/logstash-spikes-to-800-when-adding-one-more-grok-expression/44966)
**Author:** [@Mark\_Rodman](https://discuss.elastic.co/u/Mark_Rodman)\ **Replies:** 4\ **Last updated:** [March 21, 2016, 11:04am UTC](https://discuss.elastic.co/t/logstash-spikes-to-800-when-adding-one-more-grok-expression/44966 "2016-03-21T11:04:02Z")
Hi All, I'm suffering a strange issue when trying to process IDS events with Logstash. My events are essentially , delimited as follows; 2016-03-11T22:18:48.559342+00:00 1457648327 2016-03-11T22:18:48.538761+00:00 14… --- ## [TCP output not working well](https://discuss.elastic.co/t/tcp-output-not-working-well/44974)
**Author:** [@StavSap](https://discuss.elastic.co/u/StavSap)\ **Replies:** 0\ **Last updated:** [March 21, 2016, 10:51am UTC](https://discuss.elastic.co/t/tcp-output-not-working-well/44974 "2016-03-21T10:51:04Z")
i am outputting to a simple tcp server that accepts connection on port X and displays out comes to stdout, and in logstash i am outputting to port X on the address where is the server and to local stdout. the issue is … --- ## [Logstash 2.1 is filling my Disk volumes](https://discuss.elastic.co/t/logstash-2-1-is-filling-my-disk-volumes/44924)
**Author:** [@soodlikesjava](https://discuss.elastic.co/u/soodlikesjava)\ **Replies:** 13\ **Last updated:** [March 21, 2016, 8:03am UTC](https://discuss.elastic.co/t/logstash-2-1-is-filling-my-disk-volumes/44924 "2016-03-21T08:03:41Z")
Hi Team , I am facing an issue that when my logstash process is running for 4-5 days , my disk volume on the machine where logstash is installed is getting exhausted and i have to restart the logstash process to free the… --- ## ["SocketError: send: name or service not known" on using GELF output plugin](https://discuss.elastic.co/t/socketerror-send-name-or-service-not-known-on-using-gelf-output-plugin/44832)
**Author:** [@mshar039](https://discuss.elastic.co/u/mshar039)\ **Replies:** 3\ **Last updated:** [March 21, 2016, 7:08am UTC](https://discuss.elastic.co/t/socketerror-send-name-or-service-not-known-on-using-gelf-output-plugin/44832 "2016-03-21T07:08:34Z")
Hi all, I am facing an issue with GELF output plugin in Logstash. Recently started using Logstash. Wanted to visualize logs in Graylog2 using Logstash. So, gave a basic trail with this. My config is input { file { … --- ## [Flag traffic from Tor exit nodes](https://discuss.elastic.co/t/flag-traffic-from-tor-exit-nodes/44938)
**Author:** [@tomr](https://discuss.elastic.co/u/tomr)\ **Replies:** 1\ **Last updated:** [March 21, 2016, 2:44am UTC](https://discuss.elastic.co/t/flag-traffic-from-tor-exit-nodes/44938 "2016-03-21T02:44:02Z")
I'm looking to flag any traffic hitting our edge that appears to come from a tor exit node. I've pulled a list of all exit nodes, which I'll later cron updates to, with: curl -s https://check.torproject.org/exit-addr… --- ## [Logs shipping to redis queue](https://discuss.elastic.co/t/logs-shipping-to-redis-queue/44875)
**Author:** [@bishaka](https://discuss.elastic.co/u/bishaka)\ **Replies:** 6\ **Last updated:** [March 21, 2016, 2:24am UTC](https://discuss.elastic.co/t/logs-shipping-to-redis-queue/44875 "2016-03-21T02:24:10Z")
I'm shipping some logs from server 1 to server 2 using logstash-shipper and receiving the message on redisqueue on server 2 the config file i'm using is this: input { file { path =\> "/path/to/my/logfile.log" type =\> … --- ## [Reindex data from 1.5 cluster to 2.x cluster](https://discuss.elastic.co/t/reindex-data-from-1-5-cluster-to-2-x-cluster/44858)
**Author:** [@lhorsky1](https://discuss.elastic.co/u/lhorsky1)\ **Replies:** 2\ **Last updated:** [March 21, 2016, 2:05am UTC](https://discuss.elastic.co/t/reindex-data-from-1-5-cluster-to-2-x-cluster/44858 "2016-03-21T02:05:48Z")
I am upgrading a cluster from 1.5 to 2.x. When I asked at Elasticon, I was told that we should stand up a new cluster and then import the data from the 1.5 cluster to 2.x. I have created a new ES2 cluster with a new Log… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1175) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1177)