# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1178 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1179 --- ## [How to write only specific fields to elasticsearch from logstash](https://discuss.elastic.co/t/how-to-write-only-specific-fields-to-elasticsearch-from-logstash/44176)
**Author:** [@MikeM](https://discuss.elastic.co/u/MikeM)\ **Replies:** 4\ **Last updated:** [March 17, 2016, 8:00pm UTC](https://discuss.elastic.co/t/how-to-write-only-specific-fields-to-elasticsearch-from-logstash/44176 "2016-03-17T20:00:50Z")
I want to output an event to elasticsearch, but I really only want to have 4 - 6 fields in the index, but the event is coming in with 130 fields. I know that I can use the remove\_field array in a mutate or other filter,… --- ## [How to capture with ELK the incoming and outgoing traffic on interface card in RedHat Linux](https://discuss.elastic.co/t/how-to-capture-with-elk-the-incoming-and-outgoing-traffic-on-interface-card-in-redhat-linux/44661)
**Author:** [@rajput1919](https://discuss.elastic.co/u/rajput1919)\ **Replies:** 1\ **Last updated:** [March 17, 2016, 5:33pm UTC](https://discuss.elastic.co/t/how-to-capture-with-elk-the-incoming-and-outgoing-traffic-on-interface-card-in-redhat-linux/44661 "2016-03-17T17:33:58Z")
i want to capture the incoming and outgoing traffic on interface card in linux. And show these data for analysis in kibana. --- ## [Does grok filter could not change @timestamp?](https://discuss.elastic.co/t/does-grok-filter-could-not-change-timestamp/44688)
**Author:** [@abcfy2](https://discuss.elastic.co/u/abcfy2)\ **Replies:** 2\ **Last updated:** [March 17, 2016, 12:08pm UTC](https://discuss.elastic.co/t/does-grok-filter-could-not-change-timestamp/44688 "2016-03-17T12:08:42Z")
Here is my config: grok { match =\> { message =\> "%{TIMESTAMP\_ISO8601:@timestamp} %{MONGO3\_SEVERITY:severity} %{MONGO3\_COMPONENT:component}%{SPACE}(?:\\\[%{DATA:context}\\\])? %{GREEDYD… --- ## [Why the logstash running so slowly?](https://discuss.elastic.co/t/why-the-logstash-running-so-slowly/44664)
**Author:** [@lester015](https://discuss.elastic.co/u/lester015)\ **Replies:** 3\ **Last updated:** [March 17, 2016, 11:59am UTC](https://discuss.elastic.co/t/why-the-logstash-running-so-slowly/44664 "2016-03-17T11:59:59Z")
hi everyone, I found the logstash running my conf file so slowly,Anyone has an solution? My conf file is very easy. a. stdin.conf contents is input { stdin { add\_field =\> {"key" =\> "value"} c… --- ## [Rubydebug codec not working](https://discuss.elastic.co/t/rubydebug-codec-not-working/44620)
**Author:** [@tetlika](https://discuss.elastic.co/u/tetlika)\ **Replies:** 4\ **Last updated:** [March 17, 2016, 11:31am UTC](https://discuss.elastic.co/t/rubydebug-codec-not-working/44620 "2016-03-17T11:31:19Z")
hi, we're using logstash 2.2.2, I have next simple config of logstash: input { file { path =\> "/var/log/logstash/logstash.log" codec =\> "rubydebug" } } output { stdout { codec =\> "… --- ## [How do I get first line from multiline message by using logstash 1.5?](https://discuss.elastic.co/t/how-do-i-get-first-line-from-multiline-message-by-using-logstash-1-5/1817)
**Author:** [@abcfy2](https://discuss.elastic.co/u/abcfy2)\ **Replies:** 6\ **Last updated:** [March 17, 2016, 8:45am UTC](https://discuss.elastic.co/t/how-do-i-get-first-line-from-multiline-message-by-using-logstash-1-5/1817 "2016-03-17T08:45:33Z")
Here is a sample: { "@timestamp" =\> "2015-06-03T11:12:43.776Z", "message" =\> "2015-06-03 16:40:30,356 \[DefaultQuartzScheduler\_Worker-9\] ERROR StackTrace - Full Stack Trace:\\norg.springframework.transacti… --- ## [Help Parsing Websphere log entry](https://discuss.elastic.co/t/help-parsing-websphere-log-entry/44470)
**Author:** [@rameeelastic](https://discuss.elastic.co/u/rameeelastic)\ **Replies:** 2\ **Last updated:** [March 17, 2016, 8:22am UTC](https://discuss.elastic.co/t/help-parsing-websphere-log-entry/44470 "2016-03-17T08:22:20Z")
I have a websphere log entry as follows \[3/15/16 20:47:40:923 CEST\] 0000005f MediationFlow E CWSXM1017E: Request flow runtime instance is unavailable due to a flow build error: 'null'. I am able to parse the entire d… --- ## [Install logstash without plugins](https://discuss.elastic.co/t/install-logstash-without-plugins/44625)
**Author:** [@ebuildy](https://discuss.elastic.co/u/ebuildy)\ **Replies:** 0\ **Last updated:** [March 16, 2016, 9:53pm UTC](https://discuss.elastic.co/t/install-logstash-without-plugins/44625 "2016-03-16T21:53:06Z")
In order to develop a logstash plugin, I install logstash via git. Running "rake bootstrap" install jruby + all plugins \[:confused:\] Is it possible to install logstash without all plugins? Cheers, --- ## [Run logstash with already installed jRuby](https://discuss.elastic.co/t/run-logstash-with-already-installed-jruby/44624)
**Author:** [@ebuildy](https://discuss.elastic.co/u/ebuildy)\ **Replies:** 0\ **Last updated:** [March 16, 2016, 9:47pm UTC](https://discuss.elastic.co/t/run-logstash-with-already-installed-jruby/44624 "2016-03-16T21:47:26Z")
Why logstash downloads its own jruby instead of using the already installed one? Thanks, --- ## [Feed one input event into another input](https://discuss.elastic.co/t/feed-one-input-event-into-another-input/44611)
**Author:** [@sk\_nag](https://discuss.elastic.co/u/sk_nag)\ **Replies:** 0\ **Last updated:** [March 16, 2016, 8:05pm UTC](https://discuss.elastic.co/t/feed-one-input-event-into-another-input/44611 "2016-03-16T20:05:46Z")
I am looking for a way to read from a file and use the content to query elasticsearch. Basically, feeding the data from file input to elastic input. How does one achieve this in logstash ? Any help would be appreciated… --- ## [Logstash Startup completed but no data loaded](https://discuss.elastic.co/t/logstash-startup-completed-but-no-data-loaded/44243)
**Author:** [@Lucky](https://discuss.elastic.co/u/Lucky)\ **Replies:** 9\ **Last updated:** [March 16, 2016, 1:34pm UTC](https://discuss.elastic.co/t/logstash-startup-completed-but-no-data-loaded/44243 "2016-03-16T13:34:01Z")
I am using logstash to feed my CSV file into my elasticsearch , my logstash startup completed but the files didn't load into the index. I try checking by using GET /\_cat/indices?v health status index pri rep docs.count… --- ## [Failed parsing date, linux syslog](https://discuss.elastic.co/t/failed-parsing-date-linux-syslog/44549)
**Author:** [@Willie\_Cadete](https://discuss.elastic.co/u/Willie_Cadete)\ **Replies:** 2\ **Last updated:** [March 16, 2016, 12:33pm UTC](https://discuss.elastic.co/t/failed-parsing-date-linux-syslog/44549 "2016-03-16T12:33:52Z")
Hello, Everyone I'm having problems to parse field timestamp, it shoud be something simple but I'm not getting to see! I'm already here trying resolve this all day log example: Mar 8 03:34:15 fw01 block-INPUT IN=w… --- ## [Ruby filter, load csv file to add field](https://discuss.elastic.co/t/ruby-filter-load-csv-file-to-add-field/44322)
**Author:** [@patou](https://discuss.elastic.co/u/patou)\ **Replies:** 2\ **Last updated:** [March 16, 2016, 11:23am UTC](https://discuss.elastic.co/t/ruby-filter-load-csv-file-to-add-field/44322 "2016-03-16T11:23:34Z")
hi, i need to load a csv file in a ruby filter to add fields to the document. will the csv file be loaded for each line of the input or only once ? cdt patrick --- ## [Logstash tutorial: index\_not\_found\_exception \[SOLVED\]](https://discuss.elastic.co/t/logstash-tutorial-index-not-found-exception-solved/43786)
**Author:** [@dr01](https://discuss.elastic.co/u/dr01)\ **Replies:** 3\ **Last updated:** [March 15, 2016, 10:32am UTC](https://discuss.elastic.co/t/logstash-tutorial-index-not-found-exception-solved/43786 "2016-03-15T10:32:57Z")
Hello, I am following the Logstash tutorial. This command curl -XGET '192.168.77.200:9200/logstash-2016.03.08/\_search?q=response=200' returns the following error, instead of the data shown in the tutorial: {"error"… --- ## [Troubles with elastic + logstash + rabbit](https://discuss.elastic.co/t/troubles-with-elastic-logstash-rabbit/44524)
**Author:** [@Igor\_Samusenko](https://discuss.elastic.co/u/Igor_Samusenko)\ **Replies:** 5\ **Last updated:** [March 16, 2016, 9:07am UTC](https://discuss.elastic.co/t/troubles-with-elastic-logstash-rabbit/44524 "2016-03-16T09:07:48Z")
Hi everybody, We are using elastic stack for storing logs data. We use rabbitmq as an input for logstash. For some reasons our elasticsearch cluster has been down for several times. And logstash was unable to deliver … --- ## [Load Epoch time](https://discuss.elastic.co/t/load-epoch-time/44410)
**Author:** [@chenbe2204](https://discuss.elastic.co/u/chenbe2204)\ **Replies:** 8\ **Last updated:** [March 16, 2016, 7:14am UTC](https://discuss.elastic.co/t/load-epoch-time/44410 "2016-03-16T07:14:19Z")
Hi , I'm trying to convert epoch time to human date. In my json file I tried to put the value of the field with "" and without "". I saw some answers about this in the web but in my case it doesn't work. The name of t… --- ## [Is there any method to parse json without quotations, kind of file in logstash](https://discuss.elastic.co/t/is-there-any-method-to-parse-json-without-quotations-kind-of-file-in-logstash/44392)
**Author:** [@Sai\_Birada](https://discuss.elastic.co/u/Sai_Birada)\ **Replies:** 5\ **Last updated:** [March 16, 2016, 6:43am UTC](https://discuss.elastic.co/t/is-there-any-method-to-parse-json-without-quotations-kind-of-file-in-logstash/44392 "2016-03-16T06:43:01Z")
I had a file which i want to parse with logstash, but its a json with out quotation marks. Is there any method to parse it? --- ## [Logstash own debugging logs location?](https://discuss.elastic.co/t/logstash-own-debugging-logs-location/44404)
**Author:** [@thyfere](https://discuss.elastic.co/u/thyfere)\ **Replies:** 8\ **Last updated:** [March 16, 2016, 5:24am UTC](https://discuss.elastic.co/t/logstash-own-debugging-logs-location/44404 "2016-03-16T05:24:45Z")
Hi, I am trying to debug logstash; therefore, I need it's debug logs but couldn't find any. In fact, I moved the ELK stack from one Windows box to another. Obviously, version has also changed. Before I was using logsta… --- ## [Logstash 429 errors](https://discuss.elastic.co/t/logstash-429-errors/44387)
**Author:** [@Augustin\_Chen](https://discuss.elastic.co/u/Augustin_Chen)\ **Replies:** 4\ **Last updated:** [March 16, 2016, 1:51am UTC](https://discuss.elastic.co/t/logstash-429-errors/44387 "2016-03-16T01:51:20Z")
I have logstash 2.2.2 installed in my server. I see following 429 warnings in the logstashlogs. what do these logs mean? Does it mean the retry succeeds, or the event is going to be retried? Also are there any tips to wa… --- ## [Arrays in logstash](https://discuss.elastic.co/t/arrays-in-logstash/44180)
**Author:** [@James\_Hamilton](https://discuss.elastic.co/u/James_Hamilton)\ **Replies:** 1\ **Last updated:** [March 15, 2016, 8:22pm UTC](https://discuss.elastic.co/t/arrays-in-logstash/44180 "2016-03-15T20:22:23Z")
Hi, How do I use arrays in conditionals in logstash? I want to do the following: if array\[1\] is not empty { mutate { .... } } Where array is created by using mutate split. Thanks, James --- ## [Grok date parsing trouble](https://discuss.elastic.co/t/grok-date-parsing-trouble/44385)
**Author:** [@RobertC](https://discuss.elastic.co/u/RobertC)\ **Replies:** 2\ **Last updated:** [March 15, 2016, 8:18pm UTC](https://discuss.elastic.co/t/grok-date-parsing-trouble/44385 "2016-03-15T20:18:44Z")
Hi Everyone, I'm trying to parse a tab separated access log and having some trouble with updating the @timestamp field in order to store the actual event time, using logstash 2.2. Here is a log sample: 2016-03-14 … --- ## [Logstash service stop after a while](https://discuss.elastic.co/t/logstash-service-stop-after-a-while/44338)
**Author:** [@billy6](https://discuss.elastic.co/u/billy6)\ **Replies:** 3\ **Last updated:** [March 15, 2016, 8:05pm UTC](https://discuss.elastic.co/t/logstash-service-stop-after-a-while/44338 "2016-03-15T20:05:44Z")
Hello, I have been struggling with this for 2 days. I have a logstash instance with ES input and ES output, without filtering anything. I run the logstash service and after a while (20 seconds more or less) the service… --- ## [Can I add message to array when using update action in Elasticsearch output?](https://discuss.elastic.co/t/can-i-add-message-to-array-when-using-update-action-in-elasticsearch-output/44462)
**Author:** [@Karol\_Stojek](https://discuss.elastic.co/u/Karol_Stojek)\ **Replies:** 0\ **Last updated:** [March 15, 2016, 4:48pm UTC](https://discuss.elastic.co/t/can-i-add-message-to-array-when-using-update-action-in-elasticsearch-output/44462 "2016-03-15T16:48:21Z")
Hello, I'm using Logstash 2.2.2 and Elasticsearch 2.2.0. I parse logs and put it into Elasticsearch. Log lines contain transactionId, so I wanted to use "update" action of elasticsearch output and put transactionId as … --- ## [Tcp over SSL error message](https://discuss.elastic.co/t/tcp-over-ssl-error-message/43303)
**Author:** [@CraigFoote](https://discuss.elastic.co/u/CraigFoote)\ **Replies:** 7\ **Last updated:** [March 15, 2016, 2:29pm UTC](https://discuss.elastic.co/t/tcp-over-ssl-error-message/43303 "2016-03-15T14:29:25Z")
I'm attempting to receive syslog events that are being sent over SSL/TLS. I'm using the post at https://groups.google.com/forum/#!topic/logstash-users/PcR0it4wiK0 as an example. input{ tcp{ port =\> 7007 … --- ## [Cannot match end of line with multiline codec](https://discuss.elastic.co/t/cannot-match-end-of-line-with-multiline-codec/44436)
**Author:** [@Soprano](https://discuss.elastic.co/u/Soprano)\ **Replies:** 0\ **Last updated:** [March 15, 2016, 2:10pm UTC](https://discuss.elastic.co/t/cannot-match-end-of-line-with-multiline-codec/44436 "2016-03-15T14:10:52Z")
Hi, I have been trying to get a log into logstash, but I am stuck on parsing the last part of the first line. The last bit is a sentence with an error message, the only way to match this, is to use the EOL character, w… --- ## [Logstash Multiline Codec skipping first messages](https://discuss.elastic.co/t/logstash-multiline-codec-skipping-first-messages/44339)
**Author:** [@rakesh76](https://discuss.elastic.co/u/rakesh76)\ **Replies:** 1\ **Last updated:** [March 15, 2016, 12:10pm UTC](https://discuss.elastic.co/t/logstash-multiline-codec-skipping-first-messages/44339 "2016-03-15T12:10:50Z")
Hi I am using following configuration file to process multi-line logs. It seems logstash is always skipping first message from log file and not saving in elasticsearch input { file { type =\> "logs" #path =\> \["C:… --- ## [Timestamp parsing issue](https://discuss.elastic.co/t/timestamp-parsing-issue/44420)
**Author:** [@Dhanushka1282](https://discuss.elastic.co/u/Dhanushka1282)\ **Replies:** 1\ **Last updated:** [March 15, 2016, 11:53am UTC](https://discuss.elastic.co/t/timestamp-parsing-issue/44420 "2016-03-15T11:53:16Z")
Hi All I have log file as below 07/03/2016 03:54:56 07/03/2016 03:54:57 192.168. 2. 3 209.132.182. 33 203.115.80.90 TCP 50467 80 DNAT 2423 And my filter looks like below filter { if \[ty… --- ## [Removing a part of every line on a multiple codec](https://discuss.elastic.co/t/removing-a-part-of-every-line-on-a-multiple-codec/43874)
**Author:** [@jervdv](https://discuss.elastic.co/u/jervdv)\ **Replies:** 6\ **Last updated:** [March 15, 2016, 9:52am UTC](https://discuss.elastic.co/t/removing-a-part-of-every-line-on-a-multiple-codec/43874 "2016-03-15T09:52:19Z")
Hi I'm combining a stack trace with a mutiline codec everything is going great my multiline codec combines evertyhing to one logstash event. But as you can see in the logstash event below i need to delete a part of the… --- ## [Filter working on ubuntu but not on windows; mysterious "\\r"](https://discuss.elastic.co/t/filter-working-on-ubuntu-but-not-on-windows-mysterious-r/44268)
**Author:** [@pat7](https://discuss.elastic.co/u/pat7)\ **Replies:** 4\ **Last updated:** [March 15, 2016, 9:49am UTC](https://discuss.elastic.co/t/filter-working-on-ubuntu-but-not-on-windows-mysterious-r/44268 "2016-03-15T09:49:17Z")
Hi, i have a working elastic stack linux setup for evaulation but I wanted to try out Windows 7 as server as well.. Because I have to backfill a lot of logs, I have to change the timestamp with the filter date to the rea… --- ## [Jdbc MSSql Server Connection](https://discuss.elastic.co/t/jdbc-mssql-server-connection/44324)
**Author:** [@Navarro](https://discuss.elastic.co/u/Navarro)\ **Replies:** 1\ **Last updated:** [March 14, 2016, 3:58pm UTC](https://discuss.elastic.co/t/jdbc-mssql-server-connection/44324 "2016-03-14T15:58:16Z")
Im trying to establish a connection to a MSsql Server. This is my config file: input { jdbc { jdbc\_driver\_library =\> "/etc/logstash/driver/sqljdbc\_4.0/enu/sqljdbc4.jar" jdbc\_driver\_class =\> "com.microsoft.… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1177) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1179)