# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1180 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1181 --- ## [How to install logstash-input-jdbc in windows](https://discuss.elastic.co/t/how-to-install-logstash-input-jdbc-in-windows/26149)
**Author:** [@Navneet\_Mathpal](https://discuss.elastic.co/u/Navneet_Mathpal)\ **Replies:** 12\ **Last updated:** [March 11, 2016, 2:42pm UTC](https://discuss.elastic.co/t/how-to-install-logstash-input-jdbc-in-windows/26149 "2016-03-11T14:42:40Z")
hi, I tried to use logstash-input-jdbc using followed command :plugin install logstash-input-jdbc But it is showing some error, i am using logstash logstash-1.5.2 , how to install jdbc plugin in windows machine so I… --- ## [Using ssl between filebeat client and logstash server](https://discuss.elastic.co/t/using-ssl-between-filebeat-client-and-logstash-server/44164)
**Author:** [@Dhanushka1282](https://discuss.elastic.co/u/Dhanushka1282)\ **Replies:** 0\ **Last updated:** [March 11, 2016, 2:09pm UTC](https://discuss.elastic.co/t/using-ssl-between-filebeat-client-and-logstash-server/44164 "2016-03-11T14:09:16Z")
Hi All i created the required certificate and the ssl communication between filebeat client and logstah server . Then i ran the wireshark on the logstash server to check whether that communication is encrypted bet… --- ## [How to use Python to send data to logstash](https://discuss.elastic.co/t/how-to-use-python-to-send-data-to-logstash/44118)
**Author:** [@szcountryboy](https://discuss.elastic.co/u/szcountryboy)\ **Replies:** 4\ **Last updated:** [March 11, 2016, 10:00am UTC](https://discuss.elastic.co/t/how-to-use-python-to-send-data-to-logstash/44118 "2016-03-11T10:00:04Z")
I use Python2.7 send data to the logstash above, the use of ordinary TCP port data transmission. msgDict\["@metadata"\] = { "beat":"python-test", "type":"python" } msgDict\["@timestamp"\] = time.strftime("%Y-%m-%dT%H:%… --- ## [Grok TIME](https://discuss.elastic.co/t/grok-time/43994)
**Author:** [@Prateek\_Kshtriya](https://discuss.elastic.co/u/Prateek_Kshtriya)\ **Replies:** 10\ **Last updated:** [March 11, 2016, 9:05am UTC](https://discuss.elastic.co/t/grok-time/43994 "2016-03-11T09:05:31Z")
Hi All , I am new to ELK and trying to forward a non-real time log by applying grok in config file to pick the log time .I referred few previous discussions to find that Grok could be used to parse the data & Date{} co… --- ## [Parse email message in Logstash](https://discuss.elastic.co/t/parse-email-message-in-logstash/44036)
**Author:** [@petar.kozic](https://discuss.elastic.co/u/petar.kozic)\ **Replies:** 4\ **Last updated:** [March 11, 2016, 8:31am UTC](https://discuss.elastic.co/t/parse-email-message-in-logstash/44036 "2016-03-11T08:31:59Z")
Hi, I use imap-plugin in Logstash. How can I parse email message. I receive log from server with long message. I need one sentense of them not whole message. Thank you. --- ## [Variable in gsub](https://discuss.elastic.co/t/variable-in-gsub/44051)
**Author:** [@deepmind](https://discuss.elastic.co/u/deepmind)\ **Replies:** 2\ **Last updated:** [March 11, 2016, 7:50am UTC](https://discuss.elastic.co/t/variable-in-gsub/44051 "2016-03-11T07:50:03Z")
Hi, Multiline concat my device logs but does not remove unusefull informations. exemple: \<134\>Mar 03 11:39:57 SHK-NSW-CORE CLI(67) Data: USERCMD: \ \<10.1.16.1\> \[no ip interface lololol\] \ **Author:** [@MRamakri](https://discuss.elastic.co/u/MRamakri)\ **Replies:** 2\ **Last updated:** [March 10, 2016, 11:41pm UTC](https://discuss.elastic.co/t/how-do-i-create-raw-fields-for-all-string-fields-by-default/43701 "2016-03-10T23:41:04Z") I'm new to elasticsearch, and when I create an index with a CSV filter, I see that all the string fields have been created as analyzed strings. I read in some websites that logstash creates .raw fields for all string fie… --- ## [Logstash 2.2.2 mutuate](https://discuss.elastic.co/t/logstash-2-2-2-mutuate/44060)
**Author:** [@genesis](https://discuss.elastic.co/u/genesis)\ **Replies:** 4\ **Last updated:** [March 10, 2016, 11:02pm UTC](https://discuss.elastic.co/t/logstash-2-2-2-mutuate/44060 "2016-03-10T23:02:49Z")
I am running logstash 2.2.2 and I am trying to rename these 2 fields from my data and it does not take effect on the index. Please help Rename "Fashion&Beauty" to Fashion\_and\_Beauty "Business/Finance" to Business\_and\_F… --- ## [Logstash Input HTTP Plugin](https://discuss.elastic.co/t/logstash-input-http-plugin/42420)
**Author:** [@njbhatt18](https://discuss.elastic.co/u/njbhatt18)\ **Replies:** 9\ **Last updated:** [March 10, 2016, 6:44pm UTC](https://discuss.elastic.co/t/logstash-input-http-plugin/42420 "2016-03-10T18:44:39Z")
I am using logstash input plugin and capture all data post on specific port number. I would like to create custom field and during post method I want to capture data on custom field or variable. Can anyone help me for th… --- ## [Divide your logstash config into multiple files](https://discuss.elastic.co/t/divide-your-logstash-config-into-multiple-files/44023)
**Author:** [@jervdv](https://discuss.elastic.co/u/jervdv)\ **Replies:** 1\ **Last updated:** [March 10, 2016, 6:33pm UTC](https://discuss.elastic.co/t/divide-your-logstash-config-into-multiple-files/44023 "2016-03-10T18:33:42Z")
Hi How can i divide my logstash config into multiple files? Like for example i want the input part in one file, the filter in another and the output in another. Kind Regards --- ## [Syslog Input](https://discuss.elastic.co/t/syslog-input/44048)
**Author:** [@Jackal9301](https://discuss.elastic.co/u/Jackal9301)\ **Replies:** 1\ **Last updated:** [March 10, 2016, 6:16pm UTC](https://discuss.elastic.co/t/syslog-input/44048 "2016-03-10T18:16:39Z")
What is the best way to differentiate between devices all sending to syslog? for example if I have an ASA a Switch and a Router all sending syslog to logstash how can I tell them apart? --- ## [On the fly Changes in Logstash config file](https://discuss.elastic.co/t/on-the-fly-changes-in-logstash-config-file/43970)
**Author:** [@gaurav1424](https://discuss.elastic.co/u/gaurav1424)\ **Replies:** 2\ **Last updated:** [March 10, 2016, 3:36pm UTC](https://discuss.elastic.co/t/on-the-fly-changes-in-logstash-config-file/43970 "2016-03-10T15:36:59Z")
Hello All, I am aware of that logstash 2.2 introduces new pipeline architecture and auto reload option. I have following question : Static modification in Logstash conf file : I am using environment filter to add… --- ## [Workers option logstash input](https://discuss.elastic.co/t/workers-option-logstash-input/43358)
**Author:** [@Python\_Coder](https://discuss.elastic.co/u/Python_Coder)\ **Replies:** 8\ **Last updated:** [March 10, 2016, 2:26pm UTC](https://discuss.elastic.co/t/workers-option-logstash-input/43358 "2016-03-10T14:26:46Z")
Does the option "workers" works with redis input???? input { redis { host =\> "172.16.122.120" data\_type =\> "list" type =\> "redis-input" key =\> "lo… --- ## [Convert ip-address of long type to the Dotted decimal notation](https://discuss.elastic.co/t/convert-ip-address-of-long-type-to-the-dotted-decimal-notation/43972)
**Author:** [@lizhenmxcz](https://discuss.elastic.co/u/lizhenmxcz)\ **Replies:** 4\ **Last updated:** [March 10, 2016, 1:58pm UTC](https://discuss.elastic.co/t/convert-ip-address-of-long-type-to-the-dotted-decimal-notation/43972 "2016-03-10T13:58:43Z")
hi, I want use logstash to write the log that contains the ip of long type to the elasticsearch. how can i convert the long type ip to the Dotted decimal notation in the logstash --- ## [Input-redis parameters versus pipeline parameters](https://discuss.elastic.co/t/input-redis-parameters-versus-pipeline-parameters/43948)
**Author:** [@Bruno\_Lavoie](https://discuss.elastic.co/u/Bruno_Lavoie)\ **Replies:** 0\ **Last updated:** [March 9, 2016, 9:07pm UTC](https://discuss.elastic.co/t/input-redis-parameters-versus-pipeline-parameters/43948 "2016-03-09T21:07:19Z")
Hello, As of 2.2, pipeline architecture has changed. From the docs: Each input {} statement in the Logstash configuration file runs in its own thread. Inputs write events to a common Java SynchronousQueue. This queue… --- ## [Solution for multiple patterns for multiline configuration](https://discuss.elastic.co/t/solution-for-multiple-patterns-for-multiline-configuration/43807)
**Author:** [@Marine](https://discuss.elastic.co/u/Marine)\ **Replies:** 2\ **Last updated:** [March 10, 2016, 12:47pm UTC](https://discuss.elastic.co/t/solution-for-multiple-patterns-for-multiline-configuration/43807 "2016-03-10T12:47:51Z")
In the multiline documentation the setting "pattern" is a string and it's not possible to put an array of patterns, but I have a really hard logfile to parse and I need to do something similar. I have two type of logs … --- ## [Json array parsing](https://discuss.elastic.co/t/json-array-parsing/44030)
**Author:** [@GregorEyzenhosrn](https://discuss.elastic.co/u/GregorEyzenhosrn)\ **Replies:** 0\ **Last updated:** [March 10, 2016, 12:41pm UTC](https://discuss.elastic.co/t/json-array-parsing/44030 "2016-03-10T12:41:15Z")
Hello! I need help in parsing some json array logs. I have logs like \[{ "actionId": "bf727a6a-9d8a-4a35-852b-7bfb9d69dc60", "actionName": "Report build started", "timestamp": "10.03.2016 00:17:57.426", "data": … --- ## [Logstash-2.2.2 Related Error](https://discuss.elastic.co/t/logstash-2-2-2-related-error/43788)
**Author:** [@Shrawan\_Bhagwat](https://discuss.elastic.co/u/Shrawan_Bhagwat)\ **Replies:** 5\ **Last updated:** [March 10, 2016, 12:38pm UTC](https://discuss.elastic.co/t/logstash-2-2-2-related-error/43788 "2016-03-10T12:38:16Z")
Hi All, I am getting below mentioned error while running logstash-2.2.2. :message=\>"Connection refused", :class=\>"Manticore::SocketException", :level=\>:error I have tried the solutions that were previously discusse… --- ## [The best input option for Logstash](https://discuss.elastic.co/t/the-best-input-option-for-logstash/32774)
**Author:** [@y3g0r](https://discuss.elastic.co/u/y3g0r)\ **Replies:** 10\ **Last updated:** [March 10, 2016, 8:18am UTC](https://discuss.elastic.co/t/the-best-input-option-for-logstash/32774 "2016-03-10T08:18:32Z")
Hi there, Our team is working on creating some instant messaging applications. We would like to gather logs from our applications with logstash. As we are developing, we can use whatever technique to produce/store lo… --- ## [How to add a space or comma(,) between two concatenating fields using mutate?](https://discuss.elastic.co/t/how-to-add-a-space-or-comma-between-two-concatenating-fields-using-mutate/43945)
**Author:** [@vikas\_gopal](https://discuss.elastic.co/u/vikas_gopal)\ **Replies:** 2\ **Last updated:** [March 10, 2016, 7:55am UTC](https://discuss.elastic.co/t/how-to-add-a-space-or-comma-between-two-concatenating-fields-using-mutate/43945 "2016-03-10T07:55:17Z")
Hi Experts , Please help me to achieve as follow .I want something like Fullname= vikas , gopal With below mutate output is like vikasgopal. So I want to add , in-between first an last mutate {add\_field =\> {"Fullna… --- ## [Making a part in the grok expression optional](https://discuss.elastic.co/t/making-a-part-in-the-grok-expression-optional/43961)
**Author:** [@sankallada](https://discuss.elastic.co/u/sankallada)\ **Replies:** 1\ **Last updated:** [March 10, 2016, 7:10am UTC](https://discuss.elastic.co/t/making-a-part-in-the-grok-expression-optional/43961 "2016-03-10T07:10:14Z")
Hi all, Each line in my log file does not contain a source IP adderss so the "message" =\> "%{TIMESTAMP\_ISO8601:timestamp}\\s+%{LOGLEVEL:loglevel}\\s+%{THREAD:thread}\\s+(?:%{IP:ip})" so it returns a "no mach" - fro… --- ## [Elasticsearch logstash output plugin production configuration](https://discuss.elastic.co/t/elasticsearch-logstash-output-plugin-production-configuration/43969)
**Author:** [@gaurav1424](https://discuss.elastic.co/u/gaurav1424)\ **Replies:** 1\ **Last updated:** [March 10, 2016, 7:04am UTC](https://discuss.elastic.co/t/elasticsearch-logstash-output-plugin-production-configuration/43969 "2016-03-10T07:04:12Z")
Hello All, I have prototype working for me with Devices sending syslogs and then logstash parsing it and putting into elasticsearch. In my logstash config file I have this : elasticsearch { hosts =\> \["hostIP… --- ## [Logstash not writing to elasticsearch if split filter is used](https://discuss.elastic.co/t/logstash-not-writing-to-elasticsearch-if-split-filter-is-used/43693)
**Author:** [@Muaaz\_Saleem](https://discuss.elastic.co/u/Muaaz_Saleem)\ **Replies:** 3\ **Last updated:** [March 10, 2016, 5:11am UTC](https://discuss.elastic.co/t/logstash-not-writing-to-elasticsearch-if-split-filter-is-used/43693 "2016-03-10T05:11:16Z")
Hi Guys, I'm trying to use the split filter. But Logstash doesn't write to elasticsearch if I do so. However, if I comment out the split filter it works like a charm. Would really appreciate the help, following is my c… --- ## [Grok with conditional patterns and adding a tag](https://discuss.elastic.co/t/grok-with-conditional-patterns-and-adding-a-tag/43844)
**Author:** [@pzero](https://discuss.elastic.co/u/pzero)\ **Replies:** 2\ **Last updated:** [March 9, 2016, 11:47pm UTC](https://discuss.elastic.co/t/grok-with-conditional-patterns-and-adding-a-tag/43844 "2016-03-09T23:47:45Z")
Hello, I'm trying to filter logs from auth.log on a linux server. I want to tag with "ssh\_successful\_login", "ssh\_failed\_login", "ssh\_brute\_force". Mar 3 16:56:22 test sshd\[8510\]: Failed password for user1 from 192… --- ## [GROK multiple MATCH filters](https://discuss.elastic.co/t/grok-multiple-match-filters/27940)
**Author:** [@Sunny\_Advani](https://discuss.elastic.co/u/Sunny_Advani)\ **Replies:** 2\ **Last updated:** [August 24, 2015, 1:33pm UTC](https://discuss.elastic.co/t/grok-multiple-match-filters/27940 "2015-08-24T13:33:39Z")
Apologies if this has been asked repetitively, however I have a hard time understanding multiple MATCH filters using GROK. Here is my config: filter { grok { break\_on\_match =\> false keep\_empty\_captures =\> true … --- ## [Input plugin JDBC error](https://discuss.elastic.co/t/input-plugin-jdbc-error/43958)
**Author:** [@tarik\_setia](https://discuss.elastic.co/u/tarik_setia)\ **Replies:** 0\ **Last updated:** [March 9, 2016, 10:57pm UTC](https://discuss.elastic.co/t/input-plugin-jdbc-error/43958 "2016-03-09T22:57:04Z")
I trying to log SQL server data using logstash but getting following error: PS D:\\elk\\logstash\\bin\> .\\logstash -f simple.conf io/console not supported; tty will not be manipulated Settings: Default pipeline workers: 4 L… --- ## [Grok filter help](https://discuss.elastic.co/t/grok-filter-help/43847)
**Author:** [@stecino](https://discuss.elastic.co/u/stecino)\ **Replies:** 4\ **Last updated:** [March 9, 2016, 10:15pm UTC](https://discuss.elastic.co/t/grok-filter-help/43847 "2016-03-09T22:15:28Z")
I am seeing this error in my logstash log at \[Source: \[B@1717bb35; line: 1, column: 2\]\>, :level=\>:warn} {:timestamp=\>"2016-03-09T02:07:34.248000+0000", :message=\>"Error parsing json", :source=\>"message", :raw=\>"\<182\>Ma… --- ## [Planning capacity and ELK using filebeat/logstash or logstash/redis?](https://discuss.elastic.co/t/planning-capacity-and-elk-using-filebeat-logstash-or-logstash-redis/43894)
**Author:** [@Willie\_Cadete](https://discuss.elastic.co/u/Willie_Cadete)\ **Replies:** 1\ **Last updated:** [March 9, 2016, 8:42pm UTC](https://discuss.elastic.co/t/planning-capacity-and-elk-using-filebeat-logstash-or-logstash-redis/43894 "2016-03-09T20:42:13Z")
Hello everyone! It's my first time here, Reading logstash book I bought, it recommends using redis as a broker and several other sources recommend the same scenario in a production environment. Searching I saw tha… --- ## [Extracting fields and then indexing JSON in a log](https://discuss.elastic.co/t/extracting-fields-and-then-indexing-json-in-a-log/43936)
**Author:** [@poc](https://discuss.elastic.co/u/poc)\ **Replies:** 1\ **Last updated:** [March 9, 2016, 8:26pm UTC](https://discuss.elastic.co/t/extracting-fields-and-then-indexing-json-in-a-log/43936 "2016-03-09T20:26:42Z")
Hi there, I am trying to get a proof of concept up and running with ELK to see if it could be a replacement for our Splunk installation. There is a particular log line in our tomcat application that gets logged for each… --- ## [How to ingest logstash logs ...so we can see them from elasticsearch](https://discuss.elastic.co/t/how-to-ingest-logstash-logs-so-we-can-see-them-from-elasticsearch/43939)
**Author:** [@naga1](https://discuss.elastic.co/u/naga1)\ **Replies:** 1\ **Last updated:** [March 9, 2016, 8:24pm UTC](https://discuss.elastic.co/t/how-to-ingest-logstash-logs-so-we-can-see-them-from-elasticsearch/43939 "2016-03-09T20:24:16Z")
Hi, Is there a way to ingest Logstash logs into elasticsearch, as I am noticing the logstash logs are useful, is there a way to ingest these logs instead of installing filebeats on this machine and loopback to itself. … [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1179) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1181)