# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1182 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1183 --- ## [Insufficient memory - OpenJDK 64-Bit Server VM warning](https://discuss.elastic.co/t/insufficient-memory-openjdk-64-bit-server-vm-warning/43567)
**Author:** [@gabe](https://discuss.elastic.co/u/gabe)\ **Replies:** 4\ **Last updated:** [March 7, 2016, 7:09pm UTC](https://discuss.elastic.co/t/insufficient-memory-openjdk-64-bit-server-vm-warning/43567 "2016-03-07T19:09:32Z")
Topbeat Logstash Elasticsearch seem to be working okay. Started the configuration of Logstash syslog (rsyslog) input using the example file: https://www.elastic.co/guide/en/logstash/current/config-examples.html#\_proces… --- ## [Combining application/aop log and tomcat log](https://discuss.elastic.co/t/combining-application-aop-log-and-tomcat-log/43689)
**Author:** [@rbkumar88](https://discuss.elastic.co/u/rbkumar88)\ **Replies:** 1\ **Last updated:** [March 7, 2016, 6:58pm UTC](https://discuss.elastic.co/t/combining-application-aop-log-and-tomcat-log/43689 "2016-03-07T18:58:30Z")
Hi, I have a requirement to capture a single record/document in ES for each SSO hits we receive. I have a separate aop logging file (with user information/fields/timestamp) and also a separate tomcat log file (parseabl… --- ## [Nil Class error crashing pipeline](https://discuss.elastic.co/t/nil-class-error-crashing-pipeline/43684)
**Author:** [@bwgriffith](https://discuss.elastic.co/u/bwgriffith)\ **Replies:** 1\ **Last updated:** [March 7, 2016, 6:21pm UTC](https://discuss.elastic.co/t/nil-class-error-crashing-pipeline/43684 "2016-03-07T18:21:30Z")
I started getting this error today with some new code I put into logstash. I'm having trouble tracking it down. Would appreciate any help on where to start. The error: NoMethodError: undefined method \`strip' for nil… --- ## [Logstash with long GC](https://discuss.elastic.co/t/logstash-with-long-gc/42159)
**Author:** [@Jeferson\_Martins](https://discuss.elastic.co/u/Jeferson_Martins)\ **Replies:** 2\ **Last updated:** [March 7, 2016, 5:00pm UTC](https://discuss.elastic.co/t/logstash-with-long-gc/42159 "2016-03-07T17:00:54Z")
Hi, I still using Logstash 1.4.2 and in the last week begin a Long GC problem. I dont have any filters in this logstash(s) and I use only to ship logs to redis. There's some thing can create this problem in Logstas… --- ## [How to send email](https://discuss.elastic.co/t/how-to-send-email/43633)
**Author:** [@szcountryboy](https://discuss.elastic.co/u/szcountryboy)\ **Replies:** 2\ **Last updated:** [March 7, 2016, 3:27pm UTC](https://discuss.elastic.co/t/how-to-send-email/43633 "2016-03-07T15:27:45Z")
I used logstash 2.2 version,Use the following configuration output { if \[beat\_ip\] != "%{tags\[1\]}" { elasticsearch { hosts =\> \["localhost:9200"\] index =\> "logstash-%{type}-%{+YYYY.MM.dd}" doc… --- ## ["certificate signed by unknown authority" error in logstash-forwarder](https://discuss.elastic.co/t/certificate-signed-by-unknown-authority-error-in-logstash-forwarder/43656)
**Author:** [@111112](https://discuss.elastic.co/u/111112)\ **Replies:** 0\ **Last updated:** [March 7, 2016, 1:17pm UTC](https://discuss.elastic.co/t/certificate-signed-by-unknown-authority-error-in-logstash-forwarder/43656 "2016-03-07T13:17:26Z")
Hi All, I hope someone can help me with this because I am really out of my wits. We have a working ELK server and a logstash forwarder that is sending logs to it, and they work perfectly fine. I am now installing a n… --- ## [Logstash.err log file starts with zero bytes](https://discuss.elastic.co/t/logstash-err-log-file-starts-with-zero-bytes/43635)
**Author:** [@mguiwin](https://discuss.elastic.co/u/mguiwin)\ **Replies:** 0\ **Last updated:** [March 7, 2016, 9:47am UTC](https://discuss.elastic.co/t/logstash-err-log-file-starts-with-zero-bytes/43635 "2016-03-07T09:47:15Z")
Hello, This is possibly a bug: I discovered that logstash.err log file starts with an array of zero bytes, which makes it hard (but not impossible) to read by text viewers. I use LogStash 2.2.2. \> file logstash.err l… --- ## [How to close the Loading of data by logstash programmatically](https://discuss.elastic.co/t/how-to-close-the-loading-of-data-by-logstash-programmatically/43522)
**Author:** [@Rajeev\_Gaurav](https://discuss.elastic.co/u/Rajeev_Gaurav)\ **Replies:** 4\ **Last updated:** [March 7, 2016, 5:07am UTC](https://discuss.elastic.co/t/how-to-close-the-loading-of-data-by-logstash-programmatically/43522 "2016-03-07T05:07:35Z")
Hi, I am loading the data in ES using Logstash pro grammatically by starting the process cmd.exe.But I am not able to close this loading of data . can you help me that How can i shutdown logsatsh programmatically. --- ## [Extracting multiple schema and multiple tables data to Elasticsearch](https://discuss.elastic.co/t/extracting-multiple-schema-and-multiple-tables-data-to-elasticsearch/43543)
**Author:** [@prashanthrd](https://discuss.elastic.co/u/prashanthrd)\ **Replies:** 3\ **Last updated:** [March 6, 2016, 7:57am UTC](https://discuss.elastic.co/t/extracting-multiple-schema-and-multiple-tables-data-to-elasticsearch/43543 "2016-03-06T07:57:51Z")
Continuing the discussion from 1) How to integrate Elasticsearch-Hadoop with MySQL DB at the backend and User interface developed in dhtmlx, Spring. 2) Also how to integrate Elasticsearch-Hadoop with Services written in … --- ## [Logstash 2.2.2 Not reading file input](https://discuss.elastic.co/t/logstash-2-2-2-not-reading-file-input/43353)
**Author:** [@mr\_pkd](https://discuss.elastic.co/u/mr_pkd)\ **Replies:** 4\ **Last updated:** [March 6, 2016, 7:42am UTC](https://discuss.elastic.co/t/logstash-2-2-2-not-reading-file-input/43353 "2016-03-06T07:42:29Z")
New to logstash. I am trying to read a simple input and output it to command window. Logstash version: 2.2.2 Below is my .conf file input { file { path =\> "/home/pdutt/CollPoll/Data/logstash-test-data.… --- ## [CSV Timstamp issues](https://discuss.elastic.co/t/csv-timstamp-issues/43050)
**Author:** [@hursto75](https://discuss.elastic.co/u/hursto75)\ **Replies:** 19\ **Last updated:** [March 6, 2016, 6:55am UTC](https://discuss.elastic.co/t/csv-timstamp-issues/43050 "2016-03-06T06:55:14Z")
Here is my conf file, and it seems to be working ok, except I need the timestamp to be the actually time in the csv file. Not the time the file was added. What am i doing wrong.... total Noob here. Sorry. input { … --- ## [Logstash + elasticsearch + shield](https://discuss.elastic.co/t/logstash-elasticsearch-shield/43581)
**Author:** [@zozo6015](https://discuss.elastic.co/u/zozo6015)\ **Replies:** 2\ **Last updated:** [March 5, 2016, 10:17pm UTC](https://discuss.elastic.co/t/logstash-elasticsearch-shield/43581 "2016-03-05T22:17:23Z")
Hello, I am having an elasticsearch 2.0 with shield which would require authentication to submit the logs to elasticsearch. I hav configured logstash output for elasticsearch with username and password but I am still … --- ## [Logstash kafka input to elasticsearch output stops consuming](https://discuss.elastic.co/t/logstash-kafka-input-to-elasticsearch-output-stops-consuming/42880)
**Author:** [@zot42](https://discuss.elastic.co/u/zot42)\ **Replies:** 9\ **Last updated:** [March 5, 2016, 4:53pm UTC](https://discuss.elastic.co/t/logstash-kafka-input-to-elasticsearch-output-stops-consuming/42880 "2016-03-05T16:53:54Z")
Logstash 2.2 elasticsearch 1.7.4 I am seeing and issue where I am consuming from kafka and sending to elasticsearch. It consumes about 500 messages at start and then stops with this messages being output to logs {:t… --- ## [Getting errors in logstash log "Lumberjack input pipeline is blocked"](https://discuss.elastic.co/t/getting-errors-in-logstash-log-lumberjack-input-pipeline-is-blocked/42487)
**Author:** [@shan](https://discuss.elastic.co/u/shan)\ **Replies:** 22\ **Last updated:** [March 5, 2016, 1:30pm UTC](https://discuss.elastic.co/t/getting-errors-in-logstash-log-lumberjack-input-pipeline-is-blocked/42487 "2016-03-05T13:30:03Z")
Hi, I'm getting the below error in my logstash logs message=\>"Lumberjack input: the pipeline is blocked, temporary refusing new connection.", :level=\>:warn} message=\>"CircuitBreaker::rescuing exceptions", :name=\>"Lum… --- ## [Can File Output Drop Messages?](https://discuss.elastic.co/t/can-file-output-drop-messages/43556)
**Author:** [@wstrater](https://discuss.elastic.co/u/wstrater)\ **Replies:** 0\ **Last updated:** [March 4, 2016, 9:23pm UTC](https://discuss.elastic.co/t/can-file-output-drop-messages/43556 "2016-03-04T21:23:54Z")
I am trying to work with beats, logstash, elasticsearch and kafka and it appears that logstash file output could be dropping messages. I started with a simple filebeat to logstash to work on my filtering. The logstash … --- ## [Data enrichment Huge CPU consumption](https://discuss.elastic.co/t/data-enrichment-huge-cpu-consumption/43453)
**Author:** [@sharon.c](https://discuss.elastic.co/u/sharon.c)\ **Replies:** 5\ **Last updated:** [March 4, 2016, 5:58pm UTC](https://discuss.elastic.co/t/data-enrichment-huge-cpu-consumption/43453 "2016-03-04T17:58:06Z")
I am trying to use logstash translate plugin to enrich data before putting to elasticsearch. There are 4 tables I used to join, which I already exported as yml file. The yml files are in the following format: id: file… --- ## [:message=\>"Failed to send event to Redis"](https://discuss.elastic.co/t/message-failed-to-send-event-to-redis/41850)
**Author:** [@Shrawan\_Bhagwat](https://discuss.elastic.co/u/Shrawan_Bhagwat)\ **Replies:** 3\ **Last updated:** [March 4, 2016, 5:23pm UTC](https://discuss.elastic.co/t/message-failed-to-send-event-to-redis/41850 "2016-03-04T17:23:21Z")
Hi All, We are getting this error message in logstash logs: {:timestamp=\>"2016-02-16T13:31:05.697000+0530", :message=\>"Failed to send event to Redis", :event=\>#@accessors=#@store={"message"=\>"dhdieiidjpie", "@version"… --- ## [Fingerprint filter and concatenate\_sources](https://discuss.elastic.co/t/fingerprint-filter-and-concatenate-sources/43498)
**Author:** [@peppetrick](https://discuss.elastic.co/u/peppetrick)\ **Replies:** 3\ **Last updated:** [March 4, 2016, 2:00pm UTC](https://discuss.elastic.co/t/fingerprint-filter-and-concatenate-sources/43498 "2016-03-04T14:00:20Z")
Hi I have a doubt about documentation for fingerprint filter. regarding concatenate\_sources Documentation states "When set to true, we concatenate the values of all fields into 1 string like the old checksum fi… --- ## [Kafka Input Plugin issue](https://discuss.elastic.co/t/kafka-input-plugin-issue/43394)
**Author:** [@astro](https://discuss.elastic.co/u/astro)\ **Replies:** 3\ **Last updated:** [March 4, 2016, 12:55pm UTC](https://discuss.elastic.co/t/kafka-input-plugin-issue/43394 "2016-03-04T12:55:55Z")
Hi All, I came across a scenario where I am producing logs through php applictaion directly in kafka and using logstash to index logs in elasticsearch . To test my feature whether I stopped one of the broker and I saw … --- ## [Logstash: ^CSIGINT received. Shutting down the pipeline. {:level=\>:warn}](https://discuss.elastic.co/t/logstash-csigint-received-shutting-down-the-pipeline-level-warn/43497)
**Author:** [@Shobhlika](https://discuss.elastic.co/u/Shobhlika)\ **Replies:** 3\ **Last updated:** [March 4, 2016, 12:06pm UTC](https://discuss.elastic.co/t/logstash-csigint-received-shutting-down-the-pipeline-level-warn/43497 "2016-03-04T12:06:20Z")
./logstash -f weblogic-config You are using a deprecated config setting "pattern" set in grok. Deprecated sett ings will continue to work, but are scheduled for removal from logstash in the f uture. You should use this … --- ## [Logstash sync from Oracle to MongoDB (updating records)](https://discuss.elastic.co/t/logstash-sync-from-oracle-to-mongodb-updating-records/43492)
**Author:** [@srinivas](https://discuss.elastic.co/u/srinivas)\ **Replies:** 0\ **Last updated:** [March 4, 2016, 9:33am UTC](https://discuss.elastic.co/t/logstash-sync-from-oracle-to-mongodb-updating-records/43492 "2016-03-04T09:33:33Z")
We are using an pipeline file to sync data from oracle to mongo to perfom an update operation. When logstash is pushing data to mongo we want logstash to do an db.collection.save() instead of db.collection.insert() as t… --- ## [Multiline log](https://discuss.elastic.co/t/multiline-log/43075)
**Author:** [@pecwich](https://discuss.elastic.co/u/pecwich)\ **Replies:** 5\ **Last updated:** [March 4, 2016, 9:11am UTC](https://discuss.elastic.co/t/multiline-log/43075 "2016-03-04T09:11:57Z")
In a multiline log, can parsing or indexing of fields occur only in the first line? I want to parse fields present in the second or third line for example, what should I do? --- ## [Unable to build Logstash 2.2.0 on ARM 64](https://discuss.elastic.co/t/unable-to-build-logstash-2-2-0-on-arm-64/42651)
**Author:** [@nbhoyar](https://discuss.elastic.co/u/nbhoyar)\ **Replies:** 2\ **Last updated:** [March 3, 2016, 11:25pm UTC](https://discuss.elastic.co/t/unable-to-build-logstash-2-2-0-on-arm-64/42651 "2016-03-03T23:25:49Z")
I tried running Logstash 2.2.0 on ARM architecture (aarch64) system (w/ Fedora 22) but I am getting the following error: \[root@arm-01 logstash-2.2.0\]# bin/logstash agent -f logstash\_json.conf io/console not supported;… --- ## [Using multiple template inside the logstash'selasticsearch output plugin](https://discuss.elastic.co/t/using-multiple-template-inside-the-logstashselasticsearch-output-plugin/43317)
**Author:** [@faitlezen](https://discuss.elastic.co/u/faitlezen)\ **Replies:** 3\ **Last updated:** [March 3, 2016, 11:04pm UTC](https://discuss.elastic.co/t/using-multiple-template-inside-the-logstashselasticsearch-output-plugin/43317 "2016-03-03T23:04:26Z")
Hi, I'm trying to use the template option of the ES output plugin but I'm parsing 2 types of logs... traditional logs and another type called aws\_billing\_hourly. I tried to put them together in the json template but log… --- ## [Get the not matching field name when \_grokparsefailure happens](https://discuss.elastic.co/t/get-the-not-matching-field-name-when--grokparsefailure-happens/43440)
**Author:** [@sharon.c](https://discuss.elastic.co/u/sharon.c)\ **Replies:** 1\ **Last updated:** [March 3, 2016, 9:25pm UTC](https://discuss.elastic.co/t/get-the-not-matching-field-name-when--grokparsefailure-happens/43440 "2016-03-03T21:25:49Z")
When grok parse multiple fields, can I get the actual field name which does not parse and trigger \_grokparsefailure --- ## [Files are not processed with file input unless I edit them](https://discuss.elastic.co/t/files-are-not-processed-with-file-input-unless-i-edit-them/43276)
**Author:** [@syunusic](https://discuss.elastic.co/u/syunusic)\ **Replies:** 5\ **Last updated:** [March 3, 2016, 7:58pm UTC](https://discuss.elastic.co/t/files-are-not-processed-with-file-input-unless-i-edit-them/43276 "2016-03-03T19:58:41Z")
With the file input, I understand that sincedb traces if that file has been processed or not. If I have a new file, that never has being processed by logstash (so is not in sincedb). My input config is like this: inpu… --- ## [Logstash 2.2.x kafka output large increase in broker tcp connections](https://discuss.elastic.co/t/logstash-2-2-x-kafka-output-large-increase-in-broker-tcp-connections/43270)
**Author:** [@toma](https://discuss.elastic.co/u/toma)\ **Replies:** 1\ **Last updated:** [March 3, 2016, 5:38pm UTC](https://discuss.elastic.co/t/logstash-2-2-x-kafka-output-large-increase-in-broker-tcp-connections/43270 "2016-03-03T17:38:51Z")
Upgrading from logstash 2.1.1 to 2.2.2 and seeing a rough 10x increase in established tcp connections to brokers. Running in a large environment this is a problem. We want to use ls 2.2.x to take advantage of the better … --- ## [One log object is divided unexpectedly in LogStash](https://discuss.elastic.co/t/one-log-object-is-divided-unexpectedly-in-logstash/43422)
**Author:** [@bilguuna](https://discuss.elastic.co/u/bilguuna)\ **Replies:** 0\ **Last updated:** [March 3, 2016, 5:10pm UTC](https://discuss.elastic.co/t/one-log-object-is-divided-unexpectedly-in-logstash/43422 "2016-03-03T17:10:14Z")
Hi, I have JSON log that is created by Log4j2 and was read by LogStash. But sometimes, when log object has long inner trace, it is divided and appears as separated logs on my kibana. Here is my config: input { file { … --- ## [Daily index name and @timestamp value discrepancies](https://discuss.elastic.co/t/daily-index-name-and-timestamp-value-discrepancies/43319)
**Author:** [@Bruno\_Lavoie](https://discuss.elastic.co/u/Bruno_Lavoie)\ **Replies:** 3\ **Last updated:** [March 3, 2016, 3:00pm UTC](https://discuss.elastic.co/t/daily-index-name-and-timestamp-value-discrepancies/43319 "2016-03-03T15:00:59Z")
Hello, As many here, we use logstash to fill in data in ES and the output is a daily index with this format: index-name-%{+YYYY.MM.dd} Yesterday (2016.03.01) , I saw a few a hours before midnight the next day index … --- ## [Failed date from field](https://discuss.elastic.co/t/failed-date-from-field/43294)
**Author:** [@hursto75](https://discuss.elastic.co/u/hursto75)\ **Replies:** 12\ **Last updated:** [March 3, 2016, 2:49pm UTC](https://discuss.elastic.co/t/failed-date-from-field/43294 "2016-03-03T14:49:23Z")
I have the conf file reading data but still getting exceptions to my CSV Timestamp issues. Is this the proper ISO8601 format? 2016-02-21T04:15:04.290 Failed parsing date from field {:field=\>"mydatetime", :value=\>"2016-0… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1181) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1183)