# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1184 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1185 --- ## [Initiating Logstash through process .start](https://discuss.elastic.co/t/initiating-logstash-through-process-start/43199)
**Author:** [@krushnat\_khawale](https://discuss.elastic.co/u/krushnat_khawale)\ **Replies:** 2\ **Last updated:** [March 2, 2016, 7:29am UTC](https://discuss.elastic.co/t/initiating-logstash-through-process-start/43199 "2016-03-02T07:29:46Z")
Dear Team, I have a java program which initiates logstash for each user(10 users) different conf files. will it create different instance or queue up in the same instance. Regards, KK --- ## [Date Parser error](https://discuss.elastic.co/t/date-parser-error/43051)
**Author:** [@eso](https://discuss.elastic.co/u/eso)\ **Replies:** 3\ **Last updated:** [March 2, 2016, 6:59am UTC](https://discuss.elastic.co/t/date-parser-error/43051 "2016-03-02T06:59:24Z")
I am using Winlogbeat to ship Windows Event Logs to LogStash. According to "codec=\>rubydebug", the JSON output contains a field named "@timestamp". So, I used Date Filter to parse it and got an error: JSON Display … --- ## [Email plugin - logstas output](https://discuss.elastic.co/t/email-plugin-logstas-output/43116)
**Author:** [@cooldharma06](https://discuss.elastic.co/u/cooldharma06)\ **Replies:** 2\ **Last updated:** [March 2, 2016, 6:23am UTC](https://discuss.elastic.co/t/email-plugin-logstas-output/43116 "2016-03-02T06:23:01Z")
hi all, i am using elasticsearch + logstash + kibana ( all are updated version). i enabled the email plugin in output section but i am facing following error: output { elasticsearch { hosts =\> \["localhost:9200"… --- ## [Experiencing java.lang.NoSuchMethodError for logstash version higher than 1.4.2](https://discuss.elastic.co/t/experiencing-java-lang-nosuchmethoderror-for-logstash-version-higher-than-1-4-2/43077)
**Author:** [@droidnxs](https://discuss.elastic.co/u/droidnxs)\ **Replies:** 2\ **Last updated:** [March 2, 2016, 6:27am UTC](https://discuss.elastic.co/t/experiencing-java-lang-nosuchmethoderror-for-logstash-version-higher-than-1-4-2/43077 "2016-03-02T06:27:14Z")
Referencing this issue: enter link description here Tried upgrading to releases 1.5 and up and keep getting this exception even though my config file seems to be correct: io/console not supported; tty will not be manip… --- ## [Input files with dynamic filename](https://discuss.elastic.co/t/input-files-with-dynamic-filename/42695)
**Author:** [@sunilmchaudhari](https://discuss.elastic.co/u/sunilmchaudhari)\ **Replies:** 3\ **Last updated:** [March 2, 2016, 5:35am UTC](https://discuss.elastic.co/t/input-files-with-dynamic-filename/42695 "2016-03-02T05:35:44Z")
Hi, We have some files in our systems, which has dynamic file names, date time appended. Example, server\_201602025 etc. FIle created today will neither be archived to some other location nor it will be appended any new … --- ## [Collecting Windows event log](https://discuss.elastic.co/t/collecting-windows-event-log/43049)
**Author:** [@miko370](https://discuss.elastic.co/u/miko370)\ **Replies:** 7\ **Last updated:** [March 2, 2016, 4:11am UTC](https://discuss.elastic.co/t/collecting-windows-event-log/43049 "2016-03-02T04:11:00Z")
Hi. I have read about different options to collect Windows eventlog to LogStash. I am trying to understand what is currently the preferred way. Moreover, since I want to do it remotely, I need to do it efficiently - pe… --- ## [IndexNotFoundException\[no such index\]](https://discuss.elastic.co/t/indexnotfoundexception-no-such-index/43138)
**Author:** [@Vakhtang\_Badzhadze](https://discuss.elastic.co/u/Vakhtang_Badzhadze)\ **Replies:** 1\ **Last updated:** [March 2, 2016, 1:02am UTC](https://discuss.elastic.co/t/indexnotfoundexception-no-such-index/43138 "2016-03-02T01:02:10Z")
Hi i have ELK on windows my logstash.json: input { file { type =\> "log4net" path =\> "d:\\Other Programms\\ELK\\logstash\\bin\\logs\*.log" } } output { elasticsearch { hosts =\> "localhost" } stdout {} } i have … --- ## [Run multiple logstash instances vs. one instance?](https://discuss.elastic.co/t/run-multiple-logstash-instances-vs-one-instance/43141)
**Author:** [@anhlqn](https://discuss.elastic.co/u/anhlqn)\ **Replies:** 4\ **Last updated:** [March 1, 2016, 11:55pm UTC](https://discuss.elastic.co/t/run-multiple-logstash-instances-vs-one-instance/43141 "2016-03-01T23:55:25Z")
Hi All, I have the following Logstash config input { # Receive logs tcp { port =\> 5544 type =\> "iis" } tcp { port =\> 5545 type =\> "perfmon" } } filter {} output { if \[type\] == "iis" { … --- ## [Kibana configuration on a server](https://discuss.elastic.co/t/kibana-configuration-on-a-server/43169)
**Author:** [@bishaka](https://discuss.elastic.co/u/bishaka)\ **Replies:** 5\ **Last updated:** [March 1, 2016, 11:51pm UTC](https://discuss.elastic.co/t/kibana-configuration-on-a-server/43169 "2016-03-01T23:51:23Z")
So i setup Kibana, elasticsearch and logstash on a staging server and i used a simple logstash config file with the following content: vi logstash-filter.conf input { stdin { } } filter { grok { match =\> { "message" … --- ## [Logstash cnfiguration error](https://discuss.elastic.co/t/logstash-cnfiguration-error/43083)
**Author:** [@bishaka](https://discuss.elastic.co/u/bishaka)\ **Replies:** 4\ **Last updated:** [March 1, 2016, 10:37pm UTC](https://discuss.elastic.co/t/logstash-cnfiguration-error/43083 "2016-03-01T22:37:54Z")
So I have both elasticsearch and kibana both up and running on a linux staging server . Now i am trying to configure logstash ans run it I wrote a logstash-simple.conf file put it in the bin folder when i try to run … --- ## [Does logstash 2.2.2-1 has backward compatibility with ES-1.5?](https://discuss.elastic.co/t/does-logstash-2-2-2-1-has-backward-compatibility-with-es-1-5/43158)
**Author:** [@piyush](https://discuss.elastic.co/u/piyush)\ **Replies:** 8\ **Last updated:** [March 1, 2016, 9:45pm UTC](https://discuss.elastic.co/t/does-logstash-2-2-2-1-has-backward-compatibility-with-es-1-5/43158 "2016-03-01T21:45:34Z")
Hi, I installed logstash-2.2.2-1.noarch.rpm and trying to connect managed Elastic Search cluster (version: 1.5.2), it failing with error: \[408\] {:class=\>"Elasticsearch::Transport::Transport::Errors::RequestTimeout", :le… --- ## [Can I specify the filename in logstash-output-s3?](https://discuss.elastic.co/t/can-i-specify-the-filename-in-logstash-output-s3/43091)
**Author:** [@hfuops](https://discuss.elastic.co/u/hfuops)\ **Replies:** 1\ **Last updated:** [March 1, 2016, 9:30pm UTC](https://discuss.elastic.co/t/can-i-specify-the-filename-in-logstash-output-s3/43091 "2016-03-01T21:30:27Z")
Greetings, because the original name is pretty strange which may be like ls.s3.26facecb-62c1-4d29-8608-0fb8fd327c15.2016-02-26T07.15.part0.txt I want to the files displayed on S3 with a regular name, i.e ${YY}-{MM… --- ## [Outputting to several elastcisearch indeces](https://discuss.elastic.co/t/outputting-to-several-elastcisearch-indeces/43123)
**Author:** [@Igor\_Samusenko](https://discuss.elastic.co/u/Igor_Samusenko)\ **Replies:** 1\ **Last updated:** [March 1, 2016, 9:27pm UTC](https://discuss.elastic.co/t/outputting-to-several-elastcisearch-indeces/43123 "2016-03-01T21:27:41Z")
I get JSON document to logstash. I write them to elasticsearch (it is log data). I'm wondering If I can write these documents to several elasticsearch indeces. I'd like to write the whole documents to one index, and on… --- ## [Syslog + Beats](https://discuss.elastic.co/t/syslog-beats/43048)
**Author:** [@matthieurobin](https://discuss.elastic.co/u/matthieurobin)\ **Replies:** 4\ **Last updated:** [March 1, 2016, 9:17pm UTC](https://discuss.elastic.co/t/syslog-beats/43048 "2016-03-01T21:17:43Z")
Hello guys, I'm currently configuring my ELK cluster to receive syslog from ESXi and Winlogbeats events from Windows. On input file, i got: input { udp { port =\> 3514 type =\> "syslog" } beats { … --- ## [Cat logs in when using logstash as service](https://discuss.elastic.co/t/cat-logs-in-when-using-logstash-as-service/43151)
**Author:** [@dkota](https://discuss.elastic.co/u/dkota)\ **Replies:** 2\ **Last updated:** [March 1, 2016, 9:16pm UTC](https://discuss.elastic.co/t/cat-logs-in-when-using-logstash-as-service/43151 "2016-03-01T21:16:41Z")
how can we cat/redirect logs when using logstash as service.? I am not able to locate the command to cat logs as input while running logstash as service. similar to cat filename|bin/logstash -f logstash-syslog.conf --- ## [Logstash Through DMZ](https://discuss.elastic.co/t/logstash-through-dmz/43136)
**Author:** [@keith.moffat](https://discuss.elastic.co/u/keith.moffat)\ **Replies:** 1\ **Last updated:** [March 1, 2016, 9:16pm UTC](https://discuss.elastic.co/t/logstash-through-dmz/43136 "2016-03-01T21:16:02Z")
Hello, I am new to this community and might have a newbie question. I built an ELK server that lives on the internal network, filebeats is working fine on the client servers who live internally. but I cant get it to w… --- ## [Module puppet-logstash: Is it still being developed?](https://discuss.elastic.co/t/module-puppet-logstash-is-it-still-being-developed/42093)
**Author:** [@eroussel](https://discuss.elastic.co/u/eroussel)\ **Replies:** 1\ **Last updated:** [March 1, 2016, 7:29pm UTC](https://discuss.elastic.co/t/module-puppet-logstash-is-it-still-being-developed/42093 "2016-03-01T19:29:25Z")
Hello, The latest puppet-logstash module on Puppet forge is version 0.5.1 and was released May 15th 2014. The most recent version of Logstash "officially" supported by the module is 1.4.1, and the most recent version o… --- ## [\[Solved\] Truncate long lines](https://discuss.elastic.co/t/solved-truncate-long-lines/43126)
**Author:** [@mikula](https://discuss.elastic.co/u/mikula)\ **Replies:** 1\ **Last updated:** [March 1, 2016, 3:53pm UTC](https://discuss.elastic.co/t/solved-truncate-long-lines/43126 "2016-03-01T15:53:26Z")
Hello, I would like to be able to truncate long lines. I found: ruby { code =\> 'event\["message"\] = event.sprintf("\_MESSAGE\_SIZE\_EXCEEDED\_-\_DROPPING\_MESSAGE\_") if event\["message"\].bytesize \> 10240' } I trie… --- ## [Can't remove\_field - help please](https://discuss.elastic.co/t/cant-remove-field-help-please/42894)
**Author:** [@Marjana](https://discuss.elastic.co/u/Marjana)\ **Replies:** 8\ **Last updated:** [March 1, 2016, 3:29pm UTC](https://discuss.elastic.co/t/cant-remove-field-help-please/42894 "2016-03-01T15:29:57Z")
I am very new with Logstash, trying to create my first config. I am using 1.5.6 version. As I am testing, I wanted to try to use db2 log file as input. Got the multiline thing working fine. Example of my event: "2016-02… --- ## [Add custom field for all records with a logged value](https://discuss.elastic.co/t/add-custom-field-for-all-records-with-a-logged-value/43122)
**Author:** [@Dmitry\_Reshetnik](https://discuss.elastic.co/u/Dmitry_Reshetnik)\ **Replies:** 0\ **Last updated:** [March 1, 2016, 1:33pm UTC](https://discuss.elastic.co/t/add-custom-field-for-all-records-with-a-logged-value/43122 "2016-03-01T13:33:08Z")
In my log file there is a line with "hash: " I need to parse this value and set to all records in this file (at least for all those which go right after this record). 01/03/2016: log init 01/03/2016: hash = 452345 … --- ## [Date filter stuck in 2000](https://discuss.elastic.co/t/date-filter-stuck-in-2000/43103)
**Author:** [@devjr](https://discuss.elastic.co/u/devjr)\ **Replies:** 2\ **Last updated:** [March 1, 2016, 1:26pm UTC](https://discuss.elastic.co/t/date-filter-stuck-in-2000/43103 "2016-03-01T13:26:23Z")
Hello, I have a strange problem with the date filter : whenever I use it and there is no year specified in the field, instead of using the current year, it puts 2000 in @timestamp. Tested on a wide variety of logs with… --- ## [File input documentation for logstash 2.2](https://discuss.elastic.co/t/file-input-documentation-for-logstash-2-2/41421)
**Author:** [@damartin77](https://discuss.elastic.co/u/damartin77)\ **Replies:** 0\ **Last updated:** [February 10, 2016, 6:43pm UTC](https://discuss.elastic.co/t/file-input-documentation-for-logstash-2-2/41421 "2016-02-10T18:43:38Z")
I recently updated to logstash-2.2 and found this in the log soon after startup: :message=\>"Reached open files limit: 4095, set by the 'max\_open\_files' option I don't see the max\_open\_files option in: enter link descri… --- ## [Win environment, parse failure, unexpected end-of-input](https://discuss.elastic.co/t/win-environment-parse-failure-unexpected-end-of-input/43114)
**Author:** [@bongo\_zg](https://discuss.elastic.co/u/bongo_zg)\ **Replies:** 0\ **Last updated:** [March 1, 2016, 12:02pm UTC](https://discuss.elastic.co/t/win-environment-parse-failure-unexpected-end-of-input/43114 "2016-03-01T12:02:51Z")
Logstash 2.2.1 on windows with config file: input { file { path =\> "c:/oracle\_output2/my\_log\*.log" start\_position =\> beginning sincedb\_path =\> "c:/oracle\_output2/my\_log.db" codec =\> "json" } } output { stdout … --- ## [Excel (.xlsx) filter](https://discuss.elastic.co/t/excel-xlsx-filter/1081)
**Author:** [@whittssg](https://discuss.elastic.co/u/whittssg)\ **Replies:** 3\ **Last updated:** [March 1, 2016, 10:53am UTC](https://discuss.elastic.co/t/excel-xlsx-filter/1081 "2016-03-01T10:53:42Z")
Hello, Is there any filters or plugins for logstash that can parse excel (.xlsx) files? I looked around but could only find a CSV filter. Thanks, --- ## [Grok seems not working anymore](https://discuss.elastic.co/t/grok-seems-not-working-anymore/42840)
**Author:** [@Weizhen\_Yan](https://discuss.elastic.co/u/Weizhen_Yan)\ **Replies:** 2\ **Last updated:** [March 1, 2016, 9:48am UTC](https://discuss.elastic.co/t/grok-seems-not-working-anymore/42840 "2016-03-01T09:48:36Z")
I'm trying to import nginx logs into ES, i'm using this patterns NGUSERNAME \[a-zA-Z\\.\\@\\-\\+\_%\]+ NGUSER %{NGUSERNAME} NGINXACCESS %{IPORHOST:clientip} - %{NOTSPACE:remote\_user} \\\[%{HTTPDATE:timestamp}\\\] \\"(?:%{WORD:verb}… --- ## [Logstash file read basic question](https://discuss.elastic.co/t/logstash-file-read-basic-question/43074)
**Author:** [@sudheer157](https://discuss.elastic.co/u/sudheer157)\ **Replies:** 2\ **Last updated:** [March 1, 2016, 6:17am UTC](https://discuss.elastic.co/t/logstash-file-read-basic-question/43074 "2016-03-01T06:17:50Z")
please point me in the right direction. I just started with logstash. Thanks My config file cat test.conf input { file { path =\> "/localhome/user/test.txt" start\_position =\> "beginni… --- ## [Mutate convert not working](https://discuss.elastic.co/t/mutate-convert-not-working/42995)
**Author:** [@Rohan\_Jain](https://discuss.elastic.co/u/Rohan_Jain)\ **Replies:** 2\ **Last updated:** [March 1, 2016, 6:11am UTC](https://discuss.elastic.co/t/mutate-convert-not-working/42995 "2016-03-01T06:11:58Z")
I am trying to convert a field named " sf\_query\_time" from string to integer field using mutate convert in filters in logstash.conf. But its not getting converted Here is the code (filter in logstash) input { bea… --- ## [Parsing a multiline log](https://discuss.elastic.co/t/parsing-a-multiline-log/42936)
**Author:** [@lucifer](https://discuss.elastic.co/u/lucifer)\ **Replies:** 10\ **Last updated:** [March 1, 2016, 4:59am UTC](https://discuss.elastic.co/t/parsing-a-multiline-log/42936 "2016-03-01T04:59:39Z")
How can I parse some information present in the last line of a multiline message. For example, the log format is: the first line contains the timestamp, the log level and some other important information, which is follow… --- ## [Auto Field Detection in Logs](https://discuss.elastic.co/t/auto-field-detection-in-logs/42543)
**Author:** [@gringo](https://discuss.elastic.co/u/gringo)\ **Replies:** 6\ **Last updated:** [March 1, 2016, 3:08am UTC](https://discuss.elastic.co/t/auto-field-detection-in-logs/42543 "2016-03-01T03:08:29Z")
Is there a way to write grok pattern such that it will automatically detect fields and parse it into elasticsearch. I am hoping to eliminate the need to constantly create grok patterns to recognize new log patterns For… --- ## [Logstash doesn't recognize "Feb 29" as a valid date](https://discuss.elastic.co/t/logstash-doesnt-recognize-feb-29-as-a-valid-date/42965)
**Author:** [@s0mb00n](https://discuss.elastic.co/u/s0mb00n)\ **Replies:** 2\ **Last updated:** [March 1, 2016, 2:50am UTC](https://discuss.elastic.co/t/logstash-doesnt-recognize-feb-29-as-a-valid-date/42965 "2016-03-01T02:50:58Z")
Logstash continuously output the following error when the clock hit February 29th, 2016: {"type"=\>"mapper\_parsing\_exception", "reason"=\>"failed to parse \[timestamp\]", "caused\_by"=\>{"type"=\>"illegal\_field\_value\_excepti… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1183) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1185)