# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1187 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1188 --- ## [Logstash 2.2.1 and 492s all over the place](https://discuss.elastic.co/t/logstash-2-2-1-and-492s-all-over-the-place/41841)
**Author:** [@Marcin\_Kubica](https://discuss.elastic.co/u/Marcin_Kubica)\ **Replies:** 2\ **Last updated:** [February 23, 2016, 11:41pm UTC](https://discuss.elastic.co/t/logstash-2-2-1-and-492s-all-over-the-place/41841 "2016-02-23T23:41:11Z")
Hi I have a 6 node es cluster and trying to run two instances of logstash against it. Both piping into stdin, hosts =\> set with all nodes, and with default 4 workers and they return me 492s instantly. If I set work… --- ## [Logstash JVM GC "Allocation Failure"](https://discuss.elastic.co/t/logstash-jvm-gc-allocation-failure/42498)
**Author:** [@ebuildy](https://discuss.elastic.co/u/ebuildy)\ **Replies:** 2\ **Last updated:** [February 23, 2016, 7:26pm UTC](https://discuss.elastic.co/t/logstash-jvm-gc-allocation-failure/42498 "2016-02-23T19:26:52Z")
I run Logstash 2.2 with head size of 8G: export LS\_HEAP\_SIZE=8G exec setuser logstash logstash agent --pipeline-workers 4 --pipeline-batch-size 2500 --pipeline-batch-delay 10 -f /etc/service/logstash/logstas… --- ## [Logstash Conditional format?](https://discuss.elastic.co/t/logstash-conditional-format/42338)
**Author:** [@tpnoonan](https://discuss.elastic.co/u/tpnoonan)\ **Replies:** 2\ **Last updated:** [February 23, 2016, 7:00pm UTC](https://discuss.elastic.co/t/logstash-conditional-format/42338 "2016-02-23T19:00:56Z")
I've got a filter that I'm trying to add to a log stash instance that is receiving netflow data. I am trying to test the value of the field "netflow.protocol" and then based on that add a string literal for the type of … --- ## [Questions about Grok and add\_tag](https://discuss.elastic.co/t/questions-about-grok-and-add-tag/42475)
**Author:** [@guojingjing](https://discuss.elastic.co/u/guojingjing)\ **Replies:** 1\ **Last updated:** [February 23, 2016, 6:54pm UTC](https://discuss.elastic.co/t/questions-about-grok-and-add-tag/42475 "2016-02-23T18:54:54Z")
Anyone can help with my two questions regarding grok and add\_tag? 1) Can grok be used more than once in the filter part? after my first grok, which worked perfectly, I added a second grok to extract some more informa… --- ## [Trouble parsing this statement - help with grok expression](https://discuss.elastic.co/t/trouble-parsing-this-statement-help-with-grok-expression/42496)
**Author:** [@jjdepaul](https://discuss.elastic.co/u/jjdepaul)\ **Replies:** 3\ **Last updated:** [February 23, 2016, 6:52pm UTC](https://discuss.elastic.co/t/trouble-parsing-this-statement-help-with-grok-expression/42496 "2016-02-23T18:52:19Z")
LogStash 2.0.0 on Window7 (and cygwin). I have the following grok expression: Customer Account Number=%{NOTSPACE:accountId} Contract Number=%{NOTSPACE:cftsContractNumber} Work Number=%{NOTSPACE:cftsWorkNumber} … --- ## [SNMP Trap forward to logstash server?](https://discuss.elastic.co/t/snmp-trap-forward-to-logstash-server/42469)
**Author:** [@stefansaye](https://discuss.elastic.co/u/stefansaye)\ **Replies:** 2\ **Last updated:** [February 23, 2016, 6:43pm UTC](https://discuss.elastic.co/t/snmp-trap-forward-to-logstash-server/42469 "2016-02-23T18:43:00Z")
Hi all I'm looking for how to forward SNMP Trap to logstash server. SNMP trap have received from embedded devices . but how to forward these snmp trap to logstash server in real-time ? What would you suggest please? … --- ## [Filebeat to redis](https://discuss.elastic.co/t/filebeat-to-redis/42223)
**Author:** [@Python\_Coder](https://discuss.elastic.co/u/Python_Coder)\ **Replies:** 6\ **Last updated:** [February 23, 2016, 5:41pm UTC](https://discuss.elastic.co/t/filebeat-to-redis/42223 "2016-02-23T17:41:53Z")
I already know that filebeat (LS forwarder) wasn't designed to communicate with redis but only LS, however, i have an HIDS (host intrusion detection) OSSEC, which is currently sending logs to Logstash over UDP(ossec sup… --- ## [Duplicate events in filebeat + logstash + elasticsearch pipeline](https://discuss.elastic.co/t/duplicate-events-in-filebeat-logstash-elasticsearch-pipeline/42371)
**Author:** [@vgondil](https://discuss.elastic.co/u/vgondil)\ **Replies:** 1\ **Last updated:** [February 23, 2016, 5:36pm UTC](https://discuss.elastic.co/t/duplicate-events-in-filebeat-logstash-elasticsearch-pipeline/42371 "2016-02-23T17:36:18Z")
Filebeat version:1.1.1 Logstash version:2.1.0 Logstash multiline codec : 2.0.9 Logstash beats plugin: 2.1.4 Elasticsearch version: 2.1.0 I am shipping logs from a linux server using filebeat. The only configuration of … --- ## [Logstash failed to send ping to zen unicast](https://discuss.elastic.co/t/logstash-failed-to-send-ping-to-zen-unicast/42474)
**Author:** [@Sameer\_Dharur](https://discuss.elastic.co/u/Sameer_Dharur)\ **Replies:** 2\ **Last updated:** [February 23, 2016, 3:23pm UTC](https://discuss.elastic.co/t/logstash-failed-to-send-ping-to-zen-unicast/42474 "2016-02-23T15:23:07Z")
Hi, I've used ELK successfully before but now I get the problem of failing to send ping to zen unicast. Here's my config file - input { file { path =\> "C:\\logstash-1.5.4\\slt.log" type =\> "sample" sta… --- ## [Error in updating logstash to 2.2.2](https://discuss.elastic.co/t/error-in-updating-logstash-to-2-2-2/42488)
**Author:** [@ayasha88](https://discuss.elastic.co/u/ayasha88)\ **Replies:** 0\ **Last updated:** [February 23, 2016, 11:06am UTC](https://discuss.elastic.co/t/error-in-updating-logstash-to-2-2-2/42488 "2016-02-23T11:06:08Z")
Hi I have updated logstash from 2.0.0 to 2.2.2 following this This are my configurations: input { udp { port =\> 8192 } } output { elasticsearch { hosts =\> \["localhost:9200"\] } stdout { codec =\> ru… --- ## [Logstash timestamp - not reading timestamp from log files](https://discuss.elastic.co/t/logstash-timestamp-not-reading-timestamp-from-log-files/42256)
**Author:** [@bgrzinic](https://discuss.elastic.co/u/bgrzinic)\ **Replies:** 4\ **Last updated:** [February 23, 2016, 1:16pm UTC](https://discuss.elastic.co/t/logstash-timestamp-not-reading-timestamp-from-log-files/42256 "2016-02-23T13:16:51Z")
Hi guys, wandering if anybody can help with advice, suggestion on configuring logstash for properly reading timestamp from custom log files. I use logstash to read custom logs and forward to Elasticssearch - in the end… --- ## [Should Logstash and ES be in different machines in production?](https://discuss.elastic.co/t/should-logstash-and-es-be-in-different-machines-in-production/42251)
**Author:** [@taraka16](https://discuss.elastic.co/u/taraka16)\ **Replies:** 2\ **Last updated:** [February 23, 2016, 1:05pm UTC](https://discuss.elastic.co/t/should-logstash-and-es-be-in-different-machines-in-production/42251 "2016-02-23T13:05:28Z")
Should I have elasticsearch and logstash on different machines when deploying the ELK stack in production (as I've read that somewhere in the internet)? or can they be installed on the same server with the following logs… --- ## [Kv filter: a number added in the beginning of the field](https://discuss.elastic.co/t/kv-filter-a-number-added-in-the-beginning-of-the-field/42266)
**Author:** [@taraka16](https://discuss.elastic.co/u/taraka16)\ **Replies:** 2\ **Last updated:** [February 23, 2016, 1:04pm UTC](https://discuss.elastic.co/t/kv-filter-a-number-added-in-the-beginning-of-the-field/42266 "2016-02-23T13:04:17Z")
This is my conf file: input { file { start\_position =\> "beginning" path =\> \[ "/home/taraka/Projects/neonion/logs/\*.log" \] type =\> "syslog" } } filter{ multiline { pattern =\> "\\\[\\#\\|\\d{4}" n… --- ## [Only specific output from logstash](https://discuss.elastic.co/t/only-specific-output-from-logstash/42245)
**Author:** [@lucifer](https://discuss.elastic.co/u/lucifer)\ **Replies:** 5\ **Last updated:** [February 23, 2016, 6:28am UTC](https://discuss.elastic.co/t/only-specific-output-from-logstash/42245 "2016-02-23T06:28:08Z")
Is there a way I can send only certain parts of a log to elasticsearch. I don't want to remove some logs, I want to remove some parts of a log. For eg. I want to remove \[INFO\] from my log, and only send the rest of it to… --- ## [Multiple Select queries in Logstash JDBC Plugin](https://discuss.elastic.co/t/multiple-select-queries-in-logstash-jdbc-plugin/42329)
**Author:** [@sumit\_gupta\_sgt](https://discuss.elastic.co/u/sumit_gupta_sgt)\ **Replies:** 5\ **Last updated:** [February 23, 2016, 5:16am UTC](https://discuss.elastic.co/t/multiple-select-queries-in-logstash-jdbc-plugin/42329 "2016-02-23T05:16:11Z")
Hi All, I am trying to pull data from MYSQL.I am able to get Data from MYSQL. But i want fetch data one mysql table as one type in ES index like for Example: I have A,B, C tables in MYSQL i want to run Select \* on al… --- ## [Shard in initialing state for a long period of time now](https://discuss.elastic.co/t/shard-in-initialing-state-for-a-long-period-of-time-now/42347)
**Author:** [@James\_Tang](https://discuss.elastic.co/u/James_Tang)\ **Replies:** 5\ **Last updated:** [February 23, 2016, 2:32am UTC](https://discuss.elastic.co/t/shard-in-initialing-state-for-a-long-period-of-time-now/42347 "2016-02-23T02:32:34Z")
Cluster ID : 45cd54 Shard location-541275-1602 Observing KOPF plugin show that the shard is in an initializing state for more than 10 minutes now. Please restart or do your magic. I have stop all indexing activity and al… --- ## [Websocket output broken in 2.2?](https://discuss.elastic.co/t/websocket-output-broken-in-2-2/42441)
**Author:** [@uduncanu](https://discuss.elastic.co/u/uduncanu)\ **Replies:** 0\ **Last updated:** [February 23, 2016, 12:20am UTC](https://discuss.elastic.co/t/websocket-output-broken-in-2-2/42441 "2016-02-23T00:20:49Z")
I'm getting the error "Errno::EADDRINUSE: Address already in use - bind - Address already in use" when using the websocket output after upgrading from Logstash 2.1 to 2.2. I've also tried it on a clean install of Logsta… --- ## [Shipper in Windows service](https://discuss.elastic.co/t/shipper-in-windows-service/42363)
**Author:** [@binurajps](https://discuss.elastic.co/u/binurajps)\ **Replies:** 2\ **Last updated:** [February 23, 2016, 12:01am UTC](https://discuss.elastic.co/t/shipper-in-windows-service/42363 "2016-02-23T00:01:43Z")
Hello Team, Currently the log shipper is started from the command prompt using the command java -jar logstash-1.2.2-flatjar.jar agent -f shipper.conf Hence if the user closes the window, the service is stopped. Is th… --- ## [How to write output to avro file from logstash using avro codec](https://discuss.elastic.co/t/how-to-write-output-to-avro-file-from-logstash-using-avro-codec/42406)
**Author:** [@sdaruna](https://discuss.elastic.co/u/sdaruna)\ **Replies:** 2\ **Last updated:** [February 23, 2016, 12:00am UTC](https://discuss.elastic.co/t/how-to-write-output-to-avro-file-from-logstash-using-avro-codec/42406 "2016-02-23T00:00:08Z")
Hi. I have file input that is in json format. How can i write to avro file output using elasticsearch.? --- ## [Translation missing](https://discuss.elastic.co/t/translation-missing/42435)
**Author:** [@voipoclay](https://discuss.elastic.co/u/voipoclay)\ **Replies:** 0\ **Last updated:** [February 22, 2016, 10:29pm UTC](https://discuss.elastic.co/t/translation-missing/42435 "2016-02-22T22:29:47Z")
Hello, When I run the help for logstash (logstash 2.2.0) i notice a few parameters have translation missing. Was hoping for an opinion on the matter. -w, --pipeline-workers COUNT translation missing: en.logstash.run… --- ## [Logstash compare one field with multiple value (string)](https://discuss.elastic.co/t/logstash-compare-one-field-with-multiple-value-string/42315)
**Author:** [@gnoale](https://discuss.elastic.co/u/gnoale)\ **Replies:** 5\ **Last updated:** [February 22, 2016, 9:25pm UTC](https://discuss.elastic.co/t/logstash-compare-one-field-with-multiple-value-string/42315 "2016-02-22T21:25:46Z")
Hi there, This is the configuration I am using for debugging purpose. The goal is basically to filter sources hosts to apply appropriate filter to the messages, and add a tag to distinguish them in elasticsearch. inp… --- ## [Logstash duplicating log events?](https://discuss.elastic.co/t/logstash-duplicating-log-events/36933)
**Author:** [@zombie101](https://discuss.elastic.co/u/zombie101)\ **Replies:** 3\ **Last updated:** [February 22, 2016, 8:39pm UTC](https://discuss.elastic.co/t/logstash-duplicating-log-events/36933 "2016-02-22T20:39:16Z")
hi -- I have a fairly simple logstash setup: logstash runs on a web server, and sends events to redis logstash running on another server takes the events from redis and outputs them into ES. I am occasionally, but n… --- ## [Updated to logstash 2.2.2 now my plugin crashes](https://discuss.elastic.co/t/updated-to-logstash-2-2-2-now-my-plugin-crashes/42412)
**Author:** [@CamJN](https://discuss.elastic.co/u/CamJN)\ **Replies:** 1\ **Last updated:** [February 22, 2016, 7:18pm UTC](https://discuss.elastic.co/t/updated-to-logstash-2-2-2-now-my-plugin-crashes/42412 "2016-02-22T19:18:14Z")
I have a fork of the influxdb output plugin that was working great untill I updated to logstash 2.2.2, now I get the following error. Unfortunately there's no indication what was being looked up when the NameError got th… --- ## [Aggregate Nginx Metrics](https://discuss.elastic.co/t/aggregate-nginx-metrics/42187)
**Author:** [@Jeferson\_Martins](https://discuss.elastic.co/u/Jeferson_Martins)\ **Replies:** 1\ **Last updated:** [February 22, 2016, 7:05pm UTC](https://discuss.elastic.co/t/aggregate-nginx-metrics/42187 "2016-02-22T19:05:13Z")
Hi, Today I use StatsD to generate metrics about Nginx access, for example: how many requests in especific URL; how many 5XX/4XX/3XX/2XX httpcode for especific application but I have a problem with application UR… --- ## [Converting String to Geo Point](https://discuss.elastic.co/t/converting-string-to-geo-point/42422)
**Author:** [@Wayne\_Taylor](https://discuss.elastic.co/u/Wayne_Taylor)\ **Replies:** 1\ **Last updated:** [February 22, 2016, 6:59pm UTC](https://discuss.elastic.co/t/converting-string-to-geo-point/42422 "2016-02-22T18:59:52Z")
Hi All, I was able to get my data imported from JDBC into Elasticsearch and can query using Kibana. However, the geo data is being imported as a string. Please could I get some help in converting it. Below is a snap… --- ## [Unable to write to avro file from logstash](https://discuss.elastic.co/t/unable-to-write-to-avro-file-from-logstash/42410)
**Author:** [@sdaruna](https://discuss.elastic.co/u/sdaruna)\ **Replies:** 5\ **Last updated:** [February 22, 2016, 6:54pm UTC](https://discuss.elastic.co/t/unable-to-write-to-avro-file-from-logstash/42410 "2016-02-22T18:54:49Z")
Hi, I am trying to write the file using avro codel in logstash. Below is my simple configuration: === input { file { path =\> "/Users/srini/Downloads/imp/2016-01-22/\*.json" … --- ## [Unable to index xml file properly using logstash](https://discuss.elastic.co/t/unable-to-index-xml-file-properly-using-logstash/42318)
**Author:** [@sdaruna](https://discuss.elastic.co/u/sdaruna)\ **Replies:** 2\ **Last updated:** [February 22, 2016, 6:52pm UTC](https://discuss.elastic.co/t/unable-to-index-xml-file-properly-using-logstash/42318 "2016-02-22T18:52:16Z")
Hi, I am trying to index big xml file. Below is my xml file. input { file { path =\> "/Users/srini/Downloads/imp/2016-01-27/\*.xml" start\_position =\> "beginning" } } filter { xml { s… --- ## [Add\_field is not working when trying to add interger value](https://discuss.elastic.co/t/add-field-is-not-working-when-trying-to-add-interger-value/42376)
**Author:** [@Sergey\_Grigorov](https://discuss.elastic.co/u/Sergey_Grigorov)\ **Replies:** 1\ **Last updated:** [February 22, 2016, 11:38am UTC](https://discuss.elastic.co/t/add-field-is-not-working-when-trying-to-add-interger-value/42376 "2016-02-22T11:38:57Z")
I'm trying to add\_field of integer type right after "match". But the output shows that this field is a string not integer as required. Here is the part of my filter configuration: ... filter { if \[type\] == "xferlog"… --- ## [Logstash stops itself](https://discuss.elastic.co/t/logstash-stops-itself/42362)
**Author:** [@marcmga](https://discuss.elastic.co/u/marcmga)\ **Replies:** 0\ **Last updated:** [February 22, 2016, 8:00am UTC](https://discuss.elastic.co/t/logstash-stops-itself/42362 "2016-02-22T08:00:30Z")
Hello, Every 1/2 weeks i'm finding my logstash stopped. I check logstas.err and it show this log: Non US-ASCII detected and no charset defined. Defaulting to UTF-8, set your own if this is incorrect. Non US-ASCII d… --- ## [Logstash restart error?](https://discuss.elastic.co/t/logstash-restart-error/42349)
**Author:** [@clifford](https://discuss.elastic.co/u/clifford)\ **Replies:** 3\ **Last updated:** [February 22, 2016, 7:30am UTC](https://discuss.elastic.co/t/logstash-restart-error/42349 "2016-02-22T07:30:14Z")
My environment is logstash and elasticsearch with a single server. Last week I try to modify the logstash config file,configtest result is ok, and then restart the logstash service.But an error restart service results:{:… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1186) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1188)