# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1188 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1189 --- ## [Logstash csv files not loaded](https://discuss.elastic.co/t/logstash-csv-files-not-loaded/42346)
**Author:** [@Lucky](https://discuss.elastic.co/u/Lucky)\ **Replies:** 1\ **Last updated:** [February 22, 2016, 1:09am UTC](https://discuss.elastic.co/t/logstash-csv-files-not-loaded/42346 "2016-02-22T01:09:49Z")
I am using logstash to feed my CSV file into my elasticsearch , my logstash startup completed but the files didn't load into the index. I try checking by using GET /\_cat/indices?v health status index p… --- ## [Where to drop jar containing custome plugin or encoder like custom Kafka message decoder](https://discuss.elastic.co/t/where-to-drop-jar-containing-custome-plugin-or-encoder-like-custom-kafka-message-decoder/39190)
**Author:** [@anandnsingh](https://discuss.elastic.co/u/anandnsingh)\ **Replies:** 6\ **Last updated:** [February 21, 2016, 8:27pm UTC](https://discuss.elastic.co/t/where-to-drop-jar-containing-custome-plugin-or-encoder-like-custom-kafka-message-decoder/39190 "2016-02-21T20:27:49Z")
How to use custom decoder. What is the right location of a jar file containing this custom decoder. I --- ## [Duplicate field](https://discuss.elastic.co/t/duplicate-field/42311)
**Author:** [@Amos\_Shahar](https://discuss.elastic.co/u/Amos_Shahar)\ **Replies:** 2\ **Last updated:** [February 21, 2016, 8:07pm UTC](https://discuss.elastic.co/t/duplicate-field/42311 "2016-02-21T20:07:37Z")
hi, I am trying to parse the file name from the source field without the path, I trid to do the following: grok { match =\> \["source", "%{GREEDYDATA}/%{GREEDYDATA}/%{GREEDYDATA:filename9}"\] #add\_field =\> … --- ## [Logstash and redis High Availability](https://discuss.elastic.co/t/logstash-and-redis-high-availability/42275)
**Author:** [@Python\_Coder](https://discuss.elastic.co/u/Python_Coder)\ **Replies:** 4\ **Last updated:** [February 21, 2016, 5:47pm UTC](https://discuss.elastic.co/t/logstash-and-redis-high-availability/42275 "2016-02-21T17:47:37Z")
I have currently 2 Redis instances in active active modes using Redhat cluster and i'm feeding them with log shippers, We have 2 other servers with Logstash installed by which events would be popped up from both redis se… --- ## [Indexing sysstat data from sar and sadf](https://discuss.elastic.co/t/indexing-sysstat-data-from-sar-and-sadf/42044)
**Author:** [@robertws8](https://discuss.elastic.co/u/robertws8)\ **Replies:** 2\ **Last updated:** [February 21, 2016, 4:04pm UTC](https://discuss.elastic.co/t/indexing-sysstat-data-from-sar-and-sadf/42044 "2016-02-21T16:04:38Z")
I am already collecting syslog data via logstash into elasticsearch. My customer now wants sysstat date as well. So, I created a new index and types (using for example field names and types from sar -d -p 1 1) PUT /m… --- ## [Fresh install, just dies. Great... now what?](https://discuss.elastic.co/t/fresh-install-just-dies-great-now-what/41831)
**Author:** [@Mark\_Howells](https://discuss.elastic.co/u/Mark_Howells)\ **Replies:** 24\ **Last updated:** [February 20, 2016, 10:32pm UTC](https://discuss.elastic.co/t/fresh-install-just-dies-great-now-what/41831 "2016-02-20T22:32:47Z")
So, I thought 'd give LS a try having heard so much about it. I installed openjdk-7-jre onto a 12.04 ubuntu server then logatash 2.2.1 from the repositories (and then by hand when that didn't run). No errors are repo… --- ## [Logstash to ship logs on AWS Elasticsearch](https://discuss.elastic.co/t/logstash-to-ship-logs-on-aws-elasticsearch/42099)
**Author:** [@sukhada369](https://discuss.elastic.co/u/sukhada369)\ **Replies:** 3\ **Last updated:** [February 20, 2016, 7:47pm UTC](https://discuss.elastic.co/t/logstash-to-ship-logs-on-aws-elasticsearch/42099 "2016-02-20T19:47:28Z")
I am currently working on sending Logstash logs to AWS Elasticsearch. I am unable to get data for same. --- ## [No output - (no matches ?) with my config-file](https://discuss.elastic.co/t/no-output-no-matches-with-my-config-file/42127)
**Author:** [@Justin\_V](https://discuss.elastic.co/u/Justin_V)\ **Replies:** 2\ **Last updated:** [February 20, 2016, 7:43pm UTC](https://discuss.elastic.co/t/no-output-no-matches-with-my-config-file/42127 "2016-02-20T19:43:57Z")
Hi everyone. So, I'm a little bit new at the elk-stack, and I’m having an issue with further experiment with the tools. I'm using a linux machine. First of all, here's my config-file : input { file { type =\> "opener… --- ## [Bulk insert with logstash-output-mongodb](https://discuss.elastic.co/t/bulk-insert-with-logstash-output-mongodb/42158)
**Author:** [@sampasei](https://discuss.elastic.co/u/sampasei)\ **Replies:** 1\ **Last updated:** [February 20, 2016, 7:41pm UTC](https://discuss.elastic.co/t/bulk-insert-with-logstash-output-mongodb/42158 "2016-02-20T19:41:32Z")
Hi all, How can i do bulk inserts to a mongo database with the logstash-output-mongodb plugin? Thanks --- ## [Logstash Crashing on Particular Row](https://discuss.elastic.co/t/logstash-crashing-on-particular-row/42046)
**Author:** [@nomoneynoproblems](https://discuss.elastic.co/u/nomoneynoproblems)\ **Replies:** 1\ **Last updated:** [February 20, 2016, 7:35pm UTC](https://discuss.elastic.co/t/logstash-crashing-on-particular-row/42046 "2016-02-20T19:35:49Z")
We are siphoning 25m rows into ElasticSearch from Logstash. It consistently crashes after 7,493,824 rows have been posted to ES. I checked the rows all around that number and none of them look funny or have any weird… --- ## [Nested array in json](https://discuss.elastic.co/t/nested-array-in-json/41694)
**Author:** [@logstash\_oz](https://discuss.elastic.co/u/logstash_oz)\ **Replies:** 6\ **Last updated:** [February 20, 2016, 4:14pm UTC](https://discuss.elastic.co/t/nested-array-in-json/41694 "2016-02-20T16:14:34Z")
Hi, Does ELK solve the problem of parsing nested arrays in json? I spent a day or two to test graylog and it failed. Also came across another drawback in graylog(it does not handle "\\" well. Seems there is no other tool … --- ## [Logstash backfilling two type of logs, problem!](https://discuss.elastic.co/t/logstash-backfilling-two-type-of-logs-problem/40646)
**Author:** [@gh0stid](https://discuss.elastic.co/u/gh0stid)\ **Replies:** 42\ **Last updated:** [February 20, 2016, 5:34am UTC](https://discuss.elastic.co/t/logstash-backfilling-two-type-of-logs-problem/40646 "2016-02-20T05:34:39Z")
Hello, peopleeeee ! sorry to disturb you with probably such an easy question for you, veteran... BUT ... im stuck, and I mean it... heres the situation, i need to backfill a few days back log from /var/log/network.log … --- ## [Logstash 2.1.0 Geoip Filter](https://discuss.elastic.co/t/logstash-2-1-0-geoip-filter/42285)
**Author:** [@Omer\_Uludag](https://discuss.elastic.co/u/Omer_Uludag)\ **Replies:** 1\ **Last updated:** [February 20, 2016, 4:48am UTC](https://discuss.elastic.co/t/logstash-2-1-0-geoip-filter/42285 "2016-02-20T04:48:38Z")
Hello together, I would like to use the GeoIP filter for gettting the locations from the IP addresses. The code is working, but it does not parse the location field because it says: "reason"=\>"field must be either \[lat… --- ## [Any plugin/tool that read from MSMQ and send to Logstash/Elasticsearch](https://discuss.elastic.co/t/any-plugin-tool-that-read-from-msmq-and-send-to-logstash-elasticsearch/42286)
**Author:** [@anhlqn](https://discuss.elastic.co/u/anhlqn)\ **Replies:** 0\ **Last updated:** [February 20, 2016, 4:38am UTC](https://discuss.elastic.co/t/any-plugin-tool-that-read-from-msmq-and-send-to-logstash-elasticsearch/42286 "2016-02-20T04:38:23Z")
Hi, It may not be in the right category, but I'm looking for either a Logstash input plugin or any tool that can read messages from MSMQ (JSON format) and send to either Logstash or Elasticsearch? Thanks --- ## [Logstash 1.5.5 compatablity](https://discuss.elastic.co/t/logstash-1-5-5-compatablity/42234)
**Author:** [@ssi](https://discuss.elastic.co/u/ssi)\ **Replies:** 4\ **Last updated:** [February 19, 2016, 6:26pm UTC](https://discuss.elastic.co/t/logstash-1-5-5-compatablity/42234 "2016-02-19T18:26:00Z")
whats the highest version of elasticsearch that this version is compatibale with? --- ## [Elk-Create New Index-Indices](https://discuss.elastic.co/t/elk-create-new-index-indices/37280)
**Author:** [@ssampati](https://discuss.elastic.co/u/ssampati)\ **Replies:** 7\ **Last updated:** [February 19, 2016, 5:07pm UTC](https://discuss.elastic.co/t/elk-create-new-index-indices/37280 "2016-02-19T17:07:21Z")
im running elk instance, im trying to create a new indices other than the default logstash\* indice. need help on how to create. --- ## [Upgraded Logstash from 1.5.5 to 2.2.0 \> SSL heck](https://discuss.elastic.co/t/upgraded-logstash-from-1-5-5-to-2-2-0-ssl-heck/42069)
**Author:** [@Don\_Pich](https://discuss.elastic.co/u/Don_Pich)\ **Replies:** 3\ **Last updated:** [February 19, 2016, 4:23pm UTC](https://discuss.elastic.co/t/upgraded-logstash-from-1-5-5-to-2-2-0-ssl-heck/42069 "2016-02-19T16:23:53Z")
I have successfully upgraded my ES cluster to the latest/greatest and that worked great. My linux systems are rocking using the exact same SSL settings. However, my nxlog windows boxes are not being my friend. I keep… --- ## [Modify the messages in the event in logstash](https://discuss.elastic.co/t/modify-the-messages-in-the-event-in-logstash/42261)
**Author:** [@viren](https://discuss.elastic.co/u/viren)\ **Replies:** 0\ **Last updated:** [February 19, 2016, 4:04pm UTC](https://discuss.elastic.co/t/modify-the-messages-in-the-event-in-logstash/42261 "2016-02-19T16:04:04Z")
Consider the message captured by Logstash (for an event) happen to look like this. Sending 1 NEWLINE Sending 2 NEWLINE Sending 4 NEWLINE Sending 5 NEWLINE Sending 6 NEWLINE Sending 7 NEWLINE Sending 8 NEWLINE Sen… --- ## [Logstash stops emitting events when using date filter](https://discuss.elastic.co/t/logstash-stops-emitting-events-when-using-date-filter/42175)
**Author:** [@landreville](https://discuss.elastic.co/u/landreville)\ **Replies:** 3\ **Last updated:** [February 19, 2016, 3:36pm UTC](https://discuss.elastic.co/t/logstash-stops-emitting-events-when-using-date-filter/42175 "2016-02-19T15:36:00Z")
As soon as I turn on a date filter logstash stops emitting events or elastic search stops accepting them. I'm not sure which, but they do not appear in Kibana. I'm trying to use a timestamp within a log line to use as … --- ## [To reindex the whole data once in a day](https://discuss.elastic.co/t/to-reindex-the-whole-data-once-in-a-day/42162)
**Author:** [@Sandeep\_Venkatesh](https://discuss.elastic.co/u/Sandeep_Venkatesh)\ **Replies:** 1\ **Last updated:** [February 19, 2016, 3:03pm UTC](https://discuss.elastic.co/t/to-reindex-the-whole-data-once-in-a-day/42162 "2016-02-19T15:03:39Z")
I want to delete the index and index it again with same name once in a day using logstash. I want the same index name because an application will be using the same index name to fetch the data. Is there any we can do… --- ## [Getting exception while sending events from logstash shipper](https://discuss.elastic.co/t/getting-exception-while-sending-events-from-logstash-shipper/42230)
**Author:** [@Kishore](https://discuss.elastic.co/u/Kishore)\ **Replies:** 2\ **Last updated:** [February 19, 2016, 2:32pm UTC](https://discuss.elastic.co/t/getting-exception-while-sending-events-from-logstash-shipper/42230 "2016-02-19T14:32:02Z")
I am getting below error while sending events from logstash shipper to Redis, Kindly any one can help on this issue, where as i am not facing this issue for other servers. :exception=\>#....ec2.internal:7004 (Redis::Tim… --- ## [Logstash does not identify ERROR log level](https://discuss.elastic.co/t/logstash-does-not-identify-error-log-level/42213)
**Author:** [@punit\_naik1](https://discuss.elastic.co/u/punit_naik1)\ **Replies:** 3\ **Last updated:** [February 19, 2016, 11:44am UTC](https://discuss.elastic.co/t/logstash-does-not-identify-error-log-level/42213 "2016-02-19T11:44:28Z")
I have a config file like this: input{ file{ path =\> \["/home/formcept/fcstack/fclogs/relax/logging.log"\] start\_position =\> "beginning" codec =\> multiline { … --- ## [Logstash generate two events on output](https://discuss.elastic.co/t/logstash-generate-two-events-on-output/42172)
**Author:** [@Jeferson\_Martins](https://discuss.elastic.co/u/Jeferson_Martins)\ **Replies:** 2\ **Last updated:** [February 19, 2016, 10:40am UTC](https://discuss.elastic.co/t/logstash-generate-two-events-on-output/42172 "2016-02-19T10:40:41Z")
Hi, There's a way in Logstash where input a Event and output two and these events with diferent informations? For example: input event fields: - name - lastname - adress - age output event 1 (output to ES 1): - … --- ## [Multiple logstash instances don't work](https://discuss.elastic.co/t/multiple-logstash-instances-dont-work/42218)
**Author:** [@punit\_naik1](https://discuss.elastic.co/u/punit_naik1)\ **Replies:** 1\ **Last updated:** [February 19, 2016, 9:06am UTC](https://discuss.elastic.co/t/multiple-logstash-instances-dont-work/42218 "2016-02-19T09:06:45Z")
I have multiple technologies running on a single PC like Hadoop, HBase and all. So I have written that many config files. The way I deploy them is by running a for loop over all the configs and deploying them one by one … --- ## [Logstash: find out the top users](https://discuss.elastic.co/t/logstash-find-out-the-top-users/42165)
**Author:** [@taraka16](https://discuss.elastic.co/u/taraka16)\ **Replies:** 2\ **Last updated:** [February 19, 2016, 9:01am UTC](https://discuss.elastic.co/t/logstash-find-out-the-top-users/42165 "2016-02-19T09:01:56Z")
I want to know whether I can get the top 5 active users through logstash and visualize it in Kibana. the log file looks like this: 2016-02-18 13:58:30,924 comment\_created=csearch, user=user107@mail.com, text=csearch 20… --- ## [Confusion about authentication for Logstash](https://discuss.elastic.co/t/confusion-about-authentication-for-logstash/42202)
**Author:** [@MattW224](https://discuss.elastic.co/u/MattW224)\ **Replies:** 1\ **Last updated:** [February 19, 2016, 8:47am UTC](https://discuss.elastic.co/t/confusion-about-authentication-for-logstash/42202 "2016-02-19T08:47:12Z")
I'm reviewing the documentation for Shield, in order to enable authentication for the ELK stack, and am puzzled with Logstash. A couple questions: In reviewing Shield's Logstash documentation, a user and password is s… --- ## [GROK Multiple Match - Logstash](https://discuss.elastic.co/t/grok-multiple-match-logstash/27870)
**Author:** [@Dario\_Pezzi](https://discuss.elastic.co/u/Dario_Pezzi)\ **Replies:** 3\ **Last updated:** [February 19, 2016, 7:03am UTC](https://discuss.elastic.co/t/grok-multiple-match-logstash/27870 "2016-02-19T07:03:52Z")
Dear All, I'm looking for to match multiple patterns against a single field (message) but I can't understand how it works. This is my multiple match defined inside filter: grok { patterns\_dir =\> "/etc/logstash/pa… --- ## [Grok pattern for Logstash Logs](https://discuss.elastic.co/t/grok-pattern-for-logstash-logs/42070)
**Author:** [@parthu](https://discuss.elastic.co/u/parthu)\ **Replies:** 3\ **Last updated:** [February 19, 2016, 6:41am UTC](https://discuss.elastic.co/t/grok-pattern-for-logstash-logs/42070 "2016-02-19T06:41:40Z")
I am writing the configuration file in Logstash to shove logs from Logstash into Elasticsearch (so that I get to see them in Kibana eventually). A typical Logstash Log file looks like this: {:timestamp=\>"2016-02-17T1… --- ## [Field value Calculation/conversions in Logstash filter plugin](https://discuss.elastic.co/t/field-value-calculation-conversions-in-logstash-filter-plugin/42147)
**Author:** [@Architha](https://discuss.elastic.co/u/Architha)\ **Replies:** 1\ **Last updated:** [February 19, 2016, 6:39am UTC](https://discuss.elastic.co/t/field-value-calculation-conversions-in-logstash-filter-plugin/42147 "2016-02-19T06:39:52Z")
Hi folks, Can we do calculations on the field values like "multiplication or division " Or something like converting the value to percentage in the logstash filter Or rounding of numerical values ? If yes, please let … --- ## [Comparison of String with number fails](https://discuss.elastic.co/t/comparison-of-string-with-number-fails/24480)
**Author:** [@refaelos](https://discuss.elastic.co/u/refaelos)\ **Replies:** 3\ **Last updated:** [February 18, 2016, 10:26pm UTC](https://discuss.elastic.co/t/comparison-of-string-with-number-fails/24480 "2016-02-18T22:26:26Z")
Hey, I'm transferring multiple events into ES using LS. For every event, i'm creating a timeStamp according to a milliseconds field: date { match =\> \[ "saveTime", "UNIX\_MS" \] } Many events succeed but ever… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1187) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1189)