# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1189 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1190 --- ## [Http\_poller 's weird behavior with polling URLs](https://discuss.elastic.co/t/http-poller-s-weird-behavior-with-polling-urls/28620)
**Author:** [@Ramdev\_Wudali](https://discuss.elastic.co/u/Ramdev_Wudali)\ **Replies:** 21\ **Last updated:** [February 18, 2016, 9:31pm UTC](https://discuss.elastic.co/t/http-poller-s-weird-behavior-with-polling-urls/28620 "2016-02-18T21:31:18Z")
http\_poller with logstash 1.5.1 , ES 1.5.2, on Java 7 I have configured http\_poller to poll the following endpoint http://:10710/jolokia/read/:type=Registrar/InstanceName (I am using jolokia to access the JMX applica… --- ## [Deleting the Index evryday using logstash](https://discuss.elastic.co/t/deleting-the-index-evryday-using-logstash/42183)
**Author:** [@Sandeep\_Venkatesh](https://discuss.elastic.co/u/Sandeep_Venkatesh)\ **Replies:** 1\ **Last updated:** [February 18, 2016, 8:36pm UTC](https://discuss.elastic.co/t/deleting-the-index-evryday-using-logstash/42183 "2016-02-18T20:36:03Z")
I want to delete the index at the end of the day and reindex it again. Is there any way to delete the index using an scheduler in logstash. Thanks, Sandeep --- ## [Link to documentation from Logstash thank you page is wrong](https://discuss.elastic.co/t/link-to-documentation-from-logstash-thank-you-page-is-wrong/42193)
**Author:** [@vicneanschi](https://discuss.elastic.co/u/vicneanschi)\ **Replies:** 1\ **Last updated:** [February 18, 2016, 8:29pm UTC](https://discuss.elastic.co/t/link-to-documentation-from-logstash-thank-you-page-is-wrong/42193 "2016-02-18T20:29:07Z")
https://www.elastic.co/thank-you?url=https://download.elastic.co/logstash/logstash/logstash-2.2.2.zip Link should point to Logstash documentation. --- ## [How to check Logstash speed?](https://discuss.elastic.co/t/how-to-check-logstash-speed/42151)
**Author:** [@vikas\_gopal](https://discuss.elastic.co/u/vikas_gopal)\ **Replies:** 5\ **Last updated:** [February 18, 2016, 8:00pm UTC](https://discuss.elastic.co/t/how-to-check-logstash-speed/42151 "2016-02-18T20:00:30Z")
Hi Experts, Sorry to ask a very basic question , How I can check the logstash speed . I mean how many lines events/logs per second it is parsing or reading ? Thanks VG --- ## [Logstash goes to 100% cpu and stops logging after a while](https://discuss.elastic.co/t/logstash-goes-to-100-cpu-and-stops-logging-after-a-while/42182)
**Author:** [@linuxgurugamer](https://discuss.elastic.co/u/linuxgurugamer)\ **Replies:** 0\ **Last updated:** [February 18, 2016, 7:16pm UTC](https://discuss.elastic.co/t/logstash-goes-to-100-cpu-and-stops-logging-after-a-while/42182 "2016-02-18T19:16:56Z")
Logstash 2.2.1 is installed on a CentOS 6 system Server has 4 gig memory, and 4 CPUs Logs come into the server via rsyslog, local rsyslog sends to local port 5544 It works fine for a while, then it goes to 100% cpu… --- ## [Logstash with large log files](https://discuss.elastic.co/t/logstash-with-large-log-files/42163)
**Author:** [@Jeferson\_Martins](https://discuss.elastic.co/u/Jeferson_Martins)\ **Replies:** 4\ **Last updated:** [February 18, 2016, 7:30pm UTC](https://discuss.elastic.co/t/logstash-with-large-log-files/42163 "2016-02-18T19:30:34Z")
Hi, I have some Logstash that read Log files with some GBs. Some times this logstash stop to send logs to my redis and when I see, my log files have some Gbs. I using Logstash 1.4.2. There is some way to resolve this… --- ## [Logstash -\> Kafka output preferred settings](https://discuss.elastic.co/t/logstash-kafka-output-preferred-settings/41941)
**Author:** [@malonej7](https://discuss.elastic.co/u/malonej7)\ **Replies:** 3\ **Last updated:** [February 18, 2016, 5:51pm UTC](https://discuss.elastic.co/t/logstash-kafka-output-preferred-settings/41941 "2016-02-18T17:51:27Z")
Are there any preferred, non-default settings for using the kafka output in logstash? Any specific Kafka-side settings that should be checked as well? I'm running into the issue of logstash seemingly not being able to… --- ## [Logatash with nested Json parser](https://discuss.elastic.co/t/logatash-with-nested-json-parser/41198)
**Author:** [@vimalmpatel](https://discuss.elastic.co/u/vimalmpatel)\ **Replies:** 7\ **Last updated:** [February 18, 2016, 5:29pm UTC](https://discuss.elastic.co/t/logatash-with-nested-json-parser/41198 "2016-02-18T17:29:59Z")
i have kafka input something like this {"interactionId":"7891013","applicantInfoList":\[{"cif":123456,"role":"Primary","applicantType":"PROSPECT"}\],"correlationId":"d828bcf9-0fb7-467b-b2c5-a67c2305a9db","application… --- ## [How to get country name using LS filter](https://discuss.elastic.co/t/how-to-get-country-name-using-ls-filter/42146)
**Author:** [@vikas\_gopal](https://discuss.elastic.co/u/vikas_gopal)\ **Replies:** 0\ **Last updated:** [February 18, 2016, 2:12pm UTC](https://discuss.elastic.co/t/how-to-get-country-name-using-ls-filter/42146 "2016-02-18T14:12:36Z")
Hi Guys, I am aware that I can use geoip { source =\> ...} to get country name based on source IP . But My concern is I am getting less data on Map when I am using Geoip filter in LS . So what I have done is I used f… --- ## [Device with json log - how to import](https://discuss.elastic.co/t/device-with-json-log-how-to-import/42077)
**Author:** [@Bradly](https://discuss.elastic.co/u/Bradly)\ **Replies:** 2\ **Last updated:** [February 18, 2016, 1:52pm UTC](https://discuss.elastic.co/t/device-with-json-log-how-to-import/42077 "2016-02-18T13:52:43Z")
I have a device on my network that creates a json log file. Lets call this device device1. So if you curl https://device1/log.json you will get an output in json format. I want to be able to "pull" that data into elas… --- ## [Match part of a log](https://discuss.elastic.co/t/match-part-of-a-log/42117)
**Author:** [@mr\_rob](https://discuss.elastic.co/u/mr_rob)\ **Replies:** 3\ **Last updated:** [February 18, 2016, 10:36am UTC](https://discuss.elastic.co/t/match-part-of-a-log/42117 "2016-02-18T10:36:42Z")
I've seen how to match certain logs, and match every line. But i want to do something a little different (if possible??) I want to parse a log (that has many different line formats, looking for a particular keyword an… --- ## [Need to promote nested field to a higherlevel using logstash](https://discuss.elastic.co/t/need-to-promote-nested-field-to-a-higherlevel-using-logstash/34292)
**Author:** [@Ramdev\_Wudali](https://discuss.elastic.co/u/Ramdev_Wudali)\ **Replies:** 3\ **Last updated:** [February 18, 2016, 9:39am UTC](https://discuss.elastic.co/t/need-to-promote-nested-field-to-a-higherlevel-using-logstash/34292 "2016-02-18T09:39:57Z")
Hi: I have a mapping similar to this : { "type1" : { "properties" : { "field1": { "type": "nested", "nested\_field1": { "typ… --- ## [Logstash netflow V9](https://discuss.elastic.co/t/logstash-netflow-v9/40789)
**Author:** [@jdambly](https://discuss.elastic.co/u/jdambly)\ **Replies:** 7\ **Last updated:** [February 18, 2016, 8:49am UTC](https://discuss.elastic.co/t/logstash-netflow-v9/40789 "2016-02-18T08:49:09Z")
I'm getting the following from logstash Template length doesn't fit cleanly into flowset {:template\_id=\>256, :template\_length=\>47, :record\_length=\>936, :level=\>:warn} Template length doesn't fit cleanly into flowset {… --- ## [Reducing the number of Alerts](https://discuss.elastic.co/t/reducing-the-number-of-alerts/42022)
**Author:** [@praveen\_siem](https://discuss.elastic.co/u/praveen_siem)\ **Replies:** 2\ **Last updated:** [February 18, 2016, 7:03am UTC](https://discuss.elastic.co/t/reducing-the-number-of-alerts/42022 "2016-02-18T07:03:56Z")
We are creating rule "Brute force Attack" in ELK with the condition as mentioned below: if "Invalid" in \[tags\] { throttle { before\_count =\> 5 after\_count =\> 5 period =\> 86400 key =\> "%{src\_ip}" add\_tag =\> "throttled" } … --- ## [Environment filter is not working](https://discuss.elastic.co/t/environment-filter-is-not-working/42040)
**Author:** [@gaurav1424](https://discuss.elastic.co/u/gaurav1424)\ **Replies:** 4\ **Last updated:** [February 18, 2016, 7:01am UTC](https://discuss.elastic.co/t/environment-filter-is-not-working/42040 "2016-02-18T07:01:35Z")
here is example: My input file : filter { environment { add\_metadata\_from\_env =\> {"region" =\> "REGION\_ENV"} add\_field =\> \["my\_env", "%{\[@metadata\]\[region\]}"\] } } bash-3.2$ echo $REGION\_ENV amer bash-3.2$ My output… --- ## [Logstash and ElasticSearch setup not working for Netflow logs](https://discuss.elastic.co/t/logstash-and-elasticsearch-setup-not-working-for-netflow-logs/27698)
**Author:** [@akshayukey](https://discuss.elastic.co/u/akshayukey)\ **Replies:** 7\ **Last updated:** [February 18, 2016, 2:24am UTC](https://discuss.elastic.co/t/logstash-and-elasticsearch-setup-not-working-for-netflow-logs/27698 "2016-02-18T02:24:21Z")
Hi Folks, I have done a basic setup/configuration for storing Netflow logs into ElasticSearch using Logstash. My logstash config looks like: input { udp { port =\> 9995 codec =\> netflow { definit… --- ## [Logstash cannot connect to InfluxDB](https://discuss.elastic.co/t/logstash-cannot-connect-to-influxdb/28608)
**Author:** [@kemra102](https://discuss.elastic.co/u/kemra102)\ **Replies:** 4\ **Last updated:** [February 17, 2016, 11:52pm UTC](https://discuss.elastic.co/t/logstash-cannot-connect-to-influxdb/28608 "2016-02-17T23:52:23Z")
I am using the logstash-output-influxdb plugin to send some of our log data to InfluxDB. I have this configured like so: influxdb { data\_points =\> { "duration" =\> "%{data.event.duration}" } … --- ## [Logstash plugin and rspec -- internal logging output](https://discuss.elastic.co/t/logstash-plugin-and-rspec-internal-logging-output/42064)
**Author:** [@talvey](https://discuss.elastic.co/u/talvey)\ **Replies:** 0\ **Last updated:** [February 17, 2016, 6:47pm UTC](https://discuss.elastic.co/t/logstash-plugin-and-rspec-internal-logging-output/42064 "2016-02-17T18:47:13Z")
I'm writing a simple logstash plugin and associated rspec tests. I'd like to be able to see the internal logging of the plugin when I run the tests, but have been unable to enable logging. For instance, the following … --- ## [Logstash No Longer Accepting Lumberjack Input](https://discuss.elastic.co/t/logstash-no-longer-accepting-lumberjack-input/42049)
**Author:** [@michael.mckinney](https://discuss.elastic.co/u/michael.mckinney)\ **Replies:** 1\ **Last updated:** [February 17, 2016, 5:16pm UTC](https://discuss.elastic.co/t/logstash-no-longer-accepting-lumberjack-input/42049 "2016-02-17T17:16:14Z")
Hey folks, I'm running into an odd issue. I recently upgraded elasticsearch from 1.7 to 2.2.0, everything seemed to work fine. Yesterday my ELK server ran out of disk space, i shut it down, added a larger disk, started… --- ## [Logstash Transposing Field Data](https://discuss.elastic.co/t/logstash-transposing-field-data/41547)
**Author:** [@nomoneynoproblems](https://discuss.elastic.co/u/nomoneynoproblems)\ **Replies:** 1\ **Last updated:** [February 17, 2016, 4:10pm UTC](https://discuss.elastic.co/t/logstash-transposing-field-data/41547 "2016-02-17T16:10:26Z")
Hi. We're using Logstash to transport SQL data into ElasticSearch via the JDBC plugin. Two of the fields we're copying include: Name ZipCode For some reason the first few characters of zipcode are being inserted in… --- ## [Logstash environment plugin doesn't seem to work](https://discuss.elastic.co/t/logstash-environment-plugin-doesnt-seem-to-work/38872)
**Author:** [@schmorgs](https://discuss.elastic.co/u/schmorgs)\ **Replies:** 6\ **Last updated:** [February 17, 2016, 3:44pm UTC](https://discuss.elastic.co/t/logstash-environment-plugin-doesnt-seem-to-work/38872 "2016-02-17T15:44:13Z")
I want to use an environment variable in my logstash config and see there is an "environment" input community plugin which has a function called add\_metadata\_from\_env. I've installed the plugin (under Logstash 2.1.0) a… --- ## [Unable to install locally developed logstash plugin](https://discuss.elastic.co/t/unable-to-install-locally-developed-logstash-plugin/42028)
**Author:** [@vinod8427](https://discuss.elastic.co/u/vinod8427)\ **Replies:** 0\ **Last updated:** [February 17, 2016, 1:24pm UTC](https://discuss.elastic.co/t/unable-to-install-locally-developed-logstash-plugin/42028 "2016-02-17T13:24:24Z")
I have developed a logstash output plugin specifically for our need. This plugin has dependency on cassandra-driver & ione gems. The intent is to install this plugin locally and our servers are hosted on a private networ… --- ## [Got error to send bulk of actions: Connection refused](https://discuss.elastic.co/t/got-error-to-send-bulk-of-actions-connection-refused/41809)
**Author:** [@NiteshBarnwal](https://discuss.elastic.co/u/NiteshBarnwal)\ **Replies:** 7\ **Last updated:** [February 17, 2016, 12:52pm UTC](https://discuss.elastic.co/t/got-error-to-send-bulk-of-actions-connection-refused/41809 "2016-02-17T12:52:12Z")
I am using logstash 1.5.4 . getting error like below since today. Got error to send bulk of actions: Connection refused {:level=\>:error} Failed to flush outgoing items {:outgoing\_count=\>193, :exception=\>"Manticore::So… --- ## [Logs Strucked at Redis or Logstash](https://discuss.elastic.co/t/logs-strucked-at-redis-or-logstash/40876)
**Author:** [@praveen\_siem](https://discuss.elastic.co/u/praveen_siem)\ **Replies:** 5\ **Last updated:** [February 17, 2016, 10:25am UTC](https://discuss.elastic.co/t/logs-strucked-at-redis-or-logstash/40876 "2016-02-17T10:25:55Z")
Dear Folks, We are faced with a issue, were in we are monitoring data from firewall, syslog and others. The data is coming from logstash (Shipper) to logstash (Indexer) and being forwarded to elastic search. We are a… --- ## [Using hash table with filter Plugin](https://discuss.elastic.co/t/using-hash-table-with-filter-plugin/41460)
**Author:** [@miko370](https://discuss.elastic.co/u/miko370)\ **Replies:** 10\ **Last updated:** [February 17, 2016, 8:31am UTC](https://discuss.elastic.co/t/using-hash-table-with-filter-plugin/41460 "2016-02-17T08:31:13Z")
Hi. I have deployed a syslog plugin that has a set of filters that help me tag each message to the vendor or device type based on regex patterns. I am trying to avoid doing it per message, so I am thinking of something… --- ## [Creating the document\_id in logstash by combining the two columns coming from the input jdbc filter](https://discuss.elastic.co/t/creating-the-document-id-in-logstash-by-combining-the-two-columns-coming-from-the-input-jdbc-filter/39580)
**Author:** [@Sandeep\_Venkatesh](https://discuss.elastic.co/u/Sandeep_Venkatesh)\ **Replies:** 2\ **Last updated:** [February 17, 2016, 5:54am UTC](https://discuss.elastic.co/t/creating-the-document-id-in-logstash-by-combining-the-two-columns-coming-from-the-input-jdbc-filter/39580 "2016-02-17T05:54:46Z")
Right now this is how it looks, elasticsearch { user =\> "admin" password =\> "elastic" index =\> "customs" manage\_template =\> false template\_name =\> "template1" docum… --- ## [Merging a section of event to single event and splitting with key value filter](https://discuss.elastic.co/t/merging-a-section-of-event-to-single-event-and-splitting-with-key-value-filter/41143)
**Author:** [@techrawther](https://discuss.elastic.co/u/techrawther)\ **Replies:** 2\ **Last updated:** [February 17, 2016, 4:51am UTC](https://discuss.elastic.co/t/merging-a-section-of-event-to-single-event-and-splitting-with-key-value-filter/41143 "2016-02-17T04:51:51Z")
I am trying logstash to iterate a build status file and map it in to elastic search so that I could find out how much time each build and test consumes and which platform the builds are happening. A sample status logs … --- ## [Apache.log example](https://discuss.elastic.co/t/apache-log-example/41960)
**Author:** [@w0lverine](https://discuss.elastic.co/u/w0lverine)\ **Replies:** 1\ **Last updated:** [February 17, 2016, 4:45am UTC](https://discuss.elastic.co/t/apache-log-example/41960 "2016-02-17T04:45:55Z")
I am trying to have logstash parse through the apache log example. I have randomly succeeded in creating a logstash-$DATE stamp with the example "here and there" and when I do get the logstash-$DATE index it says “no su… --- ## [Logstash 2.2 :sql\_last\_value](https://discuss.elastic.co/t/logstash-2-2-sql-last-value/41942)
**Author:** [@alainc](https://discuss.elastic.co/u/alainc)\ **Replies:** 1\ **Last updated:** [February 16, 2016, 10:35pm UTC](https://discuss.elastic.co/t/logstash-2-2-sql-last-value/41942 "2016-02-16T22:35:43Z")
hi my input jdbc filter is like that file: simple-out.conf input { jdbc { jdbc\_driver\_library =\> "C:/elastic/logstash-2.2.1/bin/ojdbc14.jar" jdbc\_driver\_class =\> "Java::oracle.jdbc.driver.OracleDriver" … --- ## [Passing command line parameters while starting Logstash](https://discuss.elastic.co/t/passing-command-line-parameters-while-starting-logstash/41926)
**Author:** [@gaurav1424](https://discuss.elastic.co/u/gaurav1424)\ **Replies:** 1\ **Last updated:** [February 16, 2016, 9:34pm UTC](https://discuss.elastic.co/t/passing-command-line-parameters-while-starting-logstash/41926 "2016-02-16T21:34:07Z")
Hello All, Is there any was to pass command line arguments while starting logstash ? Current what I do : I start logstash as -\> bin/logstash -f and in config file the parameters which are region specific I add as … [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1188) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1190)