# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1190 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1191 --- ## [Logstash Official Filter Collection](https://discuss.elastic.co/t/logstash-official-filter-collection/41936)
**Author:** [@doremon](https://discuss.elastic.co/u/doremon)\ **Replies:** 2\ **Last updated:** [February 16, 2016, 8:57pm UTC](https://discuss.elastic.co/t/logstash-official-filter-collection/41936 "2016-02-16T20:57:49Z")
Hi, Is there any official repository of logstash filters for all the most common used technologies like databases, app servers, network devices etc? --- ## [Curl command not working in ES](https://discuss.elastic.co/t/curl-command-not-working-in-es/41900)
**Author:** [@bubu.senapati](https://discuss.elastic.co/u/bubu.senapati)\ **Replies:** 3\ **Last updated:** [February 16, 2016, 3:38pm UTC](https://discuss.elastic.co/t/curl-command-not-working-in-es/41900 "2016-02-16T15:38:43Z")
Hi Magnus, there is an index in my elastic search which i want to close and subsequently delete. The index created is with name falog-%{\[time\_stamp\]} I tried to execute the curl like curl -XPOST 'http://localhost:9200/fa… --- ## [Installed Gem is not recognized during configtest](https://discuss.elastic.co/t/installed-gem-is-not-recognized-during-configtest/40136)
**Author:** [@CamJN](https://discuss.elastic.co/u/CamJN)\ **Replies:** 2\ **Last updated:** [February 16, 2016, 3:13pm UTC](https://discuss.elastic.co/t/installed-gem-is-not-recognized-during-configtest/40136 "2016-02-16T15:13:03Z")
details at: https://github.com/elastic/logstash/issues/4564 --- ## [Logstash upgrade error](https://discuss.elastic.co/t/logstash-upgrade-error/41528)
**Author:** [@met3or](https://discuss.elastic.co/u/met3or)\ **Replies:** 4\ **Last updated:** [February 16, 2016, 2:42pm UTC](https://discuss.elastic.co/t/logstash-upgrade-error/41528 "2016-02-16T14:42:26Z")
Hello, We've had some trouble when upgrading logstash from version 2.1 =\> 2.2. The system we're running on is Ubuntu 14. Following the upgrade, the configuration failed. I had assumed there may be some syntax errors,… --- ## [HSL F5 Sample Grok](https://discuss.elastic.co/t/hsl-f5-sample-grok/41759)
**Author:** [@Ze\_Brodie](https://discuss.elastic.co/u/Ze_Brodie)\ **Replies:** 6\ **Last updated:** [February 16, 2016, 1:27pm UTC](https://discuss.elastic.co/t/hsl-f5-sample-grok/41759 "2016-02-16T13:27:55Z")
Hi there, can anyone help me with this logstash Grok from the sample configuration on the elastic site? so im using the F5 template from the example here https://www.elastic.co/blog/f5-high-speed-logging-with-elastic-s… --- ## [Exit after logstash finish to upload all data](https://discuss.elastic.co/t/exit-after-logstash-finish-to-upload-all-data/41860)
**Author:** [@chenbe2204](https://discuss.elastic.co/u/chenbe2204)\ **Replies:** 2\ **Last updated:** [February 16, 2016, 12:20pm UTC](https://discuss.elastic.co/t/exit-after-logstash-finish-to-upload-all-data/41860 "2016-02-16T12:20:06Z")
Hi , When I'm using this command to upload data to ElasticSearch from Logstash , I'm using this command: bin/logstash -f logstash.conf\_test1 If I want to return to the prompt , I need to press CTRL+C. Can I run the da… --- ## [How to Capture the data from a DB server using a query and visualise in kibana](https://discuss.elastic.co/t/how-to-capture-the-data-from-a-db-server-using-a-query-and-visualise-in-kibana/40349)
**Author:** [@chaitanyap](https://discuss.elastic.co/u/chaitanyap)\ **Replies:** 16\ **Last updated:** [February 16, 2016, 11:54am UTC](https://discuss.elastic.co/t/how-to-capture-the-data-from-a-db-server-using-a-query-and-visualise-in-kibana/40349 "2016-02-16T11:54:48Z")
Hi All, We have requirement to capture the data from a remote DB server using a DB query/table and visualise that metrics into dash board. Is there any step by step procedure available to get it done? Thanks, Chaita… --- ## [Logstash filter](https://discuss.elastic.co/t/logstash-filter/41873)
**Author:** [@Kishore](https://discuss.elastic.co/u/Kishore)\ **Replies:** 0\ **Last updated:** [February 16, 2016, 11:08am UTC](https://discuss.elastic.co/t/logstash-filter/41873 "2016-02-16T11:08:46Z")
I want to capture the events based time period, for example 5 events in 5 mins, which filter can be useful for this scenario. I tried throttle filter 'period' option but that is not opt for my scenario. --- ## [\[Solved\] Problem using LDAP library in custom filter plugin](https://discuss.elastic.co/t/solved-problem-using-ldap-library-in-custom-filter-plugin/41777)
**Author:** [@twnone](https://discuss.elastic.co/u/twnone)\ **Replies:** 2\ **Last updated:** [February 16, 2016, 10:50am UTC](https://discuss.elastic.co/t/solved-problem-using-ldap-library-in-custom-filter-plugin/41777 "2016-02-16T10:50:57Z")
Hi everyone ! I'm running Logstash 2.1.2 inside a docker container. My configuration specifies to read data into a file and indexes data into an ES cluster. I developped a custom filter plugin that queries a LDAP ser… --- ## [Logstash filter to match IP's](https://discuss.elastic.co/t/logstash-filter-to-match-ips/41517)
**Author:** [@Kishore](https://discuss.elastic.co/u/Kishore)\ **Replies:** 3\ **Last updated:** [February 16, 2016, 10:46am UTC](https://discuss.elastic.co/t/logstash-filter-to-match-ips/41517 "2016-02-16T10:46:33Z")
How to drop the events which are having the source IP with 10...\*\* (starts with 10 series). I have tried the below code by using regular expression but it is not working, kindly help me to find the correct solution. f… --- ## [How to build logstash into a jar](https://discuss.elastic.co/t/how-to-build-logstash-into-a-jar/29617)
**Author:** [@neutronsharc](https://discuss.elastic.co/u/neutronsharc)\ **Replies:** 2\ **Last updated:** [February 16, 2016, 9:18am UTC](https://discuss.elastic.co/t/how-to-build-logstash-into-a-jar/29617 "2016-02-16T09:18:57Z")
Hi all, I want to build logstash into a jar, and deploy this jar to my cluster. I found "warble" to be able to build jruby code into jar. I managed to get logstash.jar using warble, but when I run the jar file I got t… --- ## [Logstash Tomcat multiline](https://discuss.elastic.co/t/logstash-tomcat-multiline/41861)
**Author:** [@Marcello\_A](https://discuss.elastic.co/u/Marcello_A)\ **Replies:** 0\ **Last updated:** [February 16, 2016, 9:17am UTC](https://discuss.elastic.co/t/logstash-tomcat-multiline/41861 "2016-02-16T09:17:35Z")
Hi All, we moved our testing environment from Logstash 1.x to the latest version 2.2.x and we have to import some multiline events from an Openfire instance. The log entries are single lines and in some case an exception… --- ## [Input File failure with high inode numbes](https://discuss.elastic.co/t/input-file-failure-with-high-inode-numbes/41858)
**Author:** [@MVoelker](https://discuss.elastic.co/u/MVoelker)\ **Replies:** 2\ **Last updated:** [February 16, 2016, 9:06am UTC](https://discuss.elastic.co/t/input-file-failure-with-high-inode-numbes/41858 "2016-02-16T09:06:41Z")
running logstash on RHEL 7 (logstash -2.2.1-1 / java-1.8.0-openjdk) and a very simple configuration: more /etc/logstash/conf.d/\* :::::::::::::: /etc/logstash/conf.d/10-input-messages :::::::::::::: input { file { … --- ## [Not able to extract speciific fields in nested multiline json file](https://discuss.elastic.co/t/not-able-to-extract-speciific-fields-in-nested-multiline-json-file/39222)
**Author:** [@sharath3185](https://discuss.elastic.co/u/sharath3185)\ **Replies:** 1\ **Last updated:** [February 16, 2016, 7:34am UTC](https://discuss.elastic.co/t/not-able-to-extract-speciific-fields-in-nested-multiline-json-file/39222 "2016-02-16T07:34:32Z")
Hi, I have a multiline nested json file in the below format { "info": { "name": "name1", "ip": "12.12.12.12", "jobid": "aaa", }, "ssss": "ssdsdsdsdsdsd", "configure": { … --- ## [Logstash nmap codec @timestamp match](https://discuss.elastic.co/t/logstash-nmap-codec-timestamp-match/41829)
**Author:** [@tyler\_burge](https://discuss.elastic.co/u/tyler_burge)\ **Replies:** 0\ **Last updated:** [February 15, 2016, 11:41pm UTC](https://discuss.elastic.co/t/logstash-nmap-codec-timestamp-match/41829 "2016-02-15T23:41:06Z")
I am using Logstash to input NMAP scan data into Elasticsearch. input{ http{ host =\> "127.0.0.1" port =\> 8000 codec =\> nmap } } filter{ date{ match =\> \[ "start\_time", "ISO8601"\] target =\> "@timestamp" } } … --- ## [UDP listener died](https://discuss.elastic.co/t/udp-listener-died/24489)
**Author:** [@nzHillNet](https://discuss.elastic.co/u/nzHillNet)\ **Replies:** 6\ **Last updated:** [February 15, 2016, 10:34pm UTC](https://discuss.elastic.co/t/udp-listener-died/24489 "2016-02-15T22:34:54Z")
Hi, Logstash version 1.5.1, Elasticsearch vesion 1.6 My ddwrt based switches can only send logs over UDP port 514. I cannot get this to work, and continually get the following error: {:timestamp=\>"2015-06-28T11:5… --- ## [Logstash output to Kafka and ES too much to handle?](https://discuss.elastic.co/t/logstash-output-to-kafka-and-es-too-much-to-handle/41663)
**Author:** [@malonej7](https://discuss.elastic.co/u/malonej7)\ **Replies:** 0\ **Last updated:** [February 12, 2016, 9:39pm UTC](https://discuss.elastic.co/t/logstash-output-to-kafka-and-es-too-much-to-handle/41663 "2016-02-12T21:39:40Z")
Hi I'm trying to get IIS logs to pump through logstash and output to both Kafka and Elasticsearch. IIS logs are coming in through a load balancer with a total of only about 2-4k logs per minute. Logstash runs smoothly … --- ## [\[2.2.0\] CLOSE\_WAIT sockets/file descriptors multiplying until system crash](https://discuss.elastic.co/t/2-2-0-close-wait-sockets-file-descriptors-multiplying-until-system-crash/41235)
**Author:** [@erikanderson753](https://discuss.elastic.co/u/erikanderson753)\ **Replies:** 2\ **Last updated:** [February 15, 2016, 8:25pm UTC](https://discuss.elastic.co/t/2-2-0-close-wait-sockets-file-descriptors-multiplying-until-system-crash/41235 "2016-02-15T20:25:22Z")
We are currently testing out Elasticsearch 2.2.0, Logstash 2.2.0, and Kibana 4.4.0 on Ubuntu 14.04 In the past few days we have begun to have an issue with too many file descriptors being opened with the Logstash proce… --- ## [Logstash forwarder](https://discuss.elastic.co/t/logstash-forwarder/41814)
**Author:** [@bkish1](https://discuss.elastic.co/u/bkish1)\ **Replies:** 1\ **Last updated:** [February 15, 2016, 7:41pm UTC](https://discuss.elastic.co/t/logstash-forwarder/41814 "2016-02-15T19:41:16Z")
I would like to get install log stash forwarder for MS Windows and Netapp filler.what is the procedure. I'm able to get all the Linux syslogs, appericate your help --- ## [Google\_bigquery plugin failure affects logstash process](https://discuss.elastic.co/t/google-bigquery-plugin-failure-affects-logstash-process/41808)
**Author:** [@damartin77](https://discuss.elastic.co/u/damartin77)\ **Replies:** 2\ **Last updated:** [February 15, 2016, 6:41pm UTC](https://discuss.elastic.co/t/google-bigquery-plugin-failure-affects-logstash-process/41808 "2016-02-15T18:41:12Z")
I am running Logstash 2.2.0 with the google\_bigquery community plugin. The bigquery plugin has no error handling and when it encounters a problem it dies taking logstash with it. I start logstash back up and continue on … --- ## [Multiline codec](https://discuss.elastic.co/t/multiline-codec/41260)
**Author:** [@marcmga](https://discuss.elastic.co/u/marcmga)\ **Replies:** 14\ **Last updated:** [February 15, 2016, 5:59pm UTC](https://discuss.elastic.co/t/multiline-codec/41260 "2016-02-15T17:59:56Z")
Hi, I'm using multiline codec in my input configuration in order to merge lines in one "message". This lines are from a tomcat log. But as most of times it works, others doesn't. It mix logs from other "non-tomcat" log… --- ## [Read list within logstash configuration (translate plugin)](https://discuss.elastic.co/t/read-list-within-logstash-configuration-translate-plugin/41387)
**Author:** [@Holeun\_Lee](https://discuss.elastic.co/u/Holeun_Lee)\ **Replies:** 3\ **Last updated:** [February 15, 2016, 4:46pm UTC](https://discuss.elastic.co/t/read-list-within-logstash-configuration-translate-plugin/41387 "2016-02-15T16:46:31Z")
Hi guys, I have been working with the ELK stack with great succes for a project! really thanks for the great stuff! Recently, I would like to try have a go with using logstash to read a list of things to compare to, … --- ## [Nats.io "official" support as a move towards a distributed system](https://discuss.elastic.co/t/nats-io-official-support-as-a-move-towards-a-distributed-system/41727)
**Author:** [@molsznski](https://discuss.elastic.co/u/molsznski)\ **Replies:** 1\ **Last updated:** [February 15, 2016, 4:10pm UTC](https://discuss.elastic.co/t/nats-io-official-support-as-a-move-towards-a-distributed-system/41727 "2016-02-15T16:10:44Z")
Howdy Logstash community! I am curious. Are there are any plans to make a nats.io-input-plugin an official plugin for Logstash? Why is this important ? I believe that kafka, rmq, 0mq and inputs like that are of … --- ## [How to progressively update my document](https://discuss.elastic.co/t/how-to-progressively-update-my-document/36575)
**Author:** [@jjdepaul](https://discuss.elastic.co/u/jjdepaul)\ **Replies:** 4\ **Last updated:** [February 15, 2016, 2:57pm UTC](https://discuss.elastic.co/t/how-to-progressively-update-my-document/36575 "2016-02-15T14:57:01Z")
I have LS 2.0.x ES2.0 Shield 2.0 and Kibana 4.2 My configuration reads incoming application log data. The data represents all of the work flow events that our orders go thorugh - a series of pre-defined steps (approx … --- ## [Date filter with timestamp](https://discuss.elastic.co/t/date-filter-with-timestamp/41795)
**Author:** [@techrawther](https://discuss.elastic.co/u/techrawther)\ **Replies:** 1\ **Last updated:** [February 15, 2016, 2:37pm UTC](https://discuss.elastic.co/t/date-filter-with-timestamp/41795 "2016-02-15T14:37:59Z")
Hi, I am having syslogs both in PST and CET timezones. One such example is below. I reads the log using file plugin and add the timestamp to a field named logtimestamp. Everything works fine except when I do date parse… --- ## [MySQL to Elasticsearch](https://discuss.elastic.co/t/mysql-to-elasticsearch/41367)
**Author:** [@Croos](https://discuss.elastic.co/u/Croos)\ **Replies:** 25\ **Last updated:** [February 15, 2016, 1:29pm UTC](https://discuss.elastic.co/t/mysql-to-elasticsearch/41367 "2016-02-15T13:29:31Z")
Please propose a better way to import selected MySQL tables to Elasticsearch using Logstash or similar latest way with examples. I already did the same successfully using my Own PHP script directly without more issue… --- ## [Charon logs](https://discuss.elastic.co/t/charon-logs/41784)
**Author:** [@mr\_rob](https://discuss.elastic.co/u/mr_rob)\ **Replies:** 0\ **Last updated:** [February 15, 2016, 12:56pm UTC](https://discuss.elastic.co/t/charon-logs/41784 "2016-02-15T12:56:49Z")
Anyone got a filter for taking these VPN logs in? --- ## [Parsing ELK logs in logstash](https://discuss.elastic.co/t/parsing-elk-logs-in-logstash/41780)
**Author:** [@mikula](https://discuss.elastic.co/u/mikula)\ **Replies:** 2\ **Last updated:** [February 15, 2016, 12:42pm UTC](https://discuss.elastic.co/t/parsing-elk-logs-in-logstash/41780 "2016-02-15T12:42:20Z")
Hello, I there any guide to parse ELK logs by logstash? I see that those logs are nicely structure and reparsing them by logstash seems to be redundant work. I just to do not want to reinvent wheel. AM --- ## [Duplicate entries after grok](https://discuss.elastic.co/t/duplicate-entries-after-grok/41644)
**Author:** [@moncky](https://discuss.elastic.co/u/moncky)\ **Replies:** 2\ **Last updated:** [February 15, 2016, 12:21pm UTC](https://discuss.elastic.co/t/duplicate-entries-after-grok/41644 "2016-02-15T12:21:14Z")
We have, for reasons, a massive error file that has many different message formats in it. Im just looking to initially get the line into the server, then I should be able to split up the message field after. My config… --- ## [Problem deleting fields or renaming (from filebeat)](https://discuss.elastic.co/t/problem-deleting-fields-or-renaming-from-filebeat/41512)
**Author:** [@marcmga](https://discuss.elastic.co/u/marcmga)\ **Replies:** 6\ **Last updated:** [February 15, 2016, 11:29am UTC](https://discuss.elastic.co/t/problem-deleting-fields-or-renaming-from-filebeat/41512 "2016-02-15T11:29:00Z")
Hello there, I'm configuring filebeat. before i used logstashforwarder. In logstash i'm getting logs BUT, if i set filebeat to add a new fields, i receive it like field.nameIchoose If i use mutate filter to rename tha… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1189) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1191)