# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1193 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1194 --- ## [How to Rotate Output log which is processed by logstash](https://discuss.elastic.co/t/how-to-rotate-output-log-which-is-processed-by-logstash/41160)
**Author:** [@ndevathi](https://discuss.elastic.co/u/ndevathi)\ **Replies:** 1\ **Last updated:** [February 9, 2016, 7:38pm UTC](https://discuss.elastic.co/t/how-to-rotate-output-log-which-is-processed-by-logstash/41160 "2016-02-09T19:38:47Z")
HI, I am trying to parse a parent log file and try to store the logs into separate output files based on keyword. Sample code i have used for creating a logstash.conf file can be found below input { file { p… --- ## [How to add fields to event from ruby plugin](https://discuss.elastic.co/t/how-to-add-fields-to-event-from-ruby-plugin/41289)
**Author:** [@jjdepaul](https://discuss.elastic.co/u/jjdepaul)\ **Replies:** 2\ **Last updated:** [February 9, 2016, 7:10pm UTC](https://discuss.elastic.co/t/how-to-add-fields-to-event-from-ruby-plugin/41289 "2016-02-09T19:10:12Z")
My config file accumulates data in the Class variables and does so until it's time to write out the 'aggregated' values into the Event. I don't know how to do that. Here is the code I have, which doesn't work. How do… --- ## [How to combine two file types in logstash](https://discuss.elastic.co/t/how-to-combine-two-file-types-in-logstash/41278)
**Author:** [@nivetha](https://discuss.elastic.co/u/nivetha)\ **Replies:** 1\ **Last updated:** [February 9, 2016, 7:08pm UTC](https://discuss.elastic.co/t/how-to-combine-two-file-types-in-logstash/41278 "2016-02-09T19:08:30Z")
I have two different file types as below file { path =\> "/opt/logsl/test\_log.log\*" #start\_position =\> "beginning" type =\> "test1" } file { path =\> "/opt/lookups/testcsv.csv" start\_position =\> "beginning" … --- ## [How to stop scheduled logstash config and close the logstash pipeline?](https://discuss.elastic.co/t/how-to-stop-scheduled-logstash-config-and-close-the-logstash-pipeline/41204)
**Author:** [@mrizwan](https://discuss.elastic.co/u/mrizwan)\ **Replies:** 1\ **Last updated:** [February 9, 2016, 7:02pm UTC](https://discuss.elastic.co/t/how-to-stop-scheduled-logstash-config-and-close-the-logstash-pipeline/41204 "2016-02-09T19:02:18Z")
I have configured a logstash file in to fetch data from sql and dump it to elasticsearch. I have scheduled this process for every 5 minutes. Now I want to stop this process. Please help how can I stop that process and cl… --- ## [Correct grok pattern?](https://discuss.elastic.co/t/correct-grok-pattern/41090)
**Author:** [@trekr5](https://discuss.elastic.co/u/trekr5)\ **Replies:** 3\ **Last updated:** [February 9, 2016, 6:53pm UTC](https://discuss.elastic.co/t/correct-grok-pattern/41090 "2016-02-09T18:53:36Z")
Hello, I have the following grok pattern: (?\\d{4}/\\d{2}/\\d{2} \\d{2}:\\d{2}:\\d{2}) \[%{DATA:err\_severity}\] (%{NUMBER:pid:int}#%{NUMBER}: \*%{NUMBER}|\*%{NUMBER}) %{DATA:err\_message}(?:, client: (?%{IP}|%{HOSTNAME}))(?:, s… --- ## [Logstash not outputting logs to elasticsearch](https://discuss.elastic.co/t/logstash-not-outputting-logs-to-elasticsearch/41225)
**Author:** [@Gen\_Ohta](https://discuss.elastic.co/u/Gen_Ohta)\ **Replies:** 8\ **Last updated:** [February 9, 2016, 5:47pm UTC](https://discuss.elastic.co/t/logstash-not-outputting-logs-to-elasticsearch/41225 "2016-02-09T17:47:30Z")
Hello, When I set up Elasticsearch, Logstash, Kibana and Filebeat, I used this tutorial. Unfortunately, Logstash is not attempting to output to Elasticsearch at the correct IP address. This is shown in the log messa… --- ## [Logstash works fine when ran localy but when reading data from a NAS and pushing to staging Elasticsearch it errors out](https://discuss.elastic.co/t/logstash-works-fine-when-ran-localy-but-when-reading-data-from-a-nas-and-pushing-to-staging-elasticsearch-it-errors-out/41297)
**Author:** [@techrawther](https://discuss.elastic.co/u/techrawther)\ **Replies:** 0\ **Last updated:** [February 9, 2016, 4:42pm UTC](https://discuss.elastic.co/t/logstash-works-fine-when-ran-localy-but-when-reading-data-from-a-nas-and-pushing-to-staging-elasticsearch-it-errors-out/41297 "2016-02-09T16:42:01Z")
I am getting following error while running logstash which works fine on my local localstash -ElasticSearch instance but fails while reading data from a NAS and pushing to Production instance of elasticsearch.Following is… --- ## [Add directoryname and filename as different field to elasticsearch](https://discuss.elastic.co/t/add-directoryname-and-filename-as-different-field-to-elasticsearch/41181)
**Author:** [@techrawther](https://discuss.elastic.co/u/techrawther)\ **Replies:** 1\ **Last updated:** [February 9, 2016, 4:31pm UTC](https://discuss.elastic.co/t/add-directoryname-and-filename-as-different-field-to-elasticsearch/41181 "2016-02-09T16:31:18Z")
I am using file plugin to read mutiple files in directory . I would like to add file name and directory name as fields. how could I do that. Following is a sample directory structure and content inside it D:/test/sh… --- ## [How to pull a field from an event to another event?](https://discuss.elastic.co/t/how-to-pull-a-field-from-an-event-to-another-event/34235)
**Author:** [@fereshteh](https://discuss.elastic.co/u/fereshteh)\ **Replies:** 2\ **Last updated:** [February 9, 2016, 4:22pm UTC](https://discuss.elastic.co/t/how-to-pull-a-field-from-an-event-to-another-event/34235 "2016-02-09T16:22:49Z")
I am currently working with logs with some of its content looking like this: 00:19:59.771 (07120/evtThread ) TRC\> Cem\< \[Core1\] CALL\_STATE... #S#|Call stats, ongoing calls: 8, handled\_calls: 7304 #S#+--------------… --- ## [Logstash - Level deserialization failed - SOLVED](https://discuss.elastic.co/t/logstash-level-deserialization-failed-solved/40871)
**Author:** [@mturonne](https://discuss.elastic.co/u/mturonne)\ **Replies:** 6\ **Last updated:** [February 9, 2016, 4:20pm UTC](https://discuss.elastic.co/t/logstash-level-deserialization-failed-solved/40871 "2016-02-09T16:20:35Z")
Hello, I am facing a new issue with my Logstash configuration. It follows the previous subject I opened : Log4j SocketAppender. Logstash : tcp input --\> OK, log4j input --\> KO - SOLVED - #20 by wiibaa I am receiving t… --- ## [Logstash (1.5.3) is not able to connect to kafka](https://discuss.elastic.co/t/logstash-1-5-3-is-not-able-to-connect-to-kafka/27611)
**Author:** [@Deb](https://discuss.elastic.co/u/Deb)\ **Replies:** 7\ **Last updated:** [February 9, 2016, 3:55pm UTC](https://discuss.elastic.co/t/logstash-1-5-3-is-not-able-to-connect-to-kafka/27611 "2016-02-09T15:55:51Z")
Hi, I am trying to read some log messages from kafka. Below is my logstash config:- input { kafka { zk\_connect =\> "kafka:2181" group\_id =\> "logstash" topic\_id =\> "logstash\_logs" re… --- ## [\[SOLVED\] Forcing a static year to date timestamps](https://discuss.elastic.co/t/solved-forcing-a-static-year-to-date-timestamps/40963)
**Author:** [@IGarvin](https://discuss.elastic.co/u/IGarvin)\ **Replies:** 3\ **Last updated:** [February 9, 2016, 1:36pm UTC](https://discuss.elastic.co/t/solved-forcing-a-static-year-to-date-timestamps/40963 "2016-02-09T13:36:09Z")
Hi, I'm trying to take a timestamp from a log and force it to use the year 2015 since the log files do not originally include the year. Here's an example log entry: LOG: 06/02 15:24:03:643 1 Check for updates In m… --- ## [Logstash control records](https://discuss.elastic.co/t/logstash-control-records/41251)
**Author:** [@chicco\_95](https://discuss.elastic.co/u/chicco_95)\ **Replies:** 8\ **Last updated:** [February 9, 2016, 12:35pm UTC](https://discuss.elastic.co/t/logstash-control-records/41251 "2016-02-09T12:35:44Z")
hi all, I've got an issue with logstash, hiw can I perform a check on specific indexes in elastic search, so that i can assure the record I am loading (in the pipeline) doesn't already exist on elastic search? thank yo… --- ## [ORDER BY in SQL query for Logstash JDBC Input](https://discuss.elastic.co/t/order-by-in-sql-query-for-logstash-jdbc-input/41252)
**Author:** [@Architha](https://discuss.elastic.co/u/Architha)\ **Replies:** 2\ **Last updated:** [February 9, 2016, 10:44am UTC](https://discuss.elastic.co/t/order-by-in-sql-query-for-logstash-jdbc-input/41252 "2016-02-09T10:44:09Z")
Hi All, When Order by is used in the SQL Query we give as a JDBC input to Logstash , will the order be maintained as we have mentioned in the query ? As of now i see that the document is ordered according to my query … --- ## [Logstash throughput with metrics plugin](https://discuss.elastic.co/t/logstash-throughput-with-metrics-plugin/41265)
**Author:** [@Jordi\_Piriz](https://discuss.elastic.co/u/Jordi_Piriz)\ **Replies:** 0\ **Last updated:** [February 9, 2016, 10:40am UTC](https://discuss.elastic.co/t/logstash-throughput-with-metrics-plugin/41265 "2016-02-09T10:40:35Z")
Hi everybody, I am trying to measure the logstash's throughput with the metrics plugin and I don't understand the results I obtained, can anyone help me? My configuration: forwarders (~6000 events/min) -\> Logstash/RED… --- ## [Date format change](https://discuss.elastic.co/t/date-format-change/40858)
**Author:** [@Prateek\_Kshtriya](https://discuss.elastic.co/u/Prateek_Kshtriya)\ **Replies:** 1\ **Last updated:** [February 9, 2016, 10:25am UTC](https://discuss.elastic.co/t/date-format-change/40858 "2016-02-09T10:25:13Z")
Hi All, Please help me to change the format of date which is pushed in csv through logstash. It is picking up as string :- "GeneratedTime":{"type":"string"} Regards, Prateek Divya --- ## [Manticore::ResolutionFailure error in Logstash](https://discuss.elastic.co/t/manticore-resolutionfailure-error-in-logstash/38574)
**Author:** [@usahitya](https://discuss.elastic.co/u/usahitya)\ **Replies:** 5\ **Last updated:** [February 9, 2016, 10:03am UTC](https://discuss.elastic.co/t/manticore-resolutionfailure-error-in-logstash/38574 "2016-02-09T10:03:14Z")
Hi Community, when I am Running the .conf file in logstash I am getting the error "Address already in use - bind - Address already in use", So I killed the running process and restarted the logstash. once logstas… --- ## [Logstash Configuration File Ordering Does Matter](https://discuss.elastic.co/t/logstash-configuration-file-ordering-does-matter/28840)
**Author:** [@Yarden\_Bar](https://discuss.elastic.co/u/Yarden_Bar)\ **Replies:** 12\ **Last updated:** [February 9, 2016, 9:35am UTC](https://discuss.elastic.co/t/logstash-configuration-file-ordering-does-matter/28840 "2016-02-09T09:35:22Z")
Hi all, I'm running logstash with a couple of -f switches and for some unknown reason, the order of the files does matter: input-filter-output: ~/util/logstash-1.5.4/bin/logstash -f ./conf.d/input-50-email-sending.conf… --- ## [How to make Logstash.bat not wait](https://discuss.elastic.co/t/how-to-make-logstash-bat-not-wait/41230)
**Author:** [@maddipatla](https://discuss.elastic.co/u/maddipatla)\ **Replies:** 1\ **Last updated:** [February 9, 2016, 9:05am UTC](https://discuss.elastic.co/t/how-to-make-logstash-bat-not-wait/41230 "2016-02-09T09:05:44Z")
I want to trigger logstash.bat programmatically from C# code and i do not want the process to wait. How can i make the logstash.bat agent -f xyz to exit. I tried specifying discover\_interval=\>0 and stat\_interval=\>0 … --- ## [Logstash log formatting](https://discuss.elastic.co/t/logstash-log-formatting/41246)
**Author:** [@venkatesh](https://discuss.elastic.co/u/venkatesh)\ **Replies:** 1\ **Last updated:** [February 9, 2016, 8:56am UTC](https://discuss.elastic.co/t/logstash-log-formatting/41246 "2016-02-09T08:56:47Z")
Hi team, i am new to logstash. I installed elastic search, logstash,kibana in one linux server. Iam able to parse the logs to elastic search and able to view in Kibana. My requirement ,i need to see historical data in … --- ## [Please help me to deal with geo\_point in ES 2.1 and logstash 2.1. I am unable to set mapping of location as I use to do in old version using \_river](https://discuss.elastic.co/t/please-help-me-to-deal-with-geo-point-in-es-2-1-and-logstash-2-1-i-am-unable-to-set-mapping-of-location-as-i-use-to-do-in-old-version-using--river/39872)
**Author:** [@mrizwan](https://discuss.elastic.co/u/mrizwan)\ **Replies:** 14\ **Last updated:** [February 9, 2016, 8:22am UTC](https://discuss.elastic.co/t/please-help-me-to-deal-with-geo-point-in-es-2-1-and-logstash-2-1-i-am-unable-to-set-mapping-of-location-as-i-use-to-do-in-old-version-using--river/39872 "2016-02-09T08:22:38Z")
I used ES old versions with \_river to fetch data. For location i do following in mapping "Location": {"type": "geo\_point"}, and my data set , i return location.lat and location.lon. I am unable to set type geo\_p… --- ## [Nonstop Lumberjack pipeline is blocked messages](https://discuss.elastic.co/t/nonstop-lumberjack-pipeline-is-blocked-messages/25246)
**Author:** [@JeremyinNC](https://discuss.elastic.co/u/JeremyinNC)\ **Replies:** 11\ **Last updated:** [February 9, 2016, 8:05am UTC](https://discuss.elastic.co/t/nonstop-lumberjack-pipeline-is-blocked-messages/25246 "2016-02-09T08:05:18Z")
I recently upgraded Logstash from 1.4 to 1.5.1 and now I am constantly seeing the following in my logstash log: {:timestamp=\>"2015-07-09T15:10:03.559000+0000", :message=\>"Lumberjack input: the pipeline is blocked, tem… --- ## [Logstash-input-jdbc plugin](https://discuss.elastic.co/t/logstash-input-jdbc-plugin/38306)
**Author:** [@Architha](https://discuss.elastic.co/u/Architha)\ **Replies:** 5\ **Last updated:** [February 9, 2016, 7:08am UTC](https://discuss.elastic.co/t/logstash-input-jdbc-plugin/38306 "2016-02-09T07:08:56Z")
Hi All, I am trying to install plugins required for Logstash on my Company's desktop(Windows) where the installation of plugins through command prompt is restricted. Just wanted to know how the plugins could be install… --- ## [Logstash/logstash forwarder connection issue](https://discuss.elastic.co/t/logstash-logstash-forwarder-connection-issue/40532)
**Author:** [@DavidL](https://discuss.elastic.co/u/DavidL)\ **Replies:** 5\ **Last updated:** [February 8, 2016, 10:58pm UTC](https://discuss.elastic.co/t/logstash-logstash-forwarder-connection-issue/40532 "2016-02-08T22:58:12Z")
Hello, I am trying to send records using logstash forwarder to logstash instance(dedicated server), then from logstash to elasticsearch(another dedicated server) but got this error from logstash: Lumberjack input: The … --- ## [Logstash PIPE input](https://discuss.elastic.co/t/logstash-pipe-input/41213)
**Author:** [@Joseph\_Schwartz](https://discuss.elastic.co/u/Joseph_Schwartz)\ **Replies:** 3\ **Last updated:** [February 8, 2016, 6:56pm UTC](https://discuss.elastic.co/t/logstash-pipe-input/41213 "2016-02-08T18:56:33Z")
I'm looking for some N00B config examples for input and output to elastic --- ## [Plugin/Add-on to Log browser history with timestamp | HTTPheader](https://discuss.elastic.co/t/plugin-add-on-to-log-browser-history-with-timestamp-httpheader/41210)
**Author:** [@smitjainsj](https://discuss.elastic.co/u/smitjainsj)\ **Replies:** 0\ **Last updated:** [February 8, 2016, 5:18pm UTC](https://discuss.elastic.co/t/plugin-add-on-to-log-browser-history-with-timestamp-httpheader/41210 "2016-02-08T17:18:48Z")
Hello guyz, is there any good plug-in to add on Firefox/chrome to log browser session to a single file & autosave it. I have used several like live http header, httpfox and other but none serves the purpose. What … --- ## [How do you get logstash-forwarder to handle rotating log files?](https://discuss.elastic.co/t/how-do-you-get-logstash-forwarder-to-handle-rotating-log-files/41092)
**Author:** [@dpcrown](https://discuss.elastic.co/u/dpcrown)\ **Replies:** 2\ **Last updated:** [February 8, 2016, 4:13pm UTC](https://discuss.elastic.co/t/how-do-you-get-logstash-forwarder-to-handle-rotating-log-files/41092 "2016-02-08T16:13:04Z")
Hi, so I'm having trouble figuring out how to set up logtash-forwarder to handle log files that rotate, as in, change their name every day and log everything to a new file. We're kind of new to logstash and elasticsearch… --- ## [Telnet Data Feed logstash into elastic](https://discuss.elastic.co/t/telnet-data-feed-logstash-into-elastic/40282)
**Author:** [@Joseph\_Schwartz](https://discuss.elastic.co/u/Joseph_Schwartz)\ **Replies:** 9\ **Last updated:** [February 8, 2016, 4:07pm UTC](https://discuss.elastic.co/t/telnet-data-feed-logstash-into-elastic/40282 "2016-02-08T16:07:36Z")
I'm a N00b to ELK and would like so assistance setting up a data collection from our pbx. it generates reports via socket in a CSV data format via TCP port 2001. How do I setup logstash to connect to the socket and par… --- ## [Logstash on AIX operating system](https://discuss.elastic.co/t/logstash-on-aix-operating-system/41162)
**Author:** [@Navneet\_Mathpal](https://discuss.elastic.co/u/Navneet_Mathpal)\ **Replies:** 1\ **Last updated:** [February 8, 2016, 7:45am UTC](https://discuss.elastic.co/t/logstash-on-aix-operating-system/41162 "2016-02-08T07:45:16Z")
Hi, AS per my understating Logstash / beats does not support any AIX environment. is it correct ? Thanks, Navneet --- ## [Help to choose the right communicatio protocol](https://discuss.elastic.co/t/help-to-choose-the-right-communicatio-protocol/41146)
**Author:** [@sampasei](https://discuss.elastic.co/u/sampasei)\ **Replies:** 1\ **Last updated:** [February 8, 2016, 7:30am UTC](https://discuss.elastic.co/t/help-to-choose-the-right-communicatio-protocol/41146 "2016-02-08T07:30:27Z")
Hi all, i have two Logstash istances on two different servers: they need to communicate each other using a protocol with these features: Lightweighted Encrypted Able to compress data I've thought the beats plugin… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1192) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1194)