# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1196 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1197 --- ## [LS - elasticsearch output conditionals](https://discuss.elastic.co/t/ls-elasticsearch-output-conditionals/40637)
**Author:** [@dustin.liddick](https://discuss.elastic.co/u/dustin.liddick)\ **Replies:** 2\ **Last updated:** [February 1, 2016, 6:06pm UTC](https://discuss.elastic.co/t/ls-elasticsearch-output-conditionals/40637 "2016-02-01T18:06:24Z")
hello: I am having some issues with my LS output conditionals for elasticsearch. I have the following below as my output filter. However when I run a '--configtest' on it, it fails...I am wondering if I have my syntax … --- ## [Using input field for pattern matching](https://discuss.elastic.co/t/using-input-field-for-pattern-matching/40651)
**Author:** [@Dheeraj](https://discuss.elastic.co/u/Dheeraj)\ **Replies:** 1\ **Last updated:** [February 1, 2016, 5:34pm UTC](https://discuss.elastic.co/t/using-input-field-for-pattern-matching/40651 "2016-02-01T17:34:20Z")
Hi, Is it possible to use an input field to match the pattern via multiline/grok filter. For example, following doesn't work : multiline { pattern =\> \[log\_pattern\] negate =\> true what =\> "previous" sourc… --- ## [Multiline codec unexpected line breaks](https://discuss.elastic.co/t/multiline-codec-unexpected-line-breaks/40648)
**Author:** [@Dieter](https://discuss.elastic.co/u/Dieter)\ **Replies:** 0\ **Last updated:** [February 1, 2016, 4:03pm UTC](https://discuss.elastic.co/t/multiline-codec-unexpected-line-breaks/40648 "2016-02-01T16:03:53Z")
Hi all, Using the multiline codec, there appears to be a bug which adds unexpected line breaks to a message when using tcp or stdin as input (possibly other input plugins too) With the help of some coders on github I… --- ## [Date and mutate filter performance](https://discuss.elastic.co/t/date-and-mutate-filter-performance/40638)
**Author:** [@matejzero](https://discuss.elastic.co/u/matejzero)\ **Replies:** 0\ **Last updated:** [February 1, 2016, 2:18pm UTC](https://discuss.elastic.co/t/date-and-mutate-filter-performance/40638 "2016-02-01T14:18:39Z")
Hello, I'm doing a little bit of performance testing and optimizations with my current setup and I'm seeing weird performance drops with mutate and date filter. My setup: Logstash node with 6 CPUs (VM) and I run logs… --- ## [Logstash or redis issue?](https://discuss.elastic.co/t/logstash-or-redis-issue/40600)
**Author:** [@Kishore](https://discuss.elastic.co/u/Kishore)\ **Replies:** 7\ **Last updated:** [February 1, 2016, 10:14am UTC](https://discuss.elastic.co/t/logstash-or-redis-issue/40600 "2016-02-01T10:14:26Z")
Recently i have upgraded to ELK latest version. Every thing worked perfectly for some time. Later logstash shipper syslog events stuck at redis after some time , where as firewall events are flowing normally to logstash … --- ## [Duplicate Events](https://discuss.elastic.co/t/duplicate-events/40546)
**Author:** [@sathishlinux](https://discuss.elastic.co/u/sathishlinux)\ **Replies:** 2\ **Last updated:** [February 1, 2016, 9:41am UTC](https://discuss.elastic.co/t/duplicate-events/40546 "2016-02-01T09:41:30Z")
Hello Forum, I have the following setup (single node): Logstash 2.1.0 + Elasticsearch 2.1.0 + Kibana4 and logstash receiving logs from different sources (nxlog, syslog forward and etc..). I am seeing exactly 9 duplic… --- ## [Reading rolling log files on Win 7 doesn't work](https://discuss.elastic.co/t/reading-rolling-log-files-on-win-7-doesnt-work/40606)
**Author:** [@bongo\_zg](https://discuss.elastic.co/u/bongo_zg)\ **Replies:** 2\ **Last updated:** [February 1, 2016, 7:59am UTC](https://discuss.elastic.co/t/reading-rolling-log-files-on-win-7-doesnt-work/40606 "2016-02-01T07:59:24Z")
I have installed Logstash 2.1.1 on my Win 7 machine and set it up to read a specific folder for log files. But, it appeared I could set it up only to look for a specific file, not to check for the whole folder or some … --- ## [Logstash log4r configuration](https://discuss.elastic.co/t/logstash-log4r-configuration/40611)
**Author:** [@babeesh](https://discuss.elastic.co/u/babeesh)\ **Replies:** 0\ **Last updated:** [February 1, 2016, 7:39am UTC](https://discuss.elastic.co/t/logstash-log4r-configuration/40611 "2016-02-01T07:39:36Z")
Someone please show me an example of log4r configuration for sending logs to logstash. Also logstash configuration for recieving log4r logs. --- ## [Application log file integration](https://discuss.elastic.co/t/application-log-file-integration/40556)
**Author:** [@Sivaprakash\_Shanmuga](https://discuss.elastic.co/u/Sivaprakash_Shanmuga)\ **Replies:** 4\ **Last updated:** [February 1, 2016, 7:17am UTC](https://discuss.elastic.co/t/application-log-file-integration/40556 "2016-02-01T07:17:23Z")
Hi I'm looking for solutions for 2 use cases Is there any plugin for mongo db to logstash? I want to import data into logstash and analyze it. My application written in Python/Django, now Im writing log files into … --- ## [Logstash aggregation filter not working properly](https://discuss.elastic.co/t/logstash-aggregation-filter-not-working-properly/39847)
**Author:** [@nivetha](https://discuss.elastic.co/u/nivetha)\ **Replies:** 2\ **Last updated:** [February 1, 2016, 5:31am UTC](https://discuss.elastic.co/t/logstash-aggregation-filter-not-working-properly/39847 "2016-02-01T05:31:47Z")
I tried aggregating events ,it gets agrregated ,but in my output I get all lines displayed ,aggregatted lines and also the other lines. I want just the aggregated lines alone in my index. input { file { path =\> "/op… --- ## [@timestamp and logstash-output-mongodb](https://discuss.elastic.co/t/timestamp-and-logstash-output-mongodb/40129)
**Author:** [@sampasei](https://discuss.elastic.co/u/sampasei)\ **Replies:** 5\ **Last updated:** [January 30, 2016, 7:19pm UTC](https://discuss.elastic.co/t/timestamp-and-logstash-output-mongodb/40129 "2016-01-30T19:19:27Z")
Hi all, i have a record sent from filebeat and received by logstash: after some filtering (with grock) the record is sent to mongodb. The problem is linked to @timestamp field: "@timestamp" : "\\"2016-01-26T14:26:49.333Z… --- ## [Ganglia Packets as Input in Logstash](https://discuss.elastic.co/t/ganglia-packets-as-input-in-logstash/522)
**Author:** [@ChrisMark](https://discuss.elastic.co/u/ChrisMark)\ **Replies:** 17\ **Last updated:** [January 30, 2016, 7:18pm UTC](https://discuss.elastic.co/t/ganglia-packets-as-input-in-logstash/522 "2016-01-30T19:18:08Z")
Hello guys, i would like to take ganglia packets in Logstash as input. From Logstash documention (http://www.logstash.net/docs/1.4.2/inputs/ganglia) i make that i have to configure my Logstash Server to listen on a por… --- ## [Symbolic link to logstash.log file not working](https://discuss.elastic.co/t/symbolic-link-to-logstash-log-file-not-working/40500)
**Author:** [@trekr5](https://discuss.elastic.co/u/trekr5)\ **Replies:** 1\ **Last updated:** [January 30, 2016, 3:08pm UTC](https://discuss.elastic.co/t/symbolic-link-to-logstash-log-file-not-working/40500 "2016-01-30T15:08:05Z")
Hello, I'm hoping someone can help me with this issue. I've installed logstash 1.5.4 on an amazon linux box and everything works fine. Because this runs in production, the log file /var/log/logstash.log tends to fill… --- ## [@timestamp error on syslog logs](https://discuss.elastic.co/t/timestamp-error-on-syslog-logs/40487)
**Author:** [@zokratez](https://discuss.elastic.co/u/zokratez)\ **Replies:** 4\ **Last updated:** [January 30, 2016, 3:02pm UTC](https://discuss.elastic.co/t/timestamp-error-on-syslog-logs/40487 "2016-01-30T15:02:22Z")
I'm monitoring different logs such Squid, Apache, Nginx, Secure and Message syslogs, Postfix and Dovecot. When the Squid, Apache and Nginx logs arrive the @timestamp time is the same of my PC and Servers times. Otherw… --- ## [Interpreting output of logstash metrics filter](https://discuss.elastic.co/t/interpreting-output-of-logstash-metrics-filter/40284)
**Author:** [@biswajit86](https://discuss.elastic.co/u/biswajit86)\ **Replies:** 4\ **Last updated:** [January 30, 2016, 3:13am UTC](https://discuss.elastic.co/t/interpreting-output-of-logstash-metrics-filter/40284 "2016-01-30T03:13:34Z")
I am trying to understand the output of the logstash metrics filter . I have provided my config below input { beats { port =\> 5044 } } filter { metrics { meter =\> "documents" add\_tag =\> "metric" flush\_interv… --- ## [Cannot use strftime in codecs](https://discuss.elastic.co/t/cannot-use-strftime-in-codecs/40534)
**Author:** [@Florin\_Andrei](https://discuss.elastic.co/u/Florin_Andrei)\ **Replies:** 0\ **Last updated:** [January 30, 2016, 12:18am UTC](https://discuss.elastic.co/t/cannot-use-strftime-in-codecs/40534 "2016-01-30T00:18:48Z")
logstash-2.1.1 I am trying to use this codec to forward logs to a different app, using the tcp output plugin: This is the output config: tcp { codec =\> logio { debug\_output =\> "true" } host =\>… --- ## [Logstash output to ES via ssl](https://discuss.elastic.co/t/logstash-output-to-es-via-ssl/40404)
**Author:** [@mnhan](https://discuss.elastic.co/u/mnhan)\ **Replies:** 5\ **Last updated:** [January 29, 2016, 8:58pm UTC](https://discuss.elastic.co/t/logstash-output-to-es-via-ssl/40404 "2016-01-29T20:58:36Z")
Hi, Are there docs/example of using the ssl options in the es output plugin? I'm setting LS and ES on different hosts. I want to encrypt output from LS to ES. I can't seem to find an docs on using using ssl from LS… --- ## [Seperate ES indexes or Add a new field in logstash](https://discuss.elastic.co/t/seperate-es-indexes-or-add-a-new-field-in-logstash/40476)
**Author:** [@elastic-fan](https://discuss.elastic.co/u/elastic-fan)\ **Replies:** 3\ **Last updated:** [January 29, 2016, 6:32pm UTC](https://discuss.elastic.co/t/seperate-es-indexes-or-add-a-new-field-in-logstash/40476 "2016-01-29T18:32:55Z")
Hi, i am trying to collect logs from 2 different servers which are located far away, should i be creating 2 seperate indexes for each of them in ES or is there a way i can filter the logs coming out of those and add a… --- ## [Logstash ouptput plugin configuration is not working](https://discuss.elastic.co/t/logstash-ouptput-plugin-configuration-is-not-working/40503)
**Author:** [@Kishore](https://discuss.elastic.co/u/Kishore)\ **Replies:** 1\ **Last updated:** [January 29, 2016, 4:52pm UTC](https://discuss.elastic.co/t/logstash-ouptput-plugin-configuration-is-not-working/40503 "2016-01-29T16:52:08Z")
I have update the logstash version form 1.4.2 to 2.1.1, then tried to use template\_overwrite =\> true configuration inside the elasticsearch plugin, but this configuration is not wokring. Below i have mentioned output c… --- ## [Logstash unable to send events to Elasticsearch](https://discuss.elastic.co/t/logstash-unable-to-send-events-to-elasticsearch/40462)
**Author:** [@Kishore](https://discuss.elastic.co/u/Kishore)\ **Replies:** 8\ **Last updated:** [January 29, 2016, 1:29pm UTC](https://discuss.elastic.co/t/logstash-unable-to-send-events-to-elasticsearch/40462 "2016-01-29T13:29:47Z")
I have upgraded the logstash version from 1.4.2 and elasticsearch version from 1.5.0. to 2.1.1 Up gradation was successful, but facing issue while sending events from logstash to Elasticsearch. Logstash is unable to se… --- ## [Centralize LOGS Switches](https://discuss.elastic.co/t/centralize-logs-switches/40472)
**Author:** [@wagnerl](https://discuss.elastic.co/u/wagnerl)\ **Replies:** 3\ **Last updated:** [January 29, 2016, 1:03pm UTC](https://discuss.elastic.co/t/centralize-logs-switches/40472 "2016-01-29T13:03:30Z")
Hello! I am learning to use the logstash, ElasticSearch and Kibana. I plan to centralize logs from multiple switches. Could anyone help me in setup? --- ## [Logstash multiline with incrementation](https://discuss.elastic.co/t/logstash-multiline-with-incrementation/40338)
**Author:** [@adrianolimit](https://discuss.elastic.co/u/adrianolimit)\ **Replies:** 2\ **Last updated:** [January 29, 2016, 10:49am UTC](https://discuss.elastic.co/t/logstash-multiline-with-incrementation/40338 "2016-01-29T10:49:24Z")
Hi everyone, I'm working on log files and I have a little problem, this is an example of my logs : 192.168.0.1(localhost) (user1) file1 192.168.0.2(localhost) (user2) file2 file3 file2 - read only A new line is… --- ## [Json file parsing not working in logstash using beats](https://discuss.elastic.co/t/json-file-parsing-not-working-in-logstash-using-beats/40242)
**Author:** [@Ganesh2303](https://discuss.elastic.co/u/Ganesh2303)\ **Replies:** 15\ **Last updated:** [January 29, 2016, 7:43am UTC](https://discuss.elastic.co/t/json-file-parsing-not-working-in-logstash-using-beats/40242 "2016-01-29T07:43:47Z")
Hi, I have a log which contain the json as input . when i was using lower version of logstash with logcouier i had processed the json input. But now im using latest version of logstash with beats. In this scenario json i… --- ## [Unrecognized VM option 'TieredStopAtLevel=1'](https://discuss.elastic.co/t/unrecognized-vm-option-tieredstopatlevel-1/40381)
**Author:** [@Christophe\_Dumont](https://discuss.elastic.co/u/Christophe_Dumont)\ **Replies:** 2\ **Last updated:** [January 29, 2016, 7:36am UTC](https://discuss.elastic.co/t/unrecognized-vm-option-tieredstopatlevel-1/40381 "2016-01-29T07:36:10Z")
Hello, I want to install syslog-output plugin, i followed the doc (https://www.elastic.co/guide/en/logstash/current/plugins-outputs-syslog.html#plugins-outputs-syslog-severity) and ran the command bin/plugin install … --- ## [Error with parsing apache access log having @ symbol in auth filed using grok filter:- COMBINEDAPACHELOG](https://discuss.elastic.co/t/error-with-parsing-apache-access-log-having-symbol-in-auth-filed-using-grok-filter-combinedapachelog/40360)
**Author:** [@tushar.sharma](https://discuss.elastic.co/u/tushar.sharma)\ **Replies:** 2\ **Last updated:** [January 29, 2016, 5:32am UTC](https://discuss.elastic.co/t/error-with-parsing-apache-access-log-having-symbol-in-auth-filed-using-grok-filter-combinedapachelog/40360 "2016-01-29T05:32:41Z")
unable to parse:- 8.8.8.8 - abc.def@example.com \[28/Jan/2016:06:19:22 -0600\] "PROPFIND /sssssss/ssssssss.php/ssssssss/ HTTP/1.1" 207 290 "-" "Mozilla/5.0 (Macintosh) mirall/1.8.1" but if we remove @ from abc.def@exa… --- ## [Is there any Web GUI plugin for viewing Lostash activities!](https://discuss.elastic.co/t/is-there-any-web-gui-plugin-for-viewing-lostash-activities/40390)
**Author:** [@mrizwan](https://discuss.elastic.co/u/mrizwan)\ **Replies:** 1\ **Last updated:** [January 29, 2016, 2:04am UTC](https://discuss.elastic.co/t/is-there-any-web-gui-plugin-for-viewing-lostash-activities/40390 "2016-01-29T02:04:31Z")
I have started working on Lostash 2.1. I use to putty to the server and view logstash activities and run or stop config file. Is there any GUI plugin for logstash like we have HEAD in Elasticsearch. --- ## [Logstash talking to rubygems.org during running?](https://discuss.elastic.co/t/logstash-talking-to-rubygems-org-during-running/40424)
**Author:** [@vnagendra](https://discuss.elastic.co/u/vnagendra)\ **Replies:** 2\ **Last updated:** [January 29, 2016, 1:47am UTC](https://discuss.elastic.co/t/logstash-talking-to-rubygems-org-during-running/40424 "2016-01-29T01:47:00Z")
Is there a scenario under which AFTER the configuration files have been checked and plugins are downloaded, logstash would try to talk to rubygems.org? I have logstash version logstash 2.1.0. I have checked the config… --- ## [Grok: logstash package does not include default patterns](https://discuss.elastic.co/t/grok-logstash-package-does-not-include-default-patterns/40297)
**Author:** [@biswajit86](https://discuss.elastic.co/u/biswajit86)\ **Replies:** 6\ **Last updated:** [January 28, 2016, 10:12pm UTC](https://discuss.elastic.co/t/grok-logstash-package-does-not-include-default-patterns/40297 "2016-01-28T22:12:04Z")
Hi, I am currently running logstash-2.1.1 . While using grok patterns, I am not able to get the built-in logstash patterns for grok (like SPACE, NOTSPACE etc by default). As a result I had to download all the patterns… --- ## [Need help on the correct logstash.conf settings for processing a Log4Net file](https://discuss.elastic.co/t/need-help-on-the-correct-logstash-conf-settings-for-processing-a-log4net-file/40335)
**Author:** [@harryw](https://discuss.elastic.co/u/harryw)\ **Replies:** 1\ **Last updated:** [January 28, 2016, 8:51pm UTC](https://discuss.elastic.co/t/need-help-on-the-correct-logstash-conf-settings-for-processing-a-log4net-file/40335 "2016-01-28T20:51:30Z")
Hi All. I need to process a Log4Net file containing the following information; LOG STARTED 2016-01-12 10:05:23,181 2016-01-28 00:00:00,000 \[PhoenixInstance\_Worker-8\] DEBUG UNK0000T RetrieveAcceptorFilesJob - Re… --- ## [Help With Multiple If {} else if {} COnfiguration](https://discuss.elastic.co/t/help-with-multiple-if-else-if-configuration/40417)
**Author:** [@rcuza](https://discuss.elastic.co/u/rcuza)\ **Replies:** 1\ **Last updated:** [January 28, 2016, 8:23pm UTC](https://discuss.elastic.co/t/help-with-multiple-if-else-if-configuration/40417 "2016-01-28T20:23:57Z")
I am seeking help with a Logstash configuration issue. Some of my syslog messages coming into my indexer are in JSON format and some are not. I am solving this using multiple if {} else if {} else {} statements after gro… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1195) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1197)