# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1198 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1199 --- ## [Grep on input message with json format](https://discuss.elastic.co/t/grep-on-input-message-with-json-format/36221)
**Author:** [@vimalmpatel](https://discuss.elastic.co/u/vimalmpatel)\ **Replies:** 7\ **Last updated:** [January 26, 2016, 3:24pm UTC](https://discuss.elastic.co/t/grep-on-input-message-with-json-format/36221 "2016-01-26T15:24:08Z")
hello my input message is in json format. if i want to use condition to create new tag within jason how would i do that . please correct me if i am wrong. input file record {"applicationID":"12348811","timestamp"… --- ## [SinceDB naming convention](https://discuss.elastic.co/t/sincedb-naming-convention/40066)
**Author:** [@sombilat](https://discuss.elastic.co/u/sombilat)\ **Replies:** 3\ **Last updated:** [January 26, 2016, 2:42pm UTC](https://discuss.elastic.co/t/sincedb-naming-convention/40066 "2016-01-26T14:42:59Z")
Hello! I am a Developer using Elastic technology to parse our log files. I was wondering on how does the .sincedb naming convention work? For example when an index is created, it generates a .sincedb file. I was curi… --- ## [ELK Docker - Logstash doesn't read log file](https://discuss.elastic.co/t/elk-docker-logstash-doesnt-read-log-file/40125)
**Author:** [@aberwag](https://discuss.elastic.co/u/aberwag)\ **Replies:** 0\ **Last updated:** [January 26, 2016, 1:50pm UTC](https://discuss.elastic.co/t/elk-docker-logstash-doesnt-read-log-file/40125 "2016-01-26T13:50:08Z")
Hello, I use ELK on docker (repository) to manage logs on my server bind archive log file if file size == 5Mo (rename queries.log to queries.log0 and create a new file queries.log), after this operation logstash does… --- ## [Syslog Severity and Priority not being parsed by syslog plugin](https://discuss.elastic.co/t/syslog-severity-and-priority-not-being-parsed-by-syslog-plugin/40055)
**Author:** [@avamore](https://discuss.elastic.co/u/avamore)\ **Replies:** 4\ **Last updated:** [January 26, 2016, 1:49pm UTC](https://discuss.elastic.co/t/syslog-severity-and-priority-not-being-parsed-by-syslog-plugin/40055 "2016-01-26T13:49:57Z")
Hi all I've upgrade to Kibana 4.3, which required Elastic 2.3 which required logstash 2.1 After I upgrade to 2.1, the syslog input is no loner parsing out priority, severity and facility properly. I receive the erro… --- ## [Inserting into the same index](https://discuss.elastic.co/t/inserting-into-the-same-index/40112)
**Author:** [@Sreevatsa\_Vadiraj](https://discuss.elastic.co/u/Sreevatsa_Vadiraj)\ **Replies:** 0\ **Last updated:** [January 26, 2016, 11:37am UTC](https://discuss.elastic.co/t/inserting-into-the-same-index/40112 "2016-01-26T11:37:05Z")
This is my logstash config file: input { jdbc { jdbc\_driver\_library =\> "/home/vatsa/logstash/mysql-connector-java-5.1.38-bin.jar" jdbc\_driver\_class =\> "com.mysql.jdbc.Driver" jdbc\_connection\_string =\> "jdbc… --- ## [Can't add a number type for a field](https://discuss.elastic.co/t/cant-add-a-number-type-for-a-field/40105)
**Author:** [@\_Alexwii](https://discuss.elastic.co/u/_Alexwii)\ **Replies:** 1\ **Last updated:** [January 26, 2016, 10:46am UTC](https://discuss.elastic.co/t/cant-add-a-number-type-for-a-field/40105 "2016-01-26T10:46:52Z")
Hello everyone ! After a update of Kibana, the new feature where we can add a color for number is very important for me and my network team. But where i want a add a field type number Kibana think it's a string... … --- ## [When using logstash to index data from MySQL to ElasticSearch,only the first row is being displayed](https://discuss.elastic.co/t/when-using-logstash-to-index-data-from-mysql-to-elasticsearch-only-the-first-row-is-being-displayed/40086)
**Author:** [@Sreevatsa\_Vadiraj](https://discuss.elastic.co/u/Sreevatsa_Vadiraj)\ **Replies:** 4\ **Last updated:** [January 26, 2016, 9:50am UTC](https://discuss.elastic.co/t/when-using-logstash-to-index-data-from-mysql-to-elasticsearch-only-the-first-row-is-being-displayed/40086 "2016-01-26T09:50:02Z")
This is my logstash configuration file: input { jdbc { jdbc\_driver\_library =\> "/home/vatsa/logstash/mysql-connector-java-5.1.38-bin.jar" jdbc\_driver\_class =\> "com.mysql.jdbc.Driver" jd… --- ## [Logstash Not Creating new ES indices](https://discuss.elastic.co/t/logstash-not-creating-new-es-indices/39799)
**Author:** [@ToddL](https://discuss.elastic.co/u/ToddL)\ **Replies:** 10\ **Last updated:** [January 26, 2016, 6:59am UTC](https://discuss.elastic.co/t/logstash-not-creating-new-es-indices/39799 "2016-01-26T06:59:45Z")
I am a novice, if that, at ELK. A former co-worker setup our ELK environment to receive data from several McAfee Firewalls, and it was working until the disk ran out of space. I have at least temporarily resolved the … --- ## [Lumberjack input: the pipeline is blocked, temporary refusing new connection](https://discuss.elastic.co/t/lumberjack-input-the-pipeline-is-blocked-temporary-refusing-new-connection/39829)
**Author:** [@daq](https://discuss.elastic.co/u/daq)\ **Replies:** 7\ **Last updated:** [January 26, 2016, 6:57am UTC](https://discuss.elastic.co/t/lumberjack-input-the-pipeline-is-blocked-temporary-refusing-new-connection/39829 "2016-01-26T06:57:49Z")
We have a simple setup with 4 servers: Logstash (Log receiver) | \\/ Redis (Queue) | \\/ ElasticSearch (Storage) | \\/ Kibana (Viewer) Receiver log is full of similar messages {:timestamp=\>"2016-01-21T15:17:49.408000-08… --- ## [How filebeat collect iis log through grok filter? tags:\_grokparsefailure](https://discuss.elastic.co/t/how-filebeat-collect-iis-log-through-grok-filter-tags--grokparsefailure/40001)
**Author:** [@clifford](https://discuss.elastic.co/u/clifford)\ **Replies:** 4\ **Last updated:** [January 26, 2016, 3:35am UTC](https://discuss.elastic.co/t/how-filebeat-collect-iis-log-through-grok-filter-tags--grokparsefailure/40001 "2016-01-26T03:35:06Z")
I want to use logstash grok collect iis\_log,but I didn't succeed.\[tags:\_grokparsefailure\] my iis\_log format: 2016-01-25 07:54:53 11.11.120.130 GET /Portal/Content/HtmlImageHandler.ashx fid=50ffc09402534d70b17736b7b30… --- ## [Windows NXLOG Connecting but not showing up in ES](https://discuss.elastic.co/t/windows-nxlog-connecting-but-not-showing-up-in-es/39986)
**Author:** [@jnpetty](https://discuss.elastic.co/u/jnpetty)\ **Replies:** 17\ **Last updated:** [January 25, 2016, 6:47pm UTC](https://discuss.elastic.co/t/windows-nxlog-connecting-but-not-showing-up-in-es/39986 "2016-01-25T18:47:08Z")
I am trying to setup my first Windows server to send logs, via NXLOG, to Logstash and having some difficulty. According to the NXLOG log file on my Windows host it is successfully connecting to Logstash. So I think the i… --- ## [Because glob did not work](https://discuss.elastic.co/t/because-glob-did-not-work/40047)
**Author:** [@yahoo](https://discuss.elastic.co/u/yahoo)\ **Replies:** 0\ **Last updated:** [January 25, 2016, 4:52pm UTC](https://discuss.elastic.co/t/because-glob-did-not-work/40047 "2016-01-25T16:52:50Z")
Starting logstash with --debug in Windows after killing logstash the log file keeps growing essence of the message :method=\>"globbedfiles"} because glob did not work only way to stop it is to kill the Windows Jruby… --- ## [JSON Issues](https://discuss.elastic.co/t/json-issues/39769)
**Author:** [@tgdesrochers](https://discuss.elastic.co/u/tgdesrochers)\ **Replies:** 2\ **Last updated:** [January 25, 2016, 4:08pm UTC](https://discuss.elastic.co/t/json-issues/39769 "2016-01-25T16:08:52Z")
I am using the JSON plugin to parse bro logs I have being printed in JSON format. My current setup is: 1. distributed sensor collecting data recording it in logs in JSON format. 2. logstash picks up the logs with the fo… --- ## [Csv filter column names not appearing as fields in the logstash index](https://discuss.elastic.co/t/csv-filter-column-names-not-appearing-as-fields-in-the-logstash-index/40030)
**Author:** [@DK\_3](https://discuss.elastic.co/u/DK_3)\ **Replies:** 1\ **Last updated:** [January 25, 2016, 3:47pm UTC](https://discuss.elastic.co/t/csv-filter-column-names-not-appearing-as-fields-in-the-logstash-index/40030 "2016-01-25T15:47:45Z")
csv { columns =\> \[ "A","B","C" \] separator =\> "," remove\_field =\> \["message"\] } I want to then create a Line Chart with A timestamp o… --- ## [Conditional output to statsd](https://discuss.elastic.co/t/conditional-output-to-statsd/40022)
**Author:** [@tullis](https://discuss.elastic.co/u/tullis)\ **Replies:** 3\ **Last updated:** [January 25, 2016, 1:27pm UTC](https://discuss.elastic.co/t/conditional-output-to-statsd/40022 "2016-01-25T13:27:20Z")
Hi, I'm trying to use logstash (v 1.4.5) to increment a counter in statsd, based on a pattern match in an haproxy httplog file. I am already sending various metrics from each line in the file, but I'm now trying to a… --- ## [Matching a field (exception name) on the second line in a multiline event](https://discuss.elastic.co/t/matching-a-field-exception-name-on-the-second-line-in-a-multiline-event/40016)
**Author:** [@Ilhami\_Visne](https://discuss.elastic.co/u/Ilhami_Visne)\ **Replies:** 3\ **Last updated:** [January 25, 2016, 12:18pm UTC](https://discuss.elastic.co/t/matching-a-field-exception-name-on-the-second-line-in-a-multiline-event/40016 "2016-01-25T12:18:12Z")
I have multiline Log4J logs. The lines after the first are optional. The first line contains the log message and after that is the stacktrace. I want to extract the top exception class name on a stacktrace and it is the … --- ## [ERROR: Mixed source of plugins, you can't mix local \`.gem\` and remote gems](https://discuss.elastic.co/t/error-mixed-source-of-plugins-you-cant-mix-local-gem-and-remote-gems/40019)
**Author:** [@Latha\_P](https://discuss.elastic.co/u/Latha_P)\ **Replies:** 0\ **Last updated:** [January 25, 2016, 11:36am UTC](https://discuss.elastic.co/t/error-mixed-source-of-plugins-you-cant-mix-local-gem-and-remote-gems/40019 "2016-01-25T11:36:15Z")
Hi, when i execute below script plugin install C:\\analysis tools\\logstash-2.1.1\\bin\\logstash-input-mongodb-0.3.0.gem getting error ERROR: Mixed source of plugins, you can't mix local .gem and remote gems in command p… --- ## [Messages always last 2,33 minutes since I put REDIS](https://discuss.elastic.co/t/messages-always-last-2-33-minutes-since-i-put-redis/39907)
**Author:** [@billy6](https://discuss.elastic.co/u/billy6)\ **Replies:** 7\ **Last updated:** [January 25, 2016, 10:47am UTC](https://discuss.elastic.co/t/messages-always-last-2-33-minutes-since-i-put-redis/39907 "2016-01-25T10:47:38Z")
Hello, I changed my log architecture for this one, because I wanted to be able to handle more messages per second, I placed REDIS in one server and another server is taken the messages from there. Now I have a very … --- ## [Grok \ or \](https://discuss.elastic.co/t/grok-something-or-nothing/40011)
**Author:** [@plonka2000](https://discuss.elastic.co/u/plonka2000)\ **Replies:** 0\ **Last updated:** [January 25, 2016, 10:31am UTC](https://discuss.elastic.co/t/grok-something-or-nothing/40011 "2016-01-25T10:31:40Z")
Hi, I'm trying to bruild a grok pattern for a "Quoted String", in particular this is for the request portion of the AWS ELB logs. The problem I'm encountering, and cant seem to figure a way around is that the same po… --- ## [Logstash with redis cluster problem](https://discuss.elastic.co/t/logstash-with-redis-cluster-problem/40002)
**Author:** [@liuzg459](https://discuss.elastic.co/u/liuzg459)\ **Replies:** 4\ **Last updated:** [January 25, 2016, 10:28am UTC](https://discuss.elastic.co/t/logstash-with-redis-cluster-problem/40002 "2016-01-25T10:28:04Z")
Hi there! I want to use redis cluster instant of one instance. here is my framework： logstash shipper -\>redis cluster -\> logstash indexer -\> elasticsearch -\> kibana Here is my redis config: \[root@localhost src\]# ./re… --- ## [Exception: java.lang.ThreadDeath thrown from the UncaughtExceptionHandler in logstash.err](https://discuss.elastic.co/t/exception-java-lang-threaddeath-thrown-from-the-uncaughtexceptionhandler-in-logstash-err/40010)
**Author:** [@Sergey.k](https://discuss.elastic.co/u/Sergey.k)\ **Replies:** 0\ **Last updated:** [January 25, 2016, 10:30am UTC](https://discuss.elastic.co/t/exception-java-lang-threaddeath-thrown-from-the-uncaughtexceptionhandler-in-logstash-err/40010 "2016-01-25T10:30:15Z")
HI. I have a exceptions in logstash.err file Exception: java.lang.ThreadDeath thrown from the UncaughtExceptionHandler in thread "Thread-482" This topic is similar to https://discuss.elastic.co/t/exception-java-lang-t… --- ## [Output IF ELSE configuration error](https://discuss.elastic.co/t/output-if-else-configuration-error/39869)
**Author:** [@logstaszek](https://discuss.elastic.co/u/logstaszek)\ **Replies:** 7\ **Last updated:** [January 25, 2016, 9:37am UTC](https://discuss.elastic.co/t/output-if-else-configuration-error/39869 "2016-01-25T09:37:55Z")
So, this is my output configuration: output { if \[field\] == "ABC" and \[OK\] == "Yes" { elasticsearch { hosts =\> "localhost:9200" user =\> "xxx" password =\> "xxx" index =\> "abc" } } else if \[field\] == "DEF" a… --- ## [Few beginner questions](https://discuss.elastic.co/t/few-beginner-questions/39999)
**Author:** [@avishni](https://discuss.elastic.co/u/avishni)\ **Replies:** 1\ **Last updated:** [January 25, 2016, 8:15am UTC](https://discuss.elastic.co/t/few-beginner-questions/39999 "2016-01-25T08:15:35Z")
hello I have just started using elk and playing with it in a small lab. i gave a few question about using it and about architecture if i want to collect event logs from multiple windows servers in my network, do i nee… --- ## [A middle logstash](https://discuss.elastic.co/t/a-middle-logstash/39980)
**Author:** [@bw57899](https://discuss.elastic.co/u/bw57899)\ **Replies:** 1\ **Last updated:** [January 25, 2016, 7:05am UTC](https://discuss.elastic.co/t/a-middle-logstash/39980 "2016-01-25T07:05:43Z")
We currently have an managed services running on cloud which is not in our control. The application can export log via Logstash forwarder or Fluentd. I need set a middleware in company network to receive these logs, … --- ## [Export logs by splunk to logstash servers](https://discuss.elastic.co/t/export-logs-by-splunk-to-logstash-servers/39714)
**Author:** [@bw57899](https://discuss.elastic.co/u/bw57899)\ **Replies:** 4\ **Last updated:** [January 25, 2016, 12:03am UTC](https://discuss.elastic.co/t/export-logs-by-splunk-to-logstash-servers/39714 "2016-01-25T00:03:48Z")
We have a manage services running by another company which they only export application logs from splunk ( I don't know detail, and guess that's splunk forwarder). We don't allow to install any software on these manage s… --- ## [About host field value](https://discuss.elastic.co/t/about-host-field-value/39970)
**Author:** [@miko370](https://discuss.elastic.co/u/miko370)\ **Replies:** 1\ **Last updated:** [January 24, 2016, 5:37pm UTC](https://discuss.elastic.co/t/about-host-field-value/39970 "2016-01-24T17:37:04Z")
Hi. I am using udp input plugin to listen to syslog messages. The documentation says that the host field is the "The address which logstash will listen on". This is exacly what I need, but instead, host value is the I… --- ## [Use multiple inputs configs w/single logstash instance](https://discuss.elastic.co/t/use-multiple-inputs-configs-w-single-logstash-instance/39912)
**Author:** [@Kaufusihm](https://discuss.elastic.co/u/Kaufusihm)\ **Replies:** 3\ **Last updated:** [January 24, 2016, 3:49am UTC](https://discuss.elastic.co/t/use-multiple-inputs-configs-w-single-logstash-instance/39912 "2016-01-24T03:49:22Z")
Let me quickly define my Elastic stack. I'm currently just working with 3 different types of logs coming from 3 different machines. Goal: I would like to handle all 3 logs w/my current elastic stack. How do I do this? … --- ## [How to convert String timestamp to actual timestamp?](https://discuss.elastic.co/t/how-to-convert-string-timestamp-to-actual-timestamp/39926)
**Author:** [@gaurav1424](https://discuss.elastic.co/u/gaurav1424)\ **Replies:** 2\ **Last updated:** [January 24, 2016, 3:44am UTC](https://discuss.elastic.co/t/how-to-convert-string-timestamp-to-actual-timestamp/39926 "2016-01-24T03:44:23Z")
Hello All, I have such kind of syslog events : Jan 22 14:24:23 mike.local DDP\_Agent\[83\]: Complete - state change from encrypted\_state to encrypted\_state, commandState = encrypt\_commandedState Once I parse using sys… --- ## [Logstahs output with myType](https://discuss.elastic.co/t/logstahs-output-with-mytype/39914)
**Author:** [@Fabio\_Ebner](https://discuss.elastic.co/u/Fabio_Ebner)\ **Replies:** 3\ **Last updated:** [January 23, 2016, 5:22pm UTC](https://discuss.elastic.co/t/logstahs-output-with-mytype/39914 "2016-01-23T17:22:16Z")
I create one index with my mapping for example: { "aliases" : { "imoveislogradouro" : {} }, "mappings" : { "imoveislogradourotype" : { "properties" : { "logradouros" : { … --- ## [Split field in a json event](https://discuss.elastic.co/t/split-field-in-a-json-event/39875)
**Author:** [@golauty](https://discuss.elastic.co/u/golauty)\ **Replies:** 1\ **Last updated:** [January 23, 2016, 4:59pm UTC](https://discuss.elastic.co/t/split-field-in-a-json-event/39875 "2016-01-23T16:59:59Z")
Hi all, how can i split a field in a nested JSON Event? Following message arrives: "\_index": "logstash-2016.01.22", "\_type": "jenkins", "\_id": "AVJo32hNLCqC9e2Mq6d2", "\_score": null, "\_source": { "dat… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1197) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1199)