# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1199 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1200 --- ## [Logstash Config Issues](https://discuss.elastic.co/t/logstash-config-issues/39883)
**Author:** [@Jackal9301](https://discuss.elastic.co/u/Jackal9301)\ **Replies:** 1\ **Last updated:** [January 23, 2016, 4:51pm UTC](https://discuss.elastic.co/t/logstash-config-issues/39883 "2016-01-23T16:51:43Z")
I used to have a single input to logstash which I then parsed through conditional statements. I am now adding another input that won't apply to any of the prior work. 1. Can I just add tags to the input and add another … --- ## [How to read .7z file using logstash input file plugin](https://discuss.elastic.co/t/how-to-read-7z-file-using-logstash-input-file-plugin/39893)
**Author:** [@Kaleeswaran\_Karruppu](https://discuss.elastic.co/u/Kaleeswaran_Karruppu)\ **Replies:** 1\ **Last updated:** [January 23, 2016, 4:43pm UTC](https://discuss.elastic.co/t/how-to-read-7z-file-using-logstash-input-file-plugin/39893 "2016-01-23T16:43:10Z")
how to read .7z file using logstash input file plugin --- ## [How to avoid timestamp field getting appeared in Output](https://discuss.elastic.co/t/how-to-avoid-timestamp-field-getting-appeared-in-output/37512)
**Author:** [@gaurav1424](https://discuss.elastic.co/u/gaurav1424)\ **Replies:** 7\ **Last updated:** [January 23, 2016, 4:26pm UTC](https://discuss.elastic.co/t/how-to-avoid-timestamp-field-getting-appeared-in-output/37512 "2016-01-23T16:26:19Z")
Here is my Configuration file: input { tcp { port =\> 5000 #type =\> syslog } udp { port =\> 5000 #type =\> syslog } } filter { grok { match =\> { "message" =\> "%{SYSLOGTIMESTAMP:syslog\_tim… --- ## [Conver String to date (or replace @timestamp) (SOLVED)](https://discuss.elastic.co/t/conver-string-to-date-or-replace-timestamp-solved/32957)
**Author:** [@Jason\_Zheng](https://discuss.elastic.co/u/Jason_Zheng)\ **Replies:** 12\ **Last updated:** [January 23, 2016, 4:16pm UTC](https://discuss.elastic.co/t/conver-string-to-date-or-replace-timestamp-solved/32957 "2016-01-23T16:16:23Z")
Hi All, I would like to convert the "string" to "date" and replace @timestamp or "string" convert to type "date", but it seems does not work, am I missing something following is my logstash conf setting filter { … --- ## [Duplicate log entires](https://discuss.elastic.co/t/duplicate-log-entires/39823)
**Author:** [@Diggy](https://discuss.elastic.co/u/Diggy)\ **Replies:** 2\ **Last updated:** [January 22, 2016, 2:52pm UTC](https://discuss.elastic.co/t/duplicate-log-entires/39823 "2016-01-22T14:52:41Z")
All, I'm getting closer to a well-working ELK. However, I'm seeing duplicate log entries for everything (Windows eventlog, Linux syslog) which, of course, isn't good. What's causing this behavior, and how can I fix i… --- ## [Logstash 1.4 filter not working](https://discuss.elastic.co/t/logstash-1-4-filter-not-working/39825)
**Author:** [@genesis](https://discuss.elastic.co/u/genesis)\ **Replies:** 2\ **Last updated:** [January 22, 2016, 12:54pm UTC](https://discuss.elastic.co/t/logstash-1-4-filter-not-working/39825 "2016-01-22T12:54:34Z")
I am running logstash 1.4.0 and I try to rename site\_name with domaine\_name using the filter but it is not changing the file I am not sure what I am doing wrong. Please help input { file { path =\> "/var/d… --- ## [Reading logs from Unix server with logstash server on windows](https://discuss.elastic.co/t/reading-logs-from-unix-server-with-logstash-server-on-windows/39866)
**Author:** [@shyamank](https://discuss.elastic.co/u/shyamank)\ **Replies:** 2\ **Last updated:** [January 22, 2016, 12:18pm UTC](https://discuss.elastic.co/t/reading-logs-from-unix-server-with-logstash-server-on-windows/39866 "2016-01-22T12:18:52Z")
Hi, Im just getting started with setting up an ELK stack. Currently my logstash server running on windows reads log files on the local machine and populates the elastic search server also running on the same machine. … --- ## [Extracting a value(Integer) from the logs and plotting it in kibana VS time](https://discuss.elastic.co/t/extracting-a-value-integer-from-the-logs-and-plotting-it-in-kibana-vs-time/39861)
**Author:** [@shivam\_singh](https://discuss.elastic.co/u/shivam_singh)\ **Replies:** 3\ **Last updated:** [January 22, 2016, 12:12pm UTC](https://discuss.elastic.co/t/extracting-a-value-integer-from-the-logs-and-plotting-it-in-kibana-vs-time/39861 "2016-01-22T12:12:30Z")
Hi, I am tying to parse logs using grok filters. if \[type\]=="xyz"{ multiline { pattern =\> "^%{SYSLOG5424SD} " negate =\> true what =\> previous } grok{ match =\> { "message" =\> \["%{SYSL… --- ## [I have mulitple views in SQL (Input) and multiple INDEXES in ES (Output). How can I use logstash to deal with them in single config file?](https://discuss.elastic.co/t/i-have-mulitple-views-in-sql-input-and-multiple-indexes-in-es-output-how-can-i-use-logstash-to-deal-with-them-in-single-config-file/39800)
**Author:** [@mrizwan](https://discuss.elastic.co/u/mrizwan)\ **Replies:** 3\ **Last updated:** [January 22, 2016, 12:00pm UTC](https://discuss.elastic.co/t/i-have-mulitple-views-in-sql-input-and-multiple-indexes-in-es-output-how-can-i-use-logstash-to-deal-with-them-in-single-config-file/39800 "2016-01-22T12:00:39Z")
I am new to ES 2.1 and Logstash. I was using \_river before for fetching records from SQL and can handle multiple queries and indexes in it. Now I am using Logstash 2.1 and ES 2.1. The issue is, I am not able to deal… --- ## [File input plugin does not work](https://discuss.elastic.co/t/file-input-plugin-does-not-work/39528)
**Author:** [@punit\_naik1](https://discuss.elastic.co/u/punit_naik1)\ **Replies:** 5\ **Last updated:** [January 21, 2016, 6:27am UTC](https://discuss.elastic.co/t/file-input-plugin-does-not-work/39528 "2016-01-21T06:27:44Z")
I am using logstash-2.1.1 This is my config file: input { file { start\_position =\> "beginning" path =\> "/home/punit/Desktop/1.log" } } output { stdout {codec =\> rubydebug} } And when I run logstash using thi… --- ## [How to read environment variables from logstash?](https://discuss.elastic.co/t/how-to-read-environment-variables-from-logstash/39856)
**Author:** [@punit\_naik1](https://discuss.elastic.co/u/punit_naik1)\ **Replies:** 2\ **Last updated:** [January 22, 2016, 10:42am UTC](https://discuss.elastic.co/t/how-to-read-environment-variables-from-logstash/39856 "2016-01-22T10:42:41Z")
I wanted to read an environment variable so I used the environment filter. This was my config: input {stdin{}} filter{ environment{ add\_metadata\_from\_env =\> {"hadoop" =\> "HADOOP\_HOME"} } } output{stdout{codec=\>r… --- ## [Logstash error "Missing kbn-version header"](https://discuss.elastic.co/t/logstash-error-missing-kbn-version-header/39776)
**Author:** [@poornima](https://discuss.elastic.co/u/poornima)\ **Replies:** 2\ **Last updated:** [January 22, 2016, 10:30am UTC](https://discuss.elastic.co/t/logstash-error-missing-kbn-version-header/39776 "2016-01-22T10:30:30Z")
I am new to ELK and have installed ES 2.1.1, Kibana 4.3.1, Logstash 2.1.1 on Windows. After running Logstash, getting error "Missing kbn-version header" . Attached snapshot of the error seen in logstash and also in… --- ## [Multiple configuration files not working as expected](https://discuss.elastic.co/t/multiple-configuration-files-not-working-as-expected/36591)
**Author:** [@lookingcloudy](https://discuss.elastic.co/u/lookingcloudy)\ **Replies:** 2\ **Last updated:** [January 22, 2016, 10:29am UTC](https://discuss.elastic.co/t/multiple-configuration-files-not-working-as-expected/36591 "2016-01-22T10:29:26Z")
I have two configuration files. When I try to run together using bin/logstash -f config/\*.conf only one of the configuration files runs. Both files have the same .sql but different SQL connection strings (different dat… --- ## [Runing logstash service with number of config files](https://discuss.elastic.co/t/runing-logstash-service-with-number-of-config-files/24487)
**Author:** [@karasmeitar](https://discuss.elastic.co/u/karasmeitar)\ **Replies:** 4\ **Last updated:** [January 22, 2016, 10:24am UTC](https://discuss.elastic.co/t/runing-logstash-service-with-number-of-config-files/24487 "2016-01-22T10:24:03Z")
Hi All, I'm running logstash as a service on ubuntu machine with 10 different config files.each config get different doc type from different s3 bucket and insert it or delete it from elasticsearch. Yesterday i saw that … --- ## [How to get IP of machine in output?](https://discuss.elastic.co/t/how-to-get-ip-of-machine-in-output/39736)
**Author:** [@punit\_naik1](https://discuss.elastic.co/u/punit_naik1)\ **Replies:** 3\ **Last updated:** [January 22, 2016, 6:51am UTC](https://discuss.elastic.co/t/how-to-get-ip-of-machine-in-output/39736 "2016-01-22T06:51:50Z")
Logstash by default appends hostname in the output. I wanted to append also the IP of that machine. How do I do this? Please help! --- ## [Is it possible to specify data type with the columns in CSV filter?](https://discuss.elastic.co/t/is-it-possible-to-specify-data-type-with-the-columns-in-csv-filter/39588)
**Author:** [@Christopher\_Curzon](https://discuss.elastic.co/u/Christopher_Curzon)\ **Replies:** 5\ **Last updated:** [January 22, 2016, 3:26am UTC](https://discuss.elastic.co/t/is-it-possible-to-specify-data-type-with-the-columns-in-csv-filter/39588 "2016-01-22T03:26:01Z")
This works, of course csv { columns =\> \["mmsi", "status", "datetime", "lat", "long" \] separator =\> "," } But it does not seem possible to add data types. This does not work csv { columns =\> \[ … --- ## [Is it possible to give LS\_HEAP\_SIZE (-Xms and -Xmx) while starting logstash 1.4.2 or .15.2 like elasticsearch?](https://discuss.elastic.co/t/is-it-possible-to-give-ls-heap-size-xms-and-xmx-while-starting-logstash-1-4-2-or-15-2-like-elasticsearch/39493)
**Author:** [@thiruna](https://discuss.elastic.co/u/thiruna)\ **Replies:** 7\ **Last updated:** [January 21, 2016, 10:09pm UTC](https://discuss.elastic.co/t/is-it-possible-to-give-ls-heap-size-xms-and-xmx-while-starting-logstash-1-4-2-or-15-2-like-elasticsearch/39493 "2016-01-21T22:09:25Z")
Hi, Is it possible to give LS\_HEAP\_SIZE (-Xms and -Xmx) while starting logstash 1.4.2 or .15.2 like elasticsearch? instead of changing the logstash.sh (We don't have permission on the logstash installation folder). … --- ## [Rspec tests for logstash 2.1](https://discuss.elastic.co/t/rspec-tests-for-logstash-2-1/39548)
**Author:** [@Rudy\_Gevaert](https://discuss.elastic.co/u/Rudy_Gevaert)\ **Replies:** 3\ **Last updated:** [January 21, 2016, 9:36pm UTC](https://discuss.elastic.co/t/rspec-tests-for-logstash-2-1/39548 "2016-01-21T21:36:32Z")
Hello, I'm trying to write a rspec test for the following filter: filter { if \[type\] == "apache-access" { grok { pattern =\> "%{COMBINEDAPACHELOG}" singles =\> true } date { match =\> \["t… --- ## [Getting geoip to work](https://discuss.elastic.co/t/getting-geoip-to-work/39781)
**Author:** [@Diggy](https://discuss.elastic.co/u/Diggy)\ **Replies:** 4\ **Last updated:** [January 21, 2016, 7:57pm UTC](https://discuss.elastic.co/t/getting-geoip-to-work/39781 "2016-01-21T19:57:39Z")
Hello, all. I want to geoip e.g. apache access log. My logstash-forwarder config looks like this: { "network": { "servers": \[ "192.168.0.213:5044" \], "ssl key": "/etc/ssl/private/logstash-forwarder.key", … --- ## [How to remove a field](https://discuss.elastic.co/t/how-to-remove-a-field/39746)
**Author:** [@sampasei](https://discuss.elastic.co/u/sampasei)\ **Replies:** 1\ **Last updated:** [January 21, 2016, 6:48pm UTC](https://discuss.elastic.co/t/how-to-remove-a-field/39746 "2016-01-21T18:48:04Z")
Hi all, i have a log (txt) file like this one: #fields ts proto trans\_id test test2 1453139999.678755 udp 43124 - - Each field is tab separated. Using a grock filter i can take the field values… --- ## [Logstash forwarder with multiple log source types](https://discuss.elastic.co/t/logstash-forwarder-with-multiple-log-source-types/39801)
**Author:** [@dirtdiver512](https://discuss.elastic.co/u/dirtdiver512)\ **Replies:** 1\ **Last updated:** [January 21, 2016, 6:25pm UTC](https://discuss.elastic.co/t/logstash-forwarder-with-multiple-log-source-types/39801 "2016-01-21T18:25:09Z")
All, I have two log types I am trying to forward using the forwarder. One is a plain log and the other is a json fie. I need to be able to have ELK parse them differently but can not figure out how. For the json fil… --- ## [Shipping gzip files and unzipping them through logstash](https://discuss.elastic.co/t/shipping-gzip-files-and-unzipping-them-through-logstash/39698)
**Author:** [@kmroz](https://discuss.elastic.co/u/kmroz)\ **Replies:** 1\ **Last updated:** [January 21, 2016, 4:09pm UTC](https://discuss.elastic.co/t/shipping-gzip-files-and-unzipping-them-through-logstash/39698 "2016-01-21T16:09:35Z")
Hello, I am using all curent versions of the ELK stack and shipping with log-courier. I am shipping .gz files and they are being shipped but not uncompressed while using the gz\_lines codec. input { courier { port… --- ## [How to parse two different kind of format of log files at same time?](https://discuss.elastic.co/t/how-to-parse-two-different-kind-of-format-of-log-files-at-same-time/39512)
**Author:** [@Chi\_Heng\_Chou](https://discuss.elastic.co/u/Chi_Heng_Chou)\ **Replies:** 4\ **Last updated:** [January 21, 2016, 8:33am UTC](https://discuss.elastic.co/t/how-to-parse-two-different-kind-of-format-of-log-files-at-same-time/39512 "2016-01-21T08:33:04Z")
Hello, I have 2 log files need to parse, which are aaa.log and bbb.log. The contents of log files are different and no specific strings to differentiate both of them. So I add type to differentiate them in input. Howev… --- ## [Logstash jdbc document\_id =\> "%{uid}" problem](https://discuss.elastic.co/t/logstash-jdbc-document-id-uid-problem/35174)
**Author:** [@Marcin\_Kubica](https://discuss.elastic.co/u/Marcin_Kubica)\ **Replies:** 11\ **Last updated:** [January 21, 2016, 5:59am UTC](https://discuss.elastic.co/t/logstash-jdbc-document-id-uid-problem/35174 "2016-01-21T05:59:19Z")
Hi Logstash newbie here :smile: Using logstash 2.0.0 and elastic 2.0.0 I'm trying to follow https://www.elastic.co/blog/logstash-jdbc-input-plugin and MySQL driver. I'm setting in config The data is being read ok-i… --- ## [Log stash is not hitting elastic search for data loading when I am trying load from a string](https://discuss.elastic.co/t/log-stash-is-not-hitting-elastic-search-for-data-loading-when-i-am-trying-load-from-a-string/39678)
**Author:** [@Rajeev\_Gaurav](https://discuss.elastic.co/u/Rajeev_Gaurav)\ **Replies:** 0\ **Last updated:** [January 20, 2016, 4:20pm UTC](https://discuss.elastic.co/t/log-stash-is-not-hitting-elastic-search-for-data-loading-when-i-am-trying-load-from-a-string/39678 "2016-01-20T16:20:33Z")
Hi, I am trying to load data in elastic search using log stash from a string .I am using following command D:\\ELK Software\\logstash-2.1.1\\bin\>logstash -e 'input{ file { start\_position =\> beginning path =\> \["D:\\EL… --- ## [Log4net or Microsoft Enterprise Library Logging to Logstash http Input](https://discuss.elastic.co/t/log4net-or-microsoft-enterprise-library-logging-to-logstash-http-input/39719)
**Author:** [@tommy\_o](https://discuss.elastic.co/u/tommy_o)\ **Replies:** 0\ **Last updated:** [January 21, 2016, 12:32am UTC](https://discuss.elastic.co/t/log4net-or-microsoft-enterprise-library-logging-to-logstash-http-input/39719 "2016-01-21T00:32:34Z")
Hi folks, I'm looking for common strategies to use log4net or Microsoft Enterprise Library to send log events from a C# application to an available logstash http input. The logstash input is no problem, but I'm havin… --- ## [Using Multiline Codec and Grok to collect similar lines](https://discuss.elastic.co/t/using-multiline-codec-and-grok-to-collect-similar-lines/39041)
**Author:** [@krobi64](https://discuss.elastic.co/u/krobi64)\ **Replies:** 6\ **Last updated:** [January 15, 2016, 10:21pm UTC](https://discuss.elastic.co/t/using-multiline-codec-and-grok-to-collect-similar-lines/39041 "2016-01-15T22:21:41Z")
Hi, I'm trying to parse HTTP logs, and I want to collect all of the request headers into a single field. I've used the multiline codec to put all of the lines of a single HTTP request/response into a single message. I… --- ## [Issue with type geo\_pont](https://discuss.elastic.co/t/issue-with-type-geo-pont/39585)
**Author:** [@NiteshBarnwal](https://discuss.elastic.co/u/NiteshBarnwal)\ **Replies:** 8\ **Last updated:** [January 20, 2016, 7:59pm UTC](https://discuss.elastic.co/t/issue-with-type-geo-pont/39585 "2016-01-20T19:59:18Z")
Hi, I am trying to configure multiple logs in a single conf file. Though all things are coming to kibana but geoip fields are as string rather than geo\_point While configuring separate conf file, geo\_point is there and… --- ## [S3 logstah question](https://discuss.elastic.co/t/s3-logstah-question/39695)
**Author:** [@subbu.nv](https://discuss.elastic.co/u/subbu.nv)\ **Replies:** 0\ **Last updated:** [January 20, 2016, 7:45pm UTC](https://discuss.elastic.co/t/s3-logstah-question/39695 "2016-01-20T19:45:18Z")
i am currently having logstash + elastic search in the local linux server and using logstah to index files from S3 bucket , push it to elastic search . S3 bucket (B1) is having thousands of files and when i trigger the … --- ## [Live config reload](https://discuss.elastic.co/t/live-config-reload/39611)
**Author:** [@TigranTsat](https://discuss.elastic.co/u/TigranTsat)\ **Replies:** 6\ **Last updated:** [January 20, 2016, 6:36pm UTC](https://discuss.elastic.co/t/live-config-reload/39611 "2016-01-20T18:36:35Z")
Hello. Looks like currently there is no way for config live reload (please, correct me if I am wrong). And the only option is to shutdown logstash and start it again. In that case, question - how much logs I will loose… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1198) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1200)