# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1200 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1201 --- ## [How to bind port with Logstash service?](https://discuss.elastic.co/t/how-to-bind-port-with-logstash-service/27635)
**Author:** [@thyfere](https://discuss.elastic.co/u/thyfere)\ **Replies:** 10\ **Last updated:** [January 20, 2016, 6:35pm UTC](https://discuss.elastic.co/t/how-to-bind-port-with-logstash-service/27635 "2016-01-20T18:35:26Z")
Hi, I hope everyone is doing great. I am very new to ELK stack and deploying it on two virtual machines. One is for Logstash and the other is for Kibana and Elastic search. OS is Windows Server 2012 R2. I am setting… --- ## [Since Logstash 2.1.1 I am seeing the error 'undefined method close for #\ **Author:** [@jamtur01](https://discuss.elastic.co/u/jamtur01)\ **Replies:** 6\ **Last updated:** [January 20, 2016, 4:08pm UTC](https://discuss.elastic.co/t/since-logstash-2-1-1-i-am-seeing-the-error-undefined-method-close-for-manticore-client-when-ls-starts/36943 "2016-01-20T16:08:24Z") Since i upgraded to Logstash 2.1.1 I am seeing the following when LS starts: {:timestamp=\>"2015-12-11T06:01:55.371000+0000", :message=\>"undefined method close' for #", :class=\>"NoMethodError", :backtrace=\>\["/opt/logsta… --- ## [Issue with getting rspec test output to use Junit XML format](https://discuss.elastic.co/t/issue-with-getting-rspec-test-output-to-use-junit-xml-format/39665)
**Author:** [@amtux](https://discuss.elastic.co/u/amtux)\ **Replies:** 0\ **Last updated:** [January 20, 2016, 2:27pm UTC](https://discuss.elastic.co/t/issue-with-getting-rspec-test-output-to-use-junit-xml-format/39665 "2016-01-20T14:27:12Z")
I'm trying to install a rspec\_junit\_formatter gem to write rspec output to file as JUnit XML so that Jenkins CI can read the generated XML I'm using an Ubuntu 14.04 docker container and installing Logstash 1.5.2: Insta… --- ## [Reading Old Log files](https://discuss.elastic.co/t/reading-old-log-files/39620)
**Author:** [@novice](https://discuss.elastic.co/u/novice)\ **Replies:** 11\ **Last updated:** [January 20, 2016, 9:37am UTC](https://discuss.elastic.co/t/reading-old-log-files/39620 "2016-01-20T09:37:30Z")
Hi, I have ELK Server setup and the logstash keeps reading the old files along with the new ones. How can I prevent that? --- ## [Logstash maximum log rate](https://discuss.elastic.co/t/logstash-maximum-log-rate/39623)
**Author:** [@Vikran](https://discuss.elastic.co/u/Vikran)\ **Replies:** 4\ **Last updated:** [January 20, 2016, 8:00am UTC](https://discuss.elastic.co/t/logstash-maximum-log-rate/39623 "2016-01-20T08:00:12Z")
Hi team, I am looking at what is maximum log rate logstash can ingest logs at i have got scenario where log rate will be 10k to 20k /sec has anyone got documented maximum log rate supported ? Vik --- ## [Perfmon Data Visualization](https://discuss.elastic.co/t/perfmon-data-visualization/39320)
**Author:** [@Prateek\_Kshtriya](https://discuss.elastic.co/u/Prateek_Kshtriya)\ **Replies:** 3\ **Last updated:** [January 20, 2016, 7:48am UTC](https://discuss.elastic.co/t/perfmon-data-visualization/39320 "2016-01-20T07:48:45Z")
Hi , Please help me plotting graph for CPU ,Memory & other parameters(Y-axis) with time(X-axis). I am not able able to plot the graphs as getting warning for analysed field. Please suggest where I am missing. PFB log… --- ## [One Logstash shipper on windows 2012 frequently keeps crashing](https://discuss.elastic.co/t/one-logstash-shipper-on-windows-2012-frequently-keeps-crashing/39624)
**Author:** [@zpp](https://discuss.elastic.co/u/zpp)\ **Replies:** 0\ **Last updated:** [January 20, 2016, 7:39am UTC](https://discuss.elastic.co/t/one-logstash-shipper-on-windows-2012-frequently-keeps-crashing/39624 "2016-01-20T07:39:05Z")
Hi, I've one Logstash shipper service (Logstash 1.5.6) keeps crashing. Below is the log and configuration. Anyone has any clues? Thanks a lot! The logstash configuration (of course the actual configuration contains… --- ## [Get miss log from server](https://discuss.elastic.co/t/get-miss-log-from-server/39612)
**Author:** [@tatdat](https://discuss.elastic.co/u/tatdat)\ **Replies:** 0\ **Last updated:** [January 20, 2016, 3:10am UTC](https://discuss.elastic.co/t/get-miss-log-from-server/39612 "2016-01-20T03:10:18Z")
I'm using Logstash 2.1.1, ES 2.1.1, Filebeat 1.01, Winlogbeat 1.2.0 nightly build. I'm deploy my system with model : Server (agent) -\> LS-forward -\> RabbitMQ-LS-Indexer-ES I checked log in my server and have 70GB log… --- ## [Logstash.log rotate](https://discuss.elastic.co/t/logstash-log-rotate/39606)
**Author:** [@sripri](https://discuss.elastic.co/u/sripri)\ **Replies:** 1\ **Last updated:** [January 20, 2016, 12:38am UTC](https://discuss.elastic.co/t/logstash-log-rotate/39606 "2016-01-20T00:38:07Z")
This is an oft repeated question with several answers. How to rotate logstash.log? I have not turned verbosity on. Yet the logs are massive. I have set the codec to dots and yet I see all of the logs in full json. A… --- ## [Count of DeDuplicated Message from Logstash in ElasticSearch](https://discuss.elastic.co/t/count-of-deduplicated-message-from-logstash-in-elasticsearch/39608)
**Author:** [@rahulnadella](https://discuss.elastic.co/u/rahulnadella)\ **Replies:** 0\ **Last updated:** [January 20, 2016, 12:32am UTC](https://discuss.elastic.co/t/count-of-deduplicated-message-from-logstash-in-elasticsearch/39608 "2016-01-20T00:32:50Z")
Currently using ElasticSearch 2.1.1, Logstash 2.1.1, and FileBeat 1.0. I have implemented the document\_id and am wondering if it is possible to keep track of the count of these records. I am planning on having anot… --- ## [Logstash server read data from resturl](https://discuss.elastic.co/t/logstash-server-read-data-from-resturl/38976)
**Author:** [@mayank\_verma](https://discuss.elastic.co/u/mayank_verma)\ **Replies:** 7\ **Last updated:** [January 19, 2016, 9:09pm UTC](https://discuss.elastic.co/t/logstash-server-read-data-from-resturl/38976 "2016-01-19T21:09:07Z")
I want to read data from resturl and feed that in logstash server. i did google and found \[a link\] https://github.com/logstash-plugins/logstash-input-http\_poller Logstash version - logstash-1.4.5-1\_a2bacae.noarch plugi… --- ## [How to get filename from AWS logs via logstash](https://discuss.elastic.co/t/how-to-get-filename-from-aws-logs-via-logstash/39367)
**Author:** [@subbu.nv](https://discuss.elastic.co/u/subbu.nv)\ **Replies:** 1\ **Last updated:** [January 19, 2016, 7:52pm UTC](https://discuss.elastic.co/t/how-to-get-filename-from-aws-logs-via-logstash/39367 "2016-01-19T19:52:16Z")
Here is my logstah configuration file. can some one help on how to get the logfile name with AWS path. input { s3 { access\_key\_id =\> "accesscode" bucket =\> "bucket" region =\> "location" secret\_a… --- ## [Receiving Multicast syslog data](https://discuss.elastic.co/t/receiving-multicast-syslog-data/39582)
**Author:** [@wblair](https://discuss.elastic.co/u/wblair)\ **Replies:** 0\ **Last updated:** [January 19, 2016, 6:42pm UTC](https://discuss.elastic.co/t/receiving-multicast-syslog-data/39582 "2016-01-19T18:42:06Z")
I am having trouble trying to receive syslog data that is being sent to a multicast address. Current setup is this Ubuntu PC with rsyslogd configured to send syslog data to a multicast address . @239.4.4.4:9211 note … --- ## [Logstash elasticsearch plugin](https://discuss.elastic.co/t/logstash-elasticsearch-plugin/39578)
**Author:** [@venky1987](https://discuss.elastic.co/u/venky1987)\ **Replies:** 0\ **Last updated:** [January 19, 2016, 6:04pm UTC](https://discuss.elastic.co/t/logstash-elasticsearch-plugin/39578 "2016-01-19T18:04:07Z")
Hi, I m trying to use elasticsearch input plugin in logstash (logstash 2.1.1) to aggregate data based on time. A sample logstash config is given below: input { elasticsearch { hosts =\> "localhost" index =\> … --- ## [Logstash drop newyears eve](https://discuss.elastic.co/t/logstash-drop-newyears-eve/38859)
**Author:** [@luuk](https://discuss.elastic.co/u/luuk)\ **Replies:** 3\ **Last updated:** [January 19, 2016, 4:04pm UTC](https://discuss.elastic.co/t/logstash-drop-newyears-eve/38859 "2016-01-19T16:04:50Z")
hey all, on the night of 31-12 to 1-1 i had an insane log drop on my ELK-stack cluster. the cluster exists of 2 elasticsearch clusters 8GB memory each and 1 logstash server 4gb memory. they are recieving syslog messa… --- ## [Mutute Date in CSV](https://discuss.elastic.co/t/mutute-date-in-csv/39524)
**Author:** [@sharan\_jain](https://discuss.elastic.co/u/sharan_jain)\ **Replies:** 5\ **Last updated:** [January 19, 2016, 3:05pm UTC](https://discuss.elastic.co/t/mutute-date-in-csv/39524 "2016-01-19T15:05:17Z")
Hi team , I have data in CSV File with some column as DATE . Since Mutute Doesnot allow date . How can i set type DATE in Filter. Thanks Sharan --- ## [Logstash stops parsing after one entry](https://discuss.elastic.co/t/logstash-stops-parsing-after-one-entry/39539)
**Author:** [@jansest](https://discuss.elastic.co/u/jansest)\ **Replies:** 0\ **Last updated:** [January 19, 2016, 12:25pm UTC](https://discuss.elastic.co/t/logstash-stops-parsing-after-one-entry/39539 "2016-01-19T12:25:38Z")
Hi, I'm new to logstash and I'm having trouble parsing my logfile. Logfile (sanitized) can be found here: http://pastebin.com/6nsSVMQj There are three different types (outbound, inbound and "misc") of log entries in … --- ## [Using translate plugin to speed up grok?](https://discuss.elastic.co/t/using-translate-plugin-to-speed-up-grok/39436)
**Author:** [@Gilad\_Pellaeon](https://discuss.elastic.co/u/Gilad_Pellaeon)\ **Replies:** 7\ **Last updated:** [January 19, 2016, 12:06pm UTC](https://discuss.elastic.co/t/using-translate-plugin-to-speed-up-grok/39436 "2016-01-19T12:06:37Z")
Hi all, I'm trying to get grok to perform better for our firewall logs. Unfortunately, they are ASA firewalls, which means that there are dozens of patterns that every message needs to be matched to - even though the m… --- ## [Throttle filter sends 3x e-mails](https://discuss.elastic.co/t/throttle-filter-sends-3x-e-mails/39468)
**Author:** [@marcmga](https://discuss.elastic.co/u/marcmga)\ **Replies:** 4\ **Last updated:** [January 19, 2016, 10:54am UTC](https://discuss.elastic.co/t/throttle-filter-sends-3x-e-mails/39468 "2016-01-19T10:54:43Z")
Hi, I've created a filter to throttle issolatelly messages from several servers. When the systems receives 50 equal messages from an specific server i add a tag "e-mail". Output sends e-mail when a message have this ta… --- ## [Logstash shipper or filebeat?](https://discuss.elastic.co/t/logstash-shipper-or-filebeat/39445)
**Author:** [@Kishore](https://discuss.elastic.co/u/Kishore)\ **Replies:** 3\ **Last updated:** [January 19, 2016, 7:08am UTC](https://discuss.elastic.co/t/logstash-shipper-or-filebeat/39445 "2016-01-19T07:08:29Z")
We are under the process of upgrading the versions of logstash and elasticsearch. Currently we are using logstash-1.4.2 version. Our project flow is like this " logstash shipper (parse the logs here only) ---\> ( ( redis… --- ## [Grok parse failure after successful debug](https://discuss.elastic.co/t/grok-parse-failure-after-successful-debug/39407)
**Author:** [@Freddy\_Kasprzykowski](https://discuss.elastic.co/u/Freddy_Kasprzykowski)\ **Replies:** 5\ **Last updated:** [January 19, 2016, 6:41am UTC](https://discuss.elastic.co/t/grok-parse-failure-after-successful-debug/39407 "2016-01-19T06:41:38Z")
I have used http://grokdebug.herokuapp.com/ to create the grok match statements based on tcpdump of the syslog strips the ELK box is receiving. However, when checking Kibana, the logs are not parsed. i have used service … --- ## [How to add ip (any specific parameters) to filter in logstash?](https://discuss.elastic.co/t/how-to-add-ip-any-specific-parameters-to-filter-in-logstash/39398)
**Author:** [@Mohamed\_Ibrahim](https://discuss.elastic.co/u/Mohamed_Ibrahim)\ **Replies:** 5\ **Last updated:** [January 18, 2016, 9:39pm UTC](https://discuss.elastic.co/t/how-to-add-ip-any-specific-parameters-to-filter-in-logstash/39398 "2016-01-18T21:39:14Z")
i successfully revived the below masses on my web server 10.29.10.204 - - \[17/Jan/2016:00:12:16 +0300\] "GET /POS-WS-Client/mTopup?uid=\*\*\*\*&password=\*\*\*\*&amount=20&msisdn=012&tid=0 HTTP/1.1" 200 21 actually i need … --- ## [Perfect way to get logs out of windows](https://discuss.elastic.co/t/perfect-way-to-get-logs-out-of-windows/39431)
**Author:** [@elastic-fan](https://discuss.elastic.co/u/elastic-fan)\ **Replies:** 3\ **Last updated:** [January 18, 2016, 9:35pm UTC](https://discuss.elastic.co/t/perfect-way-to-get-logs-out-of-windows/39431 "2016-01-18T21:35:53Z")
hi, i have tried so many things like nxlog,logstash in windows but there are certain areas which i am failing to understand. do we have any guide here to give us a perfect way to send logs out of windows machine? --- ## [Logs from logstash indexer produce abnormal spam](https://discuss.elastic.co/t/logs-from-logstash-indexer-produce-abnormal-spam/37935)
**Author:** [@szemlyanoy](https://discuss.elastic.co/u/szemlyanoy)\ **Replies:** 5\ **Last updated:** [January 18, 2016, 8:07pm UTC](https://discuss.elastic.co/t/logs-from-logstash-indexer-produce-abnormal-spam/37935 "2016-01-18T20:07:12Z")
Dear community, Logstash version 1.5.6 Problem: I have some logstash configs populated cross the fleet as well as on logatash indexer itself. When I simulate error from any agent, event is processed, stored in ES and… --- ## [Need a date parser for my custom date fielsd](https://discuss.elastic.co/t/need-a-date-parser-for-my-custom-date-fielsd/39390)
**Author:** [@bubu.senapati](https://discuss.elastic.co/u/bubu.senapati)\ **Replies:** 2\ **Last updated:** [January 18, 2016, 6:54pm UTC](https://discuss.elastic.co/t/need-a-date-parser-for-my-custom-date-fielsd/39390 "2016-01-18T18:54:05Z")
Hi , I have a custom date-time field like "January 14th 2016, 00:00:00.000". I want to parse it into timestamp field in logstash. Can anybody provide me the pattern that can be used as a pattern to match in a date filte… --- ## [How to know when Logstash finished parsing?](https://discuss.elastic.co/t/how-to-know-when-logstash-finished-parsing/39470)
**Author:** [@Rajeev\_Gaurav](https://discuss.elastic.co/u/Rajeev_Gaurav)\ **Replies:** 1\ **Last updated:** [January 18, 2016, 6:22pm UTC](https://discuss.elastic.co/t/how-to-know-when-logstash-finished-parsing/39470 "2016-01-18T18:22:25Z")
Hi, I am currently working in a program where I need to know whether log stash completely loaded the data or not. For this, I am using an idea in which I want to know the idea of the index before and after some minutes… --- ## [Logstash 2.1.1 - Output to Redis](https://discuss.elastic.co/t/logstash-2-1-1-output-to-redis/39271)
**Author:** [@Ahamed\_Musthafa](https://discuss.elastic.co/u/Ahamed_Musthafa)\ **Replies:** 1\ **Last updated:** [January 18, 2016, 3:47pm UTC](https://discuss.elastic.co/t/logstash-2-1-1-output-to-redis/39271 "2016-01-18T15:47:11Z")
Hello Team, I recently upgraded Logstash to 2.1.1 from 1.4.0. The pipeline works fine with my product, however following errors surfacing in /var/log/logstash/logstash.log. {:timestamp=\>"2016-01-14T17:50:09.683000+00… --- ## [Trouble getting my grok on](https://discuss.elastic.co/t/trouble-getting-my-grok-on/39247)
**Author:** [@Cooker](https://discuss.elastic.co/u/Cooker)\ **Replies:** 5\ **Last updated:** [January 18, 2016, 2:59pm UTC](https://discuss.elastic.co/t/trouble-getting-my-grok-on/39247 "2016-01-18T14:59:31Z")
Hello, I am trying to get a reasonably simple filter for hmail working with logstash but not having much luck so far. An example log line would be: 2016-01-14 16:03:05 sql@contoso.com dba@contoso.com 192.168.31.22… --- ## [Elapsed plugin and multiple files/matches](https://discuss.elastic.co/t/elapsed-plugin-and-multiple-files-matches/39459)
**Author:** [@CPS](https://discuss.elastic.co/u/CPS)\ **Replies:** 0\ **Last updated:** [January 18, 2016, 2:42pm UTC](https://discuss.elastic.co/t/elapsed-plugin-and-multiple-files-matches/39459 "2016-01-18T14:42:07Z")
Hello In logstash config I would like to use elapsed filter to match particular ID which can exist in 3 separate FILES: filter { if (\[path\] =~ "FILEA") { grok{ match =\> \["message","RECEIVED … --- ## [Input file contains tailing buffer - cannot input](https://discuss.elastic.co/t/input-file-contains-tailing-buffer-cannot-input/39421)
**Author:** [@jagfarrell](https://discuss.elastic.co/u/jagfarrell)\ **Replies:** 3\ **Last updated:** [January 18, 2016, 9:49am UTC](https://discuss.elastic.co/t/input-file-contains-tailing-buffer-cannot-input/39421 "2016-01-18T09:49:40Z")
Hi All, I've got a log file from an application which ends with a tailing buffer. When I try to input it into Logstash it doesn't read the file. At the end of each day the log file saves without the buffer and a new lo… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1199) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1201)