# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1204 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1205 --- ## [Logstash output question](https://discuss.elastic.co/t/logstash-output-question/38586)
**Author:** [@chicco\_95](https://discuss.elastic.co/u/chicco_95)\ **Replies:** 6\ **Last updated:** [January 7, 2016, 1:17pm UTC](https://discuss.elastic.co/t/logstash-output-question/38586 "2016-01-07T13:17:41Z")
Hi all, i'd like to know if it's possibile to write some custom text inside of a file, during a csv upload inside elastic search --- ## [Use cases for Weblogic with ELK stack](https://discuss.elastic.co/t/use-cases-for-weblogic-with-elk-stack/38599)
**Author:** [@harshal\_shah](https://discuss.elastic.co/u/harshal_shah)\ **Replies:** 1\ **Last updated:** [January 7, 2016, 12:04pm UTC](https://discuss.elastic.co/t/use-cases-for-weblogic-with-elk-stack/38599 "2016-01-07T12:04:05Z")
I'm evaluating ELK stack to implement log centralization so that developers do not need to log on to unix boxes. All logs should be available on a single GUI tagged with host, JVM name. We already have weblogic JVM mon… --- ## [Logstash is taking more time or hanging](https://discuss.elastic.co/t/logstash-is-taking-more-time-or-hanging/38469)
**Author:** [@amgowda](https://discuss.elastic.co/u/amgowda)\ **Replies:** 8\ **Last updated:** [January 7, 2016, 8:31am UTC](https://discuss.elastic.co/t/logstash-is-taking-more-time-or-hanging/38469 "2016-01-07T08:31:06Z")
Kibana is not showing any drop-down value in 'Time-filed name' RedHat Linux 64 bit, software installed using RPM package java -version java version "1.8.0\_66" Java(TM) SE Runtime Environment (build 1.8.0\_66-b17) Java Hot… --- ## [Logstash pattern not working](https://discuss.elastic.co/t/logstash-pattern-not-working/38479)
**Author:** [@nivetha](https://discuss.elastic.co/u/nivetha)\ **Replies:** 2\ **Last updated:** [January 7, 2016, 5:33am UTC](https://discuss.elastic.co/t/logstash-pattern-not-working/38479 "2016-01-07T05:33:21Z")
I have to match all m3u8 content as hls and others as pdl, but only the else part is working (displaying pdl) Below is my code filter{ if\[Content\] == "\*.m3u8" { mutate { add\_field =\> \[ "TrafficType", "hls" \] … --- ## [Logstash 2.1.1 Fresh ELK Install Errors](https://discuss.elastic.co/t/logstash-2-1-1-fresh-elk-install-errors/38370)
**Author:** [@ninjada](https://discuss.elastic.co/u/ninjada)\ **Replies:** 2\ **Last updated:** [January 7, 2016, 3:12am UTC](https://discuss.elastic.co/t/logstash-2-1-1-fresh-elk-install-errors/38370 "2016-01-07T03:12:24Z")
Hi Guys, Presently updating my ELK stack a few versions behind to new servers running the latest versions. At first I got some error: you might need to reinstall the gem which depends on the missing jar or in case th… --- ## [Upgrade Collectors before Indexers?](https://discuss.elastic.co/t/upgrade-collectors-before-indexers/38530)
**Author:** [@lethalMango](https://discuss.elastic.co/u/lethalMango)\ **Replies:** 2\ **Last updated:** [January 6, 2016, 10:30pm UTC](https://discuss.elastic.co/t/upgrade-collectors-before-indexers/38530 "2016-01-06T22:30:52Z")
I currently have the following setup: Logstash - Collector (1.5) -\> Redis (3.0) -\> Logstash - Indexer (1.5) -\> Elasticsearch (1.5.2) \<- Kibana (4.1) I'm looking to upgrade all to the latest version, however as we… --- ## [Advice needed to index multiple files from logstash to elastic search](https://discuss.elastic.co/t/advice-needed-to-index-multiple-files-from-logstash-to-elastic-search/38548)
**Author:** [@subbu.nv](https://discuss.elastic.co/u/subbu.nv)\ **Replies:** 5\ **Last updated:** [January 6, 2016, 9:35pm UTC](https://discuss.elastic.co/t/advice-needed-to-index-multiple-files-from-logstash-to-elastic-search/38548 "2016-01-06T21:35:52Z")
Hi All, when i index a single file in logstash, as multiple threads are running , the indices pushed to elastic search in also multiple. instead can i control the order of indexing in logstash. For example. i have th… --- ## [Is the tutorial for logstash 2.1.0 incomplete?](https://discuss.elastic.co/t/is-the-tutorial-for-logstash-2-1-0-incomplete/38542)
**Author:** [@Christopher\_Curzon](https://discuss.elastic.co/u/Christopher_Curzon)\ **Replies:** 1\ **Last updated:** [January 6, 2016, 8:19pm UTC](https://discuss.elastic.co/t/is-the-tutorial-for-logstash-2-1-0-incomplete/38542 "2016-01-06T20:19:33Z")
I'm working through the logstash tutorial, for 2.1.0 https://www.elastic.co/guide/en/logstash/current/advanced-pipeline.html which references a logstash-tutorial.log file input { file { path =\> "/path/t… --- ## [Logstash tracking gauge/counter values](https://discuss.elastic.co/t/logstash-tracking-gauge-counter-values/38534)
**Author:** [@mad\_min](https://discuss.elastic.co/u/mad_min)\ **Replies:** 0\ **Last updated:** [January 6, 2016, 6:55pm UTC](https://discuss.elastic.co/t/logstash-tracking-gauge-counter-values/38534 "2016-01-06T18:55:36Z")
Hi List, Is there anyway Logstash can help me with tracking monotonically increasing gauge / counter type values and show the rate of those values (not the rate of the metric, but the value of the metric). I have a nee… --- ## [Rotating indices every few hours - output to elasticsearch](https://discuss.elastic.co/t/rotating-indices-every-few-hours-output-to-elasticsearch/38335)
**Author:** [@jelliott](https://discuss.elastic.co/u/jelliott)\ **Replies:** 3\ **Last updated:** [January 6, 2016, 2:11pm UTC](https://discuss.elastic.co/t/rotating-indices-every-few-hours-output-to-elasticsearch/38335 "2016-01-06T14:11:07Z")
Hi folks, I'm running into an issue using ElasticSearch 1.5 wherein I get heap memory circuit breakers if I use daily indices, but query buffer overrun if I use hourly. So I'd like to split the difference to get a li… --- ## [Logstash multiline Bug](https://discuss.elastic.co/t/logstash-multiline-bug/38483)
**Author:** [@KarouiMourad](https://discuss.elastic.co/u/KarouiMourad)\ **Replies:** 1\ **Last updated:** [January 6, 2016, 11:28am UTC](https://discuss.elastic.co/t/logstash-multiline-bug/38483 "2016-01-06T11:28:34Z")
Hello, I have a problem to parse this type of log : 2015-12-05 20:08:17,689 INFO applicationhistoryservice.ApplicationHistoryServer (LogAdapter.java:info(45)) - STARTUP\_MSG: /\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*… --- ## [Monitoring Log Activity into Logstash](https://discuss.elastic.co/t/monitoring-log-activity-into-logstash/38493)
**Author:** [@Ben19](https://discuss.elastic.co/u/Ben19)\ **Replies:** 1\ **Last updated:** [January 6, 2016, 11:21am UTC](https://discuss.elastic.co/t/monitoring-log-activity-into-logstash/38493 "2016-01-06T11:21:11Z")
Hi, I’m looking for a way to alert ourselves when we are either not receiving logs into logstash or the logs received are not being sent to ES. I could come up with some O/S ways in Linux like inotifywait and maybe … --- ## [Logstash with protobuf](https://discuss.elastic.co/t/logstash-with-protobuf/27450)
**Author:** [@yairtheone](https://discuss.elastic.co/u/yairtheone)\ **Replies:** 1\ **Last updated:** [January 6, 2016, 9:42am UTC](https://discuss.elastic.co/t/logstash-with-protobuf/27450 "2016-01-06T09:42:53Z")
hi , is there plans to support input as protobuf file ? --- ## [Setting Up an Advanced Logstash Pipeline](https://discuss.elastic.co/t/setting-up-an-advanced-logstash-pipeline/38472)
**Author:** [@Architha](https://discuss.elastic.co/u/Architha)\ **Replies:** 5\ **Last updated:** [January 6, 2016, 8:11am UTC](https://discuss.elastic.co/t/setting-up-an-advanced-logstash-pipeline/38472 "2016-01-06T08:11:22Z")
Hi All, I am new to Logstash and i was referring to the document on Setting Up an Advanced Logstash Pipeline (link:https://www.elastic.co/guide/en/logstash/current/advanced-pipeline.html#advanced-pipeline) I have done … --- ## [Logstash config file](https://discuss.elastic.co/t/logstash-config-file/38448)
**Author:** [@matthewjon](https://discuss.elastic.co/u/matthewjon)\ **Replies:** 1\ **Last updated:** [January 5, 2016, 11:58pm UTC](https://discuss.elastic.co/t/logstash-config-file/38448 "2016-01-05T23:58:58Z")
Is there a way to have the logstash config file be served from a http endpoint? I thought I saw somewhere I can centralize the config files...and point the command line to an endpoint. Thanks MD --- ## [Newbie questions about KV filter](https://discuss.elastic.co/t/newbie-questions-about-kv-filter/38446)
**Author:** [@zhangzhehust](https://discuss.elastic.co/u/zhangzhehust)\ **Replies:** 2\ **Last updated:** [January 5, 2016, 11:08pm UTC](https://discuss.elastic.co/t/newbie-questions-about-kv-filter/38446 "2016-01-05T23:08:42Z")
Hi everyone, I am new to the ELK stack. I have logs that look like this: A = B C = D E = F G = H I = J K = L As you can see, each line is a key-value pair. The first three lines are associated together with one … --- ## [UI for Logstash-JDBC-plugin](https://discuss.elastic.co/t/ui-for-logstash-jdbc-plugin/37820)
**Author:** [@srinivas](https://discuss.elastic.co/u/srinivas)\ **Replies:** 2\ **Last updated:** [January 5, 2016, 7:17pm UTC](https://discuss.elastic.co/t/ui-for-logstash-jdbc-plugin/37820 "2016-01-05T19:17:40Z")
Hi, I am using logstash-jdbc plugin for extracting millions of records from DB to ElasticSearch. Is there any UI available for logstash where we can monitor if all the records are getting inserted into ES ? Any issu… --- ## [Feed Data to Elastic Serach Via Logstash using CSV](https://discuss.elastic.co/t/feed-data-to-elastic-serach-via-logstash-using-csv/38400)
**Author:** [@sharan\_jain](https://discuss.elastic.co/u/sharan_jain)\ **Replies:** 3\ **Last updated:** [January 5, 2016, 6:50pm UTC](https://discuss.elastic.co/t/feed-data-to-elastic-serach-via-logstash-using-csv/38400 "2016-01-05T18:50:35Z")
Hi Team , I am using Logstast To read the data from CSV file and Output to Elastic search . Below is Conf File : input { file { path =\> "/opt/app/data/TC\_Export\_CSV.csv" start\_position =\> "beginning" } } filter … --- ## [Match variants of logs](https://discuss.elastic.co/t/match-variants-of-logs/38409)
**Author:** [@lwhitworth](https://discuss.elastic.co/u/lwhitworth)\ **Replies:** 4\ **Last updated:** [January 5, 2016, 4:21pm UTC](https://discuss.elastic.co/t/match-variants-of-logs/38409 "2016-01-05T16:21:57Z")
Hey all, I'm ingesting some logs where the lines start the same (timestamp) and then vary thereafter with multiple fields appearing but in various orders, e.g. File 1: Tue Jan 5 13:01:21 2016 Packet-Type = Access-Req… --- ## [Proxy protocol support for logstash? (ELB and HAProxy for inbound failover)](https://discuss.elastic.co/t/proxy-protocol-support-for-logstash-elb-and-haproxy-for-inbound-failover/38117)
**Author:** [@nneul](https://discuss.elastic.co/u/nneul)\ **Replies:** 5\ **Last updated:** [January 5, 2016, 2:35pm UTC](https://discuss.elastic.co/t/proxy-protocol-support-for-logstash-elb-and-haproxy-for-inbound-failover/38117 "2016-01-05T14:35:36Z")
Is there any way to get proxy protocol support for logstash so that the indexer can see the originating IP/host for the connections if you have logstash sitting behind ELB or HAProxy? --- ## [Logstash 2.1.1 : Routing output to multiple clusters](https://discuss.elastic.co/t/logstash-2-1-1-routing-output-to-multiple-clusters/38165)
**Author:** [@dawiro](https://discuss.elastic.co/u/dawiro)\ **Replies:** 5\ **Last updated:** [January 5, 2016, 9:32am UTC](https://discuss.elastic.co/t/logstash-2-1-1-routing-output-to-multiple-clusters/38165 "2016-01-05T09:32:41Z")
Hi, I have a need to route different message types to different elasticsearch clusters. I realise I could do this by having different "elasticsearch" output blocks separated by "if" conditionals. However, that is wastefu… --- ## [Date format on Logstash](https://discuss.elastic.co/t/date-format-on-logstash/38364)
**Author:** [@tatdat](https://discuss.elastic.co/u/tatdat)\ **Replies:** 2\ **Last updated:** [January 5, 2016, 8:10am UTC](https://discuss.elastic.co/t/date-format-on-logstash/38364 "2016-01-05T08:10:27Z")
I using logstash 2.1.1 and i create format indices on Output Elasticsearch with config \[image\] Before i using format "Name-Indices-YYYY-MM-dd", now i change to weekly format (above image) "Name-Indices-GGGG-WW" but i g… --- ## [How to write custom debugging of logstash](https://discuss.elastic.co/t/how-to-write-custom-debugging-of-logstash/38314)
**Author:** [@chicco\_95](https://discuss.elastic.co/u/chicco_95)\ **Replies:** 2\ **Last updated:** [January 5, 2016, 8:03am UTC](https://discuss.elastic.co/t/how-to-write-custom-debugging-of-logstash/38314 "2016-01-05T08:03:35Z")
Hi all, I should record in the logs of logstash something like : loading date: .... / file name: ..... / lines insede the file: ..... / record loaded: ...... how can I do it ? Thank you --- ## [Grokparsefailure but passes grok debugger](https://discuss.elastic.co/t/grokparsefailure-but-passes-grok-debugger/38377)
**Author:** [@fijimunkii](https://discuss.elastic.co/u/fijimunkii)\ **Replies:** 2\ **Last updated:** [January 5, 2016, 7:07am UTC](https://discuss.elastic.co/t/grokparsefailure-but-passes-grok-debugger/38377 "2016-01-05T07:07:21Z")
Hi, have been at this all night with no luck. Any help would be so appreciated! Jan 5 04:26:13 ip-172-31-58-114 docker/user-repo/test-logs/c2f75d91f17f2d6831faa2283dbd28bc83abc1a1\[13945\]: 04:26:13 index-0 Tue, 05 Jan… --- ## [Host field not present on logstash event](https://discuss.elastic.co/t/host-field-not-present-on-logstash-event/37906)
**Author:** [@thematthewgreen](https://discuss.elastic.co/u/thematthewgreen)\ **Replies:** 1\ **Last updated:** [January 5, 2016, 6:57am UTC](https://discuss.elastic.co/t/host-field-not-present-on-logstash-event/37906 "2016-01-05T06:57:17Z")
Greetings. I am shipping logs from two servers in disparate data centers and utilizing the lumberjack plugin as a means of communication between the two. The communication is working fine (no ssl issues) but when the … --- ## [Parse log referring the information from other services (redis, etc)](https://discuss.elastic.co/t/parse-log-referring-the-information-from-other-services-redis-etc/38363)
**Author:** [@Joo\_Won\_Jung](https://discuss.elastic.co/u/Joo_Won_Jung)\ **Replies:** 1\ **Last updated:** [January 5, 2016, 6:46am UTC](https://discuss.elastic.co/t/parse-log-referring-the-information-from-other-services-redis-etc/38363 "2016-01-05T06:46:07Z")
Is there any way to mutate the log stream or to add more fields using other information from other services? Case 1: add field from redis. Mr. A wants to add "user\_name" information using the "login\_id" in the log. T… --- ## [Offline plugin installation?](https://discuss.elastic.co/t/offline-plugin-installation/29062)
**Author:** [@CraigFoote](https://discuss.elastic.co/u/CraigFoote)\ **Replies:** 6\ **Last updated:** [January 5, 2016, 6:12am UTC](https://discuss.elastic.co/t/offline-plugin-installation/29062 "2016-01-05T06:12:33Z")
I have transferred the http\_poller.gem file to my non-internet-connected intranet machine but when I run plugin install /pathToPlugin it times out trying to connect to the rubygems site. I saw some mention of --local fla… --- ## [Need help with SSL](https://discuss.elastic.co/t/need-help-with-ssl/36212)
**Author:** [@CraigFoote](https://discuss.elastic.co/u/CraigFoote)\ **Replies:** 1\ **Last updated:** [January 4, 2016, 10:20pm UTC](https://discuss.elastic.co/t/need-help-with-ssl/36212 "2016-01-04T22:20:23Z")
I'm using the tcp input plugin to ingest encrypted rsyslog logs but I can't get the SSL option to work. I have ssl\_enable set to true but I'm not sure what to do with the CRT file the owner of the logs provided me with. … --- ## [Handlng microsecond timestamps](https://discuss.elastic.co/t/handlng-microsecond-timestamps/38350)
**Author:** [@bbach](https://discuss.elastic.co/u/bbach)\ **Replies:** 0\ **Last updated:** [January 4, 2016, 10:20pm UTC](https://discuss.elastic.co/t/handlng-microsecond-timestamps/38350 "2016-01-04T22:20:06Z")
Elasticseach search's native timestamp can currently only handle times with millisecond resolution and I know there are people out there looking to store timestamps with as least microsecond (usec) resolution. My wor… --- ## [How to collect logstash logs without filling hard drive?](https://discuss.elastic.co/t/how-to-collect-logstash-logs-without-filling-hard-drive/38345)
**Author:** [@spuder](https://discuss.elastic.co/u/spuder)\ **Replies:** 0\ **Last updated:** [January 4, 2016, 8:15pm UTC](https://discuss.elastic.co/t/how-to-collect-logstash-logs-without-filling-hard-drive/38345 "2016-01-04T20:15:18Z")
Occasionally I get a log message that logstash can't parse. Usually it is because the filename is invalid. Sometimes it is because my elasticsearch mappings are incorrect. I want to collect these logs so I can take a… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1203) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1205)