# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1206 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1207 --- ## [Failed to install template: waited for \[30s\]](https://discuss.elastic.co/t/failed-to-install-template-waited-for-30s/38024)
**Author:** [@Jason\_Zheng](https://discuss.elastic.co/u/Jason_Zheng)\ **Replies:** 6\ **Last updated:** [December 29, 2015, 5:49am UTC](https://discuss.elastic.co/t/failed-to-install-template-waited-for-30s/38024 "2015-12-29T05:49:58Z")
Hi All, My ES (1.7.4) is running well, but when I start logstash (1.5.2), something wrong with my logstash conf? ES Status $curl localhost:9200/\_nodes/process?pretty { "cluster\_name" : "es\_course\_master", "nodes… --- ## [Load balancing logstash](https://discuss.elastic.co/t/load-balancing-logstash/38028)
**Author:** [@Navneet\_Mathpal](https://discuss.elastic.co/u/Navneet_Mathpal)\ **Replies:** 1\ **Last updated:** [December 28, 2015, 10:19pm UTC](https://discuss.elastic.co/t/load-balancing-logstash/38028 "2015-12-28T22:19:26Z")
Hi, how to load balance logstash ? for ex: I have elastic node running on 3 servers , and one of them logstash also running . if any of the es node goes down other becomes master and application still runs fine .. Bu… --- ## [Don't binding name index on Elasticsearch when using RabbitMQ](https://discuss.elastic.co/t/dont-binding-name-index-on-elasticsearch-when-using-rabbitmq/37971)
**Author:** [@tatdat](https://discuss.elastic.co/u/tatdat)\ **Replies:** 5\ **Last updated:** [December 28, 2015, 8:28am UTC](https://discuss.elastic.co/t/dont-binding-name-index-on-elasticsearch-when-using-rabbitmq/37971 "2015-12-28T08:28:54Z")
Hi, I using Message queue RabbitMQ : Client (Using Beat) -\>Logstash (forwarder) -\> RabbitMQ -\> Logstash (Indexer) -\> ES I got errror when i config on Logstash Indexer, Out is ES. But when i see all my indices, new name… --- ## [\[Double\] Don’t binding name index on Elasticsearch when using RabbitMQ Beats](https://discuss.elastic.co/t/double-don-t-binding-name-index-on-elasticsearch-when-using-rabbitmq-beats/38012)
**Author:** [@tatdat](https://discuss.elastic.co/u/tatdat)\ **Replies:** 1\ **Last updated:** [December 28, 2015, 1:37am UTC](https://discuss.elastic.co/t/double-don-t-binding-name-index-on-elasticsearch-when-using-rabbitmq-beats/38012 "2015-12-28T01:37:49Z")
Hi, I using Message queue RabbitMQ : Client (Using Beat) -\>Logstash (forwarder) -\> RabbitMQ -\> Logstash (Indexer) -\> ES I got errror when i config on Logstash Indexer, Out is ES. But when i see all my indices, new nam… --- ## [Where to check the logs which are sent by the filebeat plugin in logstash server?](https://discuss.elastic.co/t/where-to-check-the-logs-which-are-sent-by-the-filebeat-plugin-in-logstash-server/37937)
**Author:** [@kartheek91](https://discuss.elastic.co/u/kartheek91)\ **Replies:** 1\ **Last updated:** [December 27, 2015, 8:10pm UTC](https://discuss.elastic.co/t/where-to-check-the-logs-which-are-sent-by-the-filebeat-plugin-in-logstash-server/37937 "2015-12-27T20:10:18Z")
Please let me where to check the logs which are sent by the filebeat plugin --- ## [Clustered ELK using the puppet modules](https://discuss.elastic.co/t/clustered-elk-using-the-puppet-modules/37964)
**Author:** [@Alex\_Harvey](https://discuss.elastic.co/u/Alex_Harvey)\ **Replies:** 0\ **Last updated:** [December 25, 2015, 4:39am UTC](https://discuss.elastic.co/t/clustered-elk-using-the-puppet-modules/37964 "2015-12-25T04:39:45Z")
Hi all, I have a somewhat daunting task in front of me to build a clustered ELK stack using the available Forge puppet modules. I am prepared to build in and submit PRs for missing features in the puppet modules if r… --- ## [How to prevent logstash output float in scientific notation](https://discuss.elastic.co/t/how-to-prevent-logstash-output-float-in-scientific-notation/37960)
**Author:** [@abcfy2](https://discuss.elastic.co/u/abcfy2)\ **Replies:** 0\ **Last updated:** [December 25, 2015, 1:45am UTC](https://discuss.elastic.co/t/how-to-prevent-logstash-output-float-in-scientific-notation/37960 "2015-12-25T01:45:02Z")
Here is a postgresql slow query: 2015-12-25 09:28:34 CST \[28500-1\] aircare\_root@aircare LOG: duration: 1322.650 ms statement: update sym\_node\_communication set locking\_server\_id= E'shifudaotest', lock\_time= E'2015-12… --- ## [Logstash if statement not working probably](https://discuss.elastic.co/t/logstash-if-statement-not-working-probably/37920)
**Author:** [@davinders](https://discuss.elastic.co/u/davinders)\ **Replies:** 1\ **Last updated:** [December 24, 2015, 11:06pm UTC](https://discuss.elastic.co/t/logstash-if-statement-not-working-probably/37920 "2015-12-24T23:06:00Z")
Continuing the discussion from Grok filter if condition issue: Continuing the discussion from Grok filter if condition issue: I am trying to restrict content/data to go to Elasticsearch if grok not able to parse data… --- ## [Not sure how to get this info into Elasticsearch](https://discuss.elastic.co/t/not-sure-how-to-get-this-info-into-elasticsearch/37575)
**Author:** [@pushmycar](https://discuss.elastic.co/u/pushmycar)\ **Replies:** 1\ **Last updated:** [December 24, 2015, 7:16pm UTC](https://discuss.elastic.co/t/not-sure-how-to-get-this-info-into-elasticsearch/37575 "2015-12-24T19:16:11Z")
So I would like to get info from this site https://basketball.fantasysports.yahoo.com/nba/injuries (yahoo injury report) into elastic search that way I can track it via kibana. What would be the best way to go about it? … --- ## [JDBC input plugin to feed JSON from database table](https://discuss.elastic.co/t/jdbc-input-plugin-to-feed-json-from-database-table/37876)
**Author:** [@chinmoyd](https://discuss.elastic.co/u/chinmoyd)\ **Replies:** 3\ **Last updated:** [December 24, 2015, 4:52pm UTC](https://discuss.elastic.co/t/jdbc-input-plugin-to-feed-json-from-database-table/37876 "2015-12-24T16:52:11Z")
I need to feed JSON data from a PostGreSQL table as input to logstash. For this, I shall use the JDBC input plugin. In Kibana I need to display only selective fields from this JSON. So, somewhere I need to parse this JSO… --- ## [Logstash: Reading a file inside filter/input/output](https://discuss.elastic.co/t/logstash-reading-a-file-inside-filter-input-output/37855)
**Author:** [@krushnat\_khawale](https://discuss.elastic.co/u/krushnat_khawale)\ **Replies:** 6\ **Last updated:** [December 24, 2015, 2:54pm UTC](https://discuss.elastic.co/t/logstash-reading-a-file-inside-filter-input-output/37855 "2015-12-24T14:54:31Z")
I am uploading data from a CSV file and here is Use case. for a column, user can enter description, and I want to group the records in several categories based on description for that I want to add one more column/field … --- ## [Parsing XML with self-closing tags](https://discuss.elastic.co/t/parsing-xml-with-self-closing-tags/31723)
**Author:** [@JW1](https://discuss.elastic.co/u/JW1)\ **Replies:** 1\ **Last updated:** [December 24, 2015, 9:21am UTC](https://discuss.elastic.co/t/parsing-xml-with-self-closing-tags/31723 "2015-12-24T09:21:12Z")
If I use logstash to parse XML with an self-closing tag (e.g. \), it turns it into an empty object instead of an empty string. For example: "parsed" =\> { "foo" =\> \[ \[0\] {} \] } How can I add a con… --- ## [Logstash if statement not working correctly](https://discuss.elastic.co/t/logstash-if-statement-not-working-correctly/37919)
**Author:** [@davinders](https://discuss.elastic.co/u/davinders)\ **Replies:** 0\ **Last updated:** [December 24, 2015, 8:07am UTC](https://discuss.elastic.co/t/logstash-if-statement-not-working-correctly/37919 "2015-12-24T08:07:28Z")
I am trying to restrict content/data to go to elastic search if grok not able to parse data in input.log but seems if "\_grokparsefailure" not in \[tags\] not working. I am parsing some input log and matching some pattern… --- ## [\[Resolved\] Logstash Custom Plugin - Unable to create session to Neo4j within Logstash](https://discuss.elastic.co/t/resolved-logstash-custom-plugin-unable-to-create-session-to-neo4j-within-logstash/37890)
**Author:** [@thehybridtech](https://discuss.elastic.co/u/thehybridtech)\ **Replies:** 1\ **Last updated:** [December 24, 2015, 4:25am UTC](https://discuss.elastic.co/t/resolved-logstash-custom-plugin-unable-to-create-session-to-neo4j-within-logstash/37890 "2015-12-24T04:25:12Z")
I am having issues with a custom plugin and not exactly where to turn. I am building a custom Logstash output plugin to build our Neo4j models. Running the code externally with jruby included with Logstash, I have no … --- ## [Netflow Codec Not Matching Interface from Netflow Export](https://discuss.elastic.co/t/netflow-codec-not-matching-interface-from-netflow-export/37864)
**Author:** [@Stefano\_Pirrello](https://discuss.elastic.co/u/Stefano_Pirrello)\ **Replies:** 2\ **Last updated:** [December 24, 2015, 4:14am UTC](https://discuss.elastic.co/t/netflow-codec-not-matching-interface-from-netflow-export/37864 "2015-12-24T04:14:58Z")
Hi, I've setup ELK for Netflow analysis and overall everything seems to be working fine. The only problem I'm seeing is the Netflow codec is not matching interface information of the router. For instance, I'm not see… --- ## [Is there a way to get messages from MSMQ to Logstash?](https://discuss.elastic.co/t/is-there-a-way-to-get-messages-from-msmq-to-logstash/37867)
**Author:** [@elvarb](https://discuss.elastic.co/u/elvarb)\ **Replies:** 1\ **Last updated:** [December 23, 2015, 10:30pm UTC](https://discuss.elastic.co/t/is-there-a-way-to-get-messages-from-msmq-to-logstash/37867 "2015-12-23T22:30:20Z")
For inhouse developed software in .Net it would be fantastic if they could log to MSMQ and have Logstash parse those messages. Google is turning up blank in getting Logstash to read from MSMQ and that is kind of expected… --- ## [Logging freezes every hour](https://discuss.elastic.co/t/logging-freezes-every-hour/37868)
**Author:** [@Kevin\_Ross](https://discuss.elastic.co/u/Kevin_Ross)\ **Replies:** 2\ **Last updated:** [December 23, 2015, 10:26pm UTC](https://discuss.elastic.co/t/logging-freezes-every-hour/37868 "2015-12-23T22:26:14Z")
Hi, I have noticed in Kibana that every hour nearly on the hour logs stop going into elasticsearch for about 1 minute and then it seems to perhaps to a batch update as they all seem to find they way in as far as I can … --- ## [Logstash: Calling WebService or a program from filters](https://discuss.elastic.co/t/logstash-calling-webservice-or-a-program-from-filters/37760)
**Author:** [@krushnat\_khawale](https://discuss.elastic.co/u/krushnat_khawale)\ **Replies:** 5\ **Last updated:** [December 23, 2015, 6:47pm UTC](https://discuss.elastic.co/t/logstash-calling-webservice-or-a-program-from-filters/37760 "2015-12-23T18:47:04Z")
I am working on logstash to extract data from mysql, as existing filters/plugins lack in doing required operations/transformations I think I need to create a program of my own to do this. My question is, Is it possible… --- ## [Syslog](https://discuss.elastic.co/t/syslog/37841)
**Author:** [@Christophe\_Dumont](https://discuss.elastic.co/u/Christophe_Dumont)\ **Replies:** 6\ **Last updated:** [December 23, 2015, 12:59pm UTC](https://discuss.elastic.co/t/syslog/37841 "2015-12-23T12:59:42Z")
Hello I'm trying to get the syslog messages from a server to another using logstash. The server where the logs come from is 130.190.224.91 (server1) the server where ELK is installed is 130.190.250.82 (elkserver) I'm us… --- ## [Json codec crashing logstash](https://discuss.elastic.co/t/json-codec-crashing-logstash/33680)
**Author:** [@treehouse](https://discuss.elastic.co/u/treehouse)\ **Replies:** 3\ **Last updated:** [December 23, 2015, 12:48pm UTC](https://discuss.elastic.co/t/json-codec-crashing-logstash/33680 "2015-12-23T12:48:32Z")
I have courier input feeding the pipeline. When i try using the tcp output using codec =\> json or codec =\> json\_lines, logstash crashes and spits this error -- LogStash::Json::GeneratorError: Failed to load class 'org… --- ## [How to parse json responses in logs](https://discuss.elastic.co/t/how-to-parse-json-responses-in-logs/37754)
**Author:** [@clandestino\_bgd](https://discuss.elastic.co/u/clandestino_bgd)\ **Replies:** 2\ **Last updated:** [December 23, 2015, 9:03am UTC](https://discuss.elastic.co/t/how-to-parse-json-responses-in-logs/37754 "2015-12-23T09:03:20Z")
Hello, could somebody help me figuring this out? I have the log file (containing server json responses) in the following format {"success":true,"data":{"field1":"value1", "field2":"value2"}} {"success":true,"data":{"fi… --- ## [How can i push the tomcat logs into elasticsearch it is showing grokparsefailure](https://discuss.elastic.co/t/how-can-i-push-the-tomcat-logs-into-elasticsearch-it-is-showing-grokparsefailure/37764)
**Author:** [@Akash\_Katakam](https://discuss.elastic.co/u/Akash_Katakam)\ **Replies:** 2\ **Last updated:** [December 23, 2015, 6:27am UTC](https://discuss.elastic.co/t/how-can-i-push-the-tomcat-logs-into-elasticsearch-it-is-showing-grokparsefailure/37764 "2015-12-23T06:27:55Z")
input { file { path =\> "E:\\wo\\examples\\xxxxxx.log.2015-12-19.log" start\_position =\> "beginning" sincedb\_path =\> "C:\\Users\\Akash katakam\\null" } } filter { grok { match =\> { "message" =\>… --- ## [Logstorm after the Logstashserver become for some time unavailable](https://discuss.elastic.co/t/logstorm-after-the-logstashserver-become-for-some-time-unavailable/37782)
**Author:** [@fred23](https://discuss.elastic.co/u/fred23)\ **Replies:** 3\ **Last updated:** [December 23, 2015, 5:45am UTC](https://discuss.elastic.co/t/logstorm-after-the-logstashserver-become-for-some-time-unavailable/37782 "2015-12-23T05:45:02Z")
Hi, I have a small setup with 20 clients (logstash-forwarder) and 1 logstash,elasticsearch,kibana server. Now the destination server for my logstash-forwarders becomes for some time (2 days) unavailable. After restart … --- ## [How to parse single line for different outputs](https://discuss.elastic.co/t/how-to-parse-single-line-for-different-outputs/37696)
**Author:** [@Igor\_Belykh](https://discuss.elastic.co/u/Igor_Belykh)\ **Replies:** 9\ **Last updated:** [December 22, 2015, 8:19pm UTC](https://discuss.elastic.co/t/how-to-parse-single-line-for-different-outputs/37696 "2015-12-22T20:19:08Z")
Hi, Does somebody know how to parse single line from a file and parse it for different outputs? For example: input is a log file, outputs are elasticsearch indices with different templates. I need to parse every line a… --- ## [Need help in configuring the logstash on windows box](https://discuss.elastic.co/t/need-help-in-configuring-the-logstash-on-windows-box/37690)
**Author:** [@Lokesh\_Kumar](https://discuss.elastic.co/u/Lokesh_Kumar)\ **Replies:** 5\ **Last updated:** [December 22, 2015, 8:07pm UTC](https://discuss.elastic.co/t/need-help-in-configuring-the-logstash-on-windows-box/37690 "2015-12-22T20:07:26Z")
I am new to this can you guide me how to capture the data from /var/log/messages based on some keywords and want to see the messages on dashboard/send an email. steps: 1) need to read the /var/log/messages for keywords… --- ## [Difference between multiline codec and filter?](https://discuss.elastic.co/t/difference-between-multiline-codec-and-filter/37771)
**Author:** [@CraigFoote](https://discuss.elastic.co/u/CraigFoote)\ **Replies:** 1\ **Last updated:** [December 22, 2015, 6:03pm UTC](https://discuss.elastic.co/t/difference-between-multiline-codec-and-filter/37771 "2015-12-22T18:03:19Z")
I'm using the multiline codec in the input section and finding some issues. I just learned there is a multiline filter as well. How does it differ? In particular I have to concatenate discrete log files together as they … --- ## [Broken after upgrade](https://discuss.elastic.co/t/broken-after-upgrade/37634)
**Author:** [@DigiAngel](https://discuss.elastic.co/u/DigiAngel)\ **Replies:** 3\ **Last updated:** [December 22, 2015, 4:06pm UTC](https://discuss.elastic.co/t/broken-after-upgrade/37634 "2015-12-22T16:06:07Z")
Topic says it....I upgraded to the latest version in the 1.5.6 from the ppa and now I am seeing this: \`{:timestamp=\>"2015-12-19T17:28:27.323000-0700", :message=\>"Got error to send bulk of actions: Cannot find Serialize… --- ## [Processing logs from Jersey JAX-RS](https://discuss.elastic.co/t/processing-logs-from-jersey-jax-rs/35576)
**Author:** [@borillo](https://discuss.elastic.co/u/borillo)\ **Replies:** 2\ **Last updated:** [December 22, 2015, 11:55am UTC](https://discuss.elastic.co/t/processing-logs-from-jersey-jax-rs/35576 "2015-12-22T11:55:04Z")
Hi guys, First of all, thanks a lot for such an amazing work!! In our webapps, jersey is generating two entries in the log file, one for the HTTP request and one for the reponse. The problem is that this entries are … --- ## [Mapping field to geoip.location throws parsing exception](https://discuss.elastic.co/t/mapping-field-to-geoip-location-throws-parsing-exception/37745)
**Author:** [@cannibalcow](https://discuss.elastic.co/u/cannibalcow)\ **Replies:** 0\ **Last updated:** [December 22, 2015, 10:34am UTC](https://discuss.elastic.co/t/mapping-field-to-geoip-location-throws-parsing-exception/37745 "2015-12-22T10:34:20Z")
Hi I use the jdbc input plugin to fetch my data. It contains a couple of columns with log data. One of the columns contains latitue,longitude values. I thought I could use the the 'geoip.location' field and then visua… --- ## [Sincedb maintenance](https://discuss.elastic.co/t/sincedb-maintenance/24372)
**Author:** [@iconnj](https://discuss.elastic.co/u/iconnj)\ **Replies:** 5\ **Last updated:** [December 22, 2015, 9:22am UTC](https://discuss.elastic.co/t/sincedb-maintenance/24372 "2015-12-22T09:22:54Z")
I am trying to figure out the best approach to keep the file input plugin's sincedb file in sync with the directory where the log files are being read from. The log files will be rolled daily and archived at the end of… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1205) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1207)