# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1209 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1210 --- ## [Jstat wan't show stat aboue logstash](https://discuss.elastic.co/t/jstat-want-show-stat-aboue-logstash/37225)
**Author:** [@Max\_Just](https://discuss.elastic.co/u/Max_Just)\ **Replies:** 0\ **Last updated:** [December 15, 2015, 9:57am UTC](https://discuss.elastic.co/t/jstat-want-show-stat-aboue-logstash/37225 "2015-12-15T09:57:30Z")
hi fillow command jstat -gcutil do not wan't to show information about logstash, how I can get info about memory etc. inside logstash jvm process? --- ## [Logstash File input Observation](https://discuss.elastic.co/t/logstash-file-input-observation/37139)
**Author:** [@PKD](https://discuss.elastic.co/u/PKD)\ **Replies:** 4\ **Last updated:** [December 15, 2015, 9:51am UTC](https://discuss.elastic.co/t/logstash-file-input-observation/37139 "2015-12-15T09:51:35Z")
Hi all, We have configured logstash with file input to scan files from specified directory and index into elastic search. We have provided the following path for file input : /var/log/varnish/varnish-access\*.log Varn… --- ## [Hi,may i install logstash in IBM Aix?](https://discuss.elastic.co/t/hi-may-i-install-logstash-in-ibm-aix/37215)
**Author:** [@jalen\_wang](https://discuss.elastic.co/u/jalen_wang)\ **Replies:** 1\ **Last updated:** [December 15, 2015, 9:46am UTC](https://discuss.elastic.co/t/hi-may-i-install-logstash-in-ibm-aix/37215 "2015-12-15T09:46:19Z")
I want to install logstash in aix,but i can't find any binary software ,anyone could help me ? --- ## [Getting relevant information from CDATA of XML file with Grok](https://discuss.elastic.co/t/getting-relevant-information-from-cdata-of-xml-file-with-grok/37155)
**Author:** [@Omer\_Uludag](https://discuss.elastic.co/u/Omer_Uludag)\ **Replies:** 7\ **Last updated:** [December 15, 2015, 6:56am UTC](https://discuss.elastic.co/t/getting-relevant-information-from-cdata-of-xml-file-with-grok/37155 "2015-12-15T06:56:41Z")
Hello together, I try to parse an XML document and get some relevant information about it. The document looks like this: \ **Author:** [@abcfy2](https://discuss.elastic.co/u/abcfy2)\ **Replies:** 1\ **Last updated:** [December 15, 2015, 4:36am UTC](https://discuss.elastic.co/t/how-to-append-a-newer-event-to-an-older/37096 "2015-12-15T04:36:59Z") Here is postgresql slow query log: 2015-12-14 14:36:26 CST \[29680-1\] aircare\_root@aircare LOG: duration: 828.438 ms execute \: select ic.sourceid , e.id … --- ## [Shield + logstash + elastic + kibana Issue with transport protocol](https://discuss.elastic.co/t/shield-logstash-elastic-kibana-issue-with-transport-protocol/25501)
**Author:** [@quejinho](https://discuss.elastic.co/u/quejinho)\ **Replies:** 1\ **Last updated:** [December 15, 2015, 1:13am UTC](https://discuss.elastic.co/t/shield-logstash-elastic-kibana-issue-with-transport-protocol/25501 "2015-12-15T01:13:55Z")
I have an issue with my logstash plugin ( logstash-output-elasticsearch-shield ) i wanted to Use the transport protocol with login . With http it works fine when i change port and protocol to transport messages does n… --- ## [Logstash-output-elasticssearch gem out of date](https://discuss.elastic.co/t/logstash-output-elasticssearch-gem-out-of-date/37186)
**Author:** [@Kaufusihm](https://discuss.elastic.co/u/Kaufusihm)\ **Replies:** 0\ **Last updated:** [December 15, 2015, 1:13am UTC](https://discuss.elastic.co/t/logstash-output-elasticssearch-gem-out-of-date/37186 "2015-12-15T01:13:07Z")
I am trying to install logstash-output-elasticsearch plugin so I can use the transport protocol. When I run bin/plugin install logstash-output-elasticsearch-shield I get this error message ERROR: Installation Aborte… --- ## [RSS input plugin fails with fatal error](https://discuss.elastic.co/t/rss-input-plugin-fails-with-fatal-error/37173)
**Author:** [@Jaime\_Meritt](https://discuss.elastic.co/u/Jaime_Meritt)\ **Replies:** 1\ **Last updated:** [December 15, 2015, 1:05am UTC](https://discuss.elastic.co/t/rss-input-plugin-fails-with-fatal-error/37173 "2015-12-15T01:05:24Z")
I am trying to use the rss community plugin and can't get it to startup successfully. I used the plugin tool to install and everything worked well. Put together a very simple test The configuration is very simple inp… --- ## [Dataparse failure using csv filter](https://discuss.elastic.co/t/dataparse-failure-using-csv-filter/37177)
**Author:** [@RustyWilson](https://discuss.elastic.co/u/RustyWilson)\ **Replies:** 13\ **Last updated:** [December 14, 2015, 10:32pm UTC](https://discuss.elastic.co/t/dataparse-failure-using-csv-filter/37177 "2015-12-14T22:32:54Z")
Thanks in advance. Lots of info to follow... I've been fighting this for quite sometime, and I've been unable to locate any other topics that relate specifically to this problem. First, here's a summary of the issue… --- ## [Logstash not binding to 5504](https://discuss.elastic.co/t/logstash-not-binding-to-5504/37166)
**Author:** [@jacoblw](https://discuss.elastic.co/u/jacoblw)\ **Replies:** 1\ **Last updated:** [December 14, 2015, 9:23pm UTC](https://discuss.elastic.co/t/logstash-not-binding-to-5504/37166 "2015-12-14T21:23:08Z")
Hi, I'm new to the ELK stack. Following the guide for CentOS 7 created by DigitalOcean I got as far as creating an index pattern in Kibana before I noticed I was running into an issue. I get the following error in … --- ## [Access nested fields with wildcards?](https://discuss.elastic.co/t/access-nested-fields-with-wildcards/37160)
**Author:** [@CraigFoote](https://discuss.elastic.co/u/CraigFoote)\ **Replies:** 2\ **Last updated:** [December 14, 2015, 8:23pm UTC](https://discuss.elastic.co/t/access-nested-fields-with-wildcards/37160 "2015-12-14T20:23:53Z")
I'm using the XML filter to parse an XML log, targeting "doc": filter{ xml{ source =\> "message" target =\> "doc" } But I have some numeric fields that come through as Strings. They are not in qu… --- ## [Dealing with multiple timezones](https://discuss.elastic.co/t/dealing-with-multiple-timezones/37145)
**Author:** [@SuperBuster](https://discuss.elastic.co/u/SuperBuster)\ **Replies:** 4\ **Last updated:** [December 14, 2015, 7:34pm UTC](https://discuss.elastic.co/t/dealing-with-multiple-timezones/37145 "2015-12-14T19:34:24Z")
Hi, i use the elk stack and i have machines in utc time, machines in pst time and some in eastern time. I wanted to know how you guys deal with this with your elk stack. (btw, i can't put everything in utc) Even when i… --- ## [Logstash bug with timestamp](https://discuss.elastic.co/t/logstash-bug-with-timestamp/29641)
**Author:** [@ishantt](https://discuss.elastic.co/u/ishantt)\ **Replies:** 8\ **Last updated:** [December 14, 2015, 4:55pm UTC](https://discuss.elastic.co/t/logstash-bug-with-timestamp/29641 "2015-12-14T16:55:21Z")
I need to report back to Logstash community about a bug that i found. As you can see below, the @timestamp field is populated with date and timestamp in the UTC where as first\_switched and last\_switched are in local ti… --- ## [Type vs Tags?](https://discuss.elastic.co/t/type-vs-tags/37131)
**Author:** [@elvarb](https://discuss.elastic.co/u/elvarb)\ **Replies:** 4\ **Last updated:** [December 14, 2015, 3:04pm UTC](https://discuss.elastic.co/t/type-vs-tags/37131 "2015-12-14T15:04:30Z")
Some time ago type was declared to being depreciated in Logstash and that we should be using tags instead. Ever since then I have migrated everything to tags, and that is fine. I know that in Elasticsearch type has a mea… --- ## [Grok Patterns - issue using repetitive regular expressions](https://discuss.elastic.co/t/grok-patterns-issue-using-repetitive-regular-expressions/37106)
**Author:** [@marv](https://discuss.elastic.co/u/marv)\ **Replies:** 2\ **Last updated:** [December 14, 2015, 1:24pm UTC](https://discuss.elastic.co/t/grok-patterns-issue-using-repetitive-regular-expressions/37106 "2015-12-14T13:24:38Z")
Hey guys, I´ve been using the ELK-Stack for a while and it really is a great tool. Right now I am confronted with a problem, which I try solving for a while. I wrote a custom SAP pattern to match SAP-Taks from the … --- ## [Logstash issue with %{UNIXPATH} in version 1.5.5 and up](https://discuss.elastic.co/t/logstash-issue-with-unixpath-in-version-1-5-5-and-up/37122)
**Author:** [@m1k3ga](https://discuss.elastic.co/u/m1k3ga)\ **Replies:** 3\ **Last updated:** [December 14, 2015, 1:00pm UTC](https://discuss.elastic.co/t/logstash-issue-with-unixpath-in-version-1-5-5-and-up/37122 "2015-12-14T13:00:41Z")
In our (grok) logstash configuration we use a matching pattern like "%{UNIXPATH}%{UNIXPATH:filename}" with example log file entry file path /opt/foo/bar/file.xml found Until version 1.5.4 i get a field "filenam… --- ## [How to print the file path and the count of records processed from the file when there are multiple input files](https://discuss.elastic.co/t/how-to-print-the-file-path-and-the-count-of-records-processed-from-the-file-when-there-are-multiple-input-files/37123)
**Author:** [@aravind\_ram](https://discuss.elastic.co/u/aravind_ram)\ **Replies:** 0\ **Last updated:** [December 14, 2015, 12:42pm UTC](https://discuss.elastic.co/t/how-to-print-the-file-path-and-the-count-of-records-processed-from-the-file-when-there-are-multiple-input-files/37123 "2015-12-14T12:42:46Z")
Hi, I am using logstash to read a particular type of logs from multiple input files like file { path =\> "C:/Users/Documents/\*/\*/\*.txt" start\_position =\> "beginning" } Each file contains many lines in which e… --- ## [How to assign a new field a certain type and value?](https://discuss.elastic.co/t/how-to-assign-a-new-field-a-certain-type-and-value/34148)
**Author:** [@marv](https://discuss.elastic.co/u/marv)\ **Replies:** 2\ **Last updated:** [November 13, 2015, 7:32am UTC](https://discuss.elastic.co/t/how-to-assign-a-new-field-a-certain-type-and-value/34148 "2015-11-13T07:32:12Z")
Hi, I´m using the grok filter to process logs. Everything works fine but I can´t find a solution for the following problem: I need to extract a numerical value out of my log files. There are two ways they appear in t… --- ## [How to export overall fields in CSV format using CSV output plugin in LS](https://discuss.elastic.co/t/how-to-export-overall-fields-in-csv-format-using-csv-output-plugin-in-ls/37110)
**Author:** [@vikas\_gopal](https://discuss.elastic.co/u/vikas_gopal)\ **Replies:** 0\ **Last updated:** [December 14, 2015, 9:55am UTC](https://discuss.elastic.co/t/how-to-export-overall-fields-in-csv-format-using-csv-output-plugin-in-ls/37110 "2015-12-14T09:55:22Z")
Hi Experts , I want to export ES documents in CSV format using CSV output plugin in LS, this is what I have done. input { elasticsearch { hosts =\> "localhost" query =\> '{"query": { "bool": { "must": \[{ "match\_all":… --- ## [Logstash Failing with Certain Error](https://discuss.elastic.co/t/logstash-failing-with-certain-error/37109)
**Author:** [@piyush.jain2](https://discuss.elastic.co/u/piyush.jain2)\ **Replies:** 0\ **Last updated:** [December 14, 2015, 9:48am UTC](https://discuss.elastic.co/t/logstash-failing-with-certain-error/37109 "2015-12-14T09:48:00Z")
Hi , I am trying to run Logstash on a cloud server but it does not come up properly and fails with below error : Exception in thread "Ruby-0-Thread-3: C:/ELK/logstash-1.5.4/vendor/bundle/jruby/1.9/gems/stud-0.0.21/li… --- ## [Processing solr logs using logstash](https://discuss.elastic.co/t/processing-solr-logs-using-logstash/36241)
**Author:** [@Maddy](https://discuss.elastic.co/u/Maddy)\ **Replies:** 5\ **Last updated:** [December 14, 2015, 8:24am UTC](https://discuss.elastic.co/t/processing-solr-logs-using-logstash/36241 "2015-12-14T08:24:22Z")
Hi, I am using solr which has multiple collections in it. Solr dumps the log of all collections into a single file(solr.log) and I want the logs of one particular collection. Here is a sample log structure, INFO… --- ## [Logstash beats input doesn't find certificates](https://discuss.elastic.co/t/logstash-beats-input-doesnt-find-certificates/34316)
**Author:** [@vmcano](https://discuss.elastic.co/u/vmcano)\ **Replies:** 1\ **Last updated:** [December 14, 2015, 6:11am UTC](https://discuss.elastic.co/t/logstash-beats-input-doesnt-find-certificates/34316 "2015-12-14T06:11:28Z")
When I enable SSL in the logstash-beats-input, I get the following message: {:timestamp=\>"2015-11-11T12:07:41.539000+0100", :message=\>"The error reported is: \\n Neither PUB key nor PRIV key:"} And Logstash stops. The … --- ## [Redis as a broken really help with loading the raw logs?](https://discuss.elastic.co/t/redis-as-a-broken-really-help-with-loading-the-raw-logs/37025)
**Author:** [@shilong](https://discuss.elastic.co/u/shilong)\ **Replies:** 6\ **Last updated:** [December 13, 2015, 4:46pm UTC](https://discuss.elastic.co/t/redis-as-a-broken-really-help-with-loading-the-raw-logs/37025 "2015-12-13T16:46:33Z")
Hi , is there anyone can help answer this question, it takes 2 hours even longer for the server to load the one day's apache access logs from the one file to by logstash conf, is it kind of normally ? Any suggestions T… --- ## [Extract Sub string and reverse](https://discuss.elastic.co/t/extract-sub-string-and-reverse/37033)
**Author:** [@mvenkat\_in](https://discuss.elastic.co/u/mvenkat_in)\ **Replies:** 1\ **Last updated:** [December 13, 2015, 4:03pm UTC](https://discuss.elastic.co/t/extract-sub-string-and-reverse/37033 "2015-12-13T16:03:37Z")
Hi I have date & time filed in the log as below, which I have parsed to a filed in the logstash. 11-12-2015 10:00:00,301 However I want the date only in 2015-12-11 (YYYY-MM-DD) format into a variable, say event date i… --- ## [How to use multiple inputs in Logstash?](https://discuss.elastic.co/t/how-to-use-multiple-inputs-in-logstash/36247)
**Author:** [@thyfere](https://discuss.elastic.co/u/thyfere)\ **Replies:** 11\ **Last updated:** [December 13, 2015, 3:52pm UTC](https://discuss.elastic.co/t/how-to-use-multiple-inputs-in-logstash/36247 "2015-12-13T15:52:13Z")
Hi, My setup: Two Windows boxes; one is for Elasticsearch and Kibana, and other is for Logstash. I am already dumping Windows events to my ELK setup. Now, I want to collect Microsoft Exchange logs too. How can I cont… --- ## [Jdbc input doesn't manage with a date field](https://discuss.elastic.co/t/jdbc-input-doesnt-manage-with-a-date-field/37059)
**Author:** [@aviv.ratzon](https://discuss.elastic.co/u/aviv.ratzon)\ **Replies:** 0\ **Last updated:** [December 13, 2015, 1:41pm UTC](https://discuss.elastic.co/t/jdbc-input-doesnt-manage-with-a-date-field/37059 "2015-12-13T13:41:07Z")
Hello, I'm trying to work with the JDBC plugin so it will only read recently modified events from an Oracle database. this is the configuration I have: input { jdbc { jdbc\_driver\_library =\> "ojdbc7.jar" jdbc\_driver… --- ## [SSL certificate for multiple servers. bug?](https://discuss.elastic.co/t/ssl-certificate-for-multiple-servers-bug/37045)
**Author:** [@gerardoa](https://discuss.elastic.co/u/gerardoa)\ **Replies:** 0\ **Last updated:** [December 12, 2015, 10:21pm UTC](https://discuss.elastic.co/t/ssl-certificate-for-multiple-servers-bug/37045 "2015-12-12T22:21:08Z")
I'm trying to setup multiple logstash servers and came across a possible bug/feature, wanted the community input on this. I'm setting up two logstash servers for redundancy,let's say they are using IP addresses 192.168.… --- ## [Logstash 1.5.1 Twitter Input Connection Refused](https://discuss.elastic.co/t/logstash-1-5-1-twitter-input-connection-refused/24960)
**Author:** [@zWang95](https://discuss.elastic.co/u/zWang95)\ **Replies:** 5\ **Last updated:** [December 12, 2015, 8:30pm UTC](https://discuss.elastic.co/t/logstash-1-5-1-twitter-input-connection-refused/24960 "2015-12-12T20:30:07Z")
Hi, Getting connection refused error when trying to use Twitter input on Logstash 1.5.1. I would appreciate any help. Thanks. input { twitter { consumer\_key =\> " " consumer\_secret =\> " " oa… --- ## [Obtaining historical feed from twitter](https://discuss.elastic.co/t/obtaining-historical-feed-from-twitter/37037)
**Author:** [@andresmmujica](https://discuss.elastic.co/u/andresmmujica)\ **Replies:** 0\ **Last updated:** [December 12, 2015, 1:23pm UTC](https://discuss.elastic.co/t/obtaining-historical-feed-from-twitter/37037 "2015-12-12T13:23:01Z")
Hi, I'm trying to access older tweets using logstash, I only need to get a feed that's about a month old. It seems there are some restrictions with Twitter API but I was wondering if there is someway (using since\_id) to… --- ## [Error "fatal: Not a git repository (or any of the parent directories): .git" when trying to install a plugin in offline mode with LS 1.5.5 or newer](https://discuss.elastic.co/t/error-fatal-not-a-git-repository-or-any-of-the-parent-directories-git-when-trying-to-install-a-plugin-in-offline-mode-with-ls-1-5-5-or-newer/37032)
**Author:** [@christiangalsterer](https://discuss.elastic.co/u/christiangalsterer)\ **Replies:** 0\ **Last updated:** [December 12, 2015, 6:14am UTC](https://discuss.elastic.co/t/error-fatal-not-a-git-repository-or-any-of-the-parent-directories-git-when-trying-to-install-a-plugin-in-offline-mode-with-ls-1-5-5-or-newer/37032 "2015-12-12T06:14:05Z")
Starting with Logstash 1.5.5 I get the following error message when trying to install with a downloaded gem file. Validating /tmp/logstash-input-salesforce-0.1.1.gem Installing logstash-input-salesforce fatal: Not a gi… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1208) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1210)