# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1210 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1211 --- ## [Wildcard in conditionals?](https://discuss.elastic.co/t/wildcard-in-conditionals/37016)
**Author:** [@CraigFoote](https://discuss.elastic.co/u/CraigFoote)\ **Replies:** 1\ **Last updated:** [December 12, 2015, 1:00am UTC](https://discuss.elastic.co/t/wildcard-in-conditionals/37016 "2015-12-12T01:00:20Z")
Is this legal? output{ if "\*error\*" in \[tags\] or "\*failure\*" in \[tags\]{ stdout{ codec =\> rubydebug } } else{ # index in ES } } --- ## [Am I missing an installation step?](https://discuss.elastic.co/t/am-i-missing-an-installation-step/36222)
**Author:** [@Russ](https://discuss.elastic.co/u/Russ)\ **Replies:** 20\ **Last updated:** [December 11, 2015, 8:30pm UTC](https://discuss.elastic.co/t/am-i-missing-an-installation-step/36222 "2015-12-11T20:30:55Z")
I'm running Elasticsearch on an AIX 7.1.0.0 server, and just installed Logstash v2.1.0 today. Once I untar the installation file, I attempted to run the basic example command in the tutorial, and I'm getting a Java erro… --- ## [\[Logstash Performance\]](https://discuss.elastic.co/t/logstash-performance/36904)
**Author:** [@varun\_kumar1](https://discuss.elastic.co/u/varun_kumar1)\ **Replies:** 2\ **Last updated:** [December 11, 2015, 7:39pm UTC](https://discuss.elastic.co/t/logstash-performance/36904 "2015-12-11T19:39:14Z")
I am running logstash with the following config input { file{ path =\> "D:/Log/\*/MIP/\*" start\_position =\> "beginning" } } filter{ mutate{ gsub =\> \["path","D:/Log/", ""\] } } output { s… --- ## [\[Logstash configuration when dumping the result file in shared network location\]](https://discuss.elastic.co/t/logstash-configuration-when-dumping-the-result-file-in-shared-network-location/36802)
**Author:** [@varun\_kumar1](https://discuss.elastic.co/u/varun_kumar1)\ **Replies:** 3\ **Last updated:** [December 11, 2015, 6:23pm UTC](https://discuss.elastic.co/t/logstash-configuration-when-dumping-the-result-file-in-shared-network-location/36802 "2015-12-11T18:23:08Z")
Hello, I am trying to parse the input log file and sending the result to a file in a shared network location .Below is my configuration file{ path =\> "\\optym-01/Share/Temporary\_Shared\_Space/varun/Logs/%{host}/%{pat… --- ## [ES sniffing in logstash 2.1 vs 2.0](https://discuss.elastic.co/t/es-sniffing-in-logstash-2-1-vs-2-0/36886)
**Author:** [@stefws](https://discuss.elastic.co/u/stefws)\ **Replies:** 1\ **Last updated:** [December 11, 2015, 5:17pm UTC](https://discuss.elastic.co/t/es-sniffing-in-logstash-2-1-vs-2-0/36886 "2015-12-11T17:17:29Z")
Updated from logstash 2.0 to 2.1 on a CentOS 6.7 box and now when launching it I found below issue. Am using sniffing to a ES cluster. Any hints, TIA? {:timestamp=\>"2015-12-10T15:31:31.852000+0100", :message=\>"undefine… --- ## [Logstash - Saving Soap/Rest Request](https://discuss.elastic.co/t/logstash-saving-soap-rest-request/36912)
**Author:** [@rakesh76](https://discuss.elastic.co/u/rakesh76)\ **Replies:** 2\ **Last updated:** [December 11, 2015, 3:21pm UTC](https://discuss.elastic.co/t/logstash-saving-soap-rest-request/36912 "2015-12-11T15:21:37Z")
Hi I am very new to elastic search and logstash so need guidance. 1) We are having different environment e.g dev1, dev2, test, For each environment there is log4 log file which contains soap/rest request. 2… --- ## [Failed to parse Timestamp](https://discuss.elastic.co/t/failed-to-parse-timestamp/36920)
**Author:** [@sombilat](https://discuss.elastic.co/u/sombilat)\ **Replies:** 3\ **Last updated:** [December 11, 2015, 3:17pm UTC](https://discuss.elastic.co/t/failed-to-parse-timestamp/36920 "2015-12-11T15:17:38Z")
Hello Guys, need some help. In my logstash I am reading a date pattern from input files. I have defined a format in my mapping with dd/MM/yyyy HH:mm:ss.SSS, so when it reads the input files it would follow the format … --- ## [If in output conf stop working!](https://discuss.elastic.co/t/if-in-output-conf-stop-working/36980)
**Author:** [@ashwin2011](https://discuss.elastic.co/u/ashwin2011)\ **Replies:** 1\ **Last updated:** [December 11, 2015, 2:50pm UTC](https://discuss.elastic.co/t/if-in-output-conf-stop-working/36980 "2015-12-11T14:50:04Z")
Hi everyone, I have configure my output conf in logstash to send to select data to different indexes but one it just stop working I dont think that I made any mistake in my codes any suggestions ? below is my conf :… --- ## [Trouble with ESXI filters in logstash](https://discuss.elastic.co/t/trouble-with-esxi-filters-in-logstash/36953)
**Author:** [@AthenaInterns](https://discuss.elastic.co/u/AthenaInterns)\ **Replies:** 4\ **Last updated:** [December 11, 2015, 2:43pm UTC](https://discuss.elastic.co/t/trouble-with-esxi-filters-in-logstash/36953 "2015-12-11T14:43:11Z")
hello, I'm having an issue with esxi filters in logstash, getting the grok error even after following the current documentation https://www.elastic.co/guide/en/logstash/current/config-examples.html, here is my config and… --- ## [JMX input filter, howto construct right query](https://discuss.elastic.co/t/jmx-input-filter-howto-construct-right-query/36929)
**Author:** [@stefws](https://discuss.elastic.co/u/stefws)\ **Replies:** 1\ **Last updated:** [December 11, 2015, 1:08pm UTC](https://discuss.elastic.co/t/jmx-input-filter-howto-construct-right-query/36929 "2015-12-11T13:08:28Z")
So I've got a jconsole on a cassandra 2.0 cluster and can see metrics like o.a.c.m.ThreadPools.request.RequestResponseStage.\*Tasks cassandra wiki says (note ThreadPool in singular): o.a.c.m:type=ThreadPool,path=(type)… --- ## [How to define fields in kibana](https://discuss.elastic.co/t/how-to-define-fields-in-kibana/36856)
**Author:** [@Prateek\_Kshtriya](https://discuss.elastic.co/u/Prateek_Kshtriya)\ **Replies:** 2\ **Last updated:** [December 11, 2015, 11:39am UTC](https://discuss.elastic.co/t/how-to-define-fields-in-kibana/36856 "2015-12-11T11:39:00Z")
Hi, I am using Acconts.json as a data file which is having different fields e.g firstName, lastName ,city etc but I am not able to get the same as different fields in kibana. Please suggest how to apply filters to get … --- ## [Logstash send all messages to their log file instead of elasticsearch](https://discuss.elastic.co/t/logstash-send-all-messages-to-their-log-file-instead-of-elasticsearch/36971)
**Author:** [@xandr](https://discuss.elastic.co/u/xandr)\ **Replies:** 1\ **Last updated:** [December 11, 2015, 11:09am UTC](https://discuss.elastic.co/t/logstash-send-all-messages-to-their-log-file-instead-of-elasticsearch/36971 "2015-12-11T11:09:17Z")
Yesterday I upgraded logstash and elasticsearch to the latest version (from 1.x). I have had some problem with it but after fixing all issues it started to work. Today at 2am (at this time server load increase for 5-7min… --- ## [Logstash exception for copying docs from one index to another index](https://discuss.elastic.co/t/logstash-exception-for-copying-docs-from-one-index-to-another-index/34585)
**Author:** [@r.ganeshbabu](https://discuss.elastic.co/u/r.ganeshbabu)\ **Replies:** 2\ **Last updated:** [December 11, 2015, 8:05am UTC](https://discuss.elastic.co/t/logstash-exception-for-copying-docs-from-one-index-to-another-index/34585 "2015-12-11T08:05:08Z")
Hi Team, I tried to copy docs from one index to another index by using logstash. Elasticsearch is 1.7.2 and I am using logstash 1.5.0 Below is the logstash.conf file I created. input { We read from the "old" in… --- ## [Logstash multiple output](https://discuss.elastic.co/t/logstash-multiple-output/36942)
**Author:** [@Siddharth](https://discuss.elastic.co/u/Siddharth)\ **Replies:** 1\ **Last updated:** [December 11, 2015, 6:48am UTC](https://discuss.elastic.co/t/logstash-multiple-output/36942 "2015-12-11T06:48:17Z")
Hello, How to store logstash output in multiple places at same time. For example, I am reading apache access logs and storing in elasticsearch after filtering. Now how to store those logs in elasticsearch and file at… --- ## [Problems with parsing XML log files with XML filter of Logstash](https://discuss.elastic.co/t/problems-with-parsing-xml-log-files-with-xml-filter-of-logstash/36796)
**Author:** [@Omer\_Uludag](https://discuss.elastic.co/u/Omer_Uludag)\ **Replies:** 7\ **Last updated:** [December 11, 2015, 6:47am UTC](https://discuss.elastic.co/t/problems-with-parsing-xml-log-files-with-xml-filter-of-logstash/36796 "2015-12-11T06:47:25Z")
Hello together, I tried multiple solutions for parsing my logs which are XML files to JSON in Logstash. One log file does look like in this way: \ **Author:** [@charlesnharvey](https://discuss.elastic.co/u/charlesnharvey)\ **Replies:** 3\ **Last updated:** [December 11, 2015, 2:11am UTC](https://discuss.elastic.co/t/logstash-on-app-server-or-on-elk-server/36810 "2015-12-11T02:11:21Z") Hello. Just poking around to see what the typical setup looks like. I see a lot of people have a Logstash Server that they forward messages to. And that server in turn forwards data to Elasticsearch. Is the Logstash … --- ## [Json\_line plugin error](https://discuss.elastic.co/t/json-line-plugin-error/36926)
**Author:** [@justin.beals](https://discuss.elastic.co/u/justin.beals)\ **Replies:** 0\ **Last updated:** [December 10, 2015, 10:48pm UTC](https://discuss.elastic.co/t/json-line-plugin-error/36926 "2015-12-10T22:48:18Z")
I'm receiving the following error running logstash in an ELK environment: Couldn't find any filter plugin named 'json\_line'. Are you sure this is correct? Trying to load the json\_line filter plugin resulted in this err… --- ## [Logstash crashing with "Too many files open"](https://discuss.elastic.co/t/logstash-crashing-with-too-many-files-open/36479)
**Author:** [@vtst2412](https://discuss.elastic.co/u/vtst2412)\ **Replies:** 8\ **Last updated:** [December 10, 2015, 7:43pm UTC](https://discuss.elastic.co/t/logstash-crashing-with-too-many-files-open/36479 "2015-12-10T19:43:38Z")
I have two logstash nodes running with 8 cores each. However, they consistently crash (every 1 or 2 days) with "Too many files open". I've only been able to find cases of this message on ES, has anyone encountered this o… --- ## [CSV file with mutated fields does not get indexed](https://discuss.elastic.co/t/csv-file-with-mutated-fields-does-not-get-indexed/36854)
**Author:** [@Kranthi\_Paidi](https://discuss.elastic.co/u/Kranthi_Paidi)\ **Replies:** 2\ **Last updated:** [December 10, 2015, 6:01pm UTC](https://discuss.elastic.co/t/csv-file-with-mutated-fields-does-not-get-indexed/36854 "2015-12-10T18:01:05Z")
Hi, I am pretty new to ELK stack. We are trying to build some performance test result dashboards by indexing results csv fils. I am trying to index a .csv file with columns mutated to float data types. Here is my config … --- ## [Can I use both json and plain logs in a common filebeat input?](https://discuss.elastic.co/t/can-i-use-both-json-and-plain-logs-in-a-common-filebeat-input/36879)
**Author:** [@iammichiel](https://discuss.elastic.co/u/iammichiel)\ **Replies:** 3\ **Last updated:** [December 10, 2015, 5:58pm UTC](https://discuss.elastic.co/t/can-i-use-both-json-and-plain-logs-in-a-common-filebeat-input/36879 "2015-12-10T17:58:43Z")
Hi, I'm trying to send both classic nginx logs (access/error) using filebeat. Which works great. Now, my application, also spawns logs which are json encoded. Which also works great if I send only these. It is whe… --- ## [How to get Grok Filter to see Newline and Carriage Returns?](https://discuss.elastic.co/t/how-to-get-grok-filter-to-see-newline-and-carriage-returns/36894)
**Author:** [@jeremiah.adams](https://discuss.elastic.co/u/jeremiah.adams)\ **Replies:** 1\ **Last updated:** [December 10, 2015, 5:20pm UTC](https://discuss.elastic.co/t/how-to-get-grok-filter-to-see-newline-and-carriage-returns/36894 "2015-12-10T17:20:02Z")
I originally posted this over in stack overflow but I think I am unlikely to get an answer there so am posting here. I am trying to parse our log files and send them to elasticsearch. The problem is that our S3 client … --- ## [Output-syslog plugin install on offline system](https://discuss.elastic.co/t/output-syslog-plugin-install-on-offline-system/36896)
**Author:** [@hughesr9](https://discuss.elastic.co/u/hughesr9)\ **Replies:** 0\ **Last updated:** [December 10, 2015, 3:48pm UTC](https://discuss.elastic.co/t/output-syslog-plugin-install-on-offline-system/36896 "2015-12-10T15:48:06Z")
I have a system with no internet connection with logstash installed. I need to install the output-syslog-plugin I have downloaded the logstash-output-syslog-2.1.0.gem file and tried to use "bin/plugin install /tmp/logsta… --- ## [Adding fields](https://discuss.elastic.co/t/adding-fields/36891)
**Author:** [@marcmga](https://discuss.elastic.co/u/marcmga)\ **Replies:** 1\ **Last updated:** [December 10, 2015, 3:36pm UTC](https://discuss.elastic.co/t/adding-fields/36891 "2015-12-10T15:36:04Z")
Hello there, I want to know if there's a way to add two or more fields. We take two fields which are numbers (not string) and want to add each other into another field. Or even more, is there a way to add a number to a… --- ## [Will Index Alias solve my issue?](https://discuss.elastic.co/t/will-index-alias-solve-my-issue/36834)
**Author:** [@Aravinthan\_Asokan](https://discuss.elastic.co/u/Aravinthan_Asokan)\ **Replies:** 1\ **Last updated:** [December 10, 2015, 2:43pm UTC](https://discuss.elastic.co/t/will-index-alias-solve-my-issue/36834 "2015-12-10T14:43:57Z")
Currently I am using Ubuntu 14.04 with 4GB RAM. My Data size is more than 5GB to index. I am getting below error Settings: Default filter workers: 1 Logstash startup completed java.lang.OutOfMemoryError: Java heap spa… --- ## [Logstash Memory leak?](https://discuss.elastic.co/t/logstash-memory-leak/28494)
**Author:** [@sumithub](https://discuss.elastic.co/u/sumithub)\ **Replies:** 21\ **Last updated:** [December 10, 2015, 2:11pm UTC](https://discuss.elastic.co/t/logstash-memory-leak/28494 "2015-12-10T14:11:19Z")
Hello, We're running logstash 1.5.3 on windows 8.1 server 2012 having 8GB RAM. Logstash configured to have max 1g heap size. We're running quite a big job which runs for 10-12 hours to complete and creates multiple rol… --- ## [Ingesting JSON files, format problem?](https://discuss.elastic.co/t/ingesting-json-files-format-problem/36411)
**Author:** [@CraigFoote](https://discuss.elastic.co/u/CraigFoote)\ **Replies:** 12\ **Last updated:** [December 9, 2015, 6:02pm UTC](https://discuss.elastic.co/t/ingesting-json-files-format-problem/36411 "2015-12-09T18:02:22Z")
I have a series of JSON files, each with one rather large, single-line JSON document. I'm trying to ingest via the file input plugin: input{ file{ path =\> "/path/to/files/\*.txt" start-position =\> "beginning" sin… --- ## [Help to calculate start time from disconnection time and session time](https://discuss.elastic.co/t/help-to-calculate-start-time-from-disconnection-time-and-session-time/36607)
**Author:** [@cdgraff](https://discuss.elastic.co/u/cdgraff)\ **Replies:** 7\ **Last updated:** [December 10, 2015, 1:23pm UTC](https://discuss.elastic.co/t/help-to-calculate-start-time-from-disconnection-time-and-session-time/36607 "2015-12-10T13:23:13Z")
Hi all, I'm trying to get the StartTime of a session from my icecast streaming logs, into the logs I has the Disconnection date and the session duration time. In simple math need to be something like this: new timesta… --- ## [Matching word inside message field](https://discuss.elastic.co/t/matching-word-inside-message-field/36843)
**Author:** [@Bernstein](https://discuss.elastic.co/u/Bernstein)\ **Replies:** 3\ **Last updated:** [December 10, 2015, 12:59pm UTC](https://discuss.elastic.co/t/matching-word-inside-message-field/36843 "2015-12-10T12:59:50Z")
Hi, Guys Just like many others i am quite new to ELK and have a question. My logstash recieves syslogs from pfsense firewall. I crated a grok filter that parses firewall events and extract all needed data from @message,… --- ## [Beats plugin configuation](https://discuss.elastic.co/t/beats-plugin-configuation/36867)
**Author:** [@Max\_Just](https://discuss.elastic.co/u/Max_Just)\ **Replies:** 6\ **Last updated:** [December 10, 2015, 11:38am UTC](https://discuss.elastic.co/t/beats-plugin-configuation/36867 "2015-12-10T11:38:51Z")
is it possible to set ports as a range or array in logstash config instead beats { port =\> 5013 ssl =\> true ssl\_certificate =\> "/etc/pki/tls/certs/logstash-forwarder.crt" ssl\_key =\> "/etc/pki/tls/priv… --- ## [How to ingest multiple json documents from a folder into ES using logstash](https://discuss.elastic.co/t/how-to-ingest-multiple-json-documents-from-a-folder-into-es-using-logstash/36866)
**Author:** [@Steve64](https://discuss.elastic.co/u/Steve64)\ **Replies:** 1\ **Last updated:** [December 10, 2015, 11:01am UTC](https://discuss.elastic.co/t/how-to-ingest-multiple-json-documents-from-a-folder-into-es-using-logstash/36866 "2015-12-10T11:01:13Z")
Continuing the discussion from Ingesting JSON files, format problem?: [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1209) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1211)