# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1212 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1213 --- ## [Appending information to an index](https://discuss.elastic.co/t/appending-information-to-an-index/36632)
**Author:** [@aviv.ratzon](https://discuss.elastic.co/u/aviv.ratzon)\ **Replies:** 0\ **Last updated:** [December 8, 2015, 12:37pm UTC](https://discuss.elastic.co/t/appending-information-to-an-index/36632 "2015-12-08T12:37:20Z")
Hello, I've connected to an Oracle databse via JDBC input. This is pretty new so I'm trying to figure out how to model this. In the database there is a bug table, with rows of bugs that each have a unique ID. I want to… --- ## [Ruby filter raises error on event.delete](https://discuss.elastic.co/t/ruby-filter-raises-error-on-event-delete/36471)
**Author:** [@stefws](https://discuss.elastic.co/u/stefws)\ **Replies:** 7\ **Last updated:** [December 8, 2015, 12:43pm UTC](https://discuss.elastic.co/t/ruby-filter-raises-error-on-event-delete/36471 "2015-12-08T12:43:55Z")
Got a ruby filter: ruby { code =\> " event.delete('message') if event\['message'\].empty? $DROP\_STATS = %w\[unwantedstat1 unwantedstat2 unwantedstat3\] event.cancel if event\['stat'\] and $DROP\_STATS.include?(event\['stat'… --- ## [Best Practice Configuration of Twitter Plugin for multiple twitter sources](https://discuss.elastic.co/t/best-practice-configuration-of-twitter-plugin-for-multiple-twitter-sources/36631)
**Author:** [@mob](https://discuss.elastic.co/u/mob)\ **Replies:** 0\ **Last updated:** [December 8, 2015, 12:21pm UTC](https://discuss.elastic.co/t/best-practice-configuration-of-twitter-plugin-for-multiple-twitter-sources/36631 "2015-12-08T12:21:39Z")
Hi all, I've been looking for a reason to try ELK for a while now and finally have a small project I think would suit. I need to collect twitter data over a 2 week period but I'm not sure whats the best way to configur… --- ## [Best practice to organize Grok patterns in production](https://discuss.elastic.co/t/best-practice-to-organize-grok-patterns-in-production/36615)
**Author:** [@Krzysztof](https://discuss.elastic.co/u/Krzysztof)\ **Replies:** 1\ **Last updated:** [December 8, 2015, 11:55am UTC](https://discuss.elastic.co/t/best-practice-to-organize-grok-patterns-in-production/36615 "2015-12-08T11:55:59Z")
Hello, In our system we're progressing with ELK stack usage on a larger scale. We're are about to connect a large amount of systems and almost all of them require a custom Grok pattern for log parsing. I'm wondering wh… --- ## [Logstash 2.1 - Listener Died](https://discuss.elastic.co/t/logstash-2-1-listener-died/35686)
**Author:** [@dawiro](https://discuss.elastic.co/u/dawiro)\ **Replies:** 5\ **Last updated:** [December 8, 2015, 8:43am UTC](https://discuss.elastic.co/t/logstash-2-1-listener-died/35686 "2015-12-08T08:43:33Z")
Hi, I'm seeing the following in the log for a new logstash instance I've created: {:timestamp=\>"2015-11-26T15:15:05.769000+0000", :message=\>"UDP listener died", :exception=\>#, :backtrace=\>\["org/jruby/RubyIO.java:3682:i… --- ## [How to have multiple nodes on same machine with Elasticsearch 2.0.0](https://discuss.elastic.co/t/how-to-have-multiple-nodes-on-same-machine-with-elasticsearch-2-0-0/35578)
**Author:** [@Miguel\_Bessa](https://discuss.elastic.co/u/Miguel_Bessa)\ **Replies:** 19\ **Last updated:** [December 8, 2015, 6:43am UTC](https://discuss.elastic.co/t/how-to-have-multiple-nodes-on-same-machine-with-elasticsearch-2-0-0/35578 "2015-12-08T06:43:04Z")
Hi, I have one machine with ELK (Elasticsearch 2.0.0, Logstash 2.0 and Kibana 4.2.0) stack, but I just have a single node, but I want more 3 nodes. How can I do this? And how I can define on logstash in waht node wil… --- ## [Error: Cannot use more than 1 filter worker because the following plugins don't work with more than one worker](https://discuss.elastic.co/t/error-cannot-use-more-than-1-filter-worker-because-the-following-plugins-dont-work-with-more-than-one-worker/36532)
**Author:** [@DK\_3](https://discuss.elastic.co/u/DK_3)\ **Replies:** 1\ **Last updated:** [December 8, 2015, 3:47am UTC](https://discuss.elastic.co/t/error-cannot-use-more-than-1-filter-worker-because-the-following-plugins-dont-work-with-more-than-one-worker/36532 "2015-12-08T03:47:57Z")
I'm hitting the following error when I moved to latest logstash-2.0.0 {:timestamp=\>"2015-12-07T12:40:35.126000+0000", :message=\>"Error: Cannot use more than 1 filter worker because the following plugins don't work with… --- ## [Found not picking up the right seconds value](https://discuss.elastic.co/t/found-not-picking-up-the-right-seconds-value/36517)
**Author:** [@Rishi1](https://discuss.elastic.co/u/Rishi1)\ **Replies:** 1\ **Last updated:** [December 8, 2015, 3:40am UTC](https://discuss.elastic.co/t/found-not-picking-up-the-right-seconds-value/36517 "2015-12-08T03:40:42Z")
Hi, I have Logstash sending data to Found right now and 've specified how Found should parse my date timestamps in the config file as follows: filter { date { locale =\> "en" match =\> \[ "timestamp","MMM dd … --- ## [Logstash 2.1.0 with ElasticSearch 1.7.3 vs 2.0 vs 2.1 missing data](https://discuss.elastic.co/t/logstash-2-1-0-with-elasticsearch-1-7-3-vs-2-0-vs-2-1-missing-data/36539)
**Author:** [@Adam\_Wrobel](https://discuss.elastic.co/u/Adam_Wrobel)\ **Replies:** 2\ **Last updated:** [December 8, 2015, 3:35am UTC](https://discuss.elastic.co/t/logstash-2-1-0-with-elasticsearch-1-7-3-vs-2-0-vs-2-1-missing-data/36539 "2015-12-08T03:35:39Z")
Hi. I have ES cluster running on 1.7.3 storing logs parsed by logstash 2.1. I prepare new logstash template compatible with ES 2.x and run new separated ES cluster with version 2.0.1 and another one separated with 2.1. … --- ## [Syslog can cann't capture dell network devices which end up with 0x00](https://discuss.elastic.co/t/syslog-can-cannt-capture-dell-network-devices-which-end-up-with-0x00/36236)
**Author:** [@woodkan](https://discuss.elastic.co/u/woodkan)\ **Replies:** 1\ **Last updated:** [December 8, 2015, 3:26am UTC](https://discuss.elastic.co/t/syslog-can-cannt-capture-dell-network-devices-which-end-up-with-0x00/36236 "2015-12-08T03:26:43Z")
I am using LS 2.1 syslog to capture network devices' syslog . My input configure is as below : input { syslog { port =\> 514 type =\> "netsyslog" #codec =\> plain { charset =\> "UTF-8" } # codec… --- ## [Throttle filter error](https://discuss.elastic.co/t/throttle-filter-error/36592)
**Author:** [@Gabriel\_Rosca](https://discuss.elastic.co/u/Gabriel_Rosca)\ **Replies:** 3\ **Last updated:** [December 8, 2015, 1:38am UTC](https://discuss.elastic.co/t/throttle-filter-error/36592 "2015-12-08T01:38:21Z")
{:timestamp=\>"2015-12-07T16:37:58.521000-0500", :message=\>"Exception in filterworker, the pipeline stopped processing new events, please check your filter configuration and restart Logstash.", "exception"=\>#, "backtrace"… --- ## [Logstash2.0 can't write to ES2.0 with Shield](https://discuss.elastic.co/t/logstash2-0-cant-write-to-es2-0-with-shield/34856)
**Author:** [@robertranjan](https://discuss.elastic.co/u/robertranjan)\ **Replies:** 7\ **Last updated:** [December 7, 2015, 9:59pm UTC](https://discuss.elastic.co/t/logstash2-0-cant-write-to-es2-0-with-shield/34856 "2015-12-07T21:59:24Z")
I'm trying to send events from LS2.0 to ES2.0+Shield2.0 using basic http authentication but failing because of authentication issue. OS: centOS 6 ES, LS and Kibana 2.0 Tried solution at http://stackoverflow.com/ques… --- ## [Postgresql log not sending data with logstash service](https://discuss.elastic.co/t/postgresql-log-not-sending-data-with-logstash-service/36550)
**Author:** [@yairaba](https://discuss.elastic.co/u/yairaba)\ **Replies:** 1\ **Last updated:** [December 7, 2015, 6:42pm UTC](https://discuss.elastic.co/t/postgresql-log-not-sending-data-with-logstash-service/36550 "2015-12-07T18:42:48Z")
Hi postgresql logs are not processed when logstash run as service , When i run it with below command line it works /opt/logstash/bin/logstash agent -f /etc/logstash/conf.d See below conf file and logstash debug messa… --- ## [Can I do an or in a match](https://discuss.elastic.co/t/can-i-do-an-or-in-a-match/36557)
**Author:** [@Jackal9301](https://discuss.elastic.co/u/Jackal9301)\ **Replies:** 1\ **Last updated:** [December 7, 2015, 6:41pm UTC](https://discuss.elastic.co/t/can-i-do-an-or-in-a-match/36557 "2015-12-07T18:41:03Z")
Is there a way I can write a grok to do something like: grok{ match =\> \[ "Message\_Data", "File \\"C:\\\\\\\\Windows\\\\Prefetch\\\\DLL" or "New File \\"C:\\\\\\\\Windows\\\\Prefetch\\\\DLL " \] I don't want to have to write to separ… --- ## [How to Install Logstash-forwarder 0.4.0 on MAC book](https://discuss.elastic.co/t/how-to-install-logstash-forwarder-0-4-0-on-mac-book/36561)
**Author:** [@anur](https://discuss.elastic.co/u/anur)\ **Replies:** 1\ **Last updated:** [December 7, 2015, 6:37pm UTC](https://discuss.elastic.co/t/how-to-install-logstash-forwarder-0-4-0-on-mac-book/36561 "2015-12-07T18:37:56Z")
Hi to all, I was successfully setup logstash-forwarder on Linux and Ubuntu machines. But I am unable to install Logstash-forwarder on MAC book. I downloaded binary for Mac book. but that file deos not containg any file… --- ## [IIS logs not making it from NXLog to Logstash](https://discuss.elastic.co/t/iis-logs-not-making-it-from-nxlog-to-logstash/36558)
**Author:** [@malonej7](https://discuss.elastic.co/u/malonej7)\ **Replies:** 0\ **Last updated:** [December 7, 2015, 4:47pm UTC](https://discuss.elastic.co/t/iis-logs-not-making-it-from-nxlog-to-logstash/36558 "2015-12-07T16:47:09Z")
Hi, I have a windows server with NXLog installed and the below config which should be sending IIS logs from this server to our Logstash server (on a linux box). The Logstash config I'm using is also below. For whatever… --- ## [Logstash receive from multiple source & data analysis](https://discuss.elastic.co/t/logstash-receive-from-multiple-source-data-analysis/36406)
**Author:** [@Karl\_Trasschaert](https://discuss.elastic.co/u/Karl_Trasschaert)\ **Replies:** 17\ **Last updated:** [December 7, 2015, 2:20pm UTC](https://discuss.elastic.co/t/logstash-receive-from-multiple-source-data-analysis/36406 "2015-12-07T14:20:56Z")
Hi, I'm new to logstash, i've set up the "sexilog" appliance ( it's a elk appliance mostly developped for vmware logs) I'm trying to catch a extreme networks wifi controller logs. Actually, all the log are received tr… --- ## [How do I handle the dates properly](https://discuss.elastic.co/t/how-do-i-handle-the-dates-properly/36535)
**Author:** [@jjdepaul](https://discuss.elastic.co/u/jjdepaul)\ **Replies:** 1\ **Last updated:** [December 7, 2015, 2:19pm UTC](https://discuss.elastic.co/t/how-do-i-handle-the-dates-properly/36535 "2015-12-07T14:19:48Z")
We have transactions rolling in from different logs in different timestamp formats. Would like the users to have the ability in Kibana to display the timestamps in their local TZ - what's the proper way of handling t… --- ## [Logstash json filter's add\_field ignored](https://discuss.elastic.co/t/logstash-json-filters-add-field-ignored/36504)
**Author:** [@vgondil](https://discuss.elastic.co/u/vgondil)\ **Replies:** 6\ **Last updated:** [December 7, 2015, 11:37am UTC](https://discuss.elastic.co/t/logstash-json-filters-add-field-ignored/36504 "2015-12-07T11:37:05Z")
I'm trying to use the json filter for Logstash 2.1. I find the "add\_field" option is ignored. I had a more complex config earlier, but I stripped it down to test just the add\_field. input { generator{ lines =\> \['{"@m… --- ## [Logstash 2.1.0 : Kafka Output (JMX)](https://discuss.elastic.co/t/logstash-2-1-0-kafka-output-jmx/36518)
**Author:** [@dawiro](https://discuss.elastic.co/u/dawiro)\ **Replies:** 0\ **Last updated:** [December 7, 2015, 10:52am UTC](https://discuss.elastic.co/t/logstash-2-1-0-kafka-output-jmx/36518 "2015-12-07T10:52:32Z")
Hi, I've been watching the behaviour of the logstash-kafka-output producer via JMX and it appears that it reports the outbound message rate to kafka incorectly for producer-topic-metrics. Basically I'm seeing that it… --- ## [Changing Logstash config file on the fly](https://discuss.elastic.co/t/changing-logstash-config-file-on-the-fly/36508)
**Author:** [@spireofdreams](https://discuss.elastic.co/u/spireofdreams)\ **Replies:** 3\ **Last updated:** [December 7, 2015, 10:16am UTC](https://discuss.elastic.co/t/changing-logstash-config-file-on-the-fly/36508 "2015-12-07T10:16:11Z")
Is it possible to update a logstash conf file without restarting the logstash instance in the latest 2.1 version? e.g. if I am reading from one kafka topic, and in the meantime another topic has pushed some data, I need … --- ## [Ouput Explanation of lsperfm - logstash performance testing](https://discuss.elastic.co/t/ouput-explanation-of-lsperfm-logstash-performance-testing/25281)
**Author:** [@Deb](https://discuss.elastic.co/u/Deb)\ **Replies:** 4\ **Last updated:** [December 7, 2015, 10:09am UTC](https://discuss.elastic.co/t/ouput-explanation-of-lsperfm-logstash-performance-testing/25281 "2015-12-07T10:09:28Z")
Hi, I am trying to use lsperfm, a logstash peformance testing tool. I have followed their installation instruction as mentioned in the README.md in their github wiki. I have logstash 1.5.2 installed in logstash 1.5.2/.… --- ## [Logstash Windows Event Logging](https://discuss.elastic.co/t/logstash-windows-event-logging/36469)
**Author:** [@usmanjamali90](https://discuss.elastic.co/u/usmanjamali90)\ **Replies:** 2\ **Last updated:** [December 7, 2015, 7:13am UTC](https://discuss.elastic.co/t/logstash-windows-event-logging/36469 "2015-12-07T07:13:41Z")
EventLog plugin not ingesting previous logs (log events that were registered before running the logstash). I am running it from command line and it is ingesting the new events. --- ## [What Logstash Should be](https://discuss.elastic.co/t/what-logstash-should-be/35099)
**Author:** [@Raggyman](https://discuss.elastic.co/u/Raggyman)\ **Replies:** 6\ **Last updated:** [December 7, 2015, 7:07am UTC](https://discuss.elastic.co/t/what-logstash-should-be/35099 "2015-12-07T07:07:14Z")
After being exposed to Logstash in my current role, I thought I would share with you what I think Logstash should be, and maybe I don't know enough about the product, but the focus should be in making the product better.… --- ## [Does eventlog plugin support on Chinese windows 2012R2?](https://discuss.elastic.co/t/does-eventlog-plugin-support-on-chinese-windows-2012r2/36489)
**Author:** [@woodkan](https://discuss.elastic.co/u/woodkan)\ **Replies:** 1\ **Last updated:** [December 7, 2015, 5:29am UTC](https://discuss.elastic.co/t/does-eventlog-plugin-support-on-chinese-windows-2012r2/36489 "2015-12-07T05:29:05Z")
I am using LS 2.1. My Windows servers are all Chinese Windows 2012R2. I configure LS to use eventlog plugin to collect windows security log. but the output is like below" "message" =\> "\\xD5\\xCA\\xBB\\xA7\\xB5\\xC7\\xC2\\xBC\\… --- ## [Stateful contextual tagging](https://discuss.elastic.co/t/stateful-contextual-tagging/36036)
**Author:** [@barisacar](https://discuss.elastic.co/u/barisacar)\ **Replies:** 7\ **Last updated:** [December 6, 2015, 10:38pm UTC](https://discuss.elastic.co/t/stateful-contextual-tagging/36036 "2015-12-06T22:38:41Z")
Hi, I have a logfile a bit like this: ... Starting task 123456 Reticulating splines Sequencing Particles Computing Optimal Bin Packing Integrating Curves Finished processing task 123456 Waiting for another task Star… --- ## [Howto eas{y|ier} debug grok parse failures](https://discuss.elastic.co/t/howto-eas-y-ier-debug-grok-parse-failures/36466)
**Author:** [@stefws](https://discuss.elastic.co/u/stefws)\ **Replies:** 4\ **Last updated:** [December 6, 2015, 9:30pm UTC](https://discuss.elastic.co/t/howto-eas-y-ier-debug-grok-parse-failures/36466 "2015-12-06T21:30:11Z")
Trying to find a grok parse failure for hours now, though I seem to get my wanted fields and wondering how people go about debugging such failures other than the old interpreted language method of inserting print stateme… --- ## [Ingest Logstash logs Logstash](https://discuss.elastic.co/t/ingest-logstash-logs-logstash/36340)
**Author:** [@treehouse](https://discuss.elastic.co/u/treehouse)\ **Replies:** 0\ **Last updated:** [December 4, 2015, 3:26am UTC](https://discuss.elastic.co/t/ingest-logstash-logs-logstash/36340 "2015-12-04T03:26:58Z")
Trying to ingest the logstash logs that i have in logstash/logstash.log and logstash/logstash.err into elasticsearch with logstash. This is the format, I think it is a ruby hash object -- {:timestamp=\>"2015-12-03T18:… --- ## [Multiline log (array) with logstash](https://discuss.elastic.co/t/multiline-log-array-with-logstash/36477)
**Author:** [@tikejhya](https://discuss.elastic.co/u/tikejhya)\ **Replies:** 0\ **Last updated:** [December 6, 2015, 5:43pm UTC](https://discuss.elastic.co/t/multiline-log-array-with-logstash/36477 "2015-12-06T17:43:30Z")
I want to parse logfile with logstash which contains both single line and multiple line. \[e.g first 2 lines with 1 line log entry whereas 3rd one has multiple line entry \] ERROR - 2015-12-05 20:48:53 --\> Could not find… --- ## [Logstash config query](https://discuss.elastic.co/t/logstash-config-query/36452)
**Author:** [@gugansankar](https://discuss.elastic.co/u/gugansankar)\ **Replies:** 5\ **Last updated:** [December 5, 2015, 7:25pm UTC](https://discuss.elastic.co/t/logstash-config-query/36452 "2015-12-05T19:25:33Z")
Till now I had maintain single configuration file in logstash server that is called as logstash-server.conf. Now I would like to separate the configuration based on input criteria. my logstash service is pointed to defa… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1211) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1213)