# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1213 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1214 --- ## [Logstash 2.x : Dynamic Mapping](https://discuss.elastic.co/t/logstash-2-x-dynamic-mapping/36353)
**Author:** [@dawiro](https://discuss.elastic.co/u/dawiro)\ **Replies:** 9\ **Last updated:** [December 5, 2015, 6:31pm UTC](https://discuss.elastic.co/t/logstash-2-x-dynamic-mapping/36353 "2015-12-05T18:31:04Z")
Hi, Based on the breaking changes in elasticsearch 2,0 and other information: https://www.elastic.co/guide/en/elasticsearch/reference/current/breaking\_20\_mapping\_changes.html ...its apparent that fields names with le… --- ## [Conditionals and Dates](https://discuss.elastic.co/t/conditionals-and-dates/36387)
**Author:** [@Jackal9301](https://discuss.elastic.co/u/Jackal9301)\ **Replies:** 2\ **Last updated:** [December 5, 2015, 4:29pm UTC](https://discuss.elastic.co/t/conditionals-and-dates/36387 "2015-12-05T16:29:15Z")
Issue: I have a lot of different logs coming from 1 source and separate date formats. Situation: Hey everyone I have a conditional logstash file that takes a single input and runs multiple conditionals to determine whi… --- ## [Logstash Multiple File Inputs](https://discuss.elastic.co/t/logstash-multiple-file-inputs/36397)
**Author:** [@Kryten](https://discuss.elastic.co/u/Kryten)\ **Replies:** 2\ **Last updated:** [December 5, 2015, 9:57am UTC](https://discuss.elastic.co/t/logstash-multiple-file-inputs/36397 "2015-12-05T09:57:03Z")
Hi, Would appreciate a pointer with regard to using multiple file inputs. This works:- input { file { path =\> \[ "//server\_1/Logs/\*", "//server\_2/Logs/\*", "//server\_2/Logs/\*", "//server\_2/Logs/\*",… --- ## [Mutate and Columns combined](https://discuss.elastic.co/t/mutate-and-columns-combined/36327)
**Author:** [@Optius\_Prime](https://discuss.elastic.co/u/Optius_Prime)\ **Replies:** 2\ **Last updated:** [December 4, 2015, 8:27pm UTC](https://discuss.elastic.co/t/mutate-and-columns-combined/36327 "2015-12-04T20:27:51Z")
Hello Fellow Logstash users. I have just started to use ELK and am impressed with it. I am trying to propose a project to my senior management. However i am getting a problem in trying to upload the data in appropriate… --- ## [Any Help Un-structure log message to map structure message in Logstash](https://discuss.elastic.co/t/any-help-un-structure-log-message-to-map-structure-message-in-logstash/36258)
**Author:** [@jayaram](https://discuss.elastic.co/u/jayaram)\ **Replies:** 11\ **Last updated:** [December 4, 2015, 6:28pm UTC](https://discuss.elastic.co/t/any-help-un-structure-log-message-to-map-structure-message-in-logstash/36258 "2015-12-04T18:28:11Z")
Hello, I have the log message 2015-11-18 21:11:38,693 \[WARN \] \[xx.web.common.filter.RequestFilter\] NDC\[UserPrincipal(ABCDF22602)\] request (/member/control/loginAction) exceeded threshold; elapsed milliseconds since star… --- ## [Install custum GEM to logstash without .gem.spec](https://discuss.elastic.co/t/install-custum-gem-to-logstash-without-gem-spec/36405)
**Author:** [@Max\_Just](https://discuss.elastic.co/u/Max_Just)\ **Replies:** 0\ **Last updated:** [December 4, 2015, 5:19pm UTC](https://discuss.elastic.co/t/install-custum-gem-to-logstash-without-gem-spec/36405 "2015-12-04T17:19:57Z")
Hi, can anybody help, how I can install ftw to logstash? without write personal plugin with gem.spec file, just command from cli. Is it possible? --- ## [createTableUnsafe/UnsatisfiedLinkError - Win Srv 2008 R2 SP1](https://discuss.elastic.co/t/createtableunsafe-unsatisfiedlinkerror-win-srv-2008-r2-sp1/36231)
**Author:** [@Russ](https://discuss.elastic.co/u/Russ)\ **Replies:** 0\ **Last updated:** [December 2, 2015, 11:58pm UTC](https://discuss.elastic.co/t/createtableunsafe-unsatisfiedlinkerror-win-srv-2008-r2-sp1/36231 "2015-12-02T23:58:22Z")
I have installed Java 1.8.0\_65, and downloaded the .ZIP file from the LogStash install page (https://download.elastic.co/logstash/logstash/logstash-2.1.0.zip), but I'm getting a "createTableUnsafe", "UnsatisfiedLinkError… --- ## [Combine multiple sources](https://discuss.elastic.co/t/combine-multiple-sources/26795)
**Author:** [@Hornov](https://discuss.elastic.co/u/Hornov)\ **Replies:** 10\ **Last updated:** [December 4, 2015, 11:38am UTC](https://discuss.elastic.co/t/combine-multiple-sources/26795 "2015-12-04T11:38:28Z")
I've logs from multiple sources for the same user. But I need to report fields of this differents sources. Is it possible to store all this data in the same document ? Thanks --- ## [Logstash twitter api - Sentiment](https://discuss.elastic.co/t/logstash-twitter-api-sentiment/36313)
**Author:** [@abaykal](https://discuss.elastic.co/u/abaykal)\ **Replies:** 1\ **Last updated:** [December 4, 2015, 8:46am UTC](https://discuss.elastic.co/t/logstash-twitter-api-sentiment/36313 "2015-12-04T08:46:55Z")
are there any examples of sentiment integration into twitter plugin? like incorporating textblob (python) or something like that? --- ## [CloudWatch input](https://discuss.elastic.co/t/cloudwatch-input/2652)
**Author:** [@jrgns](https://discuss.elastic.co/u/jrgns)\ **Replies:** 5\ **Last updated:** [December 4, 2015, 8:46am UTC](https://discuss.elastic.co/t/cloudwatch-input/2652 "2015-12-04T08:46:18Z")
Hey I created a CloudWatch input for Logstash. I'd like to get some feedback and guidance on how to properly write tests for it. The gem has been published (so you can install it on Logstash 1.5) and the code is availa… --- ## [Twitter sentimental analysis using elk stack](https://discuss.elastic.co/t/twitter-sentimental-analysis-using-elk-stack/36349)
**Author:** [@kriti\_singh](https://discuss.elastic.co/u/kriti_singh)\ **Replies:** 1\ **Last updated:** [December 4, 2015, 8:44am UTC](https://discuss.elastic.co/t/twitter-sentimental-analysis-using-elk-stack/36349 "2015-12-04T08:44:28Z")
HI, I am trying to do twitter sentimental analysis using elk stack.. I want to show how many tweets are positive negative and neutral in pie chart. however i dont want any python related information. please help. I could… --- ## [Logstash service not starting ,it is in paused status](https://discuss.elastic.co/t/logstash-service-not-starting-it-is-in-paused-status/29581)
**Author:** [@Dilip\_Dwivedi](https://discuss.elastic.co/u/Dilip_Dwivedi)\ **Replies:** 5\ **Last updated:** [December 4, 2015, 4:46am UTC](https://discuss.elastic.co/t/logstash-service-not-starting-it-is-in-paused-status/29581 "2015-12-04T04:46:55Z")
logstash service is in paused status and when I am trying to restart or resume logstash service ,attached message pops up --- ## [HDFS as Input for Logstash](https://discuss.elastic.co/t/hdfs-as-input-for-logstash/36301)
**Author:** [@Omer\_Uludag](https://discuss.elastic.co/u/Omer_Uludag)\ **Replies:** 2\ **Last updated:** [December 3, 2015, 8:22pm UTC](https://discuss.elastic.co/t/hdfs-as-input-for-logstash/36301 "2015-12-03T20:22:15Z")
Hello together, I am new to the ELK stack and I wonder if one need an extra logstash plugin for integrating logstash with HDFS as an Input. Unfortunately, I am not sure if the plugins are only designed for the output d… --- ## [Slow log file read from url for geoip](https://discuss.elastic.co/t/slow-log-file-read-from-url-for-geoip/36126)
**Author:** [@Hans](https://discuss.elastic.co/u/Hans)\ **Replies:** 10\ **Last updated:** [December 3, 2015, 6:10pm UTC](https://discuss.elastic.co/t/slow-log-file-read-from-url-for-geoip/36126 "2015-12-03T18:10:03Z")
Hi All, I am currently facing challenges with geoip processing for url. Does anyone maybe have any suggestions how to increase the processing speed? Here is the filter: geoip { source =\> "url" target =\> "geoip"… --- ## [Using http output plugin for multi-form rest api call and attaching message as a file](https://discuss.elastic.co/t/using-http-output-plugin-for-multi-form-rest-api-call-and-attaching-message-as-a-file/36214)
**Author:** [@SKing](https://discuss.elastic.co/u/SKing)\ **Replies:** 3\ **Last updated:** [December 3, 2015, 5:20pm UTC](https://discuss.elastic.co/t/using-http-output-plugin-for-multi-form-rest-api-call-and-attaching-message-as-a-file/36214 "2015-12-03T17:20:44Z")
Hi guys, first time poster. I've started using logstash to collect event data. The requirement I have is to send this information as a file attachment using a rest api. Now, I'd rather not go to the "expense" of hav… --- ## [Parse WebLogic Access Log File](https://discuss.elastic.co/t/parse-weblogic-access-log-file/35960)
**Author:** [@Diego\_Grecco](https://discuss.elastic.co/u/Diego_Grecco)\ **Replies:** 6\ **Last updated:** [December 3, 2015, 4:55pm UTC](https://discuss.elastic.co/t/parse-weblogic-access-log-file/35960 "2015-12-03T16:55:18Z")
Hey guys, i am trying to parse the WebLogic access log file with the pattern below, but it doesn't match. Log Example 2015-11-30 18:45:54 0.001 1164 GET /sample-app/ 404 - "1.0A3sN… --- ## [Add\_field to add a custom hyperlink](https://discuss.elastic.co/t/add-field-to-add-a-custom-hyperlink/36225)
**Author:** [@mc1392](https://discuss.elastic.co/u/mc1392)\ **Replies:** 2\ **Last updated:** [December 3, 2015, 3:39pm UTC](https://discuss.elastic.co/t/add-field-to-add-a-custom-hyperlink/36225 "2015-12-03T15:39:41Z")
Is there any way to add a hyperlink to the data table? A clickable hyperlink? I am concatenating the field called Id, which lives in my document. I can get a url into the document, but it's not clickable, it's just pla… --- ## [Retrieving data through a cli interface (ssh/telnet)](https://discuss.elastic.co/t/retrieving-data-through-a-cli-interface-ssh-telnet/36201)
**Author:** [@warEagle](https://discuss.elastic.co/u/warEagle)\ **Replies:** 3\ **Last updated:** [December 3, 2015, 3:38pm UTC](https://discuss.elastic.co/t/retrieving-data-through-a-cli-interface-ssh-telnet/36201 "2015-12-03T15:38:44Z")
Noob situation and questions: I have a setup where I can run filebeat and send updated logs back to elasticsearch. This works well on conventional linux servers where I can control what is installed. However, some en… --- ## [How to make logstash-forwarder treat files from svn as updated not as rotated](https://discuss.elastic.co/t/how-to-make-logstash-forwarder-treat-files-from-svn-as-updated-not-as-rotated/36295)
**Author:** [@QuantumDamage](https://discuss.elastic.co/u/QuantumDamage)\ **Replies:** 0\ **Last updated:** [December 3, 2015, 3:00pm UTC](https://discuss.elastic.co/t/how-to-make-logstash-forwarder-treat-files-from-svn-as-updated-not-as-rotated/36295 "2015-12-03T15:00:12Z")
Hi. I'm monitoring files which are periodically updated from SVN with logstash-forwarder, and I observed that logstash-forwarder treats them as rotated files and starts pushing them from beginning, even if only one line … --- ## [Kafka logstash plugin on a clustered zookeeper setup](https://discuss.elastic.co/t/kafka-logstash-plugin-on-a-clustered-zookeeper-setup/36255)
**Author:** [@shivam\_singh](https://discuss.elastic.co/u/shivam_singh)\ **Replies:** 5\ **Last updated:** [December 3, 2015, 1:57pm UTC](https://discuss.elastic.co/t/kafka-logstash-plugin-on-a-clustered-zookeeper-setup/36255 "2015-12-03T13:57:43Z")
Hi, I have a clustered setup for zookeeper and kafka. I wanted to parse the kafka topic (multiple topic) logs to logstash. 1. What is the best way to do so? 2. Will kafka-logstash plugin be able to solve my problem? 3… --- ## [Ruby date](https://discuss.elastic.co/t/ruby-date/36283)
**Author:** [@vikas.saini](https://discuss.elastic.co/u/vikas.saini)\ **Replies:** 6\ **Last updated:** [December 3, 2015, 12:21pm UTC](https://discuss.elastic.co/t/ruby-date/36283 "2015-12-03T12:21:35Z")
I searched a lot but confused . how can i check if a string is date or not in ruby filter ? --- ## [SQL Plugin - Last Input Value Tracking](https://discuss.elastic.co/t/sql-plugin-last-input-value-tracking/36264)
**Author:** [@inzanez](https://discuss.elastic.co/u/inzanez)\ **Replies:** 5\ **Last updated:** [December 3, 2015, 11:44am UTC](https://discuss.elastic.co/t/sql-plugin-last-input-value-tracking/36264 "2015-12-03T11:44:30Z")
Hi! I've been playing around with logstash and I'm fowarding syslog data to my ES cluster, which works great. Now I wanted to collect logdata that's stored in SQL databases as well, and found something about a SQL plug… --- ## [Class loading failure with Logstash 2.1.0: oracle.sql.STRUCT](https://discuss.elastic.co/t/class-loading-failure-with-logstash-2-1-0-oracle-sql-struct/36189)
**Author:** [@jrahkonen](https://discuss.elastic.co/u/jrahkonen)\ **Replies:** 1\ **Last updated:** [December 3, 2015, 11:59am UTC](https://discuss.elastic.co/t/class-loading-failure-with-logstash-2-1-0-oracle-sql-struct/36189 "2015-12-03T11:59:30Z")
Hi, I have installed Logstash 2.1.0 on Windows from the zip file and I have tried to read data from Oracle through the input-jdbc plugin. I got it almost to work thanks to this discussion https://discuss.elastic.co/t/l… --- ## [Logstash condition match](https://discuss.elastic.co/t/logstash-condition-match/36207)
**Author:** [@gugansankar](https://discuss.elastic.co/u/gugansankar)\ **Replies:** 4\ **Last updated:** [December 3, 2015, 11:33am UTC](https://discuss.elastic.co/t/logstash-condition-match/36207 "2015-12-03T11:33:55Z")
I have to add one more field , if my condition is true. But its not working. My condition is " Json message has a field called clientip, if its present then one more filed has to be added with message" Log Message : {… --- ## [Splitting Array](https://discuss.elastic.co/t/splitting-array/36187)
**Author:** [@vikas.saini](https://discuss.elastic.co/u/vikas.saini)\ **Replies:** 4\ **Last updated:** [December 3, 2015, 9:25am UTC](https://discuss.elastic.co/t/splitting-array/36187 "2015-12-03T09:25:11Z")
I have an array like "myarray":\[{"name":"alice"},{"age":14}\] and i want to split it and put values as in "dataclass": { "fields":{ "name":"alice", "age":14 } } --- ## [Split a field value and add extracted values in other fields](https://discuss.elastic.co/t/split-a-field-value-and-add-extracted-values-in-other-fields/36155)
**Author:** [@adellarocca](https://discuss.elastic.co/u/adellarocca)\ **Replies:** 2\ **Last updated:** [December 3, 2015, 10:36am UTC](https://discuss.elastic.co/t/split-a-field-value-and-add-extracted-values-in-other-fields/36155 "2015-12-03T10:36:40Z")
Hi at all! I have a field "message" =\> "A306, S1, 6742, prof1, 135.89, 13.89, 45.90,1,1" I want split its value with separator "," and add fields "id\_product" =\> "A306" "id\_model" =\> "S1" "serial" =\> "6742" "profi… --- ## [Kv filter with empty value](https://discuss.elastic.co/t/kv-filter-with-empty-value/36267)
**Author:** [@sebGA](https://discuss.elastic.co/u/sebGA)\ **Replies:** 2\ **Last updated:** [December 3, 2015, 10:21am UTC](https://discuss.elastic.co/t/kv-filter-with-empty-value/36267 "2015-12-03T10:21:46Z")
Hi, When using the logstash kv filter with default parameters ( kv { } ), i have problem when parsing a message with empty values. See the following examples. The result in the first one is not good as the value associ… --- ## [Logstash: call native script in elastic?](https://discuss.elastic.co/t/logstash-call-native-script-in-elastic/36254)
**Author:** [@MarcelHallmann](https://discuss.elastic.co/u/MarcelHallmann)\ **Replies:** 2\ **Last updated:** [December 3, 2015, 10:13am UTC](https://discuss.elastic.co/t/logstash-call-native-script-in-elastic/36254 "2015-12-03T10:13:52Z")
Hi, I wrote a java plugin for elasticsearch as described in Scripting | Elasticsearch Guide \[8.11\] | Elastic. Now I want logstash to call this plugin in the elasticsearch-output part: output { elasticsearch { … --- ## [Mapping definition for \[geoip\] has unsupported parameters: \[path : full\]”}}}}, :level=\>:warn}](https://discuss.elastic.co/t/mapping-definition-for-geoip-has-unsupported-parameters-path-full-level-warn/36263)
**Author:** [@Rajaram\_Surimenu](https://discuss.elastic.co/u/Rajaram_Surimenu)\ **Replies:** 6\ **Last updated:** [December 3, 2015, 10:07am UTC](https://discuss.elastic.co/t/mapping-definition-for-geoip-has-unsupported-parameters-path-full-level-warn/36263 "2015-12-03T10:07:20Z")
Hi, I am trying to connect to remote host of elastic search using logstash. Taken a sample /var/log/message and given as input file path in my logstash.conf. Here is the conf file which i am using : input { file { pa… --- ## [Logstash: how to use multiple geoip filter in one message](https://discuss.elastic.co/t/logstash-how-to-use-multiple-geoip-filter-in-one-message/36248)
**Author:** [@sumeet\_dembra](https://discuss.elastic.co/u/sumeet_dembra)\ **Replies:** 1\ **Last updated:** [December 3, 2015, 7:19am UTC](https://discuss.elastic.co/t/logstash-how-to-use-multiple-geoip-filter-in-one-message/36248 "2015-12-03T07:19:48Z")
Hi, I am using two geoip filters for one message. But the output shows geoip fields only for first geoip filter. Here is the snippet for filters: filter { grep { match =\> \["m… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1212) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1214)