# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1215 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1216 --- ## [Is the email plugin defunct in LS 2.1?](https://discuss.elastic.co/t/is-the-email-plugin-defunct-in-ls-2-1/35999)
**Author:** [@bluethundr](https://discuss.elastic.co/u/bluethundr)\ **Replies:** 3\ **Last updated:** [December 1, 2015, 8:21am UTC](https://discuss.elastic.co/t/is-the-email-plugin-defunct-in-ls-2-1/35999 "2015-12-01T08:21:09Z")
How can I enable e-mail alerting in LS 2.1? This: # Alerting if \[log\_message\] == "POSSIBLE BREAK-IN ATTEMPT!" { email { body =\> "Triggered in: %{message}" subject =\> "This is a Logstash alert for POSSIBLE… --- ## [Process events in reverse order](https://discuss.elastic.co/t/process-events-in-reverse-order/35952)
**Author:** [@devkmsg](https://discuss.elastic.co/u/devkmsg)\ **Replies:** 1\ **Last updated:** [December 1, 2015, 6:57am UTC](https://discuss.elastic.co/t/process-events-in-reverse-order/35952 "2015-12-01T06:57:21Z")
I'm wondering if there is something out there that will process events from a queue in reverse order, that is, newest to oldest. It would be very convenient to process logs in this way, where the newest are the most re… --- ## [Filebeats plugin - failed to download out of all possible locations](https://discuss.elastic.co/t/filebeats-plugin-failed-to-download-out-of-all-possible-locations/35977)
**Author:** [@Raggyman](https://discuss.elastic.co/u/Raggyman)\ **Replies:** 2\ **Last updated:** [December 1, 2015, 4:36am UTC](https://discuss.elastic.co/t/filebeats-plugin-failed-to-download-out-of-all-possible-locations/35977 "2015-12-01T04:36:50Z")
Any idea what is causing the error below : -\> Installing logstash-input-beats... Trying https://download.elastic.co/elasticsearch/release/org/elasticsearch/plugin/logstash-input-beats/2.1.0/logstash-input-beats-2.1.0.… --- ## [Logstash-2.0.0 processes csv twice](https://discuss.elastic.co/t/logstash-2-0-0-processes-csv-twice/35888)
**Author:** [@Saket\_Kumar](https://discuss.elastic.co/u/Saket_Kumar)\ **Replies:** 1\ **Last updated:** [November 30, 2015, 9:45pm UTC](https://discuss.elastic.co/t/logstash-2-0-0-processes-csv-twice/35888 "2015-11-30T21:45:16Z")
I was using logstash-1.x which processed CSV perfectly. Now upgraded LS to logstash-2.0.0 and when it process CSV i see repetition of rows. e.g.: CSV has following columns and values Col1|Col2|Col3 1|2|3 a|b|c x|y|z … --- ## [Logstash 2.1 error on greater than](https://discuss.elastic.co/t/logstash-2-1-error-on-greater-than/35950)
**Author:** [@Gabriel\_Rosca](https://discuss.elastic.co/u/Gabriel_Rosca)\ **Replies:** 1\ **Last updated:** [November 30, 2015, 9:41pm UTC](https://discuss.elastic.co/t/logstash-2-1-error-on-greater-than/35950 "2015-11-30T21:41:35Z")
Hi guys, My logstash crash after I upgrade from 1.5 to 2.1 with the bellow error: NoMethodError: undefined method \`\>' for nil:NilClass output\_func at (eval):529 outputworker at /opt/logstash/vendor/bundle/jrub… --- ## [Logstash-forwarder listening in a port](https://discuss.elastic.co/t/logstash-forwarder-listening-in-a-port/35886)
**Author:** [@billy6](https://discuss.elastic.co/u/billy6)\ **Replies:** 3\ **Last updated:** [November 30, 2015, 9:09pm UTC](https://discuss.elastic.co/t/logstash-forwarder-listening-in-a-port/35886 "2015-11-30T21:09:14Z")
Is possible to have logstash forwarder listening in a port? I have changed logstash from my client server to logstash forwarder, because it is supossed to have a minimum package loss ratio and it's more lightweight. I … --- ## [Missing LOGSTASH\_HOME when running "rake docs:generate-docs"](https://discuss.elastic.co/t/missing-logstash-home-when-running-rake-docs-generate-docs/35949)
**Author:** [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Replies:** 0\ **Last updated:** [November 30, 2015, 8:37pm UTC](https://discuss.elastic.co/t/missing-logstash-home-when-running-rake-docs-generate-docs/35949 "2015-11-30T20:37:20Z")
When I run rake docs:generate-docs from a clean Logstash tree (latest master, commit 00a99c19) I get this: $ rake docs:generate-docs NameError: uninitialized constant LogStash::Environment::LOGSTASH\_HOME const\_missi… --- ## [Windows event logs, NXLog, and Logstash - Oh My!](https://discuss.elastic.co/t/windows-event-logs-nxlog-and-logstash-oh-my/35936)
**Author:** [@edgoad](https://discuss.elastic.co/u/edgoad)\ **Replies:** 3\ **Last updated:** [November 30, 2015, 7:13pm UTC](https://discuss.elastic.co/t/windows-event-logs-nxlog-and-logstash-oh-my/35936 "2015-11-30T19:13:52Z")
I am trying to forward the event logs from my Domain Controllers into Logstash, but something isnt working. I have followed many of the examples out there, but can't get it going. Environment: Ubuntu 15.04 server, Elas… --- ## [Combine parsed fields](https://discuss.elastic.co/t/combine-parsed-fields/35893)
**Author:** [@Adrian\_Martin](https://discuss.elastic.co/u/Adrian_Martin)\ **Replies:** 2\ **Last updated:** [November 30, 2015, 6:58pm UTC](https://discuss.elastic.co/t/combine-parsed-fields/35893 "2015-11-30T18:58:57Z")
add\_field =\> { "host\_device\_name" =\> "%{host} %{fs.device\_name}" } gives me host\_device\_name:"my-machine %{fs.device\_name}" How/Can I referfence the already parsed values? --- ## [Filter empty line with just \\r in it](https://discuss.elastic.co/t/filter-empty-line-with-just-r-in-it/35938)
**Author:** [@pesetskyps](https://discuss.elastic.co/u/pesetskyps)\ **Replies:** 1\ **Last updated:** [November 30, 2015, 6:41pm UTC](https://discuss.elastic.co/t/filter-empty-line-with-just-r-in-it/35938 "2015-11-30T18:41:27Z")
Hi, there is a task to filter out the result with just "\\r" in json represenmtation I tried the following code to filter: if \[Message\] =~ /^\\r$/ { mutate { add\_field =\> { "new\_field" =\> "should be filtered" } } … --- ## [External flat file for host lookup to add tags on network syslogs](https://discuss.elastic.co/t/external-flat-file-for-host-lookup-to-add-tags-on-network-syslogs/32579)
**Author:** [@l1carter](https://discuss.elastic.co/u/l1carter)\ **Replies:** 5\ **Last updated:** [November 30, 2015, 4:04pm UTC](https://discuss.elastic.co/t/external-flat-file-for-host-lookup-to-add-tags-on-network-syslogs/32579 "2015-11-30T16:04:36Z")
All, we use Rancid today to backup router/switch configurations. the config file in Rancid is the in format of: dnsname;manufacture;status so: router01;cisco;up I've figured out how to get syslog-ng to append the d… --- ## [Keeping a Constant variable across Log events?](https://discuss.elastic.co/t/keeping-a-constant-variable-across-log-events/35693)
**Author:** [@inderjeet26](https://discuss.elastic.co/u/inderjeet26)\ **Replies:** 6\ **Last updated:** [November 30, 2015, 3:43pm UTC](https://discuss.elastic.co/t/keeping-a-constant-variable-across-log-events/35693 "2015-11-30T15:43:40Z")
Hello, I want to have a constant value available for all the events getting processed by Logstash. So for example, I want to calculate the unique session IDs based on the Epoch time of the first event. Then subsequent … --- ## [\[SOLVED\] Date filter slowing pipeline](https://discuss.elastic.co/t/solved-date-filter-slowing-pipeline/34909)
**Author:** [@mikula](https://discuss.elastic.co/u/mikula)\ **Replies:** 4\ **Last updated:** [November 30, 2015, 3:29pm UTC](https://discuss.elastic.co/t/solved-date-filter-slowing-pipeline/34909 "2015-11-30T15:29:17Z")
Hello, I have problem when I turn on date parsing in my logstash config, whole pipeline gas a LOT slower (about 10 times). My ELK stack is quite capable (4 8 core Xeon, 16 gb memory severs) running whole ELK on them. An… --- ## [Logstash behaviour is inconsistent](https://discuss.elastic.co/t/logstash-behaviour-is-inconsistent/34965)
**Author:** [@vijay\_dhaks](https://discuss.elastic.co/u/vijay_dhaks)\ **Replies:** 4\ **Last updated:** [November 30, 2015, 2:01pm UTC](https://discuss.elastic.co/t/logstash-behaviour-is-inconsistent/34965 "2015-11-30T14:01:32Z")
Hi, I have recently started learning logstash by following the tutorials. Currently I am facing a weird problem. I have my config as below, input { file { path =\> "/home/test/project/logstash\_sample\_data… --- ## [REDIS and LOGSTASH communication monitoring](https://discuss.elastic.co/t/redis-and-logstash-communication-monitoring/35591)
**Author:** [@billy6](https://discuss.elastic.co/u/billy6)\ **Replies:** 2\ **Last updated:** [November 26, 2015, 8:39am UTC](https://discuss.elastic.co/t/redis-and-logstash-communication-monitoring/35591 "2015-11-26T08:39:10Z")
Hello, I'm using the configuration Logstash in one machine as a shipper and in other machine I have REDIS with logstash, elasticsearch and Kibana. I would like to see how Redis comunicate with logstash in the second … --- ## [Logstash JDBC input : assigning timestamp column](https://discuss.elastic.co/t/logstash-jdbc-input-assigning-timestamp-column/34677)
**Author:** [@Chandan\_PR](https://discuss.elastic.co/u/Chandan_PR)\ **Replies:** 2\ **Last updated:** [November 30, 2015, 11:57am UTC](https://discuss.elastic.co/t/logstash-jdbc-input-assigning-timestamp-column/34677 "2015-11-30T11:57:21Z")
Hi, Using logstash-input-jdbc and logstash-output-elasticsearch plugins I am populating the data from mysql database to elastic search. In the select query I have a column, which is of data type "datetime". When th… --- ## [Dynamic fields](https://discuss.elastic.co/t/dynamic-fields/35309)
**Author:** [@vikas.saini](https://discuss.elastic.co/u/vikas.saini)\ **Replies:** 7\ **Last updated:** [November 30, 2015, 7:14am UTC](https://discuss.elastic.co/t/dynamic-fields/35309 "2015-11-30T07:14:42Z")
i want a nestod json like this and my fields contains this string alice@22#bob@34 i want this json "dataclass":{ "tags":{ "alice":22, "bob":34 } } where i am wrong please suggest ruby { code =\> ' … --- ## [LS failing to start with JDBC or multiple Input plugins](https://discuss.elastic.co/t/ls-failing-to-start-with-jdbc-or-multiple-input-plugins/35837)
**Author:** [@mvenkat\_in](https://discuss.elastic.co/u/mvenkat_in)\ **Replies:** 3\ **Last updated:** [November 30, 2015, 7:05am UTC](https://discuss.elastic.co/t/ls-failing-to-start-with-jdbc-or-multiple-input-plugins/35837 "2015-11-30T07:05:09Z")
Hi My LS config has 2 input plugins 1-FileBeats & 2-JDBC. Here are my queries or issues. 1) LS is failing to start with JDBC plugin and the database listner is down, even though the jdbc\_validate\_connection is set to f… --- ## [Logstash JMS Plugin For Jboss eap 6.4](https://discuss.elastic.co/t/logstash-jms-plugin-for-jboss-eap-6-4/35864)
**Author:** [@premkumar\_r](https://discuss.elastic.co/u/premkumar_r)\ **Replies:** 0\ **Last updated:** [November 30, 2015, 6:54am UTC](https://discuss.elastic.co/t/logstash-jms-plugin-for-jboss-eap-6-4/35864 "2015-11-30T06:54:28Z")
Hi, I'm able to configure logstash as jms listener using logstash jms plugin.I've used jboss 5.0. But while trying to achieve the same using jboss eap 6.4, username is not getting read from jms.yml file of logstash-input… --- ## [Balancing logs flowing from multiple services](https://discuss.elastic.co/t/balancing-logs-flowing-from-multiple-services/35706)
**Author:** [@Deb](https://discuss.elastic.co/u/Deb)\ **Replies:** 7\ **Last updated:** [November 27, 2015, 9:56am UTC](https://discuss.elastic.co/t/balancing-logs-flowing-from-multiple-services/35706 "2015-11-27T09:56:26Z")
We have ELK deployment in which multiple logstash-forwarders (from multiple service logs) pushes log to logstash which then sends it to Kafka and then one more logstash pulls those logs from Kafka and indexes them in Ela… --- ## [Tracking Gauges/Counters value changes](https://discuss.elastic.co/t/tracking-gauges-counters-value-changes/35847)
**Author:** [@mad\_min](https://discuss.elastic.co/u/mad_min)\ **Replies:** 0\ **Last updated:** [November 29, 2015, 10:29pm UTC](https://discuss.elastic.co/t/tracking-gauges-counters-value-changes/35847 "2015-11-29T22:29:29Z")
Hello list, I am tracking interface counters (linux, routers, etc) for packets/bytes transferred over periods of time. However, as these counters are really gauges which are monotonically increasing all the time, plott… --- ## [Logstash \_dateparsefailure error](https://discuss.elastic.co/t/logstash--dateparsefailure-error/35819)
**Author:** [@gugansankar](https://discuss.elastic.co/u/gugansankar)\ **Replies:** 5\ **Last updated:** [November 29, 2015, 4:57pm UTC](https://discuss.elastic.co/t/logstash--dateparsefailure-error/35819 "2015-11-29T16:57:16Z")
How do I match the below timestamp value ?. I'm getting dateparsefailure error. Log Timestamp: 2015-11-28 16:46:41,553 Filter config: grok { match =\> \[ "message", "%{TIMESTAMP\_ISO8601:timestamp}" \] } da… --- ## [How to add customed geo location](https://discuss.elastic.co/t/how-to-add-customed-geo-location/35821)
**Author:** [@SignXer](https://discuss.elastic.co/u/SignXer)\ **Replies:** 1\ **Last updated:** [November 29, 2015, 10:30am UTC](https://discuss.elastic.co/t/how-to-add-customed-geo-location/35821 "2015-11-29T10:30:19Z")
Hi Here is my log: Nov 29 16:29:40 2015 10.248.8.39 KERNEL(H-2-H206-01@10.248.8.39): \[4415406.544000\] 6 8 0 0% Low 0 0% Low 0 0% Low 120437 This log from an AP from a building and I have it's coordinates. The IP ad… --- ## [Generate dynamic date for ES Index](https://discuss.elastic.co/t/generate-dynamic-date-for-es-index/35797)
**Author:** [@mvenkat\_in](https://discuss.elastic.co/u/mvenkat_in)\ **Replies:** 4\ **Last updated:** [November 29, 2015, 12:03am UTC](https://discuss.elastic.co/t/generate-dynamic-date-for-es-index/35797 "2015-11-29T00:03:51Z")
Hi Below is the simple ES output which indexes to e2e-YYYY.MM.dd index in ES. i.e., of the Today's date. output { elasticsearch { hosts =\> "host:9200" index =\> "e2e-%{+YYYY.MM.dd}… --- ## [Logstash rabbitmq ssl certificate support](https://discuss.elastic.co/t/logstash-rabbitmq-ssl-certificate-support/35541)
**Author:** [@saggarsunil](https://discuss.elastic.co/u/saggarsunil)\ **Replies:** 1\ **Last updated:** [November 28, 2015, 7:06am UTC](https://discuss.elastic.co/t/logstash-rabbitmq-ssl-certificate-support/35541 "2015-11-28T07:06:50Z")
Hi Team, I am trying to connect to rabbitmq queue which is protected by ssl certificates. In the plugin information, i don't see any options to provide ssl\_cert, etc Does current plugin support authentication using … --- ## [How to parse IP address from file /var/log/syslog in Logstash 10-syslog-conf](https://discuss.elastic.co/t/how-to-parse-ip-address-from-file-var-log-syslog-in-logstash-10-syslog-conf/35701)
**Author:** [@lewis151](https://discuss.elastic.co/u/lewis151)\ **Replies:** 7\ **Last updated:** [November 28, 2015, 1:53am UTC](https://discuss.elastic.co/t/how-to-parse-ip-address-from-file-var-log-syslog-in-logstash-10-syslog-conf/35701 "2015-11-28T01:53:34Z")
Time file syslog\_message syslog\_program received\_from November 26th 2015, 18:00:49.000 /var/log/syslog Invalid response packet from host 131.247.30.106. avahi-daemon xen3ubut14dt-0 --- ## [Pushing logs to logstash of elastic account](https://discuss.elastic.co/t/pushing-logs-to-logstash-of-elastic-account/35737)
**Author:** [@Rajaram\_Surimenu](https://discuss.elastic.co/u/Rajaram_Surimenu)\ **Replies:** 1\ **Last updated:** [November 27, 2015, 10:40pm UTC](https://discuss.elastic.co/t/pushing-logs-to-logstash-of-elastic-account/35737 "2015-11-27T22:40:11Z")
Hi, I have an account in http://found.elastic.co. I would like to configure logstash under .ebextensions of WebContent folder (eclipse ) in such a way that it should pickup my tomcat logs installed in aws instance and… --- ## [Parsing log using grok format](https://discuss.elastic.co/t/parsing-log-using-grok-format/35779)
**Author:** [@openRepo](https://discuss.elastic.co/u/openRepo)\ **Replies:** 1\ **Last updated:** [November 27, 2015, 5:22pm UTC](https://discuss.elastic.co/t/parsing-log-using-grok-format/35779 "2015-11-27T17:22:32Z")
Hello, I am new to logstash and trying to parse below log using grok format. 2015-11-27 11:51:28,103 INFO org.xyz.abc.ClassName @ anonymous:session\_id=20B27B5F10A828221F1C3D8B578267E9:ip\_addr=xx.xxx.xx.xxx:view\_col… --- ## [Logstash input plugin generator to generate dynamic data for elastic search](https://discuss.elastic.co/t/logstash-input-plugin-generator-to-generate-dynamic-data-for-elastic-search/35781)
**Author:** [@priya](https://discuss.elastic.co/u/priya)\ **Replies:** 0\ **Last updated:** [November 27, 2015, 4:34pm UTC](https://discuss.elastic.co/t/logstash-input-plugin-generator-to-generate-dynamic-data-for-elastic-search/35781 "2015-11-27T16:34:33Z")
I was wondering if we could use regular expression to specify the data to be emitted so that the data that gets generated is as much as possible random or different every time - with the constraint that it fits into the… --- ## [LS 2.0 & Java Memory Leak](https://discuss.elastic.co/t/ls-2-0-java-memory-leak/35732)
**Author:** [@Kryten](https://discuss.elastic.co/u/Kryten)\ **Replies:** 1\ **Last updated:** [November 27, 2015, 1:55pm UTC](https://discuss.elastic.co/t/ls-2-0-java-memory-leak/35732 "2015-11-27T13:55:06Z")
Hi, Can someone please confirm whether or not the latest LS 2.1 release fixes the Java memory leak issue described here: Since deploying LS 2.0 to a number of Windows machines I have been seeing the java.exe process … [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1214) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1216)