# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1218 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1219 --- ## [Not able to install the logstash-input-jdbc 2.0.5 plugin](https://discuss.elastic.co/t/not-able-to-install-the-logstash-input-jdbc-2-0-5-plugin/35251)
**Author:** [@chaudharikiranp](https://discuss.elastic.co/u/chaudharikiranp)\ **Replies:** 0\ **Last updated:** [November 22, 2015, 10:01pm UTC](https://discuss.elastic.co/t/not-able-to-install-the-logstash-input-jdbc-2-0-5-plugin/35251 "2015-11-22T22:01:40Z")
Hi ! I am not able to install the logstash-input-jdbc2.0.5 plugin from https://rubygems.org/gems/logstash-input-jdbc/versions/2.0.5. I tried mentioning 'gem 'logstash-input-jdbc', '~\> 2.0', '\>= 2.0.5' entry inside gemfi… --- ## [Default settings used: Filter workers: 2](https://discuss.elastic.co/t/default-settings-used-filter-workers-2/35201)
**Author:** [@aqiao](https://discuss.elastic.co/u/aqiao)\ **Replies:** 8\ **Last updated:** [November 22, 2015, 9:15pm UTC](https://discuss.elastic.co/t/default-settings-used-filter-workers-2/35201 "2015-11-22T21:15:00Z")
when i start logstash using bin/logtash -f test.config, it shows the message as title ps. i have removed all .sincedb\_\* files and the logstash version is 2.0 test.config \`input { file { path =\> "/data/tmp/elktest/t… --- ## [Tcp input problem](https://discuss.elastic.co/t/tcp-input-problem/35238)
**Author:** [@Ahmed\_Faik](https://discuss.elastic.co/u/Ahmed_Faik)\ **Replies:** 1\ **Last updated:** [November 22, 2015, 9:09pm UTC](https://discuss.elastic.co/t/tcp-input-problem/35238 "2015-11-22T21:09:46Z")
Hi every one, I try to receive data through TCP port from another pc to logstash, then save it in csv file output, the configure file which i write is: input { tcp { host =\> "192.168.0.188" port =\> "12397" } } … --- ## [Trying to access nested json in logstash mutate filter](https://discuss.elastic.co/t/trying-to-access-nested-json-in-logstash-mutate-filter/35120)
**Author:** [@skanjila](https://discuss.elastic.co/u/skanjila)\ **Replies:** 9\ **Last updated:** [November 22, 2015, 7:16pm UTC](https://discuss.elastic.co/t/trying-to-access-nested-json-in-logstash-mutate-filter/35120 "2015-11-22T19:16:07Z")
Hello Folks, I've tried hacking at this for a while now so I thought I'd ask for some help, I have the following json in the message string associated with my input: {"1.0":{"metric-id":"45","customer-id":"Cust","alarm… --- ## [How to output data to HBase?](https://discuss.elastic.co/t/how-to-output-data-to-hbase/35213)
**Author:** [@ebuildy](https://discuss.elastic.co/u/ebuildy)\ **Replies:** 0\ **Last updated:** [November 21, 2015, 10:38am UTC](https://discuss.elastic.co/t/how-to-output-data-to-hbase/35213 "2015-11-21T10:38:38Z")
I am using LogStash 2.0, with a TCP input, some cool filters and output to elasticsearch. I also want to output to HBase, do you have any suggestion or return on experience about? Thanks you, Tom --- ## [High CPU usage docker container running Logstash 2.0](https://discuss.elastic.co/t/high-cpu-usage-docker-container-running-logstash-2-0/35180)
**Author:** [@danwald](https://discuss.elastic.co/u/danwald)\ **Replies:** 2\ **Last updated:** [November 21, 2015, 10:26am UTC](https://discuss.elastic.co/t/high-cpu-usage-docker-container-running-logstash-2-0/35180 "2015-11-21T10:26:25Z")
I am running the official logstash2.0 (using marathon via mesos) docker and the process is using a lot of CPU. Heres what the top on the process and its threads (below). The process eventually dies failing to connect to… --- ## [Jdbc\_password configuration for logstash](https://discuss.elastic.co/t/jdbc-password-configuration-for-logstash/35178)
**Author:** [@learn2287](https://discuss.elastic.co/u/learn2287)\ **Replies:** 1\ **Last updated:** [November 21, 2015, 5:55am UTC](https://discuss.elastic.co/t/jdbc-password-configuration-for-logstash/35178 "2015-11-21T05:55:47Z")
Is there a way to mask/hide the jdbc\_password parameter. Config File: input { jdbc { jdbc\_driver\_library =\> "C:\\Program Files\\DbVisualizer\\jdbc\\oracle\\ojdbc6.jar" jdbc\_driver\_class =\> "Java::oracle.jdbc… --- ## [Logstash 2.0.0 an GC tunning](https://discuss.elastic.co/t/logstash-2-0-0-an-gc-tunning/35166)
**Author:** [@jsosic](https://discuss.elastic.co/u/jsosic)\ **Replies:** 1\ **Last updated:** [November 21, 2015, 5:52am UTC](https://discuss.elastic.co/t/logstash-2-0-0-an-gc-tunning/35166 "2015-11-21T05:52:08Z")
Hi guys, I'm seeing a bunch of these log entries in GC log, which are logged almost ~5-6 of them every second. : 34426K-\>585K(38080K), 0.0017447 secs\] 83465K-\>49625K(122752K), 0.0018111 secs\] \[Times: user=0.02 sys=0… --- ## [Plugin update fails](https://discuss.elastic.co/t/plugin-update-fails/35154)
**Author:** [@McStork](https://discuss.elastic.co/u/McStork)\ **Replies:** 1\ **Last updated:** [November 21, 2015, 5:42am UTC](https://discuss.elastic.co/t/plugin-update-fails/35154 "2015-11-21T05:42:12Z")
Hello, One of our Logstash 2.0.0 has an issue with the update command. Error Bundler::InstallError, retrying 10/10 An error occurred while installing nokogiri (1.6.6.4), and Bundler cannot continue. Make sure that g… --- ## [Logstash mutate filter, rename - "Exception in filterworker", "exception"=\>#\](https://discuss.elastic.co/t/logstash-mutate-filter-rename-exception-in-filterworker-exception-indexerror-string-not-matched/33438)
**Author:** [@bgow](https://discuss.elastic.co/u/bgow)\ **Replies:** 5\ **Last updated:** [November 20, 2015, 8:45pm UTC](https://discuss.elastic.co/t/logstash-mutate-filter-rename-exception-in-filterworker-exception-indexerror-string-not-matched/33438 "2015-11-20T20:45:15Z")
I'm trying to import CSV files into a nested structure in Elasticsearch (v.1.7.3), on a Windows 7 Professional machine. When I use the mutate filter with rename in Logstash (v.1.5.4) I get an: {:timestamp=\>"2015-10-26… --- ## [Multiline Config from LS1.5.4 not working in LS2.0.0](https://discuss.elastic.co/t/multiline-config-from-ls1-5-4-not-working-in-ls2-0-0/35086)
**Author:** [@mad\_min](https://discuss.elastic.co/u/mad_min)\ **Replies:** 7\ **Last updated:** [November 20, 2015, 6:49pm UTC](https://discuss.elastic.co/t/multiline-config-from-ls1-5-4-not-working-in-ls2-0-0/35086 "2015-11-20T18:49:28Z")
Hi LS community, I am trying to migrate my LS setup from 1.5.4 (which doesnt seem to be happy with ES2.0.0) over to LS 2.0.0. Everything is the same except the change from 'host' --\> 'hosts'. However, I am not able t… --- ## [Logstash nightly snapshots?](https://discuss.elastic.co/t/logstash-nightly-snapshots/35173)
**Author:** [@jcollie](https://discuss.elastic.co/u/jcollie)\ **Replies:** 0\ **Last updated:** [November 20, 2015, 5:23pm UTC](https://discuss.elastic.co/t/logstash-nightly-snapshots/35173 "2015-11-20T17:23:45Z")
Are nightly snapshots available for Logstash? I'm hitting some bugs that have fixes in git that I'd like to test out but don't want to build from scratch if I don't have to. --- ## [Grok pattern to split the stream name!](https://discuss.elastic.co/t/grok-pattern-to-split-the-stream-name/34696)
**Author:** [@gugansankar](https://discuss.elastic.co/u/gugansankar)\ **Replies:** 8\ **Last updated:** [November 20, 2015, 2:55pm UTC](https://discuss.elastic.co/t/grok-pattern-to-split-the-stream-name/34696 "2015-11-20T14:55:24Z")
Again, Come with Wowza Log parsing issue ! When I parse the wowza server logs, the stream name come as below, Is there any way to split exact stream name alone from the entire url ?. Convert the below one , FROM w… --- ## [String interpolation for HTTP output message format](https://discuss.elastic.co/t/string-interpolation-for-http-output-message-format/34917)
**Author:** [@ak0ska](https://discuss.elastic.co/u/ak0ska)\ **Replies:** 4\ **Last updated:** [November 20, 2015, 10:12am UTC](https://discuss.elastic.co/t/string-interpolation-for-http-output-message-format/34917 "2015-11-20T10:12:41Z")
Hello, I am trying to send some data gathered with the JDBC input plugin to an HTTP endpoint. I have to make my POST body match a certain specification, and so I use message format for the HTTP output plugin. This i… --- ## [Unable to remove field form nested object during mutate](https://discuss.elastic.co/t/unable-to-remove-field-form-nested-object-during-mutate/34083)
**Author:** [@Ramdev\_Wudali](https://discuss.elastic.co/u/Ramdev_Wudali)\ **Replies:** 3\ **Last updated:** [November 20, 2015, 7:34am UTC](https://discuss.elastic.co/t/unable-to-remove-field-form-nested-object-during-mutate/34083 "2015-11-20T07:34:56Z")
Hi: I am using logstash 1.5.3 and trying to reindex an existing index to a new index with modified mapping. To test if this works on nested fields, I gave the following config a shot : input { elasticsearch {… --- ## [Need help for multiline hyperic tomcat wrapper logs with datestamp on each line of the exception](https://discuss.elastic.co/t/need-help-for-multiline-hyperic-tomcat-wrapper-logs-with-datestamp-on-each-line-of-the-exception/35096)
**Author:** [@richinkansal](https://discuss.elastic.co/u/richinkansal)\ **Replies:** 2\ **Last updated:** [November 20, 2015, 6:42am UTC](https://discuss.elastic.co/t/need-help-for-multiline-hyperic-tomcat-wrapper-logs-with-datestamp-on-each-line-of-the-exception/35096 "2015-11-20T06:42:13Z")
Request: Need help for multiline hyperic tomcat wrapper logs with datestamp on each line of the exception. We have developed below mentioned grok filters for the single line wrapper logs but unable to convert that into … --- ## [Logstash circuit breaker triggered but marvel monitoring metrics seems OK](https://discuss.elastic.co/t/logstash-circuit-breaker-triggered-but-marvel-monitoring-metrics-seems-ok/35093)
**Author:** [@maxhyjal](https://discuss.elastic.co/u/maxhyjal)\ **Replies:** 1\ **Last updated:** [November 20, 2015, 3:40am UTC](https://discuss.elastic.co/t/logstash-circuit-breaker-triggered-but-marvel-monitoring-metrics-seems-ok/35093 "2015-11-20T03:40:25Z")
I've run into this prior to 2.0 and after I upgrade the Elasticsearch and Logstash stack to 2.0, is there a good way to get around this? Keep getting those in logstash.log message=\>"Lumberjack input: The circuit break… --- ## [S3 output plugin through socks proxy](https://discuss.elastic.co/t/s3-output-plugin-through-socks-proxy/35027)
**Author:** [@jelmstrom](https://discuss.elastic.co/u/jelmstrom)\ **Replies:** 1\ **Last updated:** [November 20, 2015, 3:21am UTC](https://discuss.elastic.co/t/s3-output-plugin-through-socks-proxy/35027 "2015-11-20T03:21:12Z")
Im trying to use the s3 output plugin to share and backup logs,and this works as expected in out test environment. But in UAT and PROD environment I keep getting an "The error reported is: \\n End of file reached" error… --- ## [Severity labels](https://discuss.elastic.co/t/severity-labels/35028)
**Author:** [@Captain\_Sparklez](https://discuss.elastic.co/u/Captain_Sparklez)\ **Replies:** 1\ **Last updated:** [November 20, 2015, 2:02am UTC](https://discuss.elastic.co/t/severity-labels/35028 "2015-11-20T02:02:30Z")
Hi there! I wanted to check something regarding logging. This might be meant for Watcher but I wasn't sure. I want to try and label my logs based on their values. Lets say I want four categories: Okay, Problem, Warning… --- ## [Cluster setting in elasticsearch http output](https://discuss.elastic.co/t/cluster-setting-in-elasticsearch-http-output/34477)
**Author:** [@wby](https://discuss.elastic.co/u/wby)\ **Replies:** 2\ **Last updated:** [November 20, 2015, 1:51am UTC](https://discuss.elastic.co/t/cluster-setting-in-elasticsearch-http-output/34477 "2015-11-20T01:51:08Z")
\[Please move to logstash forum; sorry\] https://www.elastic.co/guide/en/logstash/2.0/breaking-changes.html#\_configuration\_changes says: The Elasticsearch output plugin configuration has the following changes: \[...\] New … --- ## [Fresh install not getting latest beats input plugin](https://discuss.elastic.co/t/fresh-install-not-getting-latest-beats-input-plugin/35092)
**Author:** [@jcollie](https://discuss.elastic.co/u/jcollie)\ **Replies:** 0\ **Last updated:** [November 19, 2015, 10:28pm UTC](https://discuss.elastic.co/t/fresh-install-not-getting-latest-beats-input-plugin/35092 "2015-11-19T22:28:46Z")
I'm building a Logstash container but it isn't getting the latest beats plugin. The container is being built from scratch each time, but the plugin install command installs version 0.9.2. A subsequent plugin update com… --- ## ["Lumberjack input: the pipeline is blocked"](https://discuss.elastic.co/t/lumberjack-input-the-pipeline-is-blocked/31645)
**Author:** [@Mark\_van\_Rossum](https://discuss.elastic.co/u/Mark_van_Rossum)\ **Replies:** 6\ **Last updated:** [November 19, 2015, 10:24pm UTC](https://discuss.elastic.co/t/lumberjack-input-the-pipeline-is-blocked/31645 "2015-11-19T22:24:08Z")
I have a basic ELK stack with Lumberjack shipping data into Logstash, and then to Elasticsearch. Versions: Logstash :1.5.3 Elasticsearch 1.7.0 I'm getting the errors below logged a lot in logstash.log. {:timestamp… --- ## [Logstash stop logging after few minutes / hours](https://discuss.elastic.co/t/logstash-stop-logging-after-few-minutes-hours/35078)
**Author:** [@vsdr](https://discuss.elastic.co/u/vsdr)\ **Replies:** 1\ **Last updated:** [November 19, 2015, 8:38pm UTC](https://discuss.elastic.co/t/logstash-stop-logging-after-few-minutes-hours/35078 "2015-11-19T20:38:40Z")
We are facing crash since we set up a new stack ELK 2.0 We saw errors like this : {:timestamp=\>"2015-11-19T18:59:59.000000+0100", :message=\>"Attempted to send a bulk request to Elasticsearch configured at '\[\\"https:/… --- ## [Kafka optimal configuration](https://discuss.elastic.co/t/kafka-optimal-configuration/34554)
**Author:** [@allenmchan](https://discuss.elastic.co/u/allenmchan)\ **Replies:** 1\ **Last updated:** [November 19, 2015, 7:00pm UTC](https://discuss.elastic.co/t/kafka-optimal-configuration/34554 "2015-11-19T19:00:45Z")
I am trying to use Kafka to replace redis. I am curious if anyone can help with this question I have three brokers that would have 4 topics. Each topic would have dedicated three logstash indexers. My question shoul… --- ## [Passing a Log4J2 file with multilines](https://discuss.elastic.co/t/passing-a-log4j2-file-with-multilines/34913)
**Author:** [@whgibbo](https://discuss.elastic.co/u/whgibbo)\ **Replies:** 3\ **Last updated:** [November 19, 2015, 6:28pm UTC](https://discuss.elastic.co/t/passing-a-log4j2-file-with-multilines/34913 "2015-11-19T18:28:19Z")
Hi, I've just started playing with Logstash 2.0.0 and so far it looks great :smile: And it is working fine for single line entries, but not for multiline entries. :frowning: Here is my config file to pass the file. i… --- ## [Elasticsearch output cluster\_name](https://discuss.elastic.co/t/elasticsearch-output-cluster-name/33770)
**Author:** [@tgdesrochers](https://discuss.elastic.co/u/tgdesrochers)\ **Replies:** 9\ **Last updated:** [November 19, 2015, 4:20pm UTC](https://discuss.elastic.co/t/elasticsearch-output-cluster-name/33770 "2015-11-19T16:20:05Z")
Before upgrading to version 2.0 I was able to reference my elasticsearch cluster in my logstash conf file with the cluster name option. With the upgrade to ES 2.0 and logstash 2.o that option is no longer available. No… --- ## [Map geoip.location to geo\_point by default](https://discuss.elastic.co/t/map-geoip-location-to-geo-point-by-default/35055)
**Author:** [@jonblack](https://discuss.elastic.co/u/jonblack)\ **Replies:** 4\ **Last updated:** [November 19, 2015, 3:50pm UTC](https://discuss.elastic.co/t/map-geoip-location-to-geo-point-by-default/35055 "2015-11-19T15:50:46Z")
I'm trying to visualise geoip location on a tile map in Kibana but am getting the following error: No Compatible Fields: The "\[logstash-nginx-access-\]YYYY.MM.DD" index pattern does not contain any of the following fiel… --- ## [Using two custom filters prevents one of them to be used](https://discuss.elastic.co/t/using-two-custom-filters-prevents-one-of-them-to-be-used/35030)
**Author:** [@Isra](https://discuss.elastic.co/u/Isra)\ **Replies:** 1\ **Last updated:** [November 19, 2015, 3:06pm UTC](https://discuss.elastic.co/t/using-two-custom-filters-prevents-one-of-them-to-be-used/35030 "2015-11-19T15:06:16Z")
I created two filters; logstash-filter-one and logstash-filter-two. When I tested logstash-filter-one, it worked just fine and created the fields I wanted it to. However, when I used logstash-filter-two alongside logstas… --- ## [Need to Insert custom data!](https://discuss.elastic.co/t/need-to-insert-custom-data/35044)
**Author:** [@gugansankar](https://discuss.elastic.co/u/gugansankar)\ **Replies:** 1\ **Last updated:** [November 19, 2015, 3:05pm UTC](https://discuss.elastic.co/t/need-to-insert-custom-data/35044 "2015-11-19T15:05:27Z")
My Log file have part of info and API will have a part of information for a SINGLE EVENT Is it possible to merge these two info as a single document using Logstash \[ via any of input-plugin/grok pattern \] ? For examp… --- ## [Filtering data from database](https://discuss.elastic.co/t/filtering-data-from-database/34797)
**Author:** [@vikas.saini](https://discuss.elastic.co/u/vikas.saini)\ **Replies:** 22\ **Last updated:** [November 19, 2015, 2:49pm UTC](https://discuss.elastic.co/t/filtering-data-from-database/34797 "2015-11-19T14:49:37Z")
I am taking data from database tables .how to filter this data ?can i filter [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1217) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1219)