# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1220 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1221 --- ## [Logstash 1.5.4 Java.exe memory leak](https://discuss.elastic.co/t/logstash-1-5-4-java-exe-memory-leak/34680)
**Author:** [@jaminvp](https://discuss.elastic.co/u/jaminvp)\ **Replies:** 1\ **Last updated:** [November 17, 2015, 9:08am UTC](https://discuss.elastic.co/t/logstash-1-5-4-java-exe-memory-leak/34680 "2015-11-17T09:08:24Z")
Greetings, Anyone else experiencing memory leaks with Logstash 1.5.4 when you install Logstash as a service with NSSM.exe? When running Logstash as a process (with logstash.bat), there's no steady increase in private b… --- ## [What charset to use?](https://discuss.elastic.co/t/what-charset-to-use/34722)
**Author:** [@fares](https://discuss.elastic.co/u/fares)\ **Replies:** 2\ **Last updated:** [November 17, 2015, 9:00am UTC](https://discuss.elastic.co/t/what-charset-to-use/34722 "2015-11-17T09:00:24Z")
Hi, Im trying to read non UTF-8 file, it's IBM 500 file but i can't find it in the charset list provided with the plugin so i tried "US-ASCII". Here is my config file: input{ file { path =\>..… --- ## [What is polling\_frequency in sqs plugin?](https://discuss.elastic.co/t/what-is-polling-frequency-in-sqs-plugin/34768)
**Author:** [@dhaval.b](https://discuss.elastic.co/u/dhaval.b)\ **Replies:** 1\ **Last updated:** [November 17, 2015, 8:57am UTC](https://discuss.elastic.co/t/what-is-polling-frequency-in-sqs-plugin/34768 "2015-11-17T08:57:16Z")
How polling\_frequency parameter works in logstash sqs plugin. default time for this parameter is 20 seconds. Does it mean that logstash will get 10 messages from sqs, process it and wait for 20 seconds before sending ano… --- ## [How to pass array field to kv-filter](https://discuss.elastic.co/t/how-to-pass-array-field-to-kv-filter/34496)
**Author:** [@mne](https://discuss.elastic.co/u/mne)\ **Replies:** 14\ **Last updated:** [November 17, 2015, 8:24am UTC](https://discuss.elastic.co/t/how-to-pass-array-field-to-kv-filter/34496 "2015-11-17T08:24:26Z")
Hi all, i'm looking for a way within logstash to pass an array to the kv-filter and use it as parameter "include\_fields". For example in my json event i have an array named "keys": "keys" =\> \[ \[0\] "key1", … --- ## [Message.raw in logstash 2](https://discuss.elastic.co/t/message-raw-in-logstash-2/34659)
**Author:** [@jyotirtest](https://discuss.elastic.co/u/jyotirtest)\ **Replies:** 5\ **Last updated:** [November 17, 2015, 4:46am UTC](https://discuss.elastic.co/t/message-raw-in-logstash-2/34659 "2015-11-17T04:46:03Z")
Hi, We were using logstash 1.5 and recently upgraded to logstash 2. We are unable to get message.raw in elasticsearch. We followed mentioned link to make it work on logstash 1.5 But it is not working in logstas… --- ## [Retrying failed action with response code: 429](https://discuss.elastic.co/t/retrying-failed-action-with-response-code-429/34679)
**Author:** [@jsosic](https://discuss.elastic.co/u/jsosic)\ **Replies:** 5\ **Last updated:** [November 16, 2015, 10:31pm UTC](https://discuss.elastic.co/t/retrying-failed-action-with-response-code-429/34679 "2015-11-16T22:31:08Z")
Hi guys, I get a lot of the messages in logstash log that look like: retrying failed action with response code: 429 I'm using redis as input, and elasticsearch as output and my logstash.conf is pretty straightfor… --- ## [Repeated keys converted to array](https://discuss.elastic.co/t/repeated-keys-converted-to-array/33035)
**Author:** [@mihir\_ray](https://discuss.elastic.co/u/mihir_ray)\ **Replies:** 5\ **Last updated:** [November 16, 2015, 9:41pm UTC](https://discuss.elastic.co/t/repeated-keys-converted-to-array/33035 "2015-11-16T21:41:30Z")
HI, I am getting repeated keys in my log data. In such a case i want to just pick one key-value pair for my output, but logstash creates a array of values. Is there a way to pick just one key-value when there are du… --- ## [Logstash and VirusTotal](https://discuss.elastic.co/t/logstash-and-virustotal/34720)
**Author:** [@sampasei](https://discuss.elastic.co/u/sampasei)\ **Replies:** 1\ **Last updated:** [November 16, 2015, 8:11pm UTC](https://discuss.elastic.co/t/logstash-and-virustotal/34720 "2015-11-16T20:11:37Z")
Hi All, i've tried to use Lostash 2.0 with VirusTotal plugin https://github.com/coolacid/logstash-filter-virustotal without any result. Here my config file snippet: virustotal { apikey =\> "myapikey" … --- ## [Date parsing issue - returns wrong month](https://discuss.elastic.co/t/date-parsing-issue-returns-wrong-month/34476)
**Author:** [@thomas.dotreppe](https://discuss.elastic.co/u/thomas.dotreppe)\ **Replies:** 5\ **Last updated:** [November 16, 2015, 5:21pm UTC](https://discuss.elastic.co/t/date-parsing-issue-returns-wrong-month/34476 "2015-11-16T17:21:43Z")
I originally the data was not in ElasticSearch but after some help, it looks like the date was parsed incorrectly (it gets the month incorrectly). Here are the 3 (original) lines coming from the log file: \[MST Nov … --- ## [Is this conf file working for csv import?](https://discuss.elastic.co/t/is-this-conf-file-working-for-csv-import/33289)
**Author:** [@GregMeadows](https://discuss.elastic.co/u/GregMeadows)\ **Replies:** 9\ **Last updated:** [November 16, 2015, 4:40pm UTC](https://discuss.elastic.co/t/is-this-conf-file-working-for-csv-import/33289 "2015-11-16T16:40:16Z")
I am trying to get log stash to monitor a folder to import my csv data load to elastic search and view in Kibana. Logstash/ES/Kibana instances are all up and running but LS does not create the index. "default settings… --- ## [Safely shutting down logstash on AWS auto-scaling group](https://discuss.elastic.co/t/safely-shutting-down-logstash-on-aws-auto-scaling-group/34528)
**Author:** [@jelliott](https://discuss.elastic.co/u/jelliott)\ **Replies:** 0\ **Last updated:** [November 13, 2015, 4:11pm UTC](https://discuss.elastic.co/t/safely-shutting-down-logstash-on-aws-auto-scaling-group/34528 "2015-11-13T16:11:34Z")
I thought I'd share some work I've done on getting logstash to work better with AWS auto-scaling groups. This should generalize to anyone who has their logstash server(s) automatically stop / reboot for any reason. Th… --- ## [Using logstash](https://discuss.elastic.co/t/using-logstash/32454)
**Author:** [@fereshteh](https://discuss.elastic.co/u/fereshteh)\ **Replies:** 7\ **Last updated:** [November 10, 2015, 3:17pm UTC](https://discuss.elastic.co/t/using-logstash/32454 "2015-11-10T15:17:37Z")
I am trying to use the logstash documentation to set up a xml filter, but I just cant seem to get it right. My XML format is pretty straigth forward; --- ## [Types hierarchical representation](https://discuss.elastic.co/t/types-hierarchical-representation/34537)
**Author:** [@raghu\_ae](https://discuss.elastic.co/u/raghu_ae)\ **Replies:** 3\ **Last updated:** [November 16, 2015, 3:59am UTC](https://discuss.elastic.co/t/types-hierarchical-representation/34537 "2015-11-16T03:59:39Z")
Hi, I have configured ELK stack successfully and I am able to view the data in Kibana. Now I want to store the events based on different types. EX: localhost:9200/logstash-2015.11.13/httpd/app1/ localhost:9200/lo… --- ## [Upgrade to LS 1.5.5 breaks my config](https://discuss.elastic.co/t/upgrade-to-ls-1-5-5-breaks-my-config/34633)
**Author:** [@bluethundr](https://discuss.elastic.co/u/bluethundr)\ **Replies:** 2\ **Last updated:** [November 16, 2015, 2:45am UTC](https://discuss.elastic.co/t/upgrade-to-ls-1-5-5-breaks-my-config/34633 "2015-11-16T02:45:02Z")
Hey all, I had a config that was working just fine under Logstash 1.5.4. But I just upgraded to version 1.5.5, and now LS won't run correctly. No data is showing up in Kibana, where before the upgrade data was showing… --- ## [Manticore::ResolutionFailure when connecting with Logstash 2.0 to Found Elasticsearch](https://discuss.elastic.co/t/manticore-resolutionfailure-when-connecting-with-logstash-2-0-to-found-elasticsearch/34624)
**Author:** [@Constantin\_Stropsa](https://discuss.elastic.co/u/Constantin_Stropsa)\ **Replies:** 2\ **Last updated:** [November 15, 2015, 7:49pm UTC](https://discuss.elastic.co/t/manticore-resolutionfailure-when-connecting-with-logstash-2-0-to-found-elasticsearch/34624 "2015-11-15T19:49:06Z")
Hi, I'm trying to connect to the Found Elasticsearch server using logstash 2.0 but got this error bin/logstash -f test.conf io/console not supported; tty will not be manipulated Default settings used: Filter workers… --- ## [Having trouble getting data to elasticsearch](https://discuss.elastic.co/t/having-trouble-getting-data-to-elasticsearch/34555)
**Author:** [@kmroz](https://discuss.elastic.co/u/kmroz)\ **Replies:** 3\ **Last updated:** [November 15, 2015, 7:31pm UTC](https://discuss.elastic.co/t/having-trouble-getting-data-to-elasticsearch/34555 "2015-11-15T19:31:03Z")
So I am currently using the newest version of the ELK stack and I seem to be getting a few errors in elasticsearch logs and logstash. I have kibana up and running. Logstash error: :message=\>"Connection failed to init… --- ## [Add new plugin to logstash](https://discuss.elastic.co/t/add-new-plugin-to-logstash/34616)
**Author:** [@sonia](https://discuss.elastic.co/u/sonia)\ **Replies:** 1\ **Last updated:** [November 15, 2015, 2:52pm UTC](https://discuss.elastic.co/t/add-new-plugin-to-logstash/34616 "2015-11-15T14:52:56Z")
I want to add new plugin (logstash-filter-example) to logstash? --- ## [Native log reader?](https://discuss.elastic.co/t/native-log-reader/34495)
**Author:** [@ablanchet](https://discuss.elastic.co/u/ablanchet)\ **Replies:** 2\ **Last updated:** [November 14, 2015, 7:42pm UTC](https://discuss.elastic.co/t/native-log-reader/34495 "2015-11-14T19:42:11Z")
Hi guys, I'm using Logstash, Elasticsearch and Kibana to process, store and visualize my logs. My setup works fine but now I'm looking for a new tool : before ELK is was used to read my logs on Notepad++ or Glogg (on … --- ## [Multiline issue](https://discuss.elastic.co/t/multiline-issue/33349)
**Author:** [@11191](https://discuss.elastic.co/u/11191)\ **Replies:** 3\ **Last updated:** [November 14, 2015, 11:48am UTC](https://discuss.elastic.co/t/multiline-issue/33349 "2015-11-14T11:48:46Z")
Hi everyone. In Logstash 1.5 I had this config working: input { lumberjack { port =\> 5000 ssl\_certificate =\> "/certs/logstash-forwarder.crt" ssl\_key =\> "/certs/logstash-forwarder.key" } } filter { if \[type\] == "type1… --- ## [100% CPU with Logstash 1.5.x](https://discuss.elastic.co/t/100-cpu-with-logstash-1-5-x/27864)
**Author:** [@Stephen\_Meier](https://discuss.elastic.co/u/Stephen_Meier)\ **Replies:** 4\ **Last updated:** [November 14, 2015, 12:39am UTC](https://discuss.elastic.co/t/100-cpu-with-logstash-1-5-x/27864 "2015-11-14T00:39:55Z")
good afternoon all. I am running the RPM version of logstash on Centos 7. It was working great untill I started having errors. I upgraded to the 1.5.3 package. It relieved the other issue, but it is now running at 10… --- ## [Lucene Searches for $](https://discuss.elastic.co/t/lucene-searches-for/34575)
**Author:** [@Stephen\_Meier](https://discuss.elastic.co/u/Stephen_Meier)\ **Replies:** 0\ **Last updated:** [November 14, 2015, 12:34am UTC](https://discuss.elastic.co/t/lucene-searches-for/34575 "2015-11-14T00:34:45Z")
good evening. I have been googling to no avail, but I have a TargetUserName field that contains the name of an active directory account. when a computer name comes through, it has a $ on the end of it. I am trying to… --- ## [Copying data from 1 es instance to another using logstash](https://discuss.elastic.co/t/copying-data-from-1-es-instance-to-another-using-logstash/34566)
**Author:** [@Ramdev\_Wudali](https://discuss.elastic.co/u/Ramdev_Wudali)\ **Replies:** 0\ **Last updated:** [November 13, 2015, 10:11pm UTC](https://discuss.elastic.co/t/copying-data-from-1-es-instance-to-another-using-logstash/34566 "2015-11-13T22:11:24Z")
Hi: I have been trying to use logstash to copy data from one ES instance to another ES instance. However I keep running into the following problem : A plugin had an unrecoverable error. Will restart this plugin. … --- ## [Need help with SSL config](https://discuss.elastic.co/t/need-help-with-ssl-config/34559)
**Author:** [@CraigFoote](https://discuss.elastic.co/u/CraigFoote)\ **Replies:** 0\ **Last updated:** [November 13, 2015, 8:02pm UTC](https://discuss.elastic.co/t/need-help-with-ssl-config/34559 "2015-11-13T20:02:37Z")
I'm trying to use the tcp input plugin but having trouble understanding the various SSL options. I know I need to set the ssl\_enable to true but am unsure of the other options: ssl\_cacert, ssl\_cert, ssl\_key, and ssl\_key\_… --- ## [Logstash-test alternative in 2.0](https://discuss.elastic.co/t/logstash-test-alternative-in-2-0/34558)
**Author:** [@Rudy\_Gevaert](https://discuss.elastic.co/u/Rudy_Gevaert)\ **Replies:** 0\ **Last updated:** [November 13, 2015, 7:57pm UTC](https://discuss.elastic.co/t/logstash-test-alternative-in-2-0/34558 "2015-11-13T19:57:09Z")
Hi, Before 2.0 we had 'bin/logstash-test', but in version 2.0 it is gone. The logstash-test binary was calling 'bin/logstash rspec'. When I run logstash rspec with 2.0 it says it only accepts the agent and version pa… --- ## [Install plugin in custom/non-installation folder](https://discuss.elastic.co/t/install-plugin-in-custom-non-installation-folder/34552)
**Author:** [@vilas](https://discuss.elastic.co/u/vilas)\ **Replies:** 0\ **Last updated:** [November 13, 2015, 7:36pm UTC](https://discuss.elastic.co/t/install-plugin-in-custom-non-installation-folder/34552 "2015-11-13T19:36:44Z")
Hi, Can I install logstash plugins in a custom folder other than installation folder. I do not want to modify the setup folder/files often. Would like to have a plugins folder separate from installation directory. L… --- ## [Install plugin on machine without git](https://discuss.elastic.co/t/install-plugin-on-machine-without-git/34522)
**Author:** [@incogniro](https://discuss.elastic.co/u/incogniro)\ **Replies:** 2\ **Last updated:** [November 13, 2015, 3:30pm UTC](https://discuss.elastic.co/t/install-plugin-on-machine-without-git/34522 "2015-11-13T15:30:15Z")
I would like to install a plugin in a closed environment on a RHEL machine that does not have git available. I have compiled the plugin from source and made the following change to the .gemspec file: # Files #s.fil… --- ## [Logstash Mongodb output plugin is not converting jdbc (Oracle) NUMBER (32,8) column to goecode latitude data](https://discuss.elastic.co/t/logstash-mongodb-output-plugin-is-not-converting-jdbc-oracle-number-32-8-column-to-goecode-latitude-data/34068)
**Author:** [@rajivmca2004](https://discuss.elastic.co/u/rajivmca2004)\ **Replies:** 2\ **Last updated:** [November 13, 2015, 8:32am UTC](https://discuss.elastic.co/t/logstash-mongodb-output-plugin-is-not-converting-jdbc-oracle-number-32-8-column-to-goecode-latitude-data/34068 "2015-11-13T08:32:36Z")
Anyone know solution of this: Error: exception=\>#\> --- ## [Parsing log with "@" as token](https://discuss.elastic.co/t/parsing-log-with-as-token/34473)
**Author:** [@xtingray](https://discuss.elastic.co/u/xtingray)\ **Replies:** 2\ **Last updated:** [November 13, 2015, 6:30am UTC](https://discuss.elastic.co/t/parsing-log-with-as-token/34473 "2015-11-13T06:30:51Z")
I'm having a hard time parsing a log with this configuration: username/user\_id@domain Example: jhon/999@test.com I am using this grok expression: match =\> "%{DATA:username}/%{DATA:user\_id}\\@%{DATA:domain}" But t… --- ## [Searching a plugin for ELKstack like Splunk app for Stream](https://discuss.elastic.co/t/searching-a-plugin-for-elkstack-like-splunk-app-for-stream/34397)
**Author:** [@oraant](https://discuss.elastic.co/u/oraant)\ **Replies:** 2\ **Last updated:** [November 13, 2015, 4:06am UTC](https://discuss.elastic.co/t/searching-a-plugin-for-elkstack-like-splunk-app-for-stream/34397 "2015-11-13T04:06:41Z")
With Splunk app for Stream,when I login into mysql server from host1,the soft will capture the action and generate some message like this: {"endtime":"2015-11-11T08:34:41.080784Z", "timestamp":"2015-11-11T08:34:41.0807… --- ## [Http poller removing tags and type](https://discuss.elastic.co/t/http-poller-removing-tags-and-type/34198)
**Author:** [@voipoclay](https://discuss.elastic.co/u/voipoclay)\ **Replies:** 1\ **Last updated:** [November 12, 2015, 9:02pm UTC](https://discuss.elastic.co/t/http-poller-removing-tags-and-type/34198 "2015-11-12T21:02:30Z")
I am using http poller and as I was debugging I noticed some strange behavior. I am using logstash 2.0 and when I shut down nginx at one of the endpoints being polled I get this back. So when successful the json resp… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1219) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1221)