# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1222 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1223 --- ## [Logstash 2.0 HTTP Stability Issues](https://discuss.elastic.co/t/logstash-2-0-http-stability-issues/33608)
**Author:** [@Kevin\_Ross](https://discuss.elastic.co/u/Kevin_Ross)\ **Replies:** 13\ **Last updated:** [November 9, 2015, 4:52pm UTC](https://discuss.elastic.co/t/logstash-2-0-http-stability-issues/33608 "2015-11-09T16:52:29Z")
Hi, I have updated to logstash 2.0, Elasticsearch 2.0 & Kibana 4.2 yesterday & I am having issues with the stability of logstash but first just a quick note about my environment: I am running Centos 7. I have been r… --- ## [Logstash date filter question](https://discuss.elastic.co/t/logstash-date-filter-question/33663)
**Author:** [@CraigFoote](https://discuss.elastic.co/u/CraigFoote)\ **Replies:** 11\ **Last updated:** [November 9, 2015, 4:23pm UTC](https://discuss.elastic.co/t/logstash-date-filter-question/33663 "2015-11-09T16:23:59Z")
I'm on the 2.0 stack and am using the JDBC input plugin but a couple DB fields that should be dates are coming in as text, "event\_date" and "event\_timestamp". I'm trying to use the date filter to convert them to dates b… --- ## [Error with kibana 4.2.0, Elasticsearch 2.0.0 and Logstash 2.0.0](https://discuss.elastic.co/t/error-with-kibana-4-2-0-elasticsearch-2-0-0-and-logstash-2-0-0/34113)
**Author:** [@Miguel\_Bessa](https://discuss.elastic.co/u/Miguel_Bessa)\ **Replies:** 4\ **Last updated:** [November 9, 2015, 4:23pm UTC](https://discuss.elastic.co/t/error-with-kibana-4-2-0-elasticsearch-2-0-0-and-logstash-2-0-0/34113 "2015-11-09T16:23:55Z")
Hi, I installed recent versions of kibana, elasticsearch and logstash, but when I execute logstash configuration file for my logs, gives me this error: NotImplementedError: stat.st\_dev unsupported or native support f… --- ## [Event time adjustment](https://discuss.elastic.co/t/event-time-adjustment/34156)
**Author:** [@Guy\_Wicks](https://discuss.elastic.co/u/Guy_Wicks)\ **Replies:** 0\ **Last updated:** [November 9, 2015, 2:20pm UTC](https://discuss.elastic.co/t/event-time-adjustment/34156 "2015-11-09T14:20:52Z")
I have standard Windows IIS log files with event date/time stamp information and timetaken (in milliseconds). I would like to be able to adjust the event time (@timestamp) by subtracting the "timetaken" to be able to r… --- ## [\[Need Help\] Logstash start failed when use 3rd party gem in customized plugin](https://discuss.elastic.co/t/need-help-logstash-start-failed-when-use-3rd-party-gem-in-customized-plugin/29084)
**Author:** [@ttys000](https://discuss.elastic.co/u/ttys000)\ **Replies:** 9\ **Last updated:** [November 9, 2015, 1:56am UTC](https://discuss.elastic.co/t/need-help-logstash-start-failed-when-use-3rd-party-gem-in-customized-plugin/29084 "2015-11-09T01:56:07Z")
I used mail gem in customized codec plugin to handle some email related data, the plugin gem run bundle exec rspec and gem build is successful. The problem is when the plugin installed, it will lead Logstash start proces… --- ## [Extract URL from Text Field into a New Field Called URL](https://discuss.elastic.co/t/extract-url-from-text-field-into-a-new-field-called-url/34100)
**Author:** [@Isra](https://discuss.elastic.co/u/Isra)\ **Replies:** 1\ **Last updated:** [November 8, 2015, 8:45pm UTC](https://discuss.elastic.co/t/extract-url-from-text-field-into-a-new-field-called-url/34100 "2015-11-08T20:45:53Z")
I'm inputting a field called text. this field may at times contain a URL.What I would like to do is extract the URL's from text, and put them in a new field called URL. I tried grok, but it seems like grok patterns nee… --- ## [Lumberjack output crashing logstash](https://discuss.elastic.co/t/lumberjack-output-crashing-logstash/34093)
**Author:** [@treehouse](https://discuss.elastic.co/u/treehouse)\ **Replies:** 2\ **Last updated:** [November 8, 2015, 9:18am UTC](https://discuss.elastic.co/t/lumberjack-output-crashing-logstash/34093 "2015-11-08T09:18:24Z")
hey guys, I have courier input plugin feeding through to a lumberjack output... I'm trying to use the codec =\> json\_lines in lumberjack, but everytime an event comes in from courier my logstash instance crashes input… --- ## [Logstash count key words in Kafka and increment statsd](https://discuss.elastic.co/t/logstash-count-key-words-in-kafka-and-increment-statsd/34064)
**Author:** [@Chengcheng\_Pei](https://discuss.elastic.co/u/Chengcheng_Pei)\ **Replies:** 2\ **Last updated:** [November 8, 2015, 3:14am UTC](https://discuss.elastic.co/t/logstash-count-key-words-in-kafka-and-increment-statsd/34064 "2015-11-08T03:14:08Z")
New to logstash. Assume messages in kafka look like: {"key":"val1"} {"key":"val2"} {"key":"val2"} {"key":"val1"} ... Try to count the numbers of val1 and val2 in key field, and increase statsd keys: total.val1 and to… --- ## [Format nested json with Sql joins](https://discuss.elastic.co/t/format-nested-json-with-sql-joins/31405)
**Author:** [@Alexcopquin1](https://discuss.elastic.co/u/Alexcopquin1)\ **Replies:** 1\ **Last updated:** [November 7, 2015, 10:38pm UTC](https://discuss.elastic.co/t/format-nested-json-with-sql-joins/31405 "2015-11-07T22:38:03Z")
Hi, We want to hydrate an ES cluster with posgres data and are trying logstash. The input sql looks something like Select mem.id, mem.email, mem.first\_name, addr.id as address\_id, addr.city, addr.state, add… --- ## [Logstash vs NFS (null characters)](https://discuss.elastic.co/t/logstash-vs-nfs-null-characters/25918)
**Author:** [@prius](https://discuss.elastic.co/u/prius)\ **Replies:** 3\ **Last updated:** [November 7, 2015, 4:52pm UTC](https://discuss.elastic.co/t/logstash-vs-nfs-null-characters/25918 "2015-11-07T16:52:26Z")
Hi, there is an issue with logstash getting log files from remote server over NFS. Issue described here Redirecting to Google Groups And here is explanation why it is happening Java InputStream read methods returning A… --- ## [Logstash ES plugin occasionally can't reach server](https://discuss.elastic.co/t/logstash-es-plugin-occasionally-cant-reach-server/34055)
**Author:** [@rsteckler](https://discuss.elastic.co/u/rsteckler)\ **Replies:** 2\ **Last updated:** [November 7, 2015, 4:45pm UTC](https://discuss.elastic.co/t/logstash-es-plugin-occasionally-cant-reach-server/34055 "2015-11-07T16:45:39Z")
I'm using Logsene as a hosted ELK provider. I log directly to logsene from Node.js using winston-logsene and I tail some logs to them via Logstash. The node.js integration works perfectly. The problem is that the log… --- ## [Aggregations in logstash](https://discuss.elastic.co/t/aggregations-in-logstash/28823)
**Author:** [@deepak13](https://discuss.elastic.co/u/deepak13)\ **Replies:** 3\ **Last updated:** [November 7, 2015, 4:04pm UTC](https://discuss.elastic.co/t/aggregations-in-logstash/28823 "2015-11-07T16:04:34Z")
Hi all, How can we use aggregations in logstash .conf file.My input is a csv file from 2 different sources.I need to group by a field and perform aggregations like sum,average,etc. 1st csv file has fields: date,amt,type 2… --- ## [Is it possible to do aggregations using Logstash](https://discuss.elastic.co/t/is-it-possible-to-do-aggregations-using-logstash/23941)
**Author:** [@vilas](https://discuss.elastic.co/u/vilas)\ **Replies:** 3\ **Last updated:** [November 7, 2015, 4:00pm UTC](https://discuss.elastic.co/t/is-it-possible-to-do-aggregations-using-logstash/23941 "2015-11-07T16:00:56Z")
Can we do aggregations with logstash? I want to read data from elasticsearch, say for last 10 mins and aggregate over a field and perform metrics over this aggregated data. Is it possible? Thanks. --- ## [A simple logstash world](https://discuss.elastic.co/t/a-simple-logstash-world/34043)
**Author:** [@juerkan](https://discuss.elastic.co/u/juerkan)\ **Replies:** 4\ **Last updated:** [November 7, 2015, 3:20pm UTC](https://discuss.elastic.co/t/a-simple-logstash-world/34043 "2015-11-07T15:20:42Z")
hi all a question to the community imagine a: logstash input plugin: filebeat, or topbeat, or packetbeat what do you think? --- ## [Parent/child with Elasticsearch 2.0 and Logstash 2.0](https://discuss.elastic.co/t/parent-child-with-elasticsearch-2-0-and-logstash-2-0/34057)
**Author:** [@fchantrel](https://discuss.elastic.co/u/fchantrel)\ **Replies:** 0\ **Last updated:** [November 6, 2015, 9:33pm UTC](https://discuss.elastic.co/t/parent-child-with-elasticsearch-2-0-and-logstash-2-0/34057 "2015-11-06T21:33:38Z")
Hi, before I had everything working fine with elasticsearch 1.6 and logstash 1.5.4 but now I'm trying to update to elasticsearch 2.0 and logstash 2.0 and I can't make it work. Can somebody tell me what is wrong in my con… --- ## [JDBC input plugin installed by default](https://discuss.elastic.co/t/jdbc-input-plugin-installed-by-default/33559)
**Author:** [@CraigFoote](https://discuss.elastic.co/u/CraigFoote)\ **Replies:** 6\ **Last updated:** [November 6, 2015, 8:07pm UTC](https://discuss.elastic.co/t/jdbc-input-plugin-installed-by-default/33559 "2015-11-06T20:07:01Z")
Any chance of anytime soon the JDBC Logstash input plugin being installed by default? https://rubygems.org/gems/logstash-input-jdbc --- ## [Grok Placement](https://discuss.elastic.co/t/grok-placement/34010)
**Author:** [@Jackal9301](https://discuss.elastic.co/u/Jackal9301)\ **Replies:** 4\ **Last updated:** [November 6, 2015, 8:06pm UTC](https://discuss.elastic.co/t/grok-placement/34010 "2015-11-06T20:06:11Z")
I am wondering about processing. Is there any benefit to putting a GROK pattern in the input rather than creating nested conditional statements in the filter? --- ## [Removing seconds from time stamp field](https://discuss.elastic.co/t/removing-seconds-from-time-stamp-field/33995)
**Author:** [@bubu.senapati](https://discuss.elastic.co/u/bubu.senapati)\ **Replies:** 12\ **Last updated:** [November 6, 2015, 5:40pm UTC](https://discuss.elastic.co/t/removing-seconds-from-time-stamp-field/33995 "2015-11-06T17:40:47Z")
i want to make the seconds field from the timestamp field 2015-10-27T00:07:20.168+0000 in logstash 00 and create the new time stamp. Could u please help me how can i achieve this. From 2015-10-27T00:07:20.168+0000 to 2… --- ## [Set geo location from coodinates](https://discuss.elastic.co/t/set-geo-location-from-coodinates/2762)
**Author:** [@roygolan1981](https://discuss.elastic.co/u/roygolan1981)\ **Replies:** 5\ **Last updated:** [November 6, 2015, 1:33pm UTC](https://discuss.elastic.co/t/set-geo-location-from-coodinates/2762 "2015-11-06T13:33:35Z")
Hi i have latitude+latitude on logstash and i want to set geo point i tried add\_field =\>{ "geoip.location" =\> 13.55 } add\_field =\> { "geoip.location" =\> 5.69 } and many more permutation of assigning the geoip.locati… --- ## [HP ProCurve switch log files not showing](https://discuss.elastic.co/t/hp-procurve-switch-log-files-not-showing/33976)
**Author:** [@Rhrykhz](https://discuss.elastic.co/u/Rhrykhz)\ **Replies:** 2\ **Last updated:** [November 6, 2015, 1:19pm UTC](https://discuss.elastic.co/t/hp-procurve-switch-log-files-not-showing/33976 "2015-11-06T13:19:45Z")
Hello everyone, I am completely new to Logstash, Kibana and Elasticsearch. However I had no issues setting up the server and forwarding logfiles from Windows and Linux machines. What is giving me a hard time is getting… --- ## [Asp.net log with ELK](https://discuss.elastic.co/t/asp-net-log-with-elk/33986)
**Author:** [@lorenzo.gasperotti](https://discuss.elastic.co/u/lorenzo.gasperotti)\ **Replies:** 1\ **Last updated:** [November 6, 2015, 11:50am UTC](https://discuss.elastic.co/t/asp-net-log-with-elk/33986 "2015-11-06T11:50:18Z")
I need to interface an asp.net application (is a web application, write in C#.) to an Elasticsearch/Kibana/Logstash system, for centralize the tracking of the log of the application. I try to install from nuget the log… --- ## [Logstash\_1.4.2 : add double quote with grok](https://discuss.elastic.co/t/logstash-1-4-2-add-double-quote-with-grok/33981)
**Author:** [@florian.dhaussy](https://discuss.elastic.co/u/florian.dhaussy)\ **Replies:** 2\ **Last updated:** [November 6, 2015, 11:38am UTC](https://discuss.elastic.co/t/logstash-1-4-2-add-double-quote-with-grok/33981 "2015-11-06T11:38:23Z")
Hi, I'm actually trying to generate a csv file, for a GeoIP database. My goal is to have this: "startIpNum","endIpNum","locId" And i actually have this, without the double quotes: startIpNum,endIpNum,locId How … --- ## [Logstash 1.5.5 error](https://discuss.elastic.co/t/logstash-1-5-5-error/33964)
**Author:** [@Prateek\_Kshtriya](https://discuss.elastic.co/u/Prateek_Kshtriya)\ **Replies:** 1\ **Last updated:** [November 6, 2015, 9:29am UTC](https://discuss.elastic.co/t/logstash-1-5-5-error/33964 "2015-11-06T09:29:51Z")
Hi, I am getting below error while trying to run logstash \\logstash-1.5.5\\bin\>logstash.bat -f logstash.conf io/console not supported; tty will not be manipulated Please suggest. Thanks --- ## [Grok filter working, not extracting fields](https://discuss.elastic.co/t/grok-filter-working-not-extracting-fields/33965)
**Author:** [@laurentiu](https://discuss.elastic.co/u/laurentiu)\ **Replies:** 2\ **Last updated:** [November 6, 2015, 9:29am UTC](https://discuss.elastic.co/t/grok-filter-working-not-extracting-fields/33965 "2015-11-06T09:29:47Z")
Hi, I have an issue - I am trying to parse IIS logs but I am not getting any fields extracted. (I tested the filter against an log line in GROK Debugger and it seems fine). The logs look like this: 2015-11-06 08:46:00 10… --- ## [Pulling year from event to place into timestamps for future events?](https://discuss.elastic.co/t/pulling-year-from-event-to-place-into-timestamps-for-future-events/33737)
**Author:** [@IGarvin](https://discuss.elastic.co/u/IGarvin)\ **Replies:** 2\ **Last updated:** [November 6, 2015, 5:35am UTC](https://discuss.elastic.co/t/pulling-year-from-event-to-place-into-timestamps-for-future-events/33737 "2015-11-06T05:35:46Z")
I have i feeling I already know the answer to this (which is probably "can't be done") but worth a shot. The application logs I'm recording have the unfortunate incident of having no year specified in the timestamp for… --- ## [Get the correct timestamp from the log file](https://discuss.elastic.co/t/get-the-correct-timestamp-from-the-log-file/32633)
**Author:** [@Surbhi\_Agarwal](https://discuss.elastic.co/u/Surbhi_Agarwal)\ **Replies:** 5\ **Last updated:** [November 6, 2015, 5:29am UTC](https://discuss.elastic.co/t/get-the-correct-timestamp-from-the-log-file/32633 "2015-11-06T05:29:21Z")
The log file has its own timestamp and i am trying to replace the logstash timestamp with my timestamp. I got the \_dateparsefailure and \_grokparsefailure . This is my config file : input { file { path =\> "C:\\U… --- ## [Slow processing in Logstash with S3 input](https://discuss.elastic.co/t/slow-processing-in-logstash-with-s3-input/33940)
**Author:** [@andrey](https://discuss.elastic.co/u/andrey)\ **Replies:** 0\ **Last updated:** [November 5, 2015, 11:48pm UTC](https://discuss.elastic.co/t/slow-processing-in-logstash-with-s3-input/33940 "2015-11-05T23:48:50Z")
Hi, We are using Logstash 2.0 to move a couple of months of log data (3000 files, 10G total) from Amazon S3 into Elasticsearch (1.7.1), but it's taking a very long time - roughly 1 hour to get through a day of data (200… --- ## [Logstash Forwarder replacement, Filebeat RC1 is out](https://discuss.elastic.co/t/logstash-forwarder-replacement-filebeat-rc1-is-out/33929)
**Author:** [@tbragin](https://discuss.elastic.co/u/tbragin)\ **Replies:** 0\ **Last updated:** [November 5, 2015, 10:19pm UTC](https://discuss.elastic.co/t/logstash-forwarder-replacement-filebeat-rc1-is-out/33929 "2015-11-05T22:19:27Z")
We are excited to announce the release of Filebeat-1.0.0-RC1! Filebeat is a replacement for Logstash Forwarder, build on top of extensible Beats platform! It brings greater stability, performance, platform support, and a… --- ## [Grok parse error](https://discuss.elastic.co/t/grok-parse-error/33909)
**Author:** [@Don\_Pich](https://discuss.elastic.co/u/Don_Pich)\ **Replies:** 3\ **Last updated:** [November 5, 2015, 9:05pm UTC](https://discuss.elastic.co/t/grok-parse-error/33909 "2015-11-05T21:05:46Z")
So I'm getting a parse error on my grok filter. I have gone to the following url to debug it: http://grokdebug.herokuapp.com/ My input is this: 66.249.69.48|-|2015-11-05T10:57:51-06:00|/northwest-a-tacs-camo-seat-cov… --- ## [Logstash and Tenable LCE](https://discuss.elastic.co/t/logstash-and-tenable-lce/33925)
**Author:** [@Jackal9301](https://discuss.elastic.co/u/Jackal9301)\ **Replies:** 0\ **Last updated:** [November 5, 2015, 8:34pm UTC](https://discuss.elastic.co/t/logstash-and-tenable-lce/33925 "2015-11-05T20:34:58Z")
My company has recently switched our logging solution. We used to have multiple inputs from different servers, however now we are getting all logs from a single device. So I have a few questions; Has anyone used Tena… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1221) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1223)