# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1224 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1225 --- ## [Elasticsearch logstach](https://discuss.elastic.co/t/elasticsearch-logstach/33715)
**Author:** [@sylv](https://discuss.elastic.co/u/sylv)\ **Replies:** 1\ **Last updated:** [November 4, 2015, 9:13am UTC](https://discuss.elastic.co/t/elasticsearch-logstach/33715 "2015-11-04T09:13:02Z")
is there someone with these errors messages? l\\logstash\_titulaires\_config\_file.txt io/console not supported; tty will not be manipulated ←\[31mUnknown setting 'protocol' for elasticsearch {:level=\>:error}←\[0m ←\[31mUnkno… --- ## [Logstash 2.0 plugin input-relp option ssl](https://discuss.elastic.co/t/logstash-2-0-plugin-input-relp-option-ssl/33393)
**Author:** [@alicia](https://discuss.elastic.co/u/alicia)\ **Replies:** 5\ **Last updated:** [November 4, 2015, 6:45am UTC](https://discuss.elastic.co/t/logstash-2-0-plugin-input-relp-option-ssl/33393 "2015-11-04T06:45:50Z")
in logstash.log message=\>"SSL Error", :exception=\>#, :backtrace=\>\["org/jruby/ext/openssl/SSLSocket.java:262:in accept'", "/opt/logstash/vendor/bundle/jruby/1.9/gems/jruby-openssl-0.9.12-java/lib/jopenssl19/openssl/ssl-in… --- ## [Support for Encryption of Keystore passwords](https://discuss.elastic.co/t/support-for-encryption-of-keystore-passwords/33664)
**Author:** [@soodlikesjava](https://discuss.elastic.co/u/soodlikesjava)\ **Replies:** 1\ **Last updated:** [November 4, 2015, 4:39am UTC](https://discuss.elastic.co/t/support-for-encryption-of-keystore-passwords/33664 "2015-11-04T04:39:43Z")
Hi All, I am curious about knowing if there is any support available for adding Encrypted passwords for the SSL keystores and truststores in Logstash and Elastic Search in the configuration files . For Complianc… --- ## [Data loss using UDP input plugin](https://discuss.elastic.co/t/data-loss-using-udp-input-plugin/32988)
**Author:** [@Anusha\_sunkadh](https://discuss.elastic.co/u/Anusha_sunkadh)\ **Replies:** 18\ **Last updated:** [November 4, 2015, 3:46am UTC](https://discuss.elastic.co/t/data-loss-using-udp-input-plugin/32988 "2015-11-04T03:46:07Z")
Almost 80% of data is lost when i use UDP input plugin for netflow data. Below is my configuration file. input { udp { queue\_size =\> 50000 port =\> 9993 type =\> "netflow" workers =\> 4 codec =\> netflow { version… --- ## [Kafka-input](https://discuss.elastic.co/t/kafka-input/33668)
**Author:** [@vimalmpatel](https://discuss.elastic.co/u/vimalmpatel)\ **Replies:** 1\ **Last updated:** [November 4, 2015, 3:26am UTC](https://discuss.elastic.co/t/kafka-input/33668 "2015-11-04T03:26:55Z")
Hello i am using kakfa-input with stunnel stunnel config file fips = no \[broker1\] accept = 127.0.0.1:9195 connect = 10.25.37.3:9193 client = yes cert = /usr/local/etc/stunnel/kafka-cli-stunnel.pem \[broker2\] a… --- ## [Strange hanging/buffering behavior with tcp plugin](https://discuss.elastic.co/t/strange-hanging-buffering-behavior-with-tcp-plugin/33042)
**Author:** [@treehouse](https://discuss.elastic.co/u/treehouse)\ **Replies:** 3\ **Last updated:** [November 4, 2015, 12:29am UTC](https://discuss.elastic.co/t/strange-hanging-buffering-behavior-with-tcp-plugin/33042 "2015-11-04T00:29:47Z")
I am feeding one logstash output into the input of another logstash instance. I am using the tcp output plugin (in logstash A) for data output, and tcp input plugin for data input (logstash B). I'm seeing some strange be… --- ## [Rabbitmq Plugin in Logstash 2.0 not Acknowledging Messages](https://discuss.elastic.co/t/rabbitmq-plugin-in-logstash-2-0-not-acknowledging-messages/33681)
**Author:** [@jcollie](https://discuss.elastic.co/u/jcollie)\ **Replies:** 0\ **Last updated:** [November 3, 2015, 10:25pm UTC](https://discuss.elastic.co/t/rabbitmq-plugin-in-logstash-2-0-not-acknowledging-messages/33681 "2015-11-03T22:25:52Z")
I'm trying to update Elasticsearch and Logstash to 2.0. The Elasticsearch upgrade went OK and my cluster is showing green. However, when I try and update Logstash to 2.0 it's not acknowledging AMQP messages and quickly… --- ## [Issue Facing during Logstash startup](https://discuss.elastic.co/t/issue-facing-during-logstash-startup/33222)
**Author:** [@PKD](https://discuss.elastic.co/u/PKD)\ **Replies:** 3\ **Last updated:** [November 3, 2015, 9:59pm UTC](https://discuss.elastic.co/t/issue-facing-during-logstash-startup/33222 "2015-11-03T21:59:10Z")
Hi All, We are facing issue while logstash startup. We are trying with Sun JDK 7 and 8. Are there any additional steps required for startup ? We are using logstash 1.5.2 and 1.5.4 and 2.0. Are there any additional st… --- ## [Syslog message: Tag problem and bad facility and severity values in the output of logstash](https://discuss.elastic.co/t/syslog-message-tag-problem-and-bad-facility-and-severity-values-in-the-output-of-logstash/33647)
**Author:** [@thales\_jfc](https://discuss.elastic.co/u/thales_jfc)\ **Replies:** 1\ **Last updated:** [November 3, 2015, 6:27pm UTC](https://discuss.elastic.co/t/syslog-message-tag-problem-and-bad-facility-and-severity-values-in-the-output-of-logstash/33647 "2015-11-03T18:27:03Z")
Hi I have two virtual machines with centos 7 64 bits installed on it. One is used as a server for log messages. Logstach has been installed on it. nagioslogserver version is 2015r1.4. Here is the configuration file. … --- ## [Mask Output](https://discuss.elastic.co/t/mask-output/33654)
**Author:** [@maisyweb](https://discuss.elastic.co/u/maisyweb)\ **Replies:** 1\ **Last updated:** [November 3, 2015, 6:21pm UTC](https://discuss.elastic.co/t/mask-output/33654 "2015-11-03T18:21:10Z")
Hi, I have a logstash script that reads from an xml file and outputs a json file. It's all working well but I need to update the format of one of the fields. Currently the field returns a time in HH:mm:ss format (15:… --- ## [Logstash/Kibana: Filter AWS ELB logs based on the old timestamp](https://discuss.elastic.co/t/logstash-kibana-filter-aws-elb-logs-based-on-the-old-timestamp/33413)
**Author:** [@quadrim](https://discuss.elastic.co/u/quadrim)\ **Replies:** 8\ **Last updated:** [November 3, 2015, 6:03pm UTC](https://discuss.elastic.co/t/logstash-kibana-filter-aws-elb-logs-based-on-the-old-timestamp/33413 "2015-11-03T18:03:11Z")
Recently I set up the ELK stack to filter logs of my Load Balancer. But the timestamp which is getting showed up in Kibana is not from the log files, but is the one at which the file was downloaded to the server. I am n… --- ## [Are there any C++ clients available for logstash?](https://discuss.elastic.co/t/are-there-any-c-clients-available-for-logstash/33645)
**Author:** [@iamthealex](https://discuss.elastic.co/u/iamthealex)\ **Replies:** 3\ **Last updated:** [November 3, 2015, 3:31pm UTC](https://discuss.elastic.co/t/are-there-any-c-clients-available-for-logstash/33645 "2015-11-03T15:31:22Z")
I'm just now starting to look at what ELK can do for me. The code that I have to work with is C++ only. So the question now becomes: how do I get the data into logstash from C++? I found this posting about calling go f… --- ## [I really need help with standard rsyslog parsing](https://discuss.elastic.co/t/i-really-need-help-with-standard-rsyslog-parsing/33622)
**Author:** [@tomas](https://discuss.elastic.co/u/tomas)\ **Replies:** 11\ **Last updated:** [November 3, 2015, 1:49pm UTC](https://discuss.elastic.co/t/i-really-need-help-with-standard-rsyslog-parsing/33622 "2015-11-03T13:49:09Z")
Hi, env: rsyslog (clients) =\> syslog-ng (server) =\> logstash 1.5 =\> elasticsearch =\> kibana I'm trying to parse (match) the standard linux rsyslog message format but I always get \_grokparsefailure and are unable to c… --- ## [Duplicate entries in Logstash?](https://discuss.elastic.co/t/duplicate-entries-in-logstash/33571)
**Author:** [@kmroz](https://discuss.elastic.co/u/kmroz)\ **Replies:** 2\ **Last updated:** [November 3, 2015, 2:46pm UTC](https://discuss.elastic.co/t/duplicate-entries-in-logstash/33571 "2015-11-03T14:46:35Z")
I am not to sure where the issue is if it is with Logstash or Log-courier. It seems that logstash keeps rereading the same log line and parses it multiple times. To check this i named the common field type %{WORD:field1}… --- ## [Failed unmarshalling json: invalid character ':' after array element](https://discuss.elastic.co/t/failed-unmarshalling-json-invalid-character-after-array-element/33566)
**Author:** [@djdance](https://discuss.elastic.co/u/djdance)\ **Replies:** 3\ **Last updated:** [November 3, 2015, 1:59pm UTC](https://discuss.elastic.co/t/failed-unmarshalling-json-invalid-character-after-array-element/33566 "2015-11-03T13:59:10Z")
getting subject error. how do I resolve it ? { "network": { "servers": \[localhost:5043" \], "timeout": 15 }, "files": \[ "paths:" \[ "/data/logs/cog\*.log" \], "fields": \[ "type": … --- ## [Log4j2 input plugin](https://discuss.elastic.co/t/log4j2-input-plugin/32171)
**Author:** [@AndiSosp](https://discuss.elastic.co/u/AndiSosp)\ **Replies:** 1\ **Last updated:** [November 3, 2015, 11:19am UTC](https://discuss.elastic.co/t/log4j2-input-plugin/32171 "2015-11-03T11:19:57Z")
Hi everyone, I'm trying to get Log4j2 SocketAppenders to log directly in to logstash with the log4j plugin but no messages are processed by logstash. Is the log4j input plugin not working with log4j 2.x? Logstash 1.… --- ## [Get pre-filter raw message](https://discuss.elastic.co/t/get-pre-filter-raw-message/33533)
**Author:** [@raffis](https://discuss.elastic.co/u/raffis)\ **Replies:** 4\ **Last updated:** [November 3, 2015, 10:59am UTC](https://discuss.elastic.co/t/get-pre-filter-raw-message/33533 "2015-11-03T10:59:45Z")
How can I get the original raw message? I got two outputs, the first one should log the original raw log message and the second one the whole filtered stuff. But I can't do input -\> output -\> filter -\> output right? S… --- ## [Failed to connect to master](https://discuss.elastic.co/t/failed-to-connect-to-master/33597)
**Author:** [@zpp](https://discuss.elastic.co/u/zpp)\ **Replies:** 12\ **Last updated:** [November 3, 2015, 10:20am UTC](https://discuss.elastic.co/t/failed-to-connect-to-master/33597 "2015-11-03T10:20:41Z")
Hi, Our logstash(indexer) recently encountered below error frequently, what is this error and how can we fix it? Nov 03, 2015 2:00:25 PM org.elasticsearch.discovery.zen.ZenDiscovery joinElectedMaster WARNING: \[logst… --- ## [I'm loosing data in my ELK stack](https://discuss.elastic.co/t/im-loosing-data-in-my-elk-stack/33615)
**Author:** [@billy6](https://discuss.elastic.co/u/billy6)\ **Replies:** 3\ **Last updated:** [November 3, 2015, 10:06am UTC](https://discuss.elastic.co/t/im-loosing-data-in-my-elk-stack/33615 "2015-11-03T10:06:55Z")
Hello, I have been monitoring the data traffic and I have notice that I'm loosing a lot of messages, What could I do? Using REDIS buffer could be a solution but it consumes a lot of memory and I would like to study other… --- ## [Add\_field =\> \[ "EventDate", "%{@timestamp}" \]](https://discuss.elastic.co/t/add-field-eventdate-timestamp/33543)
**Author:** [@Erik\_Parienty](https://discuss.elastic.co/u/Erik_Parienty)\ **Replies:** 2\ **Last updated:** [November 3, 2015, 8:14am UTC](https://discuss.elastic.co/t/add-field-eventdate-timestamp/33543 "2015-11-03T08:14:44Z")
when i using add\_field =\> \[ "EventDate", "%{@timestamp}" \] i see this { "@version" =\> "1", "@timestamp" =\> "2015-11-02T16:23:57.815Z", "type" =\> "blabla", "EventDate" =\> "%{@timest… --- ## [Help to parse a timestamp string with grok filter in logstash](https://discuss.elastic.co/t/help-to-parse-a-timestamp-string-with-grok-filter-in-logstash/33386)
**Author:** [@Juan\_Diaz\_Gonzalez](https://discuss.elastic.co/u/Juan_Diaz_Gonzalez)\ **Replies:** 3\ **Last updated:** [November 3, 2015, 8:12am UTC](https://discuss.elastic.co/t/help-to-parse-a-timestamp-string-with-grok-filter-in-logstash/33386 "2015-11-03T08:12:57Z")
Hi, I would like to parse this string with this timestamp for example: Fri, 30 Oct 2015 15:12:17 CET But in the pattern documentation I am not able to find any pattern that it could serve to me. Thanks in advance --- ## [Continuosly import XML files from a directory](https://discuss.elastic.co/t/continuosly-import-xml-files-from-a-directory/33401)
**Author:** [@sandro1976](https://discuss.elastic.co/u/sandro1976)\ **Replies:** 6\ **Last updated:** [November 3, 2015, 7:50am UTC](https://discuss.elastic.co/t/continuosly-import-xml-files-from-a-directory/33401 "2015-11-03T07:50:48Z")
Hello everyone, I am new to elastic, so please forgive me if my questions are not correctly formed. I setup a Kibana-\>Elasticsearch-\>Logstash to store and analyze logs of a call server, that are sent to logstash via sy… --- ## [Log4j input](https://discuss.elastic.co/t/log4j-input/33557)
**Author:** [@sbecker](https://discuss.elastic.co/u/sbecker)\ **Replies:** 3\ **Last updated:** [November 3, 2015, 7:50am UTC](https://discuss.elastic.co/t/log4j-input/33557 "2015-11-03T07:50:04Z")
I have tried to input several log4j messages, generated by our internal apps, into logstash with no luck. If I can to a TCP input on port 4560, it works. Do I need a specific log4j message format? I have searched ext… --- ## [Scale Logstash in Distributed Real-Time Way based on Storm](https://discuss.elastic.co/t/scale-logstash-in-distributed-real-time-way-based-on-storm/26740)
**Author:** [@haoch](https://discuss.elastic.co/u/haoch)\ **Replies:** 7\ **Last updated:** [November 3, 2015, 7:37am UTC](https://discuss.elastic.co/t/scale-logstash-in-distributed-real-time-way-based-on-storm/26740 "2015-11-03T07:37:56Z")
Hi Logstash Community, This is Hao Chen from an e-commerce company supporting one of the largest hadoop cluster in the world. We are relying on logstash to monitor large amount of platform logs. As I could not find simi… --- ## [Can logstash push data into Hadoop?](https://discuss.elastic.co/t/can-logstash-push-data-into-hadoop/32961)
**Author:** [@asatsi](https://discuss.elastic.co/u/asatsi)\ **Replies:** 8\ **Last updated:** [November 2, 2015, 1:07pm UTC](https://discuss.elastic.co/t/can-logstash-push-data-into-hadoop/32961 "2015-11-02T13:07:48Z")
Simple question as per the subject line. I need to push data from my source into Hadoop. Can this be done? If yes which supported output plugin could be used? --- ## [Logstash json codec Failed to load class](https://discuss.elastic.co/t/logstash-json-codec-failed-to-load-class/33589)
**Author:** [@treehouse](https://discuss.elastic.co/u/treehouse)\ **Replies:** 0\ **Last updated:** [November 3, 2015, 3:08am UTC](https://discuss.elastic.co/t/logstash-json-codec-failed-to-load-class/33589 "2015-11-03T03:08:14Z")
Hey guys i have a tcp output here and when i try to use a json\* codec my logstash instance dies with error LogStash::Json::GeneratorError: Failed to load class 'org.jruby.RubyObject$Access4JacksonDeserializer4593159… --- ## [Failed action with response of 500, dropping action Logstash1.5.4](https://discuss.elastic.co/t/failed-action-with-response-of-500-dropping-action-logstash1-5-4/33502)
**Author:** [@NgocPham](https://discuss.elastic.co/u/NgocPham)\ **Replies:** 2\ **Last updated:** [November 3, 2015, 2:00am UTC](https://discuss.elastic.co/t/failed-action-with-response-of-500-dropping-action-logstash1-5-4/33502 "2015-11-03T02:00:10Z")
Hi everybody, im newbie and i try use logstash, elasticsearch to Search in my Web. One error appear and i dont know how to fix it. Pls help me , thanks you! i tried config file .conf look like this ,it work normal , my… --- ## [Logstash 2.0 Monitoring API?](https://discuss.elastic.co/t/logstash-2-0-monitoring-api/33551)
**Author:** [@natefox](https://discuss.elastic.co/u/natefox)\ **Replies:** 8\ **Last updated:** [November 2, 2015, 9:32pm UTC](https://discuss.elastic.co/t/logstash-2-0-monitoring-api/33551 "2015-11-02T21:32:53Z")
I kept seeing mentions of a monitoring API when LS 2.0 hit, but cant seem to find any mention of it in the current docs. Did it get implemented? --- ## [Combining several logstash config files into one... how do you do it?](https://discuss.elastic.co/t/combining-several-logstash-config-files-into-one-how-do-you-do-it/33546)
**Author:** [@jjdepaul](https://discuss.elastic.co/u/jjdepaul)\ **Replies:** 5\ **Last updated:** [November 2, 2015, 6:42pm UTC](https://discuss.elastic.co/t/combining-several-logstash-config-files-into-one-how-do-you-do-it/33546 "2015-11-02T18:42:51Z")
To date, we have created several mini-config files on our own to satisfy very specific goals. Now we are looking to consolidate these files on a common server and wondering how to go about it. Is the best practice to … --- ## [Config not working for logstash 2](https://discuss.elastic.co/t/config-not-working-for-logstash-2/33520)
**Author:** [@imad](https://discuss.elastic.co/u/imad)\ **Replies:** 11\ **Last updated:** [November 2, 2015, 6:05pm UTC](https://discuss.elastic.co/t/config-not-working-for-logstash-2/33520 "2015-11-02T18:05:07Z")
Hi, Can someone show me whats wrong with the config here. I am trying to convert my logstast 1.5.4 config to logstash 2. When I run it with --configtest flag, I get message 'Configuration is Ok'. and when I run the log… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1223) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1225)