# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1228 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1229 --- ## [Forwarder adds escapes to all quotes in log messages](https://discuss.elastic.co/t/forwarder-adds-escapes-to-all-quotes-in-log-messages/32854)
**Author:** [@crazyphil](https://discuss.elastic.co/u/crazyphil)\ **Replies:** 0\ **Last updated:** [October 23, 2015, 1:01pm UTC](https://discuss.elastic.co/t/forwarder-adds-escapes-to-all-quotes-in-log-messages/32854 "2015-10-23T13:01:08Z")
So I am at my wits end trying to get either a working grok filter, or getting LSF to send data properly. The data being sent looks like this: 23/Oct/2015:01:57:16 +0000 1.2.3.4/- "Status:200" "POST /api/rest/stats/ca… --- ## [Io console not supported tty will not be manipulated - logstash 1.5.4 on Windows 7](https://discuss.elastic.co/t/io-console-not-supported-tty-will-not-be-manipulated-logstash-1-5-4-on-windows-7/32831)
**Author:** [@Sameer\_Dharur](https://discuss.elastic.co/u/Sameer_Dharur)\ **Replies:** 1\ **Last updated:** [October 23, 2015, 8:58am UTC](https://discuss.elastic.co/t/io-console-not-supported-tty-will-not-be-manipulated-logstash-1-5-4-on-windows-7/32831 "2015-10-23T08:58:22Z")
A constantly recurring problem to which I don't seem to find any answers online. The config files have been defined and uploaded in the required folder. The have also been tested using the --configtest command. Anybod… --- ## [Creating a Logstash filter help](https://discuss.elastic.co/t/creating-a-logstash-filter-help/32794)
**Author:** [@yoram](https://discuss.elastic.co/u/yoram)\ **Replies:** 5\ **Last updated:** [October 23, 2015, 8:03am UTC](https://discuss.elastic.co/t/creating-a-logstash-filter-help/32794 "2015-10-23T08:03:56Z")
Hi, I am in a process of checking if kibana can be used to help me with my log analysis. I am new to the logstash and elasticsearch technology and will be happy to get help to jump start my tests. I am using syslog to … --- ## [How to pull data from json file by using logstash](https://discuss.elastic.co/t/how-to-pull-data-from-json-file-by-using-logstash/32818)
**Author:** [@Dan](https://discuss.elastic.co/u/Dan)\ **Replies:** 1\ **Last updated:** [October 23, 2015, 5:54am UTC](https://discuss.elastic.co/t/how-to-pull-data-from-json-file-by-using-logstash/32818 "2015-10-23T05:54:35Z")
Hi All, i have one json file. i want to pull this json file into my elastic search by using logstash. Please refer me some methods. Thannks, Dinesh. --- ## [Receiving logstash error after installing watcher: SERVICE\_UNAVAILABLE/1/state not recovered / initialized SERVICE\_UNAVAILABLE/2/no master](https://discuss.elastic.co/t/receiving-logstash-error-after-installing-watcher-service-unavailable-1-state-not-recovered-initialized-service-unavailable-2-no-master/32721)
**Author:** [@darinfisher](https://discuss.elastic.co/u/darinfisher)\ **Replies:** 9\ **Last updated:** [October 23, 2015, 2:26am UTC](https://discuss.elastic.co/t/receiving-logstash-error-after-installing-watcher-service-unavailable-1-state-not-recovered-initialized-service-unavailable-2-no-master/32721 "2015-10-23T02:26:36Z")
Hi, I installed Watcher on my ES cluster and started receiving this error from my logstash servers: :timestamp=\>"2015-10-21T10:56:48.613000-0700", :message=\>"Failed to flush outgoing items", :outgoing\_count=\>37, :exc… --- ## [Get ip address of logstash forwarder](https://discuss.elastic.co/t/get-ip-address-of-logstash-forwarder/32814)
**Author:** [@etfeet](https://discuss.elastic.co/u/etfeet)\ **Replies:** 0\ **Last updated:** [October 22, 2015, 11:08pm UTC](https://discuss.elastic.co/t/get-ip-address-of-logstash-forwarder/32814 "2015-10-22T23:08:33Z")
is there a way to get the ip address of the logstash-forwarder node? I tried using %{host} however that just gives me the short hostname. I'm tried to do some geoip lookups and without the fqdn or preferably the ip add… --- ## [Can i start 2 logstash process on centos?](https://discuss.elastic.co/t/can-i-start-2-logstash-process-on-centos/32798)
**Author:** [@Erik\_Parienty](https://discuss.elastic.co/u/Erik_Parienty)\ **Replies:** 1\ **Last updated:** [October 22, 2015, 7:07pm UTC](https://discuss.elastic.co/t/can-i-start-2-logstash-process-on-centos/32798 "2015-10-22T19:07:49Z")
Can you show me how? i have /etc/init.d/logstash running and i like to have 1 more --- ## [Bing API JSON - how to parse?](https://discuss.elastic.co/t/bing-api-json-how-to-parse/32621)
**Author:** [@DefensiveDepth](https://discuss.elastic.co/u/DefensiveDepth)\ **Replies:** 8\ **Last updated:** [October 22, 2015, 6:42pm UTC](https://discuss.elastic.co/t/bing-api-json-how-to-parse/32621 "2015-10-22T18:42:49Z")
I am using the HTTP Poller to hit the Bing search API, which returns JSON. Unfortunately, it does not appear to be parsed correctly. (http://screencast.com/t/xCSAc7hd) It is just being returned as one log entry, as a si… --- ## [Compile logstash-output-elasticsearch](https://discuss.elastic.co/t/compile-logstash-output-elasticsearch/23815)
**Author:** [@marczis](https://discuss.elastic.co/u/marczis)\ **Replies:** 2\ **Last updated:** [October 22, 2015, 3:52pm UTC](https://discuss.elastic.co/t/compile-logstash-output-elasticsearch/23815 "2015-10-22T15:52:49Z")
Hello everyone ! First of all thanks a lot for your great products ! I have an add-on idea for logstash-output-elasticsearch plugin, but I don't manage to compile / install the plugin... I really read the instructions bu… --- ## [Twitter Plugin](https://discuss.elastic.co/t/twitter-plugin/32769)
**Author:** [@bjoernsteffens](https://discuss.elastic.co/u/bjoernsteffens)\ **Replies:** 0\ **Last updated:** [October 22, 2015, 11:39am UTC](https://discuss.elastic.co/t/twitter-plugin/32769 "2015-10-22T11:39:19Z")
Hi, I am experimenting with the Twitter plugin. I do however see that the connection is intermittently lost every now and then. Any pointers to troubleshooting this plugin? bjoern here is my config file in case y… --- ## [Configure logstash input from database values?](https://discuss.elastic.co/t/configure-logstash-input-from-database-values/32763)
**Author:** [@jsps](https://discuss.elastic.co/u/jsps)\ **Replies:** 3\ **Last updated:** [October 22, 2015, 11:28am UTC](https://discuss.elastic.co/t/configure-logstash-input-from-database-values/32763 "2015-10-22T11:28:42Z")
I've got a dynamic number of sites. There is a RESTful api on each site that is used to consume their logs. The RESTful endpoint for each site is stored in a single DB on server x. I want to create a logstash input plugi… --- ## [How do perform string manipulations](https://discuss.elastic.co/t/how-do-perform-string-manipulations/32706)
**Author:** [@samnik60](https://discuss.elastic.co/u/samnik60)\ **Replies:** 7\ **Last updated:** [October 22, 2015, 8:04am UTC](https://discuss.elastic.co/t/how-do-perform-string-manipulations/32706 "2015-10-22T08:04:55Z")
the string manipulations has been hard from me with logstash, how do i do substr(destinationid,instr(destinationid,"discard"),7) --- ## [How to increase the data sent out by logstash forwarder](https://discuss.elastic.co/t/how-to-increase-the-data-sent-out-by-logstash-forwarder/32741)
**Author:** [@arunjohn](https://discuss.elastic.co/u/arunjohn)\ **Replies:** 1\ **Last updated:** [October 22, 2015, 6:14am UTC](https://discuss.elastic.co/t/how-to-increase-the-data-sent-out-by-logstash-forwarder/32741 "2015-10-22T06:14:07Z")
I currently see the following from the logstash-forwarder logs : 2015/10/19 04:42:01.697852 --- options ------- 2015/10/19 04:42:01.697913 config-arg: /etc/logstash-forwarder.conf 2015/10/19 04:42:… --- ## [Is logstash support mongo input](https://discuss.elastic.co/t/is-logstash-support-mongo-input/32737)
**Author:** [@Jason\_Zheng](https://discuss.elastic.co/u/Jason_Zheng)\ **Replies:** 1\ **Last updated:** [October 22, 2015, 6:06am UTC](https://discuss.elastic.co/t/is-logstash-support-mongo-input/32737 "2015-10-22T06:06:10Z")
Hi all, Logstash supports logstash-out-mongo, does it support logstash-input-mongo (e. g. https://github.com/phutchins/logstash-input-mongodb) Jason --- ## [Logstash Plugin Modifying Files](https://discuss.elastic.co/t/logstash-plugin-modifying-files/32705)
**Author:** [@ahahtyler](https://discuss.elastic.co/u/ahahtyler)\ **Replies:** 1\ **Last updated:** [October 21, 2015, 8:16pm UTC](https://discuss.elastic.co/t/logstash-plugin-modifying-files/32705 "2015-10-21T20:16:50Z")
Is it possible for a logstash plugin to modify files (delete/create) in a directory. The goal is to create a mutex. I've created a Cloud Foundry plugin for logstash that uses the Cloud Foundry CLI. The CLI can only be… --- ## [Logstash Ruby filter to subtract difference between two timestamps in single event](https://discuss.elastic.co/t/logstash-ruby-filter-to-subtract-difference-between-two-timestamps-in-single-event/32580)
**Author:** [@ottignon](https://discuss.elastic.co/u/ottignon)\ **Replies:** 4\ **Last updated:** [October 21, 2015, 4:13pm UTC](https://discuss.elastic.co/t/logstash-ruby-filter-to-subtract-difference-between-two-timestamps-in-single-event/32580 "2015-10-21T16:13:01Z")
Hi, I'm trying to demonstrate the feasability of switching from a Splunk solution to an ELK (Elasticsearch, Logstash and Kibana) stack (with Redis) solution for log analysis and triggering alerts. I have a requiremen… --- ## [Logstash doesn't create index in ES, no errors](https://discuss.elastic.co/t/logstash-doesnt-create-index-in-es-no-errors/32617)
**Author:** [@UsreTX](https://discuss.elastic.co/u/UsreTX)\ **Replies:** 12\ **Last updated:** [October 21, 2015, 4:19pm UTC](https://discuss.elastic.co/t/logstash-doesnt-create-index-in-es-no-errors/32617 "2015-10-21T16:19:24Z")
I'm having trouble getting logstash to talk to ES. My log files / console output are here: In short, ES and Logstash appear to start fine, have no obvious errors in logs and nothing in the error logs, etc. But,… --- ## [Multiple jdbc input configs error](https://discuss.elastic.co/t/multiple-jdbc-input-configs-error/32688)
**Author:** [@CraigFoote](https://discuss.elastic.co/u/CraigFoote)\ **Replies:** 3\ **Last updated:** [October 21, 2015, 4:03pm UTC](https://discuss.elastic.co/t/multiple-jdbc-input-configs-error/32688 "2015-10-21T16:03:03Z")
I have two Logstash config files that run independently fine but not when run with -f as their directory. They're almost identical in that they use jdbc input plugin just with different connection strings and system nam… --- ## [How to take EPOCH time as @timestamp](https://discuss.elastic.co/t/how-to-take-epoch-time-as-timestamp/32673)
**Author:** [@vikas\_gopal](https://discuss.elastic.co/u/vikas_gopal)\ **Replies:** 5\ **Last updated:** [October 21, 2015, 3:46pm UTC](https://discuss.elastic.co/t/how-to-take-epoch-time-as-timestamp/32673 "2015-10-21T15:46:36Z")
Hi Experts, I have a filed which has EPOCH time in it e.g "1443463933000". I want to use it as a @ timestamp filed in kibana . So this is what I have done . Step 1 --\> In logstash i used a date filter and set target … --- ## [Logstash crashes with libcrypt-2.12.so - works with libcrypt-2.5.so](https://discuss.elastic.co/t/logstash-crashes-with-libcrypt-2-12-so-works-with-libcrypt-2-5-so/32683)
**Author:** [@Shailen](https://discuss.elastic.co/u/Shailen)\ **Replies:** 0\ **Last updated:** [October 21, 2015, 3:13pm UTC](https://discuss.elastic.co/t/logstash-crashes-with-libcrypt-2-12-so-works-with-libcrypt-2-5-so/32683 "2015-10-21T15:13:59Z")
This error was reported in the past as "block device detection unsupported or native support failed to load" with missing links for libcrypt.so. In this case, all links were correct but a new version 2.12 of the library… --- ## [Logstash extract first 3 chars of a field into another field](https://discuss.elastic.co/t/logstash-extract-first-3-chars-of-a-field-into-another-field/32658)
**Author:** [@samnik60](https://discuss.elastic.co/u/samnik60)\ **Replies:** 2\ **Last updated:** [October 21, 2015, 11:14am UTC](https://discuss.elastic.co/t/logstash-extract-first-3-chars-of-a-field-into-another-field/32658 "2015-10-21T11:14:22Z")
i tried using grok for this but not getting anywhere . anyone tried this before ?? grok { add\_field =\> \[ "named\_raw\_message", "%{@field}\[1..3\]" \] } Thanks, sam --- ## [Logstash - make input file path configurable](https://discuss.elastic.co/t/logstash-make-input-file-path-configurable/32638)
**Author:** [@samnik60](https://discuss.elastic.co/u/samnik60)\ **Replies:** 2\ **Last updated:** [October 21, 2015, 6:32am UTC](https://discuss.elastic.co/t/logstash-make-input-file-path-configurable/32638 "2015-10-21T06:32:25Z")
Hi guys, Is it possible to pass the input file path from command line like a system variable or environmental variable and use it inside the logstash configuration in some way??? Thanks, sam. --- ## [ELK Stack for Suricata](https://discuss.elastic.co/t/elk-stack-for-suricata/32605)
**Author:** [@sck](https://discuss.elastic.co/u/sck)\ **Replies:** 6\ **Last updated:** [October 21, 2015, 3:43am UTC](https://discuss.elastic.co/t/elk-stack-for-suricata/32605 "2015-10-21T03:43:53Z")
Hello, Looking for some help in configuring ELK to work with Suricata-IDS. My setup is detailed below: elasticsearch-1.7.3.deb kibana-4.1.2-linux-x64.tar.gz logstash\_1.5.4-1\_all.deb logstash-forwarder\_0.4.0\_amd64.… --- ## [Logstash crash / failed to connect to es cluster](https://discuss.elastic.co/t/logstash-crash-failed-to-connect-to-es-cluster/32268)
**Author:** [@quejinho](https://discuss.elastic.co/u/quejinho)\ **Replies:** 11\ **Last updated:** [October 21, 2015, 2:58am UTC](https://discuss.elastic.co/t/logstash-crash-failed-to-connect-to-es-cluster/32268 "2015-10-21T02:58:27Z")
I have an Issue that when i killed logstash and runned it again it it should pass 5k of messages and it does not. There are two errors there One about no nodes avaible Second :message=\>"Got error to send bulk of act… --- ## [Issue logstashing to Found - Continued discussion](https://discuss.elastic.co/t/issue-logstashing-to-found-continued-discussion/32627)
**Author:** [@cstrzadala](https://discuss.elastic.co/u/cstrzadala)\ **Replies:** 1\ **Last updated:** [October 21, 2015, 1:50am UTC](https://discuss.elastic.co/t/issue-logstashing-to-found-continued-discussion/32627 "2015-10-21T01:50:42Z")
Continuing the discussion from Issue logstashing to Found: --- ## [Logstash won't create index in ES](https://discuss.elastic.co/t/logstash-wont-create-index-in-es/24051)
**Author:** [@bluethundr](https://discuss.elastic.co/u/bluethundr)\ **Replies:** 25\ **Last updated:** [October 20, 2015, 8:28pm UTC](https://discuss.elastic.co/t/logstash-wont-create-index-in-es/24051 "2015-10-20T20:28:23Z")
Hello, I followed this tutorial from Digial Ocean on how to install an ELK stack on a CentOS 7 machine. Digital Ocean ELK Setup It seemed pretty good, and got me as far as having an initial Elastic Search node wo… --- ## [Multiple config files and filter application](https://discuss.elastic.co/t/multiple-config-files-and-filter-application/32571)
**Author:** [@CraigFoote](https://discuss.elastic.co/u/CraigFoote)\ **Replies:** 5\ **Last updated:** [October 20, 2015, 7:50pm UTC](https://discuss.elastic.co/t/multiple-config-files-and-filter-application/32571 "2015-10-20T19:50:48Z")
I want to pass a directory as the -f argument to load several config files but I'm concerned about filter sequence.The following is a pair of typical config files. Is my usage of conditionals appropriate to have the filt… --- ## [Logstash line break](https://discuss.elastic.co/t/logstash-line-break/32511)
**Author:** [@Erik\_Parienty](https://discuss.elastic.co/u/Erik_Parienty)\ **Replies:** 2\ **Last updated:** [October 20, 2015, 3:00pm UTC](https://discuss.elastic.co/t/logstash-line-break/32511 "2015-10-20T15:00:39Z")
i have this config with a long line grok { match =\> { "message" =\> "%{DATESTAMP:LogDate},%{NUMBER:RamUsedPercent:float},%{NUMBER:CpuPercent:float},%{NUMBER:DiskFreePercentC:float},%{NUMBER:DiskFreePercentD:float}… --- ## [Create multiple events/docs from a single line](https://discuss.elastic.co/t/create-multiple-events-docs-from-a-single-line/32578)
**Author:** [@luis.carvalho](https://discuss.elastic.co/u/luis.carvalho)\ **Replies:** 0\ **Last updated:** [October 20, 2015, 2:43pm UTC](https://discuss.elastic.co/t/create-multiple-events-docs-from-a-single-line/32578 "2015-10-20T14:43:40Z")
Hi! I want to know if there is any filter plugin that can create multiple events/docs from a single line. For example, in my input data I have a field with the next line: "field\_name":"AAA:AAAA:AAAA;BBBB:BBB:BBB;CCC… --- ## [Logstash CSV Filter Using Unicode delimiter ( SOH )](https://discuss.elastic.co/t/logstash-csv-filter-using-unicode-delimiter-soh/32517)
**Author:** [@samnik60](https://discuss.elastic.co/u/samnik60)\ **Replies:** 4\ **Last updated:** [October 20, 2015, 12:34pm UTC](https://discuss.elastic.co/t/logstash-csv-filter-using-unicode-delimiter-soh/32517 "2015-10-20T12:34:05Z")
HI guys, I am trying to parse a CSV File which has a delimiter of (SOH) i.e Hexa value \\x01 ( unicode value \\u0001 ), but logstash csv filter seems to ignore the seperator mentioned . example filter{ csv{ … [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1227) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1229)