# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1230 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1231 --- ## [Time between timestamp](https://discuss.elastic.co/t/time-between-timestamp/32137)
**Author:** [@Anmol\_Gupta](https://discuss.elastic.co/u/Anmol_Gupta)\ **Replies:** 6\ **Last updated:** [October 15, 2015, 8:31am UTC](https://discuss.elastic.co/t/time-between-timestamp/32137 "2015-10-15T08:31:48Z")
I have a use case , logs are coming into logstash but due to some failure their is a time elapse between two timestamps for example each log has time period between it of 2 minutes and unexpectedly their is 10 minutes g… --- ## [Convert String to float failed](https://discuss.elastic.co/t/convert-string-to-float-failed/32232)
**Author:** [@Enniu\_51](https://discuss.elastic.co/u/Enniu_51)\ **Replies:** 3\ **Last updated:** [October 15, 2015, 7:27am UTC](https://discuss.elastic.co/t/convert-string-to-float-failed/32232 "2015-10-15T07:27:21Z")
My logstash config: filter { grok { match =\> {"stack\_trace" =\> "%{JAVACLASS:exception\_class}: \\\[%{DATA:error\_level}\\\]\\\[%{BASE10NUM:error\_code}\\\]-%{GREEDYDATA:error\_message}"} } grok { match =\> {"message" … --- ## [Time difference calculation between the timestamps](https://discuss.elastic.co/t/time-difference-calculation-between-the-timestamps/32239)
**Author:** [@Surbhi\_Agarwal](https://discuss.elastic.co/u/Surbhi_Agarwal)\ **Replies:** 1\ **Last updated:** [October 15, 2015, 6:44am UTC](https://discuss.elastic.co/t/time-difference-calculation-between-the-timestamps/32239 "2015-10-15T06:44:21Z")
Here comes one use case. Suppose the logs are coming in the logstash but its stop getting logs for some time interval. I want to know this time lag. For Example : At certain point of time like at 14:37:46 , i got t… --- ## [How to convert type for field like a.b in mutate plugin?](https://discuss.elastic.co/t/how-to-convert-type-for-field-like-a-b-in-mutate-plugin/32236)
**Author:** [@Enniu\_51](https://discuss.elastic.co/u/Enniu_51)\ **Replies:** 5\ **Last updated:** [October 15, 2015, 6:27am UTC](https://discuss.elastic.co/t/how-to-convert-type-for-field-like-a-b-in-mutate-plugin/32236 "2015-10-15T06:27:12Z")
As I said here, And now I change my config to: if "geo\_parse\_succeed" in \[tags\] { mutate { add\_field =\> {"geoip.location.lon" =\> "%{longitude}"} add\_field =\> {"geoip.location.lat" =\> "%{latitude}"} … --- ## [Logstash plugin installation error](https://discuss.elastic.co/t/logstash-plugin-installation-error/32132)
**Author:** [@Omkar\_Poudel](https://discuss.elastic.co/u/Omkar_Poudel)\ **Replies:** 4\ **Last updated:** [October 14, 2015, 8:38pm UTC](https://discuss.elastic.co/t/logstash-plugin-installation-error/32132 "2015-10-14T20:38:41Z")
Running plugin install logstash-input-jdbc returns Trying https://github.com/null/logstash-input-jdbc/archive/master.zip... Failed to install logstash-input-jdbc, reason: failed to download out of all possible locat… --- ## [:message=\>"The error reported is: \\n "](https://discuss.elastic.co/t/message-the-error-reported-is-n/32194)
**Author:** [@steve\_womack](https://discuss.elastic.co/u/steve_womack)\ **Replies:** 10\ **Last updated:** [October 14, 2015, 7:43pm UTC](https://discuss.elastic.co/t/message-the-error-reported-is-n/32194 "2015-10-14T19:43:32Z")
This isn't very helpful. Where can I go to find out the actual error? I have no idea where to even start with such a vague message. --- ## [Unusual date conversion](https://discuss.elastic.co/t/unusual-date-conversion/31652)
**Author:** [@ktella](https://discuss.elastic.co/u/ktella)\ **Replies:** 2\ **Last updated:** [October 14, 2015, 7:35pm UTC](https://discuss.elastic.co/t/unusual-date-conversion/31652 "2015-10-14T19:35:26Z")
Team, My Thanks to Community for helping me to get this far in implementing ELK succesfully. Now the issue... 1) I have log with timestamp like this \[05/Oct/2015:12:23:42 -0400\] How can i change this to something … --- ## [How to resolve \`\_grokparsefailure\` in node.js logs](https://discuss.elastic.co/t/how-to-resolve--grokparsefailure-in-node-js-logs/32123)
**Author:** [@smugcloud](https://discuss.elastic.co/u/smugcloud)\ **Replies:** 3\ **Last updated:** [October 14, 2015, 2:14pm UTC](https://discuss.elastic.co/t/how-to-resolve--grokparsefailure-in-node-js-logs/32123 "2015-10-14T14:14:04Z")
I am new to ELK and trying to instrument a simple node.js app that is using Winston for logging. I have tried a variety of grok patterns (including just %COMBINEDAPACHELOG) but can not seem to get all the data that I ne… --- ## [Unable to use param in sql query and load data in local Elasticsearch index](https://discuss.elastic.co/t/unable-to-use-param-in-sql-query-and-load-data-in-local-elasticsearch-index/32182)
**Author:** [@kruelah](https://discuss.elastic.co/u/kruelah)\ **Replies:** 0\ **Last updated:** [October 14, 2015, 1:49pm UTC](https://discuss.elastic.co/t/unable-to-use-param-in-sql-query-and-load-data-in-local-elasticsearch-index/32182 "2015-10-14T13:49:45Z")
Hi folks I use Logstash 2 and try to connect to a SQL Server database to load data. My Logstash input config file section looks like this: input { jdbc { jdbc\_driver\_library =\> "/opt/logstash/jtds-1.3.1.jar" … --- ## [Syslog parsing error in transmission](https://discuss.elastic.co/t/syslog-parsing-error-in-transmission/26617)
**Author:** [@gromit](https://discuss.elastic.co/u/gromit)\ **Replies:** 2\ **Last updated:** [October 14, 2015, 1:16pm UTC](https://discuss.elastic.co/t/syslog-parsing-error-in-transmission/26617 "2015-10-14T13:16:07Z")
Currently having a strange parsing error with Cisco ASA logs. ASA syslogs forwarded to Logstash via syslog-ng, a typical line is like this: 2015-07-31T01:47:35+10:00 10.0.0.25 %ASA-3-313001: Denied ICMP type=3, code=… --- ## [Multi-table JDBC Support](https://discuss.elastic.co/t/multi-table-jdbc-support/32173)
**Author:** [@Jaraxal](https://discuss.elastic.co/u/Jaraxal)\ **Replies:** 2\ **Last updated:** [October 14, 2015, 1:01pm UTC](https://discuss.elastic.co/t/multi-table-jdbc-support/32173 "2015-10-14T13:01:54Z")
Does Logstash support using JDBC to pull data from multiple, related tables as a single index? We have data sources that have multiple tables, between 10 and 20. There is always a primary table that has the key used to… --- ## [Use file:// rather than puppet:// with the Logstash Puppet submodule](https://discuss.elastic.co/t/use-file-rather-than-puppet-with-the-logstash-puppet-submodule/32081)
**Author:** [@incogniro](https://discuss.elastic.co/u/incogniro)\ **Replies:** 1\ **Last updated:** [October 14, 2015, 2:47am UTC](https://discuss.elastic.co/t/use-file-rather-than-puppet-with-the-logstash-puppet-submodule/32081 "2015-10-14T02:47:17Z")
I am using https://github.com/elasticsearch/puppet-logstash as a git submodule in a project that does not use a Puppet server and would like to update the submodule with https://github.com/elastic/puppet-logstash/pull/20… --- ## [Redis, Logstash indexer, elasticsearch bottleneck](https://discuss.elastic.co/t/redis-logstash-indexer-elasticsearch-bottleneck/32113)
**Author:** [@ktella](https://discuss.elastic.co/u/ktella)\ **Replies:** 0\ **Last updated:** [October 13, 2015, 7:22pm UTC](https://discuss.elastic.co/t/redis-logstash-indexer-elasticsearch-bottleneck/32113 "2015-10-13T19:22:57Z")
I have made a setup of ELK like below. LS(reading from file) --\> REDIS --\> LS(indexer) --\> ELS I'm using a bench mark script from here to generate a 1M logs lines to measure performance. https://github.com/aseigneurin/… --- ## [Can't install dependencies for Logstash plugin](https://discuss.elastic.co/t/cant-install-dependencies-for-logstash-plugin/32120)
**Author:** [@tmhammer](https://discuss.elastic.co/u/tmhammer)\ **Replies:** 0\ **Last updated:** [October 13, 2015, 8:35pm UTC](https://discuss.elastic.co/t/cant-install-dependencies-for-logstash-plugin/32120 "2015-10-13T20:35:16Z")
I followed along with the tutorial exactly: https://www.elastic.co/guide/en/logstash/current/\_how\_to\_write\_a\_logstash\_filter\_plugin.html After switching RVM to use Jruby bundle install gives me the following: Coul… --- ## [Cannot get csv data to load into elasticsearch](https://discuss.elastic.co/t/cannot-get-csv-data-to-load-into-elasticsearch/32112)
**Author:** [@Deepak\_Paramanand](https://discuss.elastic.co/u/Deepak_Paramanand)\ **Replies:** 3\ **Last updated:** [October 13, 2015, 8:30pm UTC](https://discuss.elastic.co/t/cannot-get-csv-data-to-load-into-elasticsearch/32112 "2015-10-13T20:30:59Z")
Hi, I have a CSV file that I want to index into Elasticsearch and I also want to see what has been written to elasticsearch, so I have created a conf file as below: input { file { path =\> \["C:\\Work\\Kodiak\\ATT… --- ## [Unable to send data to elasticsearch](https://discuss.elastic.co/t/unable-to-send-data-to-elasticsearch/32109)
**Author:** [@sfunk](https://discuss.elastic.co/u/sfunk)\ **Replies:** 10\ **Last updated:** [October 13, 2015, 8:27pm UTC](https://discuss.elastic.co/t/unable-to-send-data-to-elasticsearch/32109 "2015-10-13T20:27:15Z")
This question has probably been answered a million times, btu I can't find a satisfactory answer, nor do I understand what I'm doing wrong. Curling elasticsearch I get: { "status" : 200, "name" : "poc", "cluste… --- ## [Export data using logstash](https://discuss.elastic.co/t/export-data-using-logstash/31408)
**Author:** [@liorg2](https://discuss.elastic.co/u/liorg2)\ **Replies:** 6\ **Last updated:** [October 13, 2015, 8:10pm UTC](https://discuss.elastic.co/t/export-data-using-logstash/31408 "2015-10-13T20:10:33Z")
can logstash be used to export data FROM elasticearch to another database? --- ## [Determining why records are missing after Logstash indexing](https://discuss.elastic.co/t/determining-why-records-are-missing-after-logstash-indexing/31848)
**Author:** [@marinoc](https://discuss.elastic.co/u/marinoc)\ **Replies:** 8\ **Last updated:** [October 13, 2015, 7:09pm UTC](https://discuss.elastic.co/t/determining-why-records-are-missing-after-logstash-indexing/31848 "2015-10-13T19:09:26Z")
Hi - I'm attempting to index a single w 19,690 lines, each line will be it's own record in ES. The lines are pretty small, only 4-5 fields per line. After I run logstash using the following command: sudo bin/logstash… --- ## [\[SOLVED\] After several months, logstash input file stop working](https://discuss.elastic.co/t/solved-after-several-months-logstash-input-file-stop-working/31346)
**Author:** [@alexolivan](https://discuss.elastic.co/u/alexolivan)\ **Replies:** 1\ **Last updated:** [October 13, 2015, 3:07pm UTC](https://discuss.elastic.co/t/solved-after-several-months-logstash-input-file-stop-working/31346 "2015-10-13T15:07:21Z")
Hi forum... logstash is driving me nuts... My logstash servers are restarted every two ours, in order to keep the cluster up... but even so, there are some servers that can refuse to read some files for days... and the… --- ## [Logstash if condition](https://discuss.elastic.co/t/logstash-if-condition/32075)
**Author:** [@schilwan](https://discuss.elastic.co/u/schilwan)\ **Replies:** 5\ **Last updated:** [October 13, 2015, 1:39pm UTC](https://discuss.elastic.co/t/logstash-if-condition/32075 "2015-10-13T13:39:16Z")
I have some data that comes in and using the ipaddress to get hold of geo details using geoip. What I found is my add\_field adds the field below if it finds a region for example "region\_name": "CA", although if one d… --- ## [Logstash java.lang.unsupportedOperationException](https://discuss.elastic.co/t/logstash-java-lang-unsupportedoperationexception/32057)
**Author:** [@supermario](https://discuss.elastic.co/u/supermario)\ **Replies:** 7\ **Last updated:** [October 13, 2015, 8:14am UTC](https://discuss.elastic.co/t/logstash-java-lang-unsupportedoperationexception/32057 "2015-10-13T08:14:57Z")
I think through the TCP protocol to logstash from nxlog write log. But, i get some exceptions,excemple 'Exception in thread "\>elasticsearch.4 " java.lang.unsupportedoperationexception'. I try to reduce flush\_size in log… --- ## [Not able to create index based on log date field](https://discuss.elastic.co/t/not-able-to-create-index-based-on-log-date-field/32042)
**Author:** [@vikas\_gopal](https://discuss.elastic.co/u/vikas_gopal)\ **Replies:** 10\ **Last updated:** [October 13, 2015, 7:52am UTC](https://discuss.elastic.co/t/not-able-to-create-index-based-on-log-date-field/32042 "2015-10-13T07:52:00Z")
Hi Experts, I want to create an index based on a log date field , my logs in csv file are like logtime,name 10/13/2015 2:30,vg my LS conf has filter { csv { columns =\> \["logtime","name"\] separator =\> ",… --- ## [Unsure why i am unable to connect couchdb to elasticsearch via logstash](https://discuss.elastic.co/t/unsure-why-i-am-unable-to-connect-couchdb-to-elasticsearch-via-logstash/32052)
**Author:** [@waitwhat](https://discuss.elastic.co/u/waitwhat)\ **Replies:** 3\ **Last updated:** [October 13, 2015, 5:58am UTC](https://discuss.elastic.co/t/unsure-why-i-am-unable-to-connect-couchdb-to-elasticsearch-via-logstash/32052 "2015-10-13T05:58:09Z")
I am quite new to both Logstash and elasticsearch and as the title suggested i have no idea why my data is not being imported into elasticsearch anyway here is my logstash config file input { couchdb\_changes { … --- ## [Pull data from wikipedia](https://discuss.elastic.co/t/pull-data-from-wikipedia/31980)
**Author:** [@Dan](https://discuss.elastic.co/u/Dan)\ **Replies:** 1\ **Last updated:** [October 13, 2015, 4:52am UTC](https://discuss.elastic.co/t/pull-data-from-wikipedia/31980 "2015-10-13T04:52:05Z")
Hi All, How can we pull data from wikipedia to elastic search by using logstash and how can i index that data. please give an example for config file. Thanks & Regards, Dinesh --- ## [Please give me easy sample to use xml filter](https://discuss.elastic.co/t/please-give-me-easy-sample-to-use-xml-filter/31616)
**Author:** [@kikuchan](https://discuss.elastic.co/u/kikuchan)\ **Replies:** 10\ **Last updated:** [October 13, 2015, 12:50am UTC](https://discuss.elastic.co/t/please-give-me-easy-sample-to-use-xml-filter/31616 "2015-10-13T00:50:15Z")
Hello. I'd like to use XML filter,but I didn't use it very well. please give me easy sample to use xml filter. sincerely. --- ## [1.4 to 1.5 migration: comaptibility issues?](https://discuss.elastic.co/t/1-4-to-1-5-migration-comaptibility-issues/32049)
**Author:** [@alexolivan](https://discuss.elastic.co/u/alexolivan)\ **Replies:** 1\ **Last updated:** [October 12, 2015, 11:19pm UTC](https://discuss.elastic.co/t/1-4-to-1-5-migration-comaptibility-issues/32049 "2015-10-12T23:19:52Z")
Hi forum... I'm thinking on jumping forward to 1.5 again (early experience was bitter...) First thing that comes to my mind is wether conf files woulb be valid, or would everything had to be rebuilt from scratch? S… --- ## [Logstash "input" performance?](https://discuss.elastic.co/t/logstash-input-performance/31830)
**Author:** [@MarcelHallmann](https://discuss.elastic.co/u/MarcelHallmann)\ **Replies:** 8\ **Last updated:** [October 12, 2015, 10:48pm UTC](https://discuss.elastic.co/t/logstash-input-performance/31830 "2015-10-12T22:48:36Z")
Hi, we have one logstash instance that is monitoring several application log folders (about 10 folders). The configuration looks like: input { file { codec =\> json { charset =\> "UTF-8" … --- ## [Jsonparsefailures parsing apache access logs](https://discuss.elastic.co/t/jsonparsefailures-parsing-apache-access-logs/32039)
**Author:** [@bluethundr](https://discuss.elastic.co/u/bluethundr)\ **Replies:** 2\ **Last updated:** [October 12, 2015, 9:00pm UTC](https://discuss.elastic.co/t/jsonparsefailures-parsing-apache-access-logs/32039 "2015-10-12T21:00:06Z")
Hey guys, I tried setting up json logging in apache, as demonstrated in the logstash book. Here's the custom access log definition I'm using: LogFormat "{ \\ \\"host\\":\\"beta.jokefire.com.jokefire.com\\", \\ \\"… --- ## [Mapping for geo\_point-usage not working with twitter input](https://discuss.elastic.co/t/mapping-for-geo-point-usage-not-working-with-twitter-input/24545)
**Author:** [@dominikmueller](https://discuss.elastic.co/u/dominikmueller)\ **Replies:** 1\ **Last updated:** [October 12, 2015, 5:58pm UTC](https://discuss.elastic.co/t/mapping-for-geo-point-usage-not-working-with-twitter-input/24545 "2015-10-12T17:58:12Z")
Hi guys, i set up elasticsearch with kibana and logstash and i would like to analyze some Tweets with it. Currently my configuration looks like this: input { twitter { consumer\_key =\> mykey con… --- ## [Filter config fails](https://discuss.elastic.co/t/filter-config-fails/32028)
**Author:** [@bluethundr](https://discuss.elastic.co/u/bluethundr)\ **Replies:** 2\ **Last updated:** [October 12, 2015, 7:30pm UTC](https://discuss.elastic.co/t/filter-config-fails/32028 "2015-10-12T19:30:53Z")
Hey guys, Sorry if this is a little basic. But I wrote this filter and stashed it into it's own config file: filter { if \[type\] == "syslog" { grok { match =\> { "message" =\> "\\{", "%{QS}:%{BASE16FLOAT:time… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1229) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1231)