# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1232 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1233 --- ## [Logstash-forwarder working](https://discuss.elastic.co/t/logstash-forwarder-working/31707)
**Author:** [@Navneet\_Mathpal](https://discuss.elastic.co/u/Navneet_Mathpal)\ **Replies:** 3\ **Last updated:** [October 7, 2015, 10:52am UTC](https://discuss.elastic.co/t/logstash-forwarder-working/31707 "2015-10-07T10:52:48Z")
Hi, I have just started using Logstash-forwarder , I have created key and crt and then want to check whether is is fine or not, input { lumberjack { port =\> 9300 ssl\_certificate =\> "/elkt/software/bkup/logstash-1.5.… --- ## [Connecting to multiple servers - SSL issue](https://discuss.elastic.co/t/connecting-to-multiple-servers-ssl-issue/31629)
**Author:** [@nkoleff](https://discuss.elastic.co/u/nkoleff)\ **Replies:** 1\ **Last updated:** [October 7, 2015, 6:17am UTC](https://discuss.elastic.co/t/connecting-to-multiple-servers-ssl-issue/31629 "2015-10-07T06:17:25Z")
Hi there, My setup is including logstash servers, that have 3 correseponding elasticsearch servers. I am feeding them from a single server with logstash-forwarder I have used their FQDNs and obviously I needed a wil… --- ## [Logstash.stdout large size?](https://discuss.elastic.co/t/logstash-stdout-large-size/24939)
**Author:** [@saif](https://discuss.elastic.co/u/saif)\ **Replies:** 5\ **Last updated:** [October 7, 2015, 5:25am UTC](https://discuss.elastic.co/t/logstash-stdout-large-size/24939 "2015-10-07T05:25:32Z")
hi im using logstash to send logs to redis but i don't understand wwey that logstash.stdout have this size what is the problem thank you ! :qw! lol --- ## [Logstash BadResponseError with IMAP plugin](https://discuss.elastic.co/t/logstash-badresponseerror-with-imap-plugin/31738)
**Author:** [@javadevmtl](https://discuss.elastic.co/u/javadevmtl)\ **Replies:** 0\ **Last updated:** [October 6, 2015, 10:24pm UTC](https://discuss.elastic.co/t/logstash-badresponseerror-with-imap-plugin/31738 "2015-10-06T22:24:05Z")
Hello using logstash 1.5.4 and Elasticsearch 1.6 but can't seem to connect to my MS Exchange 2003 server. Though I can certainly Telnet to it and do manual commands. ←\[31mA plugin had an unrecoverable error. Will resta… --- ## [RabbitMQ Ack Question](https://discuss.elastic.co/t/rabbitmq-ack-question/31715)
**Author:** [@spynxo](https://discuss.elastic.co/u/spynxo)\ **Replies:** 2\ **Last updated:** [October 6, 2015, 7:27pm UTC](https://discuss.elastic.co/t/rabbitmq-ack-question/31715 "2015-10-06T19:27:32Z")
It seems like with RabbitMQ you can enable acknowledgements on the input so the message only gets deleted from the server if it was successfully received. Is there any way to make it so acknowledgments are sent only if t… --- ## [Error converting to IP type](https://discuss.elastic.co/t/error-converting-to-ip-type/31720)
**Author:** [@javi](https://discuss.elastic.co/u/javi)\ **Replies:** 2\ **Last updated:** [October 6, 2015, 6:24pm UTC](https://discuss.elastic.co/t/error-converting-to-ip-type/31720 "2015-10-06T18:24:21Z")
Hello, In trying to use the IP field type and in doing so I am seeing a strange error in the logstash logs. I am running with version 1.4.5 the portion of the config that is causing the error to be thrown is as fol… --- ## [Logstash plugin](https://discuss.elastic.co/t/logstash-plugin/31606)
**Author:** [@Anmol\_Gupta](https://discuss.elastic.co/u/Anmol_Gupta)\ **Replies:** 6\ **Last updated:** [October 6, 2015, 11:22am UTC](https://discuss.elastic.co/t/logstash-plugin/31606 "2015-10-06T11:22:06Z")
If i want to have data from different nodes or cluster index it into ES , which plugin i should use? My use case is i want to analyse logs from different cluster on kibana . --- ## [Update all logstash 1.5 plugins](https://discuss.elastic.co/t/update-all-logstash-1-5-plugins/31634)
**Author:** [@rom85](https://discuss.elastic.co/u/rom85)\ **Replies:** 2\ **Last updated:** [October 6, 2015, 7:32am UTC](https://discuss.elastic.co/t/update-all-logstash-1-5-plugins/31634 "2015-10-06T07:32:47Z")
I'd like have logstash plugins updated along with logstash 1.5 installation via puppet. I could have used "exec" for that but running something like: ./plugin update You are updating logstash-codec-collectd to a new … --- ## [\_http\_request\_failure in logstash while using http\_poller](https://discuss.elastic.co/t/-http-request-failure-in-logstash-while-using-http-poller/31637)
**Author:** [@Navneet\_Mathpal](https://discuss.elastic.co/u/Navneet_Mathpal)\ **Replies:** 5\ **Last updated:** [October 5, 2015, 5:55pm UTC](https://discuss.elastic.co/t/-http-request-failure-in-logstash-while-using-http-poller/31637 "2015-10-05T17:55:34Z")
Hi , I am getting some json documents from http\_poller input { http\_poller { urls =\> { "localhost" =\> "http://localhost:9200" } interval =\> 10 After I reads all the document It shows httprequest\_fai… --- ## [Buffer Overflow when inputing old logs into logstash](https://discuss.elastic.co/t/buffer-overflow-when-inputing-old-logs-into-logstash/31628)
**Author:** [@dlb1001](https://discuss.elastic.co/u/dlb1001)\ **Replies:** 7\ **Last updated:** [October 5, 2015, 4:38pm UTC](https://discuss.elastic.co/t/buffer-overflow-when-inputing-old-logs-into-logstash/31628 "2015-10-05T16:38:54Z")
Hello, I've been working on inputing all of our old logs into logstash. I've been using this thread to help me implement it: Right now I'm just inputing custom apache logs through a listening port. I've been… --- ## [How to setup tags?](https://discuss.elastic.co/t/how-to-setup-tags/31454)
**Author:** [@mne](https://discuss.elastic.co/u/mne)\ **Replies:** 2\ **Last updated:** [October 5, 2015, 7:38am UTC](https://discuss.elastic.co/t/how-to-setup-tags/31454 "2015-10-05T07:38:29Z")
Hi all, i'm trying to configure logstash-forwarder to send a tag with every event, but it fails: I've tried: "fields": { "type": "eslog" }, "tags": \[ "esnode1" \] But this seems to be ignored... If i add it as field e… --- ## [IP address of logstash node required in Logstash Metrics plugin](https://discuss.elastic.co/t/ip-address-of-logstash-node-required-in-logstash-metrics-plugin/31610)
**Author:** [@rahulchat](https://discuss.elastic.co/u/rahulchat)\ **Replies:** 1\ **Last updated:** [October 5, 2015, 7:25am UTC](https://discuss.elastic.co/t/ip-address-of-logstash-node-required-in-logstash-metrics-plugin/31610 "2015-10-05T07:25:30Z")
Is there any way I can get the IP address of the logstash node within metric plugin? my code is like this -- filter { metrics { meter =\> "events" add\_tag =\> "metric" } } output { if "metric" in \[ta… --- ## [Logstash Mixing Throttled and Non-Throttled inputs](https://discuss.elastic.co/t/logstash-mixing-throttled-and-non-throttled-inputs/26548)
**Author:** [@Yarden\_Bar](https://discuss.elastic.co/u/Yarden_Bar)\ **Replies:** 14\ **Last updated:** [October 5, 2015, 3:26am UTC](https://discuss.elastic.co/t/logstash-mixing-throttled-and-non-throttled-inputs/26548 "2015-10-05T03:26:26Z")
Hi, Intro We use Logstash with both throttled and unthrottled inputs. There's already an issue on github, but per suyograo recommendation, I'm opening the question here as well. Components configuration: Elasticsear… --- ## [How to add a grok expression or regex in the file name of a log for parsing](https://discuss.elastic.co/t/how-to-add-a-grok-expression-or-regex-in-the-file-name-of-a-log-for-parsing/31578)
**Author:** [@Rajeev\_Singh](https://discuss.elastic.co/u/Rajeev_Singh)\ **Replies:** 4\ **Last updated:** [October 4, 2015, 8:14pm UTC](https://discuss.elastic.co/t/how-to-add-a-grok-expression-or-regex-in-the-file-name-of-a-log-for-parsing/31578 "2015-10-04T20:14:11Z")
Hi I am trying to parse a logfile which is name as testlogfile.YEAR-MM-DD.log I used the input plugin of file with the format as testlogfile.%{+YYYY-MM-dd}.log This is not working and the only way to get this file … --- ## [How can I create logstash conf filter with different patterns for different lines for input file?](https://discuss.elastic.co/t/how-can-i-create-logstash-conf-filter-with-different-patterns-for-different-lines-for-input-file/31588)
**Author:** [@Stella\_Martin](https://discuss.elastic.co/u/Stella_Martin)\ **Replies:** 5\ **Last updated:** [October 4, 2015, 8:10pm UTC](https://discuss.elastic.co/t/how-can-i-create-logstash-conf-filter-with-different-patterns-for-different-lines-for-input-file/31588 "2015-10-04T20:10:29Z")
I have following file format HeadingString1\<\\tab\>HeadingString2\<\\tab\>......\<\\tab\>HeadingStringN Col11\_1\<\\tab\>Col11\_2\<\\tab\>Col21\_1\<\\tab\>Col21\_2\<\\tab\>...\<\\tab\>ColN1\_1\<\\tab\>ColN1\_2 Col12\_1\<\\tab\>Col12\_2\<\\tab\>Col22\_1\<\\tab\>C… --- ## [Grok Expression](https://discuss.elastic.co/t/grok-expression/31583)
**Author:** [@DocMAX](https://discuss.elastic.co/u/DocMAX)\ **Replies:** 1\ **Last updated:** [October 3, 2015, 9:11pm UTC](https://discuss.elastic.co/t/grok-expression/31583 "2015-10-03T21:11:19Z")
HI, I have test\[1234\] and test In both cases i need test as source field Shouldn't this work? %{NOTSPACE:process}(?:\\\[.+\\\]) I have no match with "test" only. --- ## [How to configureLogstash HTTP output plugin](https://discuss.elastic.co/t/how-to-configurelogstash-http-output-plugin/24707)
**Author:** [@venkaty](https://discuss.elastic.co/u/venkaty)\ **Replies:** 2\ **Last updated:** [October 3, 2015, 7:47pm UTC](https://discuss.elastic.co/t/how-to-configurelogstash-http-output-plugin/24707 "2015-10-03T19:47:11Z")
What is the significance of verify\_ssl option of HTTP output plug-in ? How to configure Logstash HTTP output plugin with the following options Enable SSL (Https) Enable client certificate path so that server side a… --- ## [Lumberjack Input Ceasing to Function](https://discuss.elastic.co/t/lumberjack-input-ceasing-to-function/27517)
**Author:** [@davisv](https://discuss.elastic.co/u/davisv)\ **Replies:** 4\ **Last updated:** [October 2, 2015, 5:00pm UTC](https://discuss.elastic.co/t/lumberjack-input-ceasing-to-function/27517 "2015-10-02T17:00:30Z")
Hello all! I'm running several logstash-forwarder instances on remote servers that connect back to a central ELK machine. Events from all logstash-forwarder instances process fine for the majority of the time but seemi… --- ## [Obtaining Tags from Tags](https://discuss.elastic.co/t/obtaining-tags-from-tags/31531)
**Author:** [@billy6](https://discuss.elastic.co/u/billy6)\ **Replies:** 4\ **Last updated:** [October 2, 2015, 2:49pm UTC](https://discuss.elastic.co/t/obtaining-tags-from-tags/31531 "2015-10-02T14:49:14Z")
Hello, I would like to Slipt a Tag in several parts. I mean, I have the Tag "Comment" = "\[Module12\] Statblablabla" I would like to divide it in other two Tags "Module" = Module12 and "Status" = Statblablabla. But with … --- ## [How to extract an Information from an attribute?](https://discuss.elastic.co/t/how-to-extract-an-information-from-an-attribute/31446)
**Author:** [@ABecker](https://discuss.elastic.co/u/ABecker)\ **Replies:** 2\ **Last updated:** [October 2, 2015, 1:45pm UTC](https://discuss.elastic.co/t/how-to-extract-an-information-from-an-attribute/31446 "2015-10-02T13:45:56Z")
Hello elastic community, I have a problem with one of my Logstash parsing configurations. One customer want to use a country field. The information to fill the country field I can extract from the path, but I don't … --- ## [Windows 10 File input hangs \[SOLVED\]](https://discuss.elastic.co/t/windows-10-file-input-hangs-solved/31462)
**Author:** [@IGarvin](https://discuss.elastic.co/u/IGarvin)\ **Replies:** 8\ **Last updated:** [October 2, 2015, 9:22am UTC](https://discuss.elastic.co/t/windows-10-file-input-hangs-solved/31462 "2015-10-02T09:22:30Z")
Running in virtual test environment on Windows 10. Looked at all sorts of topics on this only to find all solutions (often just how to type the file path) are coming up unsuccessful. Behavior is Logstash hangs on "Logsta… --- ## [Logstash - install & first test](https://discuss.elastic.co/t/logstash-install-first-test/31215)
**Author:** [@Franck\_Serot](https://discuss.elastic.co/u/Franck_Serot)\ **Replies:** 11\ **Last updated:** [October 2, 2015, 7:11am UTC](https://discuss.elastic.co/t/logstash-install-first-test/31215 "2015-10-02T07:11:43Z")
Hi, I try to install and test logstash according to the following tutorial. https://www.elastic.co/guide/en/logstash/current/first-event.html I have the following error. java -version java version "1.8.0\_31" J… --- ## [How to parse bluecoat proxyAV logs](https://discuss.elastic.co/t/how-to-parse-bluecoat-proxyav-logs/31520)
**Author:** [@riconeo](https://discuss.elastic.co/u/riconeo)\ **Replies:** 3\ **Last updated:** [October 2, 2015, 7:10am UTC](https://discuss.elastic.co/t/how-to-parse-bluecoat-proxyav-logs/31520 "2015-10-02T07:10:02Z")
Format string from Bluecoat ProxyAV c-dns, -, -, N, date, time, 1, -, -, s-dns, s-ip, s-port, time-taken, sc-bytes, cs-bytes, cs-protocol, -, cs-method, cs-uri, sc-mimetype, cache, sc-status Output in the logstash mess… --- ## [How to add a date field?](https://discuss.elastic.co/t/how-to-add-a-date-field/31488)
**Author:** [@CraigFoote](https://discuss.elastic.co/u/CraigFoote)\ **Replies:** 0\ **Last updated:** [October 1, 2015, 4:16pm UTC](https://discuss.elastic.co/t/how-to-add-a-date-field/31488 "2015-10-01T16:16:12Z")
Is there a way to add a field of type date using just logstash config? I've tried using the mutate and date filters with no success. I need to set a field with an arbitrary date, e.g. date{ add\_field =\> { "ingest… --- ## [Logstash subscribe Kafka message gets ClosedChannelException](https://discuss.elastic.co/t/logstash-subscribe-kafka-message-gets-closedchannelexception/31445)
**Author:** [@Jason\_Zheng](https://discuss.elastic.co/u/Jason_Zheng)\ **Replies:** 2\ **Last updated:** [October 1, 2015, 2:52pm UTC](https://discuss.elastic.co/t/logstash-subscribe-kafka-message-gets-closedchannelexception/31445 "2015-10-01T14:52:22Z")
Hi All, I would like to get message from kafka but get ClosedChannelException (loops) log4j, \[2015-10-01T15:44:28.569\] WARN: kafka.consumer.ConsumerFetcherManager$LeaderFinderThread: \[logstash\_logstashsubkafka-14436… --- ## [What is the best way to profile Logstash?](https://discuss.elastic.co/t/what-is-the-best-way-to-profile-logstash/29956)
**Author:** [@thehybridtech](https://discuss.elastic.co/u/thehybridtech)\ **Replies:** 5\ **Last updated:** [October 1, 2015, 2:10pm UTC](https://discuss.elastic.co/t/what-is-the-best-way-to-profile-logstash/29956 "2015-10-01T14:10:01Z")
A friend and I wrote a codec to parse syslog data for SAR files. The codec works great but performance is slow. What is the best way to profile logstash? VisualVM or jruby profiler? Is there any documentation on this… --- ## [Logstash monitoring BB-Server Logs](https://discuss.elastic.co/t/logstash-monitoring-bb-server-logs/31457)
**Author:** [@lukas\_meier](https://discuss.elastic.co/u/lukas_meier)\ **Replies:** 15\ **Last updated:** [October 1, 2015, 1:53pm UTC](https://discuss.elastic.co/t/logstash-monitoring-bb-server-logs/31457 "2015-10-01T13:53:36Z")
hi my mission it is to monitor a Blackberry (BES) Server with logstash i got 3 types of Logfiles on BES-Server to parse, core, mdat and disp logfile-types, but they save wrong into ES, with 2 types it was more easier, bu… --- ## [Comunication between logstash-forwarder and lumberjack](https://discuss.elastic.co/t/comunication-between-logstash-forwarder-and-lumberjack/31470)
**Author:** [@fprincipe](https://discuss.elastic.co/u/fprincipe)\ **Replies:** 0\ **Last updated:** [October 1, 2015, 10:52am UTC](https://discuss.elastic.co/t/comunication-between-logstash-forwarder-and-lumberjack/31470 "2015-10-01T10:52:32Z")
Hi, I'm activating a comunication channel between 2 servers generating a ssl certificate as found on your site, this works fine. Problem is that in production environment my CA authority asking me to generate certificate… --- ## [Outputing syslogs to OpenNMS](https://discuss.elastic.co/t/outputing-syslogs-to-opennms/31455)
**Author:** [@hughesr9](https://discuss.elastic.co/u/hughesr9)\ **Replies:** 1\ **Last updated:** [October 1, 2015, 9:19am UTC](https://discuss.elastic.co/t/outputing-syslogs-to-opennms/31455 "2015-10-01T09:19:44Z")
I am trying to send syslogs to OpenNMS which is listening for syslogs on port 10514. This is the config I have currently. output { stdout { } elasticsearch { host =\> "192.168.218.2" } syslog { type =\> syslog … --- ## [Multiline postfix grok filter](https://discuss.elastic.co/t/multiline-postfix-grok-filter/31435)
**Author:** [@etfeet](https://discuss.elastic.co/u/etfeet)\ **Replies:** 1\ **Last updated:** [October 1, 2015, 6:27am UTC](https://discuss.elastic.co/t/multiline-postfix-grok-filter/31435 "2015-10-01T06:27:17Z")
I'm trying to create a multi-line postfix grok pattern to have messageid, userid, username, queueid, from,to,size,etc. in the same document for graphing in kibana. is there a way to match elements in the middle of mess… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1231) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1233)