# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1235 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1236 --- ## [Changing timestamp](https://discuss.elastic.co/t/changing-timestamp/29775)
**Author:** [@billy6](https://discuss.elastic.co/u/billy6)\ **Replies:** 6\ **Last updated:** [September 22, 2015, 1:34pm UTC](https://discuss.elastic.co/t/changing-timestamp/29775 "2015-09-22T13:34:43Z")
Hello! I would like to know how could I chage the timestamp in my logs, I'm receiving logs with a previous timestamp included and I would like to put this value as the timestamp. For example\> "2014/09/22 14:20:08… --- ## [How to analyze metric log?](https://discuss.elastic.co/t/how-to-analyze-metric-log/29783)
**Author:** [@abcfy2](https://discuss.elastic.co/u/abcfy2)\ **Replies:** 4\ **Last updated:** [September 22, 2015, 1:33pm UTC](https://discuss.elastic.co/t/how-to-analyze-metric-log/29783 "2015-09-22T13:33:04Z")
Hi all. I have a file named metric.log like this: 2015-09-22 20:24:46,420 \[metrics-logger-reporter-1-thread-1\] INFO hawkeyes.rtds.monitor.MetricsVerticle - type=TIMER, name=mailman\_deliver, count=15256, min=0.342485,… --- ## [JSON rename](https://discuss.elastic.co/t/json-rename/29767)
**Author:** [@radu.stefanache](https://discuss.elastic.co/u/radu.stefanache)\ **Replies:** 2\ **Last updated:** [September 22, 2015, 10:16am UTC](https://discuss.elastic.co/t/json-rename/29767 "2015-09-22T10:16:54Z")
Hello everyone, I am currently parsing a json string into an object which gets mapped into a structure similar to this : \[parentobj\]\[childobj\]\[attr1\] \[parentobj\]\[childobj\]\[attr2\] \[parentobj\]\[childobj\]\[attr2\] What I… --- ## [Windows Event Logs - missing fields](https://discuss.elastic.co/t/windows-event-logs-missing-fields/29706)
**Author:** [@selspiero](https://discuss.elastic.co/u/selspiero)\ **Replies:** 8\ **Last updated:** [September 22, 2015, 9:40am UTC](https://discuss.elastic.co/t/windows-event-logs-missing-fields/29706 "2015-09-22T09:40:42Z")
Hi there, I am currently in the process of setting up ELK for windows event logs for a production environment. I am just testing every thing, and i think i have the a nice simple configuration to start with: nxlog is… --- ## [Maxmind mmdb - Logstash geoip](https://discuss.elastic.co/t/maxmind-mmdb-logstash-geoip/27564)
**Author:** [@gugansankar](https://discuss.elastic.co/u/gugansankar)\ **Replies:** 3\ **Last updated:** [September 22, 2015, 8:15am UTC](https://discuss.elastic.co/t/maxmind-mmdb-logstash-geoip/27564 "2015-09-22T08:15:33Z")
Hi, Is it possible to mention mmdb in logstash geoip section and also Does logstash support mmdb as like below configuration ?. geoip { source =\> "clientip" target =\> "geoip" database =\>"/tmp/geoip.mmdb… --- ## [Logstash - Elastic search term aggregation doesn't work with string "-"](https://discuss.elastic.co/t/logstash-elastic-search-term-aggregation-doesnt-work-with-string/29749)
**Author:** [@nav](https://discuss.elastic.co/u/nav)\ **Replies:** 2\ **Last updated:** [September 22, 2015, 7:52am UTC](https://discuss.elastic.co/t/logstash-elastic-search-term-aggregation-doesnt-work-with-string/29749 "2015-09-22T07:52:28Z")
I am sending http access log to my logstash server, each log has a "path" field which means the URL path after removing hostname. Therefore, "path" can be any string. When it is empty, its value is set to "-". However, u… --- ## [Logstash will not re-create the index with similar conf and log file after it was deleted](https://discuss.elastic.co/t/logstash-will-not-re-create-the-index-with-similar-conf-and-log-file-after-it-was-deleted/29669)
**Author:** [@lkekeng](https://discuss.elastic.co/u/lkekeng)\ **Replies:** 2\ **Last updated:** [September 22, 2015, 7:42am UTC](https://discuss.elastic.co/t/logstash-will-not-re-create-the-index-with-similar-conf-and-log-file-after-it-was-deleted/29669 "2015-09-22T07:42:34Z")
Hi, Has been struggling for many days and seem couldn't figure out what happen. I am running ElasticSearch 1.7.1 with Logstash 1.5.4. my logstash conf file named "logstash-apache" is stored in the path c:\\users\\studen… --- ## [Logstash as security monitoring/reporting tool](https://discuss.elastic.co/t/logstash-as-security-monitoring-reporting-tool/29704)
**Author:** [@felix1](https://discuss.elastic.co/u/felix1)\ **Replies:** 1\ **Last updated:** [September 22, 2015, 7:35am UTC](https://discuss.elastic.co/t/logstash-as-security-monitoring-reporting-tool/29704 "2015-09-22T07:35:19Z")
Hi, we recently deployed the elastic-search/logstash/kibana stack in our infrastructure. Very nice. Now we're wondering wether we could use this information to get out some basic security reporting. We're looking f… --- ## [Sending EXCEL data to Logstash & Kibana - EMC Data Storage - Chat Analysis Project](https://discuss.elastic.co/t/sending-excel-data-to-logstash-kibana-emc-data-storage-chat-analysis-project/29745)
**Author:** [@strikingraghu](https://discuss.elastic.co/u/strikingraghu)\ **Replies:** 5\ **Last updated:** [September 22, 2015, 7:27am UTC](https://discuss.elastic.co/t/sending-excel-data-to-logstash-kibana-emc-data-storage-chat-analysis-project/29745 "2015-09-22T07:27:42Z")
Hello Team, I have installed ELK stack on one of the window server. All 3 products are up and running fine! However, I need to send a simple excel file into logstash & get it displayed in Kibana. I am not sure about th… --- ## [Working of add tag in multiline](https://discuss.elastic.co/t/working-of-add-tag-in-multiline/29733)
**Author:** [@vilas](https://discuss.elastic.co/u/vilas)\ **Replies:** 1\ **Last updated:** [September 22, 2015, 5:39am UTC](https://discuss.elastic.co/t/working-of-add-tag-in-multiline/29733 "2015-09-22T05:39:49Z")
Hi, I am using Logstash 1.4.2. When we do add\_tag in multiline filter, it seems like it is not adding any tag. Following is my logstash conf: filter { grok { match =\> { "message" =\> "^Start Line.\*" } add\_fie… --- ## [Logstash Forwarder connection refused in docker container](https://discuss.elastic.co/t/logstash-forwarder-connection-refused-in-docker-container/29440)
**Author:** [@kmroz](https://discuss.elastic.co/u/kmroz)\ **Replies:** 27\ **Last updated:** [September 21, 2015, 8:30pm UTC](https://discuss.elastic.co/t/logstash-forwarder-connection-refused-in-docker-container/29440 "2015-09-21T20:30:40Z")
Hello , i seem to follow the same rules on setting up the forwarder but it seems every time i run it i get a connection refused. The IP match as the same in the logstash conf file. I have also passed along the certs to t… --- ## [Grok parse error on custom apache log file](https://discuss.elastic.co/t/grok-parse-error-on-custom-apache-log-file/29703)
**Author:** [@dlb1001](https://discuss.elastic.co/u/dlb1001)\ **Replies:** 5\ **Last updated:** [September 21, 2015, 5:26pm UTC](https://discuss.elastic.co/t/grok-parse-error-on-custom-apache-log-file/29703 "2015-09-21T17:26:32Z")
Hello, I'm trying to set up a filter for a custom apache log. The log entry has two different types of lines, as below: www.bbb.aaa.mil 33.44.112.28 - - \[13/Sep/2015:04:02:37 -0400\] "HEAD /www/default.htm HTTP/1.… --- ## [Remove a value in grok filter](https://discuss.elastic.co/t/remove-a-value-in-grok-filter/26943)
**Author:** [@Bharath\_Paruchuri](https://discuss.elastic.co/u/Bharath_Paruchuri)\ **Replies:** 8\ **Last updated:** [September 21, 2015, 1:18pm UTC](https://discuss.elastic.co/t/remove-a-value-in-grok-filter/26943 "2015-09-21T13:18:47Z")
Hi All, I have Prepared Logstash configuration code filter { multiline { pattern =\> "^####" negate =\> true what =\> "previous" } grok { pattern =\> \["####\<%{DATA:Timestamp}\> \<%{WORD:Severity}\> %{GR… --- ## [Small help with gsub](https://discuss.elastic.co/t/small-help-with-gsub/29693)
**Author:** [@Erik\_Parienty](https://discuss.elastic.co/u/Erik_Parienty)\ **Replies:** 3\ **Last updated:** [September 21, 2015, 11:16am UTC](https://discuss.elastic.co/t/small-help-with-gsub/29693 "2015-09-21T11:16:19Z")
I have this string: (dont ask \[:smile:\] ) "{\\"InternalMessageQueueSize\\":5,\\"ExceptionsNumber\\":300}" i like to change it with gsub to this: {\\"InternalMessageQueueSize\\":5\\,"ExceptionsNumber\\":300} can you help … --- ## [How logstash comes out after processing log files?](https://discuss.elastic.co/t/how-logstash-comes-out-after-processing-log-files/29689)
**Author:** [@Saket\_Kumar](https://discuss.elastic.co/u/Saket_Kumar)\ **Replies:** 1\ **Last updated:** [September 21, 2015, 10:05am UTC](https://discuss.elastic.co/t/how-logstash-comes-out-after-processing-log-files/29689 "2015-09-21T10:05:28Z")
How logstash comes back to command prompt after processing all the log files( Cntrl + C )? I have to process log once its not going to increase once processed. How would i know that the processing of file is completed an… --- ## [Error: string not matched](https://discuss.elastic.co/t/error-string-not-matched/29651)
**Author:** [@Erik\_Parienty](https://discuss.elastic.co/u/Erik_Parienty)\ **Replies:** 12\ **Last updated:** [September 21, 2015, 8:08am UTC](https://discuss.elastic.co/t/error-string-not-matched/29651 "2015-09-21T08:08:54Z")
Hi all i have an error i cant understand i have rabbitmq with a messege like this {"InternalMessageQueueSize":5,"ExceptionsNumber":300} i like to take it with logstash my input is : input { rabbitmq… --- ## [Syslog Configuration on logstash pfSense](https://discuss.elastic.co/t/syslog-configuration-on-logstash-pfsense/28312)
**Author:** [@killmasta93](https://discuss.elastic.co/u/killmasta93)\ **Replies:** 3\ **Last updated:** [September 20, 2015, 10:43pm UTC](https://discuss.elastic.co/t/syslog-configuration-on-logstash-pfsense/28312 "2015-09-20T22:43:28Z")
Hi, I was wondering if someone could help me out or guide me. So I got everything up and running my only issue that when im trying to filter my syslog dashboard (the system logs of pfSense) it shows nothing while on my… --- ## [Replace Field Values - Type Conversion](https://discuss.elastic.co/t/replace-field-values-type-conversion/29659)
**Author:** [@coderlol](https://discuss.elastic.co/u/coderlol)\ **Replies:** 1\ **Last updated:** [September 20, 2015, 3:20pm UTC](https://discuss.elastic.co/t/replace-field-values-type-conversion/29659 "2015-09-20T15:20:30Z")
Considering this event: {"@version":"1","@timestamp":"2015-09-20T06:45:03.613Z","contextMap":{"sourceline":"500"},"source":{"class":"myClass","method":"myMethod","file":"myFile.java","line":100}} \[source\]\[line\] is an… --- ## [Can I set maximum backlog retention?](https://discuss.elastic.co/t/can-i-set-maximum-backlog-retention/29609)
**Author:** [@Sam\_Saffron](https://discuss.elastic.co/u/Sam_Saffron)\ **Replies:** 4\ **Last updated:** [September 20, 2015, 4:28am UTC](https://discuss.elastic.co/t/can-i-set-maximum-backlog-retention/29609 "2015-09-20T04:28:37Z")
Is there a way to configure logstash forwarder so it only retains say 5 minutes of logs if it is unable to transmit stuff to logstash? (cause it is stopped or what not) --- ## [Logstash 2.0 rabbitmq input](https://discuss.elastic.co/t/logstash-2-0-rabbitmq-input/29644)
**Author:** [@Janet](https://discuss.elastic.co/u/Janet)\ **Replies:** 1\ **Last updated:** [September 19, 2015, 10:58pm UTC](https://discuss.elastic.co/t/logstash-2-0-rabbitmq-input/29644 "2015-09-19T22:58:47Z")
I'm facing a problem with Rabbit MQ input on 2.0 beta1, that I don't see on 1.x I have 8 inputs that look like the one below. Logstash will use them fine, grabbing from each of 8 queues, but then after a random amount… --- ## [New json filter crashing logstash](https://discuss.elastic.co/t/new-json-filter-crashing-logstash/2014)
**Author:** [@Melpheos](https://discuss.elastic.co/u/Melpheos)\ **Replies:** 7\ **Last updated:** [September 19, 2015, 2:02pm UTC](https://discuss.elastic.co/t/new-json-filter-crashing-logstash/2014 "2015-09-19T14:02:32Z")
We are filtering sflow data with logstash with the following filter filter { json { source =\> "message" type =\> "json" } } Which works fine. However, it seems it's deprecated. But if we use the supported 1.5 json… --- ## [Error parsing JSON doc](https://discuss.elastic.co/t/error-parsing-json-doc/29598)
**Author:** [@FrankC](https://discuss.elastic.co/u/FrankC)\ **Replies:** 3\ **Last updated:** [September 19, 2015, 9:43am UTC](https://discuss.elastic.co/t/error-parsing-json-doc/29598 "2015-09-19T09:43:00Z")
Testing for the first time loading a json document with logstash. I am have logstash 1.5.1 and elastic 1.6.0. I get the error below. Any help is much appreciated. Thanks in advance for taking a look. json document: {… --- ## [How to Install Logstash and Logstash Forwarder](https://discuss.elastic.co/t/how-to-install-logstash-and-logstash-forwarder/29621)
**Author:** [@kartheek91](https://discuss.elastic.co/u/kartheek91)\ **Replies:** 1\ **Last updated:** [September 19, 2015, 6:14am UTC](https://discuss.elastic.co/t/how-to-install-logstash-and-logstash-forwarder/29621 "2015-09-19T06:14:25Z")
May I know the details regarding the installation of Logtash and Logstash-forwarder in ubuntu 14.04 Thanks in Advance, Kartheek Gummaluri --- ## [GEO data still needs to use default template?](https://discuss.elastic.co/t/geo-data-still-needs-to-use-default-template/29554)
**Author:** [@gabrielhao](https://discuss.elastic.co/u/gabrielhao)\ **Replies:** 1\ **Last updated:** [September 19, 2015, 1:37am UTC](https://discuss.elastic.co/t/geo-data-still-needs-to-use-default-template/29554 "2015-09-19T01:37:43Z")
When I tried to convert IP to geo info, still have error on geo\_point. Then I found this: I want to ask if this will be fixed or keep it like old way(use logstash-\* index). --- ## [Logstash + shield giving authentication error \[401\]](https://discuss.elastic.co/t/logstash-shield-giving-authentication-error-401/29453)
**Author:** [@codinguari](https://discuss.elastic.co/u/codinguari)\ **Replies:** 1\ **Last updated:** [September 19, 2015, 1:10am UTC](https://discuss.elastic.co/t/logstash-shield-giving-authentication-error-401/29453 "2015-09-19T01:10:55Z")
I'm getting the following error while trying to output data to elasticsearch from logstash: Failed to install template: \[401\] {"error":"AuthenticationException\[unable to authenticate user \[es\_admin\] for REST request \[/\_… --- ## [Logstash+Kafka charset issue](https://discuss.elastic.co/t/logstash-kafka-charset-issue/29585)
**Author:** [@ophelan](https://discuss.elastic.co/u/ophelan)\ **Replies:** 0\ **Last updated:** [September 18, 2015, 6:38pm UTC](https://discuss.elastic.co/t/logstash-kafka-charset-issue/29585 "2015-09-18T18:38:05Z")
I'm sending JSON formatted logs from logstash -\> HTTP endpoint -\> Kafka -\> logstash -\> ElasticSearch. The logs appear to be formatted correctly until ingested by the second logstash process. I've checked with another kaf… --- ## [Logstash-kafka plugin](https://discuss.elastic.co/t/logstash-kafka-plugin/29539)
**Author:** [@ishantt](https://discuss.elastic.co/u/ishantt)\ **Replies:** 2\ **Last updated:** [September 18, 2015, 3:07pm UTC](https://discuss.elastic.co/t/logstash-kafka-plugin/29539 "2015-09-18T15:07:14Z")
Greetings Everyone, I am a very raw user of logstash and in much a phase of learning it, however I am facing a very curious case in logstash-kafka setup. when I try to send the traffic fr… --- ## [How to add a field/value from a previuos log](https://discuss.elastic.co/t/how-to-add-a-field-value-from-a-previuos-log/29423)
**Author:** [@danygor](https://discuss.elastic.co/u/danygor)\ **Replies:** 1\ **Last updated:** [September 18, 2015, 10:53am UTC](https://discuss.elastic.co/t/how-to-add-a-field-value-from-a-previuos-log/29423 "2015-09-18T10:53:44Z")
Hi all, I am using ELK to store and search logs and I need some sort of aggregation over logs that are somehow correlated. My use case is as follows: Log #1 contains field A and field B Log #2 contains field B and f… --- ## [Problem in xpath when having namespaces](https://discuss.elastic.co/t/problem-in-xpath-when-having-namespaces/29543)
**Author:** [@Navneet\_Mathpal](https://discuss.elastic.co/u/Navneet_Mathpal)\ **Replies:** 1\ **Last updated:** [September 18, 2015, 9:14am UTC](https://discuss.elastic.co/t/problem-in-xpath-when-having-namespaces/29543 "2015-09-18T09:14:17Z")
Hi , I am facing some problem when trying to extract the information , without namespaces its working fine , But when using the actual namespces it is not able to extract the information .. I have copied the xml examp… --- ## [JNA not found & failed to install template](https://discuss.elastic.co/t/jna-not-found-failed-to-install-template/28176)
**Author:** [@TramsWang](https://discuss.elastic.co/u/TramsWang)\ **Replies:** 3\ **Last updated:** [September 18, 2015, 2:16am UTC](https://discuss.elastic.co/t/jna-not-found-failed-to-install-template/28176 "2015-09-18T02:16:00Z")
Hello everyone, I'm new to logstash and I'm learning to write configuration files. As the example goes: input { stdin { } } filter { grok { match =\> { "message" =\> "%{COMBINEDAPACHELOG}" } } date { matc… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1234) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1236)