# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1238 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1239 --- ## [Disable index rotation in logstash](https://discuss.elastic.co/t/disable-index-rotation-in-logstash/28988)
**Author:** [@Hayder\_Abbass](https://discuss.elastic.co/u/Hayder_Abbass)\ **Replies:** 5\ **Last updated:** [September 10, 2015, 10:03am UTC](https://discuss.elastic.co/t/disable-index-rotation-in-logstash/28988 "2015-09-10T10:03:26Z")
Hello, By default, logstash create indices in the format logstash-YYYY.MM.DD, which essentially creates one index per day. Is it possible to disable this feature and force logstash to push data to a specific index name… --- ## [Grok data type isn't working a second time](https://discuss.elastic.co/t/grok-data-type-isnt-working-a-second-time/29000)
**Author:** [@bjoern](https://discuss.elastic.co/u/bjoern)\ **Replies:** 0\ **Last updated:** [September 10, 2015, 9:13am UTC](https://discuss.elastic.co/t/grok-data-type-isnt-working-a-second-time/29000 "2015-09-10T09:13:47Z")
Hello, I got the following pattern: SERVICE %{TIMESTAMP:time} - (%{A}|%{B}) A ServiceA - .\* Length: %{INT:length:int}\\; Time: %{INT:time:int}\\;.\* B ServiceB - .\* Length: %{INT:length… --- ## [@timestamp field not matching with the Actual log field](https://discuss.elastic.co/t/timestamp-field-not-matching-with-the-actual-log-field/343)
**Author:** [@sanju1323](https://discuss.elastic.co/u/sanju1323)\ **Replies:** 20\ **Last updated:** [September 10, 2015, 6:01am UTC](https://discuss.elastic.co/t/timestamp-field-not-matching-with-the-actual-log-field/343 "2015-09-10T06:01:01Z")
Hi, I'm new to ELK, Please help me in getting out of this issue. I have logs having a "AdmitDate" field. @timestamp field is showing the date and time which I have uploaded the logs.The requirement is, @timestamp field… --- ## [Logstash 1.5.3 does not read from file](https://discuss.elastic.co/t/logstash-1-5-3-does-not-read-from-file/27135)
**Author:** [@nabbaraju](https://discuss.elastic.co/u/nabbaraju)\ **Replies:** 9\ **Last updated:** [September 10, 2015, 4:31am UTC](https://discuss.elastic.co/t/logstash-1-5-3-does-not-read-from-file/27135 "2015-09-10T04:31:52Z")
I have logstash 1.5.3 installed. I want to read from an input log and write to stdout. Here are the details: 1. sample.conf input { file { path =\> "/nfs/private/user/nabbaraj/app\_logs/ohs/aaruvmtp09/test.log" … --- ## ['exec' only once](https://discuss.elastic.co/t/exec-only-once/28945)
**Author:** [@Jonathan\_Johnson](https://discuss.elastic.co/u/Jonathan_Johnson)\ **Replies:** 1\ **Last updated:** [September 9, 2015, 5:31pm UTC](https://discuss.elastic.co/t/exec-only-once/28945 "2015-09-09T17:31:29Z")
Hi -- I'm sure this is simple but I can't figure it out. my configuration: Input: ES query Filter: cipher Output: File, exec cmd So I query Elasticsearch and want to write those events to a single local file. That p… --- ## [Change date format need help](https://discuss.elastic.co/t/change-date-format-need-help/28309)
**Author:** [@Erik\_Parienty](https://discuss.elastic.co/u/Erik_Parienty)\ **Replies:** 14\ **Last updated:** [September 9, 2015, 4:35pm UTC](https://discuss.elastic.co/t/change-date-format-need-help/28309 "2015-09-09T16:35:14Z")
i all i am new to logstash i have a input log {"message":"08/30/2015 16:17:36.442,16.003765,20.503670","@version":"1","@timestamp":"2015-08-30T13:17:46.745Z","host":"ERIKP-PC","LogDate":"08/30/2015 16:17:36.442","RamUse… --- ## [Perfmon plugin No valid counters](https://discuss.elastic.co/t/perfmon-plugin-no-valid-counters/28949)
**Author:** [@Erik\_Parienty](https://discuss.elastic.co/u/Erik_Parienty)\ **Replies:** 0\ **Last updated:** [September 9, 2015, 4:31pm UTC](https://discuss.elastic.co/t/perfmon-plugin-no-valid-counters/28949 "2015-09-09T16:31:21Z")
my perfmon is working but i found a problem with 1 counter "No valid counters" This is the counter C:\>typeperf "\\ASP.NET Applications(\*)\\Requests/Sec" "(PDH-CSV 4.0)","\\ERIKP-PC\\ASP.NET Applications(\*)\\Requests/Sec" … --- ## [Error on logstash, can't connect to elasticsearch](https://discuss.elastic.co/t/error-on-logstash-cant-connect-to-elasticsearch/28674)
**Author:** [@Aditya\_Patel](https://discuss.elastic.co/u/Aditya_Patel)\ **Replies:** 4\ **Last updated:** [September 9, 2015, 11:23am UTC](https://discuss.elastic.co/t/error-on-logstash-cant-connect-to-elasticsearch/28674 "2015-09-09T11:23:51Z")
Hi Currently I am using logstash forwarder , logstash and elasticsearch to monitor my syslogs on various machines. It was working fine but it stopped working all of sudden. I noticed my logstash had stopped working. … --- ## [High cpu usage by worker thread](https://discuss.elastic.co/t/high-cpu-usage-by-worker-thread/28810)
**Author:** [@Ashish\_Goswami](https://discuss.elastic.co/u/Ashish_Goswami)\ **Replies:** 7\ **Last updated:** [September 9, 2015, 9:58am UTC](https://discuss.elastic.co/t/high-cpu-usage-by-worker-thread/28810 "2015-09-09T09:58:28Z")
I am trying to parse some logs by logstash which is reading logs directly from a log file. While starting logstash using bin/logstash -f logstash cpu usage go high(up to 80%). After some time logstash cpu become stable.… --- ## [No such file or directory - No such directory?](https://discuss.elastic.co/t/no-such-file-or-directory-no-such-directory/28890)
**Author:** [@samfukuda](https://discuss.elastic.co/u/samfukuda)\ **Replies:** 3\ **Last updated:** [September 9, 2015, 9:03am UTC](https://discuss.elastic.co/t/no-such-file-or-directory-no-such-directory/28890 "2015-09-09T09:03:31Z")
Guys, I've faced something an ambiguous as below. logstash is telling me no such file, but it exists. would you someone point me how I could fix this out ? C:\\logstash\>bin\\logstash agent -f conf\\sample05.conf io/cons… --- ## [Configure Logstash-Forwarder to process old files](https://discuss.elastic.co/t/configure-logstash-forwarder-to-process-old-files/28847)
**Author:** [@stevedearl](https://discuss.elastic.co/u/stevedearl)\ **Replies:** 3\ **Last updated:** [September 9, 2015, 8:40am UTC](https://discuss.elastic.co/t/configure-logstash-forwarder-to-process-old-files/28847 "2015-09-09T08:40:38Z")
Hi all, I'm trying to test a Logstash-Forwarder -\> Logstash feed and it seems that Logstash-Forwarder by default skips files where the entries are older than 24 hours. I've hit this issue because the test files I hap… --- ## [Extract integer from syslog](https://discuss.elastic.co/t/extract-integer-from-syslog/28850)
**Author:** [@lwhitworth](https://discuss.elastic.co/u/lwhitworth)\ **Replies:** 2\ **Last updated:** [September 9, 2015, 7:32am UTC](https://discuss.elastic.co/t/extract-integer-from-syslog/28850 "2015-09-09T07:32:14Z")
Hi there, I have a basic syslog input/filter/output that's working fine to ship stuff to elasticsearch and onto kibana. Occasionally though there'll be a line in the syslog for a specific system like: Sep 8 16:35:0… --- ## [Logs Cascading issue with syslog and logstash multiline configuration in ELK setup](https://discuss.elastic.co/t/logs-cascading-issue-with-syslog-and-logstash-multiline-configuration-in-elk-setup/28898)
**Author:** [@sohanc](https://discuss.elastic.co/u/sohanc)\ **Replies:** 2\ **Last updated:** [September 9, 2015, 7:26am UTC](https://discuss.elastic.co/t/logs-cascading-issue-with-syslog-and-logstash-multiline-configuration-in-elk-setup/28898 "2015-09-09T07:26:00Z")
In ELK i have found that during implementation using syslog as a shipper for logs to logstash server cause couple of issues like 1. During regression mulltiple logs shipped from logs file to logstash server at same time.… --- ## [Logstash Kafka Avro Confluent Schema Registry](https://discuss.elastic.co/t/logstash-kafka-avro-confluent-schema-registry/28827)
**Author:** [@Arttii](https://discuss.elastic.co/u/Arttii)\ **Replies:** 1\ **Last updated:** [September 8, 2015, 11:59pm UTC](https://discuss.elastic.co/t/logstash-kafka-avro-confluent-schema-registry/28827 "2015-09-08T23:59:29Z")
Hi, I was wondering if anyone has any experience on using the Logstash kafka plugin, but with AVRO and as an extra has anybody tried something like this using the Serializers from the Confluent Schema Registry? Thank… --- ## [Logstash.log gets flooded?](https://discuss.elastic.co/t/logstash-log-gets-flooded/28771)
**Author:** [@mathiasa](https://discuss.elastic.co/u/mathiasa)\ **Replies:** 3\ **Last updated:** [September 8, 2015, 1:11pm UTC](https://discuss.elastic.co/t/logstash-log-gets-flooded/28771 "2015-09-08T13:11:45Z")
Hi All, Can't understand why logstash suddenly writes all input to logstash.log? Is that some new feature in logstash 1.5? My output config look like this: output { elasticsearch { host =\> "X.X.X.X" … --- ## [Logstash smtp configuration](https://discuss.elastic.co/t/logstash-smtp-configuration/28862)
**Author:** [@jalen\_wang](https://discuss.elastic.co/u/jalen_wang)\ **Replies:** 2\ **Last updated:** [September 8, 2015, 7:17pm UTC](https://discuss.elastic.co/t/logstash-smtp-configuration/28862 "2015-09-08T19:17:14Z")
Hi I want to config logstash output to email by smtp,but it always goes wrong,this is my configuration: email { to =\> "xxx@xxx.com.cn" codec =\> "plain" contenttype =\> "text/html; charset=UTF-8" options =\> … --- ## [Large XML crashes logstash with OOM](https://discuss.elastic.co/t/large-xml-crashes-logstash-with-oom/28682)
**Author:** [@asatsi](https://discuss.elastic.co/u/asatsi)\ **Replies:** 4\ **Last updated:** [September 8, 2015, 4:11pm UTC](https://discuss.elastic.co/t/large-xml-crashes-logstash-with-oom/28682 "2015-09-08T16:11:54Z")
Hi, Working on a setup with large XML files as part of the logs. The XMLs at times could be 10,20MB large. Facing issues with such large files and logstash crashing with OutOfMemory error, or entity expansion grown too… --- ## [Filter not getting applied on ganglia input in logstash](https://discuss.elastic.co/t/filter-not-getting-applied-on-ganglia-input-in-logstash/28826)
**Author:** [@dhar](https://discuss.elastic.co/u/dhar)\ **Replies:** 5\ **Last updated:** [September 8, 2015, 10:53am UTC](https://discuss.elastic.co/t/filter-not-getting-applied-on-ganglia-input-in-logstash/28826 "2015-09-08T10:53:48Z")
Continuing the discussion from Report logged in user stats in kibana: Continuing the discussion from Not able to filter certian ganglia gmond ouput using logstash: --- ## [Not able to filter certian ganglia gmond ouput using logstash](https://discuss.elastic.co/t/not-able-to-filter-certian-ganglia-gmond-ouput-using-logstash/28779)
**Author:** [@dhar](https://discuss.elastic.co/u/dhar)\ **Replies:** 11\ **Last updated:** [September 8, 2015, 9:54am UTC](https://discuss.elastic.co/t/not-able-to-filter-certian-ganglia-gmond-ouput-using-logstash/28779 "2015-09-08T09:54:11Z")
The objective of this exercise is to visualise ganglia gmond output in kibana. I am trying to filter out certian lines from ganglia gmond though logstash. If i try listening to udp port in logstash and apply the filter… --- ## [Logstash is not taking logdate as @timestamp field although it is taking the received time as @timestamp field](https://discuss.elastic.co/t/logstash-is-not-taking-logdate-as-timestamp-field-although-it-is-taking-the-received-time-as-timestamp-field/28370)
**Author:** [@Yashpal\_Singh](https://discuss.elastic.co/u/Yashpal_Singh)\ **Replies:** 4\ **Last updated:** [September 8, 2015, 9:20am UTC](https://discuss.elastic.co/t/logstash-is-not-taking-logdate-as-timestamp-field-although-it-is-taking-the-received-time-as-timestamp-field/28370 "2015-09-08T09:20:40Z")
Hi All, I am also facing the same problem Logstash is not considering my log date rather making the date at which I am forwarding the logs as @timeStamp field. I am using date { match =\> \[ "logdate", "YYYY-MM-dd HH:m… --- ## [During Logstash forwarder startup throws "Failed to tls handshake EOF" Error](https://discuss.elastic.co/t/during-logstash-forwarder-startup-throws-failed-to-tls-handshake-eof-error/28816)
**Author:** [@vino](https://discuss.elastic.co/u/vino)\ **Replies:** 6\ **Last updated:** [September 8, 2015, 9:03am UTC](https://discuss.elastic.co/t/during-logstash-forwarder-startup-throws-failed-to-tls-handshake-eof-error/28816 "2015-09-08T09:03:50Z")
I have a 7 node setup where we have 3 logstash, 3 elastic search and 1 logstash-forwarder. I have both the logstash-forwarder and load balancer (haproxy) running in the same VM. All the three logstash communicates wi… --- ## [Logstash Exceptionhandling / Catching exceptions from output plugin](https://discuss.elastic.co/t/logstash-exceptionhandling-catching-exceptions-from-output-plugin/28664)
**Author:** [@pueffl](https://discuss.elastic.co/u/pueffl)\ **Replies:** 4\ **Last updated:** [September 8, 2015, 7:46am UTC](https://discuss.elastic.co/t/logstash-exceptionhandling-catching-exceptions-from-output-plugin/28664 "2015-09-08T07:46:12Z")
Hi there! We are currently evaluating ELK and so far it looks very promising, but we found one big issu we couldn't find satisfying information so far: We want to log all our events in Elasticsearch, so when somethin… --- ## [Grok condition for two different type of files](https://discuss.elastic.co/t/grok-condition-for-two-different-type-of-files/28768)
**Author:** [@ushadatt](https://discuss.elastic.co/u/ushadatt)\ **Replies:** 5\ **Last updated:** [September 8, 2015, 6:49am UTC](https://discuss.elastic.co/t/grok-condition-for-two-different-type-of-files/28768 "2015-09-08T06:49:24Z")
Hi, I have to match two patterns to 2 different log files such that if the pattern matches with one of the errors logs encountered in the log file, it triggers the another log file to grok another pattern. How is that po… --- ## [How to parse jason in logstash](https://discuss.elastic.co/t/how-to-parse-jason-in-logstash/28691)
**Author:** [@Navneet\_Mathpal](https://discuss.elastic.co/u/Navneet_Mathpal)\ **Replies:** 7\ **Last updated:** [September 8, 2015, 6:39am UTC](https://discuss.elastic.co/t/how-to-parse-jason-in-logstash/28691 "2015-09-08T06:39:53Z")
Hi All, I am able to parse simple json file which is having one doc in one line ex: {"name":"name1",address1:"address1"} {"name2":"name2", "address2" : "address2"} but If I am having json format like below how can… --- ## [Is Date filter costly?](https://discuss.elastic.co/t/is-date-filter-costly/28775)
**Author:** [@zpp](https://discuss.elastic.co/u/zpp)\ **Replies:** 5\ **Last updated:** [September 8, 2015, 5:45am UTC](https://discuss.elastic.co/t/is-date-filter-costly/28775 "2015-09-08T05:45:58Z")
I have one log file feeding is about 1-2 mins lagging behind of current time (view from kibana). The feeding path is like this: logstash shipper -\> redis-\>logstash indexer -\> es and indexer has date filter configured as… --- ## [Multiple lumberjack input in single logstash instance](https://discuss.elastic.co/t/multiple-lumberjack-input-in-single-logstash-instance/28792)
**Author:** [@Deb](https://discuss.elastic.co/u/Deb)\ **Replies:** 2\ **Last updated:** [September 8, 2015, 3:31am UTC](https://discuss.elastic.co/t/multiple-lumberjack-input-in-single-logstash-instance/28792 "2015-09-08T03:31:12Z")
Is multiple lumberjack inputs (in different ports) supported in a single logstash instance? The config as follow:- input { # stdin { codec =\> json {} } lumberjack { port =\> 6782 codec =\> json {} ssl\_certificate … --- ## [Sending data from LS to ES - Looks like a local machine config issue](https://discuss.elastic.co/t/sending-data-from-ls-to-es-looks-like-a-local-machine-config-issue/28781)
**Author:** [@perkinsl](https://discuss.elastic.co/u/perkinsl)\ **Replies:** 2\ **Last updated:** [September 7, 2015, 2:30pm UTC](https://discuss.elastic.co/t/sending-data-from-ls-to-es-looks-like-a-local-machine-config-issue/28781 "2015-09-07T14:30:51Z")
Hi can anyone advise if there are any specific settings required on a machine to allow LS to talk to ES. I've got everything installed and they both appear to startup ok however when I run a log file through LS I get er… --- ## [Irregular spacing](https://discuss.elastic.co/t/irregular-spacing/28719)
**Author:** [@MrUnio](https://discuss.elastic.co/u/MrUnio)\ **Replies:** 3\ **Last updated:** [September 7, 2015, 12:58pm UTC](https://discuss.elastic.co/t/irregular-spacing/28719 "2015-09-07T12:58:11Z")
Hi guys! i am working on a filter and i am using grok, everything is good apart from one thing. The logs i need to design a filter have irregular spacing between particular fields, eg: log1: field1 field2 … --- ## [Want to Understand Agent Filter](https://discuss.elastic.co/t/want-to-understand-agent-filter/28749)
**Author:** [@bhutchinson](https://discuss.elastic.co/u/bhutchinson)\ **Replies:** 1\ **Last updated:** [September 6, 2015, 9:36pm UTC](https://discuss.elastic.co/t/want-to-understand-agent-filter/28749 "2015-09-06T21:36:46Z")
What is the best way to understand what fields the agent filter creates and what values are actually stored in the fields? Example Questions The agent filter creates an field named "os" and a field named "os\_name". Wh… --- ## [How to start logstash with log4j configuration](https://discuss.elastic.co/t/how-to-start-logstash-with-log4j-configuration/28745)
**Author:** [@deepak1](https://discuss.elastic.co/u/deepak1)\ **Replies:** 2\ **Last updated:** [September 6, 2015, 9:20pm UTC](https://discuss.elastic.co/t/how-to-start-logstash-with-log4j-configuration/28745 "2015-09-06T21:20:55Z")
when i am trying to start logstash with log4j configuration i am getting error my configuration:- input { log4j { mode =\> "server" host =\> "127.0.0.1" port =\> 56445 type =\> "log4j" } } output { … [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1237) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1239)