# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1240 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1241 --- ## [Error received from logstash-rss-input \[\`Error: tag \ is too much in tag \\`\]](https://discuss.elastic.co/t/error-received-from-logstash-rss-input-error-tag-link-is-too-much-in-tag-channel/28559)
**Author:** [@bryankaraffa](https://discuss.elastic.co/u/bryankaraffa)\ **Replies:** 2\ **Last updated:** [September 3, 2015, 6:18am UTC](https://discuss.elastic.co/t/error-received-from-logstash-rss-input-error-tag-link-is-too-much-in-tag-channel/28559 "2015-09-03T06:18:03Z")
Receiving an error \[Error: tag \ is too much in tag \\] when adding my simple rss input configuration: /etc/logstash/conf.d/02-rss-input.conf input { rss { url =\> "http://status.aws.amazon.com/rss/… --- ## [Order of logs with same timestamp](https://discuss.elastic.co/t/order-of-logs-with-same-timestamp/28577)
**Author:** [@JW1](https://discuss.elastic.co/u/JW1)\ **Replies:** 3\ **Last updated:** [September 3, 2015, 5:17am UTC](https://discuss.elastic.co/t/order-of-logs-with-same-timestamp/28577 "2015-09-03T05:17:06Z")
I'm using logstash to parse my application's log files. Sometimes several events happen at the same time, at least according to their timestamp. But I'd like to be able to see them in their original order in Kibana. Is t… --- ## [Want to Change a Field Name (Not a Field Value)](https://discuss.elastic.co/t/want-to-change-a-field-name-not-a-field-value/28563)
**Author:** [@bhutchinson](https://discuss.elastic.co/u/bhutchinson)\ **Replies:** 1\ **Last updated:** [September 2, 2015, 10:32pm UTC](https://discuss.elastic.co/t/want-to-change-a-field-name-not-a-field-value/28563 "2015-09-02T22:32:29Z")
The useragent filter can be used to parse an Apache Access Log File and create a field named "browser". After running the user agent filter, how do I rename the field name from "browser" to "browser-name"? I am thinkin… --- ## [\[Solved\] Does anyone have a working LSF-\>HAProxy-\>Logstash 1.5.2 indexers stack?](https://discuss.elastic.co/t/solved-does-anyone-have-a-working-lsf-haproxy-logstash-1-5-2-indexers-stack/25268)
**Author:** [@jerrac](https://discuss.elastic.co/u/jerrac)\ **Replies:** 3\ **Last updated:** [September 2, 2015, 6:05pm UTC](https://discuss.elastic.co/t/solved-does-anyone-have-a-working-lsf-haproxy-logstash-1-5-2-indexers-stack/25268 "2015-09-02T18:05:27Z")
On my production cluster, I have Logstash-Forwarder connecting to my two Logstash 1.4.2 indexers via a HAProxy load balancer. After testing an upgrade to Logstash 1.5.2 on my test cluster, I upgraded production. And ev… --- ## [DNS reverse, PTR in logstash](https://discuss.elastic.co/t/dns-reverse-ptr-in-logstash/28523)
**Author:** [@billy6](https://discuss.elastic.co/u/billy6)\ **Replies:** 1\ **Last updated:** [September 2, 2015, 2:07pm UTC](https://discuss.elastic.co/t/dns-reverse-ptr-in-logstash/28523 "2015-09-02T14:07:55Z")
Hello, I would like to obtain the host name as a string instead of the IP.(make a DNS reverse or PTR) Could it be possible? This is my configuration filter\> mutate { … --- ## [Need help to create regex in logstash](https://discuss.elastic.co/t/need-help-to-create-regex-in-logstash/28510)
**Author:** [@vikas\_gopal](https://discuss.elastic.co/u/vikas_gopal)\ **Replies:** 1\ **Last updated:** [September 2, 2015, 1:02pm UTC](https://discuss.elastic.co/t/need-help-to-create-regex-in-logstash/28510 "2015-09-02T13:02:21Z")
Hi Experts , I have data in key value format . But some data is as follows act=ACCESS GRANTED rt=1439389790799 Now when I use KV filter in logstash it gives me an output like act=ACCESS rt=1439389790799 Here I… --- ## [Restrictions on the Code block in Ruby filter](https://discuss.elastic.co/t/restrictions-on-the-code-block-in-ruby-filter/28366)
**Author:** [@rishi](https://discuss.elastic.co/u/rishi)\ **Replies:** 2\ **Last updated:** [September 2, 2015, 12:45pm UTC](https://discuss.elastic.co/t/restrictions-on-the-code-block-in-ruby-filter/28366 "2015-09-02T12:45:43Z")
The code that can be put into the ruby filter \[1\] - are there restrictions on it in any way, such as say it should be relatively simple/short? Can I put multi line ruby code in there? How do I require other gems in the c… --- ## [Logstash csv fields](https://discuss.elastic.co/t/logstash-csv-fields/28519)
**Author:** [@Suganthi\_Thangavel](https://discuss.elastic.co/u/Suganthi_Thangavel)\ **Replies:** 1\ **Last updated:** [September 2, 2015, 11:10am UTC](https://discuss.elastic.co/t/logstash-csv-fields/28519 "2015-09-02T11:10:48Z")
Hi, Howcan I escape special characters in CSV filter field names , I tries with backslash it is not working. I need column names with double quotes for few field names as below csv { columns =\> \["timeStamp","elapse… --- ## [Send json log file to logstash with logstash forwarder but see wrong log in kibana](https://discuss.elastic.co/t/send-json-log-file-to-logstash-with-logstash-forwarder-but-see-wrong-log-in-kibana/28487)
**Author:** [@soniaeli](https://discuss.elastic.co/u/soniaeli)\ **Replies:** 2\ **Last updated:** [September 2, 2015, 9:00am UTC](https://discuss.elastic.co/t/send-json-log-file-to-logstash-with-logstash-forwarder-but-see-wrong-log-in-kibana/28487 "2015-09-02T09:00:51Z")
I have an app that writes logs to a json file that named allapp.json, Each log entry is a JSON object. An example of it looks like the following: "{\\"timestamp\\":\\"2015-08-30 19:42:26.724\\",\\"MAC\_Address\\":\\"A8:7… --- ## [How to replace 'special characters' with a logstash filter](https://discuss.elastic.co/t/how-to-replace-special-characters-with-a-logstash-filter/28240)
**Author:** [@daks](https://discuss.elastic.co/u/daks)\ **Replies:** 2\ **Last updated:** [September 1, 2015, 8:46am UTC](https://discuss.elastic.co/t/how-to-replace-special-characters-with-a-logstash-filter/28240 "2015-09-01T08:46:54Z")
Hello, I use the IMAP input to retrieve some e-mail (generated by a Windows application) and I can't find how to manipulate the data to do what I want. E-mails looks like that (simplified and anonymized): Virus/mal… --- ## [Zen-disco-receive](https://discuss.elastic.co/t/zen-disco-receive/28423)
**Author:** [@zpp](https://discuss.elastic.co/u/zpp)\ **Replies:** 4\ **Last updated:** [September 2, 2015, 3:19am UTC](https://discuss.elastic.co/t/zen-disco-receive/28423 "2015-09-02T03:19:20Z")
what does below logging mean? is there a problem? xxxx is the server name Sep 01, 2015 7:07:26 PM org.elasticsearch.cluster.service.InternalClusterService$UpdateTask run INFO: \[logstash-xxxxx-2049-11632\] added {\[logsta… --- ## [Logstash 1.5.4 - lumberjack-output SSL verification error](https://discuss.elastic.co/t/logstash-1-5-4-lumberjack-output-ssl-verification-error/28397)
**Author:** [@utilitynerd](https://discuss.elastic.co/u/utilitynerd)\ **Replies:** 1\ **Last updated:** [September 2, 2015, 1:20am UTC](https://discuss.elastic.co/t/logstash-1-5-4-lumberjack-output-ssl-verification-error/28397 "2015-09-02T01:20:39Z")
I'm stuck on the following issue and could use some help. I'm attempting to send messages from one logstash instance to another via lumberjack. This worked perfectly in the past, but after updating logstash and its pl… --- ## [Self Signed SSL Key and cert between log-forwarder and logstash](https://discuss.elastic.co/t/self-signed-ssl-key-and-cert-between-log-forwarder-and-logstash/28456)
**Author:** [@vgupta](https://discuss.elastic.co/u/vgupta)\ **Replies:** 1\ **Last updated:** [September 2, 2015, 1:15am UTC](https://discuss.elastic.co/t/self-signed-ssl-key-and-cert-between-log-forwarder-and-logstash/28456 "2015-09-02T01:15:27Z")
Hi How to setup SSL Key and Cert between log-forwarder running on multiple hosts shipping logs to logstash running on multiple hosts as well? Can we use wild card certificate? We are able to set 1to1 log-forwarder/lo… --- ## [Logstash diagram?](https://discuss.elastic.co/t/logstash-diagram/28468)
**Author:** [@Stanislav\_Rudenko](https://discuss.elastic.co/u/Stanislav_Rudenko)\ **Replies:** 3\ **Last updated:** [September 1, 2015, 9:49pm UTC](https://discuss.elastic.co/t/logstash-diagram/28468 "2015-09-01T21:49:22Z")
Hey guys, I'm trying to understand relation between Logstash, Logstash client (logstash-forwarder) and other parts. When I just dived into this I was sure that logstash forwarder reports to broker (for ex. redis) dir… --- ## [Want a Logstash Filter to Parse the Agent Field in Apache Access Log Files](https://discuss.elastic.co/t/want-a-logstash-filter-to-parse-the-agent-field-in-apache-access-log-files/28387)
**Author:** [@bhutchinson](https://discuss.elastic.co/u/bhutchinson)\ **Replies:** 5\ **Last updated:** [September 1, 2015, 7:49pm UTC](https://discuss.elastic.co/t/want-a-logstash-filter-to-parse-the-agent-field-in-apache-access-log-files/28387 "2015-09-01T19:49:04Z")
Windows 7 Elasticsearch v1.7.0 Logstash v1.5.4 Kibana v4.1.1 I need help defining a filter that I can use to parse the "Agent" Field in an Apache Access Log. My Apache Access Logs are using the Combined Apache Log F… --- ## [Progress for Logstash contributions](https://discuss.elastic.co/t/progress-for-logstash-contributions/27796)
**Author:** [@magnusbaeck](https://discuss.elastic.co/u/magnusbaeck)\ **Replies:** 4\ **Last updated:** [September 1, 2015, 7:05pm UTC](https://discuss.elastic.co/t/progress-for-logstash-contributions/27796 "2015-09-01T19:05:41Z")
It seems the progress for outside pull requests to the Logstash gits is very slow. Or am I looking in the wrong place? If not, what's the plan to improve the situation? I have a laundry list of things to look into, but w… --- ## [How do I get proper mapping for haproxy grok](https://discuss.elastic.co/t/how-do-i-get-proper-mapping-for-haproxy-grok/28406)
**Author:** [@Sam\_Saffron](https://discuss.elastic.co/u/Sam_Saffron)\ **Replies:** 7\ **Last updated:** [September 1, 2015, 6:32pm UTC](https://discuss.elastic.co/t/how-do-i-get-proper-mapping-for-haproxy-grok/28406 "2015-09-01T18:32:31Z")
I have a rather simple logstash setup. Our haproxy server ships logs via lumberjack to the logstash/kibana/elastic server. The configration is pretty trivial: input { lumberjack { port =\> 5150 type =\> "logs"… --- ## [Logging Multiline events using logforwarder and log stash](https://discuss.elastic.co/t/logging-multiline-events-using-logforwarder-and-log-stash/28455)
**Author:** [@vgupta](https://discuss.elastic.co/u/vgupta)\ **Replies:** 2\ **Last updated:** [September 1, 2015, 6:01pm UTC](https://discuss.elastic.co/t/logging-multiline-events-using-logforwarder-and-log-stash/28455 "2015-09-01T18:01:19Z")
Hi I want to transfer Java logs using log forwarder on the application servers. What will be the best way to log Java exceptions as single event as log-forwarder doesn't support Multiline input codec? Can I use "… --- ## [What is a recommended healthcheck to use for Logstash?](https://discuss.elastic.co/t/what-is-a-recommended-healthcheck-to-use-for-logstash/27691)
**Author:** [@kvick](https://discuss.elastic.co/u/kvick)\ **Replies:** 4\ **Last updated:** [September 1, 2015, 3:54pm UTC](https://discuss.elastic.co/t/what-is-a-recommended-healthcheck-to-use-for-logstash/27691 "2015-09-01T15:54:13Z")
I'm in the process of upgrading from 1.4.2 to 1.5.2. In 1.4.2, I ran Logstash with the 'web' option which I could then use in my ELB healthcheck. \/logstash agent -f /etc/logstash.conf -l /\/logstas… --- ## [Logstash 1.5.4 stops updating the log](https://discuss.elastic.co/t/logstash-1-5-4-stops-updating-the-log/28320)
**Author:** [@santublr](https://discuss.elastic.co/u/santublr)\ **Replies:** 6\ **Last updated:** [September 1, 2015, 1:37pm UTC](https://discuss.elastic.co/t/logstash-1-5-4-stops-updating-the-log/28320 "2015-09-01T13:37:38Z")
Hello, I'm new to this tool and after downloading and running the log with a simple config file, the logstash stops updating elasticsearch with the below message (Flushing...) when run with --debug. Also, is there an… --- ## [ELK Machine capacity for 10000 events per sec](https://discuss.elastic.co/t/elk-machine-capacity-for-10000-events-per-sec/27818)
**Author:** [@Manjunath](https://discuss.elastic.co/u/Manjunath)\ **Replies:** 8\ **Last updated:** [September 1, 2015, 7:56am UTC](https://discuss.elastic.co/t/elk-machine-capacity-for-10000-events-per-sec/27818 "2015-09-01T07:56:47Z")
I have close to 1000 log files which produces 10000 events per sec, out of which i have to extract 1000 events per sec and parse it to elasticsearch. Currently i have a machine (bare metal) which has 32 CPU cores, 47 gi… --- ## [Timezone and logstash](https://discuss.elastic.co/t/timezone-and-logstash/25051)
**Author:** [@hellqvio](https://discuss.elastic.co/u/hellqvio)\ **Replies:** 1\ **Last updated:** [September 1, 2015, 5:01am UTC](https://discuss.elastic.co/t/timezone-and-logstash/25051 "2015-09-01T05:01:26Z")
Hi. I had a hack that worked fine until I upgraded to logstash 1.5.1 that converted UTC time to CEST. The hack that no longer works (since localtime doesn't exist) was to convert the timestamp to my servers timezone (C… --- ## [Basic Grok pattern](https://discuss.elastic.co/t/basic-grok-pattern/28050)
**Author:** [@Didier](https://discuss.elastic.co/u/Didier)\ **Replies:** 2\ **Last updated:** [September 1, 2015, 2:20am UTC](https://discuss.elastic.co/t/basic-grok-pattern/28050 "2015-09-01T02:20:13Z")
Hello, We are trying to understand how to generate basic Grok patterns. As an example, I would have a few simple lines from a Tomcat Catalina file: Aug 25, 2015 12:00:02 AM org.apache.catalina.startup.HostConfig chec… --- ## [Can we pull data from Remote URL to Logstash?](https://discuss.elastic.co/t/can-we-pull-data-from-remote-url-to-logstash/28343)
**Author:** [@kadnan](https://discuss.elastic.co/u/kadnan)\ **Replies:** 1\ **Last updated:** [August 31, 2015, 9:58am UTC](https://discuss.elastic.co/t/can-we-pull-data-from-remote-url-to-logstash/28343 "2015-08-31T09:58:57Z")
I am new to LogStash. My task is to pull CSV data directly from Remote URL to Logstash from where it could be fed into ElasticSearch for Kibana Interface. I found there are filters to read CSV file but could not find w… --- ## [Need help?](https://discuss.elastic.co/t/need-help/28301)
**Author:** [@alimarjan](https://discuss.elastic.co/u/alimarjan)\ **Replies:** 1\ **Last updated:** [August 30, 2015, 8:41pm UTC](https://discuss.elastic.co/t/need-help/28301 "2015-08-30T20:41:52Z")
Try #logstash how to use logstash plugin for coutchdb?? --- ## [Redis-logstash-elasticsearch](https://discuss.elastic.co/t/redis-logstash-elasticsearch/28307)
**Author:** [@azeiner](https://discuss.elastic.co/u/azeiner)\ **Replies:** 2\ **Last updated:** [August 30, 2015, 8:40pm UTC](https://discuss.elastic.co/t/redis-logstash-elasticsearch/28307 "2015-08-30T20:40:25Z")
hi everybody, since i'm new to elasticsearch and logstash i wanted to ask what some of you would consider as best practice to get data via logstash from redis to elasticsearch. we have a sorted timeset in redis with… --- ## [Logastash-input-plugin JMX](https://discuss.elastic.co/t/logastash-input-plugin-jmx/28302)
**Author:** [@Dario\_Pezzi](https://discuss.elastic.co/u/Dario_Pezzi)\ **Replies:** 0\ **Last updated:** [August 30, 2015, 8:04am UTC](https://discuss.elastic.co/t/logastash-input-plugin-jmx/28302 "2015-08-30T08:04:02Z")
I'm trying to use the input plugin jmx. I still receive this error: "Failed to retrieve RMIServer stub: javax.naming.NameNotFoundException: jmxrmi" Following my jmx conf for connection: "host" : "192.168.100.4",… --- ## [How To Make File Input Read Entire File Every Time?](https://discuss.elastic.co/t/how-to-make-file-input-read-entire-file-every-time/28278)
**Author:** [@TramsWang](https://discuss.elastic.co/u/TramsWang)\ **Replies:** 4\ **Last updated:** [August 30, 2015, 1:26am UTC](https://discuss.elastic.co/t/how-to-make-file-input-read-entire-file-every-time/28278 "2015-08-30T01:26:10Z")
Hello everyone. I'm now learning to use logstash. And I want to practice a little on the "file" plugin in the input stage. However as the tutorial says, it will ignore the shipped content in an old file that had already … --- ## [Github PR fix CLA error](https://discuss.elastic.co/t/github-pr-fix-cla-error/28268)
**Author:** [@zamblauskas](https://discuss.elastic.co/u/zamblauskas)\ **Replies:** 3\ **Last updated:** [August 29, 2015, 10:24pm UTC](https://discuss.elastic.co/t/github-pr-fix-cla-error/28268 "2015-08-29T22:24:27Z")
Hey fellow logstash users, I've made a PR Header line by zamblauskas · Pull Request #12 · logstash-plugins/logstash-filter-csv · GitHub , I had signed the CLA, but hadn't made my email public on Github profile, hence t… --- ## [Date filter failing to set logs time as @timestamp field](https://discuss.elastic.co/t/date-filter-failing-to-set-logs-time-as-timestamp-field/28255)
**Author:** [@EitanVes](https://discuss.elastic.co/u/EitanVes)\ **Replies:** 3\ **Last updated:** [August 29, 2015, 4:04pm UTC](https://discuss.elastic.co/t/date-filter-failing-to-set-logs-time-as-timestamp-field/28255 "2015-08-29T16:04:28Z")
Hi Guys, I have some issue with passing these time stamps from my log files through the Date filter. 13 AUG 2015 | 05:08:57 | i wrote a grok filter that generates the field "logTimeStamp" as follows: mutate{ … [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1239) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1241)