# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1243 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1244 --- ## [Logstash.conf for Docker, Logspout, journal, syslog?](https://discuss.elastic.co/t/logstash-conf-for-docker-logspout-journal-syslog/23874)
**Author:** [@cgswong](https://discuss.elastic.co/u/cgswong)\ **Replies:** 1\ **Last updated:** [August 20, 2015, 5:47pm UTC](https://discuss.elastic.co/t/logstash-conf-for-docker-logspout-journal-syslog/23874 "2015-08-20T17:47:17Z")
I'm creating a logstash.conf file to filter input from Docker logs, Logspout, CoreOS systemd journal and syslog and was hoping if anyone could share their validated logstash.conf file which does any of these please? I … --- ## [Randomly getting \_grokparsefailure error](https://discuss.elastic.co/t/randomly-getting--grokparsefailure-error/27413)
**Author:** [@Milind\_Gode](https://discuss.elastic.co/u/Milind_Gode)\ **Replies:** 2\ **Last updated:** [August 20, 2015, 2:36pm UTC](https://discuss.elastic.co/t/randomly-getting--grokparsefailure-error/27413 "2015-08-20T14:36:08Z")
I am using syslog plugin to get logs from remote servers. When I parse these logs using 'stdin' or 'file' plugin everything works fine. But when the same logs are provided to logstash through 'syslog' plugins sometime f… --- ## [Skip header line in CSV input (v 1.5.0)](https://discuss.elastic.co/t/skip-header-line-in-csv-input-v-1-5-0/1386)
**Author:** [@whittssg](https://discuss.elastic.co/u/whittssg)\ **Replies:** 7\ **Last updated:** [August 20, 2015, 1:01pm UTC](https://discuss.elastic.co/t/skip-header-line-in-csv-input-v-1-5-0/1386 "2015-08-20T13:01:43Z")
Hello, I am importing some csv files and would like to skip the first line (headers) - at the moment if the csv has headers the lines will fail to import - if i remove the headers they import fine. I did some searching… --- ## [Logstash filter from Logstash-forwarder](https://discuss.elastic.co/t/logstash-filter-from-logstash-forwarder/27757)
**Author:** [@MiCR9](https://discuss.elastic.co/u/MiCR9)\ **Replies:** 2\ **Last updated:** [August 20, 2015, 12:36pm UTC](https://discuss.elastic.co/t/logstash-filter-from-logstash-forwarder/27757 "2015-08-20T12:36:07Z")
I am trying to get my logs work right however cannot work out what I am going wrong. filter{ grok{ match =\> \[ "message", "%{TIMESTAMP\_ISO8601:timestamp}% %{LOGLEVEL:loglevel}% %{GREEDYDATA:message}" \] overwrite =\> … --- ## [How to urldecode %uXXXX type of strings?](https://discuss.elastic.co/t/how-to-urldecode-uxxxx-type-of-strings/27718)
**Author:** [@foresightyj](https://discuss.elastic.co/u/foresightyj)\ **Replies:** 2\ **Last updated:** [August 20, 2015, 5:26am UTC](https://discuss.elastic.co/t/how-to-urldecode-uxxxx-type-of-strings/27718 "2015-08-20T05:26:13Z")
I needed a javascript equivalent of unescape in logstash. I know %uXXXX is not standard but this is still quite common. A lot of our users' browsers send urls in this format. I am reserving the use of ruby filter in logs… --- ## [Which folders should be excluded in case of any Endpoint protection client?](https://discuss.elastic.co/t/which-folders-should-be-excluded-in-case-of-any-endpoint-protection-client/27724)
**Author:** [@thyfere](https://discuss.elastic.co/u/thyfere)\ **Replies:** 0\ **Last updated:** [August 20, 2015, 5:23am UTC](https://discuss.elastic.co/t/which-folders-should-be-excluded-in-case-of-any-endpoint-protection-client/27724 "2015-08-20T05:23:46Z")
Hi, If I want to install any antivirus/malware EndPoint protection client on any of my ELK stack windows servers, which folders should I exclude? I am using two Windows Server 2012 R2 servers. One is for Logstash and… --- ## [Changing logstash.conf best practice?](https://discuss.elastic.co/t/changing-logstash-conf-best-practice/27710)
**Author:** [@russK](https://discuss.elastic.co/u/russK)\ **Replies:** 1\ **Last updated:** [August 20, 2015, 3:53am UTC](https://discuss.elastic.co/t/changing-logstash-conf-best-practice/27710 "2015-08-20T03:53:49Z")
When you have a new version of the logstash.conf file, and the current system is running in a 'production' environment; what is the best method to replace the .conf file on logstash while minimizing data loss and downtim… --- ## [Upgrading logstash 1.4.1 to logstash 1.5.3](https://discuss.elastic.co/t/upgrading-logstash-1-4-1-to-logstash-1-5-3/27708)
**Author:** [@imtiyazlogstash](https://discuss.elastic.co/u/imtiyazlogstash)\ **Replies:** 0\ **Last updated:** [August 19, 2015, 8:08pm UTC](https://discuss.elastic.co/t/upgrading-logstash-1-4-1-to-logstash-1-5-3/27708 "2015-08-19T20:08:15Z")
Following steps are performed for configuring logstash 1.5.3 downloaded and extract the logstash-1.5.3.tar.gz file into the installed logstash 1.4.1 folder (/opt/logstash/server) Now trying to run the below… --- ## [Disable logstash's binary log format](https://discuss.elastic.co/t/disable-logstashs-binary-log-format/27694)
**Author:** [@amaltson](https://discuss.elastic.co/u/amaltson)\ **Replies:** 2\ **Last updated:** [August 19, 2015, 6:04pm UTC](https://discuss.elastic.co/t/disable-logstashs-binary-log-format/27694 "2015-08-19T18:04:18Z")
Hello all, For some reason after a certain amount of time the logstash shipper's logs turn from text to binary. Is there any way to disable this or view the binary log format? I've found a hard time finding anything … --- ## [Logstash-kafka for multiple topics](https://discuss.elastic.co/t/logstash-kafka-for-multiple-topics/27422)
**Author:** [@gh\_amistry](https://discuss.elastic.co/u/gh_amistry)\ **Replies:** 5\ **Last updated:** [August 19, 2015, 5:25pm UTC](https://discuss.elastic.co/t/logstash-kafka-for-multiple-topics/27422 "2015-08-19T17:25:40Z")
Hi! There's been some interest in the past for logstash to support multple kafka topics as inputs. At the time, the only solution was to have one topic per input. Has there been additional progress on that? Is it possibl… --- ## [Failed to tls handshake i/o timeout](https://discuss.elastic.co/t/failed-to-tls-handshake-i-o-timeout/24475)
**Author:** [@bluethundr](https://discuss.elastic.co/u/bluethundr)\ **Replies:** 8\ **Last updated:** [August 19, 2015, 3:51pm UTC](https://discuss.elastic.co/t/failed-to-tls-handshake-i-o-timeout/24475 "2015-08-19T15:51:29Z")
Hey all, Well I was able to get logstash 1.5.1 working with elasticsearch 1.6.0 and kibana 4 sitting behind nxginx! It's a pretty sweet setup. Except for the fact that I can't seem to get logstash-forwarder to connect t… --- ## [Logstash to delete document from Elasticsearch](https://discuss.elastic.co/t/logstash-to-delete-document-from-elasticsearch/27142)
**Author:** [@umangjain](https://discuss.elastic.co/u/umangjain)\ **Replies:** 6\ **Last updated:** [August 19, 2015, 2:36pm UTC](https://discuss.elastic.co/t/logstash-to-delete-document-from-elasticsearch/27142 "2015-08-19T14:36:18Z")
I am using Logstash version 1.5.1 to parse a log file and create or update documents on Elasticsearch. In one of the cases, I am trying to delete an existing document from elasticsearch using logstash configuration file.… --- ## [Not able to execute simple logstash command mentioned in the documentation](https://discuss.elastic.co/t/not-able-to-execute-simple-logstash-command-mentioned-in-the-documentation/27655)
**Author:** [@Alok\_Kumar](https://discuss.elastic.co/u/Alok_Kumar)\ **Replies:** 0\ **Last updated:** [August 19, 2015, 9:34am UTC](https://discuss.elastic.co/t/not-able-to-execute-simple-logstash-command-mentioned-in-the-documentation/27655 "2015-08-19T09:34:42Z")
Hi, i am new to Logstash and while trying examples mentioned in the documentation, for learning purpose both Logstash1.5.3 and Elasticsearch 1.7.1 are on same machine. I am getting below warning and issue. Command use… --- ## [Not analyzing string data](https://discuss.elastic.co/t/not-analyzing-string-data/27574)
**Author:** [@Tibo](https://discuss.elastic.co/u/Tibo)\ **Replies:** 2\ **Last updated:** [August 19, 2015, 9:30am UTC](https://discuss.elastic.co/t/not-analyzing-string-data/27574 "2015-08-19T09:30:01Z")
Hi, I'm having an issue with elasticsearch splitting words from my "request" field. I have found some clues about analyzed and not\_analyze field that would do what I want : searching my whole sentence. So when I get my… --- ## [Logstash 404 errors when dealing with UPDATES after INSERTS](https://discuss.elastic.co/t/logstash-404-errors-when-dealing-with-updates-after-inserts/27608)
**Author:** [@crickeys](https://discuss.elastic.co/u/crickeys)\ **Replies:** 4\ **Last updated:** [August 19, 2015, 4:28am UTC](https://discuss.elastic.co/t/logstash-404-errors-when-dealing-with-updates-after-inserts/27608 "2015-08-19T04:28:12Z")
I have a logstash config like this: input { file { path =\> \["/home/csdata/\*.data"\] codec =\> json { } start\_position =\> "beginning" discover\_interval =\> 5 } } output{ if \[\_up\] == 1 { elasticsea… --- ## [Logstash (Center) connection refused (solved)](https://discuss.elastic.co/t/logstash-center-connection-refused-solved/27557)
**Author:** [@Jason\_Zheng](https://discuss.elastic.co/u/Jason_Zheng)\ **Replies:** 4\ **Last updated:** [August 19, 2015, 1:26am UTC](https://discuss.elastic.co/t/logstash-center-connection-refused-solved/27557 "2015-08-19T01:26:15Z")
Hi All, My logstash conf (center) setting as following, is it incorrect? input { redis { host =\> "redis" port =\> 6379 type =\> "redis-input" data… --- ## [Logstashforwarder on Windows -No exectutable after building with go](https://discuss.elastic.co/t/logstashforwarder-on-windows-no-exectutable-after-building-with-go/27599)
**Author:** [@DavidL](https://discuss.elastic.co/u/DavidL)\ **Replies:** 2\ **Last updated:** [August 18, 2015, 5:21pm UTC](https://discuss.elastic.co/t/logstashforwarder-on-windows-no-exectutable-after-building-with-go/27599 "2015-08-18T17:21:14Z")
I downloaded the windows version of logstash forwarder, and downloaded "go" after running the command "go build -o logstash-forwarder", I was expecting a executable file but could not see one, I have seen seen people sa… --- ## [Adding intentional delay in pulling Log Entries](https://discuss.elastic.co/t/adding-intentional-delay-in-pulling-log-entries/27563)
**Author:** [@rameeelastic](https://discuss.elastic.co/u/rameeelastic)\ **Replies:** 3\ **Last updated:** [August 18, 2015, 11:37am UTC](https://discuss.elastic.co/t/adding-intentional-delay-in-pulling-log-entries/27563 "2015-08-18T11:37:24Z")
Hi All We have a very old server that runs Java based web applications developed using ATG framework. I need to do some monitoring on this server using the webserver logs (Apache) , the system administrators have come … --- ## [Log rotations](https://discuss.elastic.co/t/log-rotations/27571)
**Author:** [@Mark\_van\_Rossum](https://discuss.elastic.co/u/Mark_van_Rossum)\ **Replies:** 1\ **Last updated:** [August 18, 2015, 11:32am UTC](https://discuss.elastic.co/t/log-rotations/27571 "2015-08-18T11:32:26Z")
I'm using logstash-forwarder 0.4, and have issues with it detecting spurious log rotations which is preventing it from importing some files, e.g. 2015/08/16 00:00:02.585975 File rename was detected: /usr/local/appinf/c… --- ## [ELK state management!](https://discuss.elastic.co/t/elk-state-management/27545)
**Author:** [@sreeram](https://discuss.elastic.co/u/sreeram)\ **Replies:** 5\ **Last updated:** [August 18, 2015, 8:32am UTC](https://discuss.elastic.co/t/elk-state-management/27545 "2015-08-18T08:32:18Z")
Hi, I'm new to ELK, need clarifications on what is the purpose of logstash-forwarder when logstash itself can ship files ? I have a Usecase where my system might get restarted at times(killing all services abruptly)… --- ## [Multiple output to elasticsearch?](https://discuss.elastic.co/t/multiple-output-to-elasticsearch/27477)
**Author:** [@Jason\_Zheng](https://discuss.elastic.co/u/Jason_Zheng)\ **Replies:** 4\ **Last updated:** [August 17, 2015, 8:16am UTC](https://discuss.elastic.co/t/multiple-output-to-elasticsearch/27477 "2015-08-17T08:16:17Z")
Hi All, I would like to do multiple output to elasticsearch by logstash conf, but the following syntax of logstash conf seems incorrect I check redis (redis-cli monitor) received two keys miki and miki2, and sent it … --- ## [\_grokparse failure, but it's working](https://discuss.elastic.co/t/-grokparse-failure-but-its-working/27533)
**Author:** [@Jack\_Judge](https://discuss.elastic.co/u/Jack_Judge)\ **Replies:** 1\ **Last updated:** [August 18, 2015, 5:45am UTC](https://discuss.elastic.co/t/-grokparse-failure-but-its-working/27533 "2015-08-18T05:45:05Z")
I'm getting a weird grokparse failure everything seems to be working, it's a bit of a puzzler. I'm running logstash 1.5.0-1 This is a sample log message; \ Workbook references the 'today' fun… --- ## [Gsub for numbers?](https://discuss.elastic.co/t/gsub-for-numbers/27436)
**Author:** [@jclose](https://discuss.elastic.co/u/jclose)\ **Replies:** 7\ **Last updated:** [August 18, 2015, 12:14am UTC](https://discuss.elastic.co/t/gsub-for-numbers/27436 "2015-08-18T00:14:22Z")
This is a take on a previous topic I posted. I have values coming across the wire that are meant to go into integer/double/float... values in Elastic, but they are coming cross as string values. Within logstash, I ne… --- ## [Init scripts defaults](https://discuss.elastic.co/t/init-scripts-defaults/27528)
**Author:** [@Erwin](https://discuss.elastic.co/u/Erwin)\ **Replies:** 1\ **Last updated:** [August 17, 2015, 10:23pm UTC](https://discuss.elastic.co/t/init-scripts-defaults/27528 "2015-08-17T22:23:11Z")
I just installed Elastic and Logstash on Debian via the repositories given via the site https://www.elastic.co/guide/en/logstash/current/package-repositories.html Now i noticed that the the scripts: - /etc/init.d/logstas… --- ## [Logstash can't run as non-privileged user logstash](https://discuss.elastic.co/t/logstash-cant-run-as-non-privileged-user-logstash/27535)
**Author:** [@bdunbar](https://discuss.elastic.co/u/bdunbar)\ **Replies:** 2\ **Last updated:** [August 17, 2015, 9:04pm UTC](https://discuss.elastic.co/t/logstash-cant-run-as-non-privileged-user-logstash/27535 "2015-08-17T21:04:43Z")
Ubuntu 12.04 Logstash 1.5.3 Logstash launches, but does not forward log files as user 'logstash'. It can (I know, I know, this is Wrong Of Me) as user root. I am confused. (I will add that I've spent most of the la… --- ## [Log monitoring on Catalina.out](https://discuss.elastic.co/t/log-monitoring-on-catalina-out/27225)
**Author:** [@krishna748](https://discuss.elastic.co/u/krishna748)\ **Replies:** 7\ **Last updated:** [August 17, 2015, 7:22pm UTC](https://discuss.elastic.co/t/log-monitoring-on-catalina-out/27225 "2015-08-17T19:22:46Z")
Hi Team, I am trying to pull the log information from tomcat catalina.out log file but I dont see any log information from catalina.out or error messages etc. Can you please help me to proceed further on this. With… --- ## [Logstash Broker hangs after upgrade to 1.5.3](https://discuss.elastic.co/t/logstash-broker-hangs-after-upgrade-to-1-5-3/27534)
**Author:** [@Igor\_Zeiger](https://discuss.elastic.co/u/Igor_Zeiger)\ **Replies:** 0\ **Last updated:** [August 17, 2015, 7:09pm UTC](https://discuss.elastic.co/t/logstash-broker-hangs-after-upgrade-to-1-5-3/27534 "2015-08-17T19:09:32Z")
We have 2 clusters in which we've upgraded logstash to version 1.5.3 and since then logstash broker, which put data to redis, hangs every 4-5 hours. The process is still in memory, no errors are shown in log file, but th… --- ## [Logstash with zabbix output ISSUE](https://discuss.elastic.co/t/logstash-with-zabbix-output-issue/1434)
**Author:** [@Cenzoooo](https://discuss.elastic.co/u/Cenzoooo)\ **Replies:** 27\ **Last updated:** [August 17, 2015, 3:50pm UTC](https://discuss.elastic.co/t/logstash-with-zabbix-output-issue/1434 "2015-08-17T15:50:49Z")
Hello! I have problem, my zabbix output just don't work and i can't find reason why. For example, i've created simple logstash conf file: input { tcp { port =\> 6000 type =\> syslog } udp { port =\> 6… --- ## [Problems getting started w/ log stash and elasticsearch](https://discuss.elastic.co/t/problems-getting-started-w-log-stash-and-elasticsearch/797)
**Author:** [@jcc](https://discuss.elastic.co/u/jcc)\ **Replies:** 11\ **Last updated:** [August 17, 2015, 3:00pm UTC](https://discuss.elastic.co/t/problems-getting-started-w-log-stash-and-elasticsearch/797 "2015-08-17T15:00:45Z")
Hello, I just installed elasticsearch and logstash on a Mac (Java 1.7). Elasticsearch seems to be running as expected and while logstash works with the simplest examples, it fails when I try to connect it to elastic se… --- ## [Reading compressed files with Logstash](https://discuss.elastic.co/t/reading-compressed-files-with-logstash/27508)
**Author:** [@simonrisberg](https://discuss.elastic.co/u/simonrisberg)\ **Replies:** 1\ **Last updated:** [August 17, 2015, 2:12pm UTC](https://discuss.elastic.co/t/reading-compressed-files-with-logstash/27508 "2015-08-17T14:12:43Z")
Hello! I'm wondering if it's possible in anyway to read compressed files with logstash. Because the log files I'm trying to read are about 24GB per file. This takes up to much space. Best regards! [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1242) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1244)