# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1247 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1248 --- ## [Input-jdbc: cannot load OracleDriver](https://discuss.elastic.co/t/input-jdbc-cannot-load-oracledriver/26800)
**Author:** [@ticl](https://discuss.elastic.co/u/ticl)\ **Replies:** 2\ **Last updated:** [August 4, 2015, 3:20pm UTC](https://discuss.elastic.co/t/input-jdbc-cannot-load-oracledriver/26800 "2015-08-04T15:20:06Z")
I am trying out the input-jdbc plugin with Oracle ojdbc6.jar. However I am getting following error: Error: oracle.jdbc.driver.OracleDriver not loaded. Are you sure you've included the correct jdbc driver in :jdbc\_drive… --- ## [JDBC Error (CLOSED)](https://discuss.elastic.co/t/jdbc-error-closed/26804)
**Author:** [@michaellizhou](https://discuss.elastic.co/u/michaellizhou)\ **Replies:** 0\ **Last updated:** [August 4, 2015, 2:36pm UTC](https://discuss.elastic.co/t/jdbc-error-closed/26804 "2015-08-04T14:36:41Z")
Has anyone seen this before. Error: oracle.jdbc.OracleDriver not loaded. Are you sure you've included the correct jdbc driver in :jdbc\_driver\_library? The river worked fine with me but I want to use the plugin now si… --- ## [Logstash 1.5.3 new unnamed thread](https://discuss.elastic.co/t/logstash-1-5-3-new-unnamed-thread/26808)
**Author:** [@L8apex32](https://discuss.elastic.co/u/L8apex32)\ **Replies:** 0\ **Last updated:** [August 4, 2015, 2:57pm UTC](https://discuss.elastic.co/t/logstash-1-5-3-new-unnamed-thread/26808 "2015-08-04T14:57:12Z")
We upgraded to 1.5.3 and I see what I think is a new Logstash thread. This thread is not named, it just shows as "java" in top with threads turned on. This process takes a lot of CPU time... usually worker threads take… --- ## [Index ASA logs](https://discuss.elastic.co/t/index-asa-logs/26515)
**Author:** [@pankaj](https://discuss.elastic.co/u/pankaj)\ **Replies:** 6\ **Last updated:** [August 4, 2015, 2:32pm UTC](https://discuss.elastic.co/t/index-asa-logs/26515 "2015-08-04T14:32:05Z")
I am trying to setup ELK for ASA logs , issue I am facing is parsing ASA logs. Any help will be appreciated. I am getting following error message "No Compatible Fields: The "logstash-\*" index pattern does not contai… --- ## [Possible to use logstash to merge data from multiple files?](https://discuss.elastic.co/t/possible-to-use-logstash-to-merge-data-from-multiple-files/26653)
**Author:** [@bmonty](https://discuss.elastic.co/u/bmonty)\ **Replies:** 2\ **Last updated:** [August 4, 2015, 12:17pm UTC](https://discuss.elastic.co/t/possible-to-use-logstash-to-merge-data-from-multiple-files/26653 "2015-08-04T12:17:17Z")
I've got two files, an xml file and a csv file. When I ingest the data from the csv file I want to add\_fields from the xml file. Here's what my xml looks like \ \07.31.2015\ \ \Jo… --- ## [Virtual Memory higher for logstash 1.5.3](https://discuss.elastic.co/t/virtual-memory-higher-for-logstash-1-5-3/26721)
**Author:** [@Kumaravel](https://discuss.elastic.co/u/Kumaravel)\ **Replies:** 3\ **Last updated:** [August 4, 2015, 10:00am UTC](https://discuss.elastic.co/t/virtual-memory-higher-for-logstash-1-5-3/26721 "2015-08-04T10:00:54Z")
I have logstash 1.5.3 running on one of the server where the process details of it are as follows: PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND 13194 logstash 39 19 2181m 233m 12m S 1.3 4.0 … --- ## [Unable to remove the field](https://discuss.elastic.co/t/unable-to-remove-the-field/26784)
**Author:** [@soujanya](https://discuss.elastic.co/u/soujanya)\ **Replies:** 1\ **Last updated:** [August 4, 2015, 9:53am UTC](https://discuss.elastic.co/t/unable-to-remove-the-field/26784 "2015-08-04T09:53:52Z")
Hi all, I'm new to the Kibana. I'm trying to remove the field based on some condition. But not getting how to do.. I've used the below code. filter { grok { break\_on\_match =\> false match =\> { "message"… --- ## [Filtering Issues with Logstash](https://discuss.elastic.co/t/filtering-issues-with-logstash/26635)
**Author:** [@Zeal\_Vora](https://discuss.elastic.co/u/Zeal_Vora)\ **Replies:** 3\ **Last updated:** [August 4, 2015, 7:35am UTC](https://discuss.elastic.co/t/filtering-issues-with-logstash/26635 "2015-08-04T07:35:53Z")
Hi I am new to ELK stack and have setup basic ELK Stack. I am using fluentd to foward logs to Logstash. Here is my basic configuration file for logstash. input { syslog { type =\> syslog port =\> 5141 } } … --- ## [Substituting Value of a Field to a Mapping from a CSV file](https://discuss.elastic.co/t/substituting-value-of-a-field-to-a-mapping-from-a-csv-file/26709)
**Author:** [@jasonct05](https://discuss.elastic.co/u/jasonct05)\ **Replies:** 3\ **Last updated:** [August 4, 2015, 4:59am UTC](https://discuss.elastic.co/t/substituting-value-of-a-field-to-a-mapping-from-a-csv-file/26709 "2015-08-04T04:59:06Z")
I have used logstash's xpath filter to parse an xml file and get a specified attribute. However, I would like to replace this value to another value based on the mapping of a separated CSV file. For example, I have us… --- ## [Logstash default template for elasticsearch output](https://discuss.elastic.co/t/logstash-default-template-for-elasticsearch-output/26526)
**Author:** [@pavan\_bkv](https://discuss.elastic.co/u/pavan_bkv)\ **Replies:** 12\ **Last updated:** [August 3, 2015, 9:38pm UTC](https://discuss.elastic.co/t/logstash-default-template-for-elasticsearch-output/26526 "2015-08-03T21:38:59Z")
So using logstash exec input (JSON response) to output to an elasticsearch cluster (using the default mapping template). Somehow even though the resultant EXEC event has a @timestamp, my mapping misses it and hence mak… --- ## [How to perform concatenation of values from the same field in multiple lines?](https://discuss.elastic.co/t/how-to-perform-concatenation-of-values-from-the-same-field-in-multiple-lines/26729)
**Author:** [@djontra](https://discuss.elastic.co/u/djontra)\ **Replies:** 0\ **Last updated:** [August 3, 2015, 3:19pm UTC](https://discuss.elastic.co/t/how-to-perform-concatenation-of-values-from-the-same-field-in-multiple-lines/26729 "2015-08-03T15:19:19Z")
Hello, This is the excerpt from the MS SharePoint log file: Timestamp Process TID Area Category EventID Level Mes… --- ## [Stop Logstash when it has finished to read a csv file](https://discuss.elastic.co/t/stop-logstash-when-it-has-finished-to-read-a-csv-file/26632)
**Author:** [@Adrian0limit](https://discuss.elastic.co/u/Adrian0limit)\ **Replies:** 2\ **Last updated:** [August 3, 2015, 12:34pm UTC](https://discuss.elastic.co/t/stop-logstash-when-it-has-finished-to-read-a-csv-file/26632 "2015-08-03T12:34:20Z")
Hi everybody, I'm using Logstash 1.5.3 and its input "file" in order to index a csv file to Elasticsearch. I want to execute logstash and when it has finished to read my file I want to properly stop Logstash. How can I… --- ## [Syslog output plugin configuration](https://discuss.elastic.co/t/syslog-output-plugin-configuration/26368)
**Author:** [@kkomv](https://discuss.elastic.co/u/kkomv)\ **Replies:** 7\ **Last updated:** [August 3, 2015, 8:33am UTC](https://discuss.elastic.co/t/syslog-output-plugin-configuration/26368 "2015-08-03T08:33:43Z")
Please help in configuring sylog output plugin I keep getting the below error while starting logstash - TypeError: can't convert nil into String + at org/jruby/RubyString.java:1172 receive at … --- ## [Prevent re-reading files from beginning](https://discuss.elastic.co/t/prevent-re-reading-files-from-beginning/25889)
**Author:** [@Mark\_van\_Rossum](https://discuss.elastic.co/u/Mark_van_Rossum)\ **Replies:** 8\ **Last updated:** [August 3, 2015, 2:23am UTC](https://discuss.elastic.co/t/prevent-re-reading-files-from-beginning/25889 "2015-08-03T02:23:54Z")
The original "lumberjack" program which we are currently using, had an option "-from-beginning" which defaulted to false. This meant when you started "lumberjack" up, it wouldn't read the entire file, but only send new … --- ## [Splitting Values in Data](https://discuss.elastic.co/t/splitting-values-in-data/26682)
**Author:** [@dray0n](https://discuss.elastic.co/u/dray0n)\ **Replies:** 11\ **Last updated:** [August 3, 2015, 1:01am UTC](https://discuss.elastic.co/t/splitting-values-in-data/26682 "2015-08-03T01:01:56Z")
I have been searching the internet for a few hours now trying to solve this question. I am currently parsing out data from Cuckoo Sandbox (automated malware analysis) which comes as a key-value pair. The issue I am runn… --- ## [Split grok pattern](https://discuss.elastic.co/t/split-grok-pattern/26535)
**Author:** [@nzbloto22](https://discuss.elastic.co/u/nzbloto22)\ **Replies:** 2\ **Last updated:** [August 3, 2015, 12:42am UTC](https://discuss.elastic.co/t/split-grok-pattern/26535 "2015-08-03T00:42:12Z")
Hey, I have just recently started using logstash and am still getting my head around it. Is it possible to run a grok filter to match a pattern then split it into two fields or get other values out of it? For examp… --- ## [HA ELK Stack lost logs](https://discuss.elastic.co/t/ha-elk-stack-lost-logs/26646)
**Author:** [@sebastianhoitz](https://discuss.elastic.co/u/sebastianhoitz)\ **Replies:** 2\ **Last updated:** [August 2, 2015, 8:04am UTC](https://discuss.elastic.co/t/ha-elk-stack-lost-logs/26646 "2015-08-02T08:04:01Z")
We are currently trying to set up a HA ELK stack for our company. Our current architecture looks like this: Logstash Forwarder -\> Logstash Shipper -\> Redis -\> Logstash Indexer -\> ES We introduced the redis queue beca… --- ## [Logstash on IBM AIX](https://discuss.elastic.co/t/logstash-on-ibm-aix/26472)
**Author:** [@bed](https://discuss.elastic.co/u/bed)\ **Replies:** 3\ **Last updated:** [August 1, 2015, 3:35pm UTC](https://discuss.elastic.co/t/logstash-on-ibm-aix/26472 "2015-08-01T15:35:26Z")
Hello, I'm trying to do my first installation of logstash on an IBM AIX 7.1 environment. I've tried to use different JRE version, from 1.7 to 1.8 but I always receive the following error: io/console not supported; tty wi… --- ## [Logstash stops exporting netflow data to elasticsearch](https://discuss.elastic.co/t/logstash-stops-exporting-netflow-data-to-elasticsearch/26604)
**Author:** [@etfeet](https://discuss.elastic.co/u/etfeet)\ **Replies:** 3\ **Last updated:** [July 31, 2015, 9:30pm UTC](https://discuss.elastic.co/t/logstash-stops-exporting-netflow-data-to-elasticsearch/26604 "2015-07-31T21:30:08Z")
We're currently using logstash to collect and filter netflow data from network devices (switches, routers, etc). However, periodically the logstash server that the netflow data is being shipped to will stop exporting to … --- ## [Regular expression problem](https://discuss.elastic.co/t/regular-expression-problem/26484)
**Author:** [@simonrisberg](https://discuss.elastic.co/u/simonrisberg)\ **Replies:** 11\ **Last updated:** [July 31, 2015, 6:07pm UTC](https://discuss.elastic.co/t/regular-expression-problem/26484 "2015-07-31T18:07:21Z")
Hi! I'm trying to make a regular expression to get out a certain word from a URIPATH that is not actually in the parh itself. So far I've actually managed to do that although when I put it into my logstash configurati… --- ## [Delete file after read](https://discuss.elastic.co/t/delete-file-after-read/26656)
**Author:** [@Win\_Wang](https://discuss.elastic.co/u/Win_Wang)\ **Replies:** 1\ **Last updated:** [July 31, 2015, 5:58pm UTC](https://discuss.elastic.co/t/delete-file-after-read/26656 "2015-07-31T17:58:58Z")
I want to delete a file once all its lines have been read. I'm using file input + split filter so I can't just delete at the end of my filters. --- ## [How to debug plugin installation](https://discuss.elastic.co/t/how-to-debug-plugin-installation/25841)
**Author:** [@ozbo](https://discuss.elastic.co/u/ozbo)\ **Replies:** 5\ **Last updated:** [July 31, 2015, 5:02pm UTC](https://discuss.elastic.co/t/how-to-debug-plugin-installation/25841 "2015-07-31T17:02:45Z")
I'm running Logstash 1.5.2 under RHEL 6.4. (I previously was running 1.4.x so this is an upgraded install) I've developed an output plugin which I have been testing by modifying the LS Gemfile and adding a path entry t… --- ## [Building a custom plugin](https://discuss.elastic.co/t/building-a-custom-plugin/26595)
**Author:** [@Win\_Wang](https://discuss.elastic.co/u/Win_Wang)\ **Replies:** 1\ **Last updated:** [July 31, 2015, 8:16am UTC](https://discuss.elastic.co/t/building-a-custom-plugin/26595 "2015-07-31T08:16:38Z")
Hi, I've gone through https://www.elastic.co/guide/en/logstash/current/\_how\_to\_write\_a\_logstash\_codec\_plugin.html and found two problems. First, when I build the gem I get the error \["git" "ls-files"\] is not a file, wh… --- ## [Logstash behavior on file name change](https://discuss.elastic.co/t/logstash-behavior-on-file-name-change/26460)
**Author:** [@zpp](https://discuss.elastic.co/u/zpp)\ **Replies:** 2\ **Last updated:** [July 31, 2015, 7:45am UTC](https://discuss.elastic.co/t/logstash-behavior-on-file-name-change/26460 "2015-07-31T07:45:06Z")
Hi, i configured logstasth to monitor a file with below config file { path =\> "/var/log/app1/xxxx.log" type =\> "app1log" } when the file reaches certain size, it'll be renamed to xxxx-01.log by the applicati… --- ## [Can we monitor IBM webSphere event logs using elasticsearch?](https://discuss.elastic.co/t/can-we-monitor-ibm-websphere-event-logs-using-elasticsearch/26543)
**Author:** [@Ashok](https://discuss.elastic.co/u/Ashok)\ **Replies:** 13\ **Last updated:** [July 31, 2015, 7:28am UTC](https://discuss.elastic.co/t/can-we-monitor-ibm-websphere-event-logs-using-elasticsearch/26543 "2015-07-31T07:28:35Z")
Hi, I want to monitor the near real time logs of IBM webSphere. How can we do with elasticsearch? --- ## [How to install logstash-input-jdbc in Off-line environment(windows)](https://discuss.elastic.co/t/how-to-install-logstash-input-jdbc-in-off-line-environment-windows/26456)
**Author:** [@kikuchan](https://discuss.elastic.co/u/kikuchan)\ **Replies:** 2\ **Last updated:** [July 31, 2015, 5:25am UTC](https://discuss.elastic.co/t/how-to-install-logstash-input-jdbc-in-off-line-environment-windows/26456 "2015-07-31T05:25:05Z")
hello. I tried to use logstash-input-jdbc using followed command :plugin install C:/local/logstash-input-jdbc-1.0.0.gem. But it is showing following error, Validating C:/local/logstash-input-jdbc-1.0.0.gem Installin… --- ## [Combine Log Lines That Share A Unique ID](https://discuss.elastic.co/t/combine-log-lines-that-share-a-unique-id/26502)
**Author:** [@cheeseandpepper](https://discuss.elastic.co/u/cheeseandpepper)\ **Replies:** 3\ **Last updated:** [July 30, 2015, 9:37pm UTC](https://discuss.elastic.co/t/combine-log-lines-that-share-a-unique-id/26502 "2015-07-30T21:37:04Z")
I've appended a unique id to the very end of every log line that tags a log message as being part of a single http request. Generally an http request has 5 log lines in my application and if there are multiple users, the… --- ## [Any way to use binding.pry in the logstash shell?](https://discuss.elastic.co/t/any-way-to-use-binding-pry-in-the-logstash-shell/26594)
**Author:** [@cheeseandpepper](https://discuss.elastic.co/u/cheeseandpepper)\ **Replies:** 1\ **Last updated:** [July 30, 2015, 9:18pm UTC](https://discuss.elastic.co/t/any-way-to-use-binding-pry-in-the-logstash-shell/26594 "2015-07-30T21:18:33Z")
I'm curious to know if anyone knows if it's possible to pause the execution of logstash with a pry binding so that I can better debug my conf file. This would greatly speed up development and allow me to understand more… --- ## [Run a self-contained install?](https://discuss.elastic.co/t/run-a-self-contained-install/26583)
**Author:** [@Bruce\_Lysik](https://discuss.elastic.co/u/Bruce_Lysik)\ **Replies:** 0\ **Last updated:** [July 30, 2015, 4:26pm UTC](https://discuss.elastic.co/t/run-a-self-contained-install/26583 "2015-07-30T16:26:11Z")
For a Heroku-like environment, how easy/hard would it be to run logstash in a self-contained manner. I would like to be able to just have a Procfile with: logstash-script -c configfile (or directory) What external de… --- ## [LS forwarder erroring out on the LS server](https://discuss.elastic.co/t/ls-forwarder-erroring-out-on-the-ls-server/25740)
**Author:** [@bluethundr](https://discuss.elastic.co/u/bluethundr)\ **Replies:** 2\ **Last updated:** [July 30, 2015, 3:55pm UTC](https://discuss.elastic.co/t/ls-forwarder-erroring-out-on-the-ls-server/25740 "2015-07-30T15:55:54Z")
Hey guys, We have logstash forwarder setup on a bunch of nodes. And initially we had results turn up in the logstash interface when you did a search. However the servers that were running forwarder stopped turning up… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1246) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1248)