# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1248 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1249 --- ## [Getting error SyntaxError: (ruby filter code):3: syntax error, unexpected kIN logstash](https://discuss.elastic.co/t/getting-error-syntaxerror-ruby-filter-code-3-syntax-error-unexpected-kin-logstash/26567)
**Author:** [@Saket\_Kumar](https://discuss.elastic.co/u/Saket_Kumar)\ **Replies:** 4\ **Last updated:** [July 30, 2015, 2:56pm UTC](https://discuss.elastic.co/t/getting-error-syntaxerror-ruby-filter-code-3-syntax-error-unexpected-kin-logstash/26567 "2015-07-30T14:56:06Z")
I want to split string field "label" which contains hyphen e.g. "Label =SCR1-xyz\_abc-Page " I am trying to split Scenario= SCR1 Transaction =xyz\_abc Request=Page But with below config getting syntax error. Any idea … --- ## [Two or more network destinations for logstash-forwarer](https://discuss.elastic.co/t/two-or-more-network-destinations-for-logstash-forwarer/26518)
**Author:** [@alexanderm](https://discuss.elastic.co/u/alexanderm)\ **Replies:** 3\ **Last updated:** [July 30, 2015, 11:58am UTC](https://discuss.elastic.co/t/two-or-more-network-destinations-for-logstash-forwarer/26518 "2015-07-30T11:58:46Z")
I have two types of log files on my host: json formatted & plain text, and I want to send them to different logstash servers. I made 2 config files with different network options, but logstash-forwarer refuse second conf… --- ## [Logstash Filter - Possibility to exec shell commands?](https://discuss.elastic.co/t/logstash-filter-possibility-to-exec-shell-commands/26218)
**Author:** [@german23](https://discuss.elastic.co/u/german23)\ **Replies:** 4\ **Last updated:** [July 30, 2015, 10:54am UTC](https://discuss.elastic.co/t/logstash-filter-possibility-to-exec-shell-commands/26218 "2015-07-30T10:54:34Z")
Hi guys, i wanted to asked quickly if it is possible in logstash to execute a shell/bash command in the processing line of an event. Background: We wanted to add an field in our events, where an ip address get matc… --- ## [Parsing Alcatel PBX multiline log tickets](https://discuss.elastic.co/t/parsing-alcatel-pbx-multiline-log-tickets/1586)
**Author:** [@almaza](https://discuss.elastic.co/u/almaza)\ **Replies:** 1\ **Last updated:** [July 30, 2015, 8:57am UTC](https://discuss.elastic.co/t/parsing-alcatel-pbx-multiline-log-tickets/1586 "2015-07-30T08:57:09Z")
Hi, I am trying to parse call trace logs from an Alcatel PBX and could not find any examples on it being done. I found how to pick up the complete tickets using multiline. The messages vary, all messages have a heade… --- ## [Logstash and databse](https://discuss.elastic.co/t/logstash-and-databse/26225)
**Author:** [@Anmol\_Gupta](https://discuss.elastic.co/u/Anmol_Gupta)\ **Replies:** 15\ **Last updated:** [July 30, 2015, 5:30am UTC](https://discuss.elastic.co/t/logstash-and-databse/26225 "2015-07-30T05:30:04Z")
First of all thanks to team that they provided us with jdbc plugin . I really needed it . Now i am stuck again I connected this plugin , ran the config file and yippie i could see the reflection in kibana. But now i wa… --- ## [Dealing with gzipped multilined log files (memory problems)](https://discuss.elastic.co/t/dealing-with-gzipped-multilined-log-files-memory-problems/26538)
**Author:** [@Win\_Wang](https://discuss.elastic.co/u/Win_Wang)\ **Replies:** 0\ **Last updated:** [July 30, 2015, 3:13am UTC](https://discuss.elastic.co/t/dealing-with-gzipped-multilined-log-files-memory-problems/26538 "2015-07-30T03:13:14Z")
I used an exec input with a command to parse the topmost file in a directory every x seconds via zcat (deleting it after I finish), then use the multiline codec to parse it line by line into a json format. I should menti… --- ## [Support for executing ruby script?](https://discuss.elastic.co/t/support-for-executing-ruby-script/26523)
**Author:** [@cheeseandpepper](https://discuss.elastic.co/u/cheeseandpepper)\ **Replies:** 2\ **Last updated:** [July 29, 2015, 8:55pm UTC](https://discuss.elastic.co/t/support-for-executing-ruby-script/26523 "2015-07-29T20:55:30Z")
Hi I'm just getting started with Logstash and the ability to execute inline ruby is pretty neat. Is it possible to invoke a ruby script in a similar manner? The advantage would be that I could make it look better as… --- ## [Pipe syslog into Redis](https://discuss.elastic.co/t/pipe-syslog-into-redis/26363)
**Author:** [@HelpComputer](https://discuss.elastic.co/u/HelpComputer)\ **Replies:** 5\ **Last updated:** [July 29, 2015, 8:50pm UTC](https://discuss.elastic.co/t/pipe-syslog-into-redis/26363 "2015-07-29T20:50:32Z")
Hello, I am just starting out with ELK and have a question that I can't seem to find an answer to. This is my first post, so I hope this is the right spot to ask. I've looked at the Logstash Book by James Turnbull and … --- ## [Logstash logstash-jdbc-input queries (mapping and type)](https://discuss.elastic.co/t/logstash-logstash-jdbc-input-queries-mapping-and-type/26224)
**Author:** [@Navneet\_Mathpal](https://discuss.elastic.co/u/Navneet_Mathpal)\ **Replies:** 4\ **Last updated:** [July 29, 2015, 8:03pm UTC](https://discuss.elastic.co/t/logstash-logstash-jdbc-input-queries-mapping-and-type/26224 "2015-07-29T20:03:05Z")
hi , I have some queries about logstash-input-jdbc 1) how to specify the type : lets us suppose I have already a mapping available for index . Lets say type is "mydata". If i talk about csv filter in Logstash it has … --- ## [How to tell, whether my Logstash instance ready?](https://discuss.elastic.co/t/how-to-tell-whether-my-logstash-instance-ready/26501)
**Author:** [@pradeepfn](https://discuss.elastic.co/u/pradeepfn)\ **Replies:** 3\ **Last updated:** [July 29, 2015, 7:10pm UTC](https://discuss.elastic.co/t/how-to-tell-whether-my-logstash-instance-ready/26501 "2015-07-29T19:10:18Z")
I want to determine whether my Logstash instance is ready for input data processing. In a manual installation, i look at the start-up logs and figure it out. Now i want to do the same programatically, for an orchestratio… --- ## [Data not coming in through redis](https://discuss.elastic.co/t/data-not-coming-in-through-redis/25957)
**Author:** [@daq](https://discuss.elastic.co/u/daq)\ **Replies:** 6\ **Last updated:** [July 29, 2015, 6:57pm UTC](https://discuss.elastic.co/t/data-not-coming-in-through-redis/25957 "2015-07-29T18:57:54Z")
I have a basic ELK setup on a single box that is fed data from several inputs like syslog and lumberjack. It started dying from too much log data coming in so I installed redis server and added it to config, but now the … --- ## [Can't parse a CSV file](https://discuss.elastic.co/t/cant-parse-a-csv-file/26362)
**Author:** [@Maruf789](https://discuss.elastic.co/u/Maruf789)\ **Replies:** 2\ **Last updated:** [July 29, 2015, 6:11pm UTC](https://discuss.elastic.co/t/cant-parse-a-csv-file/26362 "2015-07-29T18:11:09Z")
Hi, I have a simple CSV which I want to parse using Logstash and create some simple graphs in Kibana. But for some reason (unknown to me), the CSV file doesn't get parsed and I cannot see the index in Elasticsearch. He… --- ## [S3 input plungin config](https://discuss.elastic.co/t/s3-input-plungin-config/25104)
**Author:** [@bsjin](https://discuss.elastic.co/u/bsjin)\ **Replies:** 1\ **Last updated:** [July 29, 2015, 11:00am UTC](https://discuss.elastic.co/t/s3-input-plungin-config/25104 "2015-07-29T11:00:19Z")
Hello. I want input data from S3 bucket to elasticsearch when using logstash So, I don't know Why this Error jbs01@jbs01:~/logstash-1.4.2$ ./bin/logstash -f conf/s3.conf Using milestone 1 input plugin 's3'. This … --- ## [Cannot convert instance of class org.jruby.RubyTime to class java.lang.String"](https://discuss.elastic.co/t/cannot-convert-instance-of-class-org-jruby-rubytime-to-class-java-lang-string/26477)
**Author:** [@Anmol\_Gupta](https://discuss.elastic.co/u/Anmol_Gupta)\ **Replies:** 0\ **Last updated:** [July 29, 2015, 10:57am UTC](https://discuss.elastic.co/t/cannot-convert-instance-of-class-org-jruby-rubytime-to-class-java-lang-string/26477 "2015-07-29T10:57:16Z")
filter { date { match =\> \[ "timestamp", "yyyy-MM-dd HH:mm:ss " , "ISO8601" \] target =\> "@timestamp" } } I am using this filter in my conf file for feeding data from postgresql to logstash and from logstash to elast… --- ## [Logstash filtering issues](https://discuss.elastic.co/t/logstash-filtering-issues/26465)
**Author:** [@MrAV](https://discuss.elastic.co/u/MrAV)\ **Replies:** 0\ **Last updated:** [July 29, 2015, 8:05am UTC](https://discuss.elastic.co/t/logstash-filtering-issues/26465 "2015-07-29T08:05:08Z")
Hi, I encountered a rather strange situation with message filtering. I've added to my logstash configuration a few log-files: fix\_DM\*\*\*\*.fix, cluster.log and ms\_.log. For testing purposes I've added for each fix\_DMXX… --- ## [ELK - guaranteed lossless?](https://discuss.elastic.co/t/elk-guaranteed-lossless/26348)
**Author:** [@dhopkins](https://discuss.elastic.co/u/dhopkins)\ **Replies:** 5\ **Last updated:** [July 29, 2015, 4:46am UTC](https://discuss.elastic.co/t/elk-guaranteed-lossless/26348 "2015-07-29T04:46:58Z")
Hi folks, I'm trying to understand what the best setup is to guarantee zero lost messages. I know logstash will not purposely lose messages, however I have seen references of people pulling in Redis to ensure they don'… --- ## [Service logstash start, but cannot detect and send logs](https://discuss.elastic.co/t/service-logstash-start-but-cannot-detect-and-send-logs/26404)
**Author:** [@Jason\_Zheng](https://discuss.elastic.co/u/Jason_Zheng)\ **Replies:** 4\ **Last updated:** [July 29, 2015, 2:40am UTC](https://discuss.elastic.co/t/service-logstash-start-but-cannot-detect-and-send-logs/26404 "2015-07-29T02:40:16Z")
Hi all, service logstash start (start ok as following) cannot detect and send logs, but using /opt/logstash/bin/logstash -f /etc/logstash/conf.d/logstashmiki.conf works fine $service logstash start $ps aux | grep log… --- ## [Remove a field that starts with an integer](https://discuss.elastic.co/t/remove-a-field-that-starts-with-an-integer/26370)
**Author:** [@Gabriel\_Rosca](https://discuss.elastic.co/u/Gabriel_Rosca)\ **Replies:** 11\ **Last updated:** [July 28, 2015, 8:43pm UTC](https://discuss.elastic.co/t/remove-a-field-that-starts-with-an-integer/26370 "2015-07-28T20:43:16Z")
Hi Guys, I want to remove a field that starts with an integer. How can I do that using logstash. EX: of the field. "1. 2015.07.27 17": "25:35 message sent" Regards, Gabriel --- ## [Logstash to Re-index Elasticsearch indexes](https://discuss.elastic.co/t/logstash-to-re-index-elasticsearch-indexes/26365)
**Author:** [@inderjeet26](https://discuss.elastic.co/u/inderjeet26)\ **Replies:** 3\ **Last updated:** [July 28, 2015, 6:59pm UTC](https://discuss.elastic.co/t/logstash-to-re-index-elasticsearch-indexes/26365 "2015-07-28T18:59:27Z")
I am trying to re-index all the results in my elasticsearch by using Logstash Elasticsearch input and then some filter and then Logstash Elasticsearch Output plugins. For this I created a logstash-elastic.conf file. If… --- ## [Logstash plugin flush interval](https://discuss.elastic.co/t/logstash-plugin-flush-interval/25654)
**Author:** [@karthikbox](https://discuss.elastic.co/u/karthikbox)\ **Replies:** 1\ **Last updated:** [July 28, 2015, 6:07pm UTC](https://discuss.elastic.co/t/logstash-plugin-flush-interval/25654 "2015-07-28T18:07:24Z")
Hi all, I've been writing a custom filter plugin for logstash. I have a cleanup method which needs to be called periodically (lets say 3 sec). I understand that this is achievable by overriding "flush" method in my plu… --- ## [Logstash elasticsearch output and IP change](https://discuss.elastic.co/t/logstash-elasticsearch-output-and-ip-change/26422)
**Author:** [@fhoubart](https://discuss.elastic.co/u/fhoubart)\ **Replies:** 1\ **Last updated:** [July 28, 2015, 3:59pm UTC](https://discuss.elastic.co/t/logstash-elasticsearch-output-and-ip-change/26422 "2015-07-28T15:59:44Z")
Hi, I'm facing a strage case where after changing the IP address of my ElasticSearch server, logstash keep trying to connect to the old IP. The output configuration is: output { elasticsearch { host =\> "192.168… --- ## [Want to capture timeStamp without milliseconds](https://discuss.elastic.co/t/want-to-capture-timestamp-without-milliseconds/26389)
**Author:** [@Saket\_Kumar](https://discuss.elastic.co/u/Saket_Kumar)\ **Replies:** 5\ **Last updated:** [July 28, 2015, 1:39pm UTC](https://discuss.elastic.co/t/want-to-capture-timestamp-without-milliseconds/26389 "2015-07-28T13:39:35Z")
The CSV contains timeStamp field whose format is "yyyy/MM/dd HH:mm:ss.SSS" I want to capture only "yyyy/MM/dd HH:mm:ss" Used below config but it didn't work. filter { if (\[message\] =~ "responseCode") { drop… --- ## [Logstash forwarder, logstash, nxlog, redis, which one to use?](https://discuss.elastic.co/t/logstash-forwarder-logstash-nxlog-redis-which-one-to-use/26220)
**Author:** [@zpp](https://discuss.elastic.co/u/zpp)\ **Replies:** 6\ **Last updated:** [July 28, 2015, 12:21pm UTC](https://discuss.elastic.co/t/logstash-forwarder-logstash-nxlog-redis-which-one-to-use/26220 "2015-07-28T12:21:41Z")
when i started to play with ELK, i followed some article and setup elk like this: logstash -\> redis -\> logstash -\> elastic search -\> kibana. I'm prepared that logstash shipper will use more memory, but i wasn't prepared … --- ## [Logstash error "exception in filterworker"](https://discuss.elastic.co/t/logstash-error-exception-in-filterworker/26406)
**Author:** [@nguafogu78](https://discuss.elastic.co/u/nguafogu78)\ **Replies:** 1\ **Last updated:** [July 28, 2015, 12:13pm UTC](https://discuss.elastic.co/t/logstash-error-exception-in-filterworker/26406 "2015-07-28T12:13:47Z")
Hi, Does someone encountered the following error before: Jul 28 08:56:32 syslog1-ctr logstash: {:timestamp=\>"2015-07-28T08:56:32.481000+0200", :message=\>"Exception in filterworker", "exception"=\>#, "backtrace"=\>\["org… --- ## [Inputting JSON object to logstash - unable to remove certain fields or parse as JSON](https://discuss.elastic.co/t/inputting-json-object-to-logstash-unable-to-remove-certain-fields-or-parse-as-json/26401)
**Author:** [@s\_gonzales](https://discuss.elastic.co/u/s_gonzales)\ **Replies:** 4\ **Last updated:** [July 28, 2015, 11:42am UTC](https://discuss.elastic.co/t/inputting-json-object-to-logstash-unable-to-remove-certain-fields-or-parse-as-json/26401 "2015-07-28T11:42:47Z")
For some context, I am completeley new to logstash and am interested in filtering this data in three ways: 1. remove ceratin fields such as "anonymousId" or "library" (which is nested within context) 2. extract fields fr… --- ## [Replace RabbitMQ river for Elasticsearch from Logstash](https://discuss.elastic.co/t/replace-rabbitmq-river-for-elasticsearch-from-logstash/26405)
**Author:** [@nguafogu78](https://discuss.elastic.co/u/nguafogu78)\ **Replies:** 1\ **Last updated:** [July 28, 2015, 10:03am UTC](https://discuss.elastic.co/t/replace-rabbitmq-river-for-elasticsearch-from-logstash/26405 "2015-07-28T10:03:52Z")
Hi, I'd like to know how it works from Logstash 1.5.x if I want to send data from Logstash to Elasticsearch through a RabbitMQ server. I understand the rabbitMQ river is deprecated since then so I want to know how to… --- ## [How to calculate difference between two dates and add to index](https://discuss.elastic.co/t/how-to-calculate-difference-between-two-dates-and-add-to-index/24628)
**Author:** [@JeroenvdV](https://discuss.elastic.co/u/JeroenvdV)\ **Replies:** 2\ **Last updated:** [July 28, 2015, 8:24am UTC](https://discuss.elastic.co/t/how-to-calculate-difference-between-two-dates-and-add-to-index/24628 "2015-07-28T08:24:17Z")
I have a log file and each entry contains multiple dates (when a ticket was opened, assigned, closed). Can I calculate the time passed with logstash and then add this value to each entry? --- ## [Use of date filter plugin - Match & timezone parameters](https://discuss.elastic.co/t/use-of-date-filter-plugin-match-timezone-parameters/26397)
**Author:** [@nguafogu78](https://discuss.elastic.co/u/nguafogu78)\ **Replies:** 0\ **Last updated:** [July 28, 2015, 8:12am UTC](https://discuss.elastic.co/t/use-of-date-filter-plugin-match-timezone-parameters/26397 "2015-07-28T08:12:09Z")
Hi, I'd like to have some complementary informations regarding the use of the date plugin. I'm unable to force the timezone of a date to be at CET time. Can someone tell me which value of the timezone parameter should … --- ## [Multiline problem](https://discuss.elastic.co/t/multiline-problem/26219)
**Author:** [@ABecker](https://discuss.elastic.co/u/ABecker)\ **Replies:** 5\ **Last updated:** [July 28, 2015, 7:57am UTC](https://discuss.elastic.co/t/multiline-problem/26219 "2015-07-28T07:57:39Z")
Hello Logstash community, I have a problem with the multiline filter. I have a multiline logfile which is very huge and which will be devided into two parts. This is my multiline log: (just as info: please replace… --- ## [Output logstash not start](https://discuss.elastic.co/t/output-logstash-not-start/26340)
**Author:** [@Jungmi\_Yoo](https://discuss.elastic.co/u/Jungmi_Yoo)\ **Replies:** 5\ **Last updated:** [July 28, 2015, 7:44am UTC](https://discuss.elastic.co/t/output-logstash-not-start/26340 "2015-07-28T07:44:20Z")
Logstash 1.5.1 Elasticsearch 1.4.2 I tried to move from A index aggregated data to B index. but I can't let Logstash output start. here is log message and config file. I don't know what config is wrong. Fa… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1247) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1249)