# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1250 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1251 --- ## [Filter logs in logstash](https://discuss.elastic.co/t/filter-logs-in-logstash/26075)
**Author:** [@Smasell](https://discuss.elastic.co/u/Smasell)\ **Replies:** 2\ **Last updated:** [July 22, 2015, 1:03pm UTC](https://discuss.elastic.co/t/filter-logs-in-logstash/26075 "2015-07-22T13:03:07Z")
Hi!!! I have several type logs that comes into logstash. And I don't need logs starts from CLIENT\_LOG with "event\_name": "CraftCard" I've create script in filter section: if \[message\] =~ /^CLIENT\_LOG / { if "event\_name: … --- ## [Separate Input, Filter and Output Configurations](https://discuss.elastic.co/t/separate-input-filter-and-output-configurations/26030)
**Author:** [@gromit](https://discuss.elastic.co/u/gromit)\ **Replies:** 4\ **Last updated:** [July 22, 2015, 8:54am UTC](https://discuss.elastic.co/t/separate-input-filter-and-output-configurations/26030 "2015-07-22T08:54:56Z")
I have multiple configuration files for Logstash, each file contains inputs, filters & outputs. Is this the recommended method or should I have separate files containing only 1 of the above? For example: 1-input.conf, 2… --- ## [Logstash 1.5.3 and 1.4.4 released](https://discuss.elastic.co/t/logstash-1-5-3-and-1-4-4-released/26022)
**Author:** [@suyograo](https://discuss.elastic.co/u/suyograo)\ **Replies:** 0\ **Last updated:** [July 21, 2015, 8:39pm UTC](https://discuss.elastic.co/t/logstash-1-5-3-and-1-4-4-released/26022 "2015-07-21T20:39:48Z")
Logstash 1.5.3 and 1.4.4 is now available for download. It includes security fixes, enhancements for Elasticsearch output and bug fixes. Please check the blog or changelog for all the details. --- ## [Logstash server Address](https://discuss.elastic.co/t/logstash-server-address/26008)
**Author:** [@Sumanth\_Damarla](https://discuss.elastic.co/u/Sumanth_Damarla)\ **Replies:** 2\ **Last updated:** [July 21, 2015, 5:35pm UTC](https://discuss.elastic.co/t/logstash-server-address/26008 "2015-07-21T17:35:58Z")
I am working on Ubuntu 15.04. I installed Logstash environment, Can anyone tell me how to find logstash\_server\_private\_address in my system?? --- ## [Local generation of html doc for pluggin?](https://discuss.elastic.co/t/local-generation-of-html-doc-for-pluggin/25912)
**Author:** [@eeveaud](https://discuss.elastic.co/u/eeveaud)\ **Replies:** 3\ **Last updated:** [July 21, 2015, 3:53pm UTC](https://discuss.elastic.co/t/local-generation-of-html-doc-for-pluggin/25912 "2015-07-21T15:53:45Z")
is there a way to generate the html doc for an under development pluggin ? I would like to check it before pushing it to git regards Eric --- ## [GitHub Puppet modules - issues and pull requests](https://discuss.elastic.co/t/github-puppet-modules-issues-and-pull-requests/25723)
**Author:** [@oloc](https://discuss.elastic.co/u/oloc)\ **Replies:** 1\ **Last updated:** [July 21, 2015, 12:48pm UTC](https://discuss.elastic.co/t/github-puppet-modules-issues-and-pull-requests/25723 "2015-07-21T12:48:11Z")
Are the issues and the pull request are followed for the puppet modules? Or should I move them all in a new topic here? What is the frequency of validation/reject of the proposals? https://github.com/elastic/puppet-l… --- ## [One vs Multiple indices on ES using LS's 'date' filter](https://discuss.elastic.co/t/one-vs-multiple-indices-on-es-using-lss-date-filter/1939)
**Author:** [@refaelos](https://discuss.elastic.co/u/refaelos)\ **Replies:** 14\ **Last updated:** [July 21, 2015, 10:10am UTC](https://discuss.elastic.co/t/one-vs-multiple-indices-on-es-using-lss-date-filter/1939 "2015-07-21T10:10:04Z")
Hey Guys, Love the elastic team products \[thumbsup\] I thought if this question should go here or on the elasticsearch forum and only b/c it's a logstash configuration I decided to put it here. What i'm doing is tra… --- ## [How to parse today's file](https://discuss.elastic.co/t/how-to-parse-todays-file/25968)
**Author:** [@vikas\_gopal](https://discuss.elastic.co/u/vikas_gopal)\ **Replies:** 3\ **Last updated:** [July 21, 2015, 10:06am UTC](https://discuss.elastic.co/t/how-to-parse-todays-file/25968 "2015-07-21T10:06:20Z")
Hi Experts, I want parse today's log file . I tried the following (kind of stupid thing I have done as it works only for output )but no luck .Please suggest how I can achieve this . input { file { p… --- ## [Behaviour with unavailable Gelf output](https://discuss.elastic.co/t/behaviour-with-unavailable-gelf-output/25886)
**Author:** [@starless](https://discuss.elastic.co/u/starless)\ **Replies:** 4\ **Last updated:** [July 21, 2015, 9:44am UTC](https://discuss.elastic.co/t/behaviour-with-unavailable-gelf-output/25886 "2015-07-21T09:44:41Z")
Hi, how does Logstash behave if a Gelf output is configured but the destination host is temporarily unavailable? Are messages lost, or are they kept in a temporary place until the target Gelf host is available again? I… --- ## [No such file or directory - tmp](https://discuss.elastic.co/t/no-such-file-or-directory-tmp/25835)
**Author:** [@vilas](https://discuss.elastic.co/u/vilas)\ **Replies:** 6\ **Last updated:** [July 20, 2015, 9:35pm UTC](https://discuss.elastic.co/t/no-such-file-or-directory-tmp/25835 "2015-07-20T21:35:28Z")
Hi, Logstash is installed in read & execute only folder. I am trying to execute logstash with elasticsearch input plugin. My configuration: input { elasticsearch { host =\> "xx.xx.xx.xx" … --- ## [CSV parse failure](https://discuss.elastic.co/t/csv-parse-failure/25938)
**Author:** [@michaellizhou](https://discuss.elastic.co/u/michaellizhou)\ **Replies:** 0\ **Last updated:** [July 20, 2015, 6:40pm UTC](https://discuss.elastic.co/t/csv-parse-failure/25938 "2015-07-20T18:40:39Z")
has anyone come up to the problem with csv parsefailure? I tested with a csv file that does not have double qoutes around each cell. But when I try to parse through a csv with double qoutes around each cell i get an erro… --- ## [Logstash mutate filter always stringifies hash and array](https://discuss.elastic.co/t/logstash-mutate-filter-always-stringifies-hash-and-array/25917)
**Author:** [@tamizhgeek](https://discuss.elastic.co/u/tamizhgeek)\ **Replies:** 2\ **Last updated:** [July 20, 2015, 7:17pm UTC](https://discuss.elastic.co/t/logstash-mutate-filter-always-stringifies-hash-and-array/25917 "2015-07-20T19:17:43Z")
I have a json log file, which I am taking as a input with this config input { file { filename } codec { json\_lines } } Each line is a deeply nested JSON. In the filters, When I say mutate { add\_field =\> … --- ## [How to Aggregate Log Content](https://discuss.elastic.co/t/how-to-aggregate-log-content/25833)
**Author:** [@Dilip2610](https://discuss.elastic.co/u/Dilip2610)\ **Replies:** 7\ **Last updated:** [July 20, 2015, 4:51pm UTC](https://discuss.elastic.co/t/how-to-aggregate-log-content/25833 "2015-07-20T16:51:46Z")
Hi, I have few log entries as below. Thu Jul 09 2015 15:00:39 \[serviceout\]\[0x8060015e\]\[crypto\]\[info\] mpgw(mpgwService): tid(6440055)\[request\]\[255.255.215.129\] gtid(6440055): Data encryption succeeded Thu Jul 09 2015 … --- ## [1 XML file to 1 Document](https://discuss.elastic.co/t/1-xml-file-to-1-document/25909)
**Author:** [@Daniel\_D](https://discuss.elastic.co/u/Daniel_D)\ **Replies:** 1\ **Last updated:** [July 20, 2015, 4:35pm UTC](https://discuss.elastic.co/t/1-xml-file-to-1-document/25909 "2015-07-20T16:35:42Z")
This is more of an architectural question. Should I use LS for this scenario? I need to watch a directory for incomig XML files, each file will be one Document. I need to keep roughly 75% of the content after XPathing ar… --- ## [Logstash Plugin Install](https://discuss.elastic.co/t/logstash-plugin-install/25827)
**Author:** [@Dilip2610](https://discuss.elastic.co/u/Dilip2610)\ **Replies:** 2\ **Last updated:** [July 20, 2015, 3:43pm UTC](https://discuss.elastic.co/t/logstash-plugin-install/25827 "2015-07-20T15:43:09Z")
Hi, can some one share the steps to install logstash-filter-aggregate plugin on Windows where i don't have access to gem. Thanks, Dilip --- ## [Logstash crash for "LoadError: no such file to load -- restclient"](https://discuss.elastic.co/t/logstash-crash-for-loaderror-no-such-file-to-load-restclient/25697)
**Author:** [@Silvana\_Vezzoli](https://discuss.elastic.co/u/Silvana_Vezzoli)\ **Replies:** 5\ **Last updated:** [July 20, 2015, 7:16am UTC](https://discuss.elastic.co/t/logstash-crash-for-loaderror-no-such-file-to-load-restclient/25697 "2015-07-20T07:16:03Z")
I installed logstash 1.5.2 on Centos 6.5 VM (test environment). My previous used version was Logstash 1.4.2 and I kept the same configuration files used with previous version. When I launch logstash I get the following … --- ## [Kafka output security/encryption](https://discuss.elastic.co/t/kafka-output-security-encryption/25810)
**Author:** [@Win\_Wang](https://discuss.elastic.co/u/Win_Wang)\ **Replies:** 4\ **Last updated:** [July 19, 2015, 1:10pm UTC](https://discuss.elastic.co/t/kafka-output-security-encryption/25810 "2015-07-19T13:10:26Z")
Does anyone know if the kafka output uses ssl/tls security or can be encrypted without filters? --- ## [Elasticsearch 1.6.0 and Logstash 1.5.2 compatibility issues](https://discuss.elastic.co/t/elasticsearch-1-6-0-and-logstash-1-5-2-compatibility-issues/25692)
**Author:** [@toddysm](https://discuss.elastic.co/u/toddysm)\ **Replies:** 2\ **Last updated:** [July 19, 2015, 5:13am UTC](https://discuss.elastic.co/t/elasticsearch-1-6-0-and-logstash-1-5-2-compatibility-issues/25692 "2015-07-19T05:13:16Z")
Hello, I just downloaded the latest versions of ES (1.6.0) and LS (1.5.2) and am experiencing issues with parsing logs with LS and indexing with ES. The config file for LS works properly as I tested it with console out… --- ## [Logstash elasticsearch filter plugin](https://discuss.elastic.co/t/logstash-elasticsearch-filter-plugin/25803)
**Author:** [@juerkan](https://discuss.elastic.co/u/juerkan)\ **Replies:** 1\ **Last updated:** [July 18, 2015, 3:30am UTC](https://discuss.elastic.co/t/logstash-elasticsearch-filter-plugin/25803 "2015-07-18T03:30:56Z")
Hi there, a new log comes in, and i query my Elasticsearch Cluster to find a match with an existing document: filter { if\[type\] == 'aaa' { elasticsearch { … --- ## [Aws s3 logstash plugin](https://discuss.elastic.co/t/aws-s3-logstash-plugin/25811)
**Author:** [@trekr5](https://discuss.elastic.co/u/trekr5)\ **Replies:** 1\ **Last updated:** [July 18, 2015, 3:26am UTC](https://discuss.elastic.co/t/aws-s3-logstash-plugin/25811 "2015-07-18T03:26:56Z")
Hi, I'm new to logstash and have a ruby s3 plugin that will effectively copy log files from a local machine into an AWS s3 bucket. This is an inherited project and so my knowledge of logstash is not high. My problem … --- ## [Using the escape character](https://discuss.elastic.co/t/using-the-escape-character/25838)
**Author:** [@wstlk](https://discuss.elastic.co/u/wstlk)\ **Replies:** 0\ **Last updated:** [July 18, 2015, 3:22am UTC](https://discuss.elastic.co/t/using-the-escape-character/25838 "2015-07-18T03:22:18Z")
How or what syntax is the standard for using the escape character in a literal? "\\\\" tells me it doesn't apply to the following case here I have a message string "client 1.1.1.1#44582 (abc.com): query (cache) 'abc.… --- ## [Help with initial Logstash configuration](https://discuss.elastic.co/t/help-with-initial-logstash-configuration/25549)
**Author:** [@garresmi](https://discuss.elastic.co/u/garresmi)\ **Replies:** 8\ **Last updated:** [July 17, 2015, 7:26pm UTC](https://discuss.elastic.co/t/help-with-initial-logstash-configuration/25549 "2015-07-17T19:26:07Z")
Hi everyone, I'm trying to spin up an ELK stack on a CentOS 7 server. I got everything installed correctly (as far as I know). However, when I go to my Kibana Dashboard, It won't let me declare an index pattern. I follow… --- ## [Failure to import data with logstash into elasticsearch](https://discuss.elastic.co/t/failure-to-import-data-with-logstash-into-elasticsearch/24643)
**Author:** [@jasonc](https://discuss.elastic.co/u/jasonc)\ **Replies:** 2\ **Last updated:** [July 17, 2015, 4:06pm UTC](https://discuss.elastic.co/t/failure-to-import-data-with-logstash-into-elasticsearch/24643 "2015-07-17T16:06:25Z")
Using a kafka input, I'm getting the following error when importing data from a topic\_id: {:exception=\>#\, :backtrace=\>\["org/jruby/RubyComparable.java:168:in \`\<'", "… --- ## [@timestamp being represented as string in Logstash 1.5.1](https://discuss.elastic.co/t/timestamp-being-represented-as-string-in-logstash-1-5-1/23881)
**Author:** [@owenme26](https://discuss.elastic.co/u/owenme26)\ **Replies:** 4\ **Last updated:** [July 17, 2015, 10:43am UTC](https://discuss.elastic.co/t/timestamp-being-represented-as-string-in-logstash-1-5-1/23881 "2015-07-17T10:43:45Z")
Setup: I recently upgraded from logstash 1.4.2-1-2c0f5a1 to Logstash 1.5.1-1. I am using the date filter to replace the @timestamp with the event time of the log. I send all input to elasticsearch and I tag certain even… --- ## [Add\_field not working in date { } config](https://discuss.elastic.co/t/add-field-not-working-in-date-config/25785)
**Author:** [@Janet](https://discuss.elastic.co/u/Janet)\ **Replies:** 4\ **Last updated:** [July 17, 2015, 10:36am UTC](https://discuss.elastic.co/t/add-field-not-working-in-date-config/25785 "2015-07-17T10:36:30Z")
I use a friendly date format to display to my users, because @timestamp is a little ugly. This config adds a time field, which works as expected: date { add\_field =\> \[ "time", "%{+MMM dd HH:mm:ss}" \] match =\> … --- ## [Logstash is not able to find the flapjack plugin which has been installed in vendor\\local\_gems](https://discuss.elastic.co/t/logstash-is-not-able-to-find-the-flapjack-plugin-which-has-been-installed-in-vendor-local-gems/25645)
**Author:** [@sailesh](https://discuss.elastic.co/u/sailesh)\ **Replies:** 1\ **Last updated:** [July 17, 2015, 9:38am UTC](https://discuss.elastic.co/t/logstash-is-not-able-to-find-the-flapjack-plugin-which-has-been-installed-in-vendor-local-gems/25645 "2015-07-17T09:38:40Z")
Hi All, I have output plugin for flapjack in path vendor\\local\_gems. Even if when i am trying to list all the gems, i am not able to see the local flapjack gem. After installation of plugin, the below entries are there i… --- ## [Is it possible to set the Statsd counter type using a variable?](https://discuss.elastic.co/t/is-it-possible-to-set-the-statsd-counter-type-using-a-variable/25776)
**Author:** [@russellseymour](https://discuss.elastic.co/u/russellseymour)\ **Replies:** 0\ **Last updated:** [July 17, 2015, 8:41am UTC](https://discuss.elastic.co/t/is-it-possible-to-set-the-statsd-counter-type-using-a-variable/25776 "2015-07-17T08:41:00Z")
Good morning, I am updating my monitoring system and am thinking of changing the way metrics are sent to Graphite and want to use the Statsd output plugin. The way that the metrics are sent to Logstash is via Redis a… --- ## [Logstash problem for a creating new field?](https://discuss.elastic.co/t/logstash-problem-for-a-creating-new-field/25770)
**Author:** [@abathula](https://discuss.elastic.co/u/abathula)\ **Replies:** 0\ **Last updated:** [July 17, 2015, 7:17am UTC](https://discuss.elastic.co/t/logstash-problem-for-a-creating-new-field/25770 "2015-07-17T07:17:12Z")
Hi All, I have the log line like 2015-06-09 00:00:07,947 \[11\] DEBUG NCR.XE.Component.MessageHandler.HistoryEventMessageProcessor - Starting RentalTransactionMessageProcessor message type with the data \ **Author:** [@vilas](https://discuss.elastic.co/u/vilas)\ **Replies:** 5\ **Last updated:** [July 17, 2015, 2:12am UTC](https://discuss.elastic.co/t/input-threads-with-wild-cards/25550 "2015-07-17T02:12:56Z") Hi, As I understand, each input section would be run with separate thread. But if I use wild cards in an input section, does this create multiple threads or still a single thread would be created? I ask this because,… --- ## [Stuck with rsyslog pri-text](https://discuss.elastic.co/t/stuck-with-rsyslog-pri-text/25758)
**Author:** [@Nate\_Marks](https://discuss.elastic.co/u/Nate_Marks)\ **Replies:** 0\ **Last updated:** [July 17, 2015, 12:35am UTC](https://discuss.elastic.co/t/stuck-with-rsyslog-pri-text/25758 "2015-07-17T00:35:31Z")
When I send syslogs to logstash from my ASA, I get the severity correctly. I prefer to send through rsyslog because It'll let me process archives, but I seem to lose the severity information on my messages when I proce… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1249) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1251)