# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1253 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1254 --- ## [Converting array of strings to array of dict](https://discuss.elastic.co/t/converting-array-of-strings-to-array-of-dict/25219)
**Author:** [@Giulio\_Eulisse](https://discuss.elastic.co/u/Giulio_Eulisse)\ **Replies:** 2\ **Last updated:** [July 9, 2015, 10:27am UTC](https://discuss.elastic.co/t/converting-array-of-strings-to-array-of-dict/25219 "2015-07-09T10:27:34Z")
Hi, I've data that gets parsed to: {... message =\> \["line1: message1", "line2: message2"\] } and I can mutate it easily to: {... "lines" =\> \[1,2\] "text" =\> \["message1", "message2"\] } via: grok {"message"=\> "li… --- ## [Logstash Filters](https://discuss.elastic.co/t/logstash-filters/25203)
**Author:** [@abathula](https://discuss.elastic.co/u/abathula)\ **Replies:** 7\ **Last updated:** [July 9, 2015, 10:05am UTC](https://discuss.elastic.co/t/logstash-filters/25203 "2015-07-09T10:05:19Z")
Hi Good morning, I have a requirement of creating a filter in logstash which is displayed as a field in kibana also. if any (Exception or IOException or NullPointerException) in message, then create a field called ms… --- ## [No Password supplied for PKCS#12 Keystore](https://discuss.elastic.co/t/no-password-supplied-for-pkcs-12-keystore/25195)
**Author:** [@rrspyder](https://discuss.elastic.co/u/rrspyder)\ **Replies:** 0\ **Last updated:** [July 8, 2015, 11:34pm UTC](https://discuss.elastic.co/t/no-password-supplied-for-pkcs-12-keystore/25195 "2015-07-08T23:34:03Z")
I am trying to compile the source code from git. after cloning the repository and issuing rake artifact:tar I am getting rake aborted, setting default path failed: No Password supplied for PKCS#12 Keystore. Am I missing … --- ## [Is there a graphical interface for Logstash?](https://discuss.elastic.co/t/is-there-a-graphical-interface-for-logstash/25192)
**Author:** [@Maruf789](https://discuss.elastic.co/u/Maruf789)\ **Replies:** 1\ **Last updated:** [July 8, 2015, 10:40pm UTC](https://discuss.elastic.co/t/is-there-a-graphical-interface-for-logstash/25192 "2015-07-08T22:40:50Z")
Hi Logstash Experts, I am using Logstash 1.5.1 for my project. I am new to Logstash, but I know that Kibana is preferred to be used as a graphical interface for users/developers to create nice graphs based on logs (da… --- ## [How to avoid data loss when using CollectD?](https://discuss.elastic.co/t/how-to-avoid-data-loss-when-using-collectd/25167)
**Author:** [@jerrac](https://discuss.elastic.co/u/jerrac)\ **Replies:** 2\ **Last updated:** [July 8, 2015, 5:06pm UTC](https://discuss.elastic.co/t/how-to-avoid-data-loss-when-using-collectd/25167 "2015-07-08T17:06:31Z")
I've successfully tested getting system load/RAM/etc statistics as described in the CollectD codec docs. That said, I haven't been able to figure out how to avoid a loss of data from my nodes when/if the Logstash indexer… --- ## [Pattern matching Problem](https://discuss.elastic.co/t/pattern-matching-problem/25144)
**Author:** [@abathula](https://discuss.elastic.co/u/abathula)\ **Replies:** 6\ **Last updated:** [July 8, 2015, 4:21pm UTC](https://discuss.elastic.co/t/pattern-matching-problem/25144 "2015-07-08T16:21:43Z")
Is it correct pattern matching with below log. Actually i got \_grokParseFaliure error is coming. Log is: (Log4jNet) type log 2015-04-17 23:35:46,932 \[10\] DEBUG - Customer already exists... conservation pattern in … --- ## [Sending Extracted Fields to Kibana](https://discuss.elastic.co/t/sending-extracted-fields-to-kibana/25136)
**Author:** [@sushmithak](https://discuss.elastic.co/u/sushmithak)\ **Replies:** 8\ **Last updated:** [July 8, 2015, 12:51pm UTC](https://discuss.elastic.co/t/sending-extracted-fields-to-kibana/25136 "2015-07-08T12:51:21Z")
Hi, i have modified the logstash configuration file to extract some fields. The extracted fields are dispalying in logstash.stdout file but are not showing in kibana. my configuration file is like this: filter { … --- ## [Logstash integration with Nagios](https://discuss.elastic.co/t/logstash-integration-with-nagios/25109)
**Author:** [@ppnair](https://discuss.elastic.co/u/ppnair)\ **Replies:** 2\ **Last updated:** [July 8, 2015, 11:45am UTC](https://discuss.elastic.co/t/logstash-integration-with-nagios/25109 "2015-07-08T11:45:49Z")
Hi I am new to logstash. I would like to know nagios/op5 can be integrated with logstash so that all logstash events can be genrated as an alert via nagios/op5. Note:dont have log server installed in nagios/op5. … --- ## [Which architecture of logstash forwarder or redis is good in scalable perspective?](https://discuss.elastic.co/t/which-architecture-of-logstash-forwarder-or-redis-is-good-in-scalable-perspective/25134)
**Author:** [@harshafrnd4u](https://discuss.elastic.co/u/harshafrnd4u)\ **Replies:** 1\ **Last updated:** [July 8, 2015, 10:54am UTC](https://discuss.elastic.co/t/which-architecture-of-logstash-forwarder-or-redis-is-good-in-scalable-perspective/25134 "2015-07-08T10:54:14Z")
In a very large application, what is proposed architecture for whole ELK stack? Is it good to use redis broker between logstash forwarder and logstash indexer? Or will logstash forwarder can scale and send logs directl… --- ## [Logstash Elasticsearch output configuration](https://discuss.elastic.co/t/logstash-elasticsearch-output-configuration/25122)
**Author:** [@Nicolas\_Guyomar](https://discuss.elastic.co/u/Nicolas_Guyomar)\ **Replies:** 1\ **Last updated:** [July 8, 2015, 8:14am UTC](https://discuss.elastic.co/t/logstash-elasticsearch-output-configuration/25122 "2015-07-08T08:14:51Z")
Hi everyone, I've just upgraded from logstash 1.4.2 to 1.5.2. Everything works fine using "node" protocol to send messages to elasticsearch using bulk API I have no iptables on my elasticsearch. MulticastDiscovery is … --- ## [Grok Pattern](https://discuss.elastic.co/t/grok-pattern/25029)
**Author:** [@gugansankar](https://discuss.elastic.co/u/gugansankar)\ **Replies:** 5\ **Last updated:** [July 8, 2015, 6:34am UTC](https://discuss.elastic.co/t/grok-pattern/25029 "2015-07-08T06:34:14Z")
I'm not familiar on Grok pattern. Can someone please help me to write the Grok pattern for the below example in Logstash, At the same time, I have to populate some data on Kibana from the below one Sample Log: 2015-07… --- ## [Shield w/ Logstash Offline Install](https://discuss.elastic.co/t/shield-w-logstash-offline-install/25072)
**Author:** [@Mrc0113](https://discuss.elastic.co/u/Mrc0113)\ **Replies:** 5\ **Last updated:** [July 8, 2015, 12:07am UTC](https://discuss.elastic.co/t/shield-w-logstash-offline-install/25072 "2015-07-08T00:07:29Z")
Hi, I am installing ELK on a network that does not have internet access and am following the instructions at the link below to get Logstash to work with Shield enabled. However, it seems that the instructions require… --- ## [Configuration Validation](https://discuss.elastic.co/t/configuration-validation/24985)
**Author:** [@bdunbar](https://discuss.elastic.co/u/bdunbar)\ **Replies:** 2\ **Last updated:** [July 7, 2015, 7:37pm UTC](https://discuss.elastic.co/t/configuration-validation/24985 "2015-07-07T19:37:25Z")
I have a web server. I have a two-server es cluster. I want to pipe the access logs to the es cluster using logstash. Is this the right configuration for the web server? How do I configure the ES cluster to accept … --- ## [Why was the Logstash web ui discontinued?](https://discuss.elastic.co/t/why-was-the-logstash-web-ui-discontinued/25067)
**Author:** [@gdeconto](https://discuss.elastic.co/u/gdeconto)\ **Replies:** 1\ **Last updated:** [July 7, 2015, 5:14pm UTC](https://discuss.elastic.co/t/why-was-the-logstash-web-ui-discontinued/25067 "2015-07-07T17:14:57Z")
if there is an issue with the data that logstash is receiving, wouldn't a monitoring page be of use? even if all it did was to tail the logstash error log file(s). --- ## [LS Stops writing to ES every couple hours](https://discuss.elastic.co/t/ls-stops-writing-to-es-every-couple-hours/25064)
**Author:** [@bluethundr](https://discuss.elastic.co/u/bluethundr)\ **Replies:** 0\ **Last updated:** [July 7, 2015, 4:48pm UTC](https://discuss.elastic.co/t/ls-stops-writing-to-es-every-couple-hours/25064 "2015-07-07T16:48:05Z")
Hello, Since I've been able to get LS 1.5.1 working with ES 1.6.0 and kibana 4 it ran for a few weeks without complaint. But today I noticed that when I do a search in Kibana, there are no results.. Unless I use the… --- ## [CPU spikes to more than 150% on running logstash instance](https://discuss.elastic.co/t/cpu-spikes-to-more-than-150-on-running-logstash-instance/25040)
**Author:** [@Bhavani\_Ananth](https://discuss.elastic.co/u/Bhavani_Ananth)\ **Replies:** 1\ **Last updated:** [July 7, 2015, 1:43pm UTC](https://discuss.elastic.co/t/cpu-spikes-to-more-than-150-on-running-logstash-instance/25040 "2015-07-07T13:43:45Z")
Hello, I have two ubuntu instances in Amazon with the following configuration. Memory - 62.9 Hard Disk - 197G Hard Disk Available - 184G ard Disk Type: SSD CPU - 8 Core The first instance has logstash setup. It rea… --- ## [Logstash email alerts dynamically from multiple log files](https://discuss.elastic.co/t/logstash-email-alerts-dynamically-from-multiple-log-files/25009)
**Author:** [@abathula](https://discuss.elastic.co/u/abathula)\ **Replies:** 9\ **Last updated:** [July 7, 2015, 1:39pm UTC](https://discuss.elastic.co/t/logstash-email-alerts-dynamically-from-multiple-log-files/25009 "2015-07-07T13:39:13Z")
I have the logstash config file in which i have written the mail alert for particular text present in the message then automatically send an email with the message. Please find the configuration file (logstash.conf). i… --- ## [Failed action with response of 400, dropping action: \["index"](https://discuss.elastic.co/t/failed-action-with-response-of-400-dropping-action-index/25013)
**Author:** [@sunilmchaudhari](https://discuss.elastic.co/u/sunilmchaudhari)\ **Replies:** 3\ **Last updated:** [July 7, 2015, 10:41am UTC](https://discuss.elastic.co/t/failed-action-with-response-of-400-dropping-action-index/25013 "2015-07-07T10:41:31Z")
Hello, I have configured LS indexer output as below: output { elasticsearch { host =\> "10.211.10.32" cluster =\> "presit-elasticsearch" node\_name =\> "presit-data-Node-2" index =\> "%{type}-%{+YYYY.MM.dd}" … --- ## [Zabbix plugin is missing](https://discuss.elastic.co/t/zabbix-plugin-is-missing/25020)
**Author:** [@MrAV](https://discuss.elastic.co/u/MrAV)\ **Replies:** 2\ **Last updated:** [July 7, 2015, 9:25am UTC](https://discuss.elastic.co/t/zabbix-plugin-is-missing/25020 "2015-07-07T09:25:59Z")
Hi, Could you please advise how to install logstash-output-zabbix plugin on Linux (RedHat 6.X)? Unfortunately, it's absent in bin/plugin list output. My Logstash version is 1.5.2 bin/plugin list with output plugins i… --- ## [Sort order of files in s3 input](https://discuss.elastic.co/t/sort-order-of-files-in-s3-input/25022)
**Author:** [@karasmeitar](https://discuss.elastic.co/u/karasmeitar)\ **Replies:** 0\ **Last updated:** [July 7, 2015, 9:23am UTC](https://discuss.elastic.co/t/sort-order-of-files-in-s3-input/25022 "2015-07-07T09:23:57Z")
Hi All, it's important to me that logstash will process the files from s3 in specific order. can i control the order? what is the current order that logstash do? created date?update date? 10x. --- ## [NumberFormat Exception no clue to as why (resolved)](https://discuss.elastic.co/t/numberformat-exception-no-clue-to-as-why-resolved/24994)
**Author:** [@eperry](https://discuss.elastic.co/u/eperry)\ **Replies:** 1\ **Last updated:** [July 6, 2015, 10:25pm UTC](https://discuss.elastic.co/t/numberformat-exception-no-clue-to-as-why-resolved/24994 "2015-07-06T22:25:00Z")
Need some help with figuring out why this is an issue. I Was noticing some of my requests are getting dropped by the logstash-output-elasticsearch So I took a HTTP Dump of the and is seems my "process.root" is being… --- ## [Logstash 1.5.1 released](https://discuss.elastic.co/t/logstash-1-5-1-released/23764)
**Author:** [@suyograo](https://discuss.elastic.co/u/suyograo)\ **Replies:** 3\ **Last updated:** [July 6, 2015, 5:56pm UTC](https://discuss.elastic.co/t/logstash-1-5-1-released/23764 "2015-07-06T17:56:04Z")
Logstash 1.5.1 has been released with bug fixes! Please check the blog or changelog for all the details. Download: https://www.elastic.co/downloads/logstash --- ## [Logstash 1.5.2 released](https://discuss.elastic.co/t/logstash-1-5-2-released/24971)
**Author:** [@suyograo](https://discuss.elastic.co/u/suyograo)\ **Replies:** 0\ **Last updated:** [July 6, 2015, 5:53pm UTC](https://discuss.elastic.co/t/logstash-1-5-2-released/24971 "2015-07-06T17:53:38Z")
Logstash 1.5.2 is now available for download. It includes a new http input plugin, bug fix for file input and some performance improvements. Please check the blog or changelog for all the details. --- ## [Logstash not tracking the current position in HP-UNIX](https://discuss.elastic.co/t/logstash-not-tracking-the-current-position-in-hp-unix/24283)
**Author:** [@Kumaravel](https://discuss.elastic.co/u/Kumaravel)\ **Replies:** 4\ **Last updated:** [July 6, 2015, 5:47pm UTC](https://discuss.elastic.co/t/logstash-not-tracking-the-current-position-in-hp-unix/24283 "2015-07-06T17:47:57Z")
Hi, I am still facing issue for tracking the current position of the log file being read. Whenever I restart the logstash agent, it starts reading for the start due to which I am getting duplicate entries in my elastic… --- ## [Logstash new plugin system too restrictive](https://discuss.elastic.co/t/logstash-new-plugin-system-too-restrictive/24247)
**Author:** [@rtoma](https://discuss.elastic.co/u/rtoma)\ **Replies:** 6\ **Last updated:** [July 6, 2015, 5:31pm UTC](https://discuss.elastic.co/t/logstash-new-plugin-system-too-restrictive/24247 "2015-07-06T17:31:40Z")
With 1.5.0RC4 the --pluginpath parameter was dropped, because to paraphrase it was not needed anymore. The new plugin system is well designed, but: It breaks any installation using the pluginpath parameter. Offering… --- ## [Added fields are not displaying](https://discuss.elastic.co/t/added-fields-are-not-displaying/24937)
**Author:** [@sushmithak](https://discuss.elastic.co/u/sushmithak)\ **Replies:** 8\ **Last updated:** [July 6, 2015, 11:20am UTC](https://discuss.elastic.co/t/added-fields-are-not-displaying/24937 "2015-07-06T11:20:03Z")
Hi, I have added some fields like received\_at and received\_from using add\_field in logstash configuration file,but these fields are not displaying anywhere. Where these fields will be displayed.I want these fields to be… --- ## [Grok match pattern](https://discuss.elastic.co/t/grok-match-pattern/24906)
**Author:** [@wstlk](https://discuss.elastic.co/u/wstlk)\ **Replies:** 5\ **Last updated:** [July 6, 2015, 10:29am UTC](https://discuss.elastic.co/t/grok-match-pattern/24906 "2015-07-06T10:29:41Z")
Wondering if I should be applying a (?=subexp) look-ahead match rule but I haven't been able to do so successfully, Basically I need to do a grok match against a.b.c/1/2/A/IN or a.b/1/AA/IN where the setup is something… --- ## [Load config file into logstash](https://discuss.elastic.co/t/load-config-file-into-logstash/24915)
**Author:** [@Smasell](https://discuss.elastic.co/u/Smasell)\ **Replies:** 4\ **Last updated:** [July 6, 2015, 5:53am UTC](https://discuss.elastic.co/t/load-config-file-into-logstash/24915 "2015-07-06T05:53:21Z")
Hi!!! In my config file i have a part: if \[message\] =~ /^Deauthorizing client / { mutate { add\_tag =\> “end\_timer” } noop { add\_field =\> { "event" =\> "deauthorize" }} } if \[message\] =~ /^Logged in/ { … --- ## [CSV file with different record types](https://discuss.elastic.co/t/csv-file-with-different-record-types/24882)
**Author:** [@Khoa\_Nguyen1](https://discuss.elastic.co/u/Khoa_Nguyen1)\ **Replies:** 2\ **Last updated:** [July 3, 2015, 8:27pm UTC](https://discuss.elastic.co/t/csv-file-with-different-record-types/24882 "2015-07-03T20:27:21Z")
Our files are in CSV format but each line can be of a different record type. For example: f1,f2,f3 g1,g2,g3,g4,g5 h1,h2,h3,h4 Record type can be determined by examining the value of the first field. How do I write a … --- ## [Logstash file rotation dead time](https://discuss.elastic.co/t/logstash-file-rotation-dead-time/24885)
**Author:** [@ls\_newb](https://discuss.elastic.co/u/ls_newb)\ **Replies:** 0\ **Last updated:** [July 3, 2015, 6:43pm UTC](https://discuss.elastic.co/t/logstash-file-rotation-dead-time/24885 "2015-07-03T18:43:49Z")
I am using Logstash to read about 30k to 100k events per second using the file input plugin. Every five minutes the existing logs are rotated to a new filename, gzipped, and then deleted. The problem is during file ren… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1252) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1254)