# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1254 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1255 --- ## [Add\_field compatibility problem (upgrade from 1.4.2. to 1.5.2)](https://discuss.elastic.co/t/add-field-compatibility-problem-upgrade-from-1-4-2-to-1-5-2/24878)
**Author:** [@Karel\_Belunek](https://discuss.elastic.co/u/Karel_Belunek)\ **Replies:** 0\ **Last updated:** [July 3, 2015, 4:12pm UTC](https://discuss.elastic.co/t/add-field-compatibility-problem-upgrade-from-1-4-2-to-1-5-2/24878 "2015-07-03T16:12:39Z")
I find out problem with add\_field instruction after upgrade from 1.4.2 to 1.5.2. I use add\_field directive in my stomp input plugin to mark the message with information from with input it arrives in my custom attribute… --- ## [How to extract specific entries matching a pattern to a different file](https://discuss.elastic.co/t/how-to-extract-specific-entries-matching-a-pattern-to-a-different-file/24864)
**Author:** [@cruizpollino](https://discuss.elastic.co/u/cruizpollino)\ **Replies:** 3\ **Last updated:** [July 3, 2015, 2:25pm UTC](https://discuss.elastic.co/t/how-to-extract-specific-entries-matching-a-pattern-to-a-different-file/24864 "2015-07-03T14:25:45Z")
Good morning everyone, I'm starting with logstash and elasticsearch so maybe this is a silly question, if its sorry for make lost your time guys. We've set a central server as the syslogd server and rest of servers a… --- ## [Logstash-Forwarder and Redis](https://discuss.elastic.co/t/logstash-forwarder-and-redis/2702)
**Author:** [@bdunbar](https://discuss.elastic.co/u/bdunbar)\ **Replies:** 7\ **Last updated:** [July 3, 2015, 10:58am UTC](https://discuss.elastic.co/t/logstash-forwarder-and-redis/2702 "2015-07-03T10:58:27Z")
I want to try using Redis with logstash-forwarder, but I'm confused on a point. When forwarder tires to connect it complains about a tls handshake and fails to connect. Can forwarder connect to redis? This post sugg… --- ## [WMI plugin query error: IEnumVARIANT::Next (memory leak?)](https://discuss.elastic.co/t/wmi-plugin-query-error-ienumvariant-next-memory-leak/1417)
**Author:** [@Daniel](https://discuss.elastic.co/u/Daniel)\ **Replies:** 1\ **Last updated:** [July 3, 2015, 9:04am UTC](https://discuss.elastic.co/t/wmi-plugin-query-error-ienumvariant-next-memory-leak/1417 "2015-07-03T09:04:25Z")
Hello, not sure if this is the right place for plugin support but I've encountered a possible memory leak or something that blocks the processing of WMI queries. I've setup my LogStash config on 5 different machines al… --- ## [How does the LogStash collect Windows Event Logs](https://discuss.elastic.co/t/how-does-the-logstash-collect-windows-event-logs/24842)
**Author:** [@mohanguttikonda](https://discuss.elastic.co/u/mohanguttikonda)\ **Replies:** 0\ **Last updated:** [July 3, 2015, 7:17am UTC](https://discuss.elastic.co/t/how-does-the-logstash-collect-windows-event-logs/24842 "2015-07-03T07:17:49Z")
Hi, How does the LogStash collect Windows Event Logs? is it directly reading the .evtx files using WMI or does it depend on any events to receive the windows event logs? logstash.conf input { eventlog { … --- ## [Read old logs in .gz format](https://discuss.elastic.co/t/read-old-logs-in-gz-format/24730)
**Author:** [@simonrisberg](https://discuss.elastic.co/u/simonrisberg)\ **Replies:** 7\ **Last updated:** [July 3, 2015, 6:58am UTC](https://discuss.elastic.co/t/read-old-logs-in-gz-format/24730 "2015-07-03T06:58:07Z")
Hi! I was wondering if it's possible for logstash to read old logs that are in .gz format that are a day old? Best regards --- ## [Custom codec no longer loaded in 1.5.2](https://discuss.elastic.co/t/custom-codec-no-longer-loaded-in-1-5-2/24830)
**Author:** [@fcntl](https://discuss.elastic.co/u/fcntl)\ **Replies:** 0\ **Last updated:** [July 3, 2015, 1:50am UTC](https://discuss.elastic.co/t/custom-codec-no-longer-loaded-in-1-5-2/24830 "2015-07-03T01:50:47Z")
I updates to 1.5.2 and my codec stopped working I was dropping it in another codec dir /opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-codec-json-0.1.7/lib/logstash/codecs/ It worked fine under 1.5.1. Now under 1.5.2… --- ## [How to grok for spanish characters?](https://discuss.elastic.co/t/how-to-grok-for-spanish-characters/24750)
**Author:** [@naisanza](https://discuss.elastic.co/u/naisanza)\ **Replies:** 3\ **Last updated:** [July 2, 2015, 11:51pm UTC](https://discuss.elastic.co/t/how-to-grok-for-spanish-characters/24750 "2015-07-02T23:51:41Z")
Add these characters to your regex: \[ÁÉÍÓÚ-áéíóu-ñÑ\] --- ## [Calculate time length between two logs using timestamp?](https://discuss.elastic.co/t/calculate-time-length-between-two-logs-using-timestamp/24816)
**Author:** [@Smasell](https://discuss.elastic.co/u/Smasell)\ **Replies:** 1\ **Last updated:** [July 2, 2015, 11:31pm UTC](https://discuss.elastic.co/t/calculate-time-length-between-two-logs-using-timestamp/24816 "2015-07-02T23:31:41Z")
Hi!!! I wonder does Logstash provides option to calculate time length between two logs using timestamp? Something like this log2.timestamp - log1.timestamp. --- ## [How to install plugin?](https://discuss.elastic.co/t/how-to-install-plugin/24796)
**Author:** [@Smasell](https://discuss.elastic.co/u/Smasell)\ **Replies:** 1\ **Last updated:** [July 2, 2015, 10:02pm UTC](https://discuss.elastic.co/t/how-to-install-plugin/24796 "2015-07-02T22:02:49Z")
Hi!!! I'm absolutely new in Logstash. And I have a couple of questions: 1. I need to install this plugin https://github.com/logstash-plugins/logstash-filter-aggregate. Tell me please how can I do this? My config file par… --- ## [Elapsed filter and logstash 1.5](https://discuss.elastic.co/t/elapsed-filter-and-logstash-1-5/2232)
**Author:** [@sanaya](https://discuss.elastic.co/u/sanaya)\ **Replies:** 3\ **Last updated:** [July 2, 2015, 9:52pm UTC](https://discuss.elastic.co/t/elapsed-filter-and-logstash-1-5/2232 "2015-07-02T21:52:51Z")
Hello, I'm just getting started with logstash, and I have been using the elapsed filter on version 1.4.2. However, upgrading to version 1.5 the elapsed filter doesn't seem to generate an expired event any more. Is ther… --- ## [Syslog output plugin and dynamic values](https://discuss.elastic.co/t/syslog-output-plugin-and-dynamic-values/24732)
**Author:** [@incogniro](https://discuss.elastic.co/u/incogniro)\ **Replies:** 6\ **Last updated:** [July 2, 2015, 7:44pm UTC](https://discuss.elastic.co/t/syslog-output-plugin-and-dynamic-values/24732 "2015-07-02T19:44:11Z")
Is there a way to use fields with this plugin in much the same ways as the File or Elasticsearch output plugin? The following does not work: syslog { host =\> "10.10.10.1" port =\> 12543 protocol =\> "tcp"… --- ## [Teardown process](https://discuss.elastic.co/t/teardown-process/23949)
**Author:** [@kelvinfann](https://discuss.elastic.co/u/kelvinfann)\ **Replies:** 5\ **Last updated:** [July 2, 2015, 7:01pm UTC](https://discuss.elastic.co/t/teardown-process/23949 "2015-07-02T19:01:12Z")
Hi I was wondering if it was possible to get more information about how logstash processes the teardown. I'd imagine it first tearsdown the input, then filters, then output. If there are messages in the filter queue, do … --- ## [Enclose log-stash output in json array \[ \]](https://discuss.elastic.co/t/enclose-log-stash-output-in-json-array/24553)
**Author:** [@mozowski](https://discuss.elastic.co/u/mozowski)\ **Replies:** 2\ **Last updated:** [July 2, 2015, 2:22pm UTC](https://discuss.elastic.co/t/enclose-log-stash-output-in-json-array/24553 "2015-07-02T14:22:33Z")
Hi, I am in need of sending json on following format (note \[ \] at top level) : \[ { "some\_field" : "some\_value"} \] however what logstash file output logs following: { "some\_field" : "some\_value"} When I try to to use … --- ## [Useragent filter really slow](https://discuss.elastic.co/t/useragent-filter-really-slow/24759)
**Author:** [@Gabriel\_Rosca](https://discuss.elastic.co/u/Gabriel_Rosca)\ **Replies:** 2\ **Last updated:** [July 2, 2015, 1:46pm UTC](https://discuss.elastic.co/t/useragent-filter-really-slow/24759 "2015-07-02T13:46:20Z")
Hello logstash community. I have a problem with useragent filter. It is pailful slow. :(( Works but really slow. Same problem with the cidr filter. If I use the filter I may get maybe 3 events per second if I am luck… --- ## [How to put my logs in different types document?](https://discuss.elastic.co/t/how-to-put-my-logs-in-different-types-document/24774)
**Author:** [@Smasell](https://discuss.elastic.co/u/Smasell)\ **Replies:** 2\ **Last updated:** [July 2, 2015, 12:08pm UTC](https://discuss.elastic.co/t/how-to-put-my-logs-in-different-types-document/24774 "2015-07-02T12:08:16Z")
Hi everybody!!! I have my output in config file: elasticsearch { host =\> "myServer.com" port =\> 9200 index =\> "events” protocol =\> "http" } and I want to direct all logs with message "Logged in" and "Lo… --- ## [Location of custom filters](https://discuss.elastic.co/t/location-of-custom-filters/24700)
**Author:** [@sushmithak](https://discuss.elastic.co/u/sushmithak)\ **Replies:** 10\ **Last updated:** [July 2, 2015, 6:01am UTC](https://discuss.elastic.co/t/location-of-custom-filters/24700 "2015-07-02T06:01:05Z")
Hi, I want to extract required fields from syslog-messages where can i write (exact location) custom filters in logstash. plz provide any examples to write custom filters. -thanks --- ## [Expecting UTF-8 Char set](https://discuss.elastic.co/t/expecting-utf-8-char-set/24583)
**Author:** [@rspangle](https://discuss.elastic.co/u/rspangle)\ **Replies:** 2\ **Last updated:** [July 1, 2015, 10:44pm UTC](https://discuss.elastic.co/t/expecting-utf-8-char-set/24583 "2015-07-01T22:44:41Z")
I have some log entries that are coming in from snare that look ok in the snare.log file, but when looking at the logstash.log, I see a message that says a character set other than UTF-8 was expected, but no indication o… --- ## [Issues with if statement, grok, and mutate](https://discuss.elastic.co/t/issues-with-if-statement-grok-and-mutate/24754)
**Author:** [@naisanza](https://discuss.elastic.co/u/naisanza)\ **Replies:** 0\ **Last updated:** [July 1, 2015, 7:33pm UTC](https://discuss.elastic.co/t/issues-with-if-statement-grok-and-mutate/24754 "2015-07-01T19:33:09Z")
I'm having issues with a conditional statement. I have a grok filter used to parse through a dataset, of which a field named domain will be created. Then, I want a regex conditional to check if that field matches %{HOST} … --- ## [The offset field - what is it?](https://discuss.elastic.co/t/the-offset-field-what-is-it/24752)
**Author:** [@LansK](https://discuss.elastic.co/u/LansK)\ **Replies:** 0\ **Last updated:** [July 1, 2015, 7:17pm UTC](https://discuss.elastic.co/t/the-offset-field-what-is-it/24752 "2015-07-01T19:17:36Z")
For inputs that use the multiline codec, a field is created called “offset” and it is stored in elasticsearch. What is this field represent or is used for? I am guessing it is the location of the first character in the l… --- ## [Kafka(input) + logstash-1.5.1 + elasticsearch 1.5(output) action update?](https://discuss.elastic.co/t/kafka-input-logstash-1-5-1-elasticsearch-1-5-output-action-update/23995)
**Author:** [@Camilo\_Sierra](https://discuss.elastic.co/u/Camilo_Sierra)\ **Replies:** 4\ **Last updated:** [July 1, 2015, 2:17pm UTC](https://discuss.elastic.co/t/kafka-input-logstash-1-5-1-elasticsearch-1-5-output-action-update/23995 "2015-07-01T14:17:52Z")
i need to update documents in my elasticsearch, documentation for "action" speak about index/create/delete, someone has a idea for how update documents using logstash ? thanks! --- ## [Take out bits of a URIPATH in Logstash](https://discuss.elastic.co/t/take-out-bits-of-a-uripath-in-logstash/24597)
**Author:** [@simonrisberg](https://discuss.elastic.co/u/simonrisberg)\ **Replies:** 20\ **Last updated:** [July 1, 2015, 12:40pm UTC](https://discuss.elastic.co/t/take-out-bits-of-a-uripath-in-logstash/24597 "2015-07-01T12:40:46Z")
Hi! My name is Simon and I'm pretty new to ELK. I have been working with it for a few weeks now and I'm starting to understand how everything works (I think?). Back to the point, I am right now using Logstash to read f… --- ## [Wrong Index type set in Logstash](https://discuss.elastic.co/t/wrong-index-type-set-in-logstash/24708)
**Author:** [@gugansankar](https://discuss.elastic.co/u/gugansankar)\ **Replies:** 2\ **Last updated:** [July 1, 2015, 10:44am UTC](https://discuss.elastic.co/t/wrong-index-type-set-in-logstash/24708 "2015-07-01T10:44:58Z")
Not sure , why my Index\_type is set to "json" even I haven't mention this anywhere in my config. Actually, my index\_type would be set to "test\_log" as per the forwarder config. But here, it set to "json". its weird. F… --- ## [How can i specify the end of logs](https://discuss.elastic.co/t/how-can-i-specify-the-end-of-logs/24704)
**Author:** [@oussama](https://discuss.elastic.co/u/oussama)\ **Replies:** 1\ **Last updated:** [July 1, 2015, 10:12am UTC](https://discuss.elastic.co/t/how-can-i-specify-the-end-of-logs/24704 "2015-07-01T10:12:40Z")
0 down vote favorite I wanna know how can i specify the end of logs. this is my logs : message = state:this is a sate,client\_name:user And my match is : match =\> \[ "message", "%{DATA:dataAfterCli… --- ## [Extraction of Log Messages](https://discuss.elastic.co/t/extraction-of-log-messages/24694)
**Author:** [@praveench](https://discuss.elastic.co/u/praveench)\ **Replies:** 1\ **Last updated:** [July 1, 2015, 9:54am UTC](https://discuss.elastic.co/t/extraction-of-log-messages/24694 "2015-07-01T09:54:25Z")
where and how to write the custom filters to extract required fields in syslog message: please anyone suggest me where and how to write extraction logic,and where the default filters in logstash are located -thanks --- ## [Where does logstash store the log files that it has read](https://discuss.elastic.co/t/where-does-logstash-store-the-log-files-that-it-has-read/24695)
**Author:** [@simonrisberg](https://discuss.elastic.co/u/simonrisberg)\ **Replies:** 3\ **Last updated:** [July 1, 2015, 9:52am UTC](https://discuss.elastic.co/t/where-does-logstash-store-the-log-files-that-it-has-read/24695 "2015-07-01T09:52:28Z")
Hi! I was wondering where Logstash is storing the log files that it has read and indexed. I was reading up a little on github and apparently the default folder for this is var/log/syslog but when I jump into the log fo… --- ## [How to configure Logstash and develop our own Input](https://discuss.elastic.co/t/how-to-configure-logstash-and-develop-our-own-input/24644)
**Author:** [@ChiBiPonD](https://discuss.elastic.co/u/ChiBiPonD)\ **Replies:** 1\ **Last updated:** [July 1, 2015, 9:25am UTC](https://discuss.elastic.co/t/how-to-configure-logstash-and-develop-our-own-input/24644 "2015-07-01T09:25:19Z")
I have set up 3 master nodes with Elastisearch installed. I want to achieve storing ~600KHz to Elasticsearch. Some people had suggested me to have a look on Logstash. However, I have no idea how to configure it. What is … --- ## [Extract strings from one field](https://discuss.elastic.co/t/extract-strings-from-one-field/24637)
**Author:** [@DavidL](https://discuss.elastic.co/u/DavidL)\ **Replies:** 2\ **Last updated:** [June 30, 2015, 10:08pm UTC](https://discuss.elastic.co/t/extract-strings-from-one-field/24637 "2015-06-30T22:08:45Z")
After successfully parsing out this field from my log files, I want to extract information from this field and store it as a separate field, I looked through lots of the filters and didn't find one that serves this purpo… --- ## [How do I set a field type using grok?](https://discuss.elastic.co/t/how-do-i-set-a-field-type-using-grok/24662)
**Author:** [@naisanza](https://discuss.elastic.co/u/naisanza)\ **Replies:** 3\ **Last updated:** [June 30, 2015, 9:24pm UTC](https://discuss.elastic.co/t/how-do-i-set-a-field-type-using-grok/24662 "2015-06-30T21:24:02Z")
I know that %{NUMBER:field:integer} works, actually I think this works, too: %{NUMBER:field:int} I use the grok filter heavily and would like to know if I can set the field type in a custom pattern without needing to u… --- ## [How to set field type to "ip"?](https://discuss.elastic.co/t/how-to-set-field-type-to-ip/24659)
**Author:** [@naisanza](https://discuss.elastic.co/u/naisanza)\ **Replies:** 2\ **Last updated:** [June 30, 2015, 9:07pm UTC](https://discuss.elastic.co/t/how-to-set-field-type-to-ip/24659 "2015-06-30T21:07:44Z")
I've used the date filter to set a target field as a date type. I don't see a filter to set a target field type to "ip". I'm looking to do this so I can use the IPv4 Range Aggregation, but haven't been able to find th… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1253) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1255)