# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1255 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1256 --- ## [Tcp input writing too much data in log](https://discuss.elastic.co/t/tcp-input-writing-too-much-data-in-log/24594)
**Author:** [@Wurzelmann](https://discuss.elastic.co/u/Wurzelmann)\ **Replies:** 7\ **Last updated:** [June 30, 2015, 9:05pm UTC](https://discuss.elastic.co/t/tcp-input-writing-too-much-data-in-log/24594 "2015-06-30T21:05:18Z")
I started using four tcp inputs simultaneously and I noticed the logs (var/log/logstash/logstash.log) getting bigger and bigger since then. My log is around 28 GB currently, because everything logstash outputs to elastic… --- ## [Index files from a directory that has new file every minute](https://discuss.elastic.co/t/index-files-from-a-directory-that-has-new-file-every-minute/24658)
**Author:** [@vgupta](https://discuss.elastic.co/u/vgupta)\ **Replies:** 1\ **Last updated:** [June 30, 2015, 8:40pm UTC](https://discuss.elastic.co/t/index-files-from-a-directory-that-has-new-file-every-minute/24658 "2015-06-30T20:40:36Z")
Hi I need to index files from directory where new logs files are written every minute. What will be the best solution? thanks Vinay --- ## [Time format for creating time-based indices](https://discuss.elastic.co/t/time-format-for-creating-time-based-indices/24636)
**Author:** [@GordonM](https://discuss.elastic.co/u/GordonM)\ **Replies:** 2\ **Last updated:** [June 30, 2015, 5:31pm UTC](https://discuss.elastic.co/t/time-format-for-creating-time-based-indices/24636 "2015-06-30T17:31:52Z")
Where can I find the documentation on how to set my own date formats for time-based indices such as the default format of logstash-%{+YYYY.MM.dd}? I just want to know the proper syntax here. logstash-%{+xxxx.ww} is also … --- ## [How to index multiple files of different extensions using the same .config file](https://discuss.elastic.co/t/how-to-index-multiple-files-of-different-extensions-using-the-same-config-file/24618)
**Author:** [@PavanRGowda](https://discuss.elastic.co/u/PavanRGowda)\ **Replies:** 5\ **Last updated:** [June 30, 2015, 1:15pm UTC](https://discuss.elastic.co/t/how-to-index-multiple-files-of-different-extensions-using-the-same-config-file/24618 "2015-06-30T13:15:04Z")
I have two files with .xlsx and .csv extensions. I want to index both the files into elasticsearch using the same .config file. The problem is in the filter section as the separator for both the files varies. Is there an… --- ## [Logstash - File Input - Read Status File](https://discuss.elastic.co/t/logstash-file-input-read-status-file/24408)
**Author:** [@Florian\_Tieben](https://discuss.elastic.co/u/Florian_Tieben)\ **Replies:** 1\ **Last updated:** [June 30, 2015, 9:39am UTC](https://discuss.elastic.co/t/logstash-file-input-read-status-file/24408 "2015-06-30T09:39:43Z")
Hallo there, I'm trying to read a status csv file with the file input plugin. This file has just one line and is rewritten every 5 Minutes. Example: 0,0,0,0,2453,2453,0,0 The configlines: file { path =\> "/p… --- ## [Template creates file.file.raw, message.message.raw etc](https://discuss.elastic.co/t/template-creates-file-file-raw-message-message-raw-etc/24575)
**Author:** [@Mike\_4](https://discuss.elastic.co/u/Mike_4)\ **Replies:** 0\ **Last updated:** [June 29, 2015, 8:57pm UTC](https://discuss.elastic.co/t/template-creates-file-file-raw-message-message-raw-etc/24575 "2015-06-29T20:57:31Z")
hi, i want to set fields of a specific index to "not\_analyzed". I took https://github.com/logstash-plugins/logstash-output-elasticsearch/blob/master/lib/logstash/outputs/elasticsearch/elasticsearch-template.json chan… --- ## [Integer precision lost when inserting into elasticsearch?](https://discuss.elastic.co/t/integer-precision-lost-when-inserting-into-elasticsearch/24539)
**Author:** [@Marcin\_K](https://discuss.elastic.co/u/Marcin_K)\ **Replies:** 2\ **Last updated:** [June 30, 2015, 8:59am UTC](https://discuss.elastic.co/t/integer-precision-lost-when-inserting-into-elasticsearch/24539 "2015-06-30T08:59:42Z")
Hello, I've got logstash (1.4.2) inserting data to ES (1.5.2) Here's a sample command that I'm running echo "ID: 1029713618753128208" | /opt/logstash/bin/logstash -e 'input { stdin {} } filter { grok { match =\> \["… --- ## [Logstash using not\_analyzed not working](https://discuss.elastic.co/t/logstash-using-not-analyzed-not-working/24533)
**Author:** [@JeroenvdV](https://discuss.elastic.co/u/JeroenvdV)\ **Replies:** 5\ **Last updated:** [June 30, 2015, 8:48am UTC](https://discuss.elastic.co/t/logstash-using-not-analyzed-not-working/24533 "2015-06-30T08:48:57Z")
I am a total newby to the ELK stack and probably trying to setup a much to complicated config to start with... \[smile\] I am running the whole stack on a windows 7 laptop. and I am importing a CSV which goes well but I … --- ## [Plugin for custom log post to logstash](https://discuss.elastic.co/t/plugin-for-custom-log-post-to-logstash/24607)
**Author:** [@gugansankar](https://discuss.elastic.co/u/gugansankar)\ **Replies:** 1\ **Last updated:** [June 30, 2015, 7:54am UTC](https://discuss.elastic.co/t/plugin-for-custom-log-post-to-logstash/24607 "2015-06-30T07:54:19Z")
I would like to post my data to my logstash server. I couldn't find any link for that. Someone please share your thoughts. --- ## [Read error looking for ack: read tcp x.x.x.x:8080 i/o timeout](https://discuss.elastic.co/t/read-error-looking-for-ack-read-tcp-x-x-x-x-8080-i-o-timeout/24226)
**Author:** [@gugansankar](https://discuss.elastic.co/u/gugansankar)\ **Replies:** 7\ **Last updated:** [June 29, 2015, 7:51am UTC](https://discuss.elastic.co/t/read-error-looking-for-ack-read-tcp-x-x-x-x-8080-i-o-timeout/24226 "2015-06-29T07:51:39Z")
I'm getting this error message on Logstash-Forwarder. Since the logs are not sent to Logstash-Server. I have cross verified the Network connection. There is no blocking / Disturbance in Network \[ Firewall, Server iptable… --- ## [Can we pass on file path=\> as a command line argument](https://discuss.elastic.co/t/can-we-pass-on-file-path-as-a-command-line-argument/24595)
**Author:** [@Saket\_Kumar](https://discuss.elastic.co/u/Saket_Kumar)\ **Replies:** 2\ **Last updated:** [June 30, 2015, 6:12am UTC](https://discuss.elastic.co/t/can-we-pass-on-file-path-as-a-command-line-argument/24595 "2015-06-30T06:12:48Z")
./bin/logstash -f logstash.conf -path /a/b/\*.csv --- ## [Usage of logstash metrics to compute the number of my logs/events](https://discuss.elastic.co/t/usage-of-logstash-metrics-to-compute-the-number-of-my-logs-events/24399)
**Author:** [@shsantos](https://discuss.elastic.co/u/shsantos)\ **Replies:** 0\ **Last updated:** [June 26, 2015, 5:27am UTC](https://discuss.elastic.co/t/usage-of-logstash-metrics-to-compute-the-number-of-my-logs-events/24399 "2015-06-26T05:27:06Z")
Hi, We are using the generator plugin to get the events.rate\_1m/logs.rate\_1m metrics and trying to send it to statsd through the statsd plugin. The rate that we see is too high as show in the screenshot below and gives … --- ## [How to process heterogeneous logs in one log file](https://discuss.elastic.co/t/how-to-process-heterogeneous-logs-in-one-log-file/24560)
**Author:** [@DavidL](https://discuss.elastic.co/u/DavidL)\ **Replies:** 3\ **Last updated:** [June 30, 2015, 3:33am UTC](https://discuss.elastic.co/t/how-to-process-heterogeneous-logs-in-one-log-file/24560 "2015-06-30T03:33:11Z")
So the software we are using generate log files in different format and throw everthing in one big log file, so I am dealing with this one big log file with different types of logs, they all share the first couple fields… --- ## [Reading a log file into Logstash](https://discuss.elastic.co/t/reading-a-log-file-into-logstash/24514)
**Author:** [@gruszeckim2](https://discuss.elastic.co/u/gruszeckim2)\ **Replies:** 8\ **Last updated:** [June 30, 2015, 3:28am UTC](https://discuss.elastic.co/t/reading-a-log-file-into-logstash/24514 "2015-06-30T03:28:25Z")
I'm new to logstash/elasticsearch and am trying to teach myself how to use them. I've written a config file to read a file into logstash and then forward it to elasticsearch and, for the life of me, logstash never seems … --- ## [Stdout timestamp in logstash](https://discuss.elastic.co/t/stdout-timestamp-in-logstash/24551)
**Author:** [@Lee\_PS](https://discuss.elastic.co/u/Lee_PS)\ **Replies:** 3\ **Last updated:** [June 29, 2015, 1:45pm UTC](https://discuss.elastic.co/t/stdout-timestamp-in-logstash/24551 "2015-06-29T13:45:58Z")
Hi I would like to know about the timestamp for the logstash output simple conf file input { stdin {}} output { stdout { codec =\> rubydebug } } \[lee@server1 logstash-1.5.0\]$ bin/logstash -f logstash-simple.co… --- ## [How i can parse weblogic log file to logstash in windows :](https://discuss.elastic.co/t/how-i-can-parse-weblogic-log-file-to-logstash-in-windows/24450)
**Author:** [@Tariq\_Turabi](https://discuss.elastic.co/u/Tariq_Turabi)\ **Replies:** 4\ **Last updated:** [June 29, 2015, 1:31pm UTC](https://discuss.elastic.co/t/how-i-can-parse-weblogic-log-file-to-logstash-in-windows/24450 "2015-06-29T13:31:59Z")
i am using logstash in windows 7 and now i need to parse weblogic log file to logstash ,any help ? thank you. --- ## [Problems getting started ELK centos7](https://discuss.elastic.co/t/problems-getting-started-elk-centos7/24233)
**Author:** [@eheb](https://discuss.elastic.co/u/eheb)\ **Replies:** 6\ **Last updated:** [June 29, 2015, 12:39pm UTC](https://discuss.elastic.co/t/problems-getting-started-elk-centos7/24233 "2015-06-29T12:39:13Z")
I am on centos7 minima version on a vm virtualbox, @IP=10.82.136.52 in local network. I have no public IP 192.168.xxx, no FQDN. I install all ELK on this server with default config but not ngnix, - elasticsearch wget htt… --- ## [Getting data out of ELK and into Syslog](https://discuss.elastic.co/t/getting-data-out-of-elk-and-into-syslog/24547)
**Author:** [@srowles](https://discuss.elastic.co/u/srowles)\ **Replies:** 2\ **Last updated:** [June 29, 2015, 12:50pm UTC](https://discuss.elastic.co/t/getting-data-out-of-elk-and-into-syslog/24547 "2015-06-29T12:50:17Z")
Hi know this might sounds like a bit of a strange request, but I have an existing application that is designed to digest logs received via rsyslog. It's a 3rd party provided app so I have no control over it and can't c… --- ## [Issue on collectd setup!](https://discuss.elastic.co/t/issue-on-collectd-setup/24483)
**Author:** [@gugansankar](https://discuss.elastic.co/u/gugansankar)\ **Replies:** 5\ **Last updated:** [June 29, 2015, 9:41am UTC](https://discuss.elastic.co/t/issue-on-collectd-setup/24483 "2015-06-29T09:41:18Z")
Tried to setup collectd to push my network related stuff to Logstash/Elasticsearch and Kibana. Collectd is pushing logs to logstash. I have verified that by set output to stdout{} option. But when I redirect the outpu… --- ## [Read just the new logs, and stop generation syslog automaticly](https://discuss.elastic.co/t/read-just-the-new-logs-and-stop-generation-syslog-automaticly/2773)
**Author:** [@oussama](https://discuss.elastic.co/u/oussama)\ **Replies:** 12\ **Last updated:** [June 29, 2015, 6:46am UTC](https://discuss.elastic.co/t/read-just-the-new-logs-and-stop-generation-syslog-automaticly/2773 "2015-06-29T06:46:55Z")
Hi, i am using the last versions of logstash, kibana and elasticsearch In fact i have two problem, and i hope that you can help me the first problem is that if i add an other log in access.log, the logstash re… --- ## [Date filter question - what happens if two formats match?](https://discuss.elastic.co/t/date-filter-question-what-happens-if-two-formats-match/24509)
**Author:** [@GordonM](https://discuss.elastic.co/u/GordonM)\ **Replies:** 2\ **Last updated:** [June 28, 2015, 11:24pm UTC](https://discuss.elastic.co/t/date-filter-question-what-happens-if-two-formats-match/24509 "2015-06-28T23:24:57Z")
If date {} ‘s match method is used, and multiple formats are supplied to match against, what happens if more than one format matches? Does it just use the first match made, the last match made, or something else? date … --- ## [Grep in logstash](https://discuss.elastic.co/t/grep-in-logstash/24510)
**Author:** [@Lee\_PS](https://discuss.elastic.co/u/Lee_PS)\ **Replies:** 1\ **Last updated:** [June 28, 2015, 5:54pm UTC](https://discuss.elastic.co/t/grep-in-logstash/24510 "2015-06-28T17:54:47Z")
Hi I am using grep in conf . while i am doing the test am getting the following error \[lee@server1 logstash-1.5.0\]$ bin/logstash -f test4.conf --configtest The error reported is: Couldn't find any filter plugin named … --- ## [Logstash for Facebook Post Searches](https://discuss.elastic.co/t/logstash-for-facebook-post-searches/24504)
**Author:** [@abaykal](https://discuss.elastic.co/u/abaykal)\ **Replies:** 1\ **Last updated:** [June 28, 2015, 2:15pm UTC](https://discuss.elastic.co/t/logstash-for-facebook-post-searches/24504 "2015-06-28T14:15:06Z")
Has anyone figured out how to search and pull in facebook posts into ES using logstash? any examples? Thanks --- ## [Change logstash logs and temp location](https://discuss.elastic.co/t/change-logstash-logs-and-temp-location/24494)
**Author:** [@karasmeitar](https://discuss.elastic.co/u/karasmeitar)\ **Replies:** 5\ **Last updated:** [June 28, 2015, 7:09am UTC](https://discuss.elastic.co/t/change-logstash-logs-and-temp-location/24494 "2015-06-28T07:09:23Z")
Hi all, I install logstash on ubunto as a service and i want to change the logs location and the location of the temp folder(were logsrash save the files before execute). How can i do it? --- ## [LS 1.5.1: Split json including arrays](https://discuss.elastic.co/t/ls-1-5-1-split-json-including-arrays/24449)
**Author:** [@gefa](https://discuss.elastic.co/u/gefa)\ **Replies:** 0\ **Last updated:** [June 26, 2015, 5:41pm UTC](https://discuss.elastic.co/t/ls-1-5-1-split-json-including-arrays/24449 "2015-06-26T17:41:46Z")
Hi all, My used software: Debian 8.1 logstash 1:1.5.1-1, installed via the provided .deb java version "1.8.0\_45" from the Oracle website What I would like to achieve: I've got some logs in json format which includes… --- ## [Deleting indices does not give back disk space](https://discuss.elastic.co/t/deleting-indices-does-not-give-back-disk-space/24251)
**Author:** [@jayem](https://discuss.elastic.co/u/jayem)\ **Replies:** 1\ **Last updated:** [June 26, 2015, 11:25pm UTC](https://discuss.elastic.co/t/deleting-indices-does-not-give-back-disk-space/24251 "2015-06-26T23:25:24Z")
hi all We are running, Logstash, Elastic Search and Kibana all on the same server. We use it to review log/alert data. We only care about the last 7 days worth of data. As our hard disk is starting to fill up I'd li… --- ## [Batching HTTP output](https://discuss.elastic.co/t/batching-http-output/24370)
**Author:** [@cfili](https://discuss.elastic.co/u/cfili)\ **Replies:** 1\ **Last updated:** [June 26, 2015, 11:24pm UTC](https://discuss.elastic.co/t/batching-http-output/24370 "2015-06-26T23:24:56Z")
Is there a way to batch events on a set interval using the HTTP output plugin? I want to limit the rate at which the Logstash agent is sending messages to my HTTP end point. Ideally, I'd want it to batch all events int… --- ## [How to read SQL Server log trace?](https://discuss.elastic.co/t/how-to-read-sql-server-log-trace/24429)
**Author:** [@Zanatto](https://discuss.elastic.co/u/Zanatto)\ **Replies:** 1\ **Last updated:** [June 26, 2015, 11:19pm UTC](https://discuss.elastic.co/t/how-to-read-sql-server-log-trace/24429 "2015-06-26T23:19:24Z")
I would like to know if have any pluging in logstash for this task. If not, what do you suggest? --- ## [Deleting log entry without knowing index name](https://discuss.elastic.co/t/deleting-log-entry-without-knowing-index-name/24468)
**Author:** [@karasmeitar](https://discuss.elastic.co/u/karasmeitar)\ **Replies:** 2\ **Last updated:** [June 26, 2015, 11:07pm UTC](https://discuss.elastic.co/t/deleting-log-entry-without-knowing-index-name/24468 "2015-06-26T23:07:37Z")
Hi All, I'm creating indexes base on the current day in elasticsearch using logstash. But i'm having a problem now deleting a specific log entry because i don't know the index name(i don't know when he was created). can … --- ## [\[SOLVED and THX\]"ISO8601" in date filter](https://discuss.elastic.co/t/solved-and-thx-iso8601-in-date-filter/24442)
**Author:** [@DavidL](https://discuss.elastic.co/u/DavidL)\ **Replies:** 0\ **Last updated:** [June 26, 2015, 4:26pm UTC](https://discuss.elastic.co/t/solved-and-thx-iso8601-in-date-filter/24442 "2015-06-26T16:26:01Z")
I am working with a log that have two individual fields for time and timezone offset (tab separated) like the following: 2014-12-14 23:59:40.227 -8 I was able to use mutate and add\_field to make them into one new fie… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1254) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1256)