# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1256 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1257 --- ## [\_id as a consistent hash to avoid duplication with replays](https://discuss.elastic.co/t/-id-as-a-consistent-hash-to-avoid-duplication-with-replays/24411)
**Author:** [@tomr](https://discuss.elastic.co/u/tomr)\ **Replies:** 1\ **Last updated:** [June 26, 2015, 11:10am UTC](https://discuss.elastic.co/t/-id-as-a-consistent-hash-to-avoid-duplication-with-replays/24411 "2015-06-26T11:10:30Z")
Hi All, I'm trying to create a situation where I have the option of replaying logs with zero risk of duplication. It seems to me that a good way to do that would be to make a field, possibly UUID or \_id, be a consiste… --- ## [Logstash with Shield : Failed action with response of 404](https://discuss.elastic.co/t/logstash-with-shield-failed-action-with-response-of-404/24113)
**Author:** [@marjolaine](https://discuss.elastic.co/u/marjolaine)\ **Replies:** 9\ **Last updated:** [June 26, 2015, 7:14am UTC](https://discuss.elastic.co/t/logstash-with-shield-failed-action-with-response-of-404/24113 "2015-06-26T07:14:02Z")
Hello, I have installed Elasticsearsh 1.4.4, Shield 1.1.1, Logstash 1.5.1. I put this configuration for Logstash in /etc/logstash/conf.d/log.conf input { stdin {} } output { stdout { codec =\> rubydebug } … --- ## [Logstash integrate with Elasticsearch](https://discuss.elastic.co/t/logstash-integrate-with-elasticsearch/24361)
**Author:** [@kumarhanu](https://discuss.elastic.co/u/kumarhanu)\ **Replies:** 5\ **Last updated:** [June 26, 2015, 5:32am UTC](https://discuss.elastic.co/t/logstash-integrate-with-elasticsearch/24361 "2015-06-26T05:32:44Z")
Trying to send output to elasticsearch from logstash is not working in windows. elasticsearch is running on it default port. Both are latest versions. logstash -e 'input { stdin {} } output { elasticsearch { host =\> "l… --- ## [Create new event in logstash filter](https://discuss.elastic.co/t/create-new-event-in-logstash-filter/24375)
**Author:** [@Andrej\_Kurocenko](https://discuss.elastic.co/u/Andrej_Kurocenko)\ **Replies:** 1\ **Last updated:** [June 26, 2015, 5:02am UTC](https://discuss.elastic.co/t/create-new-event-in-logstash-filter/24375 "2015-06-26T05:02:36Z")
Hello, when processing particular events by filters i would like sometimes to create new event with one attribute same as in original event (and store this new event into other elastic search index for further terms lo… --- ## [SSL client certs allowed, but lumberjack-input doesn't seem to validate them?](https://discuss.elastic.co/t/ssl-client-certs-allowed-but-lumberjack-input-doesnt-seem-to-validate-them/23946)
**Author:** [@finn](https://discuss.elastic.co/u/finn)\ **Replies:** 2\ **Last updated:** [June 26, 2015, 12:01am UTC](https://discuss.elastic.co/t/ssl-client-certs-allowed-but-lumberjack-input-doesnt-seem-to-validate-them/23946 "2015-06-26T00:01:30Z")
First off, not sure if this would fit better in the main logstash forum, as it's about the input plugin which doesn't seem to technically be part of logstash-forwarder. So, logstash-forwarder allows me to specify SSL… --- ## [What I have choose instead Sense](https://discuss.elastic.co/t/what-i-have-choose-instead-sense/24331)
**Author:** [@Smasell](https://discuss.elastic.co/u/Smasell)\ **Replies:** 3\ **Last updated:** [June 25, 2015, 9:45pm UTC](https://discuss.elastic.co/t/what-i-have-choose-instead-sense/24331 "2015-06-25T21:45:31Z")
Hi everyone! I use Sense to create my requests, and I like it. But it has not support aggregations. What do you recommend for me with aggregations? --- ## [Logstash. Get fields by position number](https://discuss.elastic.co/t/logstash-get-fields-by-position-number/2775)
**Author:** [@Paul\_Letski](https://discuss.elastic.co/u/Paul_Letski)\ **Replies:** 3\ **Last updated:** [June 25, 2015, 7:31pm UTC](https://discuss.elastic.co/t/logstash-get-fields-by-position-number/2775 "2015-06-25T19:31:54Z")
Background I have the scheme: logs from my app go through rsyslog to central log server, then to Logstash and Elasticsearch. Logs from app is a pure JSON, but rsyslog adds to log "timestamp", "app name" and "server nam… --- ## [Reading logstash's own log file with logstash](https://discuss.elastic.co/t/reading-logstashs-own-log-file-with-logstash/23828)
**Author:** [@MaxS](https://discuss.elastic.co/u/MaxS)\ **Replies:** 4\ **Last updated:** [June 25, 2015, 7:26pm UTC](https://discuss.elastic.co/t/reading-logstashs-own-log-file-with-logstash/23828 "2015-06-25T19:26:59Z")
Hi, I'd like to read and parse logstash's own log file with logstash. Does anyone have a grok pattern or config to do this? I'm surprised this isn't an out of the box feature! Cheers, Max --- ## [Facebook input for logstash](https://discuss.elastic.co/t/facebook-input-for-logstash/23965)
**Author:** [@Dan](https://discuss.elastic.co/u/Dan)\ **Replies:** 1\ **Last updated:** [June 25, 2015, 7:22pm UTC](https://discuss.elastic.co/t/facebook-input-for-logstash/23965 "2015-06-25T19:22:47Z")
Hi All, Is their any input api available to import facebook data to elastic search?? Please give me step by step procedure to get data from facebook to logstash. Thanks, Dan --- ## [Logstash error messages - Got error to send bulk of actions AND Failed to flush outgoing items](https://discuss.elastic.co/t/logstash-error-messages-got-error-to-send-bulk-of-actions-and-failed-to-flush-outgoing-items/24215)
**Author:** [@levi\_oc](https://discuss.elastic.co/u/levi_oc)\ **Replies:** 2\ **Last updated:** [June 25, 2015, 4:25pm UTC](https://discuss.elastic.co/t/logstash-error-messages-got-error-to-send-bulk-of-actions-and-failed-to-flush-outgoing-items/24215 "2015-06-25T16:25:47Z")
I see what looks like most if not all of my logs displayed in kibana but I keep getting these messages logged in /var/log/logstash/logstash.log {:timestamp=\>"2015-06-23T13:07:02.632000-0700", :message=\>"Got error to se… --- ## [Multiline Gets Cutoff For No Reason (so strange)](https://discuss.elastic.co/t/multiline-gets-cutoff-for-no-reason-so-strange/24112)
**Author:** [@michaellizhou](https://discuss.elastic.co/u/michaellizhou)\ **Replies:** 4\ **Last updated:** [June 25, 2015, 1:17pm UTC](https://discuss.elastic.co/t/multiline-gets-cutoff-for-no-reason-so-strange/24112 "2015-06-25T13:17:02Z")
So I currently have about 3-5 log files that have multiline in them which is normal. I usually start parsing them 1 file at a time in separate logstash instances and everything runs great no grokparsefailures. The proble… --- ## [Elastic search version for logstash 1.5.1](https://discuss.elastic.co/t/elastic-search-version-for-logstash-1-5-1/24276)
**Author:** [@ajazam](https://discuss.elastic.co/u/ajazam)\ **Replies:** 4\ **Last updated:** [June 25, 2015, 1:15pm UTC](https://discuss.elastic.co/t/elastic-search-version-for-logstash-1-5-1/24276 "2015-06-25T13:15:45Z")
Hello, Is it possible to use elastic search version 1.5.2 with logstash 1.5.1? --- ## [Dynamic path indexing](https://discuss.elastic.co/t/dynamic-path-indexing/24203)
**Author:** [@german23](https://discuss.elastic.co/u/german23)\ **Replies:** 6\ **Last updated:** [June 25, 2015, 9:50am UTC](https://discuss.elastic.co/t/dynamic-path-indexing/24203 "2015-06-25T09:50:55Z")
hi guys, in windows event logs there are quite often paths like C:\\Program Files (x86)\\java\\java\\jre1.8\_45\\bin\\java.exe I wonder if it is possible to index every part of the path in separate fields like: path1:C: pa… --- ## ["hash=event\['field'\].to\_hash" instead "hash = event.to\_hash"](https://discuss.elastic.co/t/hash-event-field-to-hash-instead-hash-event-to-hash/24169)
**Author:** [@Saket\_Kumar](https://discuss.elastic.co/u/Saket_Kumar)\ **Replies:** 15\ **Last updated:** [June 25, 2015, 6:06am UTC](https://discuss.elastic.co/t/hash-event-field-to-hash-instead-hash-event-to-hash/24169 "2015-06-25T06:06:03Z")
Is it possible... I want to traverse through events against specific field. something like: hash = event\['field1'\].to\_hash hash.each { |event\['field1'\], v| puts event\['field1'\] if v == hash.values.max } Any help? --- ## [Problem of plugin logstash-input-imap](https://discuss.elastic.co/t/problem-of-plugin-logstash-input-imap/24155)
**Author:** [@Penny\_Lee](https://discuss.elastic.co/u/Penny_Lee)\ **Replies:** 3\ **Last updated:** [June 25, 2015, 1:36am UTC](https://discuss.elastic.co/t/problem-of-plugin-logstash-input-imap/24155 "2015-06-25T01:36:56Z")
Hi, I was doing the email input to logstash using plugin input imap. \[https://github.com/logstash-plugins/logstash-input-imap\]\[1\] input { imap { type =\> mail … --- ## [Logstash 1.5.1 not working in HP Unix](https://discuss.elastic.co/t/logstash-1-5-1-not-working-in-hp-unix/24284)
**Author:** [@Kumaravel](https://discuss.elastic.co/u/Kumaravel)\ **Replies:** 2\ **Last updated:** [June 25, 2015, 1:29am UTC](https://discuss.elastic.co/t/logstash-1-5-1-not-working-in-hp-unix/24284 "2015-06-25T01:29:26Z")
I am trying to use logstash 1.5.1 on a hp unix system, but I am getting the error no bash found. But the older logstash runs fine on the same system with a problem of no cursor maintained for the log file due which I r… --- ## [Elasticsearch output does not support parent-child indexing](https://discuss.elastic.co/t/elasticsearch-output-does-not-support-parent-child-indexing/1669)
**Author:** [@sumithub](https://discuss.elastic.co/u/sumithub)\ **Replies:** 2\ **Last updated:** [June 24, 2015, 8:54pm UTC](https://discuss.elastic.co/t/elasticsearch-output-does-not-support-parent-child-indexing/1669 "2015-06-24T20:54:39Z")
Hello, This issue is already opened in git https://github.com/logstash-plugins/logstash-output-elasticsearch/issues/129 I'm facing the issue while indexing child docs. I tried the code as mentioned by Vordoom in abov… --- ## [Problem with Logstash, don't start getting message "Exception in lumberjack input"](https://discuss.elastic.co/t/problem-with-logstash-dont-start-getting-message-exception-in-lumberjack-input/24214)
**Author:** [@fabiotoy](https://discuss.elastic.co/u/fabiotoy)\ **Replies:** 3\ **Last updated:** [June 24, 2015, 7:34pm UTC](https://discuss.elastic.co/t/problem-with-logstash-dont-start-getting-message-exception-in-lumberjack-input/24214 "2015-06-24T19:34:47Z")
Hi guys I´m having problem with logstash. I am using: elasticsearch-1.5.2-1.noarch logstash-1.5.1-1.noarch logstash-forwarder-0.4.0-1.x86\_64 and CentOs 7x. I have 3 files as config in logstash/conf.d/ 01-lumberjack-inp… --- ## [Logstash closes after reading ES index](https://discuss.elastic.co/t/logstash-closes-after-reading-es-index/24114)
**Author:** [@vilas](https://discuss.elastic.co/u/vilas)\ **Replies:** 4\ **Last updated:** [June 24, 2015, 6:53pm UTC](https://discuss.elastic.co/t/logstash-closes-after-reading-es-index/24114 "2015-06-24T18:53:46Z")
Hi, I am trying to read an ES index. But I observe that Logstash closes immediately after reading the ES index. But I would like Logstash to wait for new records into ES. Is it the common behavior with ES as input to L… --- ## [Logstash eating logs](https://discuss.elastic.co/t/logstash-eating-logs/23925)
**Author:** [@achechen](https://discuss.elastic.co/u/achechen)\ **Replies:** 0\ **Last updated:** [June 18, 2015, 2:49pm UTC](https://discuss.elastic.co/t/logstash-eating-logs/23925 "2015-06-18T14:49:05Z")
Hello there, I have a 2 node logstash cluster receiving 3000 messages per second on average. I have just noticed that it is not processing all the messages it receives - they are lost somewhere (UDP packets are coming … --- ## [Logstash filter plugin patterns-core](https://discuss.elastic.co/t/logstash-filter-plugin-patterns-core/23900)
**Author:** [@Penny\_Lee](https://discuss.elastic.co/u/Penny_Lee)\ **Replies:** 1\ **Last updated:** [June 24, 2015, 9:49am UTC](https://discuss.elastic.co/t/logstash-filter-plugin-patterns-core/23900 "2015-06-24T09:49:30Z")
Hi \[grin\] I installed the logstash-plugins/logstash-patterns-core to the /opt/logstash/vendor/bundle/jruby/1.9/gems/logstash-patterns-core-0.1.10/ The pattern I tested it work on the http://grokconstructor.appspot.com/… --- ## [Metrics Output Issue](https://discuss.elastic.co/t/metrics-output-issue/24248)
**Author:** [@gromit](https://discuss.elastic.co/u/gromit)\ **Replies:** 0\ **Last updated:** [June 24, 2015, 9:31am UTC](https://discuss.elastic.co/t/metrics-output-issue/24248 "2015-06-24T09:31:42Z")
I'm using Logstash 1.5.1 with the latest metrics plugin. At the end of the filters section I have the following get metrics for windows accounts lockouts: if \[EventID\] == 4740 { metrics { meter =\> "lockouts" … --- ## [Help for new logstash filter : docker metadata](https://discuss.elastic.co/t/help-for-new-logstash-filter-docker-metadata/24237)
**Author:** [@tgermain](https://discuss.elastic.co/u/tgermain)\ **Replies:** 0\ **Last updated:** [June 24, 2015, 7:16am UTC](https://discuss.elastic.co/t/help-for-new-logstash-filter-docker-metadata/24237 "2015-06-24T07:16:48Z")
(from https://github.com/elastic/logstash/issues/3494 ) Hi, I'm trying to adapt this fluentd filter (https://github.com/fabric8io/fluent-plugin-docker\_metadata\_filter) into a logstash filter. It does not seam… --- ## [Help Needed with Logstash 1.5 OOM error](https://discuss.elastic.co/t/help-needed-with-logstash-1-5-oom-error/2540)
**Author:** [@Rahul\_Durrani](https://discuss.elastic.co/u/Rahul_Durrani)\ **Replies:** 11\ **Last updated:** [June 24, 2015, 6:15am UTC](https://discuss.elastic.co/t/help-needed-with-logstash-1-5-oom-error/2540 "2015-06-24T06:15:49Z")
I am a newbie at logstash and I am working on setting it up for my environment, but after a few hours of running it logstash crashes with the flowing error Error: Your application used more memory than the safety cap … --- ## ["io/console not supported; tty will not be manipulated" msg](https://discuss.elastic.co/t/io-console-not-supported-tty-will-not-be-manipulated-msg/24218)
**Author:** [@samding](https://discuss.elastic.co/u/samding)\ **Replies:** 1\ **Last updated:** [June 24, 2015, 5:19am UTC](https://discuss.elastic.co/t/io-console-not-supported-tty-will-not-be-manipulated-msg/24218 "2015-06-24T05:19:00Z")
Hello, I run LS on SLES12 of s390 and get this msg as follows: " bin/logstash -e 'input { stdin { } } output { stdout { codec =\> rubydebug } }' io/console not supported; tty will not be manipulated Logstash startup com… --- ## [Logstash 1.5.1 crashing](https://discuss.elastic.co/t/logstash-1-5-1-crashing/24134)
**Author:** [@Sam\_Barham](https://discuss.elastic.co/u/Sam_Barham)\ **Replies:** 5\ **Last updated:** [June 23, 2015, 9:56pm UTC](https://discuss.elastic.co/t/logstash-1-5-1-crashing/24134 "2015-06-23T21:56:37Z")
I'm just installed logstash 1.5.1 on a similar VM to one that runs logstash 1.4.2 without issue. On the new VM, however, logstash 1.5.1 crashes on startup with the following error logs: NotImplementedError: stat.st\_gi… --- ## [Error Bundler::HTTPError, - what am I missing?](https://discuss.elastic.co/t/error-bundler-httperror-what-am-i-missing/24107)
**Author:** [@rmckeown](https://discuss.elastic.co/u/rmckeown)\ **Replies:** 3\ **Last updated:** [June 23, 2015, 7:26pm UTC](https://discuss.elastic.co/t/error-bundler-httperror-what-am-i-missing/24107 "2015-06-23T19:26:16Z")
I am attempting to install a custom plugin from a gem. This works fine when I do the install on an environment connected to the internet. However, on an environment not so connected, I get the following after plugin… --- ## [Whether log stash parsed log file completely](https://discuss.elastic.co/t/whether-log-stash-parsed-log-file-completely/24055)
**Author:** [@Siddhant\_Agarwal](https://discuss.elastic.co/u/Siddhant_Agarwal)\ **Replies:** 8\ **Last updated:** [June 23, 2015, 11:00am UTC](https://discuss.elastic.co/t/whether-log-stash-parsed-log-file-completely/24055 "2015-06-23T11:00:34Z")
I want to run a script when log stash has finished parsing log file completely. Can anyone suggest a way to do that? --- ## [Mutiple xml file with same fields (How to handle?) any suggestion](https://discuss.elastic.co/t/mutiple-xml-file-with-same-fields-how-to-handle-any-suggestion/24061)
**Author:** [@Saket\_Kumar](https://discuss.elastic.co/u/Saket_Kumar)\ **Replies:** 3\ **Last updated:** [June 23, 2015, 10:55am UTC](https://discuss.elastic.co/t/mutiple-xml-file-with-same-fields-how-to-handle-any-suggestion/24061 "2015-06-23T10:55:01Z")
xml { xpath =\> \[ "/response/data/median/firstView/visualComplete/text()","FV\_visualComplete", "/response/data/median/firstView/lastVisualChange/text()","FV\_lastVisualChange", "/response/data/median/firstView/loadTim… --- ## [How to get maximum value of field in events?](https://discuss.elastic.co/t/how-to-get-maximum-value-of-field-in-events/24167)
**Author:** [@Saket\_Kumar](https://discuss.elastic.co/u/Saket_Kumar)\ **Replies:** 4\ **Last updated:** [June 23, 2015, 10:12am UTC](https://discuss.elastic.co/t/how-to-get-maximum-value-of-field-in-events/24167 "2015-06-23T10:12:31Z")
I have two entries of message event, which has two array fields i have to find out maximum length of these array. Is there any ways.? [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1255) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1257)