# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1257 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1258 --- ## [Logstash on Solaris - stat.st\_gid unsupported or native support failed to load \[SOLVED\]](https://discuss.elastic.co/t/logstash-on-solaris-stat-st-gid-unsupported-or-native-support-failed-to-load-solved/24166)
**Author:** [@Thorsten\_Nickel](https://discuss.elastic.co/u/Thorsten_Nickel)\ **Replies:** 1\ **Last updated:** [June 23, 2015, 9:09am UTC](https://discuss.elastic.co/t/logstash-on-solaris-stat-st-gid-unsupported-or-native-support-failed-to-load-solved/24166 "2015-06-23T09:09:34Z")
Dear all, as I am using Logstash only swith Solaris SPARC environment, I really had the hope that with the freshly released V1.5.1 I would no more run across this error. But I still did, as this example shows: … --- ## [Matching with "date" creates \_grokparsefailure but matches are okay](https://discuss.elastic.co/t/matching-with-date-creates--grokparsefailure-but-matches-are-okay/2305)
**Author:** [@ppuschmann](https://discuss.elastic.co/u/ppuschmann)\ **Replies:** 2\ **Last updated:** [June 10, 2015, 1:30pm UTC](https://discuss.elastic.co/t/matching-with-date-creates--grokparsefailure-but-matches-are-okay/2305 "2015-06-10T13:30:25Z")
Hi there, we're using Logstash to read some files and then match these with grok. So far so fine. Our Filters: grok { tag\_on\_failure =\> \["tomcat\_match\_failed"\] match =\> \[ "message", "%{TIMESTAMP\_ISO8601:tim… --- ## [Use Case Question - Zipped logs from appliance at customer site](https://discuss.elastic.co/t/use-case-question-zipped-logs-from-appliance-at-customer-site/24143)
**Author:** [@fishpen0](https://discuss.elastic.co/u/fishpen0)\ **Replies:** 3\ **Last updated:** [June 23, 2015, 6:16am UTC](https://discuss.elastic.co/t/use-case-question-zipped-logs-from-appliance-at-customer-site/24143 "2015-06-23T06:16:40Z")
I just finished reading the documentation for logstash and I am still processing a bit, perhaps I am asking this question to early. I'm not sure if I can utilize logstash the way I had hoped. We get logs bundled in zip … --- ## [Sending SNMP trap messages to ZABBIX](https://discuss.elastic.co/t/sending-snmp-trap-messages-to-zabbix/24136)
**Author:** [@Cenzoooo](https://discuss.elastic.co/u/Cenzoooo)\ **Replies:** 1\ **Last updated:** [June 23, 2015, 5:47am UTC](https://discuss.elastic.co/t/sending-snmp-trap-messages-to-zabbix/24136 "2015-06-23T05:47:10Z")
Hello, Is it possible, and if it is how to configure Logstash to send SNMP traps to Zabbix? --- ## [Xml add field not working](https://discuss.elastic.co/t/xml-add-field-not-working/24070)
**Author:** [@Saket\_Kumar](https://discuss.elastic.co/u/Saket_Kumar)\ **Replies:** 1\ **Last updated:** [June 23, 2015, 3:49am UTC](https://discuss.elastic.co/t/xml-add-field-not-working/24070 "2015-06-23T03:49:34Z")
filter { xml { add\_field =\> { "visualComplete" =\> "\[response\]\[data\]\[median\]\[firstView\]\[visualComplete\]" } } } Logstash 1.5.0: Trying to add field "visualComplete" along with value and output to ELK but don't se… --- ## [Backlog Logs without a Day parameter](https://discuss.elastic.co/t/backlog-logs-without-a-day-parameter/23929)
**Author:** [@michaellizhou](https://discuss.elastic.co/u/michaellizhou)\ **Replies:** 5\ **Last updated:** [June 23, 2015, 2:41am UTC](https://discuss.elastic.co/t/backlog-logs-without-a-day-parameter/23929 "2015-06-23T02:41:29Z")
So I am trying to backlog some older logs which do not have a MM:dd:YYY. My question is what should I do then? The timestamp will just be over written with the one of which logstash parsed the data. Thanks. Mike --- ## [Multiline pattern with grok filter](https://discuss.elastic.co/t/multiline-pattern-with-grok-filter/24056)
**Author:** [@Keshav\_Agarwal](https://discuss.elastic.co/u/Keshav_Agarwal)\ **Replies:** 1\ **Last updated:** [June 22, 2015, 5:58pm UTC](https://discuss.elastic.co/t/multiline-pattern-with-grok-filter/24056 "2015-06-22T17:58:02Z")
I am trying to use grok filter for getting multiline patterns in logstash. I've tried using the GRREDYDATA but it doesn't seem to work. Any other method I can opt for doing the multiline pattern match? --- ## [Shield - Kibana4 - User Access Control - Keeping Marketing Matt from doing what comes naturally](https://discuss.elastic.co/t/shield-kibana4-user-access-control-keeping-marketing-matt-from-doing-what-comes-naturally/24017)
**Author:** [@bdunbar](https://discuss.elastic.co/u/bdunbar)\ **Replies:** 2\ **Last updated:** [June 22, 2015, 4:53pm UTC](https://discuss.elastic.co/t/shield-kibana4-user-access-control-keeping-marketing-matt-from-doing-what-comes-naturally/24017 "2015-06-22T16:53:58Z")
Seeking guidance. We're new to ES. Using ES, Logstash, Kibana4 to provide webstats. We want very badly to be able to allow Matt from Marketing to login to Kibana, sort data, create visualizations and dashboards, but… --- ## [How do I measure/monitor my logstash servers performance?](https://discuss.elastic.co/t/how-do-i-measure-monitor-my-logstash-servers-performance/23879)
**Author:** [@Bruce\_Lysik](https://discuss.elastic.co/u/Bruce_Lysik)\ **Replies:** 3\ **Last updated:** [June 22, 2015, 3:24pm UTC](https://discuss.elastic.co/t/how-do-i-measure-monitor-my-logstash-servers-performance/23879 "2015-06-22T15:24:27Z")
Hi, With logstash version 1.5.1, my crashing issues went away. Great! Now I'd like to see about making sure my logstash cluster is sized correctly. Currently have a number of logstash servers behind a DSR hardware … --- ## [Tags vs Fields](https://discuss.elastic.co/t/tags-vs-fields/24014)
**Author:** [@michaellizhou](https://discuss.elastic.co/u/michaellizhou)\ **Replies:** 3\ **Last updated:** [June 22, 2015, 2:17pm UTC](https://discuss.elastic.co/t/tags-vs-fields/24014 "2015-06-22T14:17:46Z")
Here is a simple question yet I do not know the difference: what is the difference between a tag and a field? --- ## [Logstash and ip reputation](https://discuss.elastic.co/t/logstash-and-ip-reputation/24033)
**Author:** [@damstux](https://discuss.elastic.co/u/damstux)\ **Replies:** 2\ **Last updated:** [June 22, 2015, 11:08am UTC](https://discuss.elastic.co/t/logstash-and-ip-reputation/24033 "2015-06-22T11:08:49Z")
Hello, I have an ELK for my Apache Logs, everything OK. I would like to query a reputation IP database to detect tor, vpn, open-proxy .... traffic on my website. have you got any idea ? I havec contacted http://w… --- ## [XML Filter Logstash 1.5.1](https://discuss.elastic.co/t/xml-filter-logstash-1-5-1/24071)
**Author:** [@Jordi\_Jansen](https://discuss.elastic.co/u/Jordi_Jansen)\ **Replies:** 0\ **Last updated:** [June 22, 2015, 10:12am UTC](https://discuss.elastic.co/t/xml-filter-logstash-1-5-1/24071 "2015-06-22T10:12:38Z")
Hey Guys, Has anybody got the XML filter working under Logstash 1.5.2. The init of the filter seems to work fine however when a event come through Logstash crashes with the following exception: NokogiriDomParser.java… --- ## [How to match IP address to hostname without dns \[Solved\]](https://discuss.elastic.co/t/how-to-match-ip-address-to-hostname-without-dns-solved/23919)
**Author:** [@thelastwilson](https://discuss.elastic.co/u/thelastwilson)\ **Replies:** 5\ **Last updated:** [June 22, 2015, 10:00am UTC](https://discuss.elastic.co/t/how-to-match-ip-address-to-hostname-without-dns-solved/23919 "2015-06-22T10:00:25Z")
I've been attempting to deploy ELK and I'm trying to figure out how to translate IP addresses into hostnames. Currently feeding in syslog from some switches and host field comes up as IP address, not a problem but I'd qu… --- ## [Syslog input always dying](https://discuss.elastic.co/t/syslog-input-always-dying/2786)
**Author:** [@Wurzelmann](https://discuss.elastic.co/u/Wurzelmann)\ **Replies:** 3\ **Last updated:** [June 22, 2015, 6:25am UTC](https://discuss.elastic.co/t/syslog-input-always-dying/2786 "2015-06-22T06:25:25Z")
Hi there! We configured multiple syslog inputs for different incoming log types (switches, firewalls, etc), each of them with a dedicated port, like this: input { syslog { host =\> "0.0.0.0" type =\> "switche… --- ## [Fix field values while importing](https://discuss.elastic.co/t/fix-field-values-while-importing/24047)
**Author:** [@refaelos](https://discuss.elastic.co/u/refaelos)\ **Replies:** 2\ **Last updated:** [June 22, 2015, 5:29am UTC](https://discuss.elastic.co/t/fix-field-values-while-importing/24047 "2015-06-22T05:29:30Z")
Hey, When I fetch events from S3 into ES i'm getting multiple errors like this: Caused by: org.elasticsearch.common.jackson.core.JsonParseException: Numeric value (9223372036854776000) out of range of long (-922337… --- ## [Logstash Under Windows Server - Questions](https://discuss.elastic.co/t/logstash-under-windows-server-questions/24000)
**Author:** [@bluethundr](https://discuss.elastic.co/u/bluethundr)\ **Replies:** 4\ **Last updated:** [June 22, 2015, 4:22am UTC](https://discuss.elastic.co/t/logstash-under-windows-server-questions/24000 "2015-06-22T04:22:10Z")
Hi all, I have a few questions about using logstash under Windows Server. How LogStash implemented on Windows servers? As a windows service (application running in the background like a daemon)? As a plug-in to t… --- ## [Send data every two hours using logstash-forwarder](https://discuss.elastic.co/t/send-data-every-two-hours-using-logstash-forwarder/23970)
**Author:** [@Keshav\_Agarwal](https://discuss.elastic.co/u/Keshav_Agarwal)\ **Replies:** 1\ **Last updated:** [June 21, 2015, 6:27am UTC](https://discuss.elastic.co/t/send-data-every-two-hours-using-logstash-forwarder/23970 "2015-06-21T06:27:34Z")
I want to send logs using the forwarder once every two hours. Is there a setting through which I can do so or should I set up a cron job? --- ## [Unterstanding the behaviour of grok-filter-plugin and elasticsearch-ouput-plugin](https://discuss.elastic.co/t/unterstanding-the-behaviour-of-grok-filter-plugin-and-elasticsearch-ouput-plugin/24038)
**Author:** [@user5518](https://discuss.elastic.co/u/user5518)\ **Replies:** 1\ **Last updated:** [June 21, 2015, 6:25am UTC](https://discuss.elastic.co/t/unterstanding-the-behaviour-of-grok-filter-plugin-and-elasticsearch-ouput-plugin/24038 "2015-06-21T06:25:59Z")
Hi to everybody. I have some questions and I hope someone can help me. I'm trying to unterstand the Grok-plugin to filter input-data. There is a option named "periodic\_flush". The documentation says "Call the filter fl… --- ## [How to debug Logstash output for custom logstash (solved)](https://discuss.elastic.co/t/how-to-debug-logstash-output-for-custom-logstash-solved/24040)
**Author:** [@eperry](https://discuss.elastic.co/u/eperry)\ **Replies:** 0\ **Last updated:** [June 21, 2015, 4:03am UTC](https://discuss.elastic.co/t/how-to-debug-logstash-output-for-custom-logstash-solved/24040 "2015-06-21T04:03:40Z")
(solved) Never mind I found the problem. One of my main varibles was initialized outside the main for loop, which meant information was being over written. process = Hash.new Dir.foreach("/proc"){ |… --- ## [Elasticsearch output plugin](https://discuss.elastic.co/t/elasticsearch-output-plugin/23986)
**Author:** [@tgdesrochers](https://discuss.elastic.co/u/tgdesrochers)\ **Replies:** 2\ **Last updated:** [June 20, 2015, 12:56pm UTC](https://discuss.elastic.co/t/elasticsearch-output-plugin/23986 "2015-06-20T12:56:03Z")
I currently have this as my output for logs to my elasticsearch cluster: output { elasticsearch { bind\_host =\> "10.1.55.4" host =\> "10.1.55.8,10.1.55.9,10.1.55.10,10.1.55.11,10.1.55.12,10.1.55.13,10.1.55.14,1… --- ## [Testing logstash when installed as a service](https://discuss.elastic.co/t/testing-logstash-when-installed-as-a-service/23981)
**Author:** [@DigiAngel](https://discuss.elastic.co/u/DigiAngel)\ **Replies:** 2\ **Last updated:** [June 20, 2015, 11:35am UTC](https://discuss.elastic.co/t/testing-logstash-when-installed-as-a-service/23981 "2015-06-20T11:35:20Z")
I remember before I installed logstash as a service I'd start it command line which was great for testing. Now as a service I'm not sure how to test with output going to the console. I have this installed using the PPA… --- ## [Sending logs from Windows to Logstash](https://discuss.elastic.co/t/sending-logs-from-windows-to-logstash/24022)
**Author:** [@cav10](https://discuss.elastic.co/u/cav10)\ **Replies:** 1\ **Last updated:** [June 20, 2015, 1:24am UTC](https://discuss.elastic.co/t/sending-logs-from-windows-to-logstash/24022 "2015-06-20T01:24:29Z")
Everything I read online is confusing, I am trying to get windows logs to logstash. I have no idea what I am doing wrong and all the reading I am doing is getting me no where. My setup is ELK on an Unbuntu system. I have… --- ## [Looking for an example plugin that uses a Java library](https://discuss.elastic.co/t/looking-for-an-example-plugin-that-uses-a-java-library/23898)
**Author:** [@Niels\_Basjes](https://discuss.elastic.co/u/Niels_Basjes)\ **Replies:** 2\ **Last updated:** [June 19, 2015, 7:07pm UTC](https://discuss.elastic.co/t/looking-for-an-example-plugin-that-uses-a-java-library/23898 "2015-06-19T19:07:22Z")
Hi , I'm looking to see if I can wrap my apache logparsing library (https://github.com/nielsbasjes/logparser/ ) (which was written in Java) to become a plugin for logstash. The problem I have is that my Ruby knowledge is… --- ## [Embed Logstash Agent within Java Process](https://discuss.elastic.co/t/embed-logstash-agent-within-java-process/24009)
**Author:** [@cfili](https://discuss.elastic.co/u/cfili)\ **Replies:** 0\ **Last updated:** [June 19, 2015, 6:07pm UTC](https://discuss.elastic.co/t/embed-logstash-agent-within-java-process/24009 "2015-06-19T18:07:04Z")
Hi, I am playing around with the idea of embedding a Logstash agent inside of another Java process. Does anyone have experience doing so? I am trying to use Redbridge to launch the Logstash runner.rb inside of a script… --- ## [How to dynamic parse log via grok regex?](https://discuss.elastic.co/t/how-to-dynamic-parse-log-via-grok-regex/23910)
**Author:** [@abcfy2](https://discuss.elastic.co/u/abcfy2)\ **Replies:** 6\ **Last updated:** [June 19, 2015, 3:16pm UTC](https://discuss.elastic.co/t/how-to-dynamic-parse-log-via-grok-regex/23910 "2015-06-19T15:16:44Z")
I have some logs like this: 2015-06-18 20:37:25,359 \[metrics-logger-reporter-1-thread-1\] INFO hawkeyes.rtds.monitor.MetricsVerticle - type=GAUGE, name=jvm.memory.pools.PS-Survivor-Space.usage, value=0.375 2015-06-18… --- ## [Multiline conf file to parse log file to elasticsearch](https://discuss.elastic.co/t/multiline-conf-file-to-parse-log-file-to-elasticsearch/1153)
**Author:** [@bradfordli](https://discuss.elastic.co/u/bradfordli)\ **Replies:** 4\ **Last updated:** [June 19, 2015, 1:39pm UTC](https://discuss.elastic.co/t/multiline-conf-file-to-parse-log-file-to-elasticsearch/1153 "2015-06-19T13:39:26Z")
I have this log file: http://dpaste.com/3FE2VNY I only want to extract certain pieces of information such as date time, and number of events posted. My attempt of putting this into elasticsearch results in hanging of … --- ## [Problem setting up Logstash-1.5.0](https://discuss.elastic.co/t/problem-setting-up-logstash-1-5-0/23767)
**Author:** [@jigar](https://discuss.elastic.co/u/jigar)\ **Replies:** 7\ **Last updated:** [June 19, 2015, 9:57am UTC](https://discuss.elastic.co/t/problem-setting-up-logstash-1-5-0/23767 "2015-06-19T09:57:15Z")
Hi Guys, I am new to logstash. I am struggling to make it working on my windows 8.1 machine. I am trying to use logstash-1.5.0. I am following below url to get going: https://www.elastic.co/guide/en/logstash/current/g… --- ## [Logstash 1.5.0 alternative for filter grep](https://discuss.elastic.co/t/logstash-1-5-0-alternative-for-filter-grep/2677)
**Author:** [@shartmann](https://discuss.elastic.co/u/shartmann)\ **Replies:** 2\ **Last updated:** [June 19, 2015, 9:23am UTC](https://discuss.elastic.co/t/logstash-1-5-0-alternative-for-filter-grep/2677 "2015-06-19T09:23:33Z")
Hello, we used logstash 1.4.2 and will update to 1.5.0. In logstash 1.4.2 we used grep as filter. For logstash 1.5.0 filter grep is never available, I think. Is there any alternative for grep or how can we change our con… --- ## [Force flush before shutdown](https://discuss.elastic.co/t/force-flush-before-shutdown/23931)
**Author:** [@kelvinfann](https://discuss.elastic.co/u/kelvinfann)\ **Replies:** 0\ **Last updated:** [June 18, 2015, 4:56pm UTC](https://discuss.elastic.co/t/force-flush-before-shutdown/23931 "2015-06-18T16:56:18Z")
Hi, I have been trying to write an interval metric counter for logstash and I was wondering if it was possible to force logstash to flush a message before shutdown so that if I restarted the logstash, it would not lose a… --- ## [Elapsed plugin](https://discuss.elastic.co/t/elapsed-plugin/23885)
**Author:** [@Andre\_Hole](https://discuss.elastic.co/u/Andre_Hole)\ **Replies:** 2\ **Last updated:** [June 18, 2015, 11:21am UTC](https://discuss.elastic.co/t/elapsed-plugin/23885 "2015-06-18T11:21:03Z")
Hello, I'm trying to use logstash 1.5.1 to parse an application log file with the following pattern: 2015-04-30 17:11:04.640 \[INFO\] 123 message started 2015-04-30 17:11:14.320 \[DEBUG\] 123 message in the middle 2… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1256) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1258)