# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1259 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1260 --- ## [Logstash runs from command line but not as a service](https://discuss.elastic.co/t/logstash-runs-from-command-line-but-not-as-a-service/2599)
**Author:** [@stuayre](https://discuss.elastic.co/u/stuayre)\ **Replies:** 2\ **Last updated:** [June 12, 2015, 8:50pm UTC](https://discuss.elastic.co/t/logstash-runs-from-command-line-but-not-as-a-service/2599 "2015-06-12T20:50:00Z")
I have logstash and elastic search installed. I'm trying to get logstash to read a csv file and populate ES everything works fine when I run logstash from the command line using: sudo /opt/logstash/bin/logstash -f… --- ## [Logstash is indexing the last line of my csv file in elasticsearch](https://discuss.elastic.co/t/logstash-is-indexing-the-last-line-of-my-csv-file-in-elasticsearch/2584)
**Author:** [@Hamza\_Chtioui](https://discuss.elastic.co/u/Hamza_Chtioui)\ **Replies:** 2\ **Last updated:** [June 12, 2015, 4:28pm UTC](https://discuss.elastic.co/t/logstash-is-indexing-the-last-line-of-my-csv-file-in-elasticsearch/2584 "2015-06-12T16:28:22Z")
Holà, I'm new in Elasticsearch, today i'm trying to index data from a csv file. I learn from the net that i can use Logstash to do this.. this is my conf file: input { file { path =\> "C:\\plus\\csv\_… --- ## [Logstash silently stops processing events and does not respond to SIGTERM](https://discuss.elastic.co/t/logstash-silently-stops-processing-events-and-does-not-respond-to-sigterm/1720)
**Author:** [@robinpblanchard](https://discuss.elastic.co/u/robinpblanchard)\ **Replies:** 5\ **Last updated:** [June 12, 2015, 3:19pm UTC](https://discuss.elastic.co/t/logstash-silently-stops-processing-events-and-does-not-respond-to-sigterm/1720 "2015-06-12T15:19:56Z")
Logstash happily plows along for an indeterminate amount of time (sometimes a couple days, sometimes a couple hours) and then nothing else is passed through to ES. At this point, the system is nearly idle (the only way I… --- ## [How filter OpenLDAP Logs?](https://discuss.elastic.co/t/how-filter-openldap-logs/2492)
**Author:** [@gqs](https://discuss.elastic.co/u/gqs)\ **Replies:** 2\ **Last updated:** [June 12, 2015, 1:17pm UTC](https://discuss.elastic.co/t/how-filter-openldap-logs/2492 "2015-06-12T13:17:49Z")
Hi, Attempting to parse LDAP access logs (sample below): required to be able to find transactions by 'conn' (to relate the IP Address to a BIND) for example. Jun 11 09:53:08 ldapserver slapd\[19329\]: conn=1202229 fd=… --- ## [Can i use split { arrayfield =\> "some\_field"} within ruby block?](https://discuss.elastic.co/t/can-i-use-split-arrayfield-some-field-within-ruby-block/2564)
**Author:** [@Saket\_Kumar](https://discuss.elastic.co/u/Saket_Kumar)\ **Replies:** 1\ **Last updated:** [June 12, 2015, 1:15pm UTC](https://discuss.elastic.co/t/can-i-use-split-arrayfield-some-field-within-ruby-block/2564 "2015-06-12T13:15:20Z")
ruby { code =\> " split { field =\> "Time\_FV" } " } is this possible? --- ## [Missing url parameter in logstash-input-jmx-0.1.5](https://discuss.elastic.co/t/missing-url-parameter-in-logstash-input-jmx-0-1-5/2563)
**Author:** [@erard22](https://discuss.elastic.co/u/erard22)\ **Replies:** 0\ **Last updated:** [June 12, 2015, 11:25am UTC](https://discuss.elastic.co/t/missing-url-parameter-in-logstash-input-jmx-0-1-5/2563 "2015-06-12T11:25:20Z")
Hello, I just installed the jmx plugin (logstash-input-jmx-0.1.5) but am a bit confused. When I check the source on github this version should contain the url parameter to be able to connect the plugin to my jboss. Bu… --- ## [Help needed with Logstash and syslog config](https://discuss.elastic.co/t/help-needed-with-logstash-and-syslog-config/2548)
**Author:** [@janus](https://discuss.elastic.co/u/janus)\ **Replies:** 5\ **Last updated:** [June 12, 2015, 10:32am UTC](https://discuss.elastic.co/t/help-needed-with-logstash-and-syslog-config/2548 "2015-06-12T10:32:28Z")
Hello all, First of all I have to say that I am new to ELK, in fact I have just installed it in the system. Let me go to the point. :smiley: I have followed the oceand digital manual to install elk in a brand new debi… --- ## [Logstash input twitter](https://discuss.elastic.co/t/logstash-input-twitter/2298)
**Author:** [@abaykal](https://discuss.elastic.co/u/abaykal)\ **Replies:** 5\ **Last updated:** [June 12, 2015, 3:36am UTC](https://discuss.elastic.co/t/logstash-input-twitter/2298 "2015-06-12T03:36:15Z")
I am using logstash-input-twitter plugin. I dont want certain fields to be not\_analyzed. is this something I can define in the output tag? if so, can you provide an example? Thanks --- ## [Remote server windows event logs](https://discuss.elastic.co/t/remote-server-windows-event-logs/2220)
**Author:** [@Shra\_vanthi](https://discuss.elastic.co/u/Shra_vanthi)\ **Replies:** 2\ **Last updated:** [June 11, 2015, 7:28pm UTC](https://discuss.elastic.co/t/remote-server-windows-event-logs/2220 "2015-06-11T19:28:08Z")
I was able to successfully setup ELK on a server and it is working great. Now, I'd like to read windows event logs from a bunch of remote servers. However, I do not want to install anything on those servers in order t… --- ## [Logstash Remove help](https://discuss.elastic.co/t/logstash-remove-help/2468)
**Author:** [@abaykal](https://discuss.elastic.co/u/abaykal)\ **Replies:** 5\ **Last updated:** [June 11, 2015, 5:50pm UTC](https://discuss.elastic.co/t/logstash-remove-help/2468 "2015-06-11T17:50:39Z")
I pull in the twitter json and want to remove certain fields from the user. object as well as some other fields. I cannot get it to work. here is my filter: filter { if \[field\] =~ /in\_reply\_to\*/ { json { … --- ## [Grok template](https://discuss.elastic.co/t/grok-template/2497)
**Author:** [@Tariq\_Turabi](https://discuss.elastic.co/u/Tariq_Turabi)\ **Replies:** 2\ **Last updated:** [June 11, 2015, 5:41pm UTC](https://discuss.elastic.co/t/grok-template/2497 "2015-06-11T17:41:01Z")
how to create a grok template, thank you --- ## [Logstash doesn't appear to be reading config'd files](https://discuss.elastic.co/t/logstash-doesnt-appear-to-be-reading-configd-files/2144)
**Author:** [@nseery](https://discuss.elastic.co/u/nseery)\ **Replies:** 6\ **Last updated:** [June 11, 2015, 3:17pm UTC](https://discuss.elastic.co/t/logstash-doesnt-appear-to-be-reading-configd-files/2144 "2015-06-11T15:17:45Z")
Was running Logstash 1.5.0 on Debian 7 Wheezy. It was running fine. Upgraded to Debian 8 Jessie, and now it's running, but doesn't display data from the configured log files. It looks like it's only reading authentica… --- ## [Issue with logstash configuration for log file having mix of multiline as well as single level events](https://discuss.elastic.co/t/issue-with-logstash-configuration-for-log-file-having-mix-of-multiline-as-well-as-single-level-events/2381)
**Author:** [@chaitanyavvs](https://discuss.elastic.co/u/chaitanyavvs)\ **Replies:** 2\ **Last updated:** [June 11, 2015, 2:19pm UTC](https://discuss.elastic.co/t/issue-with-logstash-configuration-for-log-file-having-mix-of-multiline-as-well-as-single-level-events/2381 "2015-06-11T14:19:00Z")
Hi , I am newbie to logstash and i am using logstash 1.5.0. I have a log file (which is a historical log file ,as of now). I have written the following configuration. however i am unable to get any values. I have used t… --- ## [How to use conditional statement in Filter](https://discuss.elastic.co/t/how-to-use-conditional-statement-in-filter/2443)
**Author:** [@Ankit\_Pradhan](https://discuss.elastic.co/u/Ankit_Pradhan)\ **Replies:** 4\ **Last updated:** [June 11, 2015, 2:17pm UTC](https://discuss.elastic.co/t/how-to-use-conditional-statement-in-filter/2443 "2015-06-11T14:17:08Z")
How can i query on the message for a particular String and then add a new Field in the output? I tried below but seems like the message as a field doesn't work ... it must be the wrong way i am using the syntax ... help … --- ## [Split on multiple fields logstash. Is it possible?](https://discuss.elastic.co/t/split-on-multiple-fields-logstash-is-it-possible/2428)
**Author:** [@Saket\_Kumar](https://discuss.elastic.co/u/Saket_Kumar)\ **Replies:** 4\ **Last updated:** [June 11, 2015, 12:06pm UTC](https://discuss.elastic.co/t/split-on-multiple-fields-logstash-is-it-possible/2428 "2015-06-11T12:06:12Z")
Fields are like: Time\_FV: \[0, 200,300,400\] Progess\_FV: \[10, 20,30,40\] Time\_RV: \[0, 200,300,400, 500\] Progess\_RV: \[10, 20,30,40, 90\] Can I use split {} for multiple fields? if not any possible way out. split { field =\>… --- ## [How to parse a few log files](https://discuss.elastic.co/t/how-to-parse-a-few-log-files/2282)
**Author:** [@MrAV](https://discuss.elastic.co/u/MrAV)\ **Replies:** 2\ **Last updated:** [June 11, 2015, 11:12am UTC](https://discuss.elastic.co/t/how-to-parse-a-few-log-files/2282 "2015-06-11T11:12:44Z")
Hi, I'm trying to parse a two log files. Unfortunately, at Logstash output I've seen that only first log file (events.log) has been parsed and output do not contain any data from the second log-file algotw.log. Please… --- ## [Can we use clone filter within ruby code block?](https://discuss.elastic.co/t/can-we-use-clone-filter-within-ruby-code-block/2411)
**Author:** [@Saket\_Kumar](https://discuss.elastic.co/u/Saket_Kumar)\ **Replies:** 8\ **Last updated:** [June 11, 2015, 10:23am UTC](https://discuss.elastic.co/t/can-we-use-clone-filter-within-ruby-code-block/2411 "2015-06-11T10:23:36Z")
can we use clone filter within ruby code block? --- ## [ELK Repository not responding](https://discuss.elastic.co/t/elk-repository-not-responding/2434)
**Author:** [@delProfundo](https://discuss.elastic.co/u/delProfundo)\ **Replies:** 0\ **Last updated:** [June 11, 2015, 9:55am UTC](https://discuss.elastic.co/t/elk-repository-not-responding/2434 "2015-06-11T09:55:26Z")
I'm trying to get puppet to install the individual components of ELK. (I've put under logstash as thats why im trying to install first). It appears as though the repository is dead. I get a 200 on the request but no pa… --- ## [How to parse a dynamic CSV file regularly](https://discuss.elastic.co/t/how-to-parse-a-dynamic-csv-file-regularly/2408)
**Author:** [@vikas\_gopal](https://discuss.elastic.co/u/vikas_gopal)\ **Replies:** 7\ **Last updated:** [June 11, 2015, 9:11am UTC](https://discuss.elastic.co/t/how-to-parse-a-dynamic-csv-file-regularly/2408 "2015-06-11T09:11:50Z")
Hi Experts, I am parsing a csv file which keeps on updated .I mean it is not static new data is added to CSV after every 30 min or so . My question is how I can handle this situation. I cannot afford to create a new in… --- ## [SSL Handshake Issue](https://discuss.elastic.co/t/ssl-handshake-issue/2303)
**Author:** [@ashwgupt](https://discuss.elastic.co/u/ashwgupt)\ **Replies:** 4\ **Last updated:** [June 11, 2015, 8:24am UTC](https://discuss.elastic.co/t/ssl-handshake-issue/2303 "2015-06-11T08:24:29Z")
I am facing a lot of issues to make my Forwarder work even after all steps supposedly followed. Have also been browsing and following tips from - https://github.com/elastic/logstash-forwarder/issues/221 but have not turn… --- ## [\[Solved\]Logstash 1.5.0 could not get host field](https://discuss.elastic.co/t/solved-logstash-1-5-0-could-not-get-host-field/2410)
**Author:** [@abcfy2](https://discuss.elastic.co/u/abcfy2)\ **Replies:** 4\ **Last updated:** [June 11, 2015, 7:36am UTC](https://discuss.elastic.co/t/solved-logstash-1-5-0-could-not-get-host-field/2410 "2015-06-11T07:36:46Z")
Here is rubydebug on logstash 1.5.0: { "@timestamp" =\> "2015-06-11T06:29:51.220Z", "message" =\> "2015-06-11 14:29:50,565 \[vert.x-eventloop-thread-1\] DEBUG hawkeyes.rtds.store.domain.Equipment - Packages … --- ## [How to change the datatype of field in elastic search](https://discuss.elastic.co/t/how-to-change-the-datatype-of-field-in-elastic-search/1718)
**Author:** [@elk\_2015](https://discuss.elastic.co/u/elk_2015)\ **Replies:** 8\ **Last updated:** [June 11, 2015, 3:34am UTC](https://discuss.elastic.co/t/how-to-change-the-datatype-of-field-in-elastic-search/1718 "2015-06-11T03:34:57Z")
How to change the datatype of field in elastic search, example, string to date etc. --- ## [Throttle incoming logs in a smart way](https://discuss.elastic.co/t/throttle-incoming-logs-in-a-smart-way/2338)
**Author:** [@Laines](https://discuss.elastic.co/u/Laines)\ **Replies:** 1\ **Last updated:** [June 10, 2015, 10:24pm UTC](https://discuss.elastic.co/t/throttle-incoming-logs-in-a-smart-way/2338 "2015-06-10T22:24:22Z")
Hello Currently we us the combination of the throttle and sleep filter to protect our elk cluster for unexpected high message peaks. Unfortunately the sleep filter sets logstash completely into sleep. We distinguish b… --- ## [Parsing execution metrics which are represented as TimeSpan](https://discuss.elastic.co/t/parsing-execution-metrics-which-are-represented-as-timespan/2274)
**Author:** [@maxcherednik](https://discuss.elastic.co/u/maxcherednik)\ **Replies:** 1\ **Last updated:** [June 10, 2015, 7:30pm UTC](https://discuss.elastic.co/t/parsing-execution-metrics-which-are-represented-as-timespan/2274 "2015-06-10T19:30:34Z")
Hi, I've got a log file with rows like this: Action1 took: 00:00:00.0320605 I would like to parse it and output to elasticsearh. As far as I know there is no such type like TimeSpan, so I need to convert it to int or f… --- ## [Help troubleshoot this template please](https://discuss.elastic.co/t/help-troubleshoot-this-template-please/2329)
**Author:** [@abaykal](https://discuss.elastic.co/u/abaykal)\ **Replies:** 10\ **Last updated:** [June 10, 2015, 6:31pm UTC](https://discuss.elastic.co/t/help-troubleshoot-this-template-please/2329 "2015-06-10T18:31:34Z")
I am trying to make sure everything is indexed but the username is not analyzed. This is not working. what am i doing wrong? { "template" : "twitter", "settings" : { "index.refresh\_interval" : "5s" }, "mapp… --- ## [Logstash: getting hadoop's tasks-logs](https://discuss.elastic.co/t/logstash-getting-hadoops-tasks-logs/2370)
**Author:** [@ohadR](https://discuss.elastic.co/u/ohadR)\ **Replies:** 0\ **Last updated:** [June 10, 2015, 6:27pm UTC](https://discuss.elastic.co/t/logstash-getting-hadoops-tasks-logs/2370 "2015-06-10T18:27:55Z")
I've searched here and googled the web, but surprisingly I could not find any info about this subject. So I use LS+ES+Kibana to collect and view logs of services that run on tomcat. Works like a charm. Now my next challe… --- ## [Log stash and log stash forwarder how should it be used](https://discuss.elastic.co/t/log-stash-and-log-stash-forwarder-how-should-it-be-used/2237)
**Author:** [@Peter\_Berson](https://discuss.elastic.co/u/Peter_Berson)\ **Replies:** 6\ **Last updated:** [June 10, 2015, 5:15pm UTC](https://discuss.elastic.co/t/log-stash-and-log-stash-forwarder-how-should-it-be-used/2237 "2015-06-10T17:15:16Z")
Newbie Question It seems that logstash can send logs to another server that is running elastic search. What is the need for log stash-forwarder? Security? Setup that I am trying to design. App Logs Machine … --- ## [Make logstash send logs via lumberjack to logstash](https://discuss.elastic.co/t/make-logstash-send-logs-via-lumberjack-to-logstash/2261)
**Author:** [@Jerry\_Hoffmeister](https://discuss.elastic.co/u/Jerry_Hoffmeister)\ **Replies:** 9\ **Last updated:** [June 10, 2015, 5:07pm UTC](https://discuss.elastic.co/t/make-logstash-send-logs-via-lumberjack-to-logstash/2261 "2015-06-10T17:07:48Z")
I'd like to send logs, jmx data and collectd data to a central elasticsearch server from several clients. I've setup collectd on the client to send data to LS running on the ES server and that works just fine. I can se… --- ## [Logstash data duplication... possible?](https://discuss.elastic.co/t/logstash-data-duplication-possible/2336)
**Author:** [@alexolivan](https://discuss.elastic.co/u/alexolivan)\ **Replies:** 0\ **Last updated:** [June 10, 2015, 2:37pm UTC](https://discuss.elastic.co/t/logstash-data-duplication-possible/2336 "2015-06-10T14:37:00Z")
Hi forum... Today's surprise on the cluster is my logstash-forwarder nodes seeming to have miss a lot of data during night... they appeared to run normally... but the amount of logs received is a portion owhat should b… --- ## [Logstash filters and booleans](https://discuss.elastic.co/t/logstash-filters-and-booleans/2333)
**Author:** [@efreedom](https://discuss.elastic.co/u/efreedom)\ **Replies:** 0\ **Last updated:** [June 10, 2015, 2:23pm UTC](https://discuss.elastic.co/t/logstash-filters-and-booleans/2333 "2015-06-10T14:23:59Z")
So, this works: filter { if \[type\] == "test" { grok { match =\> { "message" =\> "%{TIMESTAMP\_ISO8601:timestamp} %{LOGLEVEL:loglevel}%{SPACE}%{NOTSPACE:\\ classname}%{SPACE}%{NOTSPACE:pool} - %{GREEDYDATA:logms… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1258) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1260)