# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1261 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1262 --- ## [Logstash-forwarder reconnect with round robin DNS](https://discuss.elastic.co/t/logstash-forwarder-reconnect-with-round-robin-dns/2101)
**Author:** [@palmerabollo](https://discuss.elastic.co/u/palmerabollo)\ **Replies:** 1\ **Last updated:** [June 8, 2015, 12:55am UTC](https://discuss.elastic.co/t/logstash-forwarder-reconnect-with-round-robin-dns/2101 "2015-06-08T00:55:59Z")
You can configure a list of servers listening for messages. According to the docs, logstash-forwarder will pick one at random until it appears to be dead or unresponsive. For example: "servers": \[ "10.10.10.1:5043", … --- ## [Adding tags to IIS logs](https://discuss.elastic.co/t/adding-tags-to-iis-logs/2104)
**Author:** [@MarkL](https://discuss.elastic.co/u/MarkL)\ **Replies:** 0\ **Last updated:** [June 7, 2015, 10:31pm UTC](https://discuss.elastic.co/t/adding-tags-to-iis-logs/2104 "2015-06-07T22:31:16Z")
I'm having a similar problem. I'm sending Windows event logs and IIS logs to logstash using nxlog. I have successfully added tags to the event logs to help identify the environments and host groups using this technique… --- ## [Logstash: in log4j-input, the “path” is not correct](https://discuss.elastic.co/t/logstash-in-log4j-input-the-path-is-not-correct/2072)
**Author:** [@ohadR](https://discuss.elastic.co/u/ohadR)\ **Replies:** 1\ **Last updated:** [June 7, 2015, 9:36am UTC](https://discuss.elastic.co/t/logstash-in-log4j-input-the-path-is-not-correct/2072 "2015-06-07T09:36:30Z")
In my config file, I use input { log4j {} } output { stdout { codec =\> rubydebug } } I've attached my log4j to logstash using SocketListener. When my app prints something to the log, I see in logstash: { "message" =\>… --- ## [Metric's meter.count ruby variable name?](https://discuss.elastic.co/t/metrics-meter-count-ruby-variable-name/2051)
**Author:** [@kelvinfann](https://discuss.elastic.co/u/kelvinfann)\ **Replies:** 4\ **Last updated:** [June 6, 2015, 11:33pm UTC](https://discuss.elastic.co/t/metrics-meter-count-ruby-variable-name/2051 "2015-06-06T23:33:43Z")
I am trying to edit the metric's meter.count value with the ruby filter. Does anyone know the variable name of the metric? I know it isn't Event\['meter\_name.count'\] --- ## [Unable to read log file on windows using file input](https://discuss.elastic.co/t/unable-to-read-log-file-on-windows-using-file-input/2050)
**Author:** [@Suresh\_Ramkrishnaiah](https://discuss.elastic.co/u/Suresh_Ramkrishnaiah)\ **Replies:** 0\ **Last updated:** [June 5, 2015, 11:24pm UTC](https://discuss.elastic.co/t/unable-to-read-log-file-on-windows-using-file-input/2050 "2015-06-05T23:24:34Z")
On windows instance I have setup logstash 1.5 to read apache log files using the file input plugin, when I start the logstash instance it goes and globs all the files and throws this error {:timestamp=\>"2015-06-05T19:… --- ## [Logstash Lumberjack Input Stops Processing](https://discuss.elastic.co/t/logstash-lumberjack-input-stops-processing/1031)
**Author:** [@David\_Kleiner](https://discuss.elastic.co/u/David_Kleiner)\ **Replies:** 8\ **Last updated:** [June 5, 2015, 8:53pm UTC](https://discuss.elastic.co/t/logstash-lumberjack-input-stops-processing/1031 "2015-06-05T20:53:21Z")
Logstash 1.5.0 released version, logstash lumberjack input / rabbitMQ output goes idle after a few hours, in the log: 2015-05-20\_02:19:15.40710 {:timestamp=\>"2015-05-19T21:19:15.406000-0500", :message=\>"Lumberjack inpu… --- ## [UDP/TCP performance test, UDP drops messages](https://discuss.elastic.co/t/udp-tcp-performance-test-udp-drops-messages/2037)
**Author:** [@ourlord](https://discuss.elastic.co/u/ourlord)\ **Replies:** 4\ **Last updated:** [June 5, 2015, 8:07pm UTC](https://discuss.elastic.co/t/udp-tcp-performance-test-udp-drops-messages/2037 "2015-06-05T20:07:17Z")
I was doing perf test to Logstash's network inputs, UDP/TCP. I wrote a python script to simulate some messages generator from network. The python script and Logstash is located in different machines in LAN. So the setup … --- ## [Creating tags in logstash.conf](https://discuss.elastic.co/t/creating-tags-in-logstash-conf/1955)
**Author:** [@bluethundr](https://discuss.elastic.co/u/bluethundr)\ **Replies:** 4\ **Last updated:** [June 5, 2015, 7:09pm UTC](https://discuss.elastic.co/t/creating-tags-in-logstash-conf/1955 "2015-06-05T19:09:33Z")
Continuing the discussion from Can't create logstash indexes in elasticsearch: --- ## [How to clear counter without loss?](https://discuss.elastic.co/t/how-to-clear-counter-without-loss/2034)
**Author:** [@kelvinfann](https://discuss.elastic.co/u/kelvinfann)\ **Replies:** 0\ **Last updated:** [June 5, 2015, 6:05pm UTC](https://discuss.elastic.co/t/how-to-clear-counter-without-loss/2034 "2015-06-05T18:05:11Z")
Hi! I am relatively new to log stash, so forgive my ignorance. I am trying to count the throughput of logs in log stash for a fixed amount sets of time ('.count'). Naturally, therefore, I have been trying the filter 'm… --- ## [Strange behaviour - Logstash forwarder read logs fine however the logfile is 0 byte](https://discuss.elastic.co/t/strange-behaviour-logstash-forwarder-read-logs-fine-however-the-logfile-is-0-byte/2033)
**Author:** [@m\_abdelfattah](https://discuss.elastic.co/u/m_abdelfattah)\ **Replies:** 0\ **Last updated:** [June 5, 2015, 6:03pm UTC](https://discuss.elastic.co/t/strange-behaviour-logstash-forwarder-read-logs-fine-however-the-logfile-is-0-byte/2033 "2015-06-05T18:03:07Z")
We are using Logstash-forwarder to send Nginx access logs to remote Logstash server, but there is something strange, that the access.log file size is 0 byte and nginx is writing to access.log.1 ( I know this is not the r… --- ## [Elastic Search is crashing after I add the metrics{ } in filters and format =\> ... in output](https://discuss.elastic.co/t/elastic-search-is-crashing-after-i-add-the-metrics-in-filters-and-format-in-output/1781)
**Author:** [@Ben](https://discuss.elastic.co/u/Ben)\ **Replies:** 11\ **Last updated:** [June 5, 2015, 2:18pm UTC](https://discuss.elastic.co/t/elastic-search-is-crashing-after-i-add-the-metrics-in-filters-and-format-in-output/1781 "2015-06-05T14:18:23Z")
if \[type\] == "apacheaccesslog" { grok { patterns\_dir =\> "./patterns" match =\> {"message" =\> "%{APACHE\_ACCESS\_LOG}" } break\_on\_match =\> false } grok { … --- ## [Can i use file filter for xml docs](https://discuss.elastic.co/t/can-i-use-file-filter-for-xml-docs/1913)
**Author:** [@Saket\_Kumar](https://discuss.elastic.co/u/Saket_Kumar)\ **Replies:** 11\ **Last updated:** [June 5, 2015, 1:11pm UTC](https://discuss.elastic.co/t/can-i-use-file-filter-for-xml-docs/1913 "2015-06-05T13:11:56Z")
input { file { path =\> "D:\\folder\*.xml" type =\> "string" start\_position =\> "beginning" } } filter { xml {.... } } --- ## [Plugins reference guide](https://discuss.elastic.co/t/plugins-reference-guide/2001)
**Author:** [@Duncan\_Innes](https://discuss.elastic.co/u/Duncan_Innes)\ **Replies:** 0\ **Last updated:** [June 5, 2015, 10:22am UTC](https://discuss.elastic.co/t/plugins-reference-guide/2001 "2015-06-05T10:22:35Z")
Will there be any area for reference guides for the various plugins in https://github.com/logstash-plugins? Am specifically trying to find details for the logstash-input-http plugin (https://github.com/logstash-plugins… --- ## [Logstash 1.5 dies with SyntaxError: (eval):9841: syntax error, unexpected tRBRACK](https://discuss.elastic.co/t/logstash-1-5-dies-with-syntaxerror-eval-9841-syntax-error-unexpected-trbrack/1850)
**Author:** [@Suny](https://discuss.elastic.co/u/Suny)\ **Replies:** 2\ **Last updated:** [June 5, 2015, 8:37am UTC](https://discuss.elastic.co/t/logstash-1-5-dies-with-syntaxerror-eval-9841-syntax-error-unexpected-trbrack/1850 "2015-06-05T08:37:35Z")
Hi. We are switching to logstash 1.5.0-1 to be able to use Shield. But the --configtest throws SyntaxError: (eval):9841: syntax error, unexpected tRBRACK \[exception\]\[class\] == "javax.servlet.ServletException" … --- ## [Handling Multiple Templates in Logstash](https://discuss.elastic.co/t/handling-multiple-templates-in-logstash/1367)
**Author:** [@Suganthi\_Thangavel](https://discuss.elastic.co/u/Suganthi_Thangavel)\ **Replies:** 3\ **Last updated:** [June 5, 2015, 8:27am UTC](https://discuss.elastic.co/t/handling-multiple-templates-in-logstash/1367 "2015-06-05T08:27:35Z")
I have two different csv files with few columns having same name but different data types and i created different templates. How to handle both templates in one conf file. Please help me. --- ## [Tls errors, max mem, max clients... sudden dead everywhere!](https://discuss.elastic.co/t/tls-errors-max-mem-max-clients-sudden-dead-everywhere/1834)
**Author:** [@alexolivan](https://discuss.elastic.co/u/alexolivan)\ **Replies:** 3\ **Last updated:** [June 5, 2015, 1:12am UTC](https://discuss.elastic.co/t/tls-errors-max-mem-max-clients-sudden-dead-everywhere/1834 "2015-06-05T01:12:54Z")
Hi again forum! ...I'm sad as my brand new toy lasted very little time... thank God I kept ald stuff on. As I decided that ELK may still be suitable to have nice stats on services for IT staff, I started creting my fil… --- ## [How to split array without a target?](https://discuss.elastic.co/t/how-to-split-array-without-a-target/1590)
**Author:** [@aiden](https://discuss.elastic.co/u/aiden)\ **Replies:** 1\ **Last updated:** [June 4, 2015, 10:41pm UTC](https://discuss.elastic.co/t/how-to-split-array-without-a-target/1590 "2015-06-04T22:41:50Z")
Hi, I'm trying to split a JSON array into multiple events. Here's a sample input: {"results" : \[{"id": "a1", "name": "hello"}, {"id": "a2", "name": "logstash"}\]} Here's my filter and output config: filter { spli… --- ## [Elapsed.time from Number to Time](https://discuss.elastic.co/t/elapsed-time-from-number-to-time/1745)
**Author:** [@Tibo](https://discuss.elastic.co/u/Tibo)\ **Replies:** 1\ **Last updated:** [June 4, 2015, 9:57pm UTC](https://discuss.elastic.co/t/elapsed-time-from-number-to-time/1745 "2015-06-04T21:57:14Z")
Hi, I am using the filter elapsed to calculate the time between two events. My problem is that the result is a NUMBER (the number of seconds between the events) which is not easy to read. Is there a way to convert this e… --- ## [Logstash 1.4.2 and 1.5.0 stops processing randomly with no errors](https://discuss.elastic.co/t/logstash-1-4-2-and-1-5-0-stops-processing-randomly-with-no-errors/1950)
**Author:** [@gdeconto](https://discuss.elastic.co/u/gdeconto)\ **Replies:** 0\ **Last updated:** [June 4, 2015, 5:09pm UTC](https://discuss.elastic.co/t/logstash-1-4-2-and-1-5-0-stops-processing-randomly-with-no-errors/1950 "2015-06-04T17:09:30Z")
Hopefully someone can help with this issue. I have seen other similar posts but nothing that has helped us so far. Our linux based logstash instance is reading a series of Windows IIS log files from a CIFS share and s… --- ## [Xmpp multiline output](https://discuss.elastic.co/t/xmpp-multiline-output/1948)
**Author:** [@BAKMAH](https://discuss.elastic.co/u/BAKMAH)\ **Replies:** 0\ **Last updated:** [June 4, 2015, 4:26pm UTC](https://discuss.elastic.co/t/xmpp-multiline-output/1948 "2015-06-04T16:26:34Z")
Need an advice how to create logstash xmpp alert message with "newlines". Various replaces with gsub, googled by myself isn't work. Thanks --- ## [XML Filter Help Required](https://discuss.elastic.co/t/xml-filter-help-required/1387)
**Author:** [@Shaun\_Wells](https://discuss.elastic.co/u/Shaun_Wells)\ **Replies:** 6\ **Last updated:** [June 4, 2015, 2:12pm UTC](https://discuss.elastic.co/t/xml-filter-help-required/1387 "2015-06-04T14:12:07Z")
Hello All, I'm trying to get my head around the XML Filter, I have the following configuration for my filter. xml { source =\> "message" target =\> "message\_parsed" add\_tag =\> \["xml\_parsed"\] When… --- ## [Poorly structured log file](https://discuss.elastic.co/t/poorly-structured-log-file/1935)
**Author:** [@Paolo](https://discuss.elastic.co/u/Paolo)\ **Replies:** 1\ **Last updated:** [June 4, 2015, 1:41pm UTC](https://discuss.elastic.co/t/poorly-structured-log-file/1935 "2015-06-04T13:41:10Z")
Hello All, I am trying to analyze a log file with the logstash-elasticsearch-kibana setup. I am still a newby about these nice products and I have a big doubt. The kind of files I will be working with have very differe… --- ## [What does this error mean?](https://discuss.elastic.co/t/what-does-this-error-mean/1901)
**Author:** [@yehosef](https://discuss.elastic.co/u/yehosef)\ **Replies:** 2\ **Last updated:** [June 4, 2015, 1:17pm UTC](https://discuss.elastic.co/t/what-does-this-error-mean/1901 "2015-06-04T13:17:08Z")
I occasionally see errors that look like this in the logstash stdout: Jun 04, 2015 8:48:01 AM org.elasticsearch.monitor.jvm.JvmMonitorService$JvmMonitor monitorLongGc WARNING: \[logstash-es1-20422-9784\] \[gc\]\[young\]\[219\]… --- ## [Logstash Stopped Forwarding Messages to GrayLog After Some Time](https://discuss.elastic.co/t/logstash-stopped-forwarding-messages-to-graylog-after-some-time/1900)
**Author:** [@Haroon\_Khan](https://discuss.elastic.co/u/Haroon_Khan)\ **Replies:** 3\ **Last updated:** [June 4, 2015, 12:26pm UTC](https://discuss.elastic.co/t/logstash-stopped-forwarding-messages-to-graylog-after-some-time/1900 "2015-06-04T12:26:15Z")
Hi guys I have four servers from which i am sending the logs directly to my Gray log server. My Conf file looks like the following. input { file { type =\> "apache-localhost" path =\> "/var/log/tomcat8/localhost\_acc… --- ## [Logstash 1.5 rest plugin exception with rest-client and netrc](https://discuss.elastic.co/t/logstash-1-5-rest-plugin-exception-with-rest-client-and-netrc/1917)
**Author:** [@hurb](https://discuss.elastic.co/u/hurb)\ **Replies:** 0\ **Last updated:** [June 4, 2015, 10:04am UTC](https://discuss.elastic.co/t/logstash-1-5-rest-plugin-exception-with-rest-client-and-netrc/1917 "2015-06-04T10:04:44Z")
Hi guys, I'm trying to write a Logstash filter plugin which uses rest-client to communicate with a REST service. The plugin works fine on my development machine. However, as soon as I put it on a fresh logstash install… --- ## [Could not load : can't convert nil into String?](https://discuss.elastic.co/t/could-not-load-cant-convert-nil-into-string/1814)
**Author:** [@Siddharth\_Trikha](https://discuss.elastic.co/u/Siddharth_Trikha)\ **Replies:** 10\ **Last updated:** [June 4, 2015, 9:15am UTC](https://discuss.elastic.co/t/could-not-load-cant-convert-nil-into-string/1814 "2015-06-04T09:15:20Z")
I want to read logs only after a particular date. So my approach is to drop all the events previous to that date. I try to achieve it like this: So I am dropping all logs before June 1, 2015: Logstash config file: … --- ## [How to refer the value of variable in code block inside add\_field?](https://discuss.elastic.co/t/how-to-refer-the-value-of-variable-in-code-block-inside-add-field/1815)
**Author:** [@Saket\_Kumar](https://discuss.elastic.co/u/Saket_Kumar)\ **Replies:** 2\ **Last updated:** [June 4, 2015, 6:55am UTC](https://discuss.elastic.co/t/how-to-refer-the-value-of-variable-in-code-block-inside-add-field/1815 "2015-06-04T06:55:13Z")
ruby { code =\> " filename = File.basename(event\['path'\], '.\*') value = filename.split('\_') x = value\[0\] y = value\[1\]+'\_' + value\[2\] +'\_'+ value\[3\] z = value\[4\] " add\_field =\> { "Test\_Id" =\> "%{x}" … --- ## [Logstash & embedded elasticsearch](https://discuss.elastic.co/t/logstash-embedded-elasticsearch/1839)
**Author:** [@kebbkh](https://discuss.elastic.co/u/kebbkh)\ **Replies:** 1\ **Last updated:** [June 3, 2015, 11:50pm UTC](https://discuss.elastic.co/t/logstash-embedded-elasticsearch/1839 "2015-06-03T23:50:36Z")
Does elasticsearch not come packaged with logstash in version 1.5? --- ## [Trouble installing logstash kv filter plugin](https://discuss.elastic.co/t/trouble-installing-logstash-kv-filter-plugin/1864)
**Author:** [@Donald\_Nguyen](https://discuss.elastic.co/u/Donald_Nguyen)\ **Replies:** 1\ **Last updated:** [June 3, 2015, 10:52pm UTC](https://discuss.elastic.co/t/trouble-installing-logstash-kv-filter-plugin/1864 "2015-06-03T22:52:37Z")
Hi Logstash Community! I am learning to use the ELK stack and currently trying to install the kv filter plugin for logstash but nothing seems to work for me. I first tried to install filter plugins manual following the… --- ## [Elasticsearch failed to parse date field with logstash](https://discuss.elastic.co/t/elasticsearch-failed-to-parse-date-field-with-logstash/1623)
**Author:** [@abcfy2](https://discuss.elastic.co/u/abcfy2)\ **Replies:** 8\ **Last updated:** [June 3, 2015, 10:40am UTC](https://discuss.elastic.co/t/elasticsearch-failed-to-parse-date-field-with-logstash/1623 "2015-06-03T10:40:38Z")
Here is logstash rubydebug result: { "@timestamp" =\> "2015-06-01T07:56:39.581Z", "message" =\> "2015-06-01 15:56:39,213 \[vert.x-eventloop-thread-0\] INFO hawkeyes.rtds.monitor.MetricsVerticle - Metrics o… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1260) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1262)