# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1262 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 1263 --- ## [How can we use web socket](https://discuss.elastic.co/t/how-can-we-use-web-socket/1795)
**Author:** [@Dan](https://discuss.elastic.co/u/Dan)\ **Replies:** 1\ **Last updated:** [June 3, 2015, 5:58am UTC](https://discuss.elastic.co/t/how-can-we-use-web-socket/1795 "2015-06-03T05:58:40Z")
Hi All, Can i know what is exactly purpose of websocket plugin. I wan't to import data from one URL. With above plugin can i able to import data from URL??? If possible please give me step by step procedure OR give m… --- ## [Logstash eventlog](https://discuss.elastic.co/t/logstash-eventlog/1083)
**Author:** [@mobcdi](https://discuss.elastic.co/u/mobcdi)\ **Replies:** 1\ **Last updated:** [June 3, 2015, 4:05am UTC](https://discuss.elastic.co/t/logstash-eventlog/1083 "2015-06-03T04:05:29Z")
I'm trying to get logstash to send Windows 7 64bit to elasticsearch (all local for the moment) but logstash seems to have a problem I have ES running with kibana and marvel locally but when i start logstash it seems t… --- ## [Aggregate logs](https://discuss.elastic.co/t/aggregate-logs/1762)
**Author:** [@kebbkh](https://discuss.elastic.co/u/kebbkh)\ **Replies:** 1\ **Last updated:** [June 2, 2015, 10:08pm UTC](https://discuss.elastic.co/t/aggregate-logs/1762 "2015-06-02T22:08:37Z")
Hello, Is anyone familiar with a way to aggregate a burst of logs into one log (i.e. something similar to throttling, except I won't need to configure logstash to drop the logs) all I want is for logstash to represent … --- ## [Fluentd vs Logstash?](https://discuss.elastic.co/t/fluentd-vs-logstash/1658)
**Author:** [@Joshua\_P](https://discuss.elastic.co/u/Joshua_P)\ **Replies:** 1\ **Last updated:** [June 2, 2015, 3:49pm UTC](https://discuss.elastic.co/t/fluentd-vs-logstash/1658 "2015-06-02T15:49:07Z")
Hello! I know this is a board for Logstash, but I was hoping someone might have some experience with Fluentd and be able to talk about why you chose one over the other. We're evaluating logging solutions at our compan… --- ## [Heroku plugin not working with logstash 1.5?](https://discuss.elastic.co/t/heroku-plugin-not-working-with-logstash-1-5/1736)
**Author:** [@mooreds](https://discuss.elastic.co/u/mooreds)\ **Replies:** 0\ **Last updated:** [June 2, 2015, 2:24pm UTC](https://discuss.elastic.co/t/heroku-plugin-not-working-with-logstash-1-5/1736 "2015-06-02T14:24:54Z")
Hi folks, I'm trying to get the heroku community plugin working with logstash 1.5 $ /opt/logstash/bin/logstash --version logstash 1.5.0 Here's the plugin page: https://www.elastic.co/guide/en/logstash/current/plugin… --- ## [How to refer path from filter to other?](https://discuss.elastic.co/t/how-to-refer-path-from-filter-to-other/1698)
**Author:** [@Saket\_Kumar](https://discuss.elastic.co/u/Saket_Kumar)\ **Replies:** 5\ **Last updated:** [June 2, 2015, 12:22pm UTC](https://discuss.elastic.co/t/how-to-refer-path-from-filter-to-other/1698 "2015-06-02T12:22:36Z")
input { file { path =\> \["/opt/Log/\*.csv" \] start\_position =\> "beginning" } } i have requirement to use if \[path\] == "contains string" then set type =\> string. Also can i refer path in other filte… --- ## [Logstash throttle not triggering email, Is config missing something?](https://discuss.elastic.co/t/logstash-throttle-not-triggering-email-is-config-missing-something/1618)
**Author:** [@Dnyaneshwar\_Sonawane](https://discuss.elastic.co/u/Dnyaneshwar_Sonawane)\ **Replies:** 1\ **Last updated:** [June 2, 2015, 11:44am UTC](https://discuss.elastic.co/t/logstash-throttle-not-triggering-email-is-config-missing-something/1618 "2015-06-02T11:44:43Z")
Hi All , I have setup which is working fine. but when i am trying to send conditional email using throttle its not working. Please find the below config i am using, input { lumberjack { port =\> 5000 type =\>… --- ## [400 Error on Version 1.5.0](https://discuss.elastic.co/t/400-error-on-version-1-5-0/1644)
**Author:** [@Akumar](https://discuss.elastic.co/u/Akumar)\ **Replies:** 1\ **Last updated:** [June 2, 2015, 11:30am UTC](https://discuss.elastic.co/t/400-error-on-version-1-5-0/1644 "2015-06-02T11:30:06Z")
I receive periodic messages such as - :message=\>"failed action with response of 400, dropping action: I cannot seem to locate that in any documentation. Is this because of a busy elastic cluster? Thanks Ash Kuma… --- ## [Issues creating ES indexes after upgrading from 1.4.2 to 1.5.0-1](https://discuss.elastic.co/t/issues-creating-es-indexes-after-upgrading-from-1-4-2-to-1-5-0-1/1673)
**Author:** [@Chris\_Neal](https://discuss.elastic.co/u/Chris_Neal)\ **Replies:** 4\ **Last updated:** [June 2, 2015, 11:29am UTC](https://discuss.elastic.co/t/issues-creating-es-indexes-after-upgrading-from-1-4-2-to-1-5-0-1/1673 "2015-06-02T11:29:06Z")
Hi everyone, I'm hoping this is an easy one. I upgraded from 1.4.2 to 1.5.0-1 on CentOS 6.5 running Java 1.8.0\_31, and now I cannot seem to create indexes in my ES cluster \[frowning\] The only configuration update I … --- ## [Read logs after a particular day?](https://discuss.elastic.co/t/read-logs-after-a-particular-day/1705)
**Author:** [@Siddharth\_Trikha](https://discuss.elastic.co/u/Siddharth_Trikha)\ **Replies:** 1\ **Last updated:** [June 2, 2015, 11:07am UTC](https://discuss.elastic.co/t/read-logs-after-a-particular-day/1705 "2015-06-02T11:07:02Z")
BACKGROUND: We have rsyslog creating log files directories like: /var/log/rsyslog/SERVER-NAME/LOG-DATE/LOG-FILE-NAME So multiple servers are spilling out their logs of different dates to a central location. Now to r… --- ## [Logstash close file handles?](https://discuss.elastic.co/t/logstash-close-file-handles/1706)
**Author:** [@Siddharth\_Trikha](https://discuss.elastic.co/u/Siddharth_Trikha)\ **Replies:** 0\ **Last updated:** [June 2, 2015, 10:53am UTC](https://discuss.elastic.co/t/logstash-close-file-handles/1706 "2015-06-02T10:53:43Z")
BACKGROUND: We have rsyslog creating log files directories like: /var/log/rsyslog/SERVER-NAME/LOG-DATE/LOG-FILE-NAME So multiple servers are spilling out their logs of different dates to a central location. Now to r… --- ## [Logstash unresponsive after new grok pattern added](https://discuss.elastic.co/t/logstash-unresponsive-after-new-grok-pattern-added/1552)
**Author:** [@PeterF](https://discuss.elastic.co/u/PeterF)\ **Replies:** 2\ **Last updated:** [June 2, 2015, 7:37am UTC](https://discuss.elastic.co/t/logstash-unresponsive-after-new-grok-pattern-added/1552 "2015-06-02T07:37:54Z")
Hello, Logstash hangs after processing a few log files. Consumes 100% CPU, ignores SIGTERM and systemctl commands and can only be stopped with kill -9. It stops processing events being sent to it and outputs nothing t… --- ## [How to handle duplicate column name while parsing csv?](https://discuss.elastic.co/t/how-to-handle-duplicate-column-name-while-parsing-csv/1684)
**Author:** [@Saket\_Kumar](https://discuss.elastic.co/u/Saket_Kumar)\ **Replies:** 3\ **Last updated:** [June 2, 2015, 6:33am UTC](https://discuss.elastic.co/t/how-to-handle-duplicate-column-name-while-parsing-csv/1684 "2015-06-02T06:33:19Z")
First help: I have log where duplicate field name occurs with same values. while parsing that csv file just want to entertain single field and their values. e.g. Fields\_A |Fields\_B| Fields\_A| Fields\_C Just want Fi… --- ## [Rsyslog to logstash use mmsequence mod](https://discuss.elastic.co/t/rsyslog-to-logstash-use-mmsequence-mod/1680)
**Author:** [@lee62817](https://discuss.elastic.co/u/lee62817)\ **Replies:** 1\ **Last updated:** [June 2, 2015, 3:42am UTC](https://discuss.elastic.co/t/rsyslog-to-logstash-use-mmsequence-mod/1680 "2015-06-02T03:42:48Z")
HI! i want to use rsyslog mmsequence & omfwd send log to logstash but nothing log send to logstash please help me to fix error ! thank you rsyslog os:centos 7 10.5.1.189 elk os:centos 7 10.5.1.111 rsyslog.con… --- ## [Json typed log4j data using file input](https://discuss.elastic.co/t/json-typed-log4j-data-using-file-input/1659)
**Author:** [@Ducheol\_Kim](https://discuss.elastic.co/u/Ducheol_Kim)\ **Replies:** 3\ **Last updated:** [June 1, 2015, 8:32pm UTC](https://discuss.elastic.co/t/json-typed-log4j-data-using-file-input/1659 "2015-06-01T20:32:06Z")
Hi All. I'm evaluating logstash to replace our river plugin. Currently, I'm testing below topology. Create json data which has changed data and write on file using log4j. Using '%m%n' pattern to write only json valu… --- ## [File output filter writing logs out of order](https://discuss.elastic.co/t/file-output-filter-writing-logs-out-of-order/1654)
**Author:** [@Brandon\_Metcalf](https://discuss.elastic.co/u/Brandon_Metcalf)\ **Replies:** 2\ **Last updated:** [June 1, 2015, 7:11pm UTC](https://discuss.elastic.co/t/file-output-filter-writing-logs-out-of-order/1654 "2015-06-01T19:11:40Z")
This is a continuation from logstash-users; moving here. On Mon, Jun 1, 2015 at 9:50 AM, Magnus Bäck magnus.back@sonymobile.com wrote: On Monday, June 01, 2015 at 16:38 CEST, brandon.metcalf@logicmonitor.com wrote: … --- ## [Not able to create INDEX in ES](https://discuss.elastic.co/t/not-able-to-create-index-in-es/1637)
**Author:** [@Dan](https://discuss.elastic.co/u/Dan)\ **Replies:** 1\ **Last updated:** [June 1, 2015, 12:50pm UTC](https://discuss.elastic.co/t/not-able-to-create-index-in-es/1637 "2015-06-01T12:50:03Z")
Hi All, I am given below twitter input and output code in my logstash-config file. input { twitter { # add your data consumer\_key =\> "" consumer\_secret =\> "" oauth\_token =\> "" … --- ## [Getting data from one particular twitter hashtag](https://discuss.elastic.co/t/getting-data-from-one-particular-twitter-hashtag/1639)
**Author:** [@Dan](https://discuss.elastic.co/u/Dan)\ **Replies:** 0\ **Last updated:** [June 1, 2015, 12:49pm UTC](https://discuss.elastic.co/t/getting-data-from-one-particular-twitter-hashtag/1639 "2015-06-01T12:49:50Z")
Hi All, I would like to get data from one particular twitter hashtag... Example: i am giving you one particular hashtag https://twitter.com/IPL from this IPL hashtag i want to import all data into my logstash. Pl… --- ## [Logstash1.5 Working on HP-Unix?](https://discuss.elastic.co/t/logstash1-5-working-on-hp-unix/1621)
**Author:** [@ankit](https://discuss.elastic.co/u/ankit)\ **Replies:** 1\ **Last updated:** [June 1, 2015, 8:11am UTC](https://discuss.elastic.co/t/logstash1-5-working-on-hp-unix/1621 "2015-06-01T08:11:40Z")
Hi All, I was using logstash 1.4 on multiple operating system like windows, RHEL and HP-Unix. I did some change in filewatch plugin for running on HP-Unix box and due to those change sincedb feature stop working. My … --- ## [Alternative outputs to run alongside Elasticsearch](https://discuss.elastic.co/t/alternative-outputs-to-run-alongside-elasticsearch/1594)
**Author:** [@scottatron](https://discuss.elastic.co/u/scottatron)\ **Replies:** 1\ **Last updated:** [June 1, 2015, 6:32am UTC](https://discuss.elastic.co/t/alternative-outputs-to-run-alongside-elasticsearch/1594 "2015-06-01T06:32:13Z")
We have 300-400 machines piping a volume of roughly 20 million log messages a day through our ELK stack. We’ve recently had some stability issues and taken the opportunity to upgrade all the components and explore some… --- ## [Ruby time filter on LS 1.5](https://discuss.elastic.co/t/ruby-time-filter-on-ls-1-5/1541)
**Author:** [@fbarbeira](https://discuss.elastic.co/u/fbarbeira)\ **Replies:** 3\ **Last updated:** [June 1, 2015, 6:29am UTC](https://discuss.elastic.co/t/ruby-time-filter-on-ls-1-5/1541 "2015-06-01T06:29:48Z")
I want that logstash drop events older than 6 hours, for that purpose I have this ruby filter: ruby { code =\> "event.cancel if Time.now - event\['@timestamp'\] \> 21600" } This filters works like a charm in this envir… --- ## [Issues connecting to connecting to elasticsearch from logstash using stdin input](https://discuss.elastic.co/t/issues-connecting-to-connecting-to-elasticsearch-from-logstash-using-stdin-input/1468)
**Author:** [@Priyanku\_konar](https://discuss.elastic.co/u/Priyanku_konar)\ **Replies:** 3\ **Last updated:** [June 1, 2015, 5:59am UTC](https://discuss.elastic.co/t/issues-connecting-to-connecting-to-elasticsearch-from-logstash-using-stdin-input/1468 "2015-06-01T05:59:37Z")
Logstash is not able to connect to elasticsearch and giving errors in loop , attaching the dump with --debug flag in logstash Logstash startup completed send this message from stdin to elastic search ←\[36moutput rec… --- ## [Collectd codec and notifications](https://discuss.elastic.co/t/collectd-codec-and-notifications/1603)
**Author:** [@gb12345](https://discuss.elastic.co/u/gb12345)\ **Replies:** 0\ **Last updated:** [May 31, 2015, 12:56pm UTC](https://discuss.elastic.co/t/collectd-codec-and-notifications/1603 "2015-05-31T12:56:59Z")
I am attempting to use collectd to monitor various stats on many linux hosts. All the stats are sent to logstash via UDP and the collectd logstash codec. All worked great and I can see all my stats/hosts in kibana. I … --- ## [Can I use grok to match fields?](https://discuss.elastic.co/t/can-i-use-grok-to-match-fields/1343)
**Author:** [@jruybal](https://discuss.elastic.co/u/jruybal)\ **Replies:** 1\ **Last updated:** [May 31, 2015, 10:49am UTC](https://discuss.elastic.co/t/can-i-use-grok-to-match-fields/1343 "2015-05-31T10:49:46Z")
Is it possible to use grok to match multiple fields using regex? I have the metrics filter generating logs. Fields are generated per host and look like event.$HOST.count At this point I'm trying match =\> \[ "event\\… --- ## [Pointing output.conf to a custom added template](https://discuss.elastic.co/t/pointing-output-conf-to-a-custom-added-template/1589)
**Author:** [@bobkabir](https://discuss.elastic.co/u/bobkabir)\ **Replies:** 3\ **Last updated:** [May 31, 2015, 2:05am UTC](https://discuss.elastic.co/t/pointing-output-conf-to-a-custom-added-template/1589 "2015-05-31T02:05:58Z")
i created a new index template in elasticsearch, which is just a copy-paste of the default logstash template except i renamed it x\_logs and put "template" : "x\_logs-\*" my output.conf has this if \[type\] == x\_logs { elas… --- ## [Import data from facebook](https://discuss.elastic.co/t/import-data-from-facebook/1554)
**Author:** [@Dan](https://discuss.elastic.co/u/Dan)\ **Replies:** 1\ **Last updated:** [May 30, 2015, 3:42pm UTC](https://discuss.elastic.co/t/import-data-from-facebook/1554 "2015-05-30T15:42:38Z")
Hi All, Is it possible to import data from facebook to logstash or ES??? If it possible please give me step by step procedure. Thanks, Dan --- ## [Getting logs from several servers](https://discuss.elastic.co/t/getting-logs-from-several-servers/1513)
**Author:** [@psampson](https://discuss.elastic.co/u/psampson)\ **Replies:** 3\ **Last updated:** [May 30, 2015, 3:07pm UTC](https://discuss.elastic.co/t/getting-logs-from-several-servers/1513 "2015-05-30T15:07:35Z")
Hi, I currently have logstash-forwarder running on about 8 servers sending their logs to one logstash instance. I'd like to add this to about a hundred more and I was wondering if it makes sense to have the servers us… --- ## [Split json array and apply filter](https://discuss.elastic.co/t/split-json-array-and-apply-filter/1064)
**Author:** [@michaelT](https://discuss.elastic.co/u/michaelT)\ **Replies:** 2\ **Last updated:** [May 30, 2015, 6:12am UTC](https://discuss.elastic.co/t/split-json-array-and-apply-filter/1064 "2015-05-30T06:12:16Z")
Hi, I'm retrieving a Json Array as Input and would like to know how it would be possible to split it using the split filter in order to send each new item as a single output ? In addition, the other filters should be … --- ## [General guidance needed, multiple log files](https://discuss.elastic.co/t/general-guidance-needed-multiple-log-files/1480)
**Author:** [@jmkgreen](https://discuss.elastic.co/u/jmkgreen)\ **Replies:** 3\ **Last updated:** [May 29, 2015, 2:57pm UTC](https://discuss.elastic.co/t/general-guidance-needed-multiple-log-files/1480 "2015-05-29T14:57:38Z")
Hi, I'm new to Logstash and need some guidance on input from multiple log files. I would like to send all of my logs (i.e. messages, secure, httpd ...) to ELK. What I have found is that if I sent them through rsys… --- ## [Creating Logstash Configuration](https://discuss.elastic.co/t/creating-logstash-configuration/473)
**Author:** [@subrata\_mettle](https://discuss.elastic.co/u/subrata_mettle)\ **Replies:** 11\ **Last updated:** [May 29, 2015, 2:09pm UTC](https://discuss.elastic.co/t/creating-logstash-configuration/473 "2015-05-29T14:09:55Z")
Hi , I am new here and wanted to know how to separate the field and and save it to Elastic Search. below is the one example where you can see that I have various values which has been separated with ",". can any on… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1261) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=1263)