# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=296 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 297 --- ## [Where do I find proper syntax for configuring logstash?](https://discuss.elastic.co/t/where-do-i-find-proper-syntax-for-configuring-logstash/251160)
**Author:** [@csheridan](https://discuss.elastic.co/u/csheridan)\ **Replies:** 0\ **Last updated:** [October 6, 2020, 4:03pm UTC](https://discuss.elastic.co/t/where-do-i-find-proper-syntax-for-configuring-logstash/251160 "2020-10-06T16:03:19Z")
I have a server setup with ElasticSearch and Logstash. My plan is to have many remote servers with Filebeat installed and configured to send to this server. Currently, I am trying to get a single node setup so I know how… --- ## [JSON file -\> Filebeat -\> Logstash](https://discuss.elastic.co/t/json-file-filebeat-logstash/250636)
**Author:** [@AnthonyS4](https://discuss.elastic.co/u/AnthonyS4)\ **Replies:** 6\ **Last updated:** [October 6, 2020, 2:59pm UTC](https://discuss.elastic.co/t/json-file-filebeat-logstash/250636 "2020-10-06T14:59:51Z")
Hi, I'm trying to parse a JSON file with Filebeat and then send it to Logstash, Logstash is not receiving data then there is no an output file, these are my configs.yml: filebeat.yml filebeat.inputs: - type: log … --- ## [If Else in logstash filter](https://discuss.elastic.co/t/if-else-in-logstash-filter/251019)
**Author:** [@Rahul\_Ravichandran](https://discuss.elastic.co/u/Rahul_Ravichandran)\ **Replies:** 6\ **Last updated:** [October 6, 2020, 2:53pm UTC](https://discuss.elastic.co/t/if-else-in-logstash-filter/251019 "2020-10-06T14:53:38Z")
hey Guys, kindly help me to solve this There are two types of messages that i am trying to parse 1. {"Code":"BOSIIF902","Message":"Backup stopped. Error during the backup :: SOAP-ERROR: P","time":1583470627,"userId"… --- ## [Logstash imap input unable to read attachment](https://discuss.elastic.co/t/logstash-imap-input-unable-to-read-attachment/251143)
**Author:** [@charles97](https://discuss.elastic.co/u/charles97)\ **Replies:** 0\ **Last updated:** [October 6, 2020, 2:27pm UTC](https://discuss.elastic.co/t/logstash-imap-input-unable-to-read-attachment/251143 "2020-10-06T14:27:05Z")
I tried to parse e-mail attachment using IMAP input plugin in Logstash, but it keeps on returning error as: \[ERROR\] 2020-10-06 21:33:40.789 \[\[main\]\"Can not decode… --- ## [How to fix the sql\_last\_value time?](https://discuss.elastic.co/t/how-to-fix-the-sql-last-value-time/251120)
**Author:** [@gabriel137](https://discuss.elastic.co/u/gabriel137)\ **Replies:** 1\ **Last updated:** [October 6, 2020, 2:25pm UTC](https://discuss.elastic.co/t/how-to-fix-the-sql-last-value-time/251120 "2020-10-06T14:25:05Z")
How do I adjust the logstash time to match my database time? When I try to synchronize with my column update, the logstash seems to be well ahead of the bank's current time --- ## [Flatten the index json data](https://discuss.elastic.co/t/flatten-the-index-json-data/251076)
**Author:** [@Abhi6](https://discuss.elastic.co/u/Abhi6)\ **Replies:** 1\ **Last updated:** [October 6, 2020, 1:37pm UTC](https://discuss.elastic.co/t/flatten-the-index-json-data/251076 "2020-10-06T13:37:42Z")
\[ "code" { 1 }, "foo"{ "bar" }, "foo1" { "number": 1, "type": "In progrss", "submit\_time": "2020-10-04 "id\_type": 2153707, "order\_id": 1601849877, "foo2": \[ "xyz", "qwe", "yty" \], "order\_date": 19/09/… --- ## [Logstash multiple configuration](https://discuss.elastic.co/t/logstash-multiple-configuration/251065)
**Author:** [@peretz\_shlomi](https://discuss.elastic.co/u/peretz_shlomi)\ **Replies:** 7\ **Last updated:** [October 6, 2020, 12:16pm UTC](https://discuss.elastic.co/t/logstash-multiple-configuration/251065 "2020-10-06T12:16:30Z")
Hello everyone I'm trying to install the logstash system with multipel I have a error to run ths system. error: D:\\logstash\\bin\>logstash --path.settings d:/logstash/config Java HotSpot(TM) 64-Bit Server VM warning: … --- ## [Discovery the Logstash service](https://discuss.elastic.co/t/discovery-the-logstash-service/251108)
**Author:** [@DenProg](https://discuss.elastic.co/u/DenProg)\ **Replies:** 0\ **Last updated:** [October 6, 2020, 11:15am UTC](https://discuss.elastic.co/t/discovery-the-logstash-service/251108 "2020-10-06T11:15:14Z")
Our applications connect to Logstash and send logs there. The Logstash service may be located on any ip on the net. I'd like not to write ip of Logstash to a config of a client app, but find it somehow on the net. Is it … --- ## [Unable to run Logstash](https://discuss.elastic.co/t/unable-to-run-logstash/250989)
**Author:** [@Javier\_Stauffenberg](https://discuss.elastic.co/u/Javier_Stauffenberg)\ **Replies:** 12\ **Last updated:** [October 6, 2020, 9:22am UTC](https://discuss.elastic.co/t/unable-to-run-logstash/250989 "2020-10-06T09:22:52Z")
Hi everyone, I am completely new to the ELK stack and have been following several tutorials to set up log stash and create an index from my csv file. Even following every step, and using the uploaded config files, I get… --- ## [\[Logstash-ilm-elasticsearch-output\] ERROR - ilm settings in Logstash Elasticsearch output filter](https://discuss.elastic.co/t/logstash-ilm-elasticsearch-output-error-ilm-settings-in-logstash-elasticsearch-output-filter/249680)
**Author:** [@Apollyon](https://discuss.elastic.co/u/Apollyon)\ **Replies:** 6\ **Last updated:** [October 6, 2020, 9:12am UTC](https://discuss.elastic.co/t/logstash-ilm-elasticsearch-output-error-ilm-settings-in-logstash-elasticsearch-output-filter/249680 "2020-10-06T09:12:23Z")
Hello all, I am currently on Elastic Cloud (ESS) 7.9.1 Have been playing around with the ilm settings in the Elasticsearch output plugin in Logstash. The current setting that has been used and has been working is belo… --- ## [Logstash not picking up multiline logs](https://discuss.elastic.co/t/logstash-not-picking-up-multiline-logs/250823)
**Author:** [@Ayesha](https://discuss.elastic.co/u/Ayesha)\ **Replies:** 1\ **Last updated:** [October 6, 2020, 8:57am UTC](https://discuss.elastic.co/t/logstash-not-picking-up-multiline-logs/250823 "2020-10-06T08:57:24Z")
Hi, I am parsing a log file which has both multiline and singleline logs in it. Here is a sample data 13-08-2020 11:15:41,278 DEBUG \[org.jboss.as.config\] (MSC service thread 1-7) Configured system properties: \[Standa… --- ## [Logstash connecing over HTTP to elastic not HTTPs](https://discuss.elastic.co/t/logstash-connecing-over-http-to-elastic-not-https/251042)
**Author:** [@Oliver2](https://discuss.elastic.co/u/Oliver2)\ **Replies:** 1\ **Last updated:** [October 6, 2020, 5:38am UTC](https://discuss.elastic.co/t/logstash-connecing-over-http-to-elastic-not-https/251042 "2020-10-06T05:38:25Z")
I'm having issues gettings logs into Logstash since enabling SSL. I'm sure they're probably a configuration error but I can't find where. please help. I believe this is the issues that's causing my problems: {:url=\>"ht… --- ## [How to use Elasticsearch SQL { XPACK } in Logstash](https://discuss.elastic.co/t/how-to-use-elasticsearch-sql-xpack-in-logstash/250995)
**Author:** [@tusharnemade](https://discuss.elastic.co/u/tusharnemade)\ **Replies:** 7\ **Last updated:** [October 6, 2020, 5:29am UTC](https://discuss.elastic.co/t/how-to-use-elasticsearch-sql-xpack-in-logstash/250995 "2020-10-06T05:29:19Z")
Hello I am using Logstash 7.8.0 with Elasticsearch v7.8.0. I am using Logstash to extract data from ES Index-1 and inserting into ES Index-2. I am not finding a way to use Elasticsearch SQL a part of xpack into Logsta… --- ## [Create hyperlinks in logstash](https://discuss.elastic.co/t/create-hyperlinks-in-logstash/251010)
**Author:** [@headtea](https://discuss.elastic.co/u/headtea)\ **Replies:** 4\ **Last updated:** [October 6, 2020, 5:05am UTC](https://discuss.elastic.co/t/create-hyperlinks-in-logstash/251010 "2020-10-06T05:05:21Z")
In my logstash output, I have set up an email output that looks like this (put it for reference, doesn't really matter): # If our honeypot (called cowrie) gets someone, send me an email if \[log\]\[file\]\[path\] =~ "cowrie.… --- ## [Logstash elasticsearch input using https error](https://discuss.elastic.co/t/logstash-elasticsearch-input-using-https-error/251041)
**Author:** [@frankfoti](https://discuss.elastic.co/u/frankfoti)\ **Replies:** 1\ **Last updated:** [October 5, 2020, 7:18pm UTC](https://discuss.elastic.co/t/logstash-elasticsearch-input-using-https-error/251041 "2020-10-05T19:18:42Z")
I am able to curl the elasticsearch https but input errors out: \[ffoti@siem-logstash-01 ~\]$ curl -XGET -u elastic:\*\*\*\*\*\*\*\*\* --cacert /etc/logstash/ca.crt --cert /etc/logstash/siem-logstash-01.crt --key /etc/logstash/sie… --- ## [How to correct custom logstash index name for use by ILM](https://discuss.elastic.co/t/how-to-correct-custom-logstash-index-name-for-use-by-ilm/246346)
**Author:** [@hueyg](https://discuss.elastic.co/u/hueyg)\ **Replies:** 6\ **Last updated:** [October 5, 2020, 7:13pm UTC](https://discuss.elastic.co/t/how-to-correct-custom-logstash-index-name-for-use-by-ilm/246346 "2020-10-05T19:13:21Z")
I have a custom logstash index named asa-%date%. I have attempted to apply an ILM policy to it, but I get an error when it attempts to apply. According to an elastic team member in another thread this is because ILM ex… --- ## [How to read the failed and success messages from log file into Kibana](https://discuss.elastic.co/t/how-to-read-the-failed-and-success-messages-from-log-file-into-kibana/250730)
**Author:** [@sukumar.koganti](https://discuss.elastic.co/u/sukumar.koganti)\ **Replies:** 1\ **Last updated:** [October 5, 2020, 5:03pm UTC](https://discuss.elastic.co/t/how-to-read-the-failed-and-success-messages-from-log-file-into-kibana/250730 "2020-10-05T17:03:15Z")
Hi, I want read the the log files bases on timestamp along with the Success messages and failed messages. here is my path (Log Files) C:\\Users\\skkoganti\\Documents\\log Sample: EDI Log-2020-08-04.txt Time|Application|M… --- ## [How to send JSON directly to elasticsearch w/o any parsing in logstash](https://discuss.elastic.co/t/how-to-send-json-directly-to-elasticsearch-w-o-any-parsing-in-logstash/251030)
**Author:** [@nandalapadu\_shamriya](https://discuss.elastic.co/u/nandalapadu_shamriya)\ **Replies:** 0\ **Last updated:** [October 5, 2020, 4:47pm UTC](https://discuss.elastic.co/t/how-to-send-json-directly-to-elasticsearch-w-o-any-parsing-in-logstash/251030 "2020-10-05T16:47:18Z")
I am printing the JSON format logs in my syslog's like below. {"app":"Svc","@timestamp":"2020-10-05T15:25:17.965Z","logger":"com.zaxxer.hikari.pool.HikariPool","level":"WARN","class":"com.zaxxer.hikari.pool.HikariPool$H… --- ## [How to send formatted json logs to logstash?](https://discuss.elastic.co/t/how-to-send-formatted-json-logs-to-logstash/250944)
**Author:** [@nandalapadu\_shamriya](https://discuss.elastic.co/u/nandalapadu_shamriya)\ **Replies:** 0\ **Last updated:** [October 5, 2020, 7:55am UTC](https://discuss.elastic.co/t/how-to-send-formatted-json-logs-to-logstash/250944 "2020-10-05T07:55:13Z")
We are printing the logs in json format in K8 kernel from where the centralized system reading though logstash Agent. {"app":"Svc","@timestamp":"2020-10-05T07:25:37.575Z","logger":"com.ljec.service.impl.LjecServiceImpl"… --- ## [Create map layer from longitude and latitude](https://discuss.elastic.co/t/create-map-layer-from-longitude-and-latitude/251002)
**Author:** [@Luca\_Padovan](https://discuss.elastic.co/u/Luca_Padovan)\ **Replies:** 7\ **Last updated:** [October 5, 2020, 3:39pm UTC](https://discuss.elastic.co/t/create-map-layer-from-longitude-and-latitude/251002 "2020-10-05T15:39:34Z")
I want to create a kibana map using two float fields: lat and lon (latitude and longitude), but when i try to create a map in Kibana I can't do it because i don't have a geoip location field. How can i solve it? --- ## [Push\_map\_as\_event\_on\_timeout with interlaced events](https://discuss.elastic.co/t/push-map-as-event-on-timeout-with-interlaced-events/251017)
**Author:** [@mohsin106](https://discuss.elastic.co/u/mohsin106)\ **Replies:** 0\ **Last updated:** [October 5, 2020, 3:23pm UTC](https://discuss.elastic.co/t/push-map-as-event-on-timeout-with-interlaced-events/251017 "2020-10-05T15:23:50Z")
Hi, I have interlaced events that stream in every minute. For example: event 1: task\_id: "routerA-site1" metric1: val1 metric2: val2 event 2: task\_id:"routerB-site1" metric1: val1 metric2: val2 … --- ## [Logstash and JAVA plugins](https://discuss.elastic.co/t/logstash-and-java-plugins/251008)
**Author:** [@David\_Kennedy](https://discuss.elastic.co/u/David_Kennedy)\ **Replies:** 4\ **Last updated:** [October 5, 2020, 3:12pm UTC](https://discuss.elastic.co/t/logstash-and-java-plugins/251008 "2020-10-05T15:12:35Z")
Wondering if someone would be able to give me a hand. I'm trying to compile a java filter. I've followed the instructions here: https://github.com/logstash-plugins/logstash-filter-java\_filter\_example but get this: \[2… --- ## [Logstash warning (hanshaking error) when connecting with MongoDB](https://discuss.elastic.co/t/logstash-warning-hanshaking-error-when-connecting-with-mongodb/250979)
**Author:** [@carlos-bernad](https://discuss.elastic.co/u/carlos-bernad)\ **Replies:** 2\ **Last updated:** [October 5, 2020, 2:47pm UTC](https://discuss.elastic.co/t/logstash-warning-hanshaking-error-when-connecting-with-mongodb/250979 "2020-10-05T14:47:10Z")
I am trying to store in a MongoDB collection some JSON datalogs filtered by Logstash. Mongod instance and Logstash are running on Windows 8.1 in the same laptop and I also installed logstash-output-mongodb plugin. My co… --- ## [Parse csv attachment in email with IMAP](https://discuss.elastic.co/t/parse-csv-attachment-in-email-with-imap/251006)
**Author:** [@charles97](https://discuss.elastic.co/u/charles97)\ **Replies:** 0\ **Last updated:** [October 5, 2020, 2:21pm UTC](https://discuss.elastic.co/t/parse-csv-attachment-in-email-with-imap/251006 "2020-10-05T14:21:39Z")
I have this kind of use case where I have to parse email's attachment that have .csv format. I saw that logstash offer IMAP input and I saw save\_attachments and strip\_attachments but how do I use it to do with my use ca… --- ## [Logstash \_Bulk when delete indice in elasticsearch](https://discuss.elastic.co/t/logstash-bulk-when-delete-indice-in-elasticsearch/250967)
**Author:** [@AkatsukiPain](https://discuss.elastic.co/u/AkatsukiPain)\ **Replies:** 0\ **Last updated:** [October 5, 2020, 10:04am UTC](https://discuss.elastic.co/t/logstash-bulk-when-delete-indice-in-elasticsearch/250967 "2020-10-05T10:04:03Z")
I have 2 indices sort by day like this: -network-10.02-0001 -network-10.03-0002 And I deleted network-10.03-0002 and the error occurs, can help me about this? --- ## [Config Logstash with https to Elasticsearch cluster](https://discuss.elastic.co/t/config-logstash-with-https-to-elasticsearch-cluster/249606)
**Author:** [@AkatsukiPain](https://discuss.elastic.co/u/AkatsukiPain)\ **Replies:** 2\ **Last updated:** [October 5, 2020, 6:43am UTC](https://discuss.elastic.co/t/config-logstash-with-https-to-elasticsearch-cluster/249606 "2020-10-05T06:43:20Z")
Error Logs in Logstash \[2020-09-23T12:24:31,929\]\[WARN \]\[logstash.outputs.elasticsearch\]\[main\] Attempted to resurrect connection to dead ES instance, but got an error. {:url=\>"https://palelasticsearch01mgt:9200/", :erro… --- ## [Logstash logs isn't like according to its date when see in kibana?](https://discuss.elastic.co/t/logstash-logs-isnt-like-according-to-its-date-when-see-in-kibana/250924)
**Author:** [@Bhavin\_Varsur](https://discuss.elastic.co/u/Bhavin_Varsur)\ **Replies:** 4\ **Last updated:** [October 5, 2020, 6:22am UTC](https://discuss.elastic.co/t/logstash-logs-isnt-like-according-to-its-date-when-see-in-kibana/250924 "2020-10-05T06:22:48Z")
i'm using logstash v7.9.2. i have logs which are day wise like log-2020.10.03, log-2020.10.04, log-2020.10.05 it mixed up everything .i want to separate logs in separate index (daywise log). but i seeing logs of 3r… --- ## [How to get additional information added by filebeat in the output of logstash](https://discuss.elastic.co/t/how-to-get-additional-information-added-by-filebeat-in-the-output-of-logstash/250903)
**Author:** [@linhonghui](https://discuss.elastic.co/u/linhonghui)\ **Replies:** 2\ **Last updated:** [October 5, 2020, 12:54am UTC](https://discuss.elastic.co/t/how-to-get-additional-information-added-by-filebeat-in-the-output-of-logstash/250903 "2020-10-05T00:54:30Z")
Hi I added additional information by fields option in filebeat configuration to identify application name, 'app\_id', such as, filebeat.inputs: - type: log enabled: true fields: app\_id: crawler\_164 ...... output… --- ## [Recommended JVM settings?](https://discuss.elastic.co/t/recommended-jvm-settings/250891)
**Author:** [@headtea](https://discuss.elastic.co/u/headtea)\ **Replies:** 2\ **Last updated:** [October 4, 2020, 5:50pm UTC](https://discuss.elastic.co/t/recommended-jvm-settings/250891 "2020-10-04T17:50:48Z")
this is the settings I gave logstash: -Xms2g -Xmx4g The machine has 8 cores and 24 GB of ram. My problem is that I've only added about 10-15 machines with audit&filebeat and all the cores are over 80% and some reach … --- ## [Use elasticsearch index rollover policy with logstash](https://discuss.elastic.co/t/use-elasticsearch-index-rollover-policy-with-logstash/250504)
**Author:** [@Mohamed\_Saeed](https://discuss.elastic.co/u/Mohamed_Saeed)\ **Replies:** 1\ **Last updated:** [October 4, 2020, 1:13pm UTC](https://discuss.elastic.co/t/use-elasticsearch-index-rollover-policy-with-logstash/250504 "2020-10-04T13:13:01Z")
I'm using elasticsearch and logstash version 7.3.0 I'm using logstash to output all logs to elasticsearch. Now I'm trying to use the rollover policy to delete indexes older than 3 days. I defined policy in elasticsearc… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=295) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=297)