# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=301 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 302 --- ## [Parsing date\_field with date plugin and set it as @timestamp](https://discuss.elastic.co/t/parsing-date-field-with-date-plugin-and-set-it-as-timestamp/249701)
**Author:** [@nino](https://discuss.elastic.co/u/nino)\ **Replies:** 2\ **Last updated:** [September 23, 2020, 8:03pm UTC](https://discuss.elastic.co/t/parsing-date-field-with-date-plugin-and-set-it-as-timestamp/249701 "2020-09-23T20:03:38Z")
Hello all, i am having problems trying to parse this date field and set as @timestamp { "field\_date" =\> "2020-09-08 0:00:00.0" } This try is not running date { timezone =\> "UCT" match =\> \["field\_date", "… --- ## [Event.set and nested filed](https://discuss.elastic.co/t/event-set-and-nested-filed/249684)
**Author:** [@arp220](https://discuss.elastic.co/u/arp220)\ **Replies:** 4\ **Last updated:** [September 23, 2020, 6:47pm UTC](https://discuss.elastic.co/t/event-set-and-nested-filed/249684 "2020-09-23T18:47:24Z")
Hi. I have this config: input { file { path =\> "/opt/logs/sb\_log.json" sincedb\_path =\> "/etc/logstash/.sincedb\_sblog" start\_position =\> "beginning" } } filter{ json { source =\> "message" … --- ## [Best logstash plugin or advice to ingest this csv file on elasticsearch](https://discuss.elastic.co/t/best-logstash-plugin-or-advice-to-ingest-this-csv-file-on-elasticsearch/249686)
**Author:** [@nino](https://discuss.elastic.co/u/nino)\ **Replies:** 2\ **Last updated:** [September 23, 2020, 6:12pm UTC](https://discuss.elastic.co/t/best-logstash-plugin-or-advice-to-ingest-this-csv-file-on-elasticsearch/249686 "2020-09-23T18:12:05Z")
Hello all, i have this csv file that i need to send to elastic: alwats the same csv structure field\_1,field\_2,field\_3,field\_4,field\_5,field\_6 888,0000000A,S,4,2020-09-08 00:00:00.0,name 999,0000000C,S,4,2020-09-08 00:… --- ## [Message not splitting into events on new line](https://discuss.elastic.co/t/message-not-splitting-into-events-on-new-line/249399)
**Author:** [@kbrisso](https://discuss.elastic.co/u/kbrisso)\ **Replies:** 3\ **Last updated:** [September 23, 2020, 5:24pm UTC](https://discuss.elastic.co/t/message-not-splitting-into-events-on-new-line/249399 "2020-09-23T17:24:27Z")
Hello- I have a message that looks like below: \[INFO\] 2020-09-21 09:40:21,476\[ajp-nio-9031-exec-1\] com.gts.ci.jws.filter.ValidationFilter - Validation Filter URL /jsp\_web/access/app\_logout.jsp\\n\[DEBUG\] 2020-09-21 09:4… --- ## [How to get field in xml?](https://discuss.elastic.co/t/how-to-get-field-in-xml/249609)
**Author:** [@Luan\_Ph\_m](https://discuss.elastic.co/u/Luan_Ph_m)\ **Replies:** 1\ **Last updated:** [September 23, 2020, 1:57pm UTC](https://discuss.elastic.co/t/how-to-get-field-in-xml/249609 "2020-09-23T13:57:47Z")
Hi I need to get some field in my xml file but i don't know how to get it. Here my xml \ \ \ \ \1027\ \active\ \ \ **Author:** [@Paulogbr](https://discuss.elastic.co/u/Paulogbr)\ **Replies:** 1\ **Last updated:** [September 23, 2020, 1:25pm UTC](https://discuss.elastic.co/t/rename-field-input-syslog/249575 "2020-09-23T13:25:25Z") Hello Team, I tried rename field in logstash. I received syslog and save log in file. This is my conf. input { udp { port =\> "5133" type =\> "syslog" } } filter { if \[type\] == "syslog" { grok { … --- ## [XML: converting each tag attribute as the actual keys](https://discuss.elastic.co/t/xml-converting-each-tag-attribute-as-the-actual-keys/249546)
**Author:** [@thdesy](https://discuss.elastic.co/u/thdesy)\ **Replies:** 2\ **Last updated:** [September 23, 2020, 12:34pm UTC](https://discuss.elastic.co/t/xml-converting-each-tag-attribute-as-the-actual-keys/249546 "2020-09-23T12:34:53Z")
Hi, I have a somewhat XML log, where the attributes are the actual keys, e.g., \[1\] each event is in a \ tag and every message key/value is in a \ tag. The actual key name is the n attribute and the value is in a 'f… --- ## [FSCrawler Ingestion Issue](https://discuss.elastic.co/t/fscrawler-ingestion-issue/247706)
**Author:** [@Umesh\_S\_Bhimani](https://discuss.elastic.co/u/Umesh_S_Bhimani)\ **Replies:** 4\ **Last updated:** [September 23, 2020, 11:17am UTC](https://discuss.elastic.co/t/fscrawler-ingestion-issue/247706 "2020-09-23T11:17:43Z")
I have installed FSCrawler using a user account on a server and am trying to use a service account later to create a job and ingest the data. Does it require to use the same account used for FSCrawler installation to ing… --- ## [I am getting this error while starting the logstash6.8.0 as docker service using docker stack deploy command](https://discuss.elastic.co/t/i-am-getting-this-error-while-starting-the-logstash6-8-0-as-docker-service-using-docker-stack-deploy-command/249611)
**Author:** [@Tamil\_Selvan](https://discuss.elastic.co/u/Tamil_Selvan)\ **Replies:** 0\ **Last updated:** [September 23, 2020, 7:01am UTC](https://discuss.elastic.co/t/i-am-getting-this-error-while-starting-the-logstash6-8-0-as-docker-service-using-docker-stack-deploy-command/249611 "2020-09-23T07:01:47Z")
Encountered a retryable error. Will Retry with exponential backoff {:code=\>400, :url=\>"http://IP/\_xpack/monitoring/\_bulk?system\_id=logstash&system\_api\_version=6&interval=1s"} --- ## [Failed to execute action {:action=\>logstash::pipelineaction::create/pipeline](https://discuss.elastic.co/t/failed-to-execute-action-action-logstash-create-pipeline/249383)
**Author:** [@ludovic.denee](https://discuss.elastic.co/u/ludovic.denee)\ **Replies:** 4\ **Last updated:** [September 23, 2020, 7:25am UTC](https://discuss.elastic.co/t/failed-to-execute-action-action-logstash-create-pipeline/249383 "2020-09-23T07:25:17Z")
Hi, I'm new in ELK and i'm trying to run the logstash with the default files and I still have the error message attached. I don't understand why this behavior. (see attached print screen) can you help me ? I already tr… --- ## [Multiple statements in logstash JDBC Input](https://discuss.elastic.co/t/multiple-statements-in-logstash-jdbc-input/249450)
**Author:** [@vikramaddagulla](https://discuss.elastic.co/u/vikramaddagulla)\ **Replies:** 5\ **Last updated:** [September 23, 2020, 7:20am UTC](https://discuss.elastic.co/t/multiple-statements-in-logstash-jdbc-input/249450 "2020-09-23T07:20:29Z")
Hello, I have configured jdbc input plugin with 3 statements as below ( providing just an example ) input { jdbc { statement =\> "select from DATABASE1 where TRANSACTION\_DATE \> :sql\_last\_value" use\_column\_valu… --- ## [Set "target" in JSON filter to be variable](https://discuss.elastic.co/t/set-target-in-json-filter-to-be-variable/249434)
**Author:** [@Mohamed\_Saeed](https://discuss.elastic.co/u/Mohamed_Saeed)\ **Replies:** 2\ **Last updated:** [September 23, 2020, 12:36am UTC](https://discuss.elastic.co/t/set-target-in-json-filter-to-be-variable/249434 "2020-09-23T00:36:10Z")
I'm trying to use json filter to parse logs but I want to save them under a new field. I know that I can do something like the following: filter { json{ source =\> "message" target =\> … --- ## [Logstash not listening](https://discuss.elastic.co/t/logstash-not-listening/249325)
**Author:** [@Chandana\_Koppal](https://discuss.elastic.co/u/Chandana_Koppal)\ **Replies:** 1\ **Last updated:** [September 22, 2020, 10:27pm UTC](https://discuss.elastic.co/t/logstash-not-listening/249325 "2020-09-22T22:27:16Z")
2020-09-21T11:01:30.174+0530 INFO cfgfile/reload.go:224 Loading of config files completed. 2020-09-21T11:01:31.181+0530 INFO \[publisher\_pipeline\_output\] pipeline/output.go:143 Connecting to backoff(as… --- ## [Run additional options for logstash in docker container](https://discuss.elastic.co/t/run-additional-options-for-logstash-in-docker-container/249578)
**Author:** [@vinci](https://discuss.elastic.co/u/vinci)\ **Replies:** 2\ **Last updated:** [September 22, 2020, 8:31pm UTC](https://discuss.elastic.co/t/run-additional-options-for-logstash-in-docker-container/249578 "2020-09-22T20:31:59Z")
Hello, I would like to run logstash as such: logstash -e 'input { stdin {}} output { stdout {}}' but within a docker container, using the logstash official image. Is there a way I can do this? I simply want to test th… --- ## [Elasticsearch input on logstash duplicating documents](https://discuss.elastic.co/t/elasticsearch-input-on-logstash-duplicating-documents/249544)
**Author:** [@Matthew\_Field](https://discuss.elastic.co/u/Matthew_Field)\ **Replies:** 0\ **Last updated:** [September 22, 2020, 3:10pm UTC](https://discuss.elastic.co/t/elasticsearch-input-on-logstash-duplicating-documents/249544 "2020-09-22T15:10:25Z")
According to the docs, if i don't set a schedule, the logstash input plugin should run once and only once. However i find logstash keeps adding new duplicate/triplicate etc documents to my output for the longer i run. … --- ## [UDP Input - Get host - how?](https://discuss.elastic.co/t/udp-input-get-host-how/249458)
**Author:** [@diecode](https://discuss.elastic.co/u/diecode)\ **Replies:** 1\ **Last updated:** [September 22, 2020, 2:50pm UTC](https://discuss.elastic.co/t/udp-input-get-host-how/249458 "2020-09-22T14:50:11Z")
Hey, How can I get the sender IP in UDP Input? I would like create an if expression for set type. I tried this, but it is not working: input { udp { port =\> 1514 if \[host\] == "1.1.1.1" {… --- ## [Splitting the data in logstash](https://discuss.elastic.co/t/splitting-the-data-in-logstash/249404)
**Author:** [@subash](https://discuss.elastic.co/u/subash)\ **Replies:** 3\ **Last updated:** [September 22, 2020, 2:46pm UTC](https://discuss.elastic.co/t/splitting-the-data-in-logstash/249404 "2020-09-22T14:46:03Z")
I have a field 'brief' in the below format. "brief": \[ {rx-usage: 0.0, tx-stats: {tx-errors: 0, tx-bytes: 3597278194, tx-bps: 1808, tx-pps: 3, tx-packets: 8620093}, name: vni-0/0, host-inf: eth1, if-oper-status: up, … --- ## [Substracting event fields in partitioned data](https://discuss.elastic.co/t/substracting-event-fields-in-partitioned-data/249119)
**Author:** [@JorritvdLaan](https://discuss.elastic.co/u/JorritvdLaan)\ **Replies:** 3\ **Last updated:** [September 22, 2020, 2:40pm UTC](https://discuss.elastic.co/t/substracting-event-fields-in-partitioned-data/249119 "2020-09-22T14:40:32Z")
Hello, I am working with a set of devices that pushes data to my database every 5 minutes. The data contains a field with the device's id and a field with a float value. Now, for every device I would like to substract … --- ## [Logstash how to solve the problem about jackson-databind CVE-2020-9548](https://discuss.elastic.co/t/logstash-how-to-solve-the-problem-about-jackson-databind-cve-2020-9548/249526)
**Author:** [@geraintj](https://discuss.elastic.co/u/geraintj)\ **Replies:** 0\ **Last updated:** [September 22, 2020, 1:13pm UTC](https://discuss.elastic.co/t/logstash-how-to-solve-the-problem-about-jackson-databind-cve-2020-9548/249526 "2020-09-22T13:13:21Z")
Hi. We're using Logstash 6.8.6, which has a dependency on jackson-databind 2.9.9.3. Our scans are flagging it as vulnerable to CVE-2020-9548: FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction b… --- ## [Why does the replacement @timestamp fail？](https://discuss.elastic.co/t/why-does-the-replacement-timestamp-fail/249210)
**Author:** [@wajika](https://discuss.elastic.co/u/wajika)\ **Replies:** 5\ **Last updated:** [September 22, 2020, 1:09pm UTC](https://discuss.elastic.co/t/why-does-the-replacement-timestamp-fail/249210 "2020-09-22T13:09:15Z")
The index pattern was created without any timestamp. filter { date { match =\> \["\[CreationTime\]","yyyy-MM-dd HH:mm:ss.SSS"\] timezone =\> "Asia/Shanghai" target =\> "@timestamp" } } mutate { … --- ## [Logstash Events Latency using Stats API](https://discuss.elastic.co/t/logstash-events-latency-using-stats-api/249444)
**Author:** [@8wlgns](https://discuss.elastic.co/u/8wlgns)\ **Replies:** 0\ **Last updated:** [September 22, 2020, 5:14am UTC](https://discuss.elastic.co/t/logstash-events-latency-using-stats-api/249444 "2020-09-22T05:14:48Z")
I want to calculate Event duration per millisecond using logstash events stats api. Could I use events.out / events.duration\_in\_millis ? --- ## [Logstash data transformation or Kibana scripted field?](https://discuss.elastic.co/t/logstash-data-transformation-or-kibana-scripted-field/249435)
**Author:** [@kimjavier43](https://discuss.elastic.co/u/kimjavier43)\ **Replies:** 2\ **Last updated:** [September 22, 2020, 4:12am UTC](https://discuss.elastic.co/t/logstash-data-transformation-or-kibana-scripted-field/249435 "2020-09-22T04:12:40Z")
Consider this data that I'm going to index in elastic search. Should I implement it using logstash transformation or kibana scripted field? Which is the best practice? Data mapping: 1 = apple 2 = orange 3 = mango El… --- ## [Logstash - Can't get text on a START\_OBJECT](https://discuss.elastic.co/t/logstash-cant-get-text-on-a-start-object/249400)
**Author:** [@bruno\_aleixo](https://discuss.elastic.co/u/bruno_aleixo)\ **Replies:** 1\ **Last updated:** [September 21, 2020, 7:15pm UTC](https://discuss.elastic.co/t/logstash-cant-get-text-on-a-start-object/249400 "2020-09-21T19:15:36Z")
Hi, could help me with errors at the logstash \[2020-09-21T13:48:42,854\]\[WARN \]\[logstash.outputs.elasticsearch\] Could not index event to Elasticsearch. {:status=\>400, :action=\>\["index", {:\_id=\>nil, :\_index=\>"apimanager-2… --- ## [How to connect to DB2 using JDBC with securityMechanism=13](https://discuss.elastic.co/t/how-to-connect-to-db2-using-jdbc-with-securitymechanism-13/249410)
**Author:** [@fsilveir](https://discuss.elastic.co/u/fsilveir)\ **Replies:** 0\ **Last updated:** [September 21, 2020, 6:40pm UTC](https://discuss.elastic.co/t/how-to-connect-to-db2-using-jdbc-with-securitymechanism-13/249410 "2020-09-21T18:40:18Z")
Hi there, I'm trying to extract some data from a DB2 database with securityMechanism 13. I've tried passing this parameter as part of the connection string as shown below: input { jdbc { jdbc\_connection\_string =\> … --- ## [Logstash config date filter - what am I doing wrong?](https://discuss.elastic.co/t/logstash-config-date-filter-what-am-i-doing-wrong/248186)
**Author:** [@ThePreMan](https://discuss.elastic.co/u/ThePreMan)\ **Replies:** 14\ **Last updated:** [September 21, 2020, 6:23pm UTC](https://discuss.elastic.co/t/logstash-config-date-filter-what-am-i-doing-wrong/248186 "2020-09-21T18:23:50Z")
Hi, I am new to the elastic stack. I am currently having trouble setting the timestamp within the logstash config. The date format to be read: 2019/06/19 10:05:37.000000 19046 2019/06/19 10:07:11.000000 3893143 075… --- ## [Warning about ambiguous (mutate filter + split)](https://discuss.elastic.co/t/warning-about-ambiguous-mutate-filter-split/248881)
**Author:** [@dooger21](https://discuss.elastic.co/u/dooger21)\ **Replies:** 3\ **Last updated:** [September 21, 2020, 4:33pm UTC](https://discuss.elastic.co/t/warning-about-ambiguous-mutate-filter-split/248881 "2020-09-21T16:33:12Z")
Hi everyone, I have a Log that I read using the file plugin and the multiline codec (so far so good), I separate the columns that I want to get using a mutate and split in the filter, however in the execution of my .con… --- ## [How to match IP address to hostname (dns filter)](https://discuss.elastic.co/t/how-to-match-ip-address-to-hostname-dns-filter/246988)
**Author:** [@lilyyy](https://discuss.elastic.co/u/lilyyy)\ **Replies:** 2\ **Last updated:** [September 21, 2020, 4:26pm UTC](https://discuss.elastic.co/t/how-to-match-ip-address-to-hostname-dns-filter/246988 "2020-09-21T16:26:30Z")
Hi all, I'm trying to match the IP address to hostname. Data is json file and it is originally pcap file. I used dns filter in logstash.conf file. mutate { add\_field =\> { "src\_hostname" =\> "%{\[layers\]\[ip\]\[ip\_ip\_sr… --- ## [Grok Syntax](https://discuss.elastic.co/t/grok-syntax/249372)
**Author:** [@kotis](https://discuss.elastic.co/u/kotis)\ **Replies:** 1\ **Last updated:** [September 21, 2020, 4:13pm UTC](https://discuss.elastic.co/t/grok-syntax/249372 "2020-09-21T16:13:26Z")
Hi all :slight\_smile: , I need help with a log file that I need to make a filter from it but I can't since I am not very experienced with grok.. The log is like 2020-07-27 03:04:04,708 INFO hosty.bow.hh.hsw\_5421 Targ… --- ## [Multiple logs are concatenated to single event by Logstash](https://discuss.elastic.co/t/multiple-logs-are-concatenated-to-single-event-by-logstash/248947)
**Author:** [@Khushboo\_Kumari](https://discuss.elastic.co/u/Khushboo_Kumari)\ **Replies:** 2\ **Last updated:** [September 21, 2020, 3:44pm UTC](https://discuss.elastic.co/t/multiple-logs-are-concatenated-to-single-event-by-logstash/248947 "2020-09-21T15:44:20Z")
Hi all, I am using Filebeat to send Multiline logs to Logstash , Filebeat input is a file ( logs.txt), In case multiple events are published to (Logs.txt ) in a millisecond, they all are added as 1 log event to ES. Ple… --- ## [Log Parsing](https://discuss.elastic.co/t/log-parsing/249255)
**Author:** [@mansa](https://discuss.elastic.co/u/mansa)\ **Replies:** 5\ **Last updated:** [September 21, 2020, 2:04pm UTC](https://discuss.elastic.co/t/log-parsing/249255 "2020-09-21T14:04:08Z")
Actually we have two variety of logs. Syslogs which comes from Linux device ( start with time) Syslog but comes from cisco devices Logs which comes from cisco device start with hostname and logs which comes from linux… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=300) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=302)