# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=303 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 304 --- ## [How to get cacert for enablingssl\_certificate\_verification?](https://discuss.elastic.co/t/how-to-get-cacert-for-enablingssl-certificate-verification/248909)
**Author:** [@habeebperwad](https://discuss.elastic.co/u/habeebperwad)\ **Replies:** 1\ **Last updated:** [September 17, 2020, 1:20pm UTC](https://discuss.elastic.co/t/how-to-get-cacert-for-enablingssl-certificate-verification/248909 "2020-09-17T13:20:13Z")
ACTUAL TITLE OF THIS QUESTION: How to get cacert for enablingssl\_certificate\_verification? The validation says: Title seems unclear, is it a complete sentence? It may be a very silly question, but I couldn't resolve it… --- ## [Issue with Multiple .conf files](https://discuss.elastic.co/t/issue-with-multiple-conf-files/247760)
**Author:** [@anirudh.venkata](https://discuss.elastic.co/u/anirudh.venkata)\ **Replies:** 6\ **Last updated:** [September 17, 2020, 11:31am UTC](https://discuss.elastic.co/t/issue-with-multiple-conf-files/247760 "2020-09-17T11:31:33Z")
Hi All, My ELK is setup in a single Ubuntu machine.. I am using Logstash as a service to collect different logs and send them to Elasticsearch..Initially ,i have created an auth.conf in logstash conf.d folder to parse L… --- ## [Weird "\_dateparsefailure" issue](https://discuss.elastic.co/t/weird-dateparsefailure-issue/248798)
**Author:** [@opellulo](https://discuss.elastic.co/u/opellulo)\ **Replies:** 2\ **Last updated:** [September 17, 2020, 6:44am UTC](https://discuss.elastic.co/t/weird-dateparsefailure-issue/248798 "2020-09-17T06:44:00Z")
Hi all, I'm facing a really weird issue parsing the date from an access log that doesn't use standard ISO8601 format but one that looks like: \[08/Sep/2020:18:39:23 +0200\] I captured the group with a simple grok in a fi… --- ## [Extract Info from Field using Logstash](https://discuss.elastic.co/t/extract-info-from-field-using-logstash/248883)
**Author:** [@rsuper\_6616](https://discuss.elastic.co/u/rsuper_6616)\ **Replies:** 2\ **Last updated:** [September 16, 2020, 11:25pm UTC](https://discuss.elastic.co/t/extract-info-from-field-using-logstash/248883 "2020-09-16T23:25:40Z")
Hi I have a field in ELK and I am using logstash v7 to extract the logs from Elastic to CSV and I have a field that part of it contains XML and Json how can I write a filter plugin that can get the XML Part or (JSON) it… --- ## [Logstash output plugin elastic\_app\_search not found](https://discuss.elastic.co/t/logstash-output-plugin-elastic-app-search-not-found/248617)
**Author:** [@Henry\_Pak](https://discuss.elastic.co/u/Henry_Pak)\ **Replies:** 1\ **Last updated:** [September 16, 2020, 10:32pm UTC](https://discuss.elastic.co/t/logstash-output-plugin-elastic-app-search-not-found/248617 "2020-09-16T22:32:08Z")
I've been scratching my head for the last couple of hours on this but I can't seem to figure out why Logstash can't find the elastic\_app\_search output plugin. I have a tar.gz install of Logstash 7.9.1 (running on a Mac)… --- ## [What this error means: No implicit conversion to Float](https://discuss.elastic.co/t/what-this-error-means-no-implicit-conversion-to-float/248882)
**Author:** [@nino](https://discuss.elastic.co/u/nino)\ **Replies:** 1\ **Last updated:** [September 16, 2020, 8:54pm UTC](https://discuss.elastic.co/t/what-this-error-means-no-implicit-conversion-to-float/248882 "2020-09-16T20:54:47Z")
I am trying to debug this error: Ruby exception occurred: no implicit conversion of Float into String But i don't know what exactly means, no information about de field or line. --- ## [Debugging logstash indexing issue - trace output on index failure?](https://discuss.elastic.co/t/debugging-logstash-indexing-issue-trace-output-on-index-failure/248869)
**Author:** [@billkrauss3](https://discuss.elastic.co/u/billkrauss3)\ **Replies:** 2\ **Last updated:** [September 16, 2020, 5:53pm UTC](https://discuss.elastic.co/t/debugging-logstash-indexing-issue-trace-output-on-index-failure/248869 "2020-09-16T17:53:20Z")
I'm using logstash to forward events in JSON format to Elasticsearch to enable adhoc log analysis. I need to identify and review the events/log messages that fail to be indexed. ("Could not index event to Elasticsearch",… --- ## [Creating Custom Log level with logstash like prints](https://discuss.elastic.co/t/creating-custom-log-level-with-logstash-like-prints/248870)
**Author:** [@rkhapre](https://discuss.elastic.co/u/rkhapre)\ **Replies:** 0\ **Last updated:** [September 16, 2020, 5:32pm UTC](https://discuss.elastic.co/t/creating-custom-log-level-with-logstash-like-prints/248870 "2020-09-16T17:32:24Z")
Hi All I have created a custom plugin and in that plugin i have added lot of print/puts/milestone checks. Now when i run the pipeline i can see those prints in my command window. How can i customize my log level so th… --- ## [How to configure different indexes in logstash](https://discuss.elastic.co/t/how-to-configure-different-indexes-in-logstash/248752)
**Author:** [@pheathers](https://discuss.elastic.co/u/pheathers)\ **Replies:** 3\ **Last updated:** [September 16, 2020, 5:16pm UTC](https://discuss.elastic.co/t/how-to-configure-different-indexes-in-logstash/248752 "2020-09-16T17:16:59Z")
Hi, I'm trying to ingest multiple (two right now) different formatted logs via Filebeat into Logstash and have them sent to different indexes based on some criteria. The first thought was to use the source (path) to id… --- ## [Get Integer part of float number and round](https://discuss.elastic.co/t/get-integer-part-of-float-number-and-round/248245)
**Author:** [@nino](https://discuss.elastic.co/u/nino)\ **Replies:** 9\ **Last updated:** [September 16, 2020, 4:51pm UTC](https://discuss.elastic.co/t/get-integer-part-of-float-number-and-round/248245 "2020-09-16T16:51:03Z")
Hello all, how can extract integer part of a float field with logstash "field\_fload" =\> 1.4573624 i want to get 1, only the integer part of the float number. And how can round up the float? "field\_fload" =\> 0.923454 … --- ## [Logstash Ruby Filter](https://discuss.elastic.co/t/logstash-ruby-filter/248863)
**Author:** [@Dede\_Pessu](https://discuss.elastic.co/u/Dede_Pessu)\ **Replies:** 0\ **Last updated:** [September 16, 2020, 4:50pm UTC](https://discuss.elastic.co/t/logstash-ruby-filter/248863 "2020-09-16T16:50:15Z")
I am trying to perform file operations through the ruby filter in logstash.. For example FileUtils.mv: to move a file FileUtils.chown: to change file ownership I am getting the following errors for trying to perform b… --- ## [Logstash always restart](https://discuss.elastic.co/t/logstash-always-restart/248854)
**Author:** [@loxiaopohaiol](https://discuss.elastic.co/u/loxiaopohaiol)\ **Replies:** 7\ **Last updated:** [September 16, 2020, 4:47pm UTC](https://discuss.elastic.co/t/logstash-always-restart/248854 "2020-09-16T16:47:49Z")
logstash version:6.0, jdk version: 1.8.0, but no error log for the logstash service, the /var/log/message log is that: Sep 16 23:17:20 localhost.localdomain systemd\[1\]: Started logstash. Sep 16 23:17:30 localhost.local… --- ## [Escape backslash logstash configuration](https://discuss.elastic.co/t/escape-backslash-logstash-configuration/248855)
**Author:** [@grumo35](https://discuss.elastic.co/u/grumo35)\ **Replies:** 2\ **Last updated:** [September 16, 2020, 4:06pm UTC](https://discuss.elastic.co/t/escape-backslash-logstash-configuration/248855 "2020-09-16T16:06:12Z")
Hi, I'm experiencing some troubles trying to split a string using backslash with the split plugin. XXX\\YYY I'd like to use split =\> \["field","\\"\] Quickly ran into escape problems as expected, according to the documen… --- ## [Field value equal to 0 not recognized in a IF statetement](https://discuss.elastic.co/t/field-value-equal-to-0-not-recognized-in-a-if-statetement/248830)
**Author:** [@nino](https://discuss.elastic.co/u/nino)\ **Replies:** 3\ **Last updated:** [September 16, 2020, 1:24pm UTC](https://discuss.elastic.co/t/field-value-equal-to-0-not-recognized-in-a-if-statetement/248830 "2020-09-16T13:24:34Z")
Hello all, i have this float field: { "field\_value" =\> 0.0 } And this if statement in a logstash pipeline: if \[field\_value\] == 0 { mutate{ add\_field =\> {"is\_zero" =\> "yes"} } } else { mutate{ … --- ## [Logstash not pushing logs to kafka after it started](https://discuss.elastic.co/t/logstash-not-pushing-logs-to-kafka-after-it-started/248804)
**Author:** [@hariumesh](https://discuss.elastic.co/u/hariumesh)\ **Replies:** 0\ **Last updated:** [September 16, 2020, 9:29am UTC](https://discuss.elastic.co/t/logstash-not-pushing-logs-to-kafka-after-it-started/248804 "2020-09-16T09:29:37Z")
Hi All, I am new to logstash and iam trying to building a pipeline to push logs from a logdirectory to the kafka topic so i have below config file input { file { path =\> "/home/ubuntu/log\_dir/log\_json.json" … --- ## [Offline plugin install logstash-filter-date\_formatter on logstash 7.4.2](https://discuss.elastic.co/t/offline-plugin-install-logstash-filter-date-formatter-on-logstash-7-4-2/248514)
**Author:** [@goncalobsantos](https://discuss.elastic.co/u/goncalobsantos)\ **Replies:** 2\ **Last updated:** [September 16, 2020, 8:28am UTC](https://discuss.elastic.co/t/offline-plugin-install-logstash-filter-date-formatter-on-logstash-7-4-2/248514 "2020-09-16T08:28:33Z")
I downloaded the zip file with the plugin from Github: https://github.com/wiibaa/logstash-filter-date\_formatter I followed the documentation here, and tried installing the plugin by running the command: ./logstash-plug… --- ## [How to pick range of splitted field in mutate filter](https://discuss.elastic.co/t/how-to-pick-range-of-splitted-field-in-mutate-filter/248656)
**Author:** [@dorinand](https://discuss.elastic.co/u/dorinand)\ **Replies:** 2\ **Last updated:** [September 16, 2020, 7:44am UTC](https://discuss.elastic.co/t/how-to-pick-range-of-splitted-field-in-mutate-filter/248656 "2020-09-16T07:44:43Z")
I generate field on input: input { generator { add\_field =\> { "\[kubernetes\]\[pod\]\[name\]" =\> "aaaa-bbbb-a1b2c3" } count =\> 1 } } I need to remove last part of pod name a1b2c3. Iam trying to split it… --- ## [How to do Hive-logstash integration?](https://discuss.elastic.co/t/how-to-do-hive-logstash-integration/248776)
**Author:** [@Rahul\_Chougule](https://discuss.elastic.co/u/Rahul_Chougule)\ **Replies:** 0\ **Last updated:** [September 16, 2020, 6:58am UTC](https://discuss.elastic.co/t/how-to-do-hive-logstash-integration/248776 "2020-09-16T06:58:22Z")
I want to connect hive through Logstash to ingest data in Elasticsearch. What is the correct configuration to achieve the connection? --- ## [Elasticsearch output hosts list](https://discuss.elastic.co/t/elasticsearch-output-hosts-list/248735)
**Author:** [@YvorL](https://discuss.elastic.co/u/YvorL)\ **Replies:** 4\ **Last updated:** [September 15, 2020, 11:58pm UTC](https://discuss.elastic.co/t/elasticsearch-output-hosts-list/248735 "2020-09-15T23:58:36Z")
Hi, Should I include all Elasticsearch nodes (there are no dedicated masters, and there's one coordinating node) when I specify the list of ES nodes in the output block? I mean in case, I'm horizontally scaling, do I ne… --- ## [Logstash Error: Invalid FieldReference: \`\[iso-8859-1\]to\`](https://discuss.elastic.co/t/logstash-error-invalid-fieldreference-iso-8859-1-to/248712)
**Author:** [@adamzarn](https://discuss.elastic.co/u/adamzarn)\ **Replies:** 5\ **Last updated:** [September 15, 2020, 8:40pm UTC](https://discuss.elastic.co/t/logstash-error-invalid-fieldreference-iso-8859-1-to/248712 "2020-09-15T20:40:11Z")
I'm using ELK v7.9.1 and I get this error with some of records that are coming from CouchDB: logstash | \[2020-09-15T16:03:20,662\]\[ERROR\]\[logstash.javapipeline \]\[main\]\[69664fe8e111893f386d879e5cd848742ac1a327f… --- ## [If/Else comparison to add tag](https://discuss.elastic.co/t/if-else-comparison-to-add-tag/248706)
**Author:** [@vvwood](https://discuss.elastic.co/u/vvwood)\ **Replies:** 5\ **Last updated:** [September 15, 2020, 8:01pm UTC](https://discuss.elastic.co/t/if-else-comparison-to-add-tag/248706 "2020-09-15T20:01:27Z")
Hey y'all, I have been beating my head against the wall trying to accomplish something that seemed rather simple. If anyone could spot would I am missing, I would appreciate it. The seemingly simple task is to compare v… --- ## [Can Grok / dissect filter be used only the last line of the input file?](https://discuss.elastic.co/t/can-grok-dissect-filter-be-used-only-the-last-line-of-the-input-file/248718)
**Author:** [@saurabhc](https://discuss.elastic.co/u/saurabhc)\ **Replies:** 0\ **Last updated:** [September 15, 2020, 5:41pm UTC](https://discuss.elastic.co/t/can-grok-dissect-filter-be-used-only-the-last-line-of-the-input-file/248718 "2020-09-15T17:41:50Z")
Requirement: Depending on the value of a particular field in the last line of the input file, add\_field to all the matched pattern outputs with the value of the field. In the last line of the file, I have a string like … --- ## [Logstash Keystore doesn’t work - v7.7.1](https://discuss.elastic.co/t/logstash-keystore-doesn-t-work-v7-7-1/248711)
**Author:** [@Ashishtechnaut](https://discuss.elastic.co/u/Ashishtechnaut)\ **Replies:** 0\ **Last updated:** [September 15, 2020, 4:06pm UTC](https://discuss.elastic.co/t/logstash-keystore-doesn-t-work-v7-7-1/248711 "2020-09-15T16:06:57Z")
Hi All, We are facing an issue while using Logstash keystore. We followed the steps available at the below link. This is setup on a single node cluster with Platinum License and xpack/TLS enabled. Please find the err… --- ## [How to serach message including "keyword" and format message](https://discuss.elastic.co/t/how-to-serach-message-including-keyword-and-format-message/248701)
**Author:** [@NouhaB](https://discuss.elastic.co/u/NouhaB)\ **Replies:** 0\ **Last updated:** [September 15, 2020, 3:06pm UTC](https://discuss.elastic.co/t/how-to-serach-message-including-keyword-and-format-message/248701 "2020-09-15T15:06:26Z")
Hello, I need to filter logs in order to get only the message begining by "CALL\_END" This is an example of logs : here is my logstash config file : '' input { udp { port =\> 2514 type =\> "syslog" } } filter{ … --- ## [Json + multiline codecs together, is it possible?](https://discuss.elastic.co/t/json-multiline-codecs-together-is-it-possible/248549)
**Author:** [@Hleb\_V](https://discuss.elastic.co/u/Hleb_V)\ **Replies:** 5\ **Last updated:** [September 15, 2020, 12:20pm UTC](https://discuss.elastic.co/t/json-multiline-codecs-together-is-it-possible/248549 "2020-09-15T12:20:01Z")
Hi. We are running Java applications inside docker containers. We use file input with json codec to parse their logs. Unfortunately Java is known to throw stack traces and docker creates a single json entry for every lo… --- ## [The client is not connected when Filebeat connects to Logstash](https://discuss.elastic.co/t/the-client-is-not-connected-when-filebeat-connects-to-logstash/248654)
**Author:** [@XiaoyuZhann](https://discuss.elastic.co/u/XiaoyuZhann)\ **Replies:** 1\ **Last updated:** [September 15, 2020, 10:32am UTC](https://discuss.elastic.co/t/the-client-is-not-connected-when-filebeat-connects-to-logstash/248654 "2020-09-15T10:32:27Z")
I use the container created by the Docker images docker.io/sebp/elk. When Filebeat connects to Elasticsearch, the information is displayed perfectly in Kibana.But after Filebeat connected to Logstash, Filebeat logs repor… --- ## [Struggling to parse XML using Logstash](https://discuss.elastic.co/t/struggling-to-parse-xml-using-logstash/248616)
**Author:** [@Igor\_Olikh](https://discuss.elastic.co/u/Igor_Olikh)\ **Replies:** 0\ **Last updated:** [September 15, 2020, 7:19am UTC](https://discuss.elastic.co/t/struggling-to-parse-xml-using-logstash/248616 "2020-09-15T07:19:17Z")
I have a lot of logs each one stored in the following xml file: What I want to achieve: create fields in elasticsearch that stores the following: MainActivityText = "TEST" My config file: input { file { … --- ## [Config file load error on elastic stack](https://discuss.elastic.co/t/config-file-load-error-on-elastic-stack/248540)
**Author:** [@saiswaroop1989](https://discuss.elastic.co/u/saiswaroop1989)\ **Replies:** 0\ **Last updated:** [September 14, 2020, 2:01pm UTC](https://discuss.elastic.co/t/config-file-load-error-on-elastic-stack/248540 "2020-09-14T14:01:58Z")
Hello, Can some one help with the below error \[2020-09-14T19:28:25,643\]\[WARN \]\[logstash.config.source.multilocal\] Ignoring the 'pipelines.yml' file because modules or command line options are specified \[2020-09-14T19:… --- ## [ES output in Logstash](https://discuss.elastic.co/t/es-output-in-logstash/248390)
**Author:** [@pvaithee07](https://discuss.elastic.co/u/pvaithee07)\ **Replies:** 2\ **Last updated:** [September 14, 2020, 6:36pm UTC](https://discuss.elastic.co/t/es-output-in-logstash/248390 "2020-09-14T18:36:31Z")
Hello All - I have a requirement where i have to send my data to ES index using the ES output plugin from Logstash. If the write to ES Index is successful, i need to write a log (in another ES index) that the record ins… --- ## [Logstash maximum indexes](https://discuss.elastic.co/t/logstash-maximum-indexes/248563)
**Author:** [@headtea](https://discuss.elastic.co/u/headtea)\ **Replies:** 1\ **Last updated:** [September 14, 2020, 5:48pm UTC](https://discuss.elastic.co/t/logstash-maximum-indexes/248563 "2020-09-14T17:48:15Z")
I saw that today's data is missing in kibana. After investigating I noticed that today's index doesn't exist (I create an index everyday. Today's index should be filebeat-7.9.0-2020.09.14) This is what logstash has to s… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=302) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=304)