# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=304 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 305 --- ## [What's wrong with my mutate filter?](https://discuss.elastic.co/t/whats-wrong-with-my-mutate-filter/248536)
**Author:** [@Haptomai](https://discuss.elastic.co/u/Haptomai)\ **Replies:** 2\ **Last updated:** [September 14, 2020, 2:58pm UTC](https://discuss.elastic.co/t/whats-wrong-with-my-mutate-filter/248536 "2020-09-14T14:58:48Z")
Hi there, first time requiring help here :wink: In order to filter some different inputs (actually same filebeat input, but multiple beats/formats are sent), I achieved to get this following logstash pipeline: input {… --- ## [How to eliminate square brackets in the parsed logs](https://discuss.elastic.co/t/how-to-eliminate-square-brackets-in-the-parsed-logs/248502)
**Author:** [@prajwalgmpp](https://discuss.elastic.co/u/prajwalgmpp)\ **Replies:** 1\ **Last updated:** [September 14, 2020, 1:51pm UTC](https://discuss.elastic.co/t/how-to-eliminate-square-brackets-in-the-parsed-logs/248502 "2020-09-14T13:51:09Z")
The pattern is : match =\> { "message" =\> "%{SYSLOG5424SD:time}%{SYSLOG5424SD:level}%{SYSLOG5424SD:message} %{SYSLOG5424SD:node} realm %{SYSLOG5424SD} authenticated user %{SYSLOG5424SD:user}, with roles %{SYSLOG5424S… --- ## [How to Merge Two indices into Single using Logstash](https://discuss.elastic.co/t/how-to-merge-two-indices-into-single-using-logstash/248534)
**Author:** [@tusharnemade](https://discuss.elastic.co/u/tusharnemade)\ **Replies:** 0\ **Last updated:** [September 14, 2020, 1:30pm UTC](https://discuss.elastic.co/t/how-to-merge-two-indices-into-single-using-logstash/248534 "2020-09-14T13:30:22Z")
Hi Team I am having Elasticsearch Cluster of version 7.8.0 running with multiple indices without a pattern in their names. I want to merge two indices into single index and both \[ source \] do not have common field. I … --- ## [Logstash influxdb output with geoip feature](https://discuss.elastic.co/t/logstash-influxdb-output-with-geoip-feature/247763)
**Author:** [@Vladpov](https://discuss.elastic.co/u/Vladpov)\ **Replies:** 6\ **Last updated:** [September 14, 2020, 9:16am UTC](https://discuss.elastic.co/t/logstash-influxdb-output-with-geoip-feature/247763 "2020-09-14T09:16:46Z")
I'm trying to use logstash geoip filter to send data about location of IP address to InfluxDB via InfluxDB output plugin. My logstash conf file is: input { file { path =\> "/root/geoip\_test.txt" start\_position… --- ## [Logstash GROK](https://discuss.elastic.co/t/logstash-grok/248485)
**Author:** [@Jokie74](https://discuss.elastic.co/u/Jokie74)\ **Replies:** 4\ **Last updated:** [September 14, 2020, 9:08am UTC](https://discuss.elastic.co/t/logstash-grok/248485 "2020-09-14T09:08:42Z")
Hello Community, I'm a bit lost with creating a grok filter and need some help... I am using filebeat for AIX to send errpt messages with syslog to logstash and Kibana to visualize... The Log coming from AIX error\_dea… --- ## [Grok filter not parsing path](https://discuss.elastic.co/t/grok-filter-not-parsing-path/248331)
**Author:** [@Renato](https://discuss.elastic.co/u/Renato)\ **Replies:** 2\ **Last updated:** [September 14, 2020, 7:39am UTC](https://discuss.elastic.co/t/grok-filter-not-parsing-path/248331 "2020-09-14T07:39:29Z")
Hello, i would like to retrieve only the name of my log file, but my grok filter doesn't work. When i put it in grok debugger it works without any problems, also logstash doesn't report any error, i just get tag grokpar… --- ## [Failed to execute action {:id=\>:main, :action\_type=\>LogStash::ConvergeResult::FailedAction,](https://discuss.elastic.co/t/failed-to-execute-action-id-main-action-type-logstash-failedaction/248284)
**Author:** [@AkatsukiPain](https://discuss.elastic.co/u/AkatsukiPain)\ **Replies:** 2\ **Last updated:** [September 14, 2020, 2:23am UTC](https://discuss.elastic.co/t/failed-to-execute-action-id-main-action-type-logstash-failedaction/248284 "2020-09-14T02:23:56Z")
I run logstash with these config, and there is error when running (Fresh install with kibana or elasticsearch): Could u guys help me check this issue? I have tried to find out the problem in some topics but not work … --- ## [Does not whiteliist\_names support \[field\]\[subfiled\] logstash?](https://discuss.elastic.co/t/does-not-whiteliist-names-support-field-subfiled-logstash/248430)
**Author:** [@unisuke](https://discuss.elastic.co/u/unisuke)\ **Replies:** 2\ **Last updated:** [September 14, 2020, 2:13am UTC](https://discuss.elastic.co/t/does-not-whiteliist-names-support-field-subfiled-logstash/248430 "2020-09-14T02:13:10Z")
Hi, Does filter/whtielist\_names support \[fiield\]\[subfield\]? filter { prune { whitelist\_names =\> \["\[content\]\[0\]"\] } } I'm tring above filter for below. When no filter does, the result i… --- ## [Logstash always creates elasticsearch indexes if they dont exist](https://discuss.elastic.co/t/logstash-always-creates-elasticsearch-indexes-if-they-dont-exist/248444)
**Author:** [@ejhayes](https://discuss.elastic.co/u/ejhayes)\ **Replies:** 3\ **Last updated:** [September 13, 2020, 11:16pm UTC](https://discuss.elastic.co/t/logstash-always-creates-elasticsearch-indexes-if-they-dont-exist/248444 "2020-09-13T23:16:30Z")
I precreated Elasticsearch indexes with alias "logstash-beats" and "logstash-postgres" and that works fine with Logstash output. However I would also like to completely disable logstash from creating new indexes at all … --- ## [User credentials cannot be used for local connections](https://discuss.elastic.co/t/user-credentials-cannot-be-used-for-local-connections/247751)
**Author:** [@Adriann](https://discuss.elastic.co/u/Adriann)\ **Replies:** 2\ **Last updated:** [September 13, 2020, 5:44pm UTC](https://discuss.elastic.co/t/user-credentials-cannot-be-used-for-local-connections/247751 "2020-09-13T17:44:50Z")
Hello, I want to use WMI logstash plugin to download information from hosts. I have logstash 7.9.0 installed on Windows 2019 Terminal Server. When I use below config input { wmi { query =\> "win32\_bios" host … --- ## [Metatrader: How Parse Such Logs?](https://discuss.elastic.co/t/metatrader-how-parse-such-logs/248406)
**Author:** [@mzubairsaleem](https://discuss.elastic.co/u/mzubairsaleem)\ **Replies:** 2\ **Last updated:** [September 13, 2020, 11:56am UTC](https://discuss.elastic.co/t/metatrader-how-parse-such-logs/248406 "2020-09-13T11:56:31Z")
Hi, 0 23:35:01.102 Monitor connections: 354 free memory: 3124552 kb cpu: 3% net: 0 Kbyte/s sockets: 513 threads: 71 handles: 1423 0 23:35:01.102 Monitor max. memory block: 2064156 kb process cpu: 0% net in: 0 Kbyte/… --- ## [Timestamp is ingest timestamp, not event timestamp](https://discuss.elastic.co/t/timestamp-is-ingest-timestamp-not-event-timestamp/248351)
**Author:** [@batninja24601](https://discuss.elastic.co/u/batninja24601)\ **Replies:** 5\ **Last updated:** [September 13, 2020, 4:03am UTC](https://discuss.elastic.co/t/timestamp-is-ingest-timestamp-not-event-timestamp/248351 "2020-09-13T04:03:52Z")
I am using Filebeat to send single line ELFF formatted logs from a Bluecoat proxy to Logstash. I believe I am grokking out the timestamp field correctly from the message, but the timestamp in ElasticSearch for all these… --- ## [Expected one of \[ \\\\t\\\\r\\\\n\], \\"#\\", \\"=\>\\" at line](https://discuss.elastic.co/t/expected-one-of-t-r-n-at-line/248050)
**Author:** [@teej](https://discuss.elastic.co/u/teej)\ **Replies:** 5\ **Last updated:** [September 11, 2020, 6:45pm UTC](https://discuss.elastic.co/t/expected-one-of-t-r-n-at-line/248050 "2020-09-11T18:45:39Z")
Hi, I am trying to extract one alphanumeric field in an XML file but the config is not happy. I've search this one out for a while but I cannot seem to figure out what isnt right about this simple config: input { fil… --- ## [Twitter plugin : Twitter client error {:message=\>"", :exception=\>"Twitter::Error::BadRequest",](https://discuss.elastic.co/t/twitter-plugin-twitter-client-error-message-exception-twitter-badrequest/248129)
**Author:** [@HansPeterSloot](https://discuss.elastic.co/u/HansPeterSloot)\ **Replies:** 1\ **Last updated:** [September 11, 2020, 5:28pm UTC](https://discuss.elastic.co/t/twitter-plugin-twitter-client-error-message-exception-twitter-badrequest/248129 "2020-09-11T17:28:32Z")
Hi My version of elasticsearch, logstash is 7.9.1 I am trying to get the twitter input plugin working. My input config is: input { twitter { consumer\_key =\> "aaaa" consumer\_secret =\> "bbb" oauth\_token =\> "ccc" o… --- ## [Execute a PLSQL procedure or funtion](https://discuss.elastic.co/t/execute-a-plsql-procedure-or-funtion/248348)
**Author:** [@Rui\_Goncalves](https://discuss.elastic.co/u/Rui_Goncalves)\ **Replies:** 0\ **Last updated:** [September 11, 2020, 2:42pm UTC](https://discuss.elastic.co/t/execute-a-plsql-procedure-or-funtion/248348 "2020-09-11T14:42:27Z")
Hi, I'm new to elk. I needed on logstash to execute a PLSQL procedure with an input parameter and an output one or as an option execute a PLSQL function with an input parameter and receive a return value. These output/re… --- ## [Grok Parse Help](https://discuss.elastic.co/t/grok-parse-help/248221)
**Author:** [@Jim\_Thunder](https://discuss.elastic.co/u/Jim_Thunder)\ **Replies:** 3\ **Last updated:** [September 11, 2020, 1:38pm UTC](https://discuss.elastic.co/t/grok-parse-help/248221 "2020-09-11T13:38:35Z")
I am trying to pull one piece of information out of a field using grok. I've tried a couple different way and nothing seems to work. Nothing crashes at all, it's just that I don't see the new field that I am expecting to… --- ## [Logstash is not pushing logs to Azure](https://discuss.elastic.co/t/logstash-is-not-pushing-logs-to-azure/248204)
**Author:** [@Henri.C.Lefevre](https://discuss.elastic.co/u/Henri.C.Lefevre)\ **Replies:** 2\ **Last updated:** [September 10, 2020, 4:50pm UTC](https://discuss.elastic.co/t/logstash-is-not-pushing-logs-to-azure/248204 "2020-09-10T16:50:35Z")
Hello, I am using Logstash 7.9 on Ubuntu 18.04 LTS with OpenJDK 11. I configured an Azure Log Analytics plugin with a configuration file which works on logstash 2.3. Logstash seems to start well but no logs are pushed … --- ## [Logstash shuts down if gelf output TCP connection is refused](https://discuss.elastic.co/t/logstash-shuts-down-if-gelf-output-tcp-connection-is-refused/248132)
**Author:** [@Samuel\_Delepiere](https://discuss.elastic.co/u/Samuel_Delepiere)\ **Replies:** 3\ **Last updated:** [September 11, 2020, 1:19pm UTC](https://discuss.elastic.co/t/logstash-shuts-down-if-gelf-output-tcp-connection-is-refused/248132 "2020-09-11T13:19:03Z")
I have configured logstash with a TCP gelf output. However, if the TCP connection cannot be established (e.g graylog is down or hasn't yet been configured to listen on the port), the pipeline aborts and logstash shuts do… --- ## [Regex field starts with a string](https://discuss.elastic.co/t/regex-field-starts-with-a-string/248235)
**Author:** [@ankitachow](https://discuss.elastic.co/u/ankitachow)\ **Replies:** 2\ **Last updated:** [September 11, 2020, 1:12pm UTC](https://discuss.elastic.co/t/regex-field-starts-with-a-string/248235 "2020-09-11T13:12:29Z")
I want to add a new field if a field start with a certain string. Added below code in filter { }, to set a new field error as "Y" if text starts with ERROR: . Doesnt seem to work. if "\[dest\]\[text\]" =~ /^ERROR: .\*/ { … --- ## [Logstash unable to decode Cisco protobuf](https://discuss.elastic.co/t/logstash-unable-to-decode-cisco-protobuf/247955)
**Author:** [@Scottsdash](https://discuss.elastic.co/u/Scottsdash)\ **Replies:** 3\ **Last updated:** [September 11, 2020, 5:01am UTC](https://discuss.elastic.co/t/logstash-unable-to-decode-cisco-protobuf/247955 "2020-09-11T05:01:11Z")
Hoping someone has configured logstash to receive Cisco telemetry before, I'm able to receive the events but can't decode the telemetry. I'm getting the folowing error from logstash: \[WARN \] 2020-09-09 05:18:01.074 \[ni… --- ## [Logstash config not found](https://discuss.elastic.co/t/logstash-config-not-found/248246)
**Author:** [@Sfec](https://discuss.elastic.co/u/Sfec)\ **Replies:** 0\ **Last updated:** [September 10, 2020, 10:28pm UTC](https://discuss.elastic.co/t/logstash-config-not-found/248246 "2020-09-10T22:28:21Z")
I created a logstash config file with the following code input { jdbc { jdbc\_connection\_string =\> "jdbc:sqlserver://localhost/serverName;database=dbName;integratedSecurity=true" jdbc\_… --- ## [How does split filtered events processed?](https://discuss.elastic.co/t/how-does-split-filtered-events-processed/248135)
**Author:** [@sharma\_yash](https://discuss.elastic.co/u/sharma_yash)\ **Replies:** 2\ **Last updated:** [September 10, 2020, 9:30pm UTC](https://discuss.elastic.co/t/how-does-split-filtered-events-processed/248135 "2020-09-10T21:30:02Z")
Hi, I am new to this community and come to know about splitting the events into multiple events. Got to know split filter plugin is the answer. I didn't understand the flow of pipeline when using this plugin. For ex:- … --- ## [Logstash not creating multiple index](https://discuss.elastic.co/t/logstash-not-creating-multiple-index/248234)
**Author:** [@shubham\_gour](https://discuss.elastic.co/u/shubham_gour)\ **Replies:** 4\ **Last updated:** [September 10, 2020, 9:24pm UTC](https://discuss.elastic.co/t/logstash-not-creating-multiple-index/248234 "2020-09-10T21:24:10Z")
i have this code use in conf file of logstash input { beats{ port =\> 5044 } } filter { grok{ match =\> { "message" =\> "%{INT:Event\_Date} %{MONTH:Event\_Month} %{YEAR:Event\_Year} | %{TIME:SFS\_Event\_Time},%{INT:LOG\_N… --- ## [Grok optional pattern parsing](https://discuss.elastic.co/t/grok-optional-pattern-parsing/248220)
**Author:** [@ankitachow](https://discuss.elastic.co/u/ankitachow)\ **Replies:** 2\ **Last updated:** [September 10, 2020, 7:46pm UTC](https://discuss.elastic.co/t/grok-optional-pattern-parsing/248220 "2020-09-10T19:46:22Z")
I have path field that can have values as /root/cncnz05msp1da15-n01\_logs/a.txt OR /root/cncnz05msp1ts05\_logs/a.txt OR /root/cncnz05mspmon\_logs/a.txt; I have below logstash config which is working fine for cncnz05msp1t… --- ## [Remove wildcard fields in logstash](https://discuss.elastic.co/t/remove-wildcard-fields-in-logstash/248173)
**Author:** [@Yanick\_Quirion](https://discuss.elastic.co/u/Yanick_Quirion)\ **Replies:** 4\ **Last updated:** [September 10, 2020, 5:40pm UTC](https://discuss.elastic.co/t/remove-wildcard-fields-in-logstash/248173 "2020-09-10T17:40:10Z")
Hello, I have this data: "winlog" =\> { "channel" =\> "Security", "record\_id" =\> 1401770357, "event\_data" =\> { "param14" =\> "-", "param9" =\> "-", "param21" =\> "-", "param13" =\> … --- ## [Logstash query to elastic](https://discuss.elastic.co/t/logstash-query-to-elastic/248205)
**Author:** [@FDO](https://discuss.elastic.co/u/FDO)\ **Replies:** 0\ **Last updated:** [September 10, 2020, 4:27pm UTC](https://discuss.elastic.co/t/logstash-query-to-elastic/248205 "2020-09-10T16:27:25Z")
I use https://www.elastic.co/guide/en/logstash/current/plugins-filters-elasticsearch.html For end event I trying to find data from first event if \[url\] { elasticsearch { hosts =\> \["${ES\_node… --- ## [Logstash rabbitmq\_input connection recovery fails](https://discuss.elastic.co/t/logstash-rabbitmq-input-connection-recovery-fails/247554)
**Author:** [@Helena\_Ji](https://discuss.elastic.co/u/Helena_Ji)\ **Replies:** 2\ **Last updated:** [September 10, 2020, 4:00pm UTC](https://discuss.elastic.co/t/logstash-rabbitmq-input-connection-recovery-fails/247554 "2020-09-10T16:00:52Z")
I am facing some issue that logstash does not want to reconnect to the rabbitMQ after losing the connection somehow. I am using two logstash instances on two different VMs, these two logstash instances listen to the sam… --- ## [Is auto-generated @timestamp field will always be in UTC timezone?](https://discuss.elastic.co/t/is-auto-generated-timestamp-field-will-always-be-in-utc-timezone/248125)
**Author:** [@patilsharanu](https://discuss.elastic.co/u/patilsharanu)\ **Replies:** 1\ **Last updated:** [September 10, 2020, 3:10pm UTC](https://discuss.elastic.co/t/is-auto-generated-timestamp-field-will-always-be-in-utc-timezone/248125 "2020-09-10T15:10:33Z")
Query: @timestamp field is auto-generated and its in UTC timezone. Will is it always be in UTC or will it change in future releases? \[Input source\](input.txt): 1524206424.034 19395 207.96.0.0 TCP\_MISS/306 15363 GET ht… --- ## [Access original, un-decoded input message](https://discuss.elastic.co/t/access-original-un-decoded-input-message/248100)
**Author:** [@truekonrads](https://discuss.elastic.co/u/truekonrads)\ **Replies:** 1\ **Last updated:** [September 10, 2020, 3:04pm UTC](https://discuss.elastic.co/t/access-original-un-decoded-input-message/248100 "2020-09-10T15:04:18Z")
Hello, How can I access the original input message before it was decoded so that I can refer to it from filter or output? The setup is as follows: I am reading JSON from rabbitmq; the default codec is json and it bre… --- ## [How to filter log file by id in kibana](https://discuss.elastic.co/t/how-to-filter-log-file-by-id-in-kibana/248148)
**Author:** [@HR\_Amani](https://discuss.elastic.co/u/HR_Amani)\ **Replies:** 1\ **Last updated:** [September 10, 2020, 2:58pm UTC](https://discuss.elastic.co/t/how-to-filter-log-file-by-id-in-kibana/248148 "2020-09-10T14:58:44Z")
Hi i am new to ELk stack . i have a log file that contain many bills. every bill has more then 200 lignes of information plus the id of the bill presented in this way informations about bill 1 : informations bill ID :… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=303) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=305)