# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=309 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 310 --- ## [Logstash stopping and restatŕting every 5 seconds and is using more than 600% of cpu](https://discuss.elastic.co/t/logstash-stopping-and-restatrting-every-5-seconds-and-is-using-more-than-600-of-cpu/243202)
**Author:** [@hemant\_472](https://discuss.elastic.co/u/hemant_472)\ **Replies:** 17\ **Last updated:** [August 31, 2020, 9:54am UTC](https://discuss.elastic.co/t/logstash-stopping-and-restatrting-every-5-seconds-and-is-using-more-than-600-of-cpu/243202 "2020-08-31T09:54:54Z")
Logstash is using ore than 600% cpu and is starting and stopping again, actually it is working fine for the filters but still the cpu issue is critical and i am getting below error in the logstash logs - \[2020-07-30T10… --- ## [An error into installing template](https://discuss.elastic.co/t/an-error-into-installing-template/246899)
**Author:** [@AayushPatel](https://discuss.elastic.co/u/AayushPatel)\ **Replies:** 3\ **Last updated:** [August 31, 2020, 7:09am UTC](https://discuss.elastic.co/t/an-error-into-installing-template/246899 "2020-08-31T07:09:22Z")
Hi I am using elastic stacks 7.8.1 and trying to write data in elastic cluster from logstash. this is my simple test pipeline input{ stdin{} } output{ elasticsearch{ hosts =\> "l… --- ## [Logstash JDBC Plugin](https://discuss.elastic.co/t/logstash-jdbc-plugin/246910)
**Author:** [@Rahul12](https://discuss.elastic.co/u/Rahul12)\ **Replies:** 0\ **Last updated:** [August 31, 2020, 6:34am UTC](https://discuss.elastic.co/t/logstash-jdbc-plugin/246910 "2020-08-31T06:34:41Z")
Hi, I am querying MS SQL database to fetch some monitoring parameter. I am using JDBC plugin and firing below query which giving me error. Resultset doesn't return any result. I doubt that we can't use Create table que… --- ## [Unable to delete the document in the elasticserach using logstash action](https://discuss.elastic.co/t/unable-to-delete-the-document-in-the-elasticserach-using-logstash-action/246744)
**Author:** [@Shashikala\_G](https://discuss.elastic.co/u/Shashikala_G)\ **Replies:** 2\ **Last updated:** [August 31, 2020, 6:25am UTC](https://discuss.elastic.co/t/unable-to-delete-the-document-in-the-elasticserach-using-logstash-action/246744 "2020-08-31T06:25:11Z")
Hello there, I am using elasticsearch 7.6.2 version on a single node windows machine. i am trying to delete documents from elastic search using logstash. delete.csv: 272586 logstash configuration file: input{ stdin … --- ## [Use specific NIC for output](https://discuss.elastic.co/t/use-specific-nic-for-output/246906)
**Author:** [@gunlomboy](https://discuss.elastic.co/u/gunlomboy)\ **Replies:** 4\ **Last updated:** [August 31, 2020, 4:58am UTC](https://discuss.elastic.co/t/use-specific-nic-for-output/246906 "2020-08-31T04:58:18Z")
Hi, I'm a complete Logstash newbie, so hopefully this isn't a difficult question to answer. I have 3 NICs on my Logstash servers. I will use one to receive inputs, one for management and one for outputs. I am unable … --- ## [Logstash input beat issue](https://discuss.elastic.co/t/logstash-input-beat-issue/246894)
**Author:** [@Carlos\_Xavier](https://discuss.elastic.co/u/Carlos_Xavier)\ **Replies:** 0\ **Last updated:** [August 30, 2020, 10:42pm UTC](https://discuss.elastic.co/t/logstash-input-beat-issue/246894 "2020-08-30T22:42:23Z")
I getting an issue between filebeat and logstash that I can not uderstand what is gonig on, I need some help with that. Let me tell you what is going on... The filebeat setting is the following.... // filebeat.inputs:… --- ## [How to map multiple patterns using dissect](https://discuss.elastic.co/t/how-to-map-multiple-patterns-using-dissect/246816)
**Author:** [@shani](https://discuss.elastic.co/u/shani)\ **Replies:** 5\ **Last updated:** [August 30, 2020, 9:43pm UTC](https://discuss.elastic.co/t/how-to-map-multiple-patterns-using-dissect/246816 "2020-08-30T21:43:03Z")
Hi all, do we have any option to map more than 1 mapping of raw event as we do with grok like grok {match =\> {"fieldname" =\> \["pattern1", "pattern2", "patternN" ...\]}} Below code gets failed if I see any different patte… --- ## [Is it possible to have Output Specific Filter or vice versa in Logstash](https://discuss.elastic.co/t/is-it-possible-to-have-output-specific-filter-or-vice-versa-in-logstash/246885)
**Author:** [@Dibyendu\_Dutta](https://discuss.elastic.co/u/Dibyendu_Dutta)\ **Replies:** 4\ **Last updated:** [August 30, 2020, 6:20pm UTC](https://discuss.elastic.co/t/is-it-possible-to-have-output-specific-filter-or-vice-versa-in-logstash/246885 "2020-08-30T18:20:08Z")
I want to have a filter specific to Kafka output . Want to send messages with specific keywords only to Kafka. For ES output want to send all messages (no filter) output { kafka { bootstrap\_servers =\> "localh… --- ## [How to assign the extracted data from log file to new added fields](https://discuss.elastic.co/t/how-to-assign-the-extracted-data-from-log-file-to-new-added-fields/246866)
**Author:** [@sudhakar](https://discuss.elastic.co/u/sudhakar)\ **Replies:** 5\ **Last updated:** [August 30, 2020, 4:47pm UTC](https://discuss.elastic.co/t/how-to-assign-the-extracted-data-from-log-file-to-new-added-fields/246866 "2020-08-30T16:47:17Z")
Hi , I have the following logstash config for adding 2 new fields "timestamp1" and "response1" , when I use mutate block I am able to see the new fields but the data parsing is failing from the log file. filter { gr… --- ## [S3 Access denied error in s3snssqs logstash plugin](https://discuss.elastic.co/t/s3-access-denied-error-in-s3snssqs-logstash-plugin/246881)
**Author:** [@Jayakumar\_R\_R](https://discuss.elastic.co/u/Jayakumar_R_R)\ **Replies:** 0\ **Last updated:** [August 30, 2020, 3:43pm UTC](https://discuss.elastic.co/t/s3-access-denied-error-in-s3snssqs-logstash-plugin/246881 "2020-08-30T15:43:19Z")
Hi Team, input { s3snssqs { region =\> "us-east-1" s3\_default\_options =\> { "endpoint\_discovery" =\> true } queue =\> "queue name" queue\_owner\_aws\_account\_i… --- ## [Http\_poller REST API authentication token](https://discuss.elastic.co/t/http-poller-rest-api-authentication-token/246870)
**Author:** [@joe\_good](https://discuss.elastic.co/u/joe_good)\ **Replies:** 5\ **Last updated:** [August 30, 2020, 2:07pm UTC](https://discuss.elastic.co/t/http-poller-rest-api-authentication-token/246870 "2020-08-30T14:07:12Z")
Hello, I'm trying to use logstasth http\_poller plugin to get some events from a rest API method. Before calling the events API methods, I should call the login method and get a token from its response. While I use the … --- ## [Starting logstash with grok](https://discuss.elastic.co/t/starting-logstash-with-grok/246877)
**Author:** [@headtea](https://discuss.elastic.co/u/headtea)\ **Replies:** 1\ **Last updated:** [August 30, 2020, 11:30am UTC](https://discuss.elastic.co/t/starting-logstash-with-grok/246877 "2020-08-30T11:30:03Z")
EDIT: Solved - had to escape " in CMD=\\"%{DATA:Command}\\ I'm trying to start logstash with a new config and it just fails. This is the line I'm trying to add: match =\> { "message" =\> "\\A%{SYSLOGTIMESTAMP:sys\_timestamp… --- ## [Multiple match in one grok {}](https://discuss.elastic.co/t/multiple-match-in-one-grok/246569)
**Author:** [@shani](https://discuss.elastic.co/u/shani)\ **Replies:** 6\ **Last updated:** [August 30, 2020, 8:46am UTC](https://discuss.elastic.co/t/multiple-match-in-one-grok/246569 "2020-08-30T08:46:09Z")
Hi All, I want to match multiple different fields using GROK, this doesn't work grok { match =\> { "winlog\_subject" =\> "Subject:\\\\nSecurity ID:%{DATA:\[winlog\]\[event\_data\]\[SubjectUserSid\]}\\\\nAcc… --- ## [Logstash is sending garbage value to ES](https://discuss.elastic.co/t/logstash-is-sending-garbage-value-to-es/246658)
**Author:** [@Himanshii](https://discuss.elastic.co/u/Himanshii)\ **Replies:** 5\ **Last updated:** [August 29, 2020, 9:12pm UTC](https://discuss.elastic.co/t/logstash-is-sending-garbage-value-to-es/246658 "2020-08-29T21:12:13Z")
I'm using Logstash to read data from Oracle DB & ingesting it into a Kafka topic, then reading the data from the topic & ingesting it into ES (basically Oracle -\> Kafka, Kafka -\> ES). The query used is capturing data for… --- ## [Error on Logstash pipeline](https://discuss.elastic.co/t/error-on-logstash-pipeline/246831)
**Author:** [@zellu\_rakib](https://discuss.elastic.co/u/zellu_rakib)\ **Replies:** 1\ **Last updated:** [August 29, 2020, 2:44pm UTC](https://discuss.elastic.co/t/error-on-logstash-pipeline/246831 "2020-08-29T14:44:09Z")
what is the error on this pipeline: input { jdbc { jdbc\_driver\_library =\> "/mysql-connector-java-8.0.21.jar" jdbc\_driver\_class =\> "com.mysql.jdbc.Driver" jdbc\_connection\_string =\> "jdbc:mysql://74.117.156.179:3306/e… --- ## [If else condition for pipeline filter. How to normalise data before making into Common schema?](https://discuss.elastic.co/t/if-else-condition-for-pipeline-filter-how-to-normalise-data-before-making-into-common-schema/246768)
**Author:** [@kelk](https://discuss.elastic.co/u/kelk)\ **Replies:** 1\ **Last updated:** [August 29, 2020, 1:12pm UTC](https://discuss.elastic.co/t/if-else-condition-for-pipeline-filter-how-to-normalise-data-before-making-into-common-schema/246768 "2020-08-29T13:12:45Z")
We got certain sources coming from syslog servers (different type of data) in a single pipeline. I wanted to split the single pipeline into multiple datasets before applying the common schema For instance, the syslog da… --- ## [Logstash how to different format message](https://discuss.elastic.co/t/logstash-how-to-different-format-message/246076)
**Author:** [@Champion\_Xie](https://discuss.elastic.co/u/Champion_Xie)\ **Replies:** 4\ **Last updated:** [August 29, 2020, 4:11am UTC](https://discuss.elastic.co/t/logstash-how-to-different-format-message/246076 "2020-08-29T04:11:13Z")
07/20/20 00:48:28 INFO hello 353 us.(channel/Channel.cpp:575) 07/20/20 00:48:28 INFO transfercity:bj(city/cityTransferQueryBusiness.cpp:72) 07/20/20 00:48:29 INFO transferQuery city 965380 us.(channel/Channel.cpp:57… --- ## [Connect to Oracle DB using JDBC input plugin](https://discuss.elastic.co/t/connect-to-oracle-db-using-jdbc-input-plugin/246365)
**Author:** [@newtologstash](https://discuss.elastic.co/u/newtologstash)\ **Replies:** 6\ **Last updated:** [August 29, 2020, 1:16am UTC](https://discuss.elastic.co/t/connect-to-oracle-db-using-jdbc-input-plugin/246365 "2020-08-29T01:16:38Z")
Hi, I'm able to connect to oracle database using oracle jdbc thin driver with the below config file. In the original config file we have the username/password parameters defined. input { jdbc { jdbc\_valid… --- ## [Improve grok pattern](https://discuss.elastic.co/t/improve-grok-pattern/246770)
**Author:** [@headtea](https://discuss.elastic.co/u/headtea)\ **Replies:** 5\ **Last updated:** [August 28, 2020, 8:47pm UTC](https://discuss.elastic.co/t/improve-grok-pattern/246770 "2020-08-28T20:47:20Z")
This is some sample data I have: Aug 27 20:21:46 SERVER-150 john: USER=john PWD=/root PID=\[9103\] CMD="cat /etc/passwd" Exit=\[0\] CONNECTION=1.2.3.4 Aug 21 13:21:46 SERVER-230 root: USER=root PWD=/etc/folder PID=\[9023\] CM… --- ## [No raw logs from logstash](https://discuss.elastic.co/t/no-raw-logs-from-logstash/246775)
**Author:** [@jhayvee](https://discuss.elastic.co/u/jhayvee)\ **Replies:** 1\ **Last updated:** [August 28, 2020, 8:31pm UTC](https://discuss.elastic.co/t/no-raw-logs-from-logstash/246775 "2020-08-28T20:31:58Z")
I'm trying to do the import logs using IIS logs here's my config below. input{ file{ path =\>"C:/Users/Administrator/Documents/New folder/u\_ex200419.log" type =\>"iis" start\_position =\> "beginning" } } output{ ela… --- ## [Need a GeoIP Example](https://discuss.elastic.co/t/need-a-geoip-example/246746)
**Author:** [@Amantha](https://discuss.elastic.co/u/Amantha)\ **Replies:** 2\ **Last updated:** [August 28, 2020, 8:30pm UTC](https://discuss.elastic.co/t/need-a-geoip-example/246746 "2020-08-28T20:30:41Z")
Can someone provide a geoip example for logstash with a log file? --- ## [Resta con Ruby en logstash](https://discuss.elastic.co/t/resta-con-ruby-en-logstash/246815)
**Author:** [@mildreey11](https://discuss.elastic.co/u/mildreey11)\ **Replies:** 0\ **Last updated:** [August 28, 2020, 7:30pm UTC](https://discuss.elastic.co/t/resta-con-ruby-en-logstash/246815 "2020-08-28T19:30:08Z")
Buenas Tardes, Estoy realizando una resta de dos fechas con horas(fechainicio y fecha final) en ruby de esta manera en el logstash pero no me muestra el resultado nada muestra .¿alguien sabe que esta mal o que falta agr… --- ## [Assume role in s3snssqs logstash plugin](https://discuss.elastic.co/t/assume-role-in-s3snssqs-logstash-plugin/246795)
**Author:** [@Jayakumar\_R\_R](https://discuss.elastic.co/u/Jayakumar_R_R)\ **Replies:** 0\ **Last updated:** [August 28, 2020, 4:55pm UTC](https://discuss.elastic.co/t/assume-role-in-s3snssqs-logstash-plugin/246795 "2020-08-28T16:55:01Z")
Can we use assume role in s3sqssns plugin? s3snssqs{ queue =\> "name" queue\_owner\_aws\_account\_id =\> "1111111" access\_key\_id =\> "accesskey of trusted account" secret\_key\_id =\> "secretkey of trusted accou… --- ## [Monthly indexes](https://discuss.elastic.co/t/monthly-indexes/246585)
**Author:** [@goncalobsantos](https://discuss.elastic.co/u/goncalobsantos)\ **Replies:** 3\ **Last updated:** [August 28, 2020, 4:18pm UTC](https://discuss.elastic.co/t/monthly-indexes/246585 "2020-08-28T16:18:50Z")
I am using Logstash to create monthly indexes using the following format in the .conf file: output{ elasticsearch{ index =\> "index\_name-%{+YYYY.MM}" ... } } This format places most events in the correct month. Yet… --- ## [Cant inport Data](https://discuss.elastic.co/t/cant-inport-data/246772)
**Author:** [@dustmarijn](https://discuss.elastic.co/u/dustmarijn)\ **Replies:** 0\ **Last updated:** [August 28, 2020, 1:33pm UTC](https://discuss.elastic.co/t/cant-inport-data/246772 "2020-08-28T13:33:44Z")
Hello i'm getting stuck in the inport of my own dummy data, can someone help me? --- ## [Jdbc input plugin doesn't work with prepared statements enabled and large amount of data is proceeding](https://discuss.elastic.co/t/jdbc-input-plugin-doesnt-work-with-prepared-statements-enabled-and-large-amount-of-data-is-proceeding/245981)
**Author:** [@e1m7bo](https://discuss.elastic.co/u/e1m7bo)\ **Replies:** 8\ **Last updated:** [August 28, 2020, 9:29am UTC](https://discuss.elastic.co/t/jdbc-input-plugin-doesnt-work-with-prepared-statements-enabled-and-large-amount-of-data-is-proceeding/245981 "2020-08-28T09:29:09Z")
Before I'll create an issue on Github I'd like to be sure that I'm dealing here with a bug and not with some configuration problem. I've a task to import data from Oracle database to Elasticsearch. Of course I'm using J… --- ## [No such file to load -- elasticsearch/version](https://discuss.elastic.co/t/no-such-file-to-load-elasticsearch-version/246724)
**Author:** [@Ismael\_Garcia](https://discuss.elastic.co/u/Ismael_Garcia)\ **Replies:** 0\ **Last updated:** [August 28, 2020, 7:37am UTC](https://discuss.elastic.co/t/no-such-file-to-load-elasticsearch-version/246724 "2020-08-28T07:37:37Z")
Hi, I got this error message when I load a logstash file: \[ERROR\] 2020-08-28 07:29:27.372 \[main\] Logstash - java.lang.IllegalStateException: Logstash stopped processing because of an error: (LoadError) no such file to… --- ## [Everything looks fine but still the data is not imported and not displayed on the console](https://discuss.elastic.co/t/everything-looks-fine-but-still-the-data-is-not-imported-and-not-displayed-on-the-console/246266)
**Author:** [@Chandana\_Koppal](https://discuss.elastic.co/u/Chandana_Koppal)\ **Replies:** 3\ **Last updated:** [August 28, 2020, 4:58am UTC](https://discuss.elastic.co/t/everything-looks-fine-but-still-the-data-is-not-imported-and-not-displayed-on-the-console/246266 "2020-08-28T04:58:48Z")
C:\\CSV Files\>logstash -f summaryerrorbyfrequency.conf Java HotSpot(TM) 64-Bit Server VM warning: Ignoring option UseConcMarkSweepGC; support was removed in 14.0 Java HotSpot(TM) 64-Bit Server VM warning: Ignoring optio… --- ## [Capture Errors On Input](https://discuss.elastic.co/t/capture-errors-on-input/246193)
**Author:** [@csgeek](https://discuss.elastic.co/u/csgeek)\ **Replies:** 2\ **Last updated:** [August 28, 2020, 1:16am UTC](https://discuss.elastic.co/t/capture-errors-on-input/246193 "2020-08-28T01:16:41Z")
I'd like to add a pattern where errors that occur on the input are captured. I am using the snmp input plugin. If the host is unreachable or anything else happens, I'd like to log the error/exception and send it to a d… --- ## [How to get rid of the logs of one specific output? (ouput exec)](https://discuss.elastic.co/t/how-to-get-rid-of-the-logs-of-one-specific-output-ouput-exec/246693)
**Author:** [@Incauto](https://discuss.elastic.co/u/Incauto)\ **Replies:** 1\ **Last updated:** [August 27, 2020, 10:20pm UTC](https://discuss.elastic.co/t/how-to-get-rid-of-the-logs-of-one-specific-output-ouput-exec/246693 "2020-08-27T22:20:24Z")
Hi, Im using logstahs output exec and every time it runs, the output exec create a log like this: \[2020-08-27T16:56:40,756\]\[INFO \]\[logstash.outputs.exec \]\[my-pipeline\]\[53bf2b...\] the problem is that are hundreds of … [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=308) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=310)