# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=330 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 331 --- ## [Logstash - Trying to assign an existing key to a new key's value](https://discuss.elastic.co/t/logstash-trying-to-assign-an-existing-key-to-a-new-keys-value/241017)
**Author:** [@Acomra](https://discuss.elastic.co/u/Acomra)\ **Replies:** 3\ **Last updated:** [July 13, 2020, 6:05pm UTC](https://discuss.elastic.co/t/logstash-trying-to-assign-an-existing-key-to-a-new-keys-value/241017 "2020-07-13T18:05:58Z")
Hello, I’m pulling aggregated events from Opentsdb and I have a key/value where the key is the epoch event time and value is the agg count. Example: "dps" =\> { "1594657920" =\> 12.0 }, I’m trying to find a way to … --- ## [Kibana throws error while creating index pattern](https://discuss.elastic.co/t/kibana-throws-error-while-creating-index-pattern/240932)
**Author:** [@Sai\_Avinash\_Duddupud](https://discuss.elastic.co/u/Sai_Avinash_Duddupud)\ **Replies:** 6\ **Last updated:** [July 13, 2020, 1:44pm UTC](https://discuss.elastic.co/t/kibana-throws-error-while-creating-index-pattern/240932 "2020-07-13T13:44:02Z")
I have setup logstash on server1 which is sending data to elastic-search(server2) so that I visualise the same in Kibana but when I am creating index patter it throws Internal Server Error as show in the following image. … --- ## [Using Logstash, not able to filter Error Level while indexing to elastic search](https://discuss.elastic.co/t/using-logstash-not-able-to-filter-error-level-while-indexing-to-elastic-search/240916)
**Author:** [@Rakesh\_Katakam](https://discuss.elastic.co/u/Rakesh_Katakam)\ **Replies:** 1\ **Last updated:** [July 13, 2020, 1:38pm UTC](https://discuss.elastic.co/t/using-logstash-not-able-to-filter-error-level-while-indexing-to-elastic-search/240916 "2020-07-13T13:38:21Z")
Hi, I recently started using ELK stack and we came across a scenario where to filter Error level logs in application log files and want to push Elastic search to do more visualization on logs using Kibana. Here below i… --- ## [JDBC\_STATIC\_LOOKUP](https://discuss.elastic.co/t/jdbc-static-lookup/240704)
**Author:** [@Priyanshi\_Tiwari](https://discuss.elastic.co/u/Priyanshi_Tiwari)\ **Replies:** 3\ **Last updated:** [July 13, 2020, 12:22pm UTC](https://discuss.elastic.co/t/jdbc-static-lookup/240704 "2020-07-13T12:22:11Z")
2020-07-07T13:59:30,863\]\[WARN \]\[logstash.filters.jdbc.lookup\] Exception when executing Jdbc query {:lookup\_id=\>"lookup-1", :exception=\>"Java::JavaSql::SQLSyntaxErrorException: Syntax error: Encountered ":" at line 1, col… --- ## [Does logstash has any dependency on Elasticsearch version](https://discuss.elastic.co/t/does-logstash-has-any-dependency-on-elasticsearch-version/240544)
**Author:** [@chinmoy\_padhi](https://discuss.elastic.co/u/chinmoy_padhi)\ **Replies:** 2\ **Last updated:** [July 13, 2020, 11:11am UTC](https://discuss.elastic.co/t/does-logstash-has-any-dependency-on-elasticsearch-version/240544 "2020-07-13T11:11:13Z")
Hi, Does logstash has any dependency on Elasticsearch? When I checked the Kibana documentation it has clearly said that Elasticsearch & Kibana should be on same version. But no such information I am able to find on Elas… --- ## [Losgtash Ruby extract JSON Array Key Value](https://discuss.elastic.co/t/losgtash-ruby-extract-json-array-key-value/240909)
**Author:** [@lueneburger](https://discuss.elastic.co/u/lueneburger)\ **Replies:** 4\ **Last updated:** [July 13, 2020, 11:06am UTC](https://discuss.elastic.co/t/losgtash-ruby-extract-json-array-key-value/240909 "2020-07-13T11:06:13Z")
Hi Everyone, i was looking last week for 2 days for this and i found a solution to my first use case, but i can't get it working for my second one :confused: also its the first time doing something with ruby, so maybe i… --- ## [Ingesting Winlogbeat File output Text file](https://discuss.elastic.co/t/ingesting-winlogbeat-file-output-text-file/240925)
**Author:** [@OntheHighSeas](https://discuss.elastic.co/u/OntheHighSeas)\ **Replies:** 0\ **Last updated:** [July 13, 2020, 8:44am UTC](https://discuss.elastic.co/t/ingesting-winlogbeat-file-output-text-file/240925 "2020-07-13T08:44:11Z")
Hi, Apologies if this should be in the Beats section, though I think it should be Logstash. I need to ingest WInlogbeat events from a system which has WinlogBeats installed but is using a File output, rather than Logst… --- ## [Sending Incident data from PD to elastic](https://discuss.elastic.co/t/sending-incident-data-from-pd-to-elastic/240686)
**Author:** [@Lambo1971](https://discuss.elastic.co/u/Lambo1971)\ **Replies:** 2\ **Last updated:** [July 13, 2020, 8:15am UTC](https://discuss.elastic.co/t/sending-incident-data-from-pd-to-elastic/240686 "2020-07-13T08:15:05Z")
Hi All, would anyone know if it's possible to send PagerDuty incident data to Elastic ..? I know there is a logstash plugin allowing us to monitor Elastic using PD, but I am interested in collating PD data into Elastic. … --- ## [Connect Filebeat to logstash](https://discuss.elastic.co/t/connect-filebeat-to-logstash/240040)
**Author:** [@Revathy](https://discuss.elastic.co/u/Revathy)\ **Replies:** 8\ **Last updated:** [July 13, 2020, 6:15am UTC](https://discuss.elastic.co/t/connect-filebeat-to-logstash/240040 "2020-07-13T06:15:30Z")
Hi, I am trying to setup filebeat to logstash and get below errors at filebeat and logstash end: filebeat; Version: 7.7.0 logstash "number" : "7.8.0" Modified /etc/filebeat/filebeat.yml: enabled: true paths: co… --- ## [Does logstash map to geo\_point type when parsing geoip?](https://discuss.elastic.co/t/does-logstash-map-to-geo-point-type-when-parsing-geoip/240776)
**Author:** [@wajika](https://discuss.elastic.co/u/wajika)\ **Replies:** 2\ **Last updated:** [July 13, 2020, 5:28am UTC](https://discuss.elastic.co/t/does-logstash-map-to-geo-point-type-when-parsing-geoip/240776 "2020-07-13T05:28:48Z")
input{ kafka{ codec =\> "json" decorate\_events =\> true ...... } } filter { geoip { source =\> "remote\_addr" target =\> "geoip" add\_field =\> \["\[geoip\]\[coordinates\]","%{\[geoip\]\[lo… --- ## [Logstash\_jdbc\_last\_run file is not created](https://discuss.elastic.co/t/logstash-jdbc-last-run-file-is-not-created/240882)
**Author:** [@ohoroyoi](https://discuss.elastic.co/u/ohoroyoi)\ **Replies:** 0\ **Last updated:** [July 13, 2020, 2:11am UTC](https://discuss.elastic.co/t/logstash-jdbc-last-run-file-is-not-created/240882 "2020-07-13T02:11:50Z")
./logstash -V 6.8.8 The logstash\_jdbc\_last\_run file is not created. It was created at first, but I deleted it. Then, when I run it with a arbitrary file in another location, sql\_last\_value is not created. And the fil… --- ## [RSS Documentation Update](https://discuss.elastic.co/t/rss-documentation-update/240868)
**Author:** [@aaron-nimocks](https://discuss.elastic.co/u/aaron-nimocks)\ **Replies:** 3\ **Last updated:** [July 13, 2020, 12:14am UTC](https://discuss.elastic.co/t/rss-documentation-update/240868 "2020-07-13T00:14:18Z")
The description is for "exec" plugin and not RSS. --- ## [Additional field for syslog message](https://discuss.elastic.co/t/additional-field-for-syslog-message/237678)
**Author:** [@dghosh](https://discuss.elastic.co/u/dghosh)\ **Replies:** 1\ **Last updated:** [July 12, 2020, 11:38pm UTC](https://discuss.elastic.co/t/additional-field-for-syslog-message/237678 "2020-07-12T23:38:25Z")
can some one help me to create field for below syslog logs urgent. logs below :--- "Thu Jun 18 10:54:37 2020","pro pull / Jurong Singapore","HTTP","go.microsoft.com/fwlink/?LinkID=252669&clcid=0x409","Allowed","General … --- ## [Beats, APM & Logstash auth with aouth or oidc](https://discuss.elastic.co/t/beats-apm-logstash-auth-with-aouth-or-oidc/236588)
**Author:** [@SomeHowChris](https://discuss.elastic.co/u/SomeHowChris)\ **Replies:** 0\ **Last updated:** [June 10, 2020, 10:18pm UTC](https://discuss.elastic.co/t/beats-apm-logstash-auth-with-aouth-or-oidc/236588 "2020-06-10T22:18:47Z")
Greetings all, We are moving towards OAuth on all our applications and so we would like to do the same with logstash, the beats, and apm. Not only to secure compute but also to gain metadata at the service consuming the… --- ## [Duplicate everything to syslog](https://discuss.elastic.co/t/duplicate-everything-to-syslog/236926)
**Author:** [@PangolinCyber](https://discuss.elastic.co/u/PangolinCyber)\ **Replies:** 0\ **Last updated:** [June 12, 2020, 5:13pm UTC](https://discuss.elastic.co/t/duplicate-everything-to-syslog/236926 "2020-06-12T17:13:37Z")
I'm trying to put together a system which is intended to tee everything arriving at an ELK system from all input types to an evidence store syslog platform. i.e everything processed by ELK also goes to a syslog in the ra… --- ## [GROK pattern not work with OPTIONS Request Method](https://discuss.elastic.co/t/grok-pattern-not-work-with-options-request-method/238867)
**Author:** [@muthucse](https://discuss.elastic.co/u/muthucse)\ **Replies:** 0\ **Last updated:** [June 26, 2020, 1:41pm UTC](https://discuss.elastic.co/t/grok-pattern-not-work-with-options-request-method/238867 "2020-06-26T13:41:49Z")
Grok pattern for OPTIONS http method is not working. Pattern: %{TIMESTAMP\_ISO8601:iis.access.time} %{WORD:iis.access.site\_name} %{WORD:http.request.method} %{URIPATH:url.path} Sample Log: 2020-06-16 14:03:12 API OPTI… --- ## [ELK stack - @timestamp issue](https://discuss.elastic.co/t/elk-stack-timestamp-issue/240620)
**Author:** [@jang](https://discuss.elastic.co/u/jang)\ **Replies:** 1\ **Last updated:** [July 12, 2020, 11:00pm UTC](https://discuss.elastic.co/t/elk-stack-timestamp-issue/240620 "2020-07-12T23:00:59Z")
hello, I am using Filebeat, Logstash, Elasticsearch, and Kibana. I found a problem while checking the data through Kibana. @timestamp data is 9hours slower than local time. Of course, I know that i can change the t… --- ## [Logstash snmp input module gets stuck](https://discuss.elastic.co/t/logstash-snmp-input-module-gets-stuck/240533)
**Author:** [@motox73](https://discuss.elastic.co/u/motox73)\ **Replies:** 0\ **Last updated:** [July 9, 2020, 1:25pm UTC](https://discuss.elastic.co/t/logstash-snmp-input-module-gets-stuck/240533 "2020-07-09T13:25:32Z")
Hello, I'm trying to poll SNMP counters ( from Meraki ) using logstash SNMP input module. Sometimes the input plugin gets stuck for no apparent reason. Eventually the logs show logstash attempting a shutdown, but it nev… --- ## [Convert multiline csv data to a single line csv in filter](https://discuss.elastic.co/t/convert-multiline-csv-data-to-a-single-line-csv-in-filter/240741)
**Author:** [@rkhapre](https://discuss.elastic.co/u/rkhapre)\ **Replies:** 6\ **Last updated:** [July 12, 2020, 4:16pm UTC](https://discuss.elastic.co/t/convert-multiline-csv-data-to-a-single-line-csv-in-filter/240741 "2020-07-12T16:16:24Z")
Hi All I have a csv file, which gives me response in multiline csv, i need convert that in a single line csv, Here is the data "header1","header2","header3" "col1row1","col2row1","col3row1" "col1row2","col2row2","col3… --- ## [Logstash manipulate json object before indexing to ES](https://discuss.elastic.co/t/logstash-manipulate-json-object-before-indexing-to-es/240721)
**Author:** [@davehatma](https://discuss.elastic.co/u/davehatma)\ **Replies:** 2\ **Last updated:** [July 12, 2020, 8:46am UTC](https://discuss.elastic.co/t/logstash-manipulate-json-object-before-indexing-to-es/240721 "2020-07-12T08:46:10Z")
A Kafka input plugin is getting messages in json format and being parsed by the json filter. One of the root keys -- transaction\_details -- can contain a very large number of fields that we don't want to flatten into d… --- ## [Run logstash as service giving error](https://discuss.elastic.co/t/run-logstash-as-service-giving-error/240461)
**Author:** [@rohitarorait82](https://discuss.elastic.co/u/rohitarorait82)\ **Replies:** 5\ **Last updated:** [July 12, 2020, 6:17am UTC](https://discuss.elastic.co/t/run-logstash-as-service-giving-error/240461 "2020-07-12T06:17:42Z")
Hi All, I am able to run logstash as command line , but when I try to run it as a services . It is getting restarted after every 6 seconds and no data is getting loaded to elasticsearch I have placed my conf file in et… --- ## [Logstash node stats output --](https://discuss.elastic.co/t/logstash-node-stats-output/240793)
**Author:** [@SNJY](https://discuss.elastic.co/u/SNJY)\ **Replies:** 2\ **Last updated:** [July 12, 2020, 1:03am UTC](https://discuss.elastic.co/t/logstash-node-stats-output/240793 "2020-07-12T01:03:35Z")
Hi, Logstash node stats API "curl localhost:9600/\_node/stats" output shows pipeine id's -- e.g. below - "id" : "abb168b315455ae7945381a4132c04afd8642d0e819883168a76566db277b94e" It seems that logstash generates random… --- ## [Getting mutate\_error while trying to use ECS schema](https://discuss.elastic.co/t/getting-mutate-error-while-trying-to-use-ecs-schema/240707)
**Author:** [@curiousmind](https://discuss.elastic.co/u/curiousmind)\ **Replies:** 4\ **Last updated:** [July 11, 2020, 5:24pm UTC](https://discuss.elastic.co/t/getting-mutate-error-while-trying-to-use-ecs-schema/240707 "2020-07-11T17:24:25Z")
I was trying to ingest Fortigate firewall logs and under ECS schema. Here is my configuration: input { udp { host =\> "0.0.0.0" port =\> 10514 type =\> "log" } } filter { if \[type\] == "log" { kv { … --- ## [Define multiple ES coordinator nodes of same cluster in logstash output](https://discuss.elastic.co/t/define-multiple-es-coordinator-nodes-of-same-cluster-in-logstash-output/240795)
**Author:** [@SNJY](https://discuss.elastic.co/u/SNJY)\ **Replies:** 0\ **Last updated:** [July 11, 2020, 11:36am UTC](https://discuss.elastic.co/t/define-multiple-es-coordinator-nodes-of-same-cluster-in-logstash-output/240795 "2020-07-11T11:36:02Z")
Hi All, I need to define multiple ES coordinator nodes of same cluster in logstash output hosts setting. My cluster and logstash are running on 6.2.4. In this context, I would like to clarify following - Will logstash… --- ## [Syslog with UDP and TCP ports](https://discuss.elastic.co/t/syslog-with-udp-and-tcp-ports/240773)
**Author:** [@ElasticLiver](https://discuss.elastic.co/u/ElasticLiver)\ **Replies:** 1\ **Last updated:** [July 11, 2020, 3:17am UTC](https://discuss.elastic.co/t/syslog-with-udp-and-tcp-ports/240773 "2020-07-11T03:17:38Z")
Hi, I'm ingesting syslog logs with the UDP input, but I have seen others pipelines for syslog logs that use both UDP and TCP, so I was wandering why they do that?, they get different syslog logs from each port? Im gettin… --- ## [Re-index previous heartbeat data in ES through logstash processing](https://discuss.elastic.co/t/re-index-previous-heartbeat-data-in-es-through-logstash-processing/240739)
**Author:** [@paolinux](https://discuss.elastic.co/u/paolinux)\ **Replies:** 2\ **Last updated:** [July 10, 2020, 7:40pm UTC](https://discuss.elastic.co/t/re-index-previous-heartbeat-data-in-es-through-logstash-processing/240739 "2020-07-10T19:40:02Z")
Hi all, I know that the error described in this post has already been discussed but actually I could not find a solution yet. What I have been trying to accomplish it to have Logstash 7.6.2 read a bunch of JSON documen… --- ## [Transfer data from elastic to oracle db with Logstash](https://discuss.elastic.co/t/transfer-data-from-elastic-to-oracle-db-with-logstash/240577)
**Author:** [@liron\_gofberg](https://discuss.elastic.co/u/liron_gofberg)\ **Replies:** 4\ **Last updated:** [July 10, 2020, 6:34pm UTC](https://discuss.elastic.co/t/transfer-data-from-elastic-to-oracle-db-with-logstash/240577 "2020-07-10T18:34:53Z")
Hi, Can Logstash transfer data from Elasticsearch to Oracle db? Thanks, Liron --- ## [Logstash Node & Pipeline Stack-Monitoring 404 on Kibana](https://discuss.elastic.co/t/logstash-node-pipeline-stack-monitoring-404-on-kibana/240453)
**Author:** [@vishakh](https://discuss.elastic.co/u/vishakh)\ **Replies:** 9\ **Last updated:** [July 10, 2020, 6:23pm UTC](https://discuss.elastic.co/t/logstash-node-pipeline-stack-monitoring-404-on-kibana/240453 "2020-07-10T18:23:00Z")
I'm trying to access Logstash Node and Pipeline from Stack-Monitoring but receiving 404 Not Found Below is the Kibana-Log when accessing logstash node-pipeline on kibana { "type": "response", "@timestamp": "2020-07… --- ## [Add\_tag from fields than delete source fields](https://discuss.elastic.co/t/add-tag-from-fields-than-delete-source-fields/240730)
**Author:** [@dikkini](https://discuss.elastic.co/u/dikkini)\ **Replies:** 1\ **Last updated:** [July 10, 2020, 5:43pm UTC](https://discuss.elastic.co/t/add-tag-from-fields-than-delete-source-fields/240730 "2020-07-10T17:43:23Z")
Hello! I got JSON and there tags element which i want to use to add tags. I rename it to telegraf\_tags because of this topic and want to use them as source for ES tags. JSON: {"fields":{"created":1594396144981,"value… --- ## [Logstash if condition skipped](https://discuss.elastic.co/t/logstash-if-condition-skipped/239806)
**Author:** [@katara](https://discuss.elastic.co/u/katara)\ **Replies:** 17\ **Last updated:** [July 10, 2020, 5:16pm UTC](https://discuss.elastic.co/t/logstash-if-condition-skipped/239806 "2020-07-10T17:16:38Z")
Hi, I have a logstash filter as below: mutate { convert =\> {"\[xmldata\]\[metric-data\]\[metricValues\]\[metric-value\]\[value\]" =\> "integer" } } if \[xmldata\]\[metric-data\]\[metricValues\]\[metric-value\]\[value\] == "200" #also tr… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=329) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=331)