# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=334 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 335 --- ## [How to inject variables to input plugin](https://discuss.elastic.co/t/how-to-inject-variables-to-input-plugin/239597)
**Author:** [@ohoroyoi](https://discuss.elastic.co/u/ohoroyoi)\ **Replies:** 1\ **Last updated:** [July 2, 2020, 5:32pm UTC](https://discuss.elastic.co/t/how-to-inject-variables-to-input-plugin/239597 "2020-07-02T17:32:19Z")
according to, this answer https://discuss.elastic.co/t/optimize-logstash-configuration/239574/3 I realized I have to compare lastest row date and last run date. but the problem is I don't know that. I can find last ru… --- ## [Pipeline does not exist](https://discuss.elastic.co/t/pipeline-does-not-exist/239478)
**Author:** [@ethical20](https://discuss.elastic.co/u/ethical20)\ **Replies:** 4\ **Last updated:** [July 2, 2020, 5:27pm UTC](https://discuss.elastic.co/t/pipeline-does-not-exist/239478 "2020-07-02T17:27:58Z")
Hi, I'm sending logs from filebeat to logstash but it I'm getting this error from logstash connecting to elastisearch: Jul 01 14:26:49 elk logstash\[5445\]: \[2020-07-01T14:26:49,288\]\[WARN \]\[logstash.outputs.elasticsearch… --- ## [Help with filter](https://discuss.elastic.co/t/help-with-filter/239556)
**Author:** [@rocanelo](https://discuss.elastic.co/u/rocanelo)\ **Replies:** 2\ **Last updated:** [July 2, 2020, 5:13pm UTC](https://discuss.elastic.co/t/help-with-filter/239556 "2020-07-02T17:13:39Z")
Dear community I have the next logs: \<6\> CEF:0|A10|TH1040S|4.1.4-GR1-P2|WAF62|filter-resp-hdrs|6|rt=Jul 01 2020 20:14:29 src=X.X.X.X spt=36230 dst=X.X.X.X dpt=443 dhost=axd341sas12jf.enjoy.cl cs1=WAF\_TEST cs2=8e139634b… --- ## [Date filter needed for unix timestamps?](https://discuss.elastic.co/t/date-filter-needed-for-unix-timestamps/239585)
**Author:** [@madduck](https://discuss.elastic.co/u/madduck)\ **Replies:** 2\ **Last updated:** [July 2, 2020, 12:52pm UTC](https://discuss.elastic.co/t/date-filter-needed-for-unix-timestamps/239585 "2020-07-02T12:52:30Z")
Greetings Logstashers, I wrote a grok parser for one of my logs, the log in question has a unix timestamp. Here's a line from the log: {"name":"firefox.exe","pid":"7668","start\_time":"1585318348"} Here's what my gr… --- ## [Grokparse failure for multiline ERROR messages but not for WARN log levels](https://discuss.elastic.co/t/grokparse-failure-for-multiline-error-messages-but-not-for-warn-log-levels/239252)
**Author:** [@ramokarahasan](https://discuss.elastic.co/u/ramokarahasan)\ **Replies:** 2\ **Last updated:** [July 2, 2020, 9:53am UTC](https://discuss.elastic.co/t/grokparse-failure-for-multiline-error-messages-but-not-for-warn-log-levels/239252 "2020-07-02T09:53:06Z")
Hi, I'm using filebeat -\> logstash -\> elasticsearch -\> kibana and would like to have the loglevels displayed in kibana. Filebeat 7.6.2 Logstash 7.6.1 This works fine with WARN and INFO but not for ERROR log levels. M… --- ## [Delete raw text files once file beat forwarded to ELK](https://discuss.elastic.co/t/delete-raw-text-files-once-file-beat-forwarded-to-elk/239408)
**Author:** [@Puneeth\_S\_B\_Gowda1](https://discuss.elastic.co/u/Puneeth_S_B_Gowda1)\ **Replies:** 2\ **Last updated:** [July 2, 2020, 8:46am UTC](https://discuss.elastic.co/t/delete-raw-text-files-once-file-beat-forwarded-to-elk/239408 "2020-07-02T08:46:51Z")
Is there any way to delete text file in the folder after forwarding into ELK ? example 10 text file there in source folder 5 files has been sent through file beat to logstash and able to see in Kibana then once data avai… --- ## [How to convert my time with the date filter for kibana](https://discuss.elastic.co/t/how-to-convert-my-time-with-the-date-filter-for-kibana/239579)
**Author:** [@Mathis\_Gourc](https://discuss.elastic.co/u/Mathis_Gourc)\ **Replies:** 1\ **Last updated:** [July 2, 2020, 8:06am UTC](https://discuss.elastic.co/t/how-to-convert-my-time-with-the-date-filter-for-kibana/239579 "2020-07-02T08:06:52Z")
I need to exploit this log line: 30361 30485 494 8861012 42:42 /plw/modules/bin/Lx86\_64/opx2-intranet.exe -I /plw/modules/bin/Lx86\_64/opx2-intranet.dxl -H /plw/modules/bin/Lx86\_64 -L /plw/PLW\_PROD/modules/preload… --- ## [ShutdownWatcherExt The shutdown process appears to be stalled due to busy or blocked plugins without input entrace](https://discuss.elastic.co/t/shutdownwatcherext-the-shutdown-process-appears-to-be-stalled-due-to-busy-or-blocked-plugins-without-input-entrace/239343)
**Author:** [@ledoc](https://discuss.elastic.co/u/ledoc)\ **Replies:** 2\ **Last updated:** [July 2, 2020, 8:09am UTC](https://discuss.elastic.co/t/shutdownwatcherext-the-shutdown-process-appears-to-be-stalled-due-to-busy-or-blocked-plugins-without-input-entrace/239343 "2020-07-02T08:09:19Z")
Hello, I'm installing new stack elk for my stage env. Kibana, and ES are ok, but I have problem with logstash. Currently, I have no input on this env. no metricbeat started, no filebeat, nothing. I configured pipeline… --- ## [How to process/filter output from SNMP input plugin for logstash](https://discuss.elastic.co/t/how-to-process-filter-output-from-snmp-input-plugin-for-logstash/239549)
**Author:** [@gasparuben](https://discuss.elastic.co/u/gasparuben)\ **Replies:** 2\ **Last updated:** [July 2, 2020, 8:01am UTC](https://discuss.elastic.co/t/how-to-process-filter-output-from-snmp-input-plugin-for-logstash/239549 "2020-07-02T08:01:26Z")
hi, I am retrieving SNMP data from our webcast servers. I would like to know how to process the results in a filter stage in logstash e.g { "httpClientCountGetUserQueryStr.1.1.1.1.3" =\> "liveoutside/smil:1… --- ## [How to extract logstash log.file.path for filter](https://discuss.elastic.co/t/how-to-extract-logstash-log-file-path-for-filter/239581)
**Author:** [@jang](https://discuss.elastic.co/u/jang)\ **Replies:** 1\ **Last updated:** [July 2, 2020, 7:51am UTC](https://discuss.elastic.co/t/how-to-extract-logstash-log-file-path-for-filter/239581 "2020-07-02T07:51:16Z")
hi. I am using Filebeat and Logstash. now, my \[log\]\[file\]\[path\] result. (The file path is flexible.) /home/logs/tomcat/application/test.log or /LOG/application/test2.log etc... I only want the file name except for… --- ## [GROK Parse failure for log file pattern](https://discuss.elastic.co/t/grok-parse-failure-for-log-file-pattern/239320)
**Author:** [@Akshara](https://discuss.elastic.co/u/Akshara)\ **Replies:** 1\ **Last updated:** [July 2, 2020, 5:59am UTC](https://discuss.elastic.co/t/grok-parse-failure-for-log-file-pattern/239320 "2020-07-02T05:59:33Z")
2019-05-12 15:57:15.446 \[localhost\] \[Services\] \[Request Id : RT1242124202120519027049\] \[User Id : TEST@sales.com\] INFO Services.aspect.AspectController:120 - \[1242,124202,RT1242124202120519027049\] Exit Add\_SaleLineItem… --- ## [Logstash error with multiple pipeline](https://discuss.elastic.co/t/logstash-error-with-multiple-pipeline/239474)
**Author:** [@dorcas](https://discuss.elastic.co/u/dorcas)\ **Replies:** 1\ **Last updated:** [July 2, 2020, 5:16am UTC](https://discuss.elastic.co/t/logstash-error-with-multiple-pipeline/239474 "2020-07-02T05:16:05Z")
Logstash - java.lang.IllegalStateException: Logstash stopped processing because of an error: (SystemExit) exit can someone help with this thanks --- ## [MongoDB-Elasticsearch Integration Via Logstash Infinite Loop](https://discuss.elastic.co/t/mongodb-elasticsearch-integration-via-logstash-infinite-loop/239460)
**Author:** [@leoper](https://discuss.elastic.co/u/leoper)\ **Replies:** 1\ **Last updated:** [July 1, 2020, 4:47pm UTC](https://discuss.elastic.co/t/mongodb-elasticsearch-integration-via-logstash-infinite-loop/239460 "2020-07-01T16:47:36Z")
Hi everyone. I am trying to make an integration between MongoDB (Version 4.2.7) and Elasticsearch (Version 7.7.0) via Logstash (Version 7.8.0). The goal is to synchronize data from MongoDB to Elasticsearch. The scenar… --- ## [Keeping same log events once instead of multiple time](https://discuss.elastic.co/t/keeping-same-log-events-once-instead-of-multiple-time/239301)
**Author:** [@ksaha](https://discuss.elastic.co/u/ksaha)\ **Replies:** 5\ **Last updated:** [July 1, 2020, 3:36pm UTC](https://discuss.elastic.co/t/keeping-same-log-events-once-instead-of-multiple-time/239301 "2020-07-01T15:36:03Z")
Hello, I have a running ELK stack, and I am collecting the logs from various source using beats and parsing them using Logstash and finally visualizing in Kibana through elasticsearch. It is working fine. I have one que… --- ## [Logstash "Could not index event to Elasticsearch"](https://discuss.elastic.co/t/logstash-could-not-index-event-to-elasticsearch/236181)
**Author:** [@Abdul\_Hameed](https://discuss.elastic.co/u/Abdul_Hameed)\ **Replies:** 11\ **Last updated:** [July 1, 2020, 12:39pm UTC](https://discuss.elastic.co/t/logstash-could-not-index-event-to-elasticsearch/236181 "2020-07-01T12:39:29Z")
Hi, I am trying to index my data into Elasticsearch from logstash but I keep getting this type of errors for all indices. 2020-05-06T14:38:11,434\]\[WARN \]\[logstash.outputs.elasticsearch\] Could not index event to Elastic… --- ## [Unable to send data from filebeat 7.7.0 \> logstash 7.7.0 \> elasticsearch 7.7.0](https://discuss.elastic.co/t/unable-to-send-data-from-filebeat-7-7-0-logstash-7-7-0-elasticsearch-7-7-0/239455)
**Author:** [@dyl](https://discuss.elastic.co/u/dyl)\ **Replies:** 3\ **Last updated:** [July 1, 2020, 11:12am UTC](https://discuss.elastic.co/t/unable-to-send-data-from-filebeat-7-7-0-logstash-7-7-0-elasticsearch-7-7-0/239455 "2020-07-01T11:12:51Z")
Hello, I've got a server "A" which collect informations from a local directory and i try to send these informations to a server "B" with filebeat. My logstash pipeline running into the B server looks like : input { … --- ## [Add Nested Field Array Value based on Array String](https://discuss.elastic.co/t/add-nested-field-array-value-based-on-array-string/239286)
**Author:** [@Kevin\_f](https://discuss.elastic.co/u/Kevin_f)\ **Replies:** 15\ **Last updated:** [July 1, 2020, 10:02am UTC](https://discuss.elastic.co/t/add-nested-field-array-value-based-on-array-string/239286 "2020-07-01T10:02:33Z")
Hello All, I would like to have some assistance on how to add a nested field array to a new field based on the key string value. As you can see in the json output below, I am simply trying to add the nested field \[prop… --- ## [Gsub - Basic example](https://discuss.elastic.co/t/gsub-basic-example/239436)
**Author:** [@Florent\_Fauvin](https://discuss.elastic.co/u/Florent_Fauvin)\ **Replies:** 2\ **Last updated:** [July 1, 2020, 9:00am UTC](https://discuss.elastic.co/t/gsub-basic-example/239436 "2020-07-01T09:00:11Z")
Hello, I'm trying to use gsub with a very simple example and it doesn't work. I just want to replace "ef" with "AA" with this example: mutate { add\_field =\> { "field1" =\> "abc def ghi jkl" } gsub =\> \["field1… --- ## [Output email don´t add % fields](https://discuss.elastic.co/t/output-email-don-t-add-fields/239421)
**Author:** [@Txurrispo](https://discuss.elastic.co/u/Txurrispo)\ **Replies:** 2\ **Last updated:** [July 1, 2020, 8:28am UTC](https://discuss.elastic.co/t/output-email-don-t-add-fields/239421 "2020-07-01T08:28:42Z")
Hi all. I´m using a basic ELK stack to pharse windows DC event logs (winbeats) and send email (sendmail) to our Ticket system. When user is created, blocked, changed password etc.... All works. But i see in the docume… --- ## [Losgtash runs successfully but I doesn't see any logs on command line using stdout](https://discuss.elastic.co/t/losgtash-runs-successfully-but-i-doesnt-see-any-logs-on-command-line-using-stdout/239418)
**Author:** [@Ajaypal](https://discuss.elastic.co/u/Ajaypal)\ **Replies:** 0\ **Last updated:** [July 1, 2020, 7:05am UTC](https://discuss.elastic.co/t/losgtash-runs-successfully-but-i-doesnt-see-any-logs-on-command-line-using-stdout/239418 "2020-07-01T07:05:57Z")
Hi all On logstash system, it receives the syslog messages from my source syslog servers on port 514. Below is the code I have and I see that logstash is running successfully but I don't see output. Can any one help he… --- ## [Logstash config for grok (always get \[0\] "\_grokparsefailure")](https://discuss.elastic.co/t/logstash-config-for-grok-always-get-0-grokparsefailure/239342)
**Author:** [@chnaahmad](https://discuss.elastic.co/u/chnaahmad)\ **Replies:** 4\ **Last updated:** [July 1, 2020, 4:03am UTC](https://discuss.elastic.co/t/logstash-config-for-grok-always-get-0-grokparsefailure/239342 "2020-07-01T04:03:46Z")
Hi, I am facing a problem to parse json string in my log file; Actaully i want to parse my json string which is embeded as data={....} as you can see below in log entry. What i am usring: Elastic search : elasticsear… --- ## [Logstash output to redis with dynamic value save in key](https://discuss.elastic.co/t/logstash-output-to-redis-with-dynamic-value-save-in-key/239211)
**Author:** [@kase](https://discuss.elastic.co/u/kase)\ **Replies:** 5\ **Last updated:** [July 1, 2020, 3:53am UTC](https://discuss.elastic.co/t/logstash-output-to-redis-with-dynamic-value-save-in-key/239211 "2020-07-01T03:53:16Z")
Hi there, https://www.elastic.co/guide/en/logstash/current/plugins-outputs-redis.html#plugins-outputs-redis-key In this doc, it says key can save dynamic name, like logstash-%{type} . I have tried key =\> "netflow-%{YY… --- ## [How can I find some designated value after using split](https://discuss.elastic.co/t/how-can-i-find-some-designated-value-after-using-split/237907)
**Author:** [@kase](https://discuss.elastic.co/u/kase)\ **Replies:** 3\ **Last updated:** [July 1, 2020, 1:32am UTC](https://discuss.elastic.co/t/how-can-i-find-some-designated-value-after-using-split/237907 "2020-07-01T01:32:37Z")
Hi there, I have a filed looks like this format on kibana: flow.tcp\_flags : SYN, RST, PSH, ACK I want to split each type, so I will do fliter { mutate { split =\> \["\[flow\]\[tcp\_flags\]", ","\] } } after this, I … --- ## [Does Logstash support oracle wallet for jdbc connection?](https://discuss.elastic.co/t/does-logstash-support-oracle-wallet-for-jdbc-connection/237536)
**Author:** [@amritpal\_singh](https://discuss.elastic.co/u/amritpal_singh)\ **Replies:** 2\ **Last updated:** [June 30, 2020, 10:38pm UTC](https://discuss.elastic.co/t/does-logstash-support-oracle-wallet-for-jdbc-connection/237536 "2020-06-30T22:38:26Z")
Hi , I am trying to use oracle wallet in logstash jdbc connection and I am getting below error in logs. Unable to connect to database. Tried 1 times {:error\_message=\>"Java::JavaSql::SQLRecoverableException: IO Error: Un… --- ## [Syntax for Aggregate Filter Plugin (No End Event)?](https://discuss.elastic.co/t/syntax-for-aggregate-filter-plugin-no-end-event/239188)
**Author:** [@redapplesonly](https://discuss.elastic.co/u/redapplesonly)\ **Replies:** 4\ **Last updated:** [June 30, 2020, 7:25pm UTC](https://discuss.elastic.co/t/syntax-for-aggregate-filter-plugin-no-end-event/239188 "2020-06-30T19:25:38Z")
Hi Logstash Maestros, Suppose I have a continuous stream of data records flowing into Logstash, tracking how many widgets a producer as cranked out. The data fields are {timestamp} {producer} {numWidgits} and the data … --- ## [Push\_previous\_map\_as\_event into fields](https://discuss.elastic.co/t/push-previous-map-as-event-into-fields/239310)
**Author:** [@mohsin106](https://discuss.elastic.co/u/mohsin106)\ **Replies:** 4\ **Last updated:** [June 30, 2020, 6:41pm UTC](https://discuss.elastic.co/t/push-previous-map-as-event-into-fields/239310 "2020-06-30T18:41:49Z")
Hi, I'm trying to use push\_previous\_map\_as\_event to aggregate and save everything as key/value fields in a document. My data looks like this: device: router1 property: mem\_prop1 ( there are twelve properties per comp… --- ## [Logstash Pipeline grok filter (match) fails - Expected one of \[ \\\\t\\\\r\\\\n\], \\"#\\", \\"{\\", \\"}\\"](https://discuss.elastic.co/t/logstash-pipeline-grok-filter-match-fails-expected-one-of-t-r-n/239332)
**Author:** [@madduck](https://discuss.elastic.co/u/madduck)\ **Replies:** 4\ **Last updated:** [June 30, 2020, 5:22pm UTC](https://discuss.elastic.co/t/logstash-pipeline-grok-filter-match-fails-expected-one-of-t-r-n/239332 "2020-06-30T17:22:22Z")
Hi Logstash community, I'm trying to parse a log through logstash but there seems to be an issue with my grok pattern, however I have tried a lot of different things now and always get the exact same error message. The… --- ## [MongoDB-Elasticsearch Integration Via Logstash](https://discuss.elastic.co/t/mongodb-elasticsearch-integration-via-logstash/239316)
**Author:** [@leoper](https://discuss.elastic.co/u/leoper)\ **Replies:** 4\ **Last updated:** [June 30, 2020, 5:15pm UTC](https://discuss.elastic.co/t/mongodb-elasticsearch-integration-via-logstash/239316 "2020-06-30T17:15:55Z")
Hi everyone. I am trying to make an integration between MongoDB (Version 4.2.7) and Elasticsearch (Version 7.7.0) via Logstash (Version 7.8.0). The goal is to synchronize data from MongoDB to Elasticsearch. The scena… --- ## [Filter jdbc\_static mongodb error](https://discuss.elastic.co/t/filter-jdbc-static-mongodb-error/239194)
**Author:** [@pedropilla](https://discuss.elastic.co/u/pedropilla)\ **Replies:** 3\ **Last updated:** [June 30, 2020, 5:04pm UTC](https://discuss.elastic.co/t/filter-jdbc-static-mongodb-error/239194 "2020-06-30T17:04:06Z")
Hello, I'm trying to enrich data with mongodb objects, here's the related part in my pipeline: jdbc\_static { loaders =\> \[ { id =\> "circuitosOLT" table … --- ## [Elastic Stack with Network Security Zones](https://discuss.elastic.co/t/elastic-stack-with-network-security-zones/239337)
**Author:** [@bretonj](https://discuss.elastic.co/u/bretonj)\ **Replies:** 2\ **Last updated:** [June 30, 2020, 5:02pm UTC](https://discuss.elastic.co/t/elastic-stack-with-network-security-zones/239337 "2020-06-30T17:02:15Z")
I would like to know if what I'm trying to do is possible with Elastic Stack? I have multiple network security zones, all firewalled from each other: (PAZ - Public Access Zone, OZ - Operation Zone, RZ - Restricted Zone)… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=333) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=335)