# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=347 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 348 --- ## [We had given a task, for adding Tag but facing issue in it](https://discuss.elastic.co/t/we-had-given-a-task-for-adding-tag-but-facing-issue-in-it/235730)
**Author:** [@Ashish\_Jindal](https://discuss.elastic.co/u/Ashish_Jindal)\ **Replies:** 3\ **Last updated:** [June 4, 2020, 12:28pm UTC](https://discuss.elastic.co/t/we-had-given-a-task-for-adding-tag-but-facing-issue-in-it/235730 "2020-06-04T12:28:17Z")
We had given a task, but facing issue in it. Task is - Try adding tag A if the data read is a. a b a c d Ensure that the input data is tagged with type as test , and write the output to the file output.txt in the p… --- ## [Keystore issues on centos 6.7](https://discuss.elastic.co/t/keystore-issues-on-centos-6-7/235495)
**Author:** [@asp](https://discuss.elastic.co/u/asp)\ **Replies:** 1\ **Last updated:** [June 4, 2020, 6:31am UTC](https://discuss.elastic.co/t/keystore-issues-on-centos-6-7/235495 "2020-06-04T06:31:29Z")
Hi, I have the task to prepare installation of logstash on old servers running centos 6.7 (up to date patchlevel). When I want to create the keystore I get following error: bash-4.1$ ./logstash-keystore --path.setting… --- ## [Cannot read input from file using Logstash](https://discuss.elastic.co/t/cannot-read-input-from-file-using-logstash/235329)
**Author:** [@NITISH\_GUPTA](https://discuss.elastic.co/u/NITISH_GUPTA)\ **Replies:** 8\ **Last updated:** [June 4, 2020, 6:04am UTC](https://discuss.elastic.co/t/cannot-read-input-from-file-using-logstash/235329 "2020-06-04T06:04:54Z")
Logstash is successfully starting and running but there is no update on the elasticsearch cluster. I also tried output to stdout but nothing was displayed. Below is the following config file of logstash. input { file… --- ## [Problem using Elasticsearch input module](https://discuss.elastic.co/t/problem-using-elasticsearch-input-module/235672)
**Author:** [@Frippen](https://discuss.elastic.co/u/Frippen)\ **Replies:** 0\ **Last updated:** [June 4, 2020, 5:50am UTC](https://discuss.elastic.co/t/problem-using-elasticsearch-input-module/235672 "2020-06-04T05:50:52Z")
I'm trying to use the elasticsearch input module to read an index and save it as an json-file on a share. My problem is that it never stop getting data until the disk is full. I have an index and Kibana says its about 5… --- ## [Matching log.file.path with Grok](https://discuss.elastic.co/t/matching-log-file-path-with-grok/235649)
**Author:** [@Maria\_Daniel](https://discuss.elastic.co/u/Maria_Daniel)\ **Replies:** 1\ **Last updated:** [June 3, 2020, 11:28pm UTC](https://discuss.elastic.co/t/matching-log-file-path-with-grok/235649 "2020-06-03T23:28:59Z")
Hello! So, I'm trying to use the log filename to generate a new field that is searchable on Kibana. Currently I have this on my logstash pipeline: if "delivery\_conn\_results" in \[tags\] { grok { match =\> { … --- ## [Can we specify different http endpoint during retry for logstash-http-output-plugin](https://discuss.elastic.co/t/can-we-specify-different-http-endpoint-during-retry-for-logstash-http-output-plugin/235629)
**Author:** [@Gangadhar\_Mahadevan](https://discuss.elastic.co/u/Gangadhar_Mahadevan)\ **Replies:** 1\ **Last updated:** [June 3, 2020, 7:59pm UTC](https://discuss.elastic.co/t/can-we-specify-different-http-endpoint-during-retry-for-logstash-http-output-plugin/235629 "2020-06-03T19:59:48Z")
Hi, I got the basic logstash-http-output plugin working to send our kafka events to webhook endpoint. The output.conf looks like this output { http { url =\> "https://oss-flow.test1.com/hooks/tip-alert" http\_… --- ## [Parsing multiple lines as multiple events using fields from first and last line](https://discuss.elastic.co/t/parsing-multiple-lines-as-multiple-events-using-fields-from-first-and-last-line/234416)
**Author:** [@jsalamanca](https://discuss.elastic.co/u/jsalamanca)\ **Replies:** 4\ **Last updated:** [June 3, 2020, 7:52pm UTC](https://discuss.elastic.co/t/parsing-multiple-lines-as-multiple-events-using-fields-from-first-and-last-line/234416 "2020-06-03T19:52:26Z")
Hi everyone, I am somewhat new to Logstash. I am trying to perform a somewhat special multiline parse, and I have run out of ideas. The thing is, I want to parse some log lines, which must use values found on previous A… --- ## [How to send an array as part of body in http\_poller](https://discuss.elastic.co/t/how-to-send-an-array-as-part-of-body-in-http-poller/235598)
**Author:** [@Pankaj\_Jadhav](https://discuss.elastic.co/u/Pankaj_Jadhav)\ **Replies:** 1\ **Last updated:** [June 3, 2020, 6:06pm UTC](https://discuss.elastic.co/t/how-to-send-an-array-as-part-of-body-in-http-poller/235598 "2020-06-03T18:06:45Z")
Hi please help me to send an array as a part of http\_poller input request --- ## [Having trouble posting json event using logstash http output plugin](https://discuss.elastic.co/t/having-trouble-posting-json-event-using-logstash-http-output-plugin/235208)
**Author:** [@Gangadhar\_Mahadevan](https://discuss.elastic.co/u/Gangadhar_Mahadevan)\ **Replies:** 6\ **Last updated:** [June 3, 2020, 4:18pm UTC](https://discuss.elastic.co/t/having-trouble-posting-json-event-using-logstash-http-output-plugin/235208 "2020-06-03T16:18:53Z")
I am building a logstash runner that reads input from kafka topic converts the message in specific json format that a webhook accepts using filter.conf and uses logstash http output plugin to send the event to webhook ur… --- ## [Logstash filters to analyze data](https://discuss.elastic.co/t/logstash-filters-to-analyze-data/235568)
**Author:** [@Saber\_Ben\_Njima](https://discuss.elastic.co/u/Saber_Ben_Njima)\ **Replies:** 2\ **Last updated:** [June 3, 2020, 3:09pm UTC](https://discuss.elastic.co/t/logstash-filters-to-analyze-data/235568 "2020-06-03T15:09:02Z")
i have sent logs from filebeat to logstash with different tags to treat them with different ways so this is the format of a line of one of my log files so i don't know how to analyze it . 17-02-2020 03:08:20TO -\> | … --- ## [Logstash memory leak on RPi](https://discuss.elastic.co/t/logstash-memory-leak-on-rpi/234836)
**Author:** [@Sonkun](https://discuss.elastic.co/u/Sonkun)\ **Replies:** 13\ **Last updated:** [June 3, 2020, 2:04pm UTC](https://discuss.elastic.co/t/logstash-memory-leak-on-rpi/234836 "2020-06-03T14:04:13Z")
Hi, my Logstash (7.6.2) instance have some memory leak. Xms and Xms are set on 512m, I have 1 very simple pipeline rest-\>simple map-\>elastic - this pipeline is executed few times in hour. Logstash after up starting to … --- ## [Reading config from other remote server](https://discuss.elastic.co/t/reading-config-from-other-remote-server/235548)
**Author:** [@Ullas7](https://discuss.elastic.co/u/Ullas7)\ **Replies:** 0\ **Last updated:** [June 3, 2020, 12:44pm UTC](https://discuss.elastic.co/t/reading-config-from-other-remote-server/235548 "2020-06-03T12:44:03Z")
I want to run Logstash in multiple machines say server A, B, C and D. I would like to keep pipeline conf ( input, filter and output) common for all them. The idea is if I change something in the filter it should reflect … --- ## [How to send http\_poller response data in elastic search](https://discuss.elastic.co/t/how-to-send-http-poller-response-data-in-elastic-search/235519)
**Author:** [@Pankaj\_Jadhav](https://discuss.elastic.co/u/Pankaj_Jadhav)\ **Replies:** 1\ **Last updated:** [June 3, 2020, 10:53am UTC](https://discuss.elastic.co/t/how-to-send-http-poller-response-data-in-elastic-search/235519 "2020-06-03T10:53:35Z")
Hi Guys, can someone will help me to add http\_poller response in elastic. my config file input{ kafka { bootstrap\_servers =\> "172.20.188.11:9092,172.20.188.31:9092,172.20.188.30:9092" topics =\> \["DS\_Test"\] decorat… --- ## [Does fingerprint filter prevent updating existing fields in a CSV File?](https://discuss.elastic.co/t/does-fingerprint-filter-prevent-updating-existing-fields-in-a-csv-file/235516)
**Author:** [@Noel92](https://discuss.elastic.co/u/Noel92)\ **Replies:** 0\ **Last updated:** [June 3, 2020, 10:35am UTC](https://discuss.elastic.co/t/does-fingerprint-filter-prevent-updating-existing-fields-in-a-csv-file/235516 "2020-06-03T10:35:56Z")
I use the fingerprint filter for my logstash filter as below and the output for elasticsearch to include the fingerprint as below filter { fingerprint { source =\> "message" target =\> "\[@metadata\]… --- ## [How to convert the apache response time in Logstash?](https://discuss.elastic.co/t/how-to-convert-the-apache-response-time-in-logstash/235513)
**Author:** [@marco2005](https://discuss.elastic.co/u/marco2005)\ **Replies:** 0\ **Last updated:** [June 3, 2020, 10:07am UTC](https://discuss.elastic.co/t/how-to-convert-the-apache-response-time-in-logstash/235513 "2020-06-03T10:07:57Z")
I was able to parse the apache log with the response time using the below grok pattern: filter { grok { match =\> \[ "message" , "%{COMBINEDAPACHELOG}+%{GREEDYDATA:extra\_fie… --- ## [Issue with Parsing multiline log in together with filebeat multiline config and logstash](https://discuss.elastic.co/t/issue-with-parsing-multiline-log-in-together-with-filebeat-multiline-config-and-logstash/234566)
**Author:** [@marco2005](https://discuss.elastic.co/u/marco2005)\ **Replies:** 23\ **Last updated:** [June 3, 2020, 5:57am UTC](https://discuss.elastic.co/t/issue-with-parsing-multiline-log-in-together-with-filebeat-multiline-config-and-logstash/234566 "2020-06-03T05:57:13Z")
I have the below multiline log: 2020-05-27 11:59:17 ---------------------------------------------------------------------- 2020-05-27 11:59:17 Got context 2020-05-27 11:59:17 Raw context: EMAIL=abc.d… --- ## [Stopping plugin restart in logstash](https://discuss.elastic.co/t/stopping-plugin-restart-in-logstash/235503)
**Author:** [@Akash\_raj](https://discuss.elastic.co/u/Akash_raj)\ **Replies:** 0\ **Last updated:** [June 3, 2020, 9:28am UTC](https://discuss.elastic.co/t/stopping-plugin-restart-in-logstash/235503 "2020-06-03T09:28:34Z")
My config input{ jdbc{ jdbc\_driver\_library =\> "${JAVA\_DIR}/ojdbc8-12.2.0.1.jar" jdbc\_driver\_class =\> "Java::oracle.jdbc.OracleDriver" jdbc\_connection\_string =\> "${JDBC\_CONNECTION\_STRING}" … --- ## [ISO 8601 Basic Format](https://discuss.elastic.co/t/iso-8601-basic-format/235323)
**Author:** [@yakimant](https://discuss.elastic.co/u/yakimant)\ **Replies:** 3\ **Last updated:** [June 3, 2020, 9:05am UTC](https://discuss.elastic.co/t/iso-8601-basic-format/235323 "2020-06-03T09:05:54Z")
Hi everyone, I was reading ISO 8601 wiki: And found out: "Representations can be done in one of two formats – a basic format with a minimal number of separators or an extended format with separators added to enhan… --- ## [Cidr plugin - array fields for address input](https://discuss.elastic.co/t/cidr-plugin-array-fields-for-address-input/234270)
**Author:** [@Mustafa\_Ocak](https://discuss.elastic.co/u/Mustafa_Ocak)\ **Replies:** 2\ **Last updated:** [June 3, 2020, 8:39am UTC](https://discuss.elastic.co/t/cidr-plugin-array-fields-for-address-input/234270 "2020-06-03T08:39:38Z")
Hi, I am testing to enrich logs based on host-metadata from filebeat agent (v. 7.7.0). Logstash version in this test env. is 7.7.0 and cidr plugin version is 3.1.3. Although array field support for address input is ad… --- ## [Unable to install logstash-output-slack](https://discuss.elastic.co/t/unable-to-install-logstash-output-slack/235490)
**Author:** [@Elie\_Sbat](https://discuss.elastic.co/u/Elie_Sbat)\ **Replies:** 0\ **Last updated:** [June 3, 2020, 7:57am UTC](https://discuss.elastic.co/t/unable-to-install-logstash-output-slack/235490 "2020-06-03T07:57:42Z")
Hello, Anyone can provide a step by step documentation to install logstash-output plugins ? Tx, E --- ## [Install elastiflow on ubuntu18.04](https://discuss.elastic.co/t/install-elastiflow-on-ubuntu18-04/235475)
**Author:** [@kase](https://discuss.elastic.co/u/kase)\ **Replies:** 0\ **Last updated:** [June 3, 2020, 6:34am UTC](https://discuss.elastic.co/t/install-elastiflow-on-ubuntu18-04/235475 "2020-06-03T06:34:54Z")
Hi there, I followed this tutorial to study elastiflow(https://www.catapultsystems.com/blogs/install-elastiflow-on-ubuntu-18-04-part-3/), but faced some problem with using this command: sudo /usr/share/logstash/bin/syst… --- ## [All csv columns are saved inside message field](https://discuss.elastic.co/t/all-csv-columns-are-saved-inside-message-field/235474)
**Author:** [@Youssef\_SBAI](https://discuss.elastic.co/u/Youssef_SBAI)\ **Replies:** 1\ **Last updated:** [June 3, 2020, 6:37am UTC](https://discuss.elastic.co/t/all-csv-columns-are-saved-inside-message-field/235474 "2020-06-03T06:37:54Z")
Hello, I use logstsh and file beat for ingest my csv in elastic i have a problem the colonne is not created Elastic ingest just the first ligne of my CSV in elastic my config logsth is: input { beats { port =\> "5044… --- ## [Logstash error : org.logstash.instrument.metrics.gauge.LazyDelegatingGauge while processing data](https://discuss.elastic.co/t/logstash-error-org-logstash-instrument-metrics-gauge-lazydelegatinggauge-while-processing-data/234695)
**Author:** [@Sandy3012](https://discuss.elastic.co/u/Sandy3012)\ **Replies:** 8\ **Last updated:** [June 3, 2020, 5:11am UTC](https://discuss.elastic.co/t/logstash-error-org-logstash-instrument-metrics-gauge-lazydelegatinggauge-while-processing-data/234695 "2020-06-03T05:11:07Z")
I am getting below error while processing data: \[2020-05-28T11:35:29,467\]\[WARN \]\[org.logstash.instrument.metrics.gauge.LazyDelegatingGauge\]\[main\] A gauge metric of an unknown type (org.jruby.specialized.RubyArrayOneObje… --- ## [How to listen events from logstash without beats](https://discuss.elastic.co/t/how-to-listen-events-from-logstash-without-beats/233438)
**Author:** [@ohoroyoi](https://discuss.elastic.co/u/ohoroyoi)\ **Replies:** 9\ **Last updated:** [June 3, 2020, 3:33am UTC](https://discuss.elastic.co/t/how-to-listen-events-from-logstash-without-beats/233438 "2020-06-03T03:33:31Z")
I am receiving input from postgres using jdbc plugin. I wonder if there is a real-time change in postgres data, can't it be reflected with the jdbc input plugin? Is another plugin necessary? For example beats. --- ## [Postgres geometry to elasticsearch geo\_shape using logstash](https://discuss.elastic.co/t/postgres-geometry-to-elasticsearch-geo-shape-using-logstash/235446)
**Author:** [@ohoroyoi](https://discuss.elastic.co/u/ohoroyoi)\ **Replies:** 0\ **Last updated:** [June 3, 2020, 2:37am UTC](https://discuss.elastic.co/t/postgres-geometry-to-elasticsearch-geo-shape-using-logstash/235446 "2020-06-03T02:37:56Z")
I use the postgis function called ST\_AsText to get the geometry field of postgres. That way, logstash's input is possible. But there is a problem. Since it is a string type, I want to move it to geo\_shape for elasticsear… --- ## [Split logs to separated indexes](https://discuss.elastic.co/t/split-logs-to-separated-indexes/235433)
**Author:** [@cyberzlo](https://discuss.elastic.co/u/cyberzlo)\ **Replies:** 0\ **Last updated:** [June 3, 2020, 12:57am UTC](https://discuss.elastic.co/t/split-logs-to-separated-indexes/235433 "2020-06-03T00:57:22Z")
If I have json logs can I somehow easy analyse this json and split it to multiple indexes based on json fields? --- ## [Missing cpu.cfs\_period\_us, cpu.cfs\_quota\_us and cpu.stat on raspberry pi 4](https://discuss.elastic.co/t/missing-cpu-cfs-period-us-cpu-cfs-quota-us-and-cpu-stat-on-raspberry-pi-4/235411)
**Author:** [@Sonkun](https://discuss.elastic.co/u/Sonkun)\ **Replies:** 3\ **Last updated:** [June 3, 2020, 12:00am UTC](https://discuss.elastic.co/t/missing-cpu-cfs-period-us-cpu-cfs-quota-us-and-cpu-stat-on-raspberry-pi-4/235411 "2020-06-03T00:00:37Z")
Hi, Logstash (7.7.0) all time (every 5 sec) prints information about missing files (logstash is working, but has some memory leak - I'm not sure is that correlated): \[DEBUG\]\[logstash.instrument.periodicpoller.cgroup.cpu… --- ## [Export Logs In Josn File From Elasticsearch](https://discuss.elastic.co/t/export-logs-in-josn-file-from-elasticsearch/235390)
**Author:** [@dattack13](https://discuss.elastic.co/u/dattack13)\ **Replies:** 0\ **Last updated:** [June 2, 2020, 6:11pm UTC](https://discuss.elastic.co/t/export-logs-in-josn-file-from-elasticsearch/235390 "2020-06-02T18:11:46Z")
Hi Everyone, I need to create a job in our Kibana, which generate log file and store it some location, I have logs available in our kibana. Ca anyone explain what are the steps are required to do so. Thanks --- ## [Common Option 'id' in input plugin](https://discuss.elastic.co/t/common-option-id-in-input-plugin/235388)
**Author:** [@beyondcompare](https://discuss.elastic.co/u/beyondcompare)\ **Replies:** 3\ **Last updated:** [June 2, 2020, 8:29pm UTC](https://discuss.elastic.co/t/common-option-id-in-input-plugin/235388 "2020-06-02T20:29:21Z")
Dear all, Thank you very much for your time to read my question. I have created a config file with the the input section shown below. input { file { path =\> \[ "/var/log/messages" \] id =\> "syslog" tags =\> "syslog… --- ## [How to use logstash to get the data from Azure storage or Event Hub](https://discuss.elastic.co/t/how-to-use-logstash-to-get-the-data-from-azure-storage-or-event-hub/235398)
**Author:** [@Z\_He](https://discuss.elastic.co/u/Z_He)\ **Replies:** 0\ **Last updated:** [June 2, 2020, 7:02pm UTC](https://discuss.elastic.co/t/how-to-use-logstash-to-get-the-data-from-azure-storage-or-event-hub/235398 "2020-06-02T19:02:38Z")
Hi, all, I am new to use ELK, did some investigation and play with ELK setup locally. And I am now playing with the 14 days trial account with Azure set up as we plan to use this servive. The challenge I encounter here … [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=346) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=348)