# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=348 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 349 --- ## [Clearing FORBIDDEN/8/index write (api) blocked bulk actions](https://discuss.elastic.co/t/clearing-forbidden-8-index-write-api-blocked-bulk-actions/235383)
**Author:** [@joer](https://discuss.elastic.co/u/joer)\ **Replies:** 0\ **Last updated:** [June 2, 2020, 5:30pm UTC](https://discuss.elastic.co/t/clearing-forbidden-8-index-write-api-blocked-bulk-actions/235383 "2020-06-02T17:30:52Z")
I have looked at all the previous posts on the \[index write API block\](https://discuss.elastic.co/t/cluster-block-exception-forbidden-8-index-write-api/210594). I know that this error is due to events coming in after i… --- ## [Logstash delta time](https://discuss.elastic.co/t/logstash-delta-time/235199)
**Author:** [@griffer98](https://discuss.elastic.co/u/griffer98)\ **Replies:** 3\ **Last updated:** [June 2, 2020, 3:34pm UTC](https://discuss.elastic.co/t/logstash-delta-time/235199 "2020-06-02T15:34:06Z")
I have documents being parsed through logstash and sent to elasticsearch. Each document has a date field called delivery. There is another field that has an ID for events that happen throught the day. What I want to do i… --- ## [\[Elasticsearch Filter Plugin\] index\_not\_found\_exception java.lang.NullPointerException: null](https://discuss.elastic.co/t/elasticsearch-filter-plugin-index-not-found-exception-java-lang-nullpointerexception-null/235358)
**Author:** [@Alufolie](https://discuss.elastic.co/u/Alufolie)\ **Replies:** 1\ **Last updated:** [June 2, 2020, 3:23pm UTC](https://discuss.elastic.co/t/elasticsearch-filter-plugin-index-not-found-exception-java-lang-nullpointerexception-null/235358 "2020-06-02T15:23:34Z")
Hey Elastic Community, with the turn of May to June we had some issues with our Logstash. To get Data from older documents we use the elasticsearch filter plugin in some of our pipelines. Most of our indices are month … --- ## [Logstash 7.7.0 on Windows - java.nio.file.AccessDeniedException](https://discuss.elastic.co/t/logstash-7-7-0-on-windows-java-nio-file-accessdeniedexception/234923)
**Author:** [@Coinology](https://discuss.elastic.co/u/Coinology)\ **Replies:** 6\ **Last updated:** [June 2, 2020, 3:02pm UTC](https://discuss.elastic.co/t/logstash-7-7-0-on-windows-java-nio-file-accessdeniedexception/234923 "2020-06-02T15:02:34Z")
Hello all, I am hoping that someone may be able to help me with an issue I've recently ran into with Logstash. I am running 7.7.0 on Windows Server 2016 and I have recently began experiencing Logstash crashes. I'll past… --- ## [Filter and Output plugin not working](https://discuss.elastic.co/t/filter-and-output-plugin-not-working/234941)
**Author:** [@Xophis](https://discuss.elastic.co/u/Xophis)\ **Replies:** 4\ **Last updated:** [June 2, 2020, 1:27pm UTC](https://discuss.elastic.co/t/filter-and-output-plugin-not-working/234941 "2020-06-02T13:27:55Z")
Hi, I need some help regarding JDBC input plugin. The documentation says : \* You can periodically schedule ingestion using a cron syntax (see schedule setting) or run the query one time to load data into Logstash\* I w… --- ## [How to send headers using http input plugin in logstash](https://discuss.elastic.co/t/how-to-send-headers-using-http-input-plugin-in-logstash/235332)
**Author:** [@Pankaj\_Jadhav](https://discuss.elastic.co/u/Pankaj_Jadhav)\ **Replies:** 3\ **Last updated:** [June 2, 2020, 1:16pm UTC](https://discuss.elastic.co/t/how-to-send-headers-using-http-input-plugin-in-logstash/235332 "2020-06-02T13:16:59Z")
Hi am new in ES and logstash I want to do POST call Url:- https://dm-dev-authenticationservice-serviceapps-use-rg.azurewebsites.net/api/v1/Token Headers:- Content-Type :- application/json Body :- { "ClientId": "sd… --- ## [Logstash is sending logs to all output index configured in all conf's in pipeline](https://discuss.elastic.co/t/logstash-is-sending-logs-to-all-output-index-configured-in-all-confs-in-pipeline/235341)
**Author:** [@ramkumar.J](https://discuss.elastic.co/u/ramkumar.J)\ **Replies:** 1\ **Last updated:** [June 2, 2020, 1:13pm UTC](https://discuss.elastic.co/t/logstash-is-sending-logs-to-all-output-index-configured-in-all-confs-in-pipeline/235341 "2020-06-02T13:13:35Z")
I have a Logstash(6.8) configured with more than one conf files using one pipeline. when i execute the logstash, it is collecting logs from all inputs and sending it to all output Elastic Search index configured in pipel… --- ## [Different field syntaxes between winlogbeat and logstash (fingerprint plugin)](https://discuss.elastic.co/t/different-field-syntaxes-between-winlogbeat-and-logstash-fingerprint-plugin/234761)
**Author:** [@JeanN](https://discuss.elastic.co/u/JeanN)\ **Replies:** 2\ **Last updated:** [June 2, 2020, 1:08pm UTC](https://discuss.elastic.co/t/different-field-syntaxes-between-winlogbeat-and-logstash-fingerprint-plugin/234761 "2020-06-02T13:08:14Z")
Hello, I want to compare the fingerprint of Logstash and Winlogbeat of the same field. But when i provide the "field" setting from winlogbeat and after i provide the same field on the "source" setting from logstash, th… --- ## [Failed to parse field \[host\] of type \[text\] .. can't get text on a START\_OBJECT at 1:974](https://discuss.elastic.co/t/failed-to-parse-field-host-of-type-text-cant-get-text-on-a-start-object-at-1-974/235221)
**Author:** [@mskadu](https://discuss.elastic.co/u/mskadu)\ **Replies:** 2\ **Last updated:** [June 2, 2020, 12:30pm UTC](https://discuss.elastic.co/t/failed-to-parse-field-host-of-type-text-cant-get-text-on-a-start-object-at-1-974/235221 "2020-06-02T12:30:31Z")
My first question on this forum, so apologies for missing to post any detail. If I can also take this opportunity to say a big hello to everyone from a newbie to the world of Elastic Stack! :slight\_smile: I have a CSV … --- ## [SSL error](https://discuss.elastic.co/t/ssl-error/234291)
**Author:** [@NoobUser404](https://discuss.elastic.co/u/NoobUser404)\ **Replies:** 10\ **Last updated:** [June 2, 2020, 10:47am UTC](https://discuss.elastic.co/t/ssl-error/234291 "2020-06-02T10:47:26Z")
I've installed elasticsearch, logstash and metricbeat in my local Windows machine (all 7.7 version). The first thing I did was run .\\bin\\elasticsearch-certutil cert --pem --pass secret to get ca.crt - instance.crt - inst… --- ## [Grok Pattern with Pipe](https://discuss.elastic.co/t/grok-pattern-with-pipe/235272)
**Author:** [@ginu](https://discuss.elastic.co/u/ginu)\ **Replies:** 1\ **Last updated:** [June 2, 2020, 10:04am UTC](https://discuss.elastic.co/t/grok-pattern-with-pipe/235272 "2020-06-02T10:04:54Z")
Hi I am struggling to create a Grok Pattern that matches something like following: 2020-04-21T15:31:08.633161+02:00 server1 SYSTEM\[2564\]: DEBUG | GetAuthorizedContent(SYSTEM000427) | C:\[PD:(CLEAR):\< Network Device Id \>{… --- ## [How to get visitor ipaddress](https://discuss.elastic.co/t/how-to-get-visitor-ipaddress/235307)
**Author:** [@suresh123](https://discuss.elastic.co/u/suresh123)\ **Replies:** 0\ **Last updated:** [June 2, 2020, 9:43am UTC](https://discuss.elastic.co/t/how-to-get-visitor-ipaddress/235307 "2020-06-02T09:43:32Z")
Hi Team, Can somebody please help me on below query I am having elastic load balancer all requests go to this If any body hits my site url i need to get the visitor machine's ip address Note: I have some doubt whethe… --- ## [DNS plugin and new field](https://discuss.elastic.co/t/dns-plugin-and-new-field/235212)
**Author:** [@kernelpanic](https://discuss.elastic.co/u/kernelpanic)\ **Replies:** 2\ **Last updated:** [June 2, 2020, 8:58am UTC](https://discuss.elastic.co/t/dns-plugin-and-new-field/235212 "2020-06-02T08:58:02Z")
Hello, we're using the ElasticStack 7.6.1 and I was wondering how to get the DNS filter for Logstash to perform a reverse DNS lookup on the IP address in each each message and put the results in a new field; looking at t… --- ## [Not able to give "unknown" field name in grok filter](https://discuss.elastic.co/t/not-able-to-give-unknown-field-name-in-grok-filter/235198)
**Author:** [@sakthiskv](https://discuss.elastic.co/u/sakthiskv)\ **Replies:** 2\ **Last updated:** [June 2, 2020, 8:40am UTC](https://discuss.elastic.co/t/not-able-to-give-unknown-field-name-in-grok-filter/235198 "2020-06-02T08:40:59Z")
Hai, i am using logstash IMAP server to read messages from mail and put it into ES. I am able to read mails from Gmail and getting mail attachments also. i have to apply some filter to that attachments field. but that… --- ## [Is it possible to read config from DB?](https://discuss.elastic.co/t/is-it-possible-to-read-config-from-db/235169)
**Author:** [@Ullas7](https://discuss.elastic.co/u/Ullas7)\ **Replies:** 3\ **Last updated:** [June 2, 2020, 7:30am UTC](https://discuss.elastic.co/t/is-it-possible-to-read-config-from-db/235169 "2020-06-02T07:30:13Z")
I want to have configurable filters, basically to compare value from an input data field. I want to have configurable values, which should come from the database(preferred) or file (otherwise): for example if(\[url\]\[IP… --- ## [Logstash 6.8 role\_arn error](https://discuss.elastic.co/t/logstash-6-8-role-arn-error/235177)
**Author:** [@Kevin\_f](https://discuss.elastic.co/u/Kevin_f)\ **Replies:** 1\ **Last updated:** [June 2, 2020, 7:26am UTC](https://discuss.elastic.co/t/logstash-6-8-role-arn-error/235177 "2020-06-02T07:26:02Z")
Hello, I was hoping that someone could help me figure this one out. Basically what it is that I am trying to do in AWS is: Account 1 (logstash instance with role 1 attached) Account 2 (contains the s3 with role 2 cre… --- ## [\`collectd\` codec intermittently dropping some telemetry information](https://discuss.elastic.co/t/collectd-codec-intermittently-dropping-some-telemetry-information/231286)
**Author:** [@sjlongland](https://discuss.elastic.co/u/sjlongland)\ **Replies:** 1\ **Last updated:** [June 2, 2020, 6:30am UTC](https://discuss.elastic.co/t/collectd-codec-intermittently-dropping-some-telemetry-information/231286 "2020-06-02T06:30:59Z")
Hi all… We've been using ELK stack via a Docker container (sebp/elk) for some time along-side ElastAlert to monitor a number of virtual hosts in our care via collectd, and until very recently it's been working well. We… --- ## [Syslog Input has unreadable messages](https://discuss.elastic.co/t/syslog-input-has-unreadable-messages/235276)
**Author:** [@pavank](https://discuss.elastic.co/u/pavank)\ **Replies:** 0\ **Last updated:** [June 2, 2020, 5:57am UTC](https://discuss.elastic.co/t/syslog-input-has-unreadable-messages/235276 "2020-06-02T05:57:38Z")
I recently configured syslog plugin to collect Datapower appliance logs. The Datapower end was set to syslog-tcp for a few events tagged with an Identifier. I see most of the event logs are in proper format with the ide… --- ## [Tailing gzip files](https://discuss.elastic.co/t/tailing-gzip-files/235250)
**Author:** [@rahenri](https://discuss.elastic.co/u/rahenri)\ **Replies:** 0\ **Last updated:** [June 1, 2020, 11:22pm UTC](https://discuss.elastic.co/t/tailing-gzip-files/235250 "2020-06-01T23:22:59Z")
Hi everyone, I have been using logstash to read logs from our servers, however, we have recently switched the servers to produce gzip'ed logs to save disk space. But I just found out that means we can't use logstash to … --- ## [Logstash loading template, but not applying it?](https://discuss.elastic.co/t/logstash-loading-template-but-not-applying-it/235207)
**Author:** [@AndyS](https://discuss.elastic.co/u/AndyS)\ **Replies:** 8\ **Last updated:** [June 1, 2020, 11:14pm UTC](https://discuss.elastic.co/t/logstash-loading-template-but-not-applying-it/235207 "2020-06-01T23:14:45Z")
I'm having a problem where logstash is loading a template file, but either it's not applying it, or this isn't being communicated to Elastic. (This is using Security Onion, which has logstash in Docker) I have a logsta… --- ## [Multiple Logstash Configuration Files](https://discuss.elastic.co/t/multiple-logstash-configuration-files/235241)
**Author:** [@alpo](https://discuss.elastic.co/u/alpo)\ **Replies:** 3\ **Last updated:** [June 1, 2020, 11:05pm UTC](https://discuss.elastic.co/t/multiple-logstash-configuration-files/235241 "2020-06-01T23:05:23Z")
All: We're having an issue with Logstash and/or Elasticsearch, and we're not really sure where the issue resides. We are running Logstash and Elasticsearch on a single physical server and when viewing the data in Kiban… --- ## [Grok pattern creation error](https://discuss.elastic.co/t/grok-pattern-creation-error/232432)
**Author:** [@Alexandros888](https://discuss.elastic.co/u/Alexandros888)\ **Replies:** 3\ **Last updated:** [June 1, 2020, 7:32pm UTC](https://discuss.elastic.co/t/grok-pattern-creation-error/232432 "2020-06-01T19:32:46Z")
Hello i am trying to make a grok pattern for that type of log: \[2020-05-13T13:31:42,545\]\[DEBUG\]\[logstash.filters.mutate \]\[filebeat-lasernet\] filters/LogStash::Filters::Mutate: removing field {:field=\>"message"} but … --- ## [Keystore docker logstash](https://discuss.elastic.co/t/keystore-docker-logstash/235210)
**Author:** [@yassine](https://discuss.elastic.co/u/yassine)\ **Replies:** 0\ **Last updated:** [June 1, 2020, 5:20pm UTC](https://discuss.elastic.co/t/keystore-docker-logstash/235210 "2020-06-01T17:20:17Z")
how i can configure keystore password for logstash container via docker? --- ## [Transforming array of objects](https://discuss.elastic.co/t/transforming-array-of-objects/234366)
**Author:** [@AlessandroKP](https://discuss.elastic.co/u/AlessandroKP)\ **Replies:** 2\ **Last updated:** [June 1, 2020, 4:16pm UTC](https://discuss.elastic.co/t/transforming-array-of-objects/234366 "2020-06-01T16:16:20Z")
Hi all, we are trying to process an event with Logstash that is generated by http\_poller input. The event has the following structure: { "data": \[ { "name": "key1", "value": "A" }, { "name": "key2", … --- ## [Multiple filters to multiple indexes](https://discuss.elastic.co/t/multiple-filters-to-multiple-indexes/235186)
**Author:** [@alxsss](https://discuss.elastic.co/u/alxsss)\ **Replies:** 3\ **Last updated:** [June 1, 2020, 3:40pm UTC](https://discuss.elastic.co/t/multiple-filters-to-multiple-indexes/235186 "2020-06-01T15:40:13Z")
Hello, I have a pipeline with the following set of plutings input filter1 filter2 output Is it possible to index output from filter1 to index1 and output of from both to index2? --- ## [How to copy SQL Server data to Elasticsearch using LogStash](https://discuss.elastic.co/t/how-to-copy-sql-server-data-to-elasticsearch-using-logstash/235064)
**Author:** [@Naushad\_Ansari1](https://discuss.elastic.co/u/Naushad_Ansari1)\ **Replies:** 2\ **Last updated:** [June 1, 2020, 3:32pm UTC](https://discuss.elastic.co/t/how-to-copy-sql-server-data-to-elasticsearch-using-logstash/235064 "2020-06-01T15:32:31Z")
As a developer working with SQL Server there is a need to import data from the database to Elasticsearch and analyze data in Kibana --- ## [I can't send MongoDB data to Elasticseach via logstash](https://discuss.elastic.co/t/i-cant-send-mongodb-data-to-elasticseach-via-logstash/234976)
**Author:** [@FernandoMOTA](https://discuss.elastic.co/u/FernandoMOTA)\ **Replies:** 5\ **Last updated:** [June 1, 2020, 3:17pm UTC](https://discuss.elastic.co/t/i-cant-send-mongodb-data-to-elasticseach-via-logstash/234976 "2020-06-01T15:17:42Z")
My configuration file is as follows: input { mongodb { uri =\> 'mongodb://localhost:27017/exemplo' placeholder\_db\_dir =\> 'C:/Users/Administrator/Documents/Elastic/logstash-7.6.1/data/opt/logstash-mo… --- ## [Logstash elasticsearch input plugin query size not working](https://discuss.elastic.co/t/logstash-elasticsearch-input-plugin-query-size-not-working/235183)
**Author:** [@alxsss](https://discuss.elastic.co/u/alxsss)\ **Replies:** 0\ **Last updated:** [June 1, 2020, 2:37pm UTC](https://discuss.elastic.co/t/logstash-elasticsearch-input-plugin-query-size-not-working/235183 "2020-06-01T14:37:05Z")
Hello, I am trying to get latest timestamp from an index by using elasticsearch input plugin with query as input { elasticsearch { hosts =\> "${ES\_HOST}:9200" index=\>"myindex" query =\> '{ "query": { "match\_all": { } … --- ## [Checking null condition in logstash not working](https://discuss.elastic.co/t/checking-null-condition-in-logstash-not-working/235157)
**Author:** [@anjilinga](https://discuss.elastic.co/u/anjilinga)\ **Replies:** 1\ **Last updated:** [June 1, 2020, 2:25pm UTC](https://discuss.elastic.co/t/checking-null-condition-in-logstash-not-working/235157 "2020-06-01T14:25:56Z")
Hi, I am using the belwo logstash configuration, i will be getting one field value at a time among two fields in the record and i want to assign the value to the new field. csv{ separator =\> "," columns =\> \["source",… --- ## ["Standalone Cluster" for Logstash monitoring](https://discuss.elastic.co/t/standalone-cluster-for-logstash-monitoring/233898)
**Author:** [@pup\_seba](https://discuss.elastic.co/u/pup_seba)\ **Replies:** 7\ **Last updated:** [June 1, 2020, 2:05pm UTC](https://discuss.elastic.co/t/standalone-cluster-for-logstash-monitoring/233898 "2020-06-01T14:05:33Z")
Hi, I'm trying to setup a single node with Elasticsearch, Kibana and Logstash. After adding some filebeat agents to some servers I wanted to start centralizing logs, a new cluster was created under Kibana "monitoring". … [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=347) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=349)