# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=349 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 350 --- ## [Is it possible to run Logstash 7.6.2 on 2GB RAM and 2 Core CPU](https://discuss.elastic.co/t/is-it-possible-to-run-logstash-7-6-2-on-2gb-ram-and-2-core-cpu/234460)
**Author:** [@karthiknpy](https://discuss.elastic.co/u/karthiknpy)\ **Replies:** 5\ **Last updated:** [June 1, 2020, 1:48pm UTC](https://discuss.elastic.co/t/is-it-possible-to-run-logstash-7-6-2-on-2gb-ram-and-2-core-cpu/234460 "2020-06-01T13:48:00Z")
Hi Team, I have only one Linux server with 2GB RAM and 2 core CPUs. Is it possible to tune the JVM limit the memory and use logstash in this server. I have seen the optimization guide but it is some high level tech to … --- ## [Logstash elasticsearch output problem](https://discuss.elastic.co/t/logstash-elasticsearch-output-problem/234577)
**Author:** [@Rasoul\_Ahmadi](https://discuss.elastic.co/u/Rasoul_Ahmadi)\ **Replies:** 10\ **Last updated:** [June 1, 2020, 1:15pm UTC](https://discuss.elastic.co/t/logstash-elasticsearch-output-problem/234577 "2020-06-01T13:15:06Z")
hi all i have an strange problem i do check apache grok from this git in stdout codec rubydebug and i get success but when i try to push it in elastic search it wont show in indexes could you kindly test that out too… --- ## [Problem: \[logstash.outputs.elasticsearch\] Could not index event to Elasticsearch-wazuh-alerts-3.x-2020.05.30](https://discuss.elastic.co/t/problem-logstash-outputs-elasticsearch-could-not-index-event-to-elasticsearch-wazuh-alerts-3-x-2020-05-30/235038)
**Author:** [@Harsha7071](https://discuss.elastic.co/u/Harsha7071)\ **Replies:** 6\ **Last updated:** [June 1, 2020, 12:36pm UTC](https://discuss.elastic.co/t/problem-logstash-outputs-elasticsearch-could-not-index-event-to-elasticsearch-wazuh-alerts-3-x-2020-05-30/235038 "2020-06-01T12:36:53Z")
Hi Team, We are running into a problem where we are not seeing any alerts in the Kibana. We are using this for the first time. We have two servers- Server is installed with Wazuh Manager-API- Filebeat Elastic search … --- ## [Parsing Logs based on a Regex sequence (Prune, Grok, Mutate)](https://discuss.elastic.co/t/parsing-logs-based-on-a-regex-sequence-prune-grok-mutate/234933)
**Author:** [@clearedskies](https://discuss.elastic.co/u/clearedskies)\ **Replies:** 5\ **Last updated:** [June 1, 2020, 12:18pm UTC](https://discuss.elastic.co/t/parsing-logs-based-on-a-regex-sequence-prune-grok-mutate/234933 "2020-06-01T12:18:48Z")
The set-up I currently have is Filebeat --\> Logstash --\> Elasticsearch --\> Kibana. Filebeat naturally comes with a series of fields (that can be turned off in filebeat.yml) and I am trying to parse them in Logstash so c… --- ## [Logstash does not parse date when ingesting data](https://discuss.elastic.co/t/logstash-does-not-parse-date-when-ingesting-data/235106)
**Author:** [@raniceyue](https://discuss.elastic.co/u/raniceyue)\ **Replies:** 1\ **Last updated:** [June 1, 2020, 11:25am UTC](https://discuss.elastic.co/t/logstash-does-not-parse-date-when-ingesting-data/235106 "2020-06-01T11:25:30Z")
I have a large CSV file with many columns, and when I first ingested it into elasticsearch, everything worked fine, and all the dates that I specified in the date filters were parsed properly. However after adding 3 col… --- ## [Logstash.runner shuts down automatically after the creation of API endpoint](https://discuss.elastic.co/t/logstash-runner-shuts-down-automatically-after-the-creation-of-api-endpoint/235144)
**Author:** [@shanthveeresh](https://discuss.elastic.co/u/shanthveeresh)\ **Replies:** 0\ **Last updated:** [June 1, 2020, 10:44am UTC](https://discuss.elastic.co/t/logstash-runner-shuts-down-automatically-after-the-creation-of-api-endpoint/235144 "2020-06-01T10:44:25Z")
Please look into the output: bash-4.2$ /usr/share/logstash/bin/logstash -f /usr/share/logstash/test.conf --path.data /usr/share/logstash/df\_dev OpenJDK 64-Bit Server VM warning: Option UseConcMarkSweepGC was deprecated … --- ## [Issue with sending data from oracle to elasticsearch using logstah](https://discuss.elastic.co/t/issue-with-sending-data-from-oracle-to-elasticsearch-using-logstah/235131)
**Author:** [@sine\_traore](https://discuss.elastic.co/u/sine_traore)\ **Replies:** 0\ **Last updated:** [June 1, 2020, 8:19am UTC](https://discuss.elastic.co/t/issue-with-sending-data-from-oracle-to-elasticsearch-using-logstah/235131 "2020-06-01T08:19:52Z")
Please Could some one help with this issue. i want to send records from an oracle database to elasticsearch using logstash but i'm getting the following error \[2020-06-01T08:55:41,800\]\[ERROR\]\[logstash.agent \]… --- ## [Logstash disable retry on RC 403](https://discuss.elastic.co/t/logstash-disable-retry-on-rc-403/235125)
**Author:** [@hadars](https://discuss.elastic.co/u/hadars)\ **Replies:** 0\ **Last updated:** [June 1, 2020, 7:58am UTC](https://discuss.elastic.co/t/logstash-disable-retry-on-rc-403/235125 "2020-06-01T07:58:03Z")
Hey all, We used to let Logstash open indices if needed, this is no longer needed due to auto pre-creating of all the needed indices. Right now we removed the permissions to create indeces of the Logstash, this worked … --- ## [Logstash read mode not reading file with same name](https://discuss.elastic.co/t/logstash-read-mode-not-reading-file-with-same-name/234861)
**Author:** [@ghostd9](https://discuss.elastic.co/u/ghostd9)\ **Replies:** 2\ **Last updated:** [June 1, 2020, 7:38am UTC](https://discuss.elastic.co/t/logstash-read-mode-not-reading-file-with-same-name/234861 "2020-06-01T07:38:05Z")
Hi I'm using the read mode in logstash (version-7.7.0) to read my log files and delete them once they've been parsed by logstash. The use case is such that I have a log file in which data will be coming in intervals whi… --- ## [If statement within logstash](https://discuss.elastic.co/t/if-statement-within-logstash/234881)
**Author:** [@ErwinEnableU](https://discuss.elastic.co/u/ErwinEnableU)\ **Replies:** 3\ **Last updated:** [June 1, 2020, 4:45am UTC](https://discuss.elastic.co/t/if-statement-within-logstash/234881 "2020-06-01T04:45:45Z")
Hi all, I am trying to create an if-statement within my logstash filter. If follow the documentation on https://www.elastic.co/guide/en/logstash/current/event-dependent-configuration.html But somehow I am unable to get… --- ## [Logstash grok working on grok debugger but failing on filter.conf](https://discuss.elastic.co/t/logstash-grok-working-on-grok-debugger-but-failing-on-filter-conf/235068)
**Author:** [@niraj\_pandey](https://discuss.elastic.co/u/niraj_pandey)\ **Replies:** 3\ **Last updated:** [June 1, 2020, 4:29am UTC](https://discuss.elastic.co/t/logstash-grok-working-on-grok-debugger-but-failing-on-filter-conf/235068 "2020-06-01T04:29:58Z")
Hi , I have the following text and grok: Text: \[17/May/2020 14:53:45\] INFO \[accounts.views.login:278\] Registration failed: Invalid Referral Code. Please check your code and retry, SSG2FDLJMA57 And GroK \[(?\[\\d\\w/\\s/\\… --- ## [JDBC SQL server error, TSL](https://discuss.elastic.co/t/jdbc-sql-server-error-tsl/235094)
**Author:** [@Incauto](https://discuss.elastic.co/u/Incauto)\ **Replies:** 3\ **Last updated:** [June 1, 2020, 12:31am UTC](https://discuss.elastic.co/t/jdbc-sql-server-error-tsl/235094 "2020-06-01T00:31:43Z")
Hi im getting this error in logstash 7.6.1 when using JDBC driver The driver could not establish a secure connection to SQL Server by using Secure Sockets Layer (SSL) encryption. Error: \\"The server selected protocol ve… --- ## [Assign a value from a line before if field has no value present](https://discuss.elastic.co/t/assign-a-value-from-a-line-before-if-field-has-no-value-present/235097)
**Author:** [@hazal](https://discuss.elastic.co/u/hazal)\ **Replies:** 0\ **Last updated:** [June 1, 2020, 12:28am UTC](https://discuss.elastic.co/t/assign-a-value-from-a-line-before-if-field-has-no-value-present/235097 "2020-06-01T00:28:26Z")
Hey, I wonder that is it possible to assign data to a blank field from a line appeared before in logstash? I mean there is a csv file, and in this csv file, some lines' date field does not have value because these line… --- ## [Kibana does not shown my newly created index](https://discuss.elastic.co/t/kibana-does-not-shown-my-newly-created-index/235059)
**Author:** [@himalc](https://discuss.elastic.co/u/himalc)\ **Replies:** 4\ **Last updated:** [May 31, 2020, 4:28pm UTC](https://discuss.elastic.co/t/kibana-does-not-shown-my-newly-created-index/235059 "2020-05-31T16:28:12Z")
After changing grok pattern and restart the logstash, but newly created index does not appear in Kibana index. below is my output section. output { elasticsearch { hosts =\> \[ "elasticsearch:9200" \] index =\> "data-tes… --- ## [Logstash to s3 dynamic bucket](https://discuss.elastic.co/t/logstash-to-s3-dynamic-bucket/235072)
**Author:** [@mctj](https://discuss.elastic.co/u/mctj)\ **Replies:** 0\ **Last updated:** [May 31, 2020, 3:11pm UTC](https://discuss.elastic.co/t/logstash-to-s3-dynamic-bucket/235072 "2020-05-31T15:11:14Z")
Hey, I'm trying to upload data from logstash to s3. I couldnt find any way to use a dynamic bucket name. In my json input I'm getting a key that is called bucket\_name and I would like to use that as the destination buck… --- ## [Timezone issue with logstash date filter plugin](https://discuss.elastic.co/t/timezone-issue-with-logstash-date-filter-plugin/235026)
**Author:** [@Gauti](https://discuss.elastic.co/u/Gauti)\ **Replies:** 3\ **Last updated:** [May 30, 2020, 7:12pm UTC](https://discuss.elastic.co/t/timezone-issue-with-logstash-date-filter-plugin/235026 "2020-05-30T19:12:30Z")
Hi All, We are ingesting data into elasticsearch using logstash, our problem here is with the timezone issue. We are having a total of 8 date fields in the documents for example we are ingesting servicenow data, which … --- ## [Enrich Processor Performance Metrics](https://discuss.elastic.co/t/enrich-processor-performance-metrics/235029)
**Author:** [@Mike\_Adam](https://discuss.elastic.co/u/Mike_Adam)\ **Replies:** 0\ **Last updated:** [May 30, 2020, 6:16pm UTC](https://discuss.elastic.co/t/enrich-processor-performance-metrics/235029 "2020-05-30T18:16:25Z")
Hi, Are there any performance metrics available for using the enrich processor in large production environments setup running with around 120,000 events per second and multiple reference data enabled that change hourly. … --- ## [Reading BLOB data Docx from MySQL table](https://discuss.elastic.co/t/reading-blob-data-docx-from-mysql-table/234959)
**Author:** [@Jasmeet](https://discuss.elastic.co/u/Jasmeet)\ **Replies:** 1\ **Last updated:** [May 30, 2020, 5:07pm UTC](https://discuss.elastic.co/t/reading-blob-data-docx-from-mysql-table/234959 "2020-05-30T17:07:39Z")
I am trying to read a BLOB data stored in a Mysql table using JDBC connector in Logstash. I intend to index the data in Elasticsearch. I have been able to read a pdf file however when i read a Docx file, i get an error. … --- ## [Logstash dont use \*.conf files](https://discuss.elastic.co/t/logstash-dont-use-conf-files/234277)
**Author:** [@ahiyaz](https://discuss.elastic.co/u/ahiyaz)\ **Replies:** 27\ **Last updated:** [May 30, 2020, 4:31pm UTC](https://discuss.elastic.co/t/logstash-dont-use-conf-files/234277 "2020-05-30T16:31:59Z")
hi all i have an issue using configuration files that are under /etc/logstash/conf.d directory. The issue is that when loading logstash using systemctl the demon don't pull the configuration from the \*.conf file unde… --- ## [How to use multiple inputs and output same index in Logstash?](https://discuss.elastic.co/t/how-to-use-multiple-inputs-and-output-same-index-in-logstash/235021)
**Author:** [@MrAst160](https://discuss.elastic.co/u/MrAst160)\ **Replies:** 0\ **Last updated:** [May 30, 2020, 2:33pm UTC](https://discuss.elastic.co/t/how-to-use-multiple-inputs-and-output-same-index-in-logstash/235021 "2020-05-30T14:33:13Z")
hi~ I want to output syslog and windows event log inputs into one index. I can't input with beats (event log) and udp (syslog). So I input event log in tcp and syslog in udp. However, in kibana, the event log is brok… --- ## [Creating Certificate using Certutil](https://discuss.elastic.co/t/creating-certificate-using-certutil/234502)
**Author:** [@ethical20](https://discuss.elastic.co/u/ethical20)\ **Replies:** 2\ **Last updated:** [May 30, 2020, 5:39am UTC](https://discuss.elastic.co/t/creating-certificate-using-certutil/234502 "2020-05-30T05:39:34Z")
Hi, I've used this commands to generate CA and Cert: bin/elasticsearch-certutil ca bin/elasticsearch-certutil cert --ca elastic-stack-ca.p12 But in logstash and beats a p12 is not supported and I MUST use ssl.certifi… --- ## [Parse Delimited values from JSON log](https://discuss.elastic.co/t/parse-delimited-values-from-json-log/234637)
**Author:** [@pawankumardv](https://discuss.elastic.co/u/pawankumardv)\ **Replies:** 11\ **Last updated:** [May 29, 2020, 8:35pm UTC](https://discuss.elastic.co/t/parse-delimited-values-from-json-log/234637 "2020-05-29T20:35:41Z")
Hello i have logs in the following format { "timeMillis" : 1590564813191, "thread" : "JOBSCHEDULER\_THREAD\_2", "level" : "ALERT", "loggerName" : "JobScheduler", "message" : "value1\*value2\*value3\*value4\*", "endOfBa… --- ## [Logstash XML parsing issue](https://discuss.elastic.co/t/logstash-xml-parsing-issue/234833)
**Author:** [@Noe253](https://discuss.elastic.co/u/Noe253)\ **Replies:** 1\ **Last updated:** [May 29, 2020, 10:23pm UTC](https://discuss.elastic.co/t/logstash-xml-parsing-issue/234833 "2020-05-29T22:23:47Z")
Hello everyone, I have a problem when I'm trying to parse xml logs with Logstash. Indeed, I installed and configured Filebeat on a CentOS 7 with Prelude SIEM installed. I am using Filebeat to transmit the xml logs from… --- ## [Suppress Dissector mapping failure logs](https://discuss.elastic.co/t/suppress-dissector-mapping-failure-logs/185785)
**Author:** [@vivekkarne](https://discuss.elastic.co/u/vivekkarne)\ **Replies:** 2\ **Last updated:** [May 29, 2020, 8:58pm UTC](https://discuss.elastic.co/t/suppress-dissector-mapping-failure-logs/185785 "2020-05-29T20:58:46Z")
Hi, I have some dissect filters in my configuration file which fail at certain points in time. Failure as such causes logstash to write a message on the lines of: \[2019-06-14T00:00:00,232\]\[WARN \]\[org.logstash.dissect.D… --- ## [Iterate\_on in translate filter](https://discuss.elastic.co/t/iterate-on-in-translate-filter/234980)
**Author:** [@theo1991](https://discuss.elastic.co/u/theo1991)\ **Replies:** 1\ **Last updated:** [May 29, 2020, 8:37pm UTC](https://discuss.elastic.co/t/iterate-on-in-translate-filter/234980 "2020-05-29T20:37:41Z")
Hi, I encounter a problem with iterate\_on. I have multiple config files for different client, which are the same except the name of the files. The translation with the dictionnary works for the indexes from some config… --- ## [Problem with POST xml request with http\_poller plugin](https://discuss.elastic.co/t/problem-with-post-xml-request-with-http-poller-plugin/234343)
**Author:** [@Ranjan\_Kumar](https://discuss.elastic.co/u/Ranjan_Kumar)\ **Replies:** 8\ **Last updated:** [May 29, 2020, 8:27pm UTC](https://discuss.elastic.co/t/problem-with-post-xml-request-with-http-poller-plugin/234343 "2020-05-29T20:27:56Z")
Hi , I am using logstash to send post data to elastic node but i am getting this. Please help me regarding this. logstash\_post.conf input { http\_poller { urls =\> { method =\> post schedule =\> {cron =\> "\* \* \* \* \* UT… --- ## [?refresh=wait\_for in elasticsearch output](https://discuss.elastic.co/t/refresh-wait-for-in-elasticsearch-output/232859)
**Author:** [@Fernando\_Ruben\_Otero](https://discuss.elastic.co/u/Fernando_Ruben_Otero)\ **Replies:** 2\ **Last updated:** [May 29, 2020, 6:37pm UTC](https://discuss.elastic.co/t/refresh-wait-for-in-elasticsearch-output/232859 "2020-05-29T18:37:30Z")
Hi, I can't find in the documentation if there's a way to specify the refresh parameter on a \_bulk operation, in particular I wanted to try wait\_for https://www.elastic.co/guide/en/elasticsearch/reference/current/docs-… --- ## [TOO\_MANY\_REQUESTS/12/index read-only / allow delete (api](https://discuss.elastic.co/t/too-many-requests-12-index-read-only-allow-delete-api/234901)
**Author:** [@PraveenKT](https://discuss.elastic.co/u/PraveenKT)\ **Replies:** 2\ **Last updated:** [May 29, 2020, 6:16pm UTC](https://discuss.elastic.co/t/too-many-requests-12-index-read-only-allow-delete-api/234901 "2020-05-29T18:16:31Z")
Why i am getting below logs in Logstash logs? \[2020-05-29T03:21:20,840\]\[INFO \]\[logstash.outputs.elasticsearch\]\[main\]\[220c76045b556cf67d246e54931c092b729b0e8dcc83cd8283a28d6d531fc2bd\] retrying failed action with response… --- ## [Arcsight and CEF Modules](https://discuss.elastic.co/t/arcsight-and-cef-modules/234963)
**Author:** [@nfergusn](https://discuss.elastic.co/u/nfergusn)\ **Replies:** 0\ **Last updated:** [May 29, 2020, 5:35pm UTC](https://discuss.elastic.co/t/arcsight-and-cef-modules/234963 "2020-05-29T17:35:25Z")
I'm trying to understand the connection between the Logstash ArcSight and Filebeat CEF Modules. What I've gathered from the documentation for each, the Logstash ArcSight module will set up and configure dashboards in Kib… --- ## [How to increase the number of transaction in logstash](https://discuss.elastic.co/t/how-to-increase-the-number-of-transaction-in-logstash/234951)
**Author:** [@Md\_Iburahimsha\_S](https://discuss.elastic.co/u/Md_Iburahimsha_S)\ **Replies:** 2\ **Last updated:** [May 29, 2020, 4:41pm UTC](https://discuss.elastic.co/t/how-to-increase-the-number-of-transaction-in-logstash/234951 "2020-05-29T16:41:42Z")
My goal has to reach 600 login/sec. when i run with single client, transaction going 170-200/sec. So i have added few more client machine to achieve this goal. how ever i unable to reach my goal, maximum transaction goin… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=348) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=350)