# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=360 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 361 --- ## [Logstash deployment on AKS/EKS](https://discuss.elastic.co/t/logstash-deployment-on-aks-eks/232063)
**Author:** [@dweljali](https://discuss.elastic.co/u/dweljali)\ **Replies:** 0\ **Last updated:** [May 11, 2020, 3:46pm UTC](https://discuss.elastic.co/t/logstash-deployment-on-aks-eks/232063 "2020-05-11T15:46:24Z")
How can we deploy Logstash on AKS or EKS in multicluster mode? Does logstash support it or any other application can be use to achive it. Thank you. --- ## [No entries in sincedb after starting logstash](https://discuss.elastic.co/t/no-entries-in-sincedb-after-starting-logstash/232054)
**Author:** [@subramanyam.setty](https://discuss.elastic.co/u/subramanyam.setty)\ **Replies:** 0\ **Last updated:** [May 11, 2020, 3:15pm UTC](https://discuss.elastic.co/t/no-entries-in-sincedb-after-starting-logstash/232054 "2020-05-11T15:15:04Z")
Hi Team, I have created the portal.conf and input log file then restarted the logstash . Logstash started with out any error but not processing any records.I have mentioned portal.conf /input log file.Please help me wit… --- ## [Logstash Filter - Breaking up fields into multiple documents](https://discuss.elastic.co/t/logstash-filter-breaking-up-fields-into-multiple-documents/231755)
**Author:** [@Sinnott](https://discuss.elastic.co/u/Sinnott)\ **Replies:** 4\ **Last updated:** [May 11, 2020, 2:11pm UTC](https://discuss.elastic.co/t/logstash-filter-breaking-up-fields-into-multiple-documents/231755 "2020-05-11T14:11:25Z")
Hi Logstash Community, I am trying to break up a single input with multiple fields into multiple output documents in elasticsearch with a subsection of these fields contained, all using the same set of field names. Bac… --- ## [Error ingestion two csv in elastic search](https://discuss.elastic.co/t/error-ingestion-two-csv-in-elastic-search/229435)
**Author:** [@Youssef\_SBAI](https://discuss.elastic.co/u/Youssef_SBAI)\ **Replies:** 11\ **Last updated:** [May 11, 2020, 2:08pm UTC](https://discuss.elastic.co/t/error-ingestion-two-csv-in-elastic-search/229435 "2020-05-11T14:08:32Z")
Hello it is possible to ingest of two csv files in elastic using file beat and logstsh with the same index --- ## [What is the role of stdout { codec =\> rubydebug }](https://discuss.elastic.co/t/what-is-the-role-of-stdout-codec-rubydebug/232039)
**Author:** [@Devyani](https://discuss.elastic.co/u/Devyani)\ **Replies:** 0\ **Last updated:** [May 11, 2020, 2:08pm UTC](https://discuss.elastic.co/t/what-is-the-role-of-stdout-codec-rubydebug/232039 "2020-05-11T14:08:04Z")
I've created the following grok pattern to parse the log file--\> (?%{TIMESTAMP\_ISO8601}) %{LOGLEVEL:loglevel} \* (?\[A-Za-z0-9$\_.\]+) ((%{WORD:log-AppCode})?:(%{NOTSPACE:log-ServerId})?:(%{NOTSPACE:log-ProcessId})?:%{NOTSP… --- ## [Problem ingest Two csv in elastic](https://discuss.elastic.co/t/problem-ingest-two-csv-in-elastic/231995)
**Author:** [@Youssef\_SBAI](https://discuss.elastic.co/u/Youssef_SBAI)\ **Replies:** 3\ **Last updated:** [May 11, 2020, 1:25pm UTC](https://discuss.elastic.co/t/problem-ingest-two-csv-in-elastic/231995 "2020-05-11T13:25:32Z")
I use Logsash and filebeat for ingestion in elastic my config file beat is filebeat.inputs: - type: log enabled: true paths: - C:\\Users\\h83710\\Desktop\\elastic\\logstash-7.5.2\\test\\FICHIER.csv paths: -… --- ## [Tags are not seen in indexer](https://discuss.elastic.co/t/tags-are-not-seen-in-indexer/231977)
**Author:** [@Djamox](https://discuss.elastic.co/u/Djamox)\ **Replies:** 1\ **Last updated:** [May 11, 2020, 12:25pm UTC](https://discuss.elastic.co/t/tags-are-not-seen-in-indexer/231977 "2020-05-11T12:25:38Z")
Hello, I have a configuration like this : Logs -\> Logstash Broker -\> Kafka -\> Logstash Indexer -\> Elasticsearch In the borker, I add a tag "waf" to identify the log source. In the indexer, I use this condition in the… --- ## [Invoke Logstash pipeline from rest endpoint](https://discuss.elastic.co/t/invoke-logstash-pipeline-from-rest-endpoint/232000)
**Author:** [@aviman](https://discuss.elastic.co/u/aviman)\ **Replies:** 0\ **Last updated:** [May 11, 2020, 12:03pm UTC](https://discuss.elastic.co/t/invoke-logstash-pipeline-from-rest-endpoint/232000 "2020-05-11T12:03:41Z")
Hi, Is there any way to inovke/execute logstash pipeline using rest api. Thanks & Regards, Avijit Mandal --- ## [Sending authorization header to http input plugin](https://discuss.elastic.co/t/sending-authorization-header-to-http-input-plugin/231999)
**Author:** [@mostafaelsayed](https://discuss.elastic.co/u/mostafaelsayed)\ **Replies:** 0\ **Last updated:** [May 11, 2020, 11:54am UTC](https://discuss.elastic.co/t/sending-authorization-header-to-http-input-plugin/231999 "2020-05-11T11:54:22Z")
I am using http input plugin to send an http request from postman with "Authorization" header but apparently logstash is not reading this header name when i try to display headers field, "Authorization" header is not di… --- ## [ASA Grok Failure ASA-4-113019](https://discuss.elastic.co/t/asa-grok-failure-asa-4-113019/231976)
**Author:** [@pankaj](https://discuss.elastic.co/u/pankaj)\ **Replies:** 1\ **Last updated:** [May 11, 2020, 10:12am UTC](https://discuss.elastic.co/t/asa-grok-failure-asa-4-113019/231976 "2020-05-11T10:12:45Z")
I am trying to parse and index the cisco asa logs for particular syslog messages . The grok debuger showing the code okay but I dont see the logs indexed in elasticsearch Regards Pankaj --- ## [Grok filter for different type of log lines](https://discuss.elastic.co/t/grok-filter-for-different-type-of-log-lines/231933)
**Author:** [@falconpurple](https://discuss.elastic.co/u/falconpurple)\ **Replies:** 3\ **Last updated:** [May 11, 2020, 9:05am UTC](https://discuss.elastic.co/t/grok-filter-for-different-type-of-log-lines/231933 "2020-05-11T09:05:01Z")
Hi, I am shipping data from logstash to Elasticsearch. Can you please help me to write the grok filter . I have attached a part of the log files. \[2018-06-17 20:12:59,754|INFO |https-jkilhhs|com.myfirst.service.ai.f… --- ## [ELK beginner](https://discuss.elastic.co/t/elk-beginner/230385)
**Author:** [@faisalali92](https://discuss.elastic.co/u/faisalali92)\ **Replies:** 1\ **Last updated:** [May 11, 2020, 8:53am UTC](https://discuss.elastic.co/t/elk-beginner/230385 "2020-05-11T08:53:26Z")
Hello There I have an ELK stack running with filebeat but I have an issue when I save a search for a a specific query I am unable to view results in the last 15 and 30 minutes and so on and only start to see results whe… --- ## [Refer and extract unknown name attribute](https://discuss.elastic.co/t/refer-and-extract-unknown-name-attribute/231553)
**Author:** [@astrodi](https://discuss.elastic.co/u/astrodi)\ **Replies:** 2\ **Last updated:** [May 11, 2020, 8:31am UTC](https://discuss.elastic.co/t/refer-and-extract-unknown-name-attribute/231553 "2020-05-11T08:31:11Z")
Hi there, I would like to extract the unknown (index) name from JSON in logstash. Structure of input is: ... "indices": { "dna\_master\_v1": { ... } } I want to extra… --- ## [Need help to exlcude messages which are not having kv pair](https://discuss.elastic.co/t/need-help-to-exlcude-messages-which-are-not-having-kv-pair/231894)
**Author:** [@Nithani25](https://discuss.elastic.co/u/Nithani25)\ **Replies:** 2\ **Last updated:** [May 11, 2020, 6:15am UTC](https://discuss.elastic.co/t/need-help-to-exlcude-messages-which-are-not-having-kv-pair/231894 "2020-05-11T06:15:10Z")
HI Team, I have split last field of my message has greedydata Example Message: %{ts:timestampe} %{loglevel} %{DATA} %{GREEDYDATA:Logmessage} My "Logmessage" here at times contains some kv pair in them and i am able t… --- ## [Failed to create Logstash keystore Only PrivateKey storage is supported](https://discuss.elastic.co/t/failed-to-create-logstash-keystore-only-privatekey-storage-is-supported/231914)
**Author:** [@bootham13](https://discuss.elastic.co/u/bootham13)\ **Replies:** 0\ **Last updated:** [May 11, 2020, 3:50am UTC](https://discuss.elastic.co/t/failed-to-create-logstash-keystore-only-privatekey-storage-is-supported/231914 "2020-05-11T03:50:31Z")
Hi, I am trying to create the logstash keystore to store the keys, whenever I try to create the store I get the below mentioned error. I am attaching the logs from the error. I am logged in as root when I try to install… --- ## [Single jmx configuration json file possible for multiple servers to connect to logstash](https://discuss.elastic.co/t/single-jmx-configuration-json-file-possible-for-multiple-servers-to-connect-to-logstash/231660)
**Author:** [@Bhanu\_Praveen](https://discuss.elastic.co/u/Bhanu_Praveen)\ **Replies:** 2\ **Last updated:** [May 11, 2020, 2:48am UTC](https://discuss.elastic.co/t/single-jmx-configuration-json-file-possible-for-multiple-servers-to-connect-to-logstash/231660 "2020-05-11T02:48:15Z")
Hello, Currently i have configured single jmx json file for a single server in logstash jmx input configuration as below. \[{ "host" : "localhost" , "port" : 9000, "alias" : "jmx.elasticsearch" , "queries" : \[ { … --- ## [Initializing variable in ruby logstash filter](https://discuss.elastic.co/t/initializing-variable-in-ruby-logstash-filter/231875)
**Author:** [@sajjad0927](https://discuss.elastic.co/u/sajjad0927)\ **Replies:** 2\ **Last updated:** [May 11, 2020, 2:20am UTC](https://discuss.elastic.co/t/initializing-variable-in-ruby-logstash-filter/231875 "2020-05-11T02:20:16Z")
Can I do multiple initialization in logstash ruby filter like below. For me it is giving error ruby { init =\> "@buffer = 377" init =\> "@buffer1 = 477" code =\> " --- ## [Ingesting .gz files in elastic](https://discuss.elastic.co/t/ingesting-gz-files-in-elastic/231910)
**Author:** [@hsalim](https://discuss.elastic.co/u/hsalim)\ **Replies:** 6\ **Last updated:** [May 11, 2020, 1:33am UTC](https://discuss.elastic.co/t/ingesting-gz-files-in-elastic/231910 "2020-05-11T01:33:11Z")
Hello, I know this topic has been discussed in the past, but I am unable to find any new information. So asking again to see if anyone can offer an update. Is there a way to ingest .gz files in elastic without unzippin… --- ## [How to run Cloud Logstash Pipeline](https://discuss.elastic.co/t/how-to-run-cloud-logstash-pipeline/231906)
**Author:** [@Holguinmora](https://discuss.elastic.co/u/Holguinmora)\ **Replies:** 1\ **Last updated:** [May 10, 2020, 10:56pm UTC](https://discuss.elastic.co/t/how-to-run-cloud-logstash-pipeline/231906 "2020-05-10T22:56:55Z")
Hi I´m trying to run a cloud logstash pipeline that has the next code to start working with the mail filters but I have not been able to find code to try it inside the pipeline or how to run it outside of the pipeline … --- ## [Ruby exception occurred: undefined method '\[\]' for nil:NilClass when filtering csv](https://discuss.elastic.co/t/ruby-exception-occurred-undefined-method-for-nil-nilclass-when-filtering-csv/231893)
**Author:** [@eeijlar](https://discuss.elastic.co/u/eeijlar)\ **Replies:** 2\ **Last updated:** [May 10, 2020, 7:43pm UTC](https://discuss.elastic.co/t/ruby-exception-occurred-undefined-method-for-nil-nilclass-when-filtering-csv/231893 "2020-05-10T19:43:28Z")
I can't figure out why this filter is throwing this error: Ruby exception occurred: undefined method \[\] for nil:NilClass I have added a check anytime ruby could have thrown an exception: filter { ruby { code … --- ## [JDBC Input Multiple sql statements as sub-query](https://discuss.elastic.co/t/jdbc-input-multiple-sql-statements-as-sub-query/231787)
**Author:** [@myersman](https://discuss.elastic.co/u/myersman)\ **Replies:** 2\ **Last updated:** [May 10, 2020, 11:07am UTC](https://discuss.elastic.co/t/jdbc-input-multiple-sql-statements-as-sub-query/231787 "2020-05-10T11:07:01Z")
I want to know if the jdbc input plugin allows me to query multiple tables where the second table runs only for a key value from the first. I presume the config would look something like... input { jdbc { jdbc\_dr… --- ## [After logstash upgrade split array not working](https://discuss.elastic.co/t/after-logstash-upgrade-split-array-not-working/231866)
**Author:** [@vijay\_kaali](https://discuss.elastic.co/u/vijay_kaali)\ **Replies:** 2\ **Last updated:** [May 10, 2020, 1:49pm UTC](https://discuss.elastic.co/t/after-logstash-upgrade-split-array-not-working/231866 "2020-05-10T13:49:00Z")
I have upgraded logstash from 6.2 \> 6.8 and currently in 7.6.2-1 mutate { add\_field =\> { "shorthost2" =\> "%{\[pythonbeat\]\[Hostname\]}" } } mutate { split =\> \[ "shorthost2", "." \] add\_field =\> { "shorthost" =\> "%{sh… --- ## [CISCO Grok Fail](https://discuss.elastic.co/t/cisco-grok-fail/231802)
**Author:** [@clockard](https://discuss.elastic.co/u/clockard)\ **Replies:** 2\ **Last updated:** [May 9, 2020, 6:40pm UTC](https://discuss.elastic.co/t/cisco-grok-fail/231802 "2020-05-09T18:40:52Z")
Let me say I am a network guy so take that for what it is worth. I have spent weeks googling, testing, and debugging I tried not to hassle anyone. I am trying to Grok the following data. \<134\>May 08 2020 10:50:53: %ASA… --- ## [Logstash Service is ignoring pipelines.yml](https://discuss.elastic.co/t/logstash-service-is-ignoring-pipelines-yml/231844)
**Author:** [@mukeshkundergep](https://discuss.elastic.co/u/mukeshkundergep)\ **Replies:** 1\ **Last updated:** [May 9, 2020, 3:41pm UTC](https://discuss.elastic.co/t/logstash-service-is-ignoring-pipelines-yml/231844 "2020-05-09T15:41:26Z")
Logstash Service is ignoring pipeline.yml instead of providing following information pipeline.id: pipeline1 path.config: "/etc/logstash/conf.d/test1.conf" queue.type: persisted pipeline.id: pipeline2 path.config: "/… --- ## [Dateparse failure problem](https://discuss.elastic.co/t/dateparse-failure-problem/231828)
**Author:** [@Youssef\_SBAI](https://discuss.elastic.co/u/Youssef_SBAI)\ **Replies:** 2\ **Last updated:** [May 9, 2020, 1:31pm UTC](https://discuss.elastic.co/t/dateparse-failure-problem/231828 "2020-05-09T13:31:17Z")
I use logsth and filebeat for ingestion in elastic I have ingestion is OK but i have \_dateparsefailure input { beats { port =\> "5044" } } filter { csv { separator =\> ";" colu… --- ## [VMWare Horizon Syslog](https://discuss.elastic.co/t/vmware-horizon-syslog/231752)
**Author:** [@ntwrk80](https://discuss.elastic.co/u/ntwrk80)\ **Replies:** 3\ **Last updated:** [May 9, 2020, 5:03am UTC](https://discuss.elastic.co/t/vmware-horizon-syslog/231752 "2020-05-09T05:03:30Z")
I'm new to logstash and of course one of the first log sources I try to bring in is a weird one. The server is a VMWare Horizon ID server and it's sending some very weird timestamps. 2020.05.129 12:05:360 \[hc\] INFO: pas… --- ## [How to avoid logstash elasticsearch output ilm\_rollover\_alias overwriting the index prefix](https://discuss.elastic.co/t/how-to-avoid-logstash-elasticsearch-output-ilm-rollover-alias-overwriting-the-index-prefix/231444)
**Author:** [@Louis\_Zhang](https://discuss.elastic.co/u/Louis_Zhang)\ **Replies:** 4\ **Last updated:** [May 9, 2020, 1:09am UTC](https://discuss.elastic.co/t/how-to-avoid-logstash-elasticsearch-output-ilm-rollover-alias-overwriting-the-index-prefix/231444 "2020-05-09T01:09:34Z")
I expecting to get index mobile-2020.05.06-000001 with alias 'streamdata-alias', but the logstash creates index streamdata-alias-2020.05.06-000001, is the a bug? Alias and index name are 2 tings, why they have to be sam… --- ## [Enriching Data In SQL (Citrix Monitor Logs)](https://discuss.elastic.co/t/enriching-data-in-sql-citrix-monitor-logs/231780)
**Author:** [@wwalker](https://discuss.elastic.co/u/wwalker)\ **Replies:** 1\ **Last updated:** [May 8, 2020, 8:50pm UTC](https://discuss.elastic.co/t/enriching-data-in-sql-citrix-monitor-logs/231780 "2020-05-08T20:50:55Z")
I was tasked with pulling logs from Citrix's XenDesktops monitor API. The monitor API seems to be a middleman that converts requests into SQL queries. For example, hitting the API endpoint sessions, gives me everything… --- ## [Logstash http output user password](https://discuss.elastic.co/t/logstash-http-output-user-password/231525)
**Author:** [@katara](https://discuss.elastic.co/u/katara)\ **Replies:** 9\ **Last updated:** [May 8, 2020, 7:11pm UTC](https://discuss.elastic.co/t/logstash-http-output-user-password/231525 "2020-05-08T19:11:53Z")
I am receiving log data from TCP and sending it to a https url as json using logstash. Here is my configuration input { tcp { port =\> 8443 codec =\> json\_lines { charset =\> CP1252 } } } output { http { format=\>… --- ## [Logstash Cloud CSV Output plugin to Dropbox or Onedrive or other sites](https://discuss.elastic.co/t/logstash-cloud-csv-output-plugin-to-dropbox-or-onedrive-or-other-sites/231765)
**Author:** [@Holguinmora](https://discuss.elastic.co/u/Holguinmora)\ **Replies:** 0\ **Last updated:** [May 8, 2020, 3:54pm UTC](https://discuss.elastic.co/t/logstash-cloud-csv-output-plugin-to-dropbox-or-onedrive-or-other-sites/231765 "2020-05-08T15:54:55Z")
Hi I started to use Logstash in cloud days a go, I need to get some info into a CSV file but have not found an example / path description to store this info in dropbox or Onedrive. Any ideas on how to connect to this s… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=359) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=361)