# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=362 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 363 --- ## [Logstash container with TCP endpoint dies after about 5 min](https://discuss.elastic.co/t/logstash-container-with-tcp-endpoint-dies-after-about-5-min/231469)
**Author:** [@virapp](https://discuss.elastic.co/u/virapp)\ **Replies:** 0\ **Last updated:** [May 7, 2020, 7:07am UTC](https://discuss.elastic.co/t/logstash-container-with-tcp-endpoint-dies-after-about-5-min/231469 "2020-05-07T07:07:18Z")
Hi! I'm running logstash 6.4.2 in a container (image from elastic) on AWS ECS, here are some info: TCP Endpoint SSL\_Enabled =\> true SSL\_verify =\> true. Data = Syslog with custom ruby filter Logs are sent from thousand… --- ## [How to make logstash listen to port less than 1024](https://discuss.elastic.co/t/how-to-make-logstash-listen-to-port-less-than-1024/231467)
**Author:** [@Hari\_Krishna](https://discuss.elastic.co/u/Hari_Krishna)\ **Replies:** 0\ **Last updated:** [May 7, 2020, 6:59am UTC](https://discuss.elastic.co/t/how-to-make-logstash-listen-to-port-less-than-1024/231467 "2020-05-07T06:59:24Z")
i have my logs sent to port 514. But i get the following error. May 05 14:36:24 ubuntu logstash\[7187\]: \[2020-05-05T14:36:24,423\]\[INFO \]\[logstash.inputs.syslog \]\[main\] Starting syslog tcp listener {:address=\>"0.0.0.0:51… --- ## [Logstash Filter with wrong result for deal with lots event at the same time](https://discuss.elastic.co/t/logstash-filter-with-wrong-result-for-deal-with-lots-event-at-the-same-time/231113)
**Author:** [@stanwang](https://discuss.elastic.co/u/stanwang)\ **Replies:** 2\ **Last updated:** [May 7, 2020, 2:42am UTC](https://discuss.elastic.co/t/logstash-filter-with-wrong-result-for-deal-with-lots-event-at-the-same-time/231113 "2020-05-07T02:42:11Z")
Hi, I use Winlogbeat to transmit Windows Event Log. My Logstash Filter use for parsing the "message" in the Json. The message content will like this, "RuleName: technique\_id=T1047,technique\_name=Windows Management Inst… --- ## [Add new field data using Regex](https://discuss.elastic.co/t/add-new-field-data-using-regex/231205)
**Author:** [@JeremyP](https://discuss.elastic.co/u/JeremyP)\ **Replies:** 2\ **Last updated:** [May 7, 2020, 1:26am UTC](https://discuss.elastic.co/t/add-new-field-data-using-regex/231205 "2020-05-07T01:26:54Z")
Hello, I'm trying to do something rather simple by extracting a Microsoft KB from a string (in my case, the summary field), and adding it to a new field called "patch". I have the regex, just not sure what filter to use… --- ## [Error executing action \`run\` on resource 'bash\[shutdown logstash\]'](https://discuss.elastic.co/t/error-executing-action-run-on-resource-bash-shutdown-logstash/227224)
**Author:** [@manoj123](https://discuss.elastic.co/u/manoj123)\ **Replies:** 0\ **Last updated:** [April 9, 2020, 1:19am UTC](https://discuss.elastic.co/t/error-executing-action-run-on-resource-bash-shutdown-logstash/227224 "2020-04-09T01:19:55Z")
Noticed an error on logstash server while running chef-client. Chef is failing due to this error "Error executing action run on resource 'bash\[shutdown logstash\]' " \` Recipe: tmo-logstash::default bash\[logstash\_fix… --- ## [Logstash and elastic cloud](https://discuss.elastic.co/t/logstash-and-elastic-cloud/231424)
**Author:** [@Holguinmora](https://discuss.elastic.co/u/Holguinmora)\ **Replies:** 1\ **Last updated:** [May 6, 2020, 11:21pm UTC](https://discuss.elastic.co/t/logstash-and-elastic-cloud/231424 "2020-05-06T23:21:53Z")
Hi I just get a subscription to elk cloud but I haven´t been able to get or find or use Logstash. Is Logstash included in the elk cloud? If so where can I found ir? Do I need to run some code in the shell? Or do I nee… --- ## [Logstash Output to Elasticsearch - Try Once Logic](https://discuss.elastic.co/t/logstash-output-to-elasticsearch-try-once-logic/231403)
**Author:** [@seth.yes](https://discuss.elastic.co/u/seth.yes)\ **Replies:** 0\ **Last updated:** [May 6, 2020, 8:14pm UTC](https://discuss.elastic.co/t/logstash-output-to-elasticsearch-try-once-logic/231403 "2020-05-06T20:14:34Z")
I have a cluster that processes around 200k netflow records every second. Due to this volume of throughput, the ES cluster intermittently gets behind on indexing, returning a 503. This increases the pipeline latency, as … --- ## [Logstash stuck at 'Fixnum is deprecated'](https://discuss.elastic.co/t/logstash-stuck-at-fixnum-is-deprecated/231164)
**Author:** [@Jaishree\_Pal](https://discuss.elastic.co/u/Jaishree_Pal)\ **Replies:** 6\ **Last updated:** [May 6, 2020, 8:04pm UTC](https://discuss.elastic.co/t/logstash-stuck-at-fixnum-is-deprecated/231164 "2020-05-06T20:04:04Z")
Hi all, I was trying to send data to elasticsearch using scheduler. I want it to run once a day and update new records. But it gets stuck everytime after these outputs. Please suggest any solution, thanks. Sending Logs… --- ## [Logstash initialize variables before input](https://discuss.elastic.co/t/logstash-initialize-variables-before-input/227684)
**Author:** [@Mario\_Morelli](https://discuss.elastic.co/u/Mario_Morelli)\ **Replies:** 3\ **Last updated:** [May 2, 2020, 12:19am UTC](https://discuss.elastic.co/t/logstash-initialize-variables-before-input/227684 "2020-05-02T00:19:48Z")
Hi Guys I use Logstash for the random projects at work and I just cant seem to figure out the following, seems like it should be easy enough My input uses the http poller plugin, that posts to a REST API There are 2 v… --- ## [Logstash @timestamp replacement help](https://discuss.elastic.co/t/logstash-timestamp-replacement-help/231387)
**Author:** [@clarkritchie](https://discuss.elastic.co/u/clarkritchie)\ **Replies:** 0\ **Last updated:** [May 6, 2020, 6:14pm UTC](https://discuss.elastic.co/t/logstash-timestamp-replacement-help/231387 "2020-05-06T18:14:58Z")
Hi all, Trying to replace @timestamp with: mutate { add\_field =\> { "log\_time" =\> "%{year}-%{month}-%{day} %{time}" } } date { match =\> \[ "log\_time", "yyyy-MM-dd HH:mm:ss" \] target =\> "@timestamp" } I am seeing l… --- ## [Logstash Output to Elasticsearch using todays date instead of @timestamp](https://discuss.elastic.co/t/logstash-output-to-elasticsearch-using-todays-date-instead-of-timestamp/231372)
**Author:** [@chris.murray](https://discuss.elastic.co/u/chris.murray)\ **Replies:** 5\ **Last updated:** [May 6, 2020, 4:36pm UTC](https://discuss.elastic.co/t/logstash-output-to-elasticsearch-using-todays-date-instead-of-timestamp/231372 "2020-05-06T16:36:50Z")
By default, when you send Logstash to Elasticsearch, the index is "logstash-%{+YYYY.MM.dd}". The %{YYYY.MM.dd} from what I can tell, is coming from a document's @timestamp field. My question: Is it possible to force L… --- ## [Best way to configure multiple output block](https://discuss.elastic.co/t/best-way-to-configure-multiple-output-block/231269)
**Author:** [@yj\_h](https://discuss.elastic.co/u/yj_h)\ **Replies:** 4\ **Last updated:** [May 6, 2020, 2:37pm UTC](https://discuss.elastic.co/t/best-way-to-configure-multiple-output-block/231269 "2020-05-06T14:37:05Z")
My question is best way to configure multiple output block . in my case. input { beat =\> {}} filter { if \[type\] {} else if \[type\] {} else if \[type\] {} else \[type\] {} } output { if \[type\] {} else if \[type\] {} else if \[t… --- ## [Logstash: Grok patterns location](https://discuss.elastic.co/t/logstash-grok-patterns-location/231295)
**Author:** [@kelk](https://discuss.elastic.co/u/kelk)\ **Replies:** 3\ **Last updated:** [May 6, 2020, 11:36am UTC](https://discuss.elastic.co/t/logstash-grok-patterns-location/231295 "2020-05-06T11:36:24Z")
As given by example # contents of ./patterns/postfix: POSTFIX\_QUEUEID \[0-9A-F\]{10,11} Raw data Jan 1 06:25:43 mailserver14 postfix/cleanup\[21403\]: BEF25A72965: message-id=\<20130101142543.5828399CCAF@mailserver14.examp… --- ## [Logstash filter to extract email and credit card](https://discuss.elastic.co/t/logstash-filter-to-extract-email-and-credit-card/226736)
**Author:** [@AnanthMahadevan](https://discuss.elastic.co/u/AnanthMahadevan)\ **Replies:** 5\ **Last updated:** [May 6, 2020, 11:10am UTC](https://discuss.elastic.co/t/logstash-filter-to-extract-email-and-credit-card/226736 "2020-05-06T11:10:09Z")
I am new to logstash and want to extract email IDs and credit card details from files. I am using filebeat to pass log files to logstash and also have setup a config file with the grok patterns. However, I am not able to… --- ## [How can i use wss client in logstash-output-websocket-3.0.5?](https://discuss.elastic.co/t/how-can-i-use-wss-client-in-logstash-output-websocket-3-0-5/231321)
**Author:** [@talbehat](https://discuss.elastic.co/u/talbehat)\ **Replies:** 0\ **Last updated:** [May 6, 2020, 10:47am UTC](https://discuss.elastic.co/t/how-can-i-use-wss-client-in-logstash-output-websocket-3-0-5/231321 "2020-05-06T10:47:21Z")
Hi, Please let me know how can i use wss client configuration in logstash-output-websocket-3.0.5 with logstash version 7.4? --- ## [Does not return data from the database](https://discuss.elastic.co/t/does-not-return-data-from-the-database/231036)
**Author:** [@FernandoMOTA](https://discuss.elastic.co/u/FernandoMOTA)\ **Replies:** 1\ **Last updated:** [May 6, 2020, 9:39am UTC](https://discuss.elastic.co/t/does-not-return-data-from-the-database/231036 "2020-05-06T09:39:57Z")
I can't get Elastic to return the data received from my DB, no data is returned, below is the configuration file: input { jdbc { jdbc\_driver\_class =\> "com.microsoft.sqlserver.jdbc.SQLServerDriver" jdbc\_connection… --- ## [Not processing input/output unless running as root](https://discuss.elastic.co/t/not-processing-input-output-unless-running-as-root/230829)
**Author:** [@gregorys](https://discuss.elastic.co/u/gregorys)\ **Replies:** 3\ **Last updated:** [May 6, 2020, 8:57am UTC](https://discuss.elastic.co/t/not-processing-input-output-unless-running-as-root/230829 "2020-05-06T08:57:47Z")
Hi, OS: Debian 10.3 openjdk version "11.0.7" 2020-04-14 OpenJDK Runtime Environment (build 11.0.7+10-post-Debian-3deb10u1) OpenJDK 64-Bit Server VM (build 11.0.7+10-post-Debian-3deb10u1, mixed mode, sharing) Logstas… --- ## [How to categorize devices in 4 types like mobile, desktop, tablet, tv using logstash's ua plugin and How to give path to the custom regexes.yaml file in ua plugin of logstash](https://discuss.elastic.co/t/how-to-categorize-devices-in-4-types-like-mobile-desktop-tablet-tv-using-logstashs-ua-plugin-and-how-to-give-path-to-the-custom-regexes-yaml-file-in-ua-plugin-of-logstash/231270)
**Author:** [@darkwarrior](https://discuss.elastic.co/u/darkwarrior)\ **Replies:** 0\ **Last updated:** [May 6, 2020, 6:06am UTC](https://discuss.elastic.co/t/how-to-categorize-devices-in-4-types-like-mobile-desktop-tablet-tv-using-logstashs-ua-plugin-and-how-to-give-path-to-the-custom-regexes-yaml-file-in-ua-plugin-of-logstash/231270 "2020-05-06T06:06:23Z")
Hey all, I am using user-agent plugin of logstash and its working fine but in device field I am getting specific devices something like nokia , samsung-Gt, iphone, ..... etc for mobiles but here I want device value to … --- ## [Is possible that one jdbc block has multiple statements?](https://discuss.elastic.co/t/is-possible-that-one-jdbc-block-has-multiple-statements/231091)
**Author:** [@yj\_h](https://discuss.elastic.co/u/yj_h)\ **Replies:** 2\ **Last updated:** [May 6, 2020, 5:33am UTC](https://discuss.elastic.co/t/is-possible-that-one-jdbc-block-has-multiple-statements/231091 "2020-05-06T05:33:43Z")
Is possible that one jdbc block has multiple statements? like this input { jdbc { jdbc\_connection\_string =\> "" if() { statement =\> "" }else if() { statement =\> "" }else { statement =\> "" } } e… --- ## [S3 input plugin is failing when running logstash on kubernetes](https://discuss.elastic.co/t/s3-input-plugin-is-failing-when-running-logstash-on-kubernetes/231261)
**Author:** [@user2416](https://discuss.elastic.co/u/user2416)\ **Replies:** 0\ **Last updated:** [May 6, 2020, 5:31am UTC](https://discuss.elastic.co/t/s3-input-plugin-is-failing-when-running-logstash-on-kubernetes/231261 "2020-05-06T05:31:46Z")
hi, I am running logstash on kubernetes and using s3 input plugin to read logs from S3 and send it to elasticsearch. Pod is being crashloopback with the below error. Can someone help me with this issue? error: \[2020-0… --- ## [Logstash shutting down without noticable error](https://discuss.elastic.co/t/logstash-shutting-down-without-noticable-error/231236)
**Author:** [@Thaylin](https://discuss.elastic.co/u/Thaylin)\ **Replies:** 2\ **Last updated:** [May 6, 2020, 1:42am UTC](https://discuss.elastic.co/t/logstash-shutting-down-without-noticable-error/231236 "2020-05-06T01:42:05Z")
For some reason after logstash starts the API endpoint it shuts down. \[2020-05-05T20:22:54,694\]\[WARN \]\[logstash.config.source.multilocal\] Ignoring the 'pipelines.yml' file because modules or command line options are sp… --- ## [Classifying different events using logstash](https://discuss.elastic.co/t/classifying-different-events-using-logstash/231229)
**Author:** [@Ram\_Jeghan](https://discuss.elastic.co/u/Ram_Jeghan)\ **Replies:** 0\ **Last updated:** [May 5, 2020, 9:55pm UTC](https://discuss.elastic.co/t/classifying-different-events-using-logstash/231229 "2020-05-05T21:55:50Z")
Hi, We have log events from different sources: windows syslog firewall -database etc dumped into the same file from a legacy process. event1 could be windows, event2 could be oracle etc., What would be the best … --- ## [Logstash jdbc using tns results in error "Unknown host specified"](https://discuss.elastic.co/t/logstash-jdbc-using-tns-results-in-error-unknown-host-specified/230498)
**Author:** [@philippeE](https://discuss.elastic.co/u/philippeE)\ **Replies:** 14\ **Last updated:** [May 5, 2020, 8:11pm UTC](https://discuss.elastic.co/t/logstash-jdbc-using-tns-results-in-error-unknown-host-specified/230498 "2020-05-05T20:11:47Z")
Hello, I try to use jdbc to connect to my oracle server using tns. logstash.conf: input { jdbc { jdbc\_driver\_library =\> "" jdbc\_driver\_class =\> "Java::oracle.jdbc.driver.OracleDriver" jdbc\_connection\_string =\> "j… --- ## [Logstash 7.6.2 / Unable to produce output](https://discuss.elastic.co/t/logstash-7-6-2-unable-to-produce-output/231211)
**Author:** [@sc5283](https://discuss.elastic.co/u/sc5283)\ **Replies:** 0\ **Last updated:** [May 5, 2020, 7:08pm UTC](https://discuss.elastic.co/t/logstash-7-6-2-unable-to-produce-output/231211 "2020-05-05T19:08:02Z")
I am running rhel 7.8 / logstash 7.6.2 (as root) logstash is unable to produce any output (tested elastic, file, and stdout) executing: /usr/share/logstash/bin/logstash -f /etc/logstash/testdata/test\_file.conf --log.… --- ## [Logstash - JSON Filter to get inner json fields](https://discuss.elastic.co/t/logstash-json-filter-to-get-inner-json-fields/231022)
**Author:** [@Rekha\_Dhinagaran](https://discuss.elastic.co/u/Rekha_Dhinagaran)\ **Replies:** 1\ **Last updated:** [May 5, 2020, 7:14pm UTC](https://discuss.elastic.co/t/logstash-json-filter-to-get-inner-json-fields/231022 "2020-05-05T19:14:12Z")
Hi, This is my event log, {'\_index': 'logstash-2020.05.03', '\_type': '\_doc', '\_id': 'xXKW2XEB43wd9fLrXQnQ', '\_score': 1.0, '\_source': {'@version': '1', 'beat': {'version': '6.2.4', 'name': 'cb-rekha.local', 'hostname':… --- ## [Logstash JDBC analyzers](https://discuss.elastic.co/t/logstash-jdbc-analyzers/231210)
**Author:** [@Kevin\_Juliano](https://discuss.elastic.co/u/Kevin_Juliano)\ **Replies:** 0\ **Last updated:** [May 5, 2020, 7:07pm UTC](https://discuss.elastic.co/t/logstash-jdbc-analyzers/231210 "2020-05-05T19:07:06Z")
Hi Everyone, I'm still new to Elastic. I am trying to use the snowball or porter\_strem analyzer but I have no Idea how to do it with JDBC Logstash and PostgreSQL, as far as I search and looked for solution,to use this fe… --- ## [Logstash server running Salesforce-plugin](https://discuss.elastic.co/t/logstash-server-running-salesforce-plugin/229360)
**Author:** [@eemtzc](https://discuss.elastic.co/u/eemtzc)\ **Replies:** 4\ **Last updated:** [May 5, 2020, 6:20pm UTC](https://discuss.elastic.co/t/logstash-server-running-salesforce-plugin/229360 "2020-05-05T18:20:37Z")
Hello, I have a logstash server specifically to run salesforce-plugin to update a pipeline. Everything "works" good except for the fact that recently found out that the logstash service on this server restarts every 12-… --- ## [Pagination for REST API Through Logstash](https://discuss.elastic.co/t/pagination-for-rest-api-through-logstash/231060)
**Author:** [@Mahmmoud\_Rashed](https://discuss.elastic.co/u/Mahmmoud_Rashed)\ **Replies:** 2\ **Last updated:** [May 5, 2020, 5:29pm UTC](https://discuss.elastic.co/t/pagination-for-rest-api-through-logstash/231060 "2020-05-05T17:29:26Z")
How can I import from a REST API to Elasticsearch via Logstash using Pagination? I was able to import using http\_poller but unfortunately, it doesn't support pagination, so how can I write force a custom script or "for … --- ## [Logstash-codec-json stopped working](https://discuss.elastic.co/t/logstash-codec-json-stopped-working/231196)
**Author:** [@chrome\_test](https://discuss.elastic.co/u/chrome_test)\ **Replies:** 0\ **Last updated:** [May 5, 2020, 4:32pm UTC](https://discuss.elastic.co/t/logstash-codec-json-stopped-working/231196 "2020-05-05T16:32:03Z")
I used logstash-codec-json plugin for a POC deployment on AWS, the related configuration is as below. input { udp { port =\> "9999" type =\> "mylog" codec =\> json buffer\_size =\> 65536 … --- ## [LogStash Config File - Grok Regex](https://discuss.elastic.co/t/logstash-config-file-grok-regex/231016)
**Author:** [@Karanbir\_Mann](https://discuss.elastic.co/u/Karanbir_Mann)\ **Replies:** 2\ **Last updated:** [May 5, 2020, 5:20pm UTC](https://discuss.elastic.co/t/logstash-config-file-grok-regex/231016 "2020-05-05T17:20:26Z")
Hello Community, I'm very new to LogStash and I have a question. I am trying to use grok to get a substring from my message and put it in a new field. I've used grokdebugger in kibana and it seems to highlight the right… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=361) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=363)