# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=367 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 368 --- ## [Logstash does not clean the old generation of garbage](https://discuss.elastic.co/t/logstash-does-not-clean-the-old-generation-of-garbage/230008)
**Author:** [@lym](https://discuss.elastic.co/u/lym)\ **Replies:** 0\ **Last updated:** [April 27, 2020, 6:48pm UTC](https://discuss.elastic.co/t/logstash-does-not-clean-the-old-generation-of-garbage/230008 "2020-04-27T18:48:22Z")
Hi, I have a problem with logstash, it starts working normally, but later I see huge heap usage. After analyzing logs from garbage collector I see that Old Generation is rises and not cleaned well. It leads to degradatio… --- ## [Input and output "message" field in Ruby filter](https://discuss.elastic.co/t/input-and-output-message-field-in-ruby-filter/229886)
**Author:** [@erikwp](https://discuss.elastic.co/u/erikwp)\ **Replies:** 2\ **Last updated:** [April 27, 2020, 6:21pm UTC](https://discuss.elastic.co/t/input-and-output-message-field-in-ruby-filter/229886 "2020-04-27T18:21:20Z")
I am having difficulties with the Ruby filter. As I understand it, "message" is the default field that contains your input. What I want to do is take my input and filter the whole message string into my Ruby filter (whic… --- ## [Indices name in logstash conf not reflecting in kibana](https://discuss.elastic.co/t/indices-name-in-logstash-conf-not-reflecting-in-kibana/230001)
**Author:** [@opensourcengineer](https://discuss.elastic.co/u/opensourcengineer)\ **Replies:** 0\ **Last updated:** [April 27, 2020, 5:49pm UTC](https://discuss.elastic.co/t/indices-name-in-logstash-conf-not-reflecting-in-kibana/230001 "2020-04-27T17:49:34Z")
i m using 7.5.2 version of ELK . my pipeline is as follows: Beast -\> logstash -\> elastic-search-\> kibana i am giving the indices name in my logstash conf file but its not reflecting in my kibana. its is showing the def… --- ## [Logstash and winlogbeat configure SSL, but Logstash print error message :OPENSSL\_internal:WRONG\_VERSION\_NUMBER](https://discuss.elastic.co/t/logstash-and-winlogbeat-configure-ssl-but-logstash-print-error-message-wrong-version-number/229805)
**Author:** [@George\_Wang1](https://discuss.elastic.co/u/George_Wang1)\ **Replies:** 4\ **Last updated:** [April 27, 2020, 4:36pm UTC](https://discuss.elastic.co/t/logstash-and-winlogbeat-configure-ssl-but-logstash-print-error-message-wrong-version-number/229805 "2020-04-27T16:36:06Z")
Hi all, When I configure Logstash and Winlogbeat using SSL, Logstash print error message like that: OPENSSL\_internal:WRONG\_VERSION\_NUMBER Logstash error messages： BeatsHandler - \[local: 0.0.0.0:5044, remote: undefine… --- ## [Elasticsearch Input and Aggregation Issue](https://discuss.elastic.co/t/elasticsearch-input-and-aggregation-issue/229657)
**Author:** [@JeremyP](https://discuss.elastic.co/u/JeremyP)\ **Replies:** 2\ **Last updated:** [April 27, 2020, 4:00pm UTC](https://discuss.elastic.co/t/elasticsearch-input-and-aggregation-issue/229657 "2020-04-27T16:00:36Z")
Hello, I'm trying to combine two indexes using an elasticsearch input plugin and it's not working as intended (aggregation is not occuring). I'm setting the pipeline workers to 1. Event #1 { "\_index": "lum-asset-ent… --- ## [Logstash config file with syslog and json](https://discuss.elastic.co/t/logstash-config-file-with-syslog-and-json/229984)
**Author:** [@sublimesol](https://discuss.elastic.co/u/sublimesol)\ **Replies:** 0\ **Last updated:** [April 27, 2020, 3:13pm UTC](https://discuss.elastic.co/t/logstash-config-file-with-syslog-and-json/229984 "2020-04-27T15:13:01Z")
Hi all, Im very new to ELK and I've recently moved my firewall logging from Splunk to ELK - i currently have my palo alto firewall logging to ELK and I can see syslog messages in being displayed in dashboard in KIbana. … --- ## [Logstash plugin offline packaging](https://discuss.elastic.co/t/logstash-plugin-offline-packaging/229130)
**Author:** [@granier](https://discuss.elastic.co/u/granier)\ **Replies:** 1\ **Last updated:** [April 27, 2020, 12:35pm UTC](https://discuss.elastic.co/t/logstash-plugin-offline-packaging/229130 "2020-04-27T12:35:38Z")
Hi, I try to package a logstash plugin for offlline deployment. I use openjdk 10 2018-03-20 build 10+44 and logstash 6.8.3 that contains jruby jruby 9.2.7.0 (2.5.3) . I use the follonwing commands : logstash-plugin… --- ## [Geo\_point not indexed in Array format](https://discuss.elastic.co/t/geo-point-not-indexed-in-array-format/229334)
**Author:** [@Jalil](https://discuss.elastic.co/u/Jalil)\ **Replies:** 9\ **Last updated:** [April 27, 2020, 12:33pm UTC](https://discuss.elastic.co/t/geo-point-not-indexed-in-array-format/229334 "2020-04-27T12:33:07Z")
Hi all, I'm using logstash to index mongodb documents into ES. every thing goes well but the location object is not indexed. I defined a template mapping as geo\_point as follow : "arrival\_in": { "ignore\_m… --- ## [Cancel the data columns](https://discuss.elastic.co/t/cancel-the-data-columns/229938)
**Author:** [@sowter](https://discuss.elastic.co/u/sowter)\ **Replies:** 0\ **Last updated:** [April 27, 2020, 10:16am UTC](https://discuss.elastic.co/t/cancel-the-data-columns/229938 "2020-04-27T10:16:06Z")
fisrt use dev tool put index second use bin/logstash -f /data/logstash\_csv.conf data into Elasticsearch but data shows what not included columns such like @timestamp @version \_id \_index \_score \_type \_doc … --- ## [Haproxy grokparsefailure](https://discuss.elastic.co/t/haproxy-grokparsefailure/229899)
**Author:** [@vakarthik](https://discuss.elastic.co/u/vakarthik)\ **Replies:** 1\ **Last updated:** [April 27, 2020, 10:15am UTC](https://discuss.elastic.co/t/haproxy-grokparsefailure/229899 "2020-04-27T10:15:23Z")
HAPRoxy Logstash Grok Parse Failure This is my log entry from HAProxy (pfsense haproxy package) "message": "\<142\>Apr 27 02:24:00 haproxy\[37279\]: 162.158.155.249:54250 \[27/Apr/2020:02:24:00.173\] shared-frontend-merged~ … --- ## [Logstash: Got response code '405' contacting Elasticsearch](https://discuss.elastic.co/t/logstash-got-response-code-405-contacting-elasticsearch/228723)
**Author:** [@tom55](https://discuss.elastic.co/u/tom55)\ **Replies:** 9\ **Last updated:** [April 27, 2020, 7:19am UTC](https://discuss.elastic.co/t/logstash-got-response-code-405-contacting-elasticsearch/228723 "2020-04-27T07:19:02Z")
When trying to connect Logstash to ElasticSearch I'm getting this error and I don't understand why. The error mentions a "dead ES instance" but ElasticSearch is running and I'm able to access the API with curl from the s… --- ## [2 question about logstash config](https://discuss.elastic.co/t/2-question-about-logstash-config/229922)
**Author:** [@sowter](https://discuss.elastic.co/u/sowter)\ **Replies:** 1\ **Last updated:** [April 27, 2020, 8:40am UTC](https://discuss.elastic.co/t/2-question-about-logstash-config/229922 "2020-04-27T08:40:49Z")
How to write to the specified space in kibana in my space Put data (index) into 'read' space use bin / logstash -f import csv data How to close the program automatically after writing the data complete I m… --- ## [Lose Windows Events By Logstash](https://discuss.elastic.co/t/lose-windows-events-by-logstash/229911)
**Author:** [@alah64](https://discuss.elastic.co/u/alah64)\ **Replies:** 0\ **Last updated:** [April 27, 2020, 6:43am UTC](https://discuss.elastic.co/t/lose-windows-events-by-logstash/229911 "2020-04-27T06:43:35Z")
Hello I have Logstash 6.3.0 and helk pipeline configs to parse windows logs . i dont know why events drop and are not indexed into elasticsearch? here is discover for 10 days : --- ## [Logstash beat force\_peer authentication doesn't check hostname info](https://discuss.elastic.co/t/logstash-beat-force-peer-authentication-doesnt-check-hostname-info/229683)
**Author:** [@iorfix](https://discuss.elastic.co/u/iorfix)\ **Replies:** 2\ **Last updated:** [April 27, 2020, 6:10am UTC](https://discuss.elastic.co/t/logstash-beat-force-peer-authentication-doesnt-check-hostname-info/229683 "2020-04-27T06:10:09Z")
Hi there, I'm trying to force mutual authentication between Beats and Logstash. However, while beats correctly check logstash hostname before sending data, looking at subject or at dns list, the same doesn't happen on … --- ## [Error : installing plugin in logstash](https://discuss.elastic.co/t/error-installing-plugin-in-logstash/229884)
**Author:** [@Ekta](https://discuss.elastic.co/u/Ekta)\ **Replies:** 0\ **Last updated:** [April 27, 2020, 1:40am UTC](https://discuss.elastic.co/t/error-installing-plugin-in-logstash/229884 "2020-04-27T01:40:27Z")
I am trying to install plugin in logstash -7.6.0 It shows below error: I am download plugin from github : logstash-codec-gzip\_lines-master.zip root@DRTEST03:/usr/share/logstash/bin# ./logstash-plugin install file:///ro… --- ## [Page file size is too small to hold elements](https://discuss.elastic.co/t/page-file-size-is-too-small-to-hold-elements/229860)
**Author:** [@Louis\_Zhang](https://discuss.elastic.co/u/Louis_Zhang)\ **Replies:** 0\ **Last updated:** [April 26, 2020, 5:47pm UTC](https://discuss.elastic.co/t/page-file-size-is-too-small-to-hold-elements/229860 "2020-04-26T17:47:48Z")
logstash version 7.6.2, using persistence queue, not sure if this is a known bug? what shoud I do to work around? \[2020-04-26T17:44:41,554\]\[INFO \]\[logstash.runner \] Starting Logstash {"logstash.version"=\>"7.6.2… --- ## [Connect flask application to logstash](https://discuss.elastic.co/t/connect-flask-application-to-logstash/229844)
**Author:** [@souma](https://discuss.elastic.co/u/souma)\ **Replies:** 0\ **Last updated:** [April 26, 2020, 12:43pm UTC](https://discuss.elastic.co/t/connect-flask-application-to-logstash/229844 "2020-04-26T12:43:10Z")
Hi everyone! I'm developing a web application using Flask and i want to run logstash from my app. What i want precisely is each time i enter a file name and then pass the name to logstash config file and by clicking … --- ## [Jdbc input, its really necessary to order the results ascending?](https://discuss.elastic.co/t/jdbc-input-its-really-necessary-to-order-the-results-ascending/229820)
**Author:** [@ElasticLiver](https://discuss.elastic.co/u/ElasticLiver)\ **Replies:** 0\ **Last updated:** [April 26, 2020, 7:53am UTC](https://discuss.elastic.co/t/jdbc-input-its-really-necessary-to-order-the-results-ascending/229820 "2020-04-26T07:53:49Z")
hi, im getting data from a postgregs db, the tracking column that im using is unix epoch called clock this is part of my conf: input{ "...other parameters... … --- ## [Logstash output http from a curl command](https://discuss.elastic.co/t/logstash-output-http-from-a-curl-command/228389)
**Author:** [@stcdarrell](https://discuss.elastic.co/u/stcdarrell)\ **Replies:** 2\ **Last updated:** [April 26, 2020, 2:53am UTC](https://discuss.elastic.co/t/logstash-output-http-from-a-curl-command/228389 "2020-04-26T02:53:23Z")
hi, i need to go from logstash to a web restAPI, i'm having trouble converting a curl command into the output { http {}} format. any suggestions would be appreciated.. there arent many examples.. This is the curl comman… --- ## [Logstash configuration for multiple files](https://discuss.elastic.co/t/logstash-configuration-for-multiple-files/227670)
**Author:** [@Saber\_Ben\_Njima](https://discuss.elastic.co/u/Saber_Ben_Njima)\ **Replies:** 2\ **Last updated:** [April 25, 2020, 11:48pm UTC](https://discuss.elastic.co/t/logstash-configuration-for-multiple-files/227670 "2020-04-25T23:48:10Z")
Hello i have a problem when i want to configure logstash to filter data for multiple log files where each file has a different structure and separators how can i configure logstash ? --- ## [Strategy for Input join parent child relation with two statements?](https://discuss.elastic.co/t/strategy-for-input-join-parent-child-relation-with-two-statements/229796)
**Author:** [@Narciso\_Parra](https://discuss.elastic.co/u/Narciso_Parra)\ **Replies:** 1\ **Last updated:** [April 25, 2020, 11:38pm UTC](https://discuss.elastic.co/t/strategy-for-input-join-parent-child-relation-with-two-statements/229796 "2020-04-25T23:38:57Z")
Hi I need to Sync Postgres with Elasticsearch. I used jdbc\_input\_plugin and these is the main idea: I have a index with parent child relation join type I have one querys for index parents: (users) I have second query… --- ## [How to generate PATCH requests using the AppSearch output plugin?](https://discuss.elastic.co/t/how-to-generate-patch-requests-using-the-appsearch-output-plugin/229784)
**Author:** [@gpribi](https://discuss.elastic.co/u/gpribi)\ **Replies:** 0\ **Last updated:** [April 25, 2020, 7:28pm UTC](https://discuss.elastic.co/t/how-to-generate-patch-requests-using-the-appsearch-output-plugin/229784 "2020-04-25T19:28:22Z")
Hello, I'm using AppSearch and need to frequently update a single dynamic field in every document. All the other fields are created once and don't change. I'm using the odbc input connected to a mysql database, and apps… --- ## [Cidr filter will not accept ipv6 loopback addresses](https://discuss.elastic.co/t/cidr-filter-will-not-accept-ipv6-loopback-addresses/229774)
**Author:** [@jgregmac](https://discuss.elastic.co/u/jgregmac)\ **Replies:** 0\ **Last updated:** [April 25, 2020, 4:31pm UTC](https://discuss.elastic.co/t/cidr-filter-will-not-accept-ipv6-loopback-addresses/229774 "2020-04-25T16:31:36Z")
I have been observing a problem using the cidr filter. Occasionally, we have applications that will connect their own loopback interfaces. These events are logged as originating from ipv4 loopback 127.0.0.1 or IPv6 l… --- ## [Location array object not indexed with logstash](https://discuss.elastic.co/t/location-array-object-not-indexed-with-logstash/228717)
**Author:** [@Jalil](https://discuss.elastic.co/u/Jalil)\ **Replies:** 1\ **Last updated:** [April 25, 2020, 12:24pm UTC](https://discuss.elastic.co/t/location-array-object-not-indexed-with-logstash/228717 "2020-04-25T12:24:53Z")
Bonjour, j'ai une collection mongodb contenant des documents dont un des objets est un array de coordonnées. voici un extract de mon mapping template : { "\_doc": { "\_meta": {}, "\_source": {}, "properties… --- ## [Unable to add logstash-input-google\_cloud\_storage plugin](https://discuss.elastic.co/t/unable-to-add-logstash-input-google-cloud-storage-plugin/229542)
**Author:** [@saroja](https://discuss.elastic.co/u/saroja)\ **Replies:** 4\ **Last updated:** [April 25, 2020, 11:52am UTC](https://discuss.elastic.co/t/unable-to-add-logstash-input-google-cloud-storage-plugin/229542 "2020-04-25T11:52:11Z")
I want to use logstash-input-google\_cloud\_storage plugin in one of our requirrement. I am using logstash-7.6 in windows 10 machine. I followed the steps below to install the gem file, but no luck. Getting error during … --- ## [No results when SQL Statement contains "Create ClusteredIndex"](https://discuss.elastic.co/t/no-results-when-sql-statement-contains-create-clusteredindex/229732)
**Author:** [@sidsniper](https://discuss.elastic.co/u/sidsniper)\ **Replies:** 0\ **Last updated:** [April 24, 2020, 11:10pm UTC](https://discuss.elastic.co/t/no-results-when-sql-statement-contains-create-clusteredindex/229732 "2020-04-24T23:10:11Z")
Hi Team, I am facing an issue where if I am adding a cluster or nonclustered index to temp tables in the sql statement, the jdbc input plugin is not giving any results. Any idea how I can create these indexes in temp t… --- ## [Error in visualization \[esaggs\] \> “field” is a required parameter](https://discuss.elastic.co/t/error-in-visualization-esaggs-field-is-a-required-parameter/229722)
**Author:** [@tbhaxor](https://discuss.elastic.co/u/tbhaxor)\ **Replies:** 0\ **Last updated:** [April 24, 2020, 8:51pm UTC](https://discuss.elastic.co/t/error-in-visualization-esaggs-field-is-a-required-parameter/229722 "2020-04-24T20:51:25Z")
I tried the solution as described in https://discuss.elastic.co/t/logstash-output-wrong-error-in-visualization-esaggs-field-is-a-required-parameter/215412/4?u=tbhaxor But this is not working --- ## [Multiple pipelines running on same machine](https://discuss.elastic.co/t/multiple-pipelines-running-on-same-machine/225217)
**Author:** [@adityaPsl](https://discuss.elastic.co/u/adityaPsl)\ **Replies:** 16\ **Last updated:** [April 24, 2020, 5:41pm UTC](https://discuss.elastic.co/t/multiple-pipelines-running-on-same-machine/225217 "2020-04-24T17:41:26Z")
Hello Team, I am facing issues with logstash pipelines filter section i am using multiple filters like grok, elasticsearch translate, ruby etc in combination, The issue is the data of some other record processed at the… --- ## [Changes to config file not updating the data in kibana](https://discuss.elastic.co/t/changes-to-config-file-not-updating-the-data-in-kibana/229572)
**Author:** [@Nani\_20](https://discuss.elastic.co/u/Nani_20)\ **Replies:** 3\ **Last updated:** [April 24, 2020, 5:34pm UTC](https://discuss.elastic.co/t/changes-to-config-file-not-updating-the-data-in-kibana/229572 "2020-04-24T17:34:28Z")
Hello All, I am using the latest version of logstash(7.6.2). I tried uploading a sample data and was able to successfully upload it into the elasticsearch using logstash(enabled auto-reload) and was able to see the inde… --- ## [Proper RegEx with Mutate\>GSub](https://discuss.elastic.co/t/proper-regex-with-mutate-gsub/229679)
**Author:** [@wwalker](https://discuss.elastic.co/u/wwalker)\ **Replies:** 1\ **Last updated:** [April 24, 2020, 5:25pm UTC](https://discuss.elastic.co/t/proper-regex-with-mutate-gsub/229679 "2020-04-24T17:25:30Z")
Pulling what's left of my hair out trying to get this field to properly display. I have log data coming in from a firewall in key=value format. I'm using kv to parse all the fields out and I'm left with a field called \[… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=366) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=368)