# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=370 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 371 --- ## [How to get integer field with comma-seperator to add\_field](https://discuss.elastic.co/t/how-to-get-integer-field-with-comma-seperator-to-add-field/228818)
**Author:** [@Phornkrit\_Hirunyanit](https://discuss.elastic.co/u/Phornkrit_Hirunyanit)\ **Replies:** 4\ **Last updated:** [April 21, 2020, 4:13pm UTC](https://discuss.elastic.co/t/how-to-get-integer-field-with-comma-seperator-to-add-field/228818 "2020-04-21T16:13:07Z")
Hello Developer, I have some issue for ask you all I tried to get field %{NUMBER:linenr:int} This is the results At add\_field mutate{ add\_field =\> { "linenrMeassage" =\> "%{fact\_or\_dim}: %{linenr} rows lo… --- ## [LoadError: no such file to load -- bundler](https://discuss.elastic.co/t/loaderror-no-such-file-to-load-bundler/229081)
**Author:** [@csaket](https://discuss.elastic.co/u/csaket)\ **Replies:** 1\ **Last updated:** [April 21, 2020, 4:07pm UTC](https://discuss.elastic.co/t/loaderror-no-such-file-to-load-bundler/229081 "2020-04-21T16:07:28Z")
I am running Fedora 31 and have just installed logstash 7.6.2 When I try to install a plugin I get this error LoadError: no such file to load -- bundler sudo DEBUG=1 /usr/share/logstash/bin/logstash-plugin install --lo… --- ## [Fields vs. tags for app/service/environment identification](https://discuss.elastic.co/t/fields-vs-tags-for-app-service-environment-identification/228966)
**Author:** [@intelfx](https://discuss.elastic.co/u/intelfx)\ **Replies:** 1\ **Last updated:** [April 21, 2020, 3:53pm UTC](https://discuss.elastic.co/t/fields-vs-tags-for-app-service-environment-identification/228966 "2020-04-21T15:53:25Z")
Greetings. In our configuration, we are planning to use a single unified ELK stack deployment for all our development needs (i. e. multiple products, each consisting of multiple services, each deployed in multiple envir… --- ## [Logstash path type Vs string type](https://discuss.elastic.co/t/logstash-path-type-vs-string-type/228924)
**Author:** [@nages](https://discuss.elastic.co/u/nages)\ **Replies:** 3\ **Last updated:** [April 21, 2020, 3:50pm UTC](https://discuss.elastic.co/t/logstash-path-type-vs-string-type/228924 "2020-04-21T15:50:17Z")
Where is the real difference between "path" and string" and "hash" . In terms of appearance, both look similar to the end user . How they are treated anything differently behind the scenes ? https://www.elastic.co/guide… --- ## [Logstash Consuming too Much JVM](https://discuss.elastic.co/t/logstash-consuming-too-much-jvm/223860)
**Author:** [@shrikantgulia](https://discuss.elastic.co/u/shrikantgulia)\ **Replies:** 9\ **Last updated:** [April 21, 2020, 3:38pm UTC](https://discuss.elastic.co/t/logstash-consuming-too-much-jvm/223860 "2020-04-21T15:38:32Z")
Hello, My Logstash is Consuming too much JVM due to it Logstash is getting shut down and not receiving any data. I have 4 Pipelines running in my Logstash and Can Some one suggest me What all steps to followed for tun… --- ## [Not able to get my Logstash 7.6.0 running](https://discuss.elastic.co/t/not-able-to-get-my-logstash-7-6-0-running/228963)
**Author:** [@vigneshr35](https://discuss.elastic.co/u/vigneshr35)\ **Replies:** 1\ **Last updated:** [April 21, 2020, 3:37pm UTC](https://discuss.elastic.co/t/not-able-to-get-my-logstash-7-6-0-running/228963 "2020-04-21T15:37:15Z")
I am having a hard time setting up my ELK. I was able to start my Elasticsearch instance. I was able to start my Kibana instance. But I am not able to have by Logstash running. Here are the details. elasticsearch.yml c… --- ## [Two Pipelines ACT at same time](https://discuss.elastic.co/t/two-pipelines-act-at-same-time/229003)
**Author:** [@brunojpsantos](https://discuss.elastic.co/u/brunojpsantos)\ **Replies:** 2\ **Last updated:** [April 21, 2020, 3:36pm UTC](https://discuss.elastic.co/t/two-pipelines-act-at-same-time/229003 "2020-04-21T15:36:08Z")
Hi! I'm using logstash to import three csv files, I have one pipeline to each file with correct path with the name of each csv file... The problem is: when a file is uploaded, the three pipelines run, and I only want … --- ## [High Availity Logstash Pipeline](https://discuss.elastic.co/t/high-availity-logstash-pipeline/228925)
**Author:** [@ksremo](https://discuss.elastic.co/u/ksremo)\ **Replies:** 3\ **Last updated:** [April 21, 2020, 3:32pm UTC](https://discuss.elastic.co/t/high-availity-logstash-pipeline/228925 "2020-04-21T15:32:36Z")
I have 2 Logstash Instances. Both are active. In case of beat-based Logshipper there is a built-in way to load balance the traffic to both Logstash. In case one Logstash is offline because of maintenance or failure traff… --- ## [How can I parse array of objects using Logstash?](https://discuss.elastic.co/t/how-can-i-parse-array-of-objects-using-logstash/228640)
**Author:** [@cezar996](https://discuss.elastic.co/u/cezar996)\ **Replies:** 6\ **Last updated:** [April 21, 2020, 3:31pm UTC](https://discuss.elastic.co/t/how-can-i-parse-array-of-objects-using-logstash/228640 "2020-04-21T15:31:53Z")
Hello everybody! Does anybody knows how can I parse an array of objects of this type: \[{name:Cezar, age:23}, {name:Leon, age:22}, {name:Steven, age:33}\]. Every object should be an event in Discovery Section. Please take… --- ## [JDBC input plugin : back pressure?](https://discuss.elastic.co/t/jdbc-input-plugin-back-pressure/229065)
**Author:** [@deslauriersp](https://discuss.elastic.co/u/deslauriersp)\ **Replies:** 0\ **Last updated:** [April 21, 2020, 2:03pm UTC](https://discuss.elastic.co/t/jdbc-input-plugin-back-pressure/229065 "2020-04-21T14:03:05Z")
I have a pipiline, with a jdbc input, http filter (adds data from a rest service), and an http output. The JDBC input, seem to run on a schedule. What will happen if all the events created by the previous query have no… --- ## [Comparing Two similar fields in two grok patterns](https://discuss.elastic.co/t/comparing-two-similar-fields-in-two-grok-patterns/229062)
**Author:** [@tushant\_gaur](https://discuss.elastic.co/u/tushant_gaur)\ **Replies:** 0\ **Last updated:** [April 21, 2020, 1:52pm UTC](https://discuss.elastic.co/t/comparing-two-similar-fields-in-two-grok-patterns/229062 "2020-04-21T13:52:22Z")
HI , I have two grok patterns that has one common field , and there is timestamp field associated with these grok patterns . Am able to make a mapping of common field wih their respective timestamps. But not able to d… --- ## [Need to monitor pending messages in JMS queue for tibco](https://discuss.elastic.co/t/need-to-monitor-pending-messages-in-jms-queue-for-tibco/228885)
**Author:** [@BPant](https://discuss.elastic.co/u/BPant)\ **Replies:** 1\ **Last updated:** [April 21, 2020, 9:26am UTC](https://discuss.elastic.co/t/need-to-monitor-pending-messages-in-jms-queue-for-tibco/228885 "2020-04-21T09:26:00Z")
Hi, I want to monitor pending messages in a jms queue for tibco. I tried to use jms logstash plugin, however it doesn't give me the parameter "pending queue messages". This is my logstash configuration: jmsconfig.con… --- ## [Websocket Input PlugIn TIBCO Mashery Connection::ConnectRefused](https://discuss.elastic.co/t/websocket-input-plugin-tibco-mashery-connection-connectrefused/229043)
**Author:** [@Loris](https://discuss.elastic.co/u/Loris)\ **Replies:** 0\ **Last updated:** [April 21, 2020, 1:00pm UTC](https://discuss.elastic.co/t/websocket-input-plugin-tibco-mashery-connection-connectrefused/229043 "2020-04-21T13:00:34Z")
Hi all, I wanted to create a Logstash pipeline that uses the websocket input plugin to connects to a TIBCO Mashery websocket. I tried with the following, very simple, pipeline configuration: input { websocket { … --- ## [Logstash Keystore doesn't work](https://discuss.elastic.co/t/logstash-keystore-doesnt-work/229034)
**Author:** [@Sonia1](https://discuss.elastic.co/u/Sonia1)\ **Replies:** 0\ **Last updated:** [April 21, 2020, 12:30pm UTC](https://discuss.elastic.co/t/logstash-keystore-doesnt-work/229034 "2020-04-21T12:30:03Z")
Hi everyone! I'm new with ELK and I'm trying to use Logstash-keystore to secure my passwords. I follow the steps of the doc but it's doesn't work. set +o history export LOGSTASH\_KEYSTORE\_PASS=mypassword set -o history… --- ## [\[Logstash - Ruby Filter\] - Execution of the filter occurs only once for cloned or splitted events](https://discuss.elastic.co/t/logstash-ruby-filter-execution-of-the-filter-occurs-only-once-for-cloned-or-splitted-events/227323)
**Author:** [@druiz61](https://discuss.elastic.co/u/druiz61)\ **Replies:** 3\ **Last updated:** [April 21, 2020, 11:36am UTC](https://discuss.elastic.co/t/logstash-ruby-filter-execution-of-the-filter-occurs-only-once-for-cloned-or-splitted-events/227323 "2020-04-21T11:36:51Z")
Hi All, I have a real strange behavior with ruby filters. I am using Elastic Stack 7.6.0 on Docker containers. This I have see occurs when an event get splitted ( with the split filter ) or when the event gets cloned … --- ## [Logstash is Parsing Nginx log only half of it](https://discuss.elastic.co/t/logstash-is-parsing-nginx-log-only-half-of-it/228733)
**Author:** [@hispeed](https://discuss.elastic.co/u/hispeed)\ **Replies:** 15\ **Last updated:** [April 20, 2020, 7:06pm UTC](https://discuss.elastic.co/t/logstash-is-parsing-nginx-log-only-half-of-it/228733 "2020-04-20T19:06:51Z")
I have the following log comming from NGINX as reverse proxy set up. Message: 192.168.1.24 - - \[19/Apr/2020:15:39:03 +0200\] "GET /website/static/src/scss/options/colors/website.assets\_wysiwyg/user\_theme\_color\_palette.… --- ## [Logstash does not map enum values in protobuf codec](https://discuss.elastic.co/t/logstash-does-not-map-enum-values-in-protobuf-codec/228859)
**Author:** [@dhanashri-pitre](https://discuss.elastic.co/u/dhanashri-pitre)\ **Replies:** 1\ **Last updated:** [April 21, 2020, 8:29am UTC](https://discuss.elastic.co/t/logstash-does-not-map-enum-values-in-protobuf-codec/228859 "2020-04-21T08:29:09Z")
My incoming message has nested protobuf structure, and I am using the protobuf-codec in Kafka-input. Following is my configuration // conf file input { kafka { boots… --- ## [My logstash cannot update the date in ES](https://discuss.elastic.co/t/my-logstash-cannot-update-the-date-in-es/228993)
**Author:** [@Echo\_yu](https://discuss.elastic.co/u/Echo_yu)\ **Replies:** 0\ **Last updated:** [April 21, 2020, 8:29am UTC](https://discuss.elastic.co/t/my-logstash-cannot-update-the-date-in-es/228993 "2020-04-21T08:29:04Z")
Hi, I changed the column value of some data in the database, but I found that my logstash did not update the change to Elasticsearch. And I cannot found the sincedb file either.How can I fix this problem？Looking forward … --- ## [Need help with date filter](https://discuss.elastic.co/t/need-help-with-date-filter/228968)
**Author:** [@back2base](https://discuss.elastic.co/u/back2base)\ **Replies:** 2\ **Last updated:** [April 21, 2020, 6:50am UTC](https://discuss.elastic.co/t/need-help-with-date-filter/228968 "2020-04-21T06:50:27Z")
Hello to everyone! I am new to ELK stack so I need help with date filter for rsyslog messages from Aix. I am sending logs from Aix to ELK and here is what I see in logstash stdout: apr 21 08:45:01 myhost logstash\[1942… --- ## [Troubleshoot intermediate output](https://discuss.elastic.co/t/troubleshoot-intermediate-output/228970)
**Author:** [@nages](https://discuss.elastic.co/u/nages)\ **Replies:** 0\ **Last updated:** [April 21, 2020, 6:06am UTC](https://discuss.elastic.co/t/troubleshoot-intermediate-output/228970 "2020-04-21T06:06:19Z")
Is there anyway to view the output of intermediate events. Say if i have filter block in the followng way , filter { grok { match =\> { "message" =\> "%{COMBINEDAPACHELOG}" } } mutate { convert =\> { … --- ## [Grok filter add\_field](https://discuss.elastic.co/t/grok-filter-add-field/226902)
**Author:** [@Jeffreyshoptrader](https://discuss.elastic.co/u/Jeffreyshoptrader)\ **Replies:** 5\ **Last updated:** [April 21, 2020, 6:01am UTC](https://discuss.elastic.co/t/grok-filter-add-field/226902 "2020-04-21T06:01:52Z")
Hi, I've tried using a add\_field in the grok filter. I want to extract the domain name from the log files I have. I've added those in my Apache logs and see them, but I'm not sure how to extract them. What I have so … --- ## [Database connection stable](https://discuss.elastic.co/t/database-connection-stable/228959)
**Author:** [@jagan](https://discuss.elastic.co/u/jagan)\ **Replies:** 0\ **Last updated:** [April 21, 2020, 5:11am UTC](https://discuss.elastic.co/t/database-connection-stable/228959 "2020-04-21T05:11:02Z")
Hi mates, Could you guide me, i have a scenario where all the main attributes are comming from kafka & some other attributes are comming from oracle db' directly and they both sync and ingest the attributes together int… --- ## [Can we invoke python script in a filter using log stash file](https://discuss.elastic.co/t/can-we-invoke-python-script-in-a-filter-using-log-stash-file/227010)
**Author:** [@deepikagarre](https://discuss.elastic.co/u/deepikagarre)\ **Replies:** 2\ **Last updated:** [April 21, 2020, 3:27am UTC](https://discuss.elastic.co/t/can-we-invoke-python-script-in-a-filter-using-log-stash-file/227010 "2020-04-21T03:27:07Z")
Can we invoke python script in a filter using log stash file. --- ## [Keep getting dateparsefailures in Nexus logs](https://discuss.elastic.co/t/keep-getting-dateparsefailures-in-nexus-logs/228218)
**Author:** [@niudaye123](https://discuss.elastic.co/u/niudaye123)\ **Replies:** 4\ **Last updated:** [April 20, 2020, 10:12pm UTC](https://discuss.elastic.co/t/keep-getting-dateparsefailures-in-nexus-logs/228218 "2020-04-20T22:12:14Z")
Hi, I keep getting the dateparsefailure from a Nexus device, could not figure out what's wrong, can someone take a quick look? Thanks a lot! { "\_index": "network-2020.04.14", "\_type": "\_doc", "\_id": "OaQHd3EB-3-fVVn… --- ## [Pipeline in logstash](https://discuss.elastic.co/t/pipeline-in-logstash/228920)
**Author:** [@elasticforme](https://discuss.elastic.co/u/elasticforme)\ **Replies:** 2\ **Last updated:** [April 20, 2020, 9:49pm UTC](https://discuss.elastic.co/t/pipeline-in-logstash/228920 "2020-04-20T21:49:06Z")
I have multiple pipeline (23) running on a system half of the job runs only once a day and half runs every hour. does each pipeline reserves memory and lock on cpu? system has 24 logical cpu. plenty of memory (98gig)… --- ## [Logstash could not index event to Elasticsearch](https://discuss.elastic.co/t/logstash-could-not-index-event-to-elasticsearch/228930)
**Author:** [@S3l3ct3d](https://discuss.elastic.co/u/S3l3ct3d)\ **Replies:** 2\ **Last updated:** [April 20, 2020, 9:05pm UTC](https://discuss.elastic.co/t/logstash-could-not-index-event-to-elasticsearch/228930 "2020-04-20T21:05:03Z")
Good afternoon all, I want to preface this post that I am completely new to Elastic and all its components. I am currently working on getting Logstash to produce an API call to our web proxy server. I have searched the … --- ## [GROK filter is not parsing the windows firewall logs for ICMP traffic](https://discuss.elastic.co/t/grok-filter-is-not-parsing-the-windows-firewall-logs-for-icmp-traffic/228011)
**Author:** [@Prabhu\_Chinnasamy](https://discuss.elastic.co/u/Prabhu_Chinnasamy)\ **Replies:** 6\ **Last updated:** [April 20, 2020, 7:05pm UTC](https://discuss.elastic.co/t/grok-filter-is-not-parsing-the-windows-firewall-logs-for-icmp-traffic/228011 "2020-04-20T19:05:32Z")
All, I am sending the windows firewall logs to logstash and created a GROK filter to parse the log. my GROK filter is: "%{TIMESTAMP\_ISO8601:TimeStamp} %{WORD:Action} %{WORD:Protocol} %{IP:Source\_IP} %{IP:Destination\_I… --- ## [Grok unable to parse message field](https://discuss.elastic.co/t/grok-unable-to-parse-message-field/228822)
**Author:** [@rschirin](https://discuss.elastic.co/u/rschirin)\ **Replies:** 4\ **Last updated:** [April 20, 2020, 3:53pm UTC](https://discuss.elastic.co/t/grok-unable-to-parse-message-field/228822 "2020-04-20T15:53:01Z")
Hi guys, using an Ansible's plugin I'm trying to send data to Logstash. Eveything seems ok but grok is not able to parse message field; I mean, I'm not able to configure it to work correctly :frowning: this is the con… --- ## [java.io.IOException: Connection reset by peer](https://discuss.elastic.co/t/java-io-ioexception-connection-reset-by-peer/228897)
**Author:** [@Konathala\_Naveen](https://discuss.elastic.co/u/Konathala_Naveen)\ **Replies:** 0\ **Last updated:** [April 20, 2020, 3:41pm UTC](https://discuss.elastic.co/t/java-io-ioexception-connection-reset-by-peer/228897 "2020-04-20T15:41:23Z")
We have the Environment Logstash with input plugin as "TCP-input plugin" And output to file. And we are sending syslogs using rsyslog to logstash tcp input plugin . But intermittently(after 5 to 6 hours) we are getting … --- ## [Interpreting sincedb file](https://discuss.elastic.co/t/interpreting-sincedb-file/228802)
**Author:** [@nages](https://discuss.elastic.co/u/nages)\ **Replies:** 1\ **Last updated:** [April 20, 2020, 3:38pm UTC](https://discuss.elastic.co/t/interpreting-sincedb-file/228802 "2020-04-20T15:38:39Z")
I am seeing the following content in sincedb file 2934664528-52087-851968 0 0 11742951 1586411789.669 C:/demo/logs From the documentation i can see that this is represent with 5 parameters https://www.elastic.co/guide… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=369) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=371)