# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=372 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 373 --- ## [Returning Multiple Events from Ruby Plugin](https://discuss.elastic.co/t/returning-multiple-events-from-ruby-plugin/227577)
**Author:** [@mdt](https://discuss.elastic.co/u/mdt)\ **Replies:** 1\ **Last updated:** [April 18, 2020, 9:48am UTC](https://discuss.elastic.co/t/returning-multiple-events-from-ruby-plugin/227577 "2020-04-18T09:48:28Z")
I need to parse some incoming messages where for network reasons, one event as seen by Logstash is really a concatenation of multiple events. To do that I'm trying to use the ruby plugin, breaking the initial message int… --- ## [Convert $0.50 to float converts it to 0.00](https://discuss.elastic.co/t/convert-0-50-to-float-converts-it-to-0-00/228561)
**Author:** [@Yaniv\_Nuriel](https://discuss.elastic.co/u/Yaniv_Nuriel)\ **Replies:** 4\ **Last updated:** [April 18, 2020, 7:15am UTC](https://discuss.elastic.co/t/convert-0-50-to-float-converts-it-to-0-00/228561 "2020-04-18T07:15:22Z")
Hey all, Here are my load file: Spend,Bbb $0.55,100 $0.80,200 The conf.file is: input { file { path =\> "/Users/yanivnuriel/logstash/data/ads/searchterms/us/one-line-15.txt" start\_posit… --- ## [Help in Parsing JSON Log File](https://discuss.elastic.co/t/help-in-parsing-json-log-file/228600)
**Author:** [@Osama\_Samaan](https://discuss.elastic.co/u/Osama_Samaan)\ **Replies:** 1\ **Last updated:** [April 18, 2020, 2:33am UTC](https://discuss.elastic.co/t/help-in-parsing-json-log-file/228600 "2020-04-18T02:33:46Z")
Hi, Please need your help to parse log file contains entries with JSON formated entries , each has the same format as below example : { "Buffer": { "timestamp": "2017-11-03 13:32:55.840817", "pcapfile": "file.pcap", … --- ## [Ruby exception occurred: undefined method \`\[\]' for #\ **Author:** [@Jaikumar\_Ganesan](https://discuss.elastic.co/u/Jaikumar_Ganesan)\ **Replies:** 6\ **Last updated:** [April 18, 2020, 2:25am UTC](https://discuss.elastic.co/t/ruby-exception-occurred-undefined-method-for-logstash-0x1f8ee438/228521 "2020-04-18T02:25:10Z") I'm using logstash 7.5.1. I would like to parse through all fields of my logstash and convert field starting with the word "time" to float. Please find below my configuration: filter { # Parse Search Logs grok { … --- ## [Unable to install logstash plugin](https://discuss.elastic.co/t/unable-to-install-logstash-plugin/228565)
**Author:** [@dranga](https://discuss.elastic.co/u/dranga)\ **Replies:** 0\ **Last updated:** [April 17, 2020, 7:33pm UTC](https://discuss.elastic.co/t/unable-to-install-logstash-plugin/228565 "2020-04-17T19:33:20Z")
Hi, I am new to JRuby and Logstash. I am trying to setup Logstash locally and install some custom plugins. I added my custom plugins to the Gemfile and tried running bin/logstash-plugin the following way: ~/logstash-6… --- ## [Nested indexing possible?](https://discuss.elastic.co/t/nested-indexing-possible/228584)
**Author:** [@EliWallic](https://discuss.elastic.co/u/EliWallic)\ **Replies:** 1\ **Last updated:** [April 17, 2020, 10:07pm UTC](https://discuss.elastic.co/t/nested-indexing-possible/228584 "2020-04-17T22:07:02Z")
Hi all, I have some plaintext logfiles which i want to have in a single event. For example: Start time: 20200417225004 property1: value1 property2: value2 property3: value3 property4: value4 Command start time: 20… --- ## [Script params via Logstash, is it possible?](https://discuss.elastic.co/t/script-params-via-logstash-is-it-possible/226586)
**Author:** [@crickes](https://discuss.elastic.co/u/crickes)\ **Replies:** 7\ **Last updated:** [April 17, 2020, 7:48pm UTC](https://discuss.elastic.co/t/script-params-via-logstash-is-it-possible/226586 "2020-04-17T19:48:52Z")
Is it possible to send 'params' to a stored script in Elasticsearch from Logstash, or do I have to use a script defined inline or as a file in Logstash in order to define a 'params' block for the script? --- ## [How can i create logstash index every 4 hours except 1 hour](https://discuss.elastic.co/t/how-can-i-create-logstash-index-every-4-hours-except-1-hour/227928)
**Author:** [@Dragon9](https://discuss.elastic.co/u/Dragon9)\ **Replies:** 13\ **Last updated:** [April 17, 2020, 4:25pm UTC](https://discuss.elastic.co/t/how-can-i-create-logstash-index-every-4-hours-except-1-hour/227928 "2020-04-17T16:25:47Z")
like output{ elasticsearch { index =\> "logstash-%{+YYYY.MM.dd.hh}" } } for example:- logstash-2020.04.14.07 logstash-2020.04.14.11 --- ## [Translate Filters :: Can the Dictionary File Include a Range?](https://discuss.elastic.co/t/translate-filters-can-the-dictionary-file-include-a-range/228545)
**Author:** [@redapplesonly](https://discuss.elastic.co/u/redapplesonly)\ **Replies:** 0\ **Last updated:** [April 17, 2020, 4:12pm UTC](https://discuss.elastic.co/t/translate-filters-can-the-dictionary-file-include-a-range/228545 "2020-04-17T16:12:41Z")
Hi Logstash Maestros, In my Logstash config file, I have a simple translate filter: filter { translate { field =\> "\[MyData\]\[FieldA\]" destination =\> "\[MyData\]\[FieldB\]" dictionary\_path =\> "/usr/share/logst… --- ## [Missing fields in Kibana](https://discuss.elastic.co/t/missing-fields-in-kibana/227974)
**Author:** [@inchirah](https://discuss.elastic.co/u/inchirah)\ **Replies:** 6\ **Last updated:** [April 17, 2020, 3:34pm UTC](https://discuss.elastic.co/t/missing-fields-in-kibana/227974 "2020-04-17T15:34:27Z")
Hello, After I imported my CSV data in ES and when I search for my fields in devtools I couldn't find them all. This is my conf file : input{ file{ path =\> "C:/Users/Asus/Dropbox/PFE\_part2/MOOV\_ALEPE\_Data.csv" … --- ## [Kafka Input Performance Problems](https://discuss.elastic.co/t/kafka-input-performance-problems/228541)
**Author:** [@chris.murray](https://discuss.elastic.co/u/chris.murray)\ **Replies:** 0\ **Last updated:** [April 17, 2020, 3:14pm UTC](https://discuss.elastic.co/t/kafka-input-performance-problems/228541 "2020-04-17T15:14:59Z")
I've been working to convert an ELK setup over to using Logstash as a parsing engine, from something home-grown (don't ask). I'm running into a problem with the performance of the Kafka input. Versions: Everything 7.6… --- ## [Logstash Date Filter Not Working with tab](https://discuss.elastic.co/t/logstash-date-filter-not-working-with-tab/228300)
**Author:** [@Atul\_Gunjal](https://discuss.elastic.co/u/Atul_Gunjal)\ **Replies:** 3\ **Last updated:** [April 17, 2020, 2:52pm UTC](https://discuss.elastic.co/t/logstash-date-filter-not-working-with-tab/228300 "2020-04-17T14:52:54Z")
I need to parse event and time separated by tab using the date filter in logstash, but logstash failed to identify tab and gives an error grok{ patterns\_dir =\> \["./patterns"\] match =\> { "message" =\> "%{TIME… --- ## [Logstash cidr filter throws error if dictionary file is empty](https://discuss.elastic.co/t/logstash-cidr-filter-throws-error-if-dictionary-file-is-empty/228496)
**Author:** [@blueren](https://discuss.elastic.co/u/blueren)\ **Replies:** 1\ **Last updated:** [April 17, 2020, 2:49pm UTC](https://discuss.elastic.co/t/logstash-cidr-filter-throws-error-if-dictionary-file-is-empty/228496 "2020-04-17T14:49:22Z")
This is on the back of an older unresolved issue: Logstash translate filter throws error if dictionary file is empty I am running into the same problem as mentioned in the above stale issue. I have a translate filter l… --- ## [Logstash http filter plugin](https://discuss.elastic.co/t/logstash-http-filter-plugin/228516)
**Author:** [@akhilsharma.in](https://discuss.elastic.co/u/akhilsharma.in)\ **Replies:** 2\ **Last updated:** [April 17, 2020, 2:46pm UTC](https://discuss.elastic.co/t/logstash-http-filter-plugin/228516 "2020-04-17T14:46:43Z")
Team, we're using http in filter to make a REST API call. Body of the call accepts a parameter which should be an array like \[1111,11\] but while passing this parameter, logstash is converting array to string which is "\[… --- ## [Ingest stabilization on db](https://discuss.elastic.co/t/ingest-stabilization-on-db/228515)
**Author:** [@jagan](https://discuss.elastic.co/u/jagan)\ **Replies:** 0\ **Last updated:** [April 17, 2020, 12:52pm UTC](https://discuss.elastic.co/t/ingest-stabilization-on-db/228515 "2020-04-17T12:52:37Z")
Hi guru's, please help me how do i handle the situation.The events are comming from Kafka topics and the source is oracle and sink is logstash. i) I want to get the events to the ES index when connection is not stabl… --- ## [How to split message fields when we have dynamic logs](https://discuss.elastic.co/t/how-to-split-message-fields-when-we-have-dynamic-logs/228497)
**Author:** [@hemant\_472](https://discuss.elastic.co/u/hemant_472)\ **Replies:** 0\ **Last updated:** [April 17, 2020, 11:09am UTC](https://discuss.elastic.co/t/how-to-split-message-fields-when-we-have-dynamic-logs/228497 "2020-04-17T11:09:36Z")
I am able to split fields using GROK in my logstash config file but have no idea how to split every log because the logs are dynamic for eg: log 1 : Dec 28 05:05:47 ff402-srv1 MC: DEBUG {2416824} \[PlanJob\] EXPLICIT: D… --- ## [Stuck at Successfully started Logstash API endpoint {:port=\>9601}](https://discuss.elastic.co/t/stuck-at-successfully-started-logstash-api-endpoint-port-9601/228475)
**Author:** [@Vrinda\_R](https://discuss.elastic.co/u/Vrinda_R)\ **Replies:** 0\ **Last updated:** [April 17, 2020, 8:34am UTC](https://discuss.elastic.co/t/stuck-at-successfully-started-logstash-api-endpoint-port-9601/228475 "2020-04-17T08:34:05Z")
Hi!! I'm new to logstash and i'm stuck at this point . Earlier in the first run i got an error like Broker invalid and after that it's stuck at Successfully started Logstash API endpoint {:port=\>9601} My conf file: \` … --- ## [Is PQ needed for logstash kinesis input plugin?](https://discuss.elastic.co/t/is-pq-needed-for-logstash-kinesis-input-plugin/225970)
**Author:** [@deepak\_deore](https://discuss.elastic.co/u/deepak_deore)\ **Replies:** 2\ **Last updated:** [April 17, 2020, 5:09am UTC](https://discuss.elastic.co/t/is-pq-needed-for-logstash-kinesis-input-plugin/225970 "2020-04-17T05:09:20Z")
logstash pulls the logs from aws kinesis, so it will read as per its own speed and there wont be sudden spike because data isnt pushed to logstash instead logstash pulls it. in this case is PQ (persistent queue) really … --- ## [Upload Logstash and Elastic Cloud data](https://discuss.elastic.co/t/upload-logstash-and-elastic-cloud-data/228448)
**Author:** [@111317](https://discuss.elastic.co/u/111317)\ **Replies:** 1\ **Last updated:** [April 17, 2020, 4:59am UTC](https://discuss.elastic.co/t/upload-logstash-and-elastic-cloud-data/228448 "2020-04-17T04:59:41Z")
Logstash has been successful. Java HotSpot(TM) 64-Bit Server VM warning: Ignoring option UseConcMarkSweepGC; support was removed in 14.0 Java HotSpot(TM) 64-Bit Server VM warning: Ignoring option CMSInitiatingOccupancyF… --- ## [How to send data to Elastic Cloud with On-Premise Logstash](https://discuss.elastic.co/t/how-to-send-data-to-elastic-cloud-with-on-premise-logstash/228423)
**Author:** [@111317](https://discuss.elastic.co/u/111317)\ **Replies:** 14\ **Last updated:** [April 17, 2020, 3:49am UTC](https://discuss.elastic.co/t/how-to-send-data-to-elastic-cloud-with-on-premise-logstash/228423 "2020-04-17T03:49:45Z")
I am using Elastic Cloud. I want to move data from Linux on VMware to Elastic Cloud. What settings do you need? --- ## [Logstash to send logs to multiple locations](https://discuss.elastic.co/t/logstash-to-send-logs-to-multiple-locations/225784)
**Author:** [@rossw](https://discuss.elastic.co/u/rossw)\ **Replies:** 4\ **Last updated:** [April 17, 2020, 2:37am UTC](https://discuss.elastic.co/t/logstash-to-send-logs-to-multiple-locations/225784 "2020-04-17T02:37:19Z")
I have seen several people ask this question, but there has been no complete solution delivered. Several people have said "just do this" or "just do that" without telling us what "this" or "that" are. So the requiremen… --- ## [Sql\_last\_value reset to 0 at 12 hour](https://discuss.elastic.co/t/sql-last-value-reset-to-0-at-12-hour/228428)
**Author:** [@Veeru\_Badavath](https://discuss.elastic.co/u/Veeru_Badavath)\ **Replies:** 0\ **Last updated:** [April 17, 2020, 2:13am UTC](https://discuss.elastic.co/t/sql-last-value-reset-to-0-at-12-hour/228428 "2020-04-17T02:13:12Z")
Hi, I am new to ELK stack. I am planning to fetch data from Oracle table to visualise data in Kibana. My table doesn't have primary key column so based timestamp (format: hhmmss eg. 00001) column scheduling to fetch inc… --- ## [Failed to fetch X-Pack information from Elasticsearch](https://discuss.elastic.co/t/failed-to-fetch-x-pack-information-from-elasticsearch/227712)
**Author:** [@enricobachiorrini](https://discuss.elastic.co/u/enricobachiorrini)\ **Replies:** 4\ **Last updated:** [April 17, 2020, 1:27am UTC](https://discuss.elastic.co/t/failed-to-fetch-x-pack-information-from-elasticsearch/227712 "2020-04-17T01:27:12Z")
Hello, I'm setting up elasticsearch and centralized pipeline management. Elasticsearch crashes with these errors: \[2020-04-13T00:41:44,943\]\[ERROR\]\[logstash.licensechecker.licensereader\] Unable to retrieve license info… --- ## [Currently we are on logstash 1.4.2 , but to comply new elasticsearch requirements we need to move to logstash version 2 or more, I am looking for any document or url that provides steps](https://discuss.elastic.co/t/currently-we-are-on-logstash-1-4-2-but-to-comply-new-elasticsearch-requirements-we-need-to-move-to-logstash-version-2-or-more-i-am-looking-for-any-document-or-url-that-provides-steps/228417)
**Author:** [@ssunkara](https://discuss.elastic.co/u/ssunkara)\ **Replies:** 3\ **Last updated:** [April 16, 2020, 11:45pm UTC](https://discuss.elastic.co/t/currently-we-are-on-logstash-1-4-2-but-to-comply-new-elasticsearch-requirements-we-need-to-move-to-logstash-version-2-or-more-i-am-looking-for-any-document-or-url-that-provides-steps/228417 "2020-04-16T23:45:13Z")
Currently we are on logstash 1.4.2 , but to comply new elasticsearch requirements we need to move to logstash version 2 or more, I am looking for any document or url that provides steps. --- ## [Syslogging a Unifi Stack with Elastic Stack](https://discuss.elastic.co/t/syslogging-a-unifi-stack-with-elastic-stack/226483)
**Author:** [@patrick\_kelly\_aci](https://discuss.elastic.co/u/patrick_kelly_aci)\ **Replies:** 8\ **Last updated:** [April 16, 2020, 11:33pm UTC](https://discuss.elastic.co/t/syslogging-a-unifi-stack-with-elastic-stack/226483 "2020-04-16T23:33:02Z")
So I wanted to start by stating that I am very new to Elastic Stack and I've been in IT for one year so my understanding of the way it works is very basic. I have completed the setup basic operations of Elastic Stack on … --- ## [Grok pattern match for multiple lines](https://discuss.elastic.co/t/grok-pattern-match-for-multiple-lines/228408)
**Author:** [@kyle\_che](https://discuss.elastic.co/u/kyle_che)\ **Replies:** 2\ **Last updated:** [April 16, 2020, 10:37pm UTC](https://discuss.elastic.co/t/grok-pattern-match-for-multiple-lines/228408 "2020-04-16T22:37:02Z")
I am reading a postgresql log file in and some lines are pretty big and come in on multiple lines. Any one have any idea on how to match this pattern? grok pattern: (%{TIMESTAMP\_ISO8601:timestamp}%{SPACE}%{TZ:time\_zon… --- ## [Two pipelines modifying different fields on the same AppSearch index keep overwriting each other](https://discuss.elastic.co/t/two-pipelines-modifying-different-fields-on-the-same-appsearch-index-keep-overwriting-each-other/228402)
**Author:** [@gpribi](https://discuss.elastic.co/u/gpribi)\ **Replies:** 0\ **Last updated:** [April 16, 2020, 8:48pm UTC](https://discuss.elastic.co/t/two-pipelines-modifying-different-fields-on-the-same-appsearch-index-keep-overwriting-each-other/228402 "2020-04-16T20:48:54Z")
Hello, I have two pipelines modifying different fields from the same documents and each time one pipeline runs, it overwrites the information of the other pipeline's fields. I have a large (150K) product database in Ela… --- ## [Dateparse failure When trying to get date from xml file](https://discuss.elastic.co/t/dateparse-failure-when-trying-to-get-date-from-xml-file/228342)
**Author:** [@kagashe](https://discuss.elastic.co/u/kagashe)\ **Replies:** 7\ **Last updated:** [April 16, 2020, 8:27pm UTC](https://discuss.elastic.co/t/dateparse-failure-when-trying-to-get-date-from-xml-file/228342 "2020-04-16T20:27:38Z")
Hi all, I'm trying to update the @timestamp field to be the timestamp pulled from my source xml file. The xml fields are mapped with xpath and all seem to be parsing fine however when I run the date filter below it does… --- ## [Set a default value if nil](https://discuss.elastic.co/t/set-a-default-value-if-nil/228319)
**Author:** [@Yaniv\_Nuriel](https://discuss.elastic.co/u/Yaniv_Nuriel)\ **Replies:** 8\ **Last updated:** [April 16, 2020, 8:26pm UTC](https://discuss.elastic.co/t/set-a-default-value-if-nil/228319 "2020-04-16T20:26:24Z")
Hey, I know it has been asked a lot, but I tried every solution and nothing works for me. I have a field that sometimes is empty (,,) so I want to set "ebay" in that case. Here it is how it looks like when it is nil: … --- ## [Logstash-input-jmx and maven](https://discuss.elastic.co/t/logstash-input-jmx-and-maven/228382)
**Author:** [@granier](https://discuss.elastic.co/u/granier)\ **Replies:** 0\ **Last updated:** [April 16, 2020, 5:30pm UTC](https://discuss.elastic.co/t/logstash-input-jmx-and-maven/228382 "2020-04-16T17:30:59Z")
Hi, I try to install logstash plugin logstash-input-jmx maven, I defined the HTTP\_PROXY variable and I get the following error message. WARNING: A maven settings file already exist at /root/.m2/settings.xml, please rev… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=371) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=373)