# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=377 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 378 --- ## [Logstash CSV Parse Error](https://discuss.elastic.co/t/logstash-csv-parse-error/227138)
**Author:** [@MoeAly](https://discuss.elastic.co/u/MoeAly)\ **Replies:** 0\ **Last updated:** [April 8, 2020, 1:37pm UTC](https://discuss.elastic.co/t/logstash-csv-parse-error/227138 "2020-04-08T13:37:31Z")
Hello ES community! I hope you are all doing well and staying safe. I'm running into a small issue while parsing/importing CSV data via logstash to ES. Specifically, the issue is with one of my CSV fields. The field cont… --- ## [Logstash XML Filter Output](https://discuss.elastic.co/t/logstash-xml-filter-output/227099)
**Author:** [@ksremo](https://discuss.elastic.co/u/ksremo)\ **Replies:** 1\ **Last updated:** [April 8, 2020, 1:00pm UTC](https://discuss.elastic.co/t/logstash-xml-filter-output/227099 "2020-04-08T13:00:14Z")
Hello, i have a xml encoded logfile which is transferd with filebeat to logstash. in the logstash pipeline i use the xml-filter. the output looks like: Event.Client-IP-Address { "content": "10.x.x.x", … --- ## [Ecs.version field as array or clean up?](https://discuss.elastic.co/t/ecs-version-field-as-array-or-clean-up/226407)
**Author:** [@widhalmt](https://discuss.elastic.co/u/widhalmt)\ **Replies:** 4\ **Last updated:** [April 8, 2020, 7:12am UTC](https://discuss.elastic.co/t/ecs-version-field-as-array-or-clean-up/226407 "2020-04-08T07:12:43Z")
Hi, As suggested in the ECS documents I want to set the ecs.version field in my Logstash pipelines. But since I'm using multiplie cascading pipelines (and receive events via filebeat), sometimes the field is already set… --- ## [Logstash filter for displaying top exception names occurred in spring boot application](https://discuss.elastic.co/t/logstash-filter-for-displaying-top-exception-names-occurred-in-spring-boot-application/226935)
**Author:** [@Mohammed\_Siddiq](https://discuss.elastic.co/u/Mohammed_Siddiq)\ **Replies:** 2\ **Last updated:** [April 8, 2020, 6:01am UTC](https://discuss.elastic.co/t/logstash-filter-for-displaying-top-exception-names-occurred-in-spring-boot-application/226935 "2020-04-08T06:01:51Z")
Hi Magnus, I have recently started using ELK, I have been assigned to do ELK integration in my project. I have installed 7.6.1 of ELK and filebeat. I need your assistance is configuring filter for logstash to achieve ta… --- ## [Jdbc\_static prepared\_parameters Mismatched number of placeholders error](https://discuss.elastic.co/t/jdbc-static-prepared-parameters-mismatched-number-of-placeholders-error/226833)
**Author:** [@jgabor](https://discuss.elastic.co/u/jgabor)\ **Replies:** 2\ **Last updated:** [April 8, 2020, 5:09am UTC](https://discuss.elastic.co/t/jdbc-static-prepared-parameters-mismatched-number-of-placeholders-error/226833 "2020-04-08T05:09:54Z")
Hi! When using the jdbc\_static filter and using prepared\_parameters in lookup I get a "Mismatched number of placeholders" error. The configuration looks like this: local\_lookups =\> \[ { id =\> "local-m… --- ## [Logstash persisant queue usage without input](https://discuss.elastic.co/t/logstash-persisant-queue-usage-without-input/227051)
**Author:** [@hlamsc](https://discuss.elastic.co/u/hlamsc)\ **Replies:** 0\ **Last updated:** [April 8, 2020, 4:51am UTC](https://discuss.elastic.co/t/logstash-persisant-queue-usage-without-input/227051 "2020-04-08T04:51:09Z")
Hello, a week ago we build a small logstash "cluster" containing 3 logstash nodes (virtual machines) and haproxys for roundrobin. It worked really nice so we tried out persistent queue on one of the three nodes. As aspe… --- ## [Is Event API synchronous or asynchronous?](https://discuss.elastic.co/t/is-event-api-synchronous-or-asynchronous/227040)
**Author:** [@Sarah\_Taaher\_Bonna](https://discuss.elastic.co/u/Sarah_Taaher_Bonna)\ **Replies:** 0\ **Last updated:** [April 8, 2020, 2:12am UTC](https://discuss.elastic.co/t/is-event-api-synchronous-or-asynchronous/227040 "2020-04-08T02:12:09Z")
Hi, I understand that the Event API has been rewritten in Java. I would like to know if the event.get and event.set methods are synchronous or asynchronous. Thanks. Regards, Sarah --- ## [Is Logstash useful for structured data?](https://discuss.elastic.co/t/is-logstash-useful-for-structured-data/226883)
**Author:** [@Robert\_Ga](https://discuss.elastic.co/u/Robert_Ga)\ **Replies:** 5\ **Last updated:** [April 7, 2020, 10:05pm UTC](https://discuss.elastic.co/t/is-logstash-useful-for-structured-data/226883 "2020-04-07T22:05:35Z")
Hello everyone, Recently I started to migrate some data into Elasticsearch using the Python client. The data is already structured in json files and needs some processing like: lowercase all the values handle value i… --- ## [Unable to ingest JSON file and output to stdout](https://discuss.elastic.co/t/unable-to-ingest-json-file-and-output-to-stdout/226793)
**Author:** [@leosoaivan](https://discuss.elastic.co/u/leosoaivan)\ **Replies:** 5\ **Last updated:** [April 7, 2020, 8:44pm UTC](https://discuss.elastic.co/t/unable-to-ingest-json-file-and-output-to-stdout/226793 "2020-04-07T20:44:00Z")
New to Logstash, and I've attempted to start with a simple JSON file, though I can't get anything to output to stdout. It just hangs at Successfully started Logstash API endpoint {:port=\>9646} I've looked at a few posts… --- ## [Newbie trying to use syslog date and time as timestamp in Logstash](https://discuss.elastic.co/t/newbie-trying-to-use-syslog-date-and-time-as-timestamp-in-logstash/226948)
**Author:** [@dbaddorf](https://discuss.elastic.co/u/dbaddorf)\ **Replies:** 4\ **Last updated:** [April 7, 2020, 8:25pm UTC](https://discuss.elastic.co/t/newbie-trying-to-use-syslog-date-and-time-as-timestamp-in-logstash/226948 "2020-04-07T20:25:40Z")
Hello! I know that I'm trying to do something simple, and I'm just getting started with Elasticsearch/Logstash, but I just can't seem to get the right combination, so I was hoping that someone might point me in the corr… --- ## [Logstash IMAP "cannot decode entire message" errors](https://discuss.elastic.co/t/logstash-imap-cannot-decode-entire-message-errors/227000)
**Author:** [@jeffkirk1](https://discuss.elastic.co/u/jeffkirk1)\ **Replies:** 0\ **Last updated:** [April 7, 2020, 7:53pm UTC](https://discuss.elastic.co/t/logstash-imap-cannot-decode-entire-message-errors/227000 "2020-04-07T19:53:45Z")
Just started using the logstash-imap-input filter to pull logs from a UNIX IMAP server. Using Logstash 7.6.1 running on a Scientific Linux 6.7 server (don't ask). The pipeline worked for 535 messages before it ran into … --- ## [Permission error when performing logstash -f](https://discuss.elastic.co/t/permission-error-when-performing-logstash-f/226976)
**Author:** [@Al1](https://discuss.elastic.co/u/Al1)\ **Replies:** 1\ **Last updated:** [April 7, 2020, 7:50pm UTC](https://discuss.elastic.co/t/permission-error-when-performing-logstash-f/226976 "2020-04-07T19:50:40Z")
Hi - I am very new to logstash and I am running into an issue when trying to perform a logstash - f on my .config file. This is my .config file: input { file { path =\> "/Users/alpitshah/Data/cars.csv" start\_position… --- ## [Fields are not shown in "Available fields" in KIbana](https://discuss.elastic.co/t/fields-are-not-shown-in-available-fields-in-kibana/226716)
**Author:** [@Manav\_Chopra](https://discuss.elastic.co/u/Manav_Chopra)\ **Replies:** 7\ **Last updated:** [April 7, 2020, 6:50pm UTC](https://discuss.elastic.co/t/fields-are-not-shown-in-available-fields-in-kibana/226716 "2020-04-07T18:50:39Z")
I have added fields i.e through mapping API and all the fields are shown on index management\> index pattern page But when I go to Discover tab, no new fields are shown there. Can you please tell what is the missing par… --- ## [Hello World doesn't output to Logstash](https://discuss.elastic.co/t/hello-world-doesnt-output-to-logstash/226985)
**Author:** [@eStrux-MAB](https://discuss.elastic.co/u/eStrux-MAB)\ **Replies:** 0\ **Last updated:** [April 7, 2020, 6:41pm UTC](https://discuss.elastic.co/t/hello-world-doesnt-output-to-logstash/226985 "2020-04-07T18:41:32Z")
I have a Logstash conf file configured as such: input { exec { command =\> "/etc/logstash/scripts/do\_something.py" interval =\> 60 } } output { stdout {} } … --- ## [Getting Json Formated Data to elastic in multiple Docs](https://discuss.elastic.co/t/getting-json-formated-data-to-elastic-in-multiple-docs/226934)
**Author:** [@KaiThoZ](https://discuss.elastic.co/u/KaiThoZ)\ **Replies:** 2\ **Last updated:** [April 7, 2020, 6:06pm UTC](https://discuss.elastic.co/t/getting-json-formated-data-to-elastic-in-multiple-docs/226934 "2020-04-07T18:06:45Z")
Hello, certainly this has been asked many times before but after hours of working on this topic I was unable to solve my problem. I have Json data that looks like this in ruby debug, I want to ghav each of those random… --- ## [Logstash generate a random number for an HTTP wait request?](https://discuss.elastic.co/t/logstash-generate-a-random-number-for-an-http-wait-request/226936)
**Author:** [@stcdarrell](https://discuss.elastic.co/u/stcdarrell)\ **Replies:** 2\ **Last updated:** [April 7, 2020, 3:53pm UTC](https://discuss.elastic.co/t/logstash-generate-a-random-number-for-an-http-wait-request/226936 "2020-04-07T15:53:39Z")
hi, i have a logstash http filter that reaches out to a public API for enrichment of the data. i'm limited to 1 request per second. i've thrown a "sleep" filter in.. to make it wait 1 second.. i'm still getting "reques… --- ## [Shodan query returns an ugly result i cant seem to fix](https://discuss.elastic.co/t/shodan-query-returns-an-ugly-result-i-cant-seem-to-fix/226778)
**Author:** [@stcdarrell](https://discuss.elastic.co/u/stcdarrell)\ **Replies:** 1\ **Last updated:** [April 7, 2020, 3:24pm UTC](https://discuss.elastic.co/t/shodan-query-returns-an-ugly-result-i-cant-seem-to-fix/226778 "2020-04-07T15:24:01Z")
hi, i'm querying shodan.io with some ip addresses.. every so often i get this message : \[2020-04-06T20:37:51,625\]\[WARN \]\[logstash.outputs.elasticsearch\]\[darkwebrdp-hospitals\] Could not index event to Elasticsearch. {:st… --- ## [Need help with key-value pair extraction](https://discuss.elastic.co/t/need-help-with-key-value-pair-extraction/226819)
**Author:** [@Nithani25](https://discuss.elastic.co/u/Nithani25)\ **Replies:** 1\ **Last updated:** [April 7, 2020, 3:17pm UTC](https://discuss.elastic.co/t/need-help-with-key-value-pair-extraction/226819 "2020-04-07T15:17:51Z")
HI Team, I have split last field of my message has greedydata, however in some case, i have some key-value pair which needs extraction. key-value format message: CurrentURL = /google/search , UserID = nishchen83 I wa… --- ## [Move to pipeline-to-pipeline communiction](https://discuss.elastic.co/t/move-to-pipeline-to-pipeline-communiction/226379)
**Author:** [@victor.nilsson](https://discuss.elastic.co/u/victor.nilsson)\ **Replies:** 2\ **Last updated:** [April 7, 2020, 3:16pm UTC](https://discuss.elastic.co/t/move-to-pipeline-to-pipeline-communiction/226379 "2020-04-07T15:16:27Z")
Hi, Today we have a pretty complicated single pipeline comprised mostly of a lot of conditionals to route everything to its right place. One issue with this that we've noticed is if a output goes down, it affects the wh… --- ## [Help with basic filtering of eventID from winlogbeat](https://discuss.elastic.co/t/help-with-basic-filtering-of-eventid-from-winlogbeat/226909)
**Author:** [@sbagciva](https://discuss.elastic.co/u/sbagciva)\ **Replies:** 2\ **Last updated:** [April 7, 2020, 3:06pm UTC](https://discuss.elastic.co/t/help-with-basic-filtering-of-eventid-from-winlogbeat/226909 "2020-04-07T15:06:15Z")
so Im trying to filter out a event code in my logstash conf file.. so I have the basic conf.. input { beats { port =\> .... type =\> "log" } } to filter I put this filter { if \[type\] == "wineventlog" and \[event\_i… --- ## [How to configure filebeat for logstash cluster environment?](https://discuss.elastic.co/t/how-to-configure-filebeat-for-logstash-cluster-environment/226851)
**Author:** [@manish.sapariya](https://discuss.elastic.co/u/manish.sapariya)\ **Replies:** 3\ **Last updated:** [April 7, 2020, 2:52pm UTC](https://discuss.elastic.co/t/how-to-configure-filebeat-for-logstash-cluster-environment/226851 "2020-04-07T14:52:31Z")
I am missing something very basic when I think of how Filebeat will be configured in a clustered logstash setup. As per the article https://www.elastic.co/guide/en/logstash/current/deploying-and-scaling.html and this ar… --- ## [Logstash does not show outout in the console while using file plugin. But when i give same input from stdin the out is printed in the console](https://discuss.elastic.co/t/logstash-does-not-show-outout-in-the-console-while-using-file-plugin-but-when-i-give-same-input-from-stdin-the-out-is-printed-in-the-console/226872)
**Author:** [@saikumar374265](https://discuss.elastic.co/u/saikumar374265)\ **Replies:** 1\ **Last updated:** [April 7, 2020, 2:50pm UTC](https://discuss.elastic.co/t/logstash-does-not-show-outout-in-the-console-while-using-file-plugin-but-when-i-give-same-input-from-stdin-the-out-is-printed-in-the-console/226872 "2020-04-07T14:50:23Z")
logstash does not show outout in the console while using file plugin. But when i give same input from stdin the out is printed in the console. Here is my config file input { file { path =\> "C:\\Users\\503160527\\test.lo… --- ## [The differences between @timestamp and time in log file](https://discuss.elastic.co/t/the-differences-between-timestamp-and-time-in-log-file/226804)
**Author:** [@lusynda](https://discuss.elastic.co/u/lusynda)\ **Replies:** 2\ **Last updated:** [April 7, 2020, 2:48pm UTC](https://discuss.elastic.co/t/the-differences-between-timestamp-and-time-in-log-file/226804 "2020-04-07T14:48:07Z")
Hi all I have a question about the @timestamp, i know that @timestamp are what generate by logstash but i dont really know how it work. For ex: i have a server that are config with time that are wrong. It set the date … --- ## [Log stash service not generating logs](https://discuss.elastic.co/t/log-stash-service-not-generating-logs/226887)
**Author:** [@Seetharaman\_K](https://discuss.elastic.co/u/Seetharaman_K)\ **Replies:** 0\ **Last updated:** [April 7, 2020, 12:00pm UTC](https://discuss.elastic.co/t/log-stash-service-not-generating-logs/226887 "2020-04-07T12:00:53Z")
All , below is the only one one content am seeing in the log file , \[2020-04-07T11:32:07,198\]\[WARN \]\[logstash.runner \] SIGINT received. Shutting down. \[2020-04-07T11:32:10,086\]\[INFO \]\[logstash.javapipeline … --- ## [How to ingest kv field values as seperate records in kibana](https://discuss.elastic.co/t/how-to-ingest-kv-field-values-as-seperate-records-in-kibana/226904)
**Author:** [@Mithuna](https://discuss.elastic.co/u/Mithuna)\ **Replies:** 0\ **Last updated:** [April 7, 2020, 1:28pm UTC](https://discuss.elastic.co/t/how-to-ingest-kv-field-values-as-seperate-records-in-kibana/226904 "2020-04-07T13:28:31Z")
Hi, I'm trying to ingest API data into kibana with Logstash. In this i'm not getting the value as expected. My config file is input { stdin{} http\_poller { urls =\> { q1 =\> { method =\> get user =\> "me" password … --- ## [Logstash not sending Packetbeat GeoIP data to Elastic via Logstash](https://discuss.elastic.co/t/logstash-not-sending-packetbeat-geoip-data-to-elastic-via-logstash/226903)
**Author:** [@dtama018](https://discuss.elastic.co/u/dtama018)\ **Replies:** 0\ **Last updated:** [April 7, 2020, 1:25pm UTC](https://discuss.elastic.co/t/logstash-not-sending-packetbeat-geoip-data-to-elastic-via-logstash/226903 "2020-04-07T13:25:23Z")
Hi everyone! Semi-noob and first post :smiley: Quick disclaimer and background: not a programmer, I am an analyst, so I became highly interested in Elastic when I came across it last year. Although I loved it when I st… --- ## [Logstash: TypeError: no implicit conversion of nil into string](https://discuss.elastic.co/t/logstash-typeerror-no-implicit-conversion-of-nil-into-string/224219)
**Author:** [@manojkrishna561994](https://discuss.elastic.co/u/manojkrishna561994)\ **Replies:** 2\ **Last updated:** [April 7, 2020, 12:48pm UTC](https://discuss.elastic.co/t/logstash-typeerror-no-implicit-conversion-of-nil-into-string/224219 "2020-04-07T12:48:08Z")
I'm new to ELK and trying to input 3rd party REST API to Logstash to feed data into it. I'm getting TypeError: no implicit conversion of nil into string. I'm using http\_input\_poller plugin to feed data. Here is configur… --- ## [Syslogs sent to wrong index](https://discuss.elastic.co/t/syslogs-sent-to-wrong-index/226734)
**Author:** [@Roger\_Westgren](https://discuss.elastic.co/u/Roger_Westgren)\ **Replies:** 5\ **Last updated:** [April 7, 2020, 12:27pm UTC](https://discuss.elastic.co/t/syslogs-sent-to-wrong-index/226734 "2020-04-07T12:27:06Z")
Hi! I have a weird problem with my Logstash configuration. There are 2 .conf files in /etc/logstash/conf.d (beats.conf and syslog.conf). All the Beats agents get sent to port 5043 (beats.conf), and that's working f… --- ## [Multiple http filters at the same time](https://discuss.elastic.co/t/multiple-http-filters-at-the-same-time/226839)
**Author:** [@akhilsharma.in](https://discuss.elastic.co/u/akhilsharma.in)\ **Replies:** 8\ **Last updated:** [April 7, 2020, 11:54am UTC](https://discuss.elastic.co/t/multiple-http-filters-at-the-same-time/226839 "2020-04-07T11:54:29Z")
Hi Team, Does Logstash support multiple http filters at the same time? Please confirm. --- ## [Http\_poller\_plugin: Index document issue](https://discuss.elastic.co/t/http-poller-plugin-index-document-issue/226884)
**Author:** [@manojkrishna561994](https://discuss.elastic.co/u/manojkrishna561994)\ **Replies:** 0\ **Last updated:** [April 7, 2020, 11:47am UTC](https://discuss.elastic.co/t/http-poller-plugin-index-document-issue/226884 "2020-04-07T11:47:45Z")
I'm using http\_poller\_plugin in order to fetch the logs for every 2 mins. Index is getting created and the data is also seen when the visualization is created, however, after completing every 1.30 mins (or so..) the da… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=376) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=378)