# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=386 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 387 --- ## [Logstash is not receiving or sending data to elastic from Azure Hub](https://discuss.elastic.co/t/logstash-is-not-receiving-or-sending-data-to-elastic-from-azure-hub/223562)
**Author:** [@igman](https://discuss.elastic.co/u/igman)\ **Replies:** 1\ **Last updated:** [March 23, 2020, 3:35pm UTC](https://discuss.elastic.co/t/logstash-is-not-receiving-or-sending-data-to-elastic-from-azure-hub/223562 "2020-03-23T15:35:18Z")
I created Azure Event Hub and I can see all message in Event Hub\*\* I installed have Elasticsearch,Kibana and LogStash on single Windows box. I enabled plug in logstash-input-azure\_event\_hubs. I run logstash –f Logstas… --- ## [Count "active" messages](https://discuss.elastic.co/t/count-active-messages/224680)
**Author:** [@KevSex](https://discuss.elastic.co/u/KevSex)\ **Replies:** 1\ **Last updated:** [March 23, 2020, 3:15pm UTC](https://discuss.elastic.co/t/count-active-messages/224680 "2020-03-23T15:15:57Z")
I have a log source that sends an event when an alert is triggered event.type: "Alert Started". Another event is triggered when the alert clears event.type: "Alert Ended" I'm looking to know how best I can retrieve a co… --- ## [Convert Text in JSON](https://discuss.elastic.co/t/convert-text-in-json/224604)
**Author:** [@brunus0475](https://discuss.elastic.co/u/brunus0475)\ **Replies:** 1\ **Last updated:** [March 23, 2020, 2:57pm UTC](https://discuss.elastic.co/t/convert-text-in-json/224604 "2020-03-23T14:57:14Z")
Hi All, this is our stdout {} of Logstash: { "\_index": "logstash","\_type": "\_doc","\_id": "UPUcBnEBHL50VNrwHY-Q","\_version": 1, "\_score": null,"\_source": {"host": {"name": "xxxxxx"},"@timestamp": "2020-03-23T06:37:16.91… --- ## [Creating a dynamic S3 tag](https://discuss.elastic.co/t/creating-a-dynamic-s3-tag/224455)
**Author:** [@byoungman](https://discuss.elastic.co/u/byoungman)\ **Replies:** 2\ **Last updated:** [March 23, 2020, 12:27pm UTC](https://discuss.elastic.co/t/creating-a-dynamic-s3-tag/224455 "2020-03-23T12:27:56Z")
I have log input coming from multiple sources that I am writing into S3 buckets but now I am wanting to add the source name (machine name) to the S3 filename as a tag so my requirement is a dynamic tag name based on the … --- ## [Syslog - how to use ELK stack server as syslog server for other servers](https://discuss.elastic.co/t/syslog-how-to-use-elk-stack-server-as-syslog-server-for-other-servers/224660)
**Author:** [@Yuva](https://discuss.elastic.co/u/Yuva)\ **Replies:** 0\ **Last updated:** [March 23, 2020, 11:31am UTC](https://discuss.elastic.co/t/syslog-how-to-use-elk-stack-server-as-syslog-server-for-other-servers/224660 "2020-03-23T11:31:48Z")
if you have any steps to enable logstash server as logging server ( syslog). Regards, ElayaRaja --- ## [Netflow module interface information missing - Elasticsearch 7.3.2 , installed ELK setup ( elasticsearch, Logstash & Kibana)](https://discuss.elastic.co/t/netflow-module-interface-information-missing-elasticsearch-7-3-2-installed-elk-setup-elasticsearch-logstash-kibana/224642)
**Author:** [@Yuva](https://discuss.elastic.co/u/Yuva)\ **Replies:** 0\ **Last updated:** [March 23, 2020, 10:10am UTC](https://discuss.elastic.co/t/netflow-module-interface-information-missing-elasticsearch-7-3-2-installed-elk-setup-elasticsearch-logstash-kibana/224642 "2020-03-23T10:10:30Z")
installed elasticsearch 7.3.2 for storing logs and installed logstash 7.3.2 for both shipping as well as processing. and installed kibana for visualization tool all these three components installed on same machine and… --- ## [Sequel::DatabaseError: Java::JavaSql::SQLException: Query failed with error code 13 and error message 'there are no users authenticated'](https://discuss.elastic.co/t/sequel-java-query-failed-with-error-code-13-and-error-message-there-are-no-users-authenticated/224649)
**Author:** [@chandu5565](https://discuss.elastic.co/u/chandu5565)\ **Replies:** 0\ **Last updated:** [March 23, 2020, 10:31am UTC](https://discuss.elastic.co/t/sequel-java-query-failed-with-error-code-13-and-error-message-there-are-no-users-authenticated/224649 "2020-03-23T10:31:11Z")
Hi, I am using jdbc input plugin in logstash to ship the documents from mongodb to elasticsearch. I gave jdbc\_user and jdbc\_password but getting below error. jdbc - Exception when executing JDBC query {:exception=\>#\ **Author:** [@Emna1](https://discuss.elastic.co/u/Emna1)\ **Replies:** 12\ **Last updated:** [March 23, 2020, 9:57am UTC](https://discuss.elastic.co/t/how-to-convert-field-date-from-string-to-date/224467 "2020-03-23T09:57:42Z") I want to convert the field of date from string to date, i try this code in my config file but it doesn't change in kibana..I don't know why! any help?? filter{ csv{ columns =\> \["car","date","dateEntree","dateSortie"\] … --- ## [How to print/trace received xml message from IBMMQ in logstash logs or in file in format of XML](https://discuss.elastic.co/t/how-to-print-trace-received-xml-message-from-ibmmq-in-logstash-logs-or-in-file-in-format-of-xml/224613)
**Author:** [@ELK3855](https://discuss.elastic.co/u/ELK3855)\ **Replies:** 0\ **Last updated:** [March 23, 2020, 8:03am UTC](https://discuss.elastic.co/t/how-to-print-trace-received-xml-message-from-ibmmq-in-logstash-logs-or-in-file-in-format-of-xml/224613 "2020-03-23T08:03:35Z")
How to print/trace received xml message from IBMMQ in logstash logs or in file ? --- ## [Beats can not connect to Logstash](https://discuss.elastic.co/t/beats-can-not-connect-to-logstash/224502)
**Author:** [@namesv](https://discuss.elastic.co/u/namesv)\ **Replies:** 3\ **Last updated:** [March 23, 2020, 5:53am UTC](https://discuss.elastic.co/t/beats-can-not-connect-to-logstash/224502 "2020-03-23T05:53:28Z")
Hi, I've been struggling to connect my filebeat to logstash in order to harvest the logs on node machines. Below is my error/ log from Logstash sudo /usr/share/logstash/bin/logstash -f ~/1phase2.conf --config.reload.a… --- ## [IN usage for multiple key word in IF condition](https://discuss.elastic.co/t/in-usage-for-multiple-key-word-in-if-condition/224563)
**Author:** [@Sridhar](https://discuss.elastic.co/u/Sridhar)\ **Replies:** 2\ **Last updated:** [March 23, 2020, 1:59am UTC](https://discuss.elastic.co/t/in-usage-for-multiple-key-word-in-if-condition/224563 "2020-03-23T01:59:45Z")
Hi, Below is the logstash code.. its not working.. it works with == "1 Key" but not with multiple key words using in Please help output { if \[data\]\[data1\]\[data3\] in "key", "key-2", "key-3", "Key-4", "aaKEY" { el… --- ## [@Timestamp does not appear when creating index](https://discuss.elastic.co/t/timestamp-does-not-appear-when-creating-index/224487)
**Author:** [@lfuentes](https://discuss.elastic.co/u/lfuentes)\ **Replies:** 3\ **Last updated:** [March 22, 2020, 11:29pm UTC](https://discuss.elastic.co/t/timestamp-does-not-appear-when-creating-index/224487 "2020-03-22T23:29:51Z")
Good morning, I have a problem creating an index, it happens that @timestamp does not appear to me, this is an example of the date in the log file: ####\ \ \ \ \ **Author:** [@quangnguyen](https://discuss.elastic.co/u/quangnguyen)\ **Replies:** 3\ **Last updated:** [March 22, 2020, 9:54pm UTC](https://discuss.elastic.co/t/drop-empty-message-with-character-null-x00/224331 "2020-03-22T21:54:30Z") Hello Community, i'm getting following log message what makes no sense to forward it in to output. The message contains only null character inside two qoutes "\\x00". How could i drop it with logstash filter? \[2020-03-2… --- ## [Elasticsearch result: Array to CSV](https://discuss.elastic.co/t/elasticsearch-result-array-to-csv/224473)
**Author:** [@Sineos](https://discuss.elastic.co/u/Sineos)\ **Replies:** 2\ **Last updated:** [March 22, 2020, 8:34pm UTC](https://discuss.elastic.co/t/elasticsearch-result-array-to-csv/224473 "2020-03-22T20:34:43Z")
I'm reading from a file and search the file's content in ES. The output of ES should go into a CSV. Conf file: input { file { path =\> "d:/uae.txt" start\_position =\> "beginning" sincedb… --- ## [Ruby Iteration in Logstash help](https://discuss.elastic.co/t/ruby-iteration-in-logstash-help/224054)
**Author:** [@GreinerA](https://discuss.elastic.co/u/GreinerA)\ **Replies:** 3\ **Last updated:** [March 22, 2020, 6:56pm UTC](https://discuss.elastic.co/t/ruby-iteration-in-logstash-help/224054 "2020-03-22T18:56:19Z")
i have a parsed xml data that looks like this: "ObjLdn\_Value" =\> \[ \[0\] "PoolType=necc, PoolId=0, PoolMember=0, Machine=XXXXXX1, UUID=ABCDABCD1", \[1\] "PoolType=necc, PoolId=0, PoolMember=1, Machine=XXXXXX2, UUID=… --- ## [Amazon\_es output plugin routing](https://discuss.elastic.co/t/amazon-es-output-plugin-routing/224572)
**Author:** [@rohit\_rohan](https://discuss.elastic.co/u/rohit_rohan)\ **Replies:** 0\ **Last updated:** [March 22, 2020, 6:46pm UTC](https://discuss.elastic.co/t/amazon-es-output-plugin-routing/224572 "2020-03-22T18:46:02Z")
\`\`\`I am using amazon\_ws output to send data, it works perfectly without \`routing\` defined but throws an error \`illegal\_argument\_exception\\",\\"reason\\":\\"Action/metadata line \[1\] contains an unknown parameter \[\_routing\]\\"… --- ## [Logstash filter logs config](https://discuss.elastic.co/t/logstash-filter-logs-config/224505)
**Author:** [@anmohamed](https://discuss.elastic.co/u/anmohamed)\ **Replies:** 1\ **Last updated:** [March 22, 2020, 5:24pm UTC](https://discuss.elastic.co/t/logstash-filter-logs-config/224505 "2020-03-22T17:24:32Z")
I have config ELK and i tried setup the logs for servers logstash config is not working properly this is my log format, can we help me to setup a conf file. (filter) W, \[2020-03-17T09:51:25.615545 #20973\] WARN -- : \[c… --- ## [Cisco ASA parse failure](https://discuss.elastic.co/t/cisco-asa-parse-failure/224259)
**Author:** [@sai\_kiran1](https://discuss.elastic.co/u/sai_kiran1)\ **Replies:** 2\ **Last updated:** [March 22, 2020, 4:39pm UTC](https://discuss.elastic.co/t/cisco-asa-parse-failure/224259 "2020-03-22T16:39:31Z")
Hello, I get below error when trying to parse cisco messages. \[2020-03-19T12:21:34,554\]\[ERROR\]\[logstash.pipeline \] Pipeline aborted due to error {:pipeline\_id=\>"main", :exception=\>#\ **Author:** [@sayyadsays](https://discuss.elastic.co/u/sayyadsays)\ **Replies:** 1\ **Last updated:** [March 22, 2020, 4:32pm UTC](https://discuss.elastic.co/t/windows-log-text-file-data-is-not-parsing-logstash/224345 "2020-03-22T16:32:21Z") Can you please check and help: Find the below Logs need to monitor: Timestamp: 12/24/2019 5:42:04 AM Message: Task timed out - SKKW is not responding in timely manner Category: Error Priority: -1 EventId: 1 Severit… --- ## [Please help - if statement for match rules](https://discuss.elastic.co/t/please-help-if-statement-for-match-rules/224271)
**Author:** [@calanon](https://discuss.elastic.co/u/calanon)\ **Replies:** 1\ **Last updated:** [March 22, 2020, 4:25pm UTC](https://discuss.elastic.co/t/please-help-if-statement-for-match-rules/224271 "2020-03-22T16:25:28Z")
I would like to match two items with the rule below. How can I make this with an if statement? date { match =\> \[ "fgt\_timestamp", "yyyyMMdd HHmmss", "yyyy-MM-dd HH:mm:ss" \] target =\> "std\_timestamp" t… --- ## [Parsing a pretty formatted JSON file using Logstash](https://discuss.elastic.co/t/parsing-a-pretty-formatted-json-file-using-logstash/224224)
**Author:** [@Noushad\_Aslam](https://discuss.elastic.co/u/Noushad_Aslam)\ **Replies:** 7\ **Last updated:** [March 22, 2020, 4:24pm UTC](https://discuss.elastic.co/t/parsing-a-pretty-formatted-json-file-using-logstash/224224 "2020-03-22T16:24:45Z")
Hi, I am pretty new to Elastic stack. I have a need to index a JSON file data. Below is my JSON file format. \[ { "metricId" : 1776736, "metricName" : "Hardware Resources|Memory|Used %", "metricPath" : "Application I… --- ## [Logstash Server 2016 Server Issues](https://discuss.elastic.co/t/logstash-server-2016-server-issues/224207)
**Author:** [@mrandolph](https://discuss.elastic.co/u/mrandolph)\ **Replies:** 1\ **Last updated:** [March 22, 2020, 4:08pm UTC](https://discuss.elastic.co/t/logstash-server-2016-server-issues/224207 "2020-03-22T16:08:21Z")
I have been trying to install and never get past the error below. I am trying to configure this up to pipe both netflow and system logs to the server. Can anyone help? Sending Logstash logs to E:/logstash-7.6.1/logs whi… --- ## [Logstash simplify list of dict](https://discuss.elastic.co/t/logstash-simplify-list-of-dict/224151)
**Author:** [@msirovy](https://discuss.elastic.co/u/msirovy)\ **Replies:** 1\ **Last updated:** [March 22, 2020, 4:05pm UTC](https://discuss.elastic.co/t/logstash-simplify-list-of-dict/224151 "2020-03-22T16:05:13Z")
Hi, I am trying to parse by logstash this: "attributes": \[ { "value": "ValueA", "name": "NameA" }, { "value": "ValueB", "name": "NameB" … --- ## [Grok add\_tag processed when no match was found](https://discuss.elastic.co/t/grok-add-tag-processed-when-no-match-was-found/224304)
**Author:** [@elady](https://discuss.elastic.co/u/elady)\ **Replies:** 2\ **Last updated:** [March 22, 2020, 10:39am UTC](https://discuss.elastic.co/t/grok-add-tag-processed-when-no-match-was-found/224304 "2020-03-22T10:39:39Z")
Hey. I have the following configuration: filter { grok { match =\> { "message" =\> "%{TIMESTAMP\_ISO8601:event\_timestamp}%{SPACE}%{DATA:log\_level}%{SPACE}\\\[%{DATA:host}\\\]%{SPACE}\\\[%{DATA:tenant}\\\]%{SPACE}\\\[%{DATA:ja… --- ## [How Filtering logstash output from winlogbeat using winevent More detail?](https://discuss.elastic.co/t/how-filtering-logstash-output-from-winlogbeat-using-winevent-more-detail/224338)
**Author:** [@dhimasjoe](https://discuss.elastic.co/u/dhimasjoe)\ **Replies:** 6\ **Last updated:** [March 21, 2020, 4:49am UTC](https://discuss.elastic.co/t/how-filtering-logstash-output-from-winlogbeat-using-winevent-more-detail/224338 "2020-03-21T04:49:32Z")
\#Windwos event ID #I have filtering using EventID and work 100% , but how to more specific filtering , i want to dinied QueryName below : my config : thanks. --- ## [Grok pattern for '|' character](https://discuss.elastic.co/t/grok-pattern-for-character/224333)
**Author:** [@Mehak\_Bhargava](https://discuss.elastic.co/u/Mehak_Bhargava)\ **Replies:** 3\ **Last updated:** [March 20, 2020, 8:15pm UTC](https://discuss.elastic.co/t/grok-pattern-for-character/224333 "2020-03-20T20:15:45Z")
I have 4 log files and a sample line from each of them is below. All these log files are under one index. How can i make one grok pattern that works for these two different format of log files? The grok i have at the en… --- ## [Not a valid keystore when running Logstash as a service](https://discuss.elastic.co/t/not-a-valid-keystore-when-running-logstash-as-a-service/224471)
**Author:** [@ancdaromidi](https://discuss.elastic.co/u/ancdaromidi)\ **Replies:** 0\ **Last updated:** [March 20, 2020, 6:39pm UTC](https://discuss.elastic.co/t/not-a-valid-keystore-when-running-logstash-as-a-service/224471 "2020-03-20T18:39:00Z")
Hi, I am trying to use keystore as documented in https://www.elastic.co/guide/en/logstash/current/keystore.html I was able to succesfully implement it and also run it. However, when I run Logstash as a service it will … --- ## [How to parse XML using XPATH from SOAP API in Logstash](https://discuss.elastic.co/t/how-to-parse-xml-using-xpath-from-soap-api-in-logstash/223979)
**Author:** [@Enyer\_Quiroz](https://discuss.elastic.co/u/Enyer_Quiroz)\ **Replies:** 1\ **Last updated:** [March 20, 2020, 2:52pm UTC](https://discuss.elastic.co/t/how-to-parse-xml-using-xpath-from-soap-api-in-logstash/223979 "2020-03-20T14:52:25Z")
Hello Everyone, I hope you are good, I have this issue with logstash filter using Xpath, I Don't really know if the xpath I Pass is wrong the error I'm getting from cmd is kinda syntax error.... What I'm seeing is like… --- ## [Logstash secure connection with elastic cluster](https://discuss.elastic.co/t/logstash-secure-connection-with-elastic-cluster/224429)
**Author:** [@jaxvaj](https://discuss.elastic.co/u/jaxvaj)\ **Replies:** 0\ **Last updated:** [March 20, 2020, 2:18pm UTC](https://discuss.elastic.co/t/logstash-secure-connection-with-elastic-cluster/224429 "2020-03-20T14:18:51Z")
Hi everybody, I will start by saying that i am new to ELK, so i am trying to put up and ELK infrastructure with 2 Logstash servers, an elastic cluster with 2 nodes, and 1 kibana server. I have succeed in securing the … --- ## [Parsing Collectd logstash file and pushing metrics to graphite](https://discuss.elastic.co/t/parsing-collectd-logstash-file-and-pushing-metrics-to-graphite/223737)
**Author:** [@Narayana](https://discuss.elastic.co/u/Narayana)\ **Replies:** 13\ **Last updated:** [March 20, 2020, 1:28pm UTC](https://discuss.elastic.co/t/parsing-collectd-logstash-file-and-pushing-metrics-to-graphite/223737 "2020-03-20T13:28:20Z")
Hi All, Can you please help me with the query. My requirement is : i have to collect the metrics using Collectd .Metrics like (cpu,memory and process) After getting this metrics in collectd.json.log (collected genera… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=385) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=387)