# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=390 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 391 --- ## [Logstash run as service](https://discuss.elastic.co/t/logstash-run-as-service/223371)
**Author:** [@Yungyoung\_Ok](https://discuss.elastic.co/u/Yungyoung_Ok)\ **Replies:** 1\ **Last updated:** [March 13, 2020, 9:01am UTC](https://discuss.elastic.co/t/logstash-run-as-service/223371 "2020-03-13T09:01:25Z")
I installed logstash with a tar.gz package. I want to run as a service so that logstash can run automatically when the system reboots. How should I set it up? logstash: 7.6 os: centos7 Instead of using rpm, we need … --- ## [Logstash | Pipeline - Hexadecimal to ASCII Converter](https://discuss.elastic.co/t/logstash-pipeline-hexadecimal-to-ascii-converter/223155)
**Author:** [@deeshu](https://discuss.elastic.co/u/deeshu)\ **Replies:** 4\ **Last updated:** [March 13, 2020, 8:54am UTC](https://discuss.elastic.co/t/logstash-pipeline-hexadecimal-to-ascii-converter/223155 "2020-03-13T08:54:21Z")
Hi experts, I am trying to parse some events from Auditd, the values have been extracted but the commands executed are coming in hexadecimal format. Can anyone help how to convert it to ASCII in a logstash pipeline. B… --- ## [How to adress \[fields\]\[env\] (f.e.) if i want to combine them into a single string](https://discuss.elastic.co/t/how-to-adress-fields-env-f-e-if-i-want-to-combine-them-into-a-single-string/223469)
**Author:** [@Dennis\_Bohs](https://discuss.elastic.co/u/Dennis_Bohs)\ **Replies:** 2\ **Last updated:** [March 13, 2020, 8:36am UTC](https://discuss.elastic.co/t/how-to-adress-fields-env-f-e-if-i-want-to-combine-them-into-a-single-string/223469 "2020-03-13T08:36:36Z")
Hi there, i hope this is a simple question and i just can't find it in the documentation: I have several fields, that i'd adress by \[fields\]\[something\] in logstash. Now i want to write an email-alert (with output emai… --- ## [Logstash sends to elasticsearch cluster failed](https://discuss.elastic.co/t/logstash-sends-to-elasticsearch-cluster-failed/223303)
**Author:** [@RAM\_NATHAN](https://discuss.elastic.co/u/RAM_NATHAN)\ **Replies:** 2\ **Last updated:** [March 13, 2020, 5:01am UTC](https://discuss.elastic.co/t/logstash-sends-to-elasticsearch-cluster-failed/223303 "2020-03-13T05:01:10Z")
I have configured logstash output with three elasticsearch nodes which is in a cluster as below elasticsearch { hosts =\> \["http://ip1:9200","http://ip2:9200","http://ip3:9200"\] do… --- ## [Parsing Problem \\""](https://discuss.elastic.co/t/parsing-problem/223445)
**Author:** [@pariksh](https://discuss.elastic.co/u/pariksh)\ **Replies:** 0\ **Last updated:** [March 13, 2020, 4:33am UTC](https://discuss.elastic.co/t/parsing-problem/223445 "2020-03-13T04:33:02Z")
The output of key\_pairs look like "key\_pairs" =\> "\\"lastName\\":\\"\\",\\"address\\":null,\\"relativeIds\\":\\"135,\\",\\"gender\\":\\"Male\\",\\"city\\":433,\\"userId\\":4265,\\"firstName\\":\\"Shiv\\",\\"mrTrendingTags\\":\\"#निरोगी जिवन\\\\t… --- ## [Pipelines + Redis = Persistent queue not growing despite Redis buffer full](https://discuss.elastic.co/t/pipelines-redis-persistent-queue-not-growing-despite-redis-buffer-full/223444)
**Author:** [@TomHome](https://discuss.elastic.co/u/TomHome)\ **Replies:** 0\ **Last updated:** [March 13, 2020, 4:20am UTC](https://discuss.elastic.co/t/pipelines-redis-persistent-queue-not-growing-despite-redis-buffer-full/223444 "2020-03-13T04:20:03Z")
Hi, Our workflow is filebeat --\> redis --\> logstash --\> ES Our problem : when there is a big influx of logs from the filebeats it fills up redis but logstash doesn't seem to work harder nor use its persistent queues. O… --- ## [Logstash elasticsearch communication fails in ssl](https://discuss.elastic.co/t/logstash-elasticsearch-communication-fails-in-ssl/223438)
**Author:** [@ajit519](https://discuss.elastic.co/u/ajit519)\ **Replies:** 0\ **Last updated:** [March 13, 2020, 3:15am UTC](https://discuss.elastic.co/t/logstash-elasticsearch-communication-fails-in-ssl/223438 "2020-03-13T03:15:08Z")
Hi all, I am running Elasticsearch(6.8.0) and Logstash(6.8.0) in SSL. I followed the steps as mentioned in docs. instead of generating certificate from elasticsearch utility i generated from openssl, this self signed c… --- ## [Can branch 6 and 7 work somehow?](https://discuss.elastic.co/t/can-branch-6-and-7-work-somehow/223366)
**Author:** [@margus](https://discuss.elastic.co/u/margus)\ **Replies:** 1\ **Last updated:** [March 13, 2020, 2:31am UTC](https://discuss.elastic.co/t/can-branch-6-and-7-work-somehow/223366 "2020-03-13T02:31:18Z")
Hello, I have tried to search for this but em unable to find a correct answer, or not sure how. But can for example ElasticSearch 7 work with Logstash 6 or Fillebeat 6 --- ## [Default UTC timzone of @timestamp writing new data to older monthly index](https://discuss.elastic.co/t/default-utc-timzone-of-timestamp-writing-new-data-to-older-monthly-index/221611)
**Author:** [@fr3eze](https://discuss.elastic.co/u/fr3eze)\ **Replies:** 7\ **Last updated:** [March 13, 2020, 1:38am UTC](https://discuss.elastic.co/t/default-utc-timzone-of-timestamp-writing-new-data-to-older-monthly-index/221611 "2020-03-13T01:38:59Z")
I have a logstash configuration parsing a set of files (which are being updated daily) and overwriting same "iccid" on the monthly index. The expected behaviour from Kibana perspective, is to see a latest output every ti… --- ## [Help required with logstash filter](https://discuss.elastic.co/t/help-required-with-logstash-filter/223395)
**Author:** [@argupta23](https://discuss.elastic.co/u/argupta23)\ **Replies:** 0\ **Last updated:** [March 12, 2020, 6:46pm UTC](https://discuss.elastic.co/t/help-required-with-logstash-filter/223395 "2020-03-12T18:46:04Z")
Deleted by --- ## [Pipeline terminated {"pipeline.id"=\>".monitoring-logstash"} after processing existing docs in the index](https://discuss.elastic.co/t/pipeline-terminated-pipeline-id-monitoring-logstash-after-processing-existing-docs-in-the-index/223401)
**Author:** [@Ilya\_Libin](https://discuss.elastic.co/u/Ilya_Libin)\ **Replies:** 0\ **Last updated:** [March 12, 2020, 7:25pm UTC](https://discuss.elastic.co/t/pipeline-terminated-pipeline-id-monitoring-logstash-after-processing-existing-docs-in-the-index/223401 "2020-03-12T19:25:44Z")
Hi! I'm running Elasticsearch and Logstash locally, trying to set up a pipeline that will process all ongoing events from Elasticsearch and write it to stdout (for POC). However after the dockerized logstash is up it tak… --- ## [Breakdown xml to nested object](https://discuss.elastic.co/t/breakdown-xml-to-nested-object/223379)
**Author:** [@crab86](https://discuss.elastic.co/u/crab86)\ **Replies:** 0\ **Last updated:** [March 12, 2020, 4:23pm UTC](https://discuss.elastic.co/t/breakdown-xml-to-nested-object/223379 "2020-03-12T16:23:32Z")
Hi, i am trying to break down PubMed Articles with Logstash, but i am not able to think of any filter suitable to break down the following xml structure. (Please also note that within the abstracttext xml element there … --- ## [Logstash json filter not sending to root of event](https://discuss.elastic.co/t/logstash-json-filter-not-sending-to-root-of-event/223332)
**Author:** [@Axl](https://discuss.elastic.co/u/Axl)\ **Replies:** 2\ **Last updated:** [March 12, 2020, 4:03pm UTC](https://discuss.elastic.co/t/logstash-json-filter-not-sending-to-root-of-event/223332 "2020-03-12T16:03:03Z")
I see that my event has a field "message", and that field is a JSON object, with several values, e.g message: {"eventid":"cowrie.login.failed","username":"uno85",...}. I would like all subvalues of message to be put at … --- ## [Custom Grok Patterns in Docker Logstash](https://discuss.elastic.co/t/custom-grok-patterns-in-docker-logstash/223340)
**Author:** [@kevin5617](https://discuss.elastic.co/u/kevin5617)\ **Replies:** 1\ **Last updated:** [March 12, 2020, 3:59pm UTC](https://discuss.elastic.co/t/custom-grok-patterns-in-docker-logstash/223340 "2020-03-12T15:59:55Z")
I'm using Logstash as a Docker container, and I know I can add a line like the following inside a grok block patterns\_dir =\> \["/opt/logstash/patterns", "/opt/logstash/extra\_patterns"\] However, since I am using this as … --- ## [Convert date to string](https://discuss.elastic.co/t/convert-date-to-string/223232)
**Author:** [@hyhong](https://discuss.elastic.co/u/hyhong)\ **Replies:** 2\ **Last updated:** [March 12, 2020, 3:20pm UTC](https://discuss.elastic.co/t/convert-date-to-string/223232 "2020-03-12T15:20:23Z")
Logstah version:7.4.0 When I used the follow command,it doesn't word: mutate{ convert =\> { "depDate"=\>"string" } } The depDate formate is '2020-03-12' or '-' or '2020-03-12/2020-03-18' --- ## [Grock inception](https://discuss.elastic.co/t/grock-inception/223359)
**Author:** [@Incauto](https://discuss.elastic.co/u/Incauto)\ **Replies:** 3\ **Last updated:** [March 12, 2020, 3:06pm UTC](https://discuss.elastic.co/t/grock-inception/223359 "2020-03-12T15:06:37Z")
Hi, it is posible to do a grok inside a groked field? This is mi log line: monitor:Something\_otherthing\_anotherthing the main grok grok { match =\> {"message" =\> "monitor:%{DATA:monitor}"} } result: Somethin… --- ## [Convert Hexadecimal value to ASCII](https://discuss.elastic.co/t/convert-hexadecimal-value-to-ascii/222408)
**Author:** [@ankitsynX](https://discuss.elastic.co/u/ankitsynX)\ **Replies:** 3\ **Last updated:** [March 12, 2020, 2:59pm UTC](https://discuss.elastic.co/t/convert-hexadecimal-value-to-ascii/222408 "2020-03-12T14:59:15Z")
Hi, I am trying to parse some events from Auditd, the values have been extracted but the commands executed are coming in hexadecimal format. Can anyone help how to convert it to ASCII in a logstash pipeline using mutat… --- ## [BACnet connector](https://discuss.elastic.co/t/bacnet-connector/223333)
**Author:** [@zdenek](https://discuss.elastic.co/u/zdenek)\ **Replies:** 0\ **Last updated:** [March 12, 2020, 1:05pm UTC](https://discuss.elastic.co/t/bacnet-connector/223333 "2020-03-12T13:05:11Z")
is possible connect to BACnet? - PLC network protocol. --- ## [Log stash not passing log fields](https://discuss.elastic.co/t/log-stash-not-passing-log-fields/223322)
**Author:** [@Seetharaman\_K](https://discuss.elastic.co/u/Seetharaman_K)\ **Replies:** 0\ **Last updated:** [March 12, 2020, 12:11pm UTC](https://discuss.elastic.co/t/log-stash-not-passing-log-fields/223322 "2020-03-12T12:11:24Z")
Hi All , Logstash Log , unable to understand what is the problem in pasing my log artifact. above is the error in logstash logs. can some one help me in analyzing the log please ? My logstash config file : log stash … --- ## [Change field type of index-pattern from date to number](https://discuss.elastic.co/t/change-field-type-of-index-pattern-from-date-to-number/223311)
**Author:** [@Mattness](https://discuss.elastic.co/u/Mattness)\ **Replies:** 0\ **Last updated:** [March 12, 2020, 10:33am UTC](https://discuss.elastic.co/t/change-field-type-of-index-pattern-from-date-to-number/223311 "2020-03-12T10:33:53Z")
Hello, I connected Logstash to my db and it indexes certain number fields that describe a duration as dates. I tried to just add another field-type in the created pattern with this API-call: PUT /myindex-2020.03.10/\_m… --- ## [Writing multiple grok filters](https://discuss.elastic.co/t/writing-multiple-grok-filters/223095)
**Author:** [@Hari\_Krishna](https://discuss.elastic.co/u/Hari_Krishna)\ **Replies:** 4\ **Last updated:** [March 12, 2020, 10:54am UTC](https://discuss.elastic.co/t/writing-multiple-grok-filters/223095 "2020-03-12T10:54:37Z")
This is how my log looks like: 2020-03-06 09:41:13.756480168 re0:ndp:18310 NDP\_TP\_NDP\_MSG Function = "NdpIRBNhMapHandler", message = "NdpIRBNhMapHandler Entered" 2020-03-06 09:41:13.756485401 re0:ndp:18310 lltp\_debug … --- ## [Convert epoch time to date](https://discuss.elastic.co/t/convert-epoch-time-to-date/223153)
**Author:** [@mehulshah](https://discuss.elastic.co/u/mehulshah)\ **Replies:** 2\ **Last updated:** [March 12, 2020, 10:32am UTC](https://discuss.elastic.co/t/convert-epoch-time-to-date/223153 "2020-03-12T10:32:14Z")
\[Edited\] I am using Logstash 7.x version I have log like below where scheduledTime is in epoch long number, {"scheduledTime":1580634058274,"processTime":1580634073293,"mailingType":1,"userId":123} I want it to be inde… --- ## [\_jsonparsefailure with grok in Logstash](https://discuss.elastic.co/t/jsonparsefailure-with-grok-in-logstash/223283)
**Author:** [@michielM](https://discuss.elastic.co/u/michielM)\ **Replies:** 2\ **Last updated:** [March 12, 2020, 9:24am UTC](https://discuss.elastic.co/t/jsonparsefailure-with-grok-in-logstash/223283 "2020-03-12T09:24:30Z")
Hi, I'm configuring a filter for my log and I am getting a \_jsonparsefailure in my tag, and I have no idea what's causing this. This is the filter I'm using. filter { if "atlassian-jira-perf" in \[tags\] { gro… --- ## [Actual Timestamp should be filtered from message context](https://discuss.elastic.co/t/actual-timestamp-should-be-filtered-from-message-context/223258)
**Author:** [@lohit18](https://discuss.elastic.co/u/lohit18)\ **Replies:** 8\ **Last updated:** [March 12, 2020, 8:33am UTC](https://discuss.elastic.co/t/actual-timestamp-should-be-filtered-from-message-context/223258 "2020-03-12T08:33:31Z")
Dear Team, Kindly help me with this how to do { "\_index": "env-2020.03.09", "\_type": "\_doc", "\_id": "dsfhdsj2e630", "\_version": 1, "\_score": null, "\_source": { "type": "Monitor Logs", "host": "efjf4323", "mess… --- ## [Logstash....... Error: Could not find or load main class SEARCH](https://discuss.elastic.co/t/logstash-error-could-not-find-or-load-main-class-search/223264)
**Author:** [@usman\_malik](https://discuss.elastic.co/u/usman_malik)\ **Replies:** 1\ **Last updated:** [March 12, 2020, 7:25am UTC](https://discuss.elastic.co/t/logstash-error-could-not-find-or-load-main-class-search/223264 "2020-03-12T07:25:44Z")
Here i'm facing this error when i'm running my logstash.conf file here is my logstash.conf file: --- ## [Problem with docker-compose and logstash](https://discuss.elastic.co/t/problem-with-docker-compose-and-logstash/222419)
**Author:** [@alxfernando](https://discuss.elastic.co/u/alxfernando)\ **Replies:** 8\ **Last updated:** [March 12, 2020, 7:07am UTC](https://discuss.elastic.co/t/problem-with-docker-compose-and-logstash/222419 "2020-03-12T07:07:10Z")
This error appears when I run a docker-compose with elasticsearch, kibana and logstash... I don't understand how to solve it logstash | \[2020-03-06T07:57:58,574\]\[ERROR\]\[logstash.agent \] Failed to execu… --- ## [ES Lookups](https://discuss.elastic.co/t/es-lookups/220276)
**Author:** [@joaociocca](https://discuss.elastic.co/u/joaociocca)\ **Replies:** 7\ **Last updated:** [March 11, 2020, 11:14pm UTC](https://discuss.elastic.co/t/es-lookups/220276 "2020-03-11T23:14:29Z")
So, I'm back dealing with RRAS logs on Logstash/Elasticsearch, and seems I'm in a pickle. I'm using filter { elasticsearch, and debug shows it's working fine: \[2020-02-20T20:36:56,495\]\[DEBUG\]\[logstash.pipeline \]… --- ## [Logstash pipeline tester UI tool - Feedback appreciated](https://discuss.elastic.co/t/logstash-pipeline-tester-ui-tool-feedback-appreciated/223219)
**Author:** [@epacke](https://discuss.elastic.co/u/epacke)\ **Replies:** 0\ **Last updated:** [March 11, 2020, 8:47pm UTC](https://discuss.elastic.co/t/logstash-pipeline-tester-ui-tool-feedback-appreciated/223219 "2020-03-11T20:47:27Z")
Hi there! I've made a pipeline testing tool using NodeJs, Logstash and docker-compose for my colleagues that is not so well versed in Linux but ended up using it myself out of convenience. Basically it launches a Web-U… --- ## [\[logstash.filters.grok\] Running grok filter missing in logs to apply grok filter](https://discuss.elastic.co/t/logstash-filters-grok-running-grok-filter-missing-in-logs-to-apply-grok-filter/223218)
**Author:** [@Mehak\_Bhargava](https://discuss.elastic.co/u/Mehak_Bhargava)\ **Replies:** 0\ **Last updated:** [March 11, 2020, 8:45pm UTC](https://discuss.elastic.co/t/logstash-filters-grok-running-grok-filter-missing-in-logs-to-apply-grok-filter/223218 "2020-03-11T20:45:15Z")
I can see that my grok filter for one file isnt working as the debugged log shows below. How can I fix to apply the logstash.filters.grok in below non-grok filter working file\> \[2020-03-11T13:36:16,801\]\[DEBUG\]\[org.logst… --- ## [IP compare](https://discuss.elastic.co/t/ip-compare/223212)
**Author:** [@Bradendurg](https://discuss.elastic.co/u/Bradendurg)\ **Replies:** 0\ **Last updated:** [March 11, 2020, 8:14pm UTC](https://discuss.elastic.co/t/ip-compare/223212 "2020-03-11T20:14:34Z")
Hi everyone! I have a big array of input in logstash IP addresses, then it saves in elastic,so I want to compare that IP adresses with big array of IP addresses from MSSQL. Pair from-to contains in single massege. It doe… [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=389) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=391)